atris 3.61.0 → 3.63.0

package/README.md

@@ -24,7 +24,7 @@ atris init && atris
 
 ## For Coding Agents
 
-**Read [`FOR_AGENTS.md`](FOR_AGENTS.md) first** — why agents adopt Atris, 60-second start, spread-it instructions.
+**Read [`FOR_AGENTS.md`](FOR_AGENTS.md) first**: why agents adopt Atris, 60-second start, spread-it instructions.
 
 If you're an agent, run:
 
@@ -110,6 +110,17 @@ atris site publish dist --slug my-site --spa
 atris site publish . --slug my-next-app --profile app --build   # Next.js static export
 ```
 
+### Bring people together with the Host
+
+The Host is a team member that gets to know everyone in a room (a company, a club, your own network) through one fun question at a time, keeps a card for each person, and introduces two people only when both say yes. Then it offers to find a time and checks that it happened. It never reads anyone's messages and keeps no scores.
+
+```bash
+atris member install host
+atris host setup --room personal     # your own network: it asks you, and drafts messages for you to send
+atris host import people.jsonl       # bulk add people and who already knows whom
+atris host room                      # the host's weekly read
+```
+
 ## Chat With Atris 2
 
 `ax` is the Atris 2 chat and coding-agent CLI. It uses the hosted Atris cloud by default, streams text, shows tool activity, and keeps fresh installs away from local setup.
@@ -123,7 +134,7 @@ ax --max "reason through this hard decision"
 ax --doctor
 ```
 
-Use Fast for quick chat and low-latency Atris loops. Use Pro for deeper tool loops. Use Max for the hardest jobs — it runs the highest-reasoning model and takes longer per turn. Advanced local workspace mode is opt-in with `--local` plus `AX_BACKEND_URL`.
+Use Fast for quick chat and low-latency Atris loops. Use Pro for deeper tool loops. Use Max for the hardest jobs; it runs the highest-reasoning model and takes longer per turn. Advanced local workspace mode is opt-in with `--local` plus `AX_BACKEND_URL`.
 
 ## Play AgentXP
 
@@ -267,9 +278,30 @@ atris business record atris/reports/2026-04-12-operator-recap.md --outcome mixed
 
 ## Engines
 
-An engine is the intelligence that builds a mission. Every installed headless coding CLI is a swappable worker behind one contract: a bounded prompt goes in, verified proof comes out, and engines never self-certify their own work. The house default is `atris-fast` (`ax`); the roster also covers `claude`, `codex`, `cursor`, and `devin` when their CLIs are installed.
+An engine is the intelligence that builds a mission. Every installed headless coding CLI is a swappable worker behind one contract: a bounded prompt goes in, verified proof comes out, and engines never self-certify their own work. The house default is `atris-fast` (`ax`); `claude`, `codex`, `cursor`, `devin`, `grok`, and others join when their CLIs are installed.
+
+### Who does each job
+
+`ROSTER.md` says which tool and model does each job. Edit it any time; every project, team member, and new chat follows it.
+
+```markdown
+## build
+- claude code, model: opus 5.5
+
+## review
+- codex, model: gpt-6-astra, effort: medium, max: 20 min, prep: search
+- claude code, model: opus 5.5
+```
+
+The first ready worker leads and the rest are backups. `~/.atris/ROSTER.md` covers every project on the machine; `atris/ROSTER.md` overrides it for one project. A worker that stalls sits out 30 minutes and the next one takes over.
+
+```bash
+atris engine roster                                   # who does what, with each worker's recent record
+atris engine assign build claude --model "opus 5.5"   # change a job's lead
+atris engine roster --available                       # tools and models on this machine
+```
 
-Show the roster and the current default:
+Show every installed engine and the current default:
 
 ```bash
 atris engine
@@ -290,7 +322,7 @@ atris mission run "fix the flaky login test" --engine codex
 
 ### Fleet Flight
 
-`atris mission run --fleet` staffs every idle installed engine on the board's claimable safe-lane tasks — one mission per task, one worktree per engine. Builds run in parallel; arrivals land serially with rebase-before-ship, so a rebase conflict pauses that landing (never auto-resolved) and keeps its worktree instead of orphaning work. Each flight writes a receipt to `atris/runs/fleet-<stamp>.json`.
+`atris mission run --fleet` staffs every idle installed engine on the board's claimable safe-lane tasks: one mission per task, one worktree per engine. Builds run in parallel; arrivals land serially with rebase-before-ship, so a rebase conflict pauses that landing (never auto-resolved) and keeps its worktree instead of orphaning work. Each flight writes a receipt to `atris/runs/fleet-<stamp>.json`.
 
 ```bash
 atris mission run --fleet --slots 3          # staff up to 3 engines

package/atris/features/README.md

@@ -86,6 +86,14 @@ None.
 
 ### Completed Features
 
+#### youtube-notes
+Free, fast, checked notes from any YouTube link
+- **Files:** commands/youtube.js, scripts/det/ytnotes, scripts/det/ytquote-repair.js, test/ytnotes.test.js, test/ytquote-repair.test.js, test/youtube.test.js, atris/features/youtube-notes/*
+- **Status:** complete; the `atris youtube bench` scorecard is in review
+- **Keywords:** youtube, notes, captions, transcript, whisper, quotes
+- **What:** `atris youtube notes <url>` reads the real English captions, transcribes on an Apple silicon Mac when there are none, writes with the fastest installed AI, and checks every quote against the transcript
+- **Completed:** 2026-09-28
+
 #### audit-gaps
 Close remaining audit gaps from self-audit
 - **Files:** atris/team/*/MEMBER.md, atris/features/README.md, atris/features/audit-gaps/*

package/atris/skills/README.md

@@ -34,6 +34,7 @@ cp -r atris/skills/[name] ~/.codex/skills/
 | backend | Backend architecture policy | `policies/atris-backend.md` |
 | blocks | Author Atris block documents: docs, decks, reports | - |
 | calendar | Google Calendar via AtrisOS API | - |
+| commerce | Quote a purchase or stock order; the person approves before anything is charged | - |
 | copy-editor | Detects and fixes AI writing patterns | - |
 | create-app | Build and deploy an Atris app from a description | - |
 | create-member | Create and manage MEMBER.md team members | - |

package/atris/skills/commerce/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: commerce
+description: "Buy or trade through Atris for a person: get a quote, show it, the person approves, check status, read their transactions. Use when asked to buy tickets, buy an item from a store, place a stock order, or list what someone bought or traded. Triggers on buy, purchase, order, trade, stock order, transactions, what did I spend."
+version: 1.0.0
+tags:
+  - commerce
+  - money
+---
+
+# Commerce: buy or trade through Atris
+
+You can quote and ask. Only the human can pay. Every dollar leaves only after
+the person acts themselves: a tap in their Link app, a payment page they
+fill in, or a text from their own phone.
+
+## The loop
+
+1. Quote. `atris buy quote --kind <kind> [fields]`.
+2. Show the person the summary, total, fee and approval text. Word for word on money.
+3. Only after they say yes, approve. `atris buy approve <id> [fields]`.
+4. Hand the person the approval link (Link or payment page). For trades, tell them to check their texts: Atris sends the one-time code only to their own text thread, never to you. Nothing else pays.
+5. Check `atris buy status <id>` until the state is `done`, `failed`, `refunded` or `unknown`.
+6. `atris transactions` lists everything they bought, paid in fees, traded or sent.
+
+Add `--json` to any command for the raw response.
+
+## Kinds
+
+| kind | quote flags | approve flags | human approves by |
+|---|---|---|---|
+| `ticket` | `--event-url` (vividseats.com), `--quantity`, `--min-each-usd`, `--max-each-usd` | `--pick` (1-3 or ticket_id), `--delivery-email` | Link app, or payment page |
+| `shop` | `--query` or `--url`, `--quantity` | `--options '<json>'`, `--delivery-email`, `--address '<json>'` (US, once), `--accept-extras` | Link app |
+| `trade` | `--side` buy/sell, `--symbol`, `--quantity` or `--dollars`, `--order-type` market/limit, `--limit-price` | none | replying to Atris's text with the exact phrase from their own phone, within 5 minutes |
+| `flight` | not wired yet, quotes are refused | | |
+
+Any field can also go in as JSON: `--intent '{"kind":"shop","query":"navy tee"}'` for quotes,
+`--details '{"pick":"1"}'` for approve. Flags win over the JSON.
+
+## Rails (enforced in code, not by you)
+
+- Approval is always human. An API key cannot confirm a trade or approve a Link spend.
+- Caps: purchases up to `TEXT_TICKETS_MAX_USD` (default $400) and $500 per Link spend. Stocks: per-order and per-day caps, the Robinhood risk policy, market hours, no shorting, stocks only.
+- Quotes expire: 30 minutes for purchases, 10 for trades. A trade quote stages at most one order. Ask again after that.
+- A trade already waiting for the person's yes blocks a new one. Let them confirm or let it expire.
+- No retries. If a result is `unknown`, money may have moved. Tell the person to check the store or Robinhood app. Never buy again to "fix" it.
+- No advice on trades. Carry out only the person's own instruction.
+- For Link-mode orders, status may carry `fee_payment_url`: the page where the person pays the Atris fee. The CLI prints it as "Pay the Atris fee".
+- Status values from quote and approve: `quoted`, `pending_approval`, `needs_input` (ask the person for the named field), `needs_setup` (send them the connect link), `refused` (read the message to them).
+
+## With the CLI
+
+```bash
+# Tickets
+atris buy quote --kind ticket --event-url "https://www.vividseats.com/..." --quantity 2
+atris buy approve ord_<uuid> --pick 1 --delivery-email sam@example.com
+# -> Approve in Link: https://...   Nothing has been charged yet.
+
+# A store item
+atris buy quote --kind shop --query "uniqlo supima crew tee navy" --quantity 1
+
+# A stock order
+atris buy quote --kind trade --side buy --symbol VTI --dollars 25
+atris buy approve trq_<token>
+# -> We texted you a confirm code. Reply to that text to place the trade.
+
+# Status and history
+atris buy status ord_<uuid>
+atris transactions --since 2026-09-01 --kind ticket,shop,trade --limit 50
+# Quotes nobody approved are left out; add --include-quotes to see them.
+```
+
+## With curl
+
+```bash
+KEY="Authorization: Bearer $ATRIS_API_KEY"
+API=https://api.atris.ai/api
+
+curl -s -X POST $API/commerce/quote -H "$KEY" -H 'content-type: application/json' \
+  -d '{"kind":"ticket","event_url":"https://www.vividseats.com/...","quantity":2}'
+curl -s -X POST $API/commerce/ord_<uuid>/approve -H "$KEY" -H 'content-type: application/json' \
+  -d '{"pick":"1","delivery_email":"sam@example.com"}'
+# -> {"status":"pending_approval","approval":{"how":"link_app","url":"https://..."}}
+
+curl -s -X POST $API/commerce/quote -H "$KEY" -H 'content-type: application/json' \
+  -d '{"kind":"trade","side":"buy","symbol":"VTI","dollars":25}'
+curl -s -X POST $API/commerce/trq_<token>/approve -H "$KEY"
+# -> {"status":"pending_approval","approval":{"how":"text_confirm","text":"Check your texts. ..."}}
+
+curl -s $API/commerce/ord_<uuid> -H "$KEY"
+curl -s "$API/transactions?since=2026-09-01&kinds=ticket,shop,trade&limit=50" -H "$KEY"
+# Quotes nobody approved are left out; add &include_quotes=true to see them.
+```
+
+Each transaction: `id, kind, when, what, amount_cents, currency, state, counterparty, receipt_url`.
+`sources` says which ledgers loaded; if one says `failed`, the list is partial. Say so.
+The CLI prints that as "Partial list: could not load ...".

package/atris/skills/engines/SKILL.md

@@ -26,29 +26,29 @@ One contract, eleven live profiles. The orchestrator writes a bounded task promp
 
 ## Pick the job owner first
 
-Before choosing an engine for search, build, or review, run `atris engine roster` and use that job's lead worker. Only deviate when the user names an engine.
+Before choosing an engine for search, build, review, or any other job, run `atris engine roster` and use that job's lead worker. Only deviate when the user names an engine.
 
-The roster is a markdown file the owner can edit any time: `atris/ROSTER.md` for this project, `~/.atris/ROSTER.md` for every project on this machine. A project job wins over the machine job with the same name. Each `## job` heading lists its workers in order, one per line, naming the tool and the model:
+**The file.** `~/.atris/ROSTER.md` covers every project on the machine; `atris/ROSTER.md` overrides it job by job. Each `## job` lists workers in order, one per line, tool then model:
 
 ```
 ## review
-- codex, model: gpt-6-astra, effort: medium, max: 20 min
+- codex, model: gpt-6-astra, effort: medium, max: 20 min, prep: search
 - claude code, model: opus 5.5
 
 ## small build
-- devin, model: swe-2-max, until 2026-10-24
+- devin, model: swe-2-max, max: 20 min, until 2026-10-24
 - grok, model: grok 4.7 fast
 ```
 
-The first worker that is ready and not expired leads; the rest are its backups, in order. Tools take engine ids or `claude code`, `atris fast`, and `gemini`. The older one-line shape (`build: claude opus 5.5, backup codex`) still reads the same, and the first `atris engine assign` rewrites the file into sections. `assign <job> <tool>` sets the lead and keeps the rest; `--add` puts a worker at the end, `--remove <tool>` drops one, `--clear` drops the job, and `--everywhere` writes the machine file. `atris engine roster --available` lists the tools and models on this machine.
+The first worker that is ready and not expired leads; the rest are backups in order, and the whole list is the job's team for parallel parts. Jobs are open-ended: add `## quick fixes (like build)` when the name does not say its kind. Use the small build lead for small, tightly specified slices.
 
-A job's list is also its team. When a task splits into parallel parts, give the parts to that job's workers in order, first worker first, instead of piling them all on the lead. Heavy models like astra and fable should only judge: have the search lead write them a trimmed brief first.
+**Changing it.** Edit the file, or: `atris engine assign <job> <tool> [--model --effort --max --prep search --days N]` sets the lead and keeps the rest; `--add`, `--remove <tool>`, `--promote <tool>` (move an existing worker to the top, line unchanged), `--clear`; `--everywhere` writes the machine file; `--session` (with `ATRIS_ROSTER_SESSION=<name>`) changes this shell only. `atris engine roster --available` lists installed tools and models.
 
-Changes for one shell only go in a session file above both rosters. Set `ATRIS_ROSTER_SESSION=<name>` (agent shells have no terminal, so they must), then `atris engine assign <job> <tool> --session`. A session job replaces that job's whole list for this shell; `atris engine roster session` shows the changes and `atris engine roster session clear` drops them. A session nobody used for a day is dropped on its own.
+**What happens on its own.** A worker that stalls or loses its connection sits out 30 minutes ("cooling") and the next worker takes the job; a failed task (tests failed) is not handed over and does not bench anyone. Every run is recorded; `atris engine roster --runs` lists them and the roster shows each worker's recent record. When the record says the order is wrong, the roster prints one suggestion with the exact command. It never edits the file: run it only when the owner says so.
 
-Jobs are open-ended: besides search, build, and review, the owner can add a job like `## small build`, or `## quick fixes (like build)` when the name does not say its kind. For a small, tightly specified build slice, use the small build lead when `atris engine roster` shows one; bigger builds use build.
+**Heavy models.** Astra and Fable should judge, not explore. Give their line `prep: search`: the search lead writes a brief of at most 300 lines first, and if prep fails the worker runs as usual.
 
-Team members pick automatically. Navigators, researchers, and scouts do search; validators, reviewers, judges, critics, and verifiers do review; everyone else builds. A line under `## team` overrides that, with a job (`- researcher: search`) or a tool and model (`- judge: claude code, model: opus 5.5`). `member run`, missions with an owner, and autopilot's plan, do, and review use the member's pick; `--engine` still wins. `atris engine roster` lists the team and warns about any line it could not use.
+**Team members.** Navigators, researchers, and scouts do search; validators, reviewers, and judges do review; everyone else builds. A `## team` line overrides: `- researcher: search` or `- judge: claude code, model: opus 5.5`. `member run`, owned missions, and autopilot phases use the member's pick; `--engine` still wins. Parked members are skipped; `atris team park <name>` and `atris team unpark <name>` toggle it.
 
 ## three verbs
 

package/bin/atris.js

@@ -574,6 +574,7 @@ function showHelpAll() {
   console.log('  who        - Show local engines and team members working, waiting, done, or stale');
   console.log('  stream     - Watch the whole team work live in one terminal');
   console.log('  team       - One team view: members, roles, engine assignments (presence for live)');
+  console.log('  host       - The Host: gets to know people, makes two-yes introductions (atris member install host)');
   console.log('  watch      - Turn one sentence into an always-on background watcher');
   console.log('  ctop       - Show a process-first live agent CPU/memory view');
   console.log('  doctor     - Node/task/auth/workspace readiness (--json for agents)');
@@ -716,6 +717,8 @@ function showHelpAll() {
   console.log('  usage      - Show developer API usage');
   console.log('  api-key    - Create, list, rotate, or revoke a developer API key');
   console.log('  topup      - Buy credits and print a Stripe checkout URL');
+  console.log('  buy        - Quote a purchase or stock order; the person approves before anything is charged');
+  console.log('  transactions - List what you bought, paid in fees, traded, or sent');
   console.log('  design     - Extract a site design system, check brand adherence, search brands');
   console.log('  mcp        - Run the atris MCP server (stdio) for Claude Desktop and Cursor');
   console.log('');
@@ -2367,6 +2370,15 @@ if (command === 'guide') {
   Promise.resolve(require('../commands/topup').topupCommand(process.argv.slice(3)))
     .then((code) => process.exit(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
+} else if (command === 'buy') {
+  // Buy: quote, then hand the person the approval step. Never charges.
+  Promise.resolve(require('../commands/buy').buyCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
+} else if (command === 'transactions') {
+  Promise.resolve(require('../commands/transactions').transactionsCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(String(err.message || err).replace(/\s+/g, ' ')); process.exit(1); });
 } else if (command === '_resolve') {
   // Hidden: resolve a profile name query → print exact profile name
   require('../commands/auth').resolveProfile();

package/commands/autoland.js

@@ -130,13 +130,38 @@ function flag(args, name, fallback = '') {
   return args[idx + 1] || fallback;
 }
 
-function runOwnCli(root, cliArgs) {
+function runOwnCli(root, cliArgs, timeoutMs = 300000) {
   // Always spawn the bin this module shipped with. Resolving through the
   // target root or a global `atris` breaks whenever the tick runs a project
   // that isn't the CLI repo on a machine without a global install (CI, cron).
   const bin = path.resolve(__dirname, '..', 'bin', 'atris.js');
-  const result = spawnSync(process.execPath, [bin, ...cliArgs], { cwd: root, encoding: 'utf8', timeout: 300000 });
-  return { status: result.status, stdout: String(result.stdout || ''), stderr: String(result.stderr || '') };
+  const result = spawnSync(process.execPath, [bin, ...cliArgs], { cwd: root, encoding: 'utf8', timeout: timeoutMs });
+  return {
+    status: result.status,
+    stdout: String(result.stdout || ''),
+    stderr: String(result.stderr || ''),
+    error_code: result.error && result.error.code ? result.error.code : null,
+    signal: result.signal || null,
+    timeout_ms: timeoutMs,
+  };
+}
+
+// The accept sweep walks every pending-review row under --all, so a fixed
+// 300s child timeout kills a real backlog mid-accept. Size the window from
+// the queue: roughly 8s a row on top of a 60s floor, never under the old
+// 300s default, capped at 25min.
+function acceptSweepTimeoutMs(pendingRows) {
+  return Math.min(1500000, Math.max(300000, 60000 + pendingRows * 8000));
+}
+
+// A killed child truncates stdout and often leaves stderr empty, so the
+// spawn failure itself is the first thing to name. Without this a timed-out
+// sweep reports "output unreadable" forever.
+function describeAcceptKillCause(accept) {
+  if (accept.error_code === 'ETIMEDOUT') return `auto-accept timed out at ${accept.timeout_ms}ms`;
+  if (accept.error_code) return `auto-accept spawn failed: ${accept.error_code}`;
+  if (accept.signal) return `auto-accept killed by ${accept.signal}`;
+  return null;
 }
 
 function readProjection(root) {
@@ -759,7 +784,11 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
   const cliArgs = ['task', 'auto-accept-certified', '--json', '--certify-first'];
   if (policy.accept_all) cliArgs.push('--all');
   else if (policy.strict_verify === false) cliArgs.push('--no-strict-verify');
-  const accept = runOwnCli(root, cliArgs);
+  const pendingReviewRows = readProjection(root)
+    .filter((task) => task && task.status === 'review')
+    .filter((task) => String(task.review?.approval_status || task.metadata?.approval_status || 'pending') === 'pending')
+    .length;
+  const accept = runOwnCli(root, cliArgs, acceptSweepTimeoutMs(pendingReviewRows));
   try {
     const parsed = JSON.parse(accept.stdout);
     const results = Array.isArray(parsed.results) ? parsed.results : [];
@@ -801,7 +830,7 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
     receipt.skipped = parsed.skipped ?? null;
     receipt.undercounted = Boolean(parsed.undercounted);
   } catch (err) {
-    receipt.accept_error = accept.stderr.slice(0, 200) || 'auto-accept output unreadable';
+    receipt.accept_error = describeAcceptKillCause(accept) || accept.stderr.slice(0, 200) || 'auto-accept output unreadable';
   }
 
   // 2b. tell the operator the moment something lands: one text, one landing
@@ -1108,6 +1137,8 @@ function autolandCommand(args = []) {
 module.exports = {
   autolandCommand,
   digestNextMoves,
+  acceptSweepTimeoutMs,
+  describeAcceptKillCause,
   digestStoryRows,
   digestTickStatus,
   engineAnswerValidationLine,

package/commands/autopilot.js

@@ -31,6 +31,10 @@ const { ownerIdentity } = require('../utils/owner-identity');
 const pkg = require('../package.json');
 
 const PHASE_TIMEOUT = 600000; // 10 min per phase
+// A phase's cap covers its prep pass too: prep's elapsed time comes out of
+// the cap before the phase command starts. The floor keeps a slow prep from
+// leaving the phase no room at all.
+const PHASE_MIN_AFTER_PREP_MS = 30000;
 
 function looksOwnerClaimed(claimed) {
   const text = String(claimed || '').trim().toLowerCase();
@@ -521,7 +525,17 @@ function buildPhaseRunner(phase, promptFile, cwd = process.cwd(), allowedTools =
       ...(picked.engine.roster_effort ? { effort: picked.engine.roster_effort } : {}),
     });
     const maxSeconds = Number(picked.engine.roster_max_seconds) || 0;
-    return { command, timeoutMs: maxSeconds > 0 ? maxSeconds * 1000 : null };
+    return {
+      command,
+      timeoutMs: maxSeconds > 0 ? maxSeconds * 1000 : null,
+      engineId: picked.engine.id,
+      maxSeconds,
+      model: picked.model || '',
+      effort: picked.engine.roster_effort || '',
+      job: picked.job || '',
+      member: AUTOPILOT_PHASE_MEMBERS[phase],
+      prep: picked.engine.roster_prep || '',
+    };
   } finally {
     if (previous === undefined) delete process.env.ATRIS_RUNNER_PROFILE;
     else process.env.ATRIS_RUNNER_PROFILE = previous;
@@ -532,6 +546,54 @@ function buildPhaseRunnerCommand(phase, promptFile, cwd = process.cwd()) {
   return buildPhaseRunner(phase, promptFile, cwd).command;
 }
 
+// One run-record line for a phase a roster worker ran. Never throws.
+function recordPhaseRosterRun(root, phase, runner, startedMs, outcome, err = null) {
+  if (!runner || !runner.engineId) return;
+  try {
+    const { appendRosterRun, parseRunUsage } = require('../lib/roster-runs');
+    const { engineRunsView } = require('../lib/roster-models');
+    const { prepRecordFields } = require('../lib/roster-prep');
+    appendRosterRun(root, {
+      at: new Date(startedMs).toISOString(),
+      job: runner.job || '',
+      member: runner.member || '',
+      engine: runner.engineId,
+      model: runner.model || engineRunsView(runner.engineId).model || '',
+      effort: runner.effort || '',
+      max_seconds: runner.maxSeconds || 0,
+      seconds: Math.max(0, (Date.now() - startedMs) / 1000),
+      task: `autopilot ${phase}`,
+      source: 'autopilot',
+      ...prepRecordFields(runner.prepResult),
+      ...parseRunUsage({ stdout: outcome.stdout || (err && err.stdout) || '', stderr: (err && err.stderr) || '' }),
+      outcome: outcome.outcome,
+      ...(outcome.detail ? { detail: outcome.detail } : {}),
+    });
+  } catch { /* best effort */ }
+}
+
+// How a phase ended when its command threw: a timeout stalled, a signal or
+// nonzero exit failed, a credit wall on stderr is credit out.
+function phaseFailureOutcome(err, runner) {
+  if (isPhaseTimeoutError(err)) {
+    const cap = Number(runner && runner.maxSeconds) || 0;
+    return { outcome: 'stalled', detail: cap >= 60 ? `stalled at ${Math.round(cap / 60)} min` : cap > 0 ? `stalled at ${cap}s` : 'hit its time limit' };
+  }
+  if (isPhaseKillError(err)) return { outcome: 'failed', detail: `stopped by ${err.signal || 'a signal'}` };
+  const { engineFailureHealthStatus } = require('../lib/engine-registry');
+  const stderr = String(err && err.stderr || '');
+  if (engineFailureHealthStatus({ status: 'errored', stderr }) === 'credit_out') return { outcome: 'credit out', detail: 'the engine hit its usage limit' };
+  const line = stderr.trim().split('\n').pop() || String(err && err.message || '').split('\n')[0];
+  return { outcome: 'failed', detail: line || `exited ${err && err.status}` };
+}
+
+// What the prep worker reads as the task: the tick's task title.
+function autopilotPhaseTaskTitle(context, phase) {
+  const task = context && context.task;
+  if (task && typeof task === 'object') return String(task.title || task.display_id || `autopilot ${phase}`);
+  return String(task || `autopilot ${phase}`);
+}
+
 /**
  * Run a phase via the configured runner subprocess.
  */
@@ -539,20 +601,43 @@ function executePhaseDetailed(phase, context, options = {}) {
   const { verbose = false } = options;
   let timeout = options.timeout || PHASE_TIMEOUT;
 
-  const prompt = buildPrompt(phase, context, options);
+  let prompt = buildPrompt(phase, context, options);
   const tmpFile = path.join(process.cwd(), '.autopilot-prompt.tmp');
   fs.writeFileSync(tmpFile, prompt);
 
+  let rosterRunner = null;
+  let startedMs = Date.now();
   try {
     let cmd = options.cmdOverride;
     if (!cmd) {
       const runner = buildPhaseRunner(phase, tmpFile);
-      cmd = runner.command;
-      // A roster time cap stops the phase at that time.
+      if (runner.engineId) rosterRunner = runner;
+      // A roster time cap stops the phase at that time, and prep runs inside
+      // it: the phase gets what remains after the pass, floored so it can
+      // still try.
       if (runner.timeoutMs) timeout = runner.timeoutMs;
+      // A worker whose roster line asks for prep gets its brief first, the
+      // same pass fleet runs; the launch reads the prompt file, brief added.
+      if (runner.engineId && runner.prep) {
+        const prepStartedMs = Date.now();
+        const { runPrepPassSync, withPrepBrief } = require('../lib/roster-prep');
+        runner.prepResult = runPrepPassSync({
+          prepJob: runner.prep,
+          forJob: runner.job || AUTOPILOT_PHASE_MEMBERS[phase],
+          task: { display_id: `autopilot ${phase}`, title: autopilotPhaseTaskTitle(context, phase) },
+          prompt,
+          root: process.cwd(),
+          record: { member: runner.member || '' },
+        });
+        prompt = withPrepBrief(prompt, runner.prepResult);
+        fs.writeFileSync(tmpFile, prompt);
+        timeout = Math.max(PHASE_MIN_AFTER_PREP_MS, timeout - (Date.now() - prepStartedMs));
+      }
+      cmd = runner.command;
     }
     const env = { ...process.env };
     delete env.CLAUDECODE;
+    startedMs = Date.now();
     const output = execPhaseCommandSync(cmd, {
       cwd: process.cwd(),
       encoding: 'utf8',
@@ -563,10 +648,19 @@ function executePhaseDetailed(phase, context, options = {}) {
     });
 
     try { fs.unlinkSync(tmpFile); } catch {}
+    recordPhaseRosterRun(process.cwd(), phase, rosterRunner, startedMs, { outcome: 'landed', stdout: output || '' });
     return { prompt, output: output || '' };
   } catch (err) {
     try { fs.unlinkSync(tmpFile); } catch {}
+    recordPhaseRosterRun(process.cwd(), phase, rosterRunner, startedMs, phaseFailureOutcome(err, rosterRunner), err);
     if (isPhaseTimeoutError(err)) {
+      // A roster worker that stalls sits out the cooldown, so the next
+      // phase run goes to the job's backup.
+      if (rosterRunner) {
+        try {
+          require('../lib/engine-registry').recordEngineRunHealth(rosterRunner.engineId, { timed_out: true, max_seconds: rosterRunner.maxSeconds }, process.cwd());
+        } catch { /* best effort */ }
+      }
       throw new Error(`${phase} phase timed out after ${timeout / 1000}s (configured runner hit the wall; any work it committed survives, reconcile from pre-tick HEADs)`);
     }
     if (isPhaseKillError(err)) {
@@ -1419,7 +1513,7 @@ function parseProposedBlock(lines) {
 // behind it, the configured runner runs exactly as before.
 function buildPlanReviewRunner(promptFile, cwd = process.cwd(), timeout = 180000) {
   const runner = buildPhaseRunner('review', promptFile, cwd, 'Bash,Read,Grep,Glob');
-  return { command: runner.command, timeoutMs: runner.timeoutMs || timeout };
+  return { ...runner, command: runner.command, timeoutMs: runner.timeoutMs || timeout };
 }
 
 /**
@@ -1429,12 +1523,15 @@ function buildPlanReviewRunner(promptFile, cwd = process.cwd(), timeout = 180000
 function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
   const tmpFile = path.join(cwd, '.autopilot-plan-review.tmp');
   fs.writeFileSync(tmpFile, prompt);
+  let runner = null;
+  let startedMs = Date.now();
   try {
-    const runner = buildPlanReviewRunner(tmpFile, cwd, timeout);
+    runner = buildPlanReviewRunner(tmpFile, cwd, timeout);
     const cmd = runner.command;
     timeout = runner.timeoutMs;
     const env = { ...process.env };
     delete env.CLAUDECODE;
+    startedMs = Date.now();
     const output = execPhaseCommandSync(cmd, {
       cwd,
       encoding: 'utf8',
@@ -1443,8 +1540,10 @@ function defaultPlanReviewExecutor(prompt, { cwd, timeout = 180000 } = {}) {
       maxBuffer: 10 * 1024 * 1024,
       env,
     });
+    recordPhaseRosterRun(cwd, 'plan review', runner, startedMs, { outcome: 'landed', stdout: output || '' });
     return output || '';
   } catch (err) {
+    recordPhaseRosterRun(cwd, 'plan review', runner, startedMs, phaseFailureOutcome(err, runner), err);
     if (err.stdout) return err.stdout;
     throw err;
   } finally {