audit-tools 0.28.8 → 0.28.9

package/dist/shared/dispatch/coordinator.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Hybrid spill coordinator (A-8).
+ *
+ * The ONE assignment layer that BOTH dispatch drivers — the audit in-process
+ * provider engine (`driveRollingAuditDispatch`) and the remediate host-subagent
+ * loop (`advanceHostRolling`) — drive identically, so the spill topology can no
+ * longer drift between them. It sits ABOVE the shared capacity fold
+ * (`computeDispatchCapacity` / `scheduleWave`, S4) and the per-node accept
+ * lifecycle (`acceptNodeWorktree`); it owns the cross-driver invariants those
+ * lower layers cannot enforce on their own:
+ *
+ *  - **Claim-before-assign (CE-001).** Every node is claimed through A-10's
+ *    file-backed {@link ClaimRegistry} BEFORE it is returned in any assignment,
+ *    so two loops driving the same goal can never both pick the same node —
+ *    exactly-one-claimant across both drivers. A node another driver already
+ *    holds a live claim on is silently skipped (it is that driver's to run); the
+ *    coordinator only ever hands back nodes it actually owns.
+ *
+ *  - **Co-owned SettledExclusionSet (CE-001 spill/exclusion handshake).** A pool
+ *    that was spilled onto and then exhausted is recorded *settled* in the SAME
+ *    exclusion set dc4 persists on the active-dispatch artifact (read in via
+ *    `readSettled`, written back via `onSettle`). A settled pool is therefore
+ *    excluded from every future split AND is never re-offered as net-new on
+ *    re-discovery (INV-S03) — the spill side and the pause side share one set,
+ *    not two that can disagree.
+ *
+ *  - **Proactive capacity split across ALL pools.** The frontier is split across
+ *    every non-settled pool by capacity up front (not one chosen pool throttled
+ *    reactively), folding inv2's RAW per-pool signals
+ *    (`quotaSourceSnapshot` / `quotaStateEntry` / `quotaSignalDegraded`) to slot
+ *    counts ONLY through the single shared `computeDispatchCapacity` fold — never
+ *    pre-folded here and never re-folded. The global host-concurrency budget is
+ *    honoured because it lives inside that same fold.
+ *
+ *  - **The single pause authorization.** {@link HybridSpillCoordinator.terminalStatus}
+ *    emits the `all_pools_exhausted` terminal — and that terminal is the ONLY
+ *    signal authorizing dc4 to pause the run. While any confirmed pool is still
+ *    unsettled the coordinator reports `dispatchable`, so a driver never pauses
+ *    on a transient single-pool exhaustion that the split could route around.
+ *
+ * The module is pure logic over injected collaborators (the registry, the
+ * read/write hooks for the shared set, an optional clock) — zero direct disk or
+ * provider coupling, so it runs identically on win32 / darwin / linux and under
+ * either driver.
+ */
+import type { CapacityPool, PartialCompletionTerminal } from "../quota/capacity.js";
+import type { SessionConfig } from "../types/sessionConfig.js";
+import type { SettledExclusionSet } from "../rolling/pausedState.js";
+import type { ClaimRegistry } from "../quota/claimRegistry.js";
+/**
+ * A dispatchable frontier node, packet-payload-agnostic. The coordinator needs
+ * only the stable id (for the claim) and the projected input-token cost (for the
+ * capacity split); the payload is the driver's own concern.
+ */
+export interface FrontierNode {
+    /** Stable, unique id for this node within the run (the claim key). */
+    id: string;
+    /** Projected input-token cost — fed to the S4 fold, never re-derived here. */
+    estimatedTokens: number;
+}
+/**
+ * One node claimed for one pool. Returned ONLY after the claim succeeded, so the
+ * caller may dispatch immediately. The `ownerToken` is carried so the caller
+ * (and {@link HybridSpillCoordinator.release}) can release or heartbeat the claim
+ * through the same registry without re-reading it.
+ */
+export interface NodeAssignment {
+    nodeId: string;
+    poolId: string;
+    providerName: CapacityPool["providerName"];
+    hostModel: string | null;
+    /** Claim token minted by the registry; required to release the claim. */
+    ownerToken: string;
+}
+/**
+ * The coordinator's terminal verdict after a planning pass.
+ *
+ * - `dispatchable`: at least one confirmed pool is still unsettled — keep going,
+ *   never pause.
+ * - `all_pools_exhausted`: every confirmed pool is settled; this is the ONLY
+ *   signal that authorizes dc4 to engage the resumable pause. The stranded ids
+ *   ride along as a {@link PartialCompletionTerminal} so the caller can route
+ *   them through its consumer-specific handler.
+ */
+export type CoordinatorTerminalStatus = {
+    kind: "dispatchable";
+} | {
+    kind: "all_pools_exhausted";
+    terminal: PartialCompletionTerminal;
+};
+/** Construction inputs for {@link HybridSpillCoordinator}. */
+export interface HybridSpillCoordinatorOptions {
+    /** Confirmed provider pools for this run, in preference order. */
+    pools: CapacityPool[];
+    sessionConfig: SessionConfig;
+    /**
+     * A-10 file-backed claim registry. The SAME registry path is supplied by both
+     * drivers so a claim taken by one is visible to the other (exactly-one-claimant).
+     */
+    claimRegistry: ClaimRegistry;
+    /**
+     * Read the CURRENT shared settled-exclusion set (the pool ids dc4 persisted on
+     * the active-dispatch artifact). Read on every pass so a pool another loop
+     * settled is honoured immediately — the set is co-owned, not snapshotted once.
+     */
+    readSettled: () => SettledExclusionSet;
+    /**
+     * Persist a newly-settled pool id back into the shared set. Invoked by
+     * {@link HybridSpillCoordinator.settlePool} so the spill side and dc4's pause
+     * side write through ONE set. Optional for in-memory / test use.
+     */
+    onSettle?: (poolId: string) => void | Promise<void>;
+}
+export declare class HybridSpillCoordinator {
+    private readonly pools;
+    private readonly sessionConfig;
+    private readonly claimRegistry;
+    private readonly readSettled;
+    private readonly onSettle?;
+    constructor(opts: HybridSpillCoordinatorOptions);
+    /** The pools NOT in the current shared settled set, in preference order. */
+    private activePools;
+    /**
+     * Plan one dispatch pass: proactively split `nodes` across every non-settled
+     * pool by capacity, then CLAIM each planned node before returning it.
+     *
+     * Steps:
+     *  1. Drop settled pools (co-owned set) — a spilled-then-exhausted pool is never
+     *     offered capacity again.
+     *  2. Size every surviving pool through the single shared `computeDispatchCapacity`
+     *     fold (S4): inv2's raw per-pool signals become slot counts THERE, the global
+     *     host budget is enforced THERE, and the largest nodes land on the pools with
+     *     the most headroom. No pre-fold or re-fold happens in this module.
+     *  3. Walk the per-pool slot allocations largest-node-first and, for each
+     *     (node, pool) pairing, take a registry claim BEFORE emitting the assignment.
+     *     A node already held by another loop (live claim) is skipped — exactly-one
+     *     claimant across both drivers (CE-001). Only owned nodes are returned.
+     *
+     * Returns the assignments the caller now exclusively owns. An empty result with
+     * no active pools means the caller should consult {@link terminalStatus}.
+     */
+    planAssignments(nodes: FrontierNode[]): Promise<NodeAssignment[]>;
+    /**
+     * Record a pool as spilled-then-exhausted in the co-owned SettledExclusionSet.
+     *
+     * This is the spill side of the CE-001 handshake: once a pool that load was
+     * spilled onto can no longer take work, it is written back through `onSettle`
+     * into the SAME set dc4 reads when it pauses — so the pool is excluded from
+     * every future split here AND is never re-offered as net-new on re-discovery
+     * (INV-S03). Idempotent: settling an already-settled pool is a no-op.
+     */
+    settlePool(poolId: string): Promise<void>;
+    /**
+     * Release a node's claim once its `acceptNodeWorktree` lifecycle has finished
+     * (success OR failure) — the convergence point both drivers share. Token-checked
+     * by the registry, so only the owner can release. A `rate_limited` node that the
+     * driver intends to re-queue should NOT be released here (it is still owned work);
+     * release only on a terminal accept outcome.
+     */
+    release(assignment: NodeAssignment): Promise<void>;
+    /**
+     * The single pause-authorization check. Returns `all_pools_exhausted` — carrying
+     * a `PartialCompletionTerminal` over `strandedIds` — ONLY when every confirmed
+     * pool is settled; otherwise `dispatchable`. dc4 may engage its resumable pause
+     * if and only if this returns the terminal; a transient single-pool exhaustion
+     * (other pools still unsettled) keeps the run dispatchable.
+     */
+    terminalStatus(strandedIds: string[]): CoordinatorTerminalStatus;
+}
+//# sourceMappingURL=coordinator.d.ts.map

package/dist/shared/dispatch/coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAM/D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,6BAA6B;IAC5C,kEAAkE;IAClE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,mBAAmB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAMD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA2C;gBAEzD,IAAI,EAAE,6BAA6B;IAQ/C,4EAA4E;IAC5E,OAAO,CAAC,WAAW;IAKnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAkDvE;;;;;;;;OAQG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD;;;;;;OAMG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,yBAAyB;CASjE"}

package/dist/shared/dispatch/coordinator.js

@@ -0,0 +1,177 @@
+/**
+ * Hybrid spill coordinator (A-8).
+ *
+ * The ONE assignment layer that BOTH dispatch drivers — the audit in-process
+ * provider engine (`driveRollingAuditDispatch`) and the remediate host-subagent
+ * loop (`advanceHostRolling`) — drive identically, so the spill topology can no
+ * longer drift between them. It sits ABOVE the shared capacity fold
+ * (`computeDispatchCapacity` / `scheduleWave`, S4) and the per-node accept
+ * lifecycle (`acceptNodeWorktree`); it owns the cross-driver invariants those
+ * lower layers cannot enforce on their own:
+ *
+ *  - **Claim-before-assign (CE-001).** Every node is claimed through A-10's
+ *    file-backed {@link ClaimRegistry} BEFORE it is returned in any assignment,
+ *    so two loops driving the same goal can never both pick the same node —
+ *    exactly-one-claimant across both drivers. A node another driver already
+ *    holds a live claim on is silently skipped (it is that driver's to run); the
+ *    coordinator only ever hands back nodes it actually owns.
+ *
+ *  - **Co-owned SettledExclusionSet (CE-001 spill/exclusion handshake).** A pool
+ *    that was spilled onto and then exhausted is recorded *settled* in the SAME
+ *    exclusion set dc4 persists on the active-dispatch artifact (read in via
+ *    `readSettled`, written back via `onSettle`). A settled pool is therefore
+ *    excluded from every future split AND is never re-offered as net-new on
+ *    re-discovery (INV-S03) — the spill side and the pause side share one set,
+ *    not two that can disagree.
+ *
+ *  - **Proactive capacity split across ALL pools.** The frontier is split across
+ *    every non-settled pool by capacity up front (not one chosen pool throttled
+ *    reactively), folding inv2's RAW per-pool signals
+ *    (`quotaSourceSnapshot` / `quotaStateEntry` / `quotaSignalDegraded`) to slot
+ *    counts ONLY through the single shared `computeDispatchCapacity` fold — never
+ *    pre-folded here and never re-folded. The global host-concurrency budget is
+ *    honoured because it lives inside that same fold.
+ *
+ *  - **The single pause authorization.** {@link HybridSpillCoordinator.terminalStatus}
+ *    emits the `all_pools_exhausted` terminal — and that terminal is the ONLY
+ *    signal authorizing dc4 to pause the run. While any confirmed pool is still
+ *    unsettled the coordinator reports `dispatchable`, so a driver never pauses
+ *    on a transient single-pool exhaustion that the split could route around.
+ *
+ * The module is pure logic over injected collaborators (the registry, the
+ * read/write hooks for the shared set, an optional clock) — zero direct disk or
+ * provider coupling, so it runs identically on win32 / darwin / linux and under
+ * either driver.
+ */
+import { computeDispatchCapacity, buildEmptyPoolTerminal } from "../quota/capacity.js";
+// ---------------------------------------------------------------------------
+// HybridSpillCoordinator
+// ---------------------------------------------------------------------------
+export class HybridSpillCoordinator {
+    pools;
+    sessionConfig;
+    claimRegistry;
+    readSettled;
+    onSettle;
+    constructor(opts) {
+        this.pools = opts.pools;
+        this.sessionConfig = opts.sessionConfig;
+        this.claimRegistry = opts.claimRegistry;
+        this.readSettled = opts.readSettled;
+        this.onSettle = opts.onSettle;
+    }
+    /** The pools NOT in the current shared settled set, in preference order. */
+    activePools() {
+        const settled = this.readSettled();
+        return this.pools.filter((p) => !settled.has(p.id));
+    }
+    /**
+     * Plan one dispatch pass: proactively split `nodes` across every non-settled
+     * pool by capacity, then CLAIM each planned node before returning it.
+     *
+     * Steps:
+     *  1. Drop settled pools (co-owned set) — a spilled-then-exhausted pool is never
+     *     offered capacity again.
+     *  2. Size every surviving pool through the single shared `computeDispatchCapacity`
+     *     fold (S4): inv2's raw per-pool signals become slot counts THERE, the global
+     *     host budget is enforced THERE, and the largest nodes land on the pools with
+     *     the most headroom. No pre-fold or re-fold happens in this module.
+     *  3. Walk the per-pool slot allocations largest-node-first and, for each
+     *     (node, pool) pairing, take a registry claim BEFORE emitting the assignment.
+     *     A node already held by another loop (live claim) is skipped — exactly-one
+     *     claimant across both drivers (CE-001). Only owned nodes are returned.
+     *
+     * Returns the assignments the caller now exclusively owns. An empty result with
+     * no active pools means the caller should consult {@link terminalStatus}.
+     */
+    async planAssignments(nodes) {
+        const active = this.activePools();
+        if (active.length === 0 || nodes.length === 0)
+            return [];
+        // Largest-node-first so the capacity split and the claim walk agree with
+        // computeDispatchCapacity's own descending layout (biggest work → most headroom).
+        const ordered = [...nodes].sort((a, b) => b.estimatedTokens - a.estimatedTokens);
+        // S4: the ONE fold. Raw per-pool quota signals → slot counts, global host
+        // budget applied, all inside computeDispatchCapacity. We pass the ordered node
+        // token costs as the pending layout and read back the per-pool slot counts.
+        const capacity = computeDispatchCapacity({
+            pools: active,
+            sessionConfig: this.sessionConfig,
+            pendingItemTokens: ordered.map((n) => n.estimatedTokens),
+        });
+        const poolById = new Map(active.map((p) => [p.id, p]));
+        const assignments = [];
+        let cursor = 0;
+        for (const alloc of capacity.pools) {
+            const pool = poolById.get(alloc.pool_id);
+            // Defensive: the fold echoes the input pools, but never assign to a pool
+            // that is not in the active (non-settled) set.
+            if (!pool)
+                continue;
+            let placed = 0;
+            while (placed < alloc.slots && cursor < ordered.length) {
+                const node = ordered[cursor];
+                cursor += 1;
+                // Claim BEFORE returning the node in any assignment (CE-001). A node
+                // another driver already holds is skipped — it is theirs to run — and the
+                // slot is freed for the next node so capacity is not wasted on a contested id.
+                const claim = await this.claimRegistry.claim(node.id, pool.id);
+                if (!claim.acquired)
+                    continue;
+                assignments.push({
+                    nodeId: node.id,
+                    poolId: pool.id,
+                    providerName: pool.providerName,
+                    hostModel: pool.hostModel,
+                    ownerToken: claim.ownerToken,
+                });
+                placed += 1;
+            }
+            if (cursor >= ordered.length)
+                break;
+        }
+        return assignments;
+    }
+    /**
+     * Record a pool as spilled-then-exhausted in the co-owned SettledExclusionSet.
+     *
+     * This is the spill side of the CE-001 handshake: once a pool that load was
+     * spilled onto can no longer take work, it is written back through `onSettle`
+     * into the SAME set dc4 reads when it pauses — so the pool is excluded from
+     * every future split here AND is never re-offered as net-new on re-discovery
+     * (INV-S03). Idempotent: settling an already-settled pool is a no-op.
+     */
+    async settlePool(poolId) {
+        if (this.readSettled().has(poolId))
+            return;
+        await this.onSettle?.(poolId);
+    }
+    /**
+     * Release a node's claim once its `acceptNodeWorktree` lifecycle has finished
+     * (success OR failure) — the convergence point both drivers share. Token-checked
+     * by the registry, so only the owner can release. A `rate_limited` node that the
+     * driver intends to re-queue should NOT be released here (it is still owned work);
+     * release only on a terminal accept outcome.
+     */
+    async release(assignment) {
+        await this.claimRegistry.release(assignment.nodeId, assignment.ownerToken);
+    }
+    /**
+     * The single pause-authorization check. Returns `all_pools_exhausted` — carrying
+     * a `PartialCompletionTerminal` over `strandedIds` — ONLY when every confirmed
+     * pool is settled; otherwise `dispatchable`. dc4 may engage its resumable pause
+     * if and only if this returns the terminal; a transient single-pool exhaustion
+     * (other pools still unsettled) keeps the run dispatchable.
+     */
+    terminalStatus(strandedIds) {
+        const settled = this.readSettled();
+        const allExhausted = this.pools.length > 0 && this.pools.every((p) => settled.has(p.id));
+        if (!allExhausted)
+            return { kind: "dispatchable" };
+        return {
+            kind: "all_pools_exhausted",
+            terminal: buildEmptyPoolTerminal(strandedIds),
+        };
+    }
+}
+//# sourceMappingURL=coordinator.js.map

package/dist/shared/dispatch/coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../../../src/shared/dispatch/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AA0EvF,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAiB;IACtB,aAAa,CAAgB;IAC7B,aAAa,CAAgB;IAC7B,WAAW,CAA4B;IACvC,QAAQ,CAA4C;IAErE,YAAY,IAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,4EAA4E;IACpE,WAAW;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,eAAe,CAAC,KAAqB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEzD,yEAAyE;QACzE,kFAAkF;QAClF,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;QAEjF,0EAA0E;QAC1E,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,KAAK,EAAE,MAAM;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,WAAW,GAAqB,EAAE,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,yEAAyE;YACzE,+CAA+C;YAC/C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,CAAC;gBACZ,qEAAqE;gBACrE,0EAA0E;gBAC1E,+EAA+E;gBAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ;oBAAE,SAAS;gBAC9B,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM;QACtC,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC3C,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,UAA0B;QACtC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,WAAqB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACnD,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,sBAAsB,CAAC,WAAW,CAAC;SAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/shared/dispatch/hybridDispatch.d.ts

@@ -0,0 +1,74 @@
+/**
+ * A-8 hybrid dispatch split (FINDING-020 capstone) — the ONE split layer BOTH
+ * orchestrators drive.
+ *
+ * Given an eligible frontier and the confirmed CapacityPools, it drives the shared
+ * {@link HybridSpillCoordinator} to split the frontier across the pools by capacity —
+ * claiming each node to exactly one pool BEFORE it is returned (CE-001, single
+ * claimant) — then partitions the claimed assignments into the work each driver
+ * executes:
+ *
+ *  - `inProcess` — nodes on a backend pool the orchestrator launches itself this cycle
+ *    (NIM / codex / opencode / subprocess), and
+ *  - `host`      — nodes on the conversation host's pool, handed to the host driver.
+ *
+ * The host-vs-backend classification is the only tool-specific input — audit's
+ * in-process provider set is narrower than remediate's — so it is injected as
+ * {@link HybridDispatchInput.isInProcess} rather than baked in here. Everything else
+ * (the coordinator, the claim, the capacity split, the settled-exclusion handshake) is
+ * identical across both drivers, so the spill topology cannot drift between the two
+ * tools. Pure logic over injected collaborators — no dispatch, no disk beyond the
+ * registry claim — so it runs identically on win32 / darwin / linux.
+ */
+import { HybridSpillCoordinator, type FrontierNode, type NodeAssignment } from "./coordinator.js";
+import type { CapacityPool } from "../quota/capacity.js";
+import type { ClaimRegistry } from "../quota/claimRegistry.js";
+import type { SessionConfig } from "../types/sessionConfig.js";
+import type { SettledExclusionSet } from "../rolling/pausedState.js";
+/** The proactive split of one frontier into the two driver classes + the coordinator. */
+export interface HybridDispatchPartition {
+    /** Nodes the orchestrator runs in-process this cycle (backend pools). */
+    inProcess: NodeAssignment[];
+    /** Nodes handed to the conversation host's driver (its own pool). */
+    host: NodeAssignment[];
+    /**
+     * The live coordinator, so the caller can `release` claims on terminal accept,
+     * `settlePool` an exhausted pool, and consult `terminalStatus` for the sole
+     * pause authorization once the cycle's work is reconciled.
+     */
+    coordinator: HybridSpillCoordinator;
+}
+export interface HybridDispatchInput {
+    frontier: FrontierNode[];
+    pools: CapacityPool[];
+    sessionConfig: SessionConfig;
+    claimRegistry: ClaimRegistry;
+    /** Current shared settled-exclusion set (pools that spilled-then-exhausted). */
+    readSettled: () => SettledExclusionSet;
+    /** Persist a newly-settled pool id into the shared set. */
+    onSettle?: (poolId: string) => void | Promise<void>;
+    /**
+     * Classify a pool as one the orchestrator launches IN-PROCESS this cycle (vs. the
+     * conversation host / IDE pool). Tool-specific: audit's in-process set excludes
+     * `local-subprocess` / `subprocess-template`; remediate's includes them.
+     */
+    isInProcess: (pool: {
+        providerName: string;
+    }) => boolean;
+}
+/**
+ * Split one eligible frontier across the confirmed pools via the shared coordinator,
+ * claiming each node to exactly one pool, and partition the claimed assignments by the
+ * caller's in-process classification.
+ *
+ * Behaviour falls out of the pool set with no special-casing:
+ *  - host-only pools → every node lands in `host`; `inProcess` empty.
+ *  - backend-only pools → every node lands in `inProcess`; `host` empty.
+ *  - mixed (`[host, backend]`) → both partitions are non-empty whenever both pools have
+ *    headroom (the proactive-spill criterion).
+ *
+ * Nodes beyond the current total capacity are left unclaimed and re-offered next cycle,
+ * which is what makes the distribution continuous.
+ */
+export declare function planHybridDispatch(input: HybridDispatchInput): Promise<HybridDispatchPartition>;
+//# sourceMappingURL=hybridDispatch.d.ts.map

package/dist/shared/dispatch/hybridDispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybridDispatch.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/hybridDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,yFAAyF;AACzF,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB;;;;OAIG;IACH,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,gFAAgF;IAChF,WAAW,EAAE,MAAM,mBAAmB,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;OAIG;IACH,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAerG"}

package/dist/shared/dispatch/hybridDispatch.js

@@ -0,0 +1,54 @@
+/**
+ * A-8 hybrid dispatch split (FINDING-020 capstone) — the ONE split layer BOTH
+ * orchestrators drive.
+ *
+ * Given an eligible frontier and the confirmed CapacityPools, it drives the shared
+ * {@link HybridSpillCoordinator} to split the frontier across the pools by capacity —
+ * claiming each node to exactly one pool BEFORE it is returned (CE-001, single
+ * claimant) — then partitions the claimed assignments into the work each driver
+ * executes:
+ *
+ *  - `inProcess` — nodes on a backend pool the orchestrator launches itself this cycle
+ *    (NIM / codex / opencode / subprocess), and
+ *  - `host`      — nodes on the conversation host's pool, handed to the host driver.
+ *
+ * The host-vs-backend classification is the only tool-specific input — audit's
+ * in-process provider set is narrower than remediate's — so it is injected as
+ * {@link HybridDispatchInput.isInProcess} rather than baked in here. Everything else
+ * (the coordinator, the claim, the capacity split, the settled-exclusion handshake) is
+ * identical across both drivers, so the spill topology cannot drift between the two
+ * tools. Pure logic over injected collaborators — no dispatch, no disk beyond the
+ * registry claim — so it runs identically on win32 / darwin / linux.
+ */
+import { HybridSpillCoordinator } from "./coordinator.js";
+/**
+ * Split one eligible frontier across the confirmed pools via the shared coordinator,
+ * claiming each node to exactly one pool, and partition the claimed assignments by the
+ * caller's in-process classification.
+ *
+ * Behaviour falls out of the pool set with no special-casing:
+ *  - host-only pools → every node lands in `host`; `inProcess` empty.
+ *  - backend-only pools → every node lands in `inProcess`; `host` empty.
+ *  - mixed (`[host, backend]`) → both partitions are non-empty whenever both pools have
+ *    headroom (the proactive-spill criterion).
+ *
+ * Nodes beyond the current total capacity are left unclaimed and re-offered next cycle,
+ * which is what makes the distribution continuous.
+ */
+export async function planHybridDispatch(input) {
+    const coordinator = new HybridSpillCoordinator({
+        pools: input.pools,
+        sessionConfig: input.sessionConfig,
+        claimRegistry: input.claimRegistry,
+        readSettled: input.readSettled,
+        onSettle: input.onSettle,
+    });
+    const assignments = await coordinator.planAssignments(input.frontier);
+    const inProcess = [];
+    const host = [];
+    for (const a of assignments) {
+        (input.isInProcess(a) ? inProcess : host).push(a);
+    }
+    return { inProcess, host, coordinator };
+}
+//# sourceMappingURL=hybridDispatch.js.map

package/dist/shared/dispatch/hybridDispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybridDispatch.js","sourceRoot":"","sources":["../../../src/shared/dispatch/hybridDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,sBAAsB,EAA0C,MAAM,kBAAkB,CAAC;AAqClG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0B;IACjE,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC;QAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC"}

package/dist/shared/dispatch/settledPools.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The cross-cycle settled-pool store for A-8 hybrid dispatch (DC-4).
+ *
+ * A pool that was spilled onto and then EXHAUSTED is recorded here so the
+ * {@link HybridSpillCoordinator} excludes it from every future split (its
+ * `readSettled` reads this set) — the stranded work then falls back to the other
+ * pool class (the conversation host) instead of re-looping on a dead backend each
+ * cycle. The set only grows within a run (a spilled-then-exhausted pool is never
+ * re-offered as net-new, INV-S03); a fresh run starts empty (the file is per-run /
+ * per-artifacts-dir, cleared with the run's artifacts).
+ *
+ * Single-sourced so audit and remediate persist exhaustion identically — the same
+ * primitive both drivers' cutovers read on every cycle and write on backend
+ * exhaustion. Every mutation runs inside `withFileLock` so two loops driving the
+ * same run can't lose a settle to a read-modify-write race (mirrors the claim
+ * registry's cross-process safety).
+ */
+export declare function readSettledPools(path: string): Promise<Set<string>>;
+/** Record a pool id as settled (idempotent), lock-guarded. */
+export declare function addSettledPool(path: string, poolId: string): Promise<void>;
+//# sourceMappingURL=settledPools.d.ts.map

package/dist/shared/dispatch/settledPools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settledPools.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/settledPools.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAGzE;AAED,8DAA8D;AAC9D,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF"}

package/dist/shared/dispatch/settledPools.js

@@ -0,0 +1,34 @@
+import { withFileLock } from "../quota/fileLock.js";
+import { readOptionalJsonFile, writeJsonFile } from "../io/json.js";
+/**
+ * The cross-cycle settled-pool store for A-8 hybrid dispatch (DC-4).
+ *
+ * A pool that was spilled onto and then EXHAUSTED is recorded here so the
+ * {@link HybridSpillCoordinator} excludes it from every future split (its
+ * `readSettled` reads this set) — the stranded work then falls back to the other
+ * pool class (the conversation host) instead of re-looping on a dead backend each
+ * cycle. The set only grows within a run (a spilled-then-exhausted pool is never
+ * re-offered as net-new, INV-S03); a fresh run starts empty (the file is per-run /
+ * per-artifacts-dir, cleared with the run's artifacts).
+ *
+ * Single-sourced so audit and remediate persist exhaustion identically — the same
+ * primitive both drivers' cutovers read on every cycle and write on backend
+ * exhaustion. Every mutation runs inside `withFileLock` so two loops driving the
+ * same run can't lose a settle to a read-modify-write race (mirrors the claim
+ * registry's cross-process safety).
+ */
+export async function readSettledPools(path) {
+    const raw = await readOptionalJsonFile(path);
+    return new Set(Array.isArray(raw) ? raw.filter((id) => typeof id === "string") : []);
+}
+/** Record a pool id as settled (idempotent), lock-guarded. */
+export async function addSettledPool(path, poolId) {
+    await withFileLock(`${path}.lock`, async () => {
+        const set = await readSettledPools(path);
+        if (set.has(poolId))
+            return;
+        set.add(poolId);
+        await writeJsonFile(path, [...set].sort());
+    });
+}
+//# sourceMappingURL=settledPools.js.map

package/dist/shared/dispatch/settledPools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settledPools.js","sourceRoot":"","sources":["../../../src/shared/dispatch/settledPools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAW,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IAC/D,MAAM,YAAY,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC5B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/index.d.ts

@@ -20,7 +20,7 @@ export { IntentCheckpointSchema } from "./types/intentCheckpoint.js";
 export type { InterpretedIntent } from "./intent/freeFormIntentInterpreter.js";
 export { interpretFreeFormIntent } from "./intent/freeFormIntentInterpreter.js";
 export type { IntentClauseKind, IntentClause, ClauseInterpretResult, } from "./intent/clauseInterpreter.js";
-export { decomposeIntent, assessClauseEncodability, interpretIntent, } from "./intent/clauseInterpreter.js";
+export { decomposeIntent, assessClauseEncodability, interpretIntent, clauseIdentity, } from "./intent/clauseInterpreter.js";
 export type { RemediationOutcomeStatus, RemediationOutcome, RemediationOutcomesReport, } from "./types/remediationOutcome.js";
 export { RemediationOutcomeStatusSchema, RemediationOutcomeSchema, RemediationOutcomesReportSchema, } from "./types/remediationOutcome.js";
 export type { Lens } from "./types/lens.js";
@@ -29,7 +29,7 @@ export type { RepoConventions } from "./tooling/repoConventions.js";
 export { detectRepoConventions, formatRepoConventions, } from "./tooling/repoConventions.js";
 export type { StepStatus, DispatchModelTier, DispatchModelHint, } from "./types/stepContract.js";
 export { StepStatusSchema, DispatchModelTierSchema, } from "./types/stepContract.js";
-export type { ProviderName, ResolvedProviderName, SessionUiMode, SubprocessTemplateConfig, ClaudeCodeConfig, CodexConfig, OpenCodeConfig, OpenAiCompatibleConfig, VSCodeTaskConfig, AntigravityConfig, BlockQuotaConfig, QuotaModelLimits, QuotaConfig, ObservabilityConfig, SynthesisConfig, GraphConfig, DispatchRoutingTiers, DispatchConfig, DesignReviewConfig, AnalyzerSetting, SessionConfig, } from "./types/sessionConfig.js";
+export type { ProviderName, ResolvedProviderName, SessionUiMode, SubprocessTemplateConfig, ClaudeCodeConfig, CodexConfig, OpenCodeConfig, OpenAiCompatibleConfig, DispatchableSource, DispatchableSourceProvider, VSCodeTaskConfig, AntigravityConfig, BlockQuotaConfig, QuotaModelLimits, QuotaConfig, ObservabilityConfig, SynthesisConfig, GraphConfig, DispatchRoutingTiers, DispatchConfig, DesignReviewConfig, AnalyzerSetting, SessionConfig, } from "./types/sessionConfig.js";
 export { PROVIDER_NAMES, SESSION_UI_MODES, PROVIDER_SECTION_KEYS, ANALYZER_SETTINGS, AnalyzerSettingSchema, } from "./types/sessionConfig.js";
 export { AUDITOR_REPORT_MARKER } from "./contracts.js";
 export { OPENCODE_MANAGED_BROAD_VALUE, withoutOpenCodeWildcard, mergeOpenCodeAgentPermissionRule, mergeOpenCodeGlobalPermissionRule, migrateOpenCodeGlobalExternalDirectory, } from "./opencodePermissions.js";
@@ -90,8 +90,8 @@ export type { CapabilityTier, DiscoveredProvider, ConfirmedProviderPool, } from
 export { discoverProviders, queryProviderQuota, buildProviderConfirmationDisplay, applyProviderConfirmationSelections, } from "./providers/providerConfirmation.js";
 export type { LimitSource, LimitConfidence, HostConcurrencyLimitSource, HostConcurrencyLimit, ResolvedLimits, ConcurrencyBucket, QuotaStateEntry, QuotaState, WaveBindingCap, WaveSchedule, BackoffState, ObservedWaveOutcome, } from "./quota/types.js";
 export { LimitSourceSchema, LimitConfidenceSchema, HostConcurrencyLimitSourceSchema, HostConcurrencyLimitSchema, ResolvedLimitsSchema, WaveBindingCapSchema, BackoffStateSchema, } from "./quota/types.js";
-export type { QuotaSource, QuotaUsageSnapshot } from "./quota/quotaSource.js";
-export { QuotaUsageSnapshotSchema } from "./quota/quotaSource.js";
+export type { QuotaSource, QuotaUsageSnapshot, QuotaProbeResult, QuotaProbeStatus, } from "./quota/quotaSource.js";
+export { QuotaUsageSnapshotSchema, probeQuotaSource } from "./quota/quotaSource.js";
 export { resolveLimits, classifyProvider, resolveHostModel, agentHostFallbackConcurrency, DEFAULT_AGENT_HOST_CONCURRENCY, } from "./quota/limits.js";
 export type { ProviderType, LimitResolutionResult, ResolveLimitsOptions, ResolveHostModelOptions, } from "./quota/limits.js";
 export { setQuotaStateDir, getQuotaStatePath, readQuotaState, writeQuotaState, computeMaxSafeConcurrency, recordWaveOutcome, clearBucketFailureEvidence, decayWeight, applyDecayToEntry, computeBackoffCooldownMs, computeBackoffFailureWeight, computeRampUpConcurrency, BASE_COOLDOWN_MS, MAX_COOLDOWN_MS, MAX_BUCKET_LEVEL, } from "./quota/state.js";
@@ -100,6 +100,8 @@ export { collectClaudeCodeJsonLines } from "./quota/claudeCodeJsonLines.js";
 export { detectHostActiveSubagentLimit, resolveHostActiveSubagentLimit, CODEX_DESKTOP_ACTIVE_SUBAGENT_LIMIT, } from "./quota/hostLimits.js";
 export type { RateLimitDetectionResult } from "./quota/errorParsing.js";
 export { acquireLock, releaseLock, withFileLock, FileLockTimeoutError, STALE_LOCK_MS, } from "./quota/fileLock.js";
+export type { ClaimRecord, ClaimResult } from "./quota/claimRegistry.js";
+export { ClaimRegistry } from "./quota/claimRegistry.js";
 export { runSlidingWindow } from "./quota/slidingWindow.js";
 export type { SlidingWindowResult } from "./quota/slidingWindow.js";
 export { scheduleWave, buildProviderModelKey, parseHostModelRoster, DEFAULT_SAFETY_MARGIN, DEFAULT_EMPIRICAL_HALF_LIFE_HOURS, DEFAULT_FIRST_CONTACT_CONCURRENCY, QUOTA_REMAINING_PCT_CRITICAL, QUOTA_REMAINING_PCT_LOW, } from "./quota/scheduler.js";
@@ -108,11 +110,12 @@ export { HostModelRosterEntrySchema } from "./quota/scheduler.js";
 export { computeDispatchCapacity, summarizeDispatchCapacityPools, detectLivelock, buildEmptyPoolTerminal, } from "./quota/capacity.js";
 export type { CapacityPool, PoolDispatchAllocation, DispatchCapacityPoolSummary, DispatchCapacity, ComputeDispatchCapacityInput, PartialCompletionReason, PartialCompletionTerminal, } from "./quota/capacity.js";
 export { DispatchCapacityPoolSummarySchema } from "./quota/capacity.js";
+export { buildSourcePools, buildSourcePool, sourceProviderConfig, dispatchableSourceId, collectDispatchableSources, withSourceConfig, sourceByPoolId, } from "./quota/apiPool.js";
 export type { CacheablePromptParts } from "./prompts.js";
 export { buildCacheablePrompt, DO_NOT_TOKEN_WRAP_NOTE, DISPATCH_PROMPT_HANDOFF_NOTE, } from "./prompts.js";
 export type { HostAssetKind, RenderHostAssetOptions } from "./hostAssets.js";
 export { renderHostAsset } from "./hostAssets.js";
-export type { GoalSpec, ContextBundle, ContextBundleEntry, DesignSpec, DesignSpecInvariant, ConceptualDesignCritique, DesignCritiqueItem, ObligationLedger, ObligationEntry, ContractAssessmentReport, ContractAssessmentFinding, Counterexample, CounterexampleReport, CounterexampleClassification, JudgedCounterexample, JudgeRepairTarget, JudgeRepairDirective, JudgeReport, ImplementationDAG, ImplementationDAGNode, ImplementationDAGEdge, VerificationReport, VerificationTraceEntry, FindingVerificationTrace, TestSpec, TestValidatorPlan, } from "./types/contractPipeline.js";
+export type { GoalSpec, ContextBundle, ContextBundleEntry, DesignSpec, DesignSpecInvariant, ConceptualDesignCritique, DesignCritiqueItem, ObligationLedger, ObligationEntry, ObligationChangeClassification, ContractAssessmentReport, ContractAssessmentFinding, Counterexample, CounterexampleReport, CounterexampleClassification, JudgedCounterexample, JudgeRepairTarget, JudgeRepairDirective, JudgeReport, ImplementationDAG, ImplementationDAGNode, ImplementationDAGEdge, VerificationReport, VerificationTraceEntry, FindingVerificationTrace, TestSpec, TestValidatorPlan, } from "./types/contractPipeline.js";
 export { CONTRACT_PIPELINE_GOAL_SPEC_VERSION, CONTRACT_PIPELINE_CONTEXT_BUNDLE_VERSION, CONTRACT_PIPELINE_DESIGN_SPEC_VERSION, CONTRACT_PIPELINE_CONCEPTUAL_DESIGN_CRITIQUE_VERSION, CONTRACT_PIPELINE_OBLIGATION_LEDGER_VERSION, CONTRACT_PIPELINE_CONTRACT_ASSESSMENT_REPORT_VERSION, CONTRACT_PIPELINE_COUNTEREXAMPLE_VERSION, CONTRACT_PIPELINE_JUDGE_REPORT_VERSION, CONTRACT_PIPELINE_IMPLEMENTATION_DAG_VERSION, CONTRACT_PIPELINE_VERIFICATION_REPORT_VERSION, CONTRACT_PIPELINE_TEST_VALIDATOR_PLAN_VERSION, } from "./types/contractPipeline.js";
 export type { BuildObligationLedgerOptions } from "./types/obligationLedger.js";
 export { detectObligationCycle, buildObligationLedger, } from "./types/obligationLedger.js";
@@ -143,10 +146,17 @@ export { LIVELOCK_PAUSE_LIMIT, filterNewProviders, checkLivelockGuard, advancePa
 export { DISPATCH_TIER_RANK, DISPATCH_TIER_ORDER, DISPATCH_TIER_RANK_FALLBACK, tierRank, compareTier, mostCapableTier, } from "./dispatch/tierRank.js";
 export type { RollingDispatchPacket, RollingDispatchResult, ProviderSlot, InFlightEntry, RollingDispatchState, RollingDispatchConfig, RollingDispatchOptions, RollingDispatcher, } from "./dispatch/rollingDispatch.js";
 export { InFlightTokenTracker, scorePacketComplexity, selectProvider, createRollingDispatcher, } from "./dispatch/rollingDispatch.js";
+export type { FrontierNode, NodeAssignment, CoordinatorTerminalStatus, HybridSpillCoordinatorOptions, } from "./dispatch/coordinator.js";
+export { HybridSpillCoordinator } from "./dispatch/coordinator.js";
+export { planHybridDispatch } from "./dispatch/hybridDispatch.js";
+export type { HybridDispatchPartition, HybridDispatchInput } from "./dispatch/hybridDispatch.js";
+export { readSettledPools, addSettledPool } from "./dispatch/settledPools.js";
 export type { RollingDispatchEnginePacket, RollingDispatchEngineResult, RollingDispatchEngineContract, } from "./types/rollingDispatch.js";
 export { ROLLING_DISPATCH_ENGINE_VERSION } from "./types/rollingDispatch.js";
 export type { ConfirmedPoolEntry, ProviderConfirmationResult, } from "./types/providerConfirmation.js";
 export { PROVIDER_CONFIRMATION_RESULT_VERSION } from "./types/providerConfirmation.js";
+export type { SharedProviderConfirmation, SharedProviderConfirmationRead } from "./providers/sharedProviderConfirmation.js";
+export { SHARED_PROVIDER_CONFIRMATION_VERSION, SHARED_PROVIDER_CONFIRMATION_FILENAME, sharedProviderConfirmationPath, currentProviderRoster, buildSharedProviderConfirmation, writeSharedProviderConfirmation, readSharedProviderConfirmation } from "./providers/sharedProviderConfirmation.js";
 export type { EncodedClause, FreeFormIntentInterpretation, } from "./types/intentInterpretation.js";
 export { FREE_FORM_INTENT_INTERPRETATION_VERSION } from "./types/intentInterpretation.js";
 export type { ObligationState, Obligation, ObligationDef, ObligationOutcome, ObligationEngine, AdvanceResult, } from "./engine/obligationEngine.js";