atris 3.58.7 → 3.59.0

package/atris/skills/engines/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: engines
 description: "Dispatch work to an installed terminal agent or named Atris engine profile. Supports Atris Fast, Claude, Codex, Cursor, Fable, Composer, Haiku, Devin, Grok, Antigravity (agy), and opencode. Triggers on: use codex, use cursor, use devin, use grok, use agy, use antigravity, use gemini, gemini session, use fable, use claude, use opencode, use atris, engine, dispatch to, worker agent, second opinion build."
-version: 1.5.2
+version: 1.7.0
 tags:
   - engines
   - claude
@@ -20,10 +20,36 @@ tags:
   - orchestration
 ---
 
-# Engines — interchangeable terminal workers
+# Engines: interchangeable terminal workers
 
 One contract, eleven live profiles. The orchestrator writes a bounded task prompt, dispatches it to an engine, then **independently verifies, lands, and pushes** the result. Engines never self-certify.
 
+## Pick the job owner first
+
+Before choosing an engine for search, build, or review, run `atris engine roster` and use that job's lead worker. Only deviate when the user names an engine.
+
+The roster is a markdown file the owner can edit any time: `atris/ROSTER.md` for this project, `~/.atris/ROSTER.md` for every project on this machine. A project job wins over the machine job with the same name. Each `## job` heading lists its workers in order, one per line, naming the tool and the model:
+
+```
+## review
+- codex, model: gpt-6-astra, effort: medium, max: 20 min
+- claude code, model: opus 5.5
+
+## small build
+- devin, model: swe-2-max, until 2026-10-24
+- grok, model: grok 4.7 fast
+```
+
+The first worker that is ready and not expired leads; the rest are its backups, in order. Tools take engine ids or `claude code`, `atris fast`, and `gemini`. The older one-line shape (`build: claude opus 5.5, backup codex`) still reads the same, and the first `atris engine assign` rewrites the file into sections. `assign <job> <tool>` sets the lead and keeps the rest; `--add` puts a worker at the end, `--remove <tool>` drops one, `--clear` drops the job, and `--everywhere` writes the machine file. `atris engine roster --available` lists the tools and models on this machine.
+
+A job's list is also its team. When a task splits into parallel parts, give the parts to that job's workers in order, first worker first, instead of piling them all on the lead. Heavy models like astra and fable should only judge: have the search lead write them a trimmed brief first.
+
+Changes for one shell only go in a session file above both rosters. Set `ATRIS_ROSTER_SESSION=<name>` (agent shells have no terminal, so they must), then `atris engine assign <job> <tool> --session`. A session job replaces that job's whole list for this shell; `atris engine roster session` shows the changes and `atris engine roster session clear` drops them. A session nobody used for a day is dropped on its own.
+
+Jobs are open-ended: besides search, build, and review, the owner can add a job like `## small build`, or `## quick fixes (like build)` when the name does not say its kind. For a small, tightly specified build slice, use the small build lead when `atris engine roster` shows one; bigger builds use build.
+
+Team members pick automatically. Navigators, researchers, and scouts do search; validators, reviewers, judges, critics, and verifiers do review; everyone else builds. A line under `## team` overrides that, with a job (`- researcher: search`) or a tool and model (`- judge: claude code, model: opus 5.5`). `member run`, missions with an owner, and autopilot's plan, do, and review use the member's pick; `--engine` still wins. `atris engine roster` lists the team and warns about any line it could not use.
+
 ## three verbs
 
 - ask: `atris engine <name> "<question>"`; pin a model with `atris engine <name> --model <model> "<question>"`
@@ -59,54 +85,47 @@ substitute raw Claude or another engine and call the result FABLE.
 
 Raw spawns are not the default because they skip Atris receipts, watch, and coaching.
 
-| Engine | Command | Notes |
-|--------|---------|-------|
-| Atris Fast | `atris chat --print "<prompt>"` (equivalently `ax --fast --print`) | Local tool runtime over the api.atris.ai fast lane. Best for bounded lookups and small verified edits. |
-| Claude | `claude -p "<prompt>"` | Uses the local Claude configuration. Add `--model opus` for maximum-depth review or `--model sonnet` for speed. |
-| Codex | `codex exec --dangerously-bypass-approvals-and-sandbox -o <result-file> "<prompt>"` (run from the target repo/worktree; read-only research: `--sandbox read-only`) | Headless, exits when done — run it as a tracked background Bash task like the other engines and completion auto-wakes the session. Final answer lands in the `-o` file. Verified live 2026-08-11. Outside a git repo add `--skip-git-repo-check` or it exits 1. ONE-SHOT SESSIONS (`claude -p` workers): run codex in the FOREGROUND and wait — a one-shot session never wakes again, so backgrounding strands the result (observed 2026-08-11). The old plugin path (`codex-companion.mjs task --background`) is deprecated for dispatch: its job store never notifies the session (a finished result sat unread overnight, 2026-08-10) |
-| Cursor | `cursor-agent --trust -p "<prompt>"` (run from the target repo) | Headless print mode; `--trust` required for non-interactive |
-| Fable | `atris engine fable "<question>"` | Canonical read-only FABLE ask with guards, live log, receipt, and health tracking. Scale `--timeout` to the work when needed. |
-| Composer | `atris run "<objective>" --engine composer` | Fast navigator/executor profile routed through the installed `ax` binary. |
-| Haiku | `claude -p "<prompt>" --model claude-haiku-4-5` | Fast validation and bounded read-only checks. |
-| Devin | `devin -p --permission-mode dangerous -- "<prompt>"` (run from the target repo) | Default permission mode is read-only for writes — build work NEEDS `--permission-mode dangerous`, so only run it in an isolated worktree. Also `devin cloud` for sessions that outlive this machine. Supports `--model swe-2-max`; `devin models list` verifies availability and price. |
-| Grok | `grok --always-approve -p "<prompt>"` (run from the target repo) | Headless single-turn via `-p`; default model grok-4.6. Very fast on lookups (~5-10s, reads MAP first). Great for quick second opinions; use `--best-of-n <N>` for tricky bounded builds. Uses grok.com login |
-| Antigravity | `agy --mode accept-edits --add-dir "$PWD" -p "<prompt>"` (run from the target repo) | `agy` executor profile; also answers to "gemini". **`--add-dir` is mandatory for writes** — without it agy edits its own scratch folder (`~/.gemini/antigravity-cli/scratch/`) and the project never changes, which looks like a silent failure (verified live 2026-08-28). Use `--mode plan --sandbox` for read-only review, `--model <id>` to pin a model, and `--dangerously-skip-permissions` if a build still stalls on an approval prompt. |
-| opencode | `opencode run "<prompt>"` (read-only ask: `opencode run --agent plan "<prompt>"`) | Headless print mode; exits when done. Pin a model with `-m provider/model`. Build work needs `--auto` to auto-approve permissions (dangerous: run in an isolated worktree). Verified live 2026-08-21, ~7s per plan-mode lookup. |
+Smoke: `reply with the word OK`, run from `$HOME`, 120s cap, one at a time on a loaded Mac (2026-09-23). Seconds are wall time under that load.
+
+| Engine | Exact command | Pinned model | Verified | Seconds | Notes |
+|--------|---------------|--------------|----------|--------:|-------|
+| Atris Fast | `atris chat --print "<prompt>"` | `atris:fast` | 2026-09-23 | 3.2 | Needs an initialized `atris/` workspace; see runtime requirements below. |
+| Claude | `claude -p "<prompt>" --model claude-opus-5-5 --output-format json --no-session-persistence` | `claude-opus-5-5` | 2026-09-23 | 20.3 | `--model opus` also resolves to `claude-opus-5-5` today; pin the id for reproducibility. |
+| Codex | `codex exec --dangerously-bypass-approvals-and-sandbox --ephemeral -m gpt-6-sol -c model_reasoning_effort=high -o <result-file> "<prompt>" </dev/null` (run from the target repo/worktree; read-only: swap the bypass flag for `--sandbox read-only`) | `gpt-6-sol`, high | 2026-09-23 | 13.8 | Keep the `</dev/null`: with stdin open codex prints "Reading additional input from stdin..." and waits forever (observed 2026-09-23). Outside a git repo add `--skip-git-repo-check` or it exits 1 (re-checked 2026-09-23). Final answer lands in the `-o` file. Run as a tracked background Bash task; in one-shot `claude -p` workers run it in the FOREGROUND, a one-shot session never wakes again (2026-08-11). `codex-companion.mjs task --background` is deprecated: its job store never notifies the session (2026-08-10). |
+| Cursor | `cursor-agent --trust --model composer-2.5 -p "<prompt>"` (run from the target repo) | `composer-2.5` | 2026-09-23 | 37.5 | `--trust` required for non-interactive. |
+| Fable | `atris engine fable --timeout 120 --json "<question>"` | `claude-fable-5` | 2026-09-23 | 21.4 | Canonical read-only FABLE ask with receipt; scale `--timeout` to the work. |
+| Composer | `cursor-agent --trust --model composer-2.5 -p "<prompt>"` | `composer-2.5` via Cursor | 2026-09-23 | 37.5 | Same binary as Cursor. |
+| Haiku | `claude -p "<prompt>" --model claude-haiku-4-5 --output-format json --no-session-persistence` | `claude-haiku-4-5` | 2026-09-23 | 19.0 | Fast validation and bounded read-only checks. |
+| Devin (build) | `devin -p --permission-mode dangerous --model swe-2-max --prompt-file <brief>` (run from an isolated worktree) | `swe-2-max` (Free tag in `devin models list`, 2026-09-23) | 2026-09-23 | 14.0 | In `-p` mode the default permission mode rejects shell commands too, so even a read-only audit dies after one step (2026-09-23). Keep the brief outside the worktree. Long runs (5+ min) can print nothing even on success: judge by the worktree diff. `devin cloud` outlives this machine. |
+| Devin (search) | `devin -p --permission-mode dangerous --model swe-1.7-lightning -- "<prompt>"` | `swe-1.7-lightning` (paid, no Free tag on 2026-09-23) | 2026-09-23 | 13.9 | |
+| Grok | `grok --always-approve --model grok-4.7 -p "<prompt>"` (run from the target repo) | `grok-4.7` | 2026-09-23 | 11.7 | Unpinned default is now `grok-4.7-build-fast`; `grok models` lists the menu. Uses grok.com login. `--best-of-n <N>` for tricky bounded builds. |
+| Antigravity (agy) | `agy --mode accept-edits --add-dir "$PWD" --model gemini-3.8-flash-high --output-format json -p "<prompt>"` (run from the target repo) | `gemini-3.8-flash-high` | 2026-09-23 | 15.9 | **`--add-dir` is mandatory for writes**: without it agy edits `~/.gemini/antigravity-cli/scratch/` and the project never changes (2026-08-28). `--mode plan --sandbox` for read-only review. Also answers to "gemini". |
+| opencode | `opencode run -m opencode/muse-spark-1.3-contributor-free "<prompt>"` (read-only: add `--agent plan`) | `opencode/muse-spark-1.3-contributor-free` | 2026-09-23 | 41.1 | Build work needs `--auto` (isolated worktree only). `opencode models` lists the live menu. |
 
 Headless dispatch permissions (verified 2026-08-11): `codex exec`, `grok`, and `cursor-agent` are allowlisted in `~/.claude/settings.json` so fresh and one-shot sessions can dispatch without a human approval click. A cold session that gets "requires approval" on an engine command means that allowlist regressed.
 
 ## Picking an engine
 
-- **Atris Fast** — cheap bounded lookups, single-file facts, small verified edits, and high-volume fan-out.
-- **FABLE** — strongest judgment lane. Use the canonical Atris profile for deep review, synthesis, validation, and complex builds.
-- **Claude** — direct Claude profile when the operator names Claude rather than FABLE.
-- **Codex** — deep root-cause work, long autonomous builds, second-opinion diagnosis. Slowest; runs sandboxed.
-- **Cursor** — fast bounded edits and refactors in a single repo.
-- **Composer / Haiku** — fast, bounded navigation, edits, and validation where a max-tier model would be wasteful.
-- **Devin** — multi-step feature work; use `cloud` when the run should survive laptop sleep.
-- **Grok** - fastest frontier lookups and quick second opinions (grok-4.6, ~5-10s; reads MAP first); use `--best-of-n` for tricky bounded builds. Uses grok.com login.
-- **Antigravity / agy** — flexible executor work across Gemini, Claude, and GPT-OSS models; use `agy` as the canonical short name.
-- **opencode** — multi-provider executor in one CLI (Claude, GPT, Gemini, DeepSeek menus via `opencode models`); plan agent for read-only asks, `--auto` builds only inside an isolated worktree.
+- **Cheap bounded errands**: Devin `swe-2-max` while its Free tag holds (check `devin models list`).
+- **Multi-file or long build**: Use the project's build pick. If there is no pick, use the router's choice.
+- **Judgment-heavy build**: Opus 5.5 subagent (Claude row).
+- **Review / deep judgment**: FABLE profile; Codex `gpt-6-sol` or Opus 5.5 as second validator.
+- **Quick fix**: Cursor.
+- **Search / bounded lookup**: Atris Fast; Haiku or Devin `swe-1.7-lightning` for read-only sweeps; Grok for quick second opinions.
+- **agy / opencode**: extra executors when you want a different model family.
 - Parallel builds across repos: one engine job per repo, never two engines writing the same checkout.
 
-## Models worth pinning (verified live 2026-08-15)
-
-Each engine CLI can pin a specific model. Current best picks:
+## Models worth pinning (verified live 2026-09-23)
 
-| Engine | Flag | Best models today |
-|--------|------|-------------------|
-| Claude / Fable | `--model opus` | `opus` currently resolves to Opus 5; use the explicit Opus 4.8 identifier only for reproducibility |
-| Devin | `--model swe-2-max` | `swe-2-max`, `swe-2-high`, `swe-2-medium` verified Free in the live CLI on 2026-09-10. Use Max for Keshav’s team; recheck with `devin models list` before unattended work. |
-| Cursor | `--model cursor-grok-4.6-xhigh` | `cursor-grok-4.6-xhigh` for second-opinion builds, `cursor-grok-4.6-high-fast` for quick pinned asks (answered in ~12s live 2026-08-12), `composer-2.5` for fast edits; parameterized Claude via `'claude-opus-4-8[effort=high]'`; `--list-models` shows the full menu |
-| Composer | `--engine composer` | `composer 2.5` through the Atris profile |
-| Haiku | `--model claude-haiku-4-5` | `haiku` for fast validation |
-| Grok | (default) | `grok-4.6` default (confirmed live 2026-08-12, ~5s lookup), `grok-4.5` still available via `-m` |
-| Codex | `-m <model>` | CLI default rides `~/.codex/config.toml`; pin with `-m` only when the task needs it |
-| Antigravity / agy | `--model <id>` | `gemini-3.7-flash-high` for speed, `gemini-3.1-pro-high` for depth, `claude-sonnet-4-6`, `claude-opus-4-6-thinking`, or `gpt-oss-120b-medium` |
-| opencode | `-m <provider/model>` | `opencode/big-pickle`, `opencode/gpt-5.2`, `opencode/claude-opus-4-8`; `opencode models` lists the live menu |
-| Atris Fast | (fixed) | api.atris.ai fast lane |
+| Engine | Flag | Alternates on the live menu |
+|--------|------|-----------------------------|
+| Claude | `--model <id>` | `claude-opus-5-5`, `claude-haiku-4-5` |
+| Devin | `--model <id>` | `swe-2-max`, `swe-2-high`, `swe-2-medium` (Free); `claude-opus-5-5-high`, `gpt-6-sol` (paid) |
+| Cursor | `--model <id>` | `composer-2.5`, `grok-4.7-xhigh`, `claude-opus-5-thinking-high`; `--list-models` |
+| Grok | `--model <id>` | `grok-4.7`, `grok-4.7-build-fast` (default), `grok-4.6`, `grok-4.5`; `grok models` |
+| Codex | `-m <id>` | `gpt-6-sol` is the `~/.codex/config.toml` default |
 
-Re-verify this table when a lab ships a new model: run each CLI's model-list command, smoke one lookup, and update the row. Free-tier windows (like swe-1.7 now) are the moment to fan out volume work.
+Pins expire 30 days after their verified date. Re-verify on a new model: run the CLI's model list, smoke one prompt, update the row.
 
 ## Keep the local roster current
 
@@ -115,7 +134,7 @@ Run `atris engine doctor`, then `atris engine --help`. The canonical profiles li
 ## Atris Fast runtime requirements (verified live 2026-07-03)
 
 - Must run from an **initialized Atris workspace** (an `atris/` folder) under an allowed workspace root (e.g. `~/arena/*`). `atris chat --print` outside one exits 1 with "Run atris init"; `ax --fast --print` outside an allowed root fail-closes with `{ok:false, error:"workspace_path must be under an allowed local workspace root"}`.
-- In an allowed root **without** an `atris/` folder the turn silently routes to the cloud no-tools chat lane — the model will honestly refuse file work ("no Atris Desktop runtime attached"). If the output says that, you dispatched from the wrong directory; it is not an engine failure.
+- In an allowed root **without** an `atris/` folder the turn silently routes to the cloud no-tools chat lane. The model will honestly refuse file work ("no Atris Desktop runtime attached"). If the output says that, you dispatched from the wrong directory; it is not an engine failure.
 
 ## Prompt contract (every dispatch)
 
@@ -140,16 +159,16 @@ the actual final state: draft, queued, and merged are different outcomes.
 Record elapsed time, engine calls, retries, and exposed token usage. Unknown
 usage stays unknown; one pilot does not establish a speedup or perfect accuracy.
 
-1. Name the absolute repo path and tell the engine to `cd` there (Atris Fast scopes to the cwd it runs from — cd first, and name absolute paths in the prompt).
+1. Name the absolute repo path and tell the engine to `cd` there (Atris Fast scopes to the cwd it runs from, so cd first and name absolute paths in the prompt).
 2. Bound the slice: one task, explicit exit criteria, the verify command to run.
-3. Git rules: `git status` first; stage only own files; never revert others' changes; never destructive git; work on a branch `member/<name>-<slug>` or a worktree. (Atris Fast does not run git — for edit tasks the orchestrator commits after verifying.)
-4. Require a final report: files changed, verify command + result, branch name. (Atris Fast returns one JSON `output` field — ask for file:line evidence in it.)
+3. Git rules: `git status` first; stage only own files; never revert others' changes; never destructive git; work on a branch `member/<name>-<slug>` or a worktree. (Atris Fast does not run git. For edit tasks the orchestrator commits after verifying.)
+4. Require a final report: files changed, verify command + result, branch name. (Atris Fast returns one JSON `output` field. Ask for file:line evidence in it.)
 
-## Landing (orchestrator duties — never skip)
+## Landing (orchestrator duties, never skip)
 
 - **Codex sandbox cannot reach github.com and may get read-only repo access.** Expect temp clones / `git format-patch` fallbacks under `/private/tmp`. Apply patches in a fresh worktree, re-run the verify command yourself, then push.
-- Cursor and Devin run unsandboxed — still re-run the verify command yourself before pushing.
-- Long Devin runs (5+ min) can return empty stdout even when the build fully succeeded — judge by `git status` and the diff in its worktree, never by the printed report.
-- Atris Fast answers are model output over a real tool runtime — treat `output` as a claim, spot-check the cited file:line, and re-run any verifier yourself before acting on it.
+- Cursor and Devin run unsandboxed. Still re-run the verify command yourself before pushing.
+- Long Devin runs (5+ min) can return empty stdout even when the build fully succeeded. Judge by `git status` and the diff in its worktree, never by the printed report.
+- Atris Fast answers are model output over a real tool runtime. Treat `output` as a claim, spot-check the cited file:line, and re-run any verifier yourself before acting on it.
 - Engine task DBs and receipts written inside a sandbox are snapshots; reconcile against the live `atris task` plane after landing.
-- A stalled job (no log output for 30+ min) gets cancelled and taken over; don't wait on it. Atris Fast turns that exceed ~60s have hung — kill and retry once with a tighter prompt.
+- A stalled job (no log output for 30+ min) gets cancelled and taken over; don't wait on it. Atris Fast turns that exceed ~60s have hung. Kill and retry once with a tighter prompt.

package/atris/skills/meta/SKILL.md

@@ -23,7 +23,7 @@ How to be an effective agent. Load this when you need to check yourself.
 
 1. **MAP first** - Read `atris/MAP.md` before any search. It's the index.
 2. **Journal context** - Check today's log for recent work, patterns, blockers.
-3. **LESSONS.md** - What failed before? Don't repeat.
+3. **atris/lessons.md** - What failed before? Don't repeat.
 4. **Skill routing** - Frontend? Load `design`. Backend? Load `backend`. Writing? Load `writing`.
 
 ## Pace control
@@ -48,7 +48,7 @@ Stop and reassess when:
 ## Memory leverage
 
 Before acting:
-1. Check `atris/policies/LESSONS.md` - short lessons from past mistakes
+1. Check `atris/lessons.md` - short lessons from past mistakes
 2. Check `atris/features/` - prior art for similar work
 3. Check journal history - `grep -i "<keyword>" atris/logs/**/*.md`
 
@@ -72,7 +72,7 @@ Act (execute with focus)
     ↓
 Check (output match intent?)
     ↓
-Learn (add to LESSONS if miss)
+Learn (add to lessons.md if miss)
 ```
 
 ## Anti-patterns
@@ -88,7 +88,7 @@ Learn (add to LESSONS if miss)
 ## Skill evolution
 
 Skills improve from your mistakes:
-1. After REVIEW, log learnings to `LESSONS.md` (format: `date | skill | lesson`)
+1. After REVIEW, log learnings to `atris/lessons.md` (one line per lesson)
 2. Repeated lessons (2-3x) get promoted into the relevant skill
 3. Next agent loads the improved skill
 

package/bin/atris.js

@@ -47,7 +47,7 @@ const {
   requireAccountBound,
   refuseAccountGlobal,
 } = require('../lib/account-bound');
-const { isHelpToken, argsWantHelp, hasYesFlag } = require('../lib/noninteractive');
+const { isHelpToken, argsWantHelp, hasYesFlag, envForcesNonInteractive } = require('../lib/noninteractive');
 
 // State detection for smart default
 const { detectWorkspaceState, loadContext } = require('../lib/state-detection');
@@ -577,7 +577,7 @@ function showHelpAll() {
   console.log('  watch      - Turn one sentence into an always-on background watcher');
   console.log('  ctop       - Show a process-first live agent CPU/memory view');
   console.log('  doctor     - Node/task/auth/workspace readiness (--json for agents)');
-  console.log('  doc-health - workspace document size, navigation, and freshness (--json)');
+  console.log('  doc-health - workspace document size, navigation, freshness, and map line refs (--json, --fix-refs)');
   console.log('  launchpad  - Show the next action from local brain, task, mission, and proof state');
   console.log('  brief      - Show the one-glance operator brief');
   console.log('  status     - See local work and completions (`atris status <business>` for remote)');
@@ -1248,6 +1248,7 @@ if (!command || !knownCommands.includes(command)) {
       error: command ? `unknown command: ${command}` : 'unknown command',
       command: command || null,
       input: rawNaturalArgs.join(' '),
+      suggestions: suggestCommands(command),
       usage: 'atris help',
     }, null, 2));
     process.exit(2);
@@ -1299,8 +1300,7 @@ function useInteractiveAtrisUi() {
   return Boolean(
     process.stdin.isTTY
     && process.stdout.isTTY
-    && !process.env.ATRIS_NO_INTERACTIVE
-    && process.env.ATRIS_NONINTERACTIVE !== '1'
+    && !envForcesNonInteractive()
   );
 }
 
@@ -1464,7 +1464,7 @@ async function interactiveEntry(userInput, options = {}) {
     : (context.inProgressFeatures || []).length;
 
   // Pull active missions (durable goals), these outrank dev-pipeline state
-  // because a mission with an unverified verifier is a Keshav-attributable
+  // because a mission with an unverified verifier is an owner commitment
   // commitment that hasn't been closed yet.
   const activeMissions = loadActiveMissions(workspaceDir);
   const liveMissionsCount = activeMissions.length;
@@ -2959,7 +2959,7 @@ if (command === 'guide') {
   const subcommand = process.argv[3];
   const args = process.argv.slice(4);
   Promise.resolve(require('../commands/member').memberCommand(subcommand, ...args))
-    .then(() => process.exit(0))
+    .then(() => process.exit(subcommand === 'run' ? (process.exitCode || 0) : 0))
     .catch((err) => { console.error(`✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'app') {
   const subcommand = process.argv[3];
@@ -3289,6 +3289,8 @@ if (command === 'guide') {
       .then(() => process.exit(0))
       .catch((err) => { console.error(`✗ Error: ${err.message || err}`); process.exit(1); });
   }
+} else if (command === 'host') {
+  require('../commands/host').hostCommand();
 } else if (command === 'social') {
   require('../commands/social').socialCommand()
     .then(() => process.exit(0))

package/commands/aeo.js

@@ -15,32 +15,29 @@
  *   atris aeo discover <source> [...]       # discovery audit
  *   atris aeo audit <source> [...]          # agent-usability audit
  *
- * Local workspace resolution: $ATRIS_AEO_ROOT or legacy $ATRIS_BACKEND_ROOT.
+ * Local workspace resolution: $ATRIS_AEO_ROOT or the configured backend root.
  */
 
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { BACKEND_ROOT_HINT, resolveBackendRoot: resolveConfiguredBackendRoot } = require('../utils/backend-root');
 const { loadCredentials, abortOnAuthFailure } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
 const { loadBusinesses, saveBusinesses } = require('./business');
 
-function resolveBackendRoot() {
-  const candidates = [
-    process.env.ATRIS_AEO_ROOT,
-    process.env.ATRIS_BACKEND_ROOT,
-  ].filter(Boolean);
-  for (const root of candidates) {
-    if (fs.existsSync(path.join(root, 'atris', 'features', 'aeo'))) return root;
-  }
-  return null;
+function resolveAeoRoot() {
+  const explicit = process.env.ATRIS_AEO_ROOT;
+  if (explicit && fs.existsSync(path.join(explicit, 'atris', 'features', 'aeo'))) return explicit;
+  const backend = resolveConfiguredBackendRoot();
+  return backend && fs.existsSync(path.join(backend, 'atris', 'features', 'aeo')) ? backend : null;
 }
 
 function requireBackendRoot() {
-  const root = resolveBackendRoot();
+  const root = resolveAeoRoot();
   if (!root) {
-    console.error('Cannot find local AEO workspace. Set ATRIS_AEO_ROOT to a workspace containing atris/features/aeo.');
+    console.error(`cannot find local aeo workspace; ${BACKEND_ROOT_HINT}`);
     process.exit(1);
   }
   return root;

package/commands/analytics.js

@@ -68,17 +68,14 @@ function analyticsAtris() {
     }
 
     // Parse timestamps for productivity hours. Match the journal heading
-    // format `### Title -- HH:MM` (the dashed form) and the legacy `**HH:MM:SS**` form.
-    const timestampMatches = content.match(/(?:\u2014|--)\s*(\d{2}):\d{2}(?::\d{2})?\b|\*\*(\d{2}):\d{2}(?::\d{2})?\*\*/g);
-    if (timestampMatches) {
-      timestampMatches.forEach(ts => {
-        const m = ts.match(/(\d{2}):/);
-        if (!m) return;
-        const hour = parseInt(m[1], 10);
-        if (Number.isFinite(hour) && hour >= 0 && hour < 24) {
-          hourCounts[hour] = (hourCounts[hour] || 0) + 1;
-        }
-      });
+    // formats `### Title -- HH:MM`, `### Title - HH:MM`, and legacy `**HH:MM:SS**`.
+    // Only heading lines count, so a prose range like "10:00 - 12:30" is not a timestamp.
+    const timestampPattern = /^#{2,4} .*(?:\u2014|--| - )\s*(\d{2}):\d{2}(?::\d{2})?\s*$|\*\*(\d{2}):\d{2}(?::\d{2})?\*\*/gm;
+    for (const match of content.matchAll(timestampPattern)) {
+      const hour = parseInt(match[1] || match[2], 10);
+      if (Number.isFinite(hour) && hour >= 0 && hour < 24) {
+        hourCounts[hour] = (hourCounts[hour] || 0) + 1;
+      }
     }
   });
 

package/commands/autopilot.js

@@ -18,6 +18,7 @@ const {
   runnerAvailabilityFailureMessage,
 } = require('../lib/runner-command');
 const { findStalePages, findStaleTasks, healBrokenMapRefs } = require('./clean');
+const { mapNotesPath } = require('../lib/map-refs');
 const {
   buildScorecardData,
   readScorecards,
@@ -25,14 +26,15 @@ const {
   detectEndgameCompletion
 } = require('../lib/scorecard');
 const { REWARD_CONFIG, REWARD_CHECKSUM } = require('../lib/reward-config');
+const { ownerIdentity } = require('../utils/owner-identity');
 
 const pkg = require('../package.json');
 
 const PHASE_TIMEOUT = 600000; // 10 min per phase
 
 function looksOwnerClaimed(claimed) {
-  const text = String(claimed || '').toLowerCase();
-  return /\bkeshav(?:rao)?\b/.test(text) || /\b(owner|human|operator)\b/.test(text);
+  const text = String(claimed || '').trim().toLowerCase();
+  return /\b(owner|human|operator)\b/.test(text) || ownerIdentity().names.includes(text.split(/\s+/)[0]);
 }
 
 function looksOwnerGatedTitle(title) {
@@ -482,19 +484,73 @@ function execPhaseCommandSync(cmd, opts = {}) {
   }
 }
 
+// plan, do, and review run as the navigator, executor, and validator. When
+// the roster names an engine for that member, the phase spawns it. A runner
+// set in the environment still wins, and with no roster line behind the
+// member the configured runner runs exactly as before.
+const AUTOPILOT_PHASE_MEMBERS = Object.freeze({ plan: 'navigator', do: 'executor', review: 'validator' });
+const RUNNER_ENV_OVERRIDES = Object.freeze([
+  'ATRIS_RUNNER_PROFILE',
+  'ATRIS_RUNNER_COMMAND_TEMPLATE',
+  'ATRIS_RUNNER_BIN',
+  'ATRIS_CLAUDE_COMMAND_TEMPLATE',
+  'ATRIS_CLAUDE_BIN',
+]);
+
+function autopilotPhaseEngine(phase, cwd = process.cwd()) {
+  const member = AUTOPILOT_PHASE_MEMBERS[phase];
+  if (!member) return null;
+  if (RUNNER_ENV_OVERRIDES.some((name) => String(process.env[name] || '').trim())) return null;
+  const { memberRosterEngine } = require('../lib/member-engine');
+  return memberRosterEngine(member, cwd, { requireMember: false });
+}
+
+// The phase's launch command and, when its roster line sets "max 20 min",
+// the time cap in ms (null means the caller's own timeout stands).
+function buildPhaseRunner(phase, promptFile, cwd = process.cwd(), allowedTools = 'Bash,Read,Write,Edit,Glob,Grep') {
+  const picked = autopilotPhaseEngine(phase, cwd);
+  if (!picked) return { command: buildRunnerCommand({ promptFile, allowedTools }), timeoutMs: null };
+  if (process.env.ATRIS_ROUTER_EXPLAIN !== '0') console.error(picked.reason);
+  const previous = process.env.ATRIS_RUNNER_PROFILE;
+  process.env.ATRIS_RUNNER_PROFILE = picked.engine.id;
+  try {
+    const command = buildRunnerCommand({
+      promptFile,
+      allowedTools,
+      ...(picked.model ? { model: picked.model } : {}),
+      ...(picked.engine.roster_effort ? { effort: picked.engine.roster_effort } : {}),
+    });
+    const maxSeconds = Number(picked.engine.roster_max_seconds) || 0;
+    return { command, timeoutMs: maxSeconds > 0 ? maxSeconds * 1000 : null };
+  } finally {
+    if (previous === undefined) delete process.env.ATRIS_RUNNER_PROFILE;
+    else process.env.ATRIS_RUNNER_PROFILE = previous;
+  }
+}
+
+function buildPhaseRunnerCommand(phase, promptFile, cwd = process.cwd()) {
+  return buildPhaseRunner(phase, promptFile, cwd).command;
+}
+
 /**
  * Run a phase via the configured runner subprocess.
  */
 function executePhaseDetailed(phase, context, options = {}) {
-  const { verbose = false, timeout = PHASE_TIMEOUT } = options;
+  const { verbose = false } = options;
+  let timeout = options.timeout || PHASE_TIMEOUT;
 
   const prompt = buildPrompt(phase, context, options);
   const tmpFile = path.join(process.cwd(), '.autopilot-prompt.tmp');
   fs.writeFileSync(tmpFile, prompt);
 
   try {
-    const cmd = options.cmdOverride
-      || buildRunnerCommand({ promptFile: tmpFile, allowedTools: 'Bash,Read,Write,Edit,Glob,Grep' });
+    let cmd = options.cmdOverride;
+    if (!cmd) {
+      const runner = buildPhaseRunner(phase, tmpFile);
+      cmd = runner.command;
+      // A roster time cap stops the phase at that time.
+      if (runner.timeoutMs) timeout = runner.timeoutMs;
+    }
     const env = { ...process.env };
     delete env.CLAUDECODE;
     const output = execPhaseCommandSync(cmd, {
@@ -624,6 +680,8 @@ function getContextFiles(phase, options = {}) {
     agentSpec && fs.existsSync(path.join(cwd, agentSpec)) ? agentSpec : null,
     'atris/PERSONA.md',
     'atris/MAP.md',
+    // Exact file:line refs live beside the short routing map.
+    mapNotesPath(cwd),
     'atris/TODO.md',
     fs.existsSync(path.join(cwd, 'atris/lessons.md')) ? 'atris/lessons.md' : null,
     (() => { const { logFile } = getLogPath(); return fs.existsSync(logFile) ? path.relative(cwd, logFile) : null; })(),
@@ -640,7 +698,7 @@ function getContextFiles(phase, options = {}) {
 // checkout is forbidden (COORDINATION.md Rule 4). Interpolated into the
 // default and self-heal do prompts, never the benchmark prompt (it never
 // commits).
-const SHARED_CHECKOUT_GIT_CONTRACT = `- Shared-checkout git safety (COORDINATION.md Rule 4): edits to any repo OTHER than this tick's cwd (../atrisos-backend-style sibling repos) go through a per-tick worktree, start with \`atris worktree start --member <member> --task "<task>"\`, land with \`atris worktree ship --message "<msg>" --verify "<cmd>"\`. Never edit a sibling repo's shared checkout directly.
+const SHARED_CHECKOUT_GIT_CONTRACT = `- Shared-checkout git safety (COORDINATION.md Rule 4): edits to any repo OTHER than this tick's cwd (including sibling repos) go through a per-tick worktree, start with \`atris worktree start --member <member> --task "<task>"\`, land with \`atris worktree ship --message "<msg>" --verify "<cmd>"\`. Never edit a sibling repo's shared checkout directly.
 - On a shared checkout, \`git reset\`, \`git checkout --\`, \`git clean\`, and stashing other agents' work are FORBIDDEN, concurrent ticks' uncommitted work lives there.`;
 
 /**
@@ -1356,15 +1414,25 @@ function parseProposedBlock(lines) {
   return Object.keys(proposed).length ? proposed : null;
 }
 
+// Plan review is review work, so it runs on the review pick like the review
+// phase, with that line's model, effort, and time cap. With no roster line
+// behind it, the configured runner runs exactly as before.
+function buildPlanReviewRunner(promptFile, cwd = process.cwd(), timeout = 180000) {
+  const runner = buildPhaseRunner('review', promptFile, cwd, 'Bash,Read,Grep,Glob');
+  return { command: runner.command, timeoutMs: runner.timeoutMs || timeout };
+}
+
 /**
- * Default executor for plan-review: spawn a fresh configured runner call.
+ * Default executor for plan-review: spawn a fresh runner call on the review pick.
  * Kept thin so tests can inject a stub via options.planReviewExec.
  */
 function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
   const tmpFile = path.join(cwd, '.autopilot-plan-review.tmp');
   fs.writeFileSync(tmpFile, prompt);
   try {
-    const cmd = buildRunnerCommand({ promptFile: tmpFile, allowedTools: 'Bash,Read,Grep,Glob' });
+    const runner = buildPlanReviewRunner(tmpFile, cwd, timeout);
+    const cmd = runner.command;
+    timeout = runner.timeoutMs;
     const env = { ...process.env };
     delete env.CLAUDECODE;
     const output = execPhaseCommandSync(cmd, {
@@ -3871,6 +3939,9 @@ module.exports = {
   isPhaseKillError,
   execPhaseCommandSync,
   executePhaseDetailed,
+  buildPhaseRunnerCommand,
+  buildPhaseRunner,
+  buildPlanReviewRunner,
   buildAutopilotGlassLog,
   writeAutopilotGlassLog,
   lessonSlug

package/commands/avail.js

@@ -308,7 +308,7 @@ async function slotsAvail(argv) {
   if (!username) {
     const identity = await apiRequestJson('/identity/me', { method: 'GET', token });
     if (!identity.ok || !identity.data?.username) {
-      console.error('Could not resolve username, pass --user keshav');
+      console.error('could not resolve username; pass --user <username>.');
       return 1;
     }
     username = identity.data.username;

package/commands/brain.js

@@ -3,6 +3,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { spawnSync } = require('child_process');
 const { refreshNowFile } = require('./now');
+const { ownerIdentity } = require('../utils/owner-identity');
 const escapeRegExp = require('../lib/escape-regexp');
 const { hasRenderedSections, isOpenSection, isDoneSection } = require('../lib/todo-sections');
 const { isNonInteractive } = require('../lib/noninteractive');
@@ -794,7 +795,8 @@ function memberNextMove(member, state = null) {
   if (member.slug === 'justin' || /justin/i.test(member.name || '')) {
     return `${name}: run one customer-moving GTM rep, update the relevant workspace state within 10 minutes, and leave a scorecard.`;
   }
-  if (member.slug === 'keshav' || /keshav/i.test(member.name || '')) {
+  const ownerNames = ownerIdentity().names;
+  if (ownerNames.includes(String(member.slug || '').toLowerCase()) || ownerNames.includes(String(member.name || '').toLowerCase())) {
     return `${name}: act as Customer 0: choose one allocation, narrative, system, or talent leverage move; leave proof and route the next owner.`;
   }
   if (/opus|overnight/i.test(identity)) {