audit-tools 0.32.68 → 0.33.1

package/dist/remediate/steps/sessionConfigLoad.js

@@ -0,0 +1,39 @@
+import { join } from "node:path";
+import { readValidatedRepoSessionIntent, resolveSessionConfig, ambientAuditorDescriptor, populateProxyCatalogIfMissing, } from "audit-tools/shared";
+/**
+ * The ONE place remediate turns a persisted `RepoSessionIntent` into an effective
+ * {@link SessionConfig} — so the descriptor choice cannot drift across call sites.
+ *
+ * It is ALWAYS the ambient descriptor: remediate has no host handshake (no `--auditor`
+ * flag), but it has an environment, so its dispatch pool resolves in-process from
+ * `declared ∩ ambient-verifiable`. Host-self-class fields (model/window/roster) stay
+ * absent → the host pool sizes to the conservative floor, which is a fidelity
+ * degradation, never a block.
+ *
+ * ⚠ Why this function exists rather than three call sites each choosing: passing `null`
+ * FAILS CLOSED to driver-self-only — no pool at all — and that is exactly what happened.
+ * Between v0.32.68 and the fix, all three remediate sites hardcoded `null`, so remediate
+ * could not dispatch to ANY non-self pool, where v0.32.68 read `sources[]` straight off
+ * disk. The mechanism was deliberate; the consequence went unnoticed for four laps.
+ * Routing every site through here makes the null choice UNREPRESENTABLE instead of a
+ * thing each site must remember — enforce in tooling, never "the next author notices".
+ * [[capability-is-per-auditor-not-per-audit]] [[enforce-robustness-in-tooling-not-host-discretion]]
+ */
+export async function loadRemediateSessionConfig(params) {
+    if (params.override)
+        return params.override;
+    // Remediate has no Gate-0 build moment (audit's populate trigger), so a declared
+    // repair-proxy lane on a remediate-only machine would never expand — the
+    // [[silent-fail-closed-on-one-draw]] class. Missing-only populate: after one
+    // success this is a cheap cache read, never a per-load fetch. Failure degrades
+    // (the resolve half then drops the lane WITH a reason via resolveSessionConfig's
+    // dropped-source report); it never blocks the load.
+    await populateProxyCatalogIfMissing(params.ambient).catch(() => null);
+    const intent = params.artifactsFirst
+        ? ((await readValidatedRepoSessionIntent(join(params.root, ".remediation-artifacts", "session-config.json"))) ?? (await readValidatedRepoSessionIntent(join(params.root, "session-config.json"))))
+        : await readValidatedRepoSessionIntent(join(params.root, "session-config.json"));
+    return intent
+        ? resolveSessionConfig(intent, ambientAuditorDescriptor(), params.ambient)
+        : undefined;
+}
+//# sourceMappingURL=sessionConfigLoad.js.map

package/dist/remediate/steps/sessionConfigLoad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionConfigLoad.js","sourceRoot":"","sources":["../../../src/remediate/steps/sessionConfigLoad.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,GAG9B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAwBhD;IACC,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC5C,iFAAiF;IACjF,yEAAyE;IACzE,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,oDAAoD;IACpD,MAAM,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc;QAClC,CAAC,CAAC,CAAC,CAAC,MAAM,8BAA8B,CACpC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,EAAE,qBAAqB,CAAC,CACnE,CAAC,IAAI,CAAC,MAAM,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,MAAM,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM;QACX,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;QAC1E,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/shared/config/resolveSessionConfig.d.ts

@@ -0,0 +1,75 @@
+import type { AuditorDescriptor } from "../types/auditorDescriptor.js";
+import { type RepoSessionIntent, type SessionConfig } from "../types/sessionConfig.js";
+import { type AmbientSourceDeps, type DroppedSource } from "../providers/auditorSources.js";
+/**
+ * The ambient probes the G2.5 source resolution reads. Production passes nothing —
+ * every probe defaults to the real environment (`process.env`, real PATH, real home
+ * dir), which is the point: the reach check must read the SAME env the provider reads
+ * at launch. Tests inject. `onDroppedSources` overrides the default stderr report
+ * for declared-but-unresolved lanes (the reasons must be loud at every draw).
+ */
+export type ResolveSessionConfigOptions = AmbientSourceDeps & {
+    onDroppedSources?: (dropped: DroppedSource[]) => void;
+};
+/**
+ * Produce the in-memory EFFECTIVE {@link SessionConfig} every dispatch/provider
+ * consumer reads, from the persisted {@link RepoSessionIntent} (audit intent +
+ * policy, NO dispatch inventory) overlaid with the per-invocation
+ * {@link AuditorDescriptor} (the driver's identity + own launch transport +
+ * reachable `sources[]`). This is the single seam that replaces the retired
+ * `applyDispatchInventory`: the backend/launch set now comes from the per-auditor
+ * descriptor, never the repo session-config, and is never inherited across auditors
+ * ([[capability-is-per-auditor-not-per-audit]], `spec/unified-dispatch-worker-model.md`, G2).
+ *
+ * - `descriptor == null` → FAIL CLOSED to driver-self-only: the intent is returned
+ *   with no resolved backends. The driver is definitionally reachable and
+ *   self-launches; there is NO stored dispatch value to fall back to. This is the
+ *   deliberate G2 behavior change from `applyDispatchInventory(cfg, null) ⇒ cfg`.
+ *   Ambient resolution deliberately does NOT apply here — `null` means "resolve NO
+ *   pool", which is a stronger statement than "no handshake happened".
+ *
+ *   ⚠ A caller that HAS no handshake but DOES have an environment wants
+ *   {@link ambientAuditorDescriptor}, NOT `null`. Passing `null` there is a silent
+ *   capability loss: it short-circuits before {@link resolveAmbientSources}, so a
+ *   declared + reachable lane never becomes a pool. Remediate did exactly that at all
+ *   three of its dispatch sites and consequently could not dispatch to any non-self
+ *   pool; it now routes through `loadRemediateSessionConfig`, which always supplies the
+ *   ambient descriptor.
+ * - `descriptor` present → the driver's `self.provider` becomes the effective
+ *   provider + conversation-host attribution key; its own host/IDE launch blocks
+ *   (`claude_code` / `vscode_task` / `antigravity`) overlay; and `sources[]` becomes
+ *   the effective dispatch pool. When the DRIVER itself is a dispatchable-source
+ *   backend (headless single-lane), its flat per-backend block is reconstructed from
+ *   the matching source so `createFreshSessionProvider` can build the primary
+ *   provider — the pool machinery reads `effective.sources` directly (dedup by
+ *   source id), so there is no double-count.
+ *
+ * **Where `sources[]` comes from (G2.5).** The cut is WHO LAUNCHES: `self` is what only
+ * the host can know (can-dispatch-subagents, can_proxy, roster, ceilings) and is
+ * irreducibly handshake-reported; `sources[]` are the six backends THIS PROCESS spawns
+ * (CLI subprocess or HTTP POST), so they are resolved in-process by
+ * `resolveAmbientSources` — `declared ∩ ambient-verifiable` over the operator's
+ * machine-level declaration — and never routed through the host. An explicit
+ * `descriptor.sources` still wins (the operator's escape hatch).
+ *
+ *   Deliberate deviation from `spec/unified-dispatch-worker-model.md`'s G2.5 sketch (a
+ *   pre-`next-step` shell-out printing `sources[]` for the host to merge): that merge is
+ *   an LLM hand-composing JSON — the host-discretion anti-pattern the commit exists to
+ *   kill, whose failure mode is a silently-empty pool indistinguishable from an
+ *   unreachable machine. The spec's shell-out conflated POPULATE (expensive, network-
+ *   bound, cacheable) with RESOLVE (local, cheap, must run at the moment of use).
+ *   G2.5 builds RESOLVE; POPULATE lands later behind this same seam.
+ *
+ * Every INTENT field (synthesis / analyzers / graph / quota / block_quota /
+ * design_review / dispatch fan-out knobs / …) is preserved identically. Never mutates
+ * its inputs.
+ *
+ * NOT pure since G2.5: when a descriptor omits `sources`, this READS the ambient
+ * environment (the declaration file, env vars, PATH). That is deliberate and is the
+ * whole point — resolving anywhere else would let the reach check and the launch read
+ * different environments. It stays cheap (one small JSON read, and only on the
+ * descriptor-present path; `descriptor == null` short-circuits before it) and every
+ * probe is injectable via {@link ResolveSessionConfigOptions} for tests.
+ */
+export declare function resolveSessionConfig(intent: RepoSessionIntent, descriptor: AuditorDescriptor | null | undefined, options?: ResolveSessionConfigOptions): SessionConfig;
+//# sourceMappingURL=resolveSessionConfig.d.ts.map

package/dist/shared/config/resolveSessionConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSessionConfig.d.ts","sourceRoot":"","sources":["../../../src/shared/config/resolveSessionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAEnB,MAAM,gCAAgC,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,GAAG;IAC5D,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,IAAI,CAAC;CACvD,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,CAAC,EAAE,2BAA2B,GACpC,aAAa,CAyDf"}

package/dist/shared/config/resolveSessionConfig.js

@@ -0,0 +1,125 @@
+import { DISPATCHABLE_SOURCE_PROVIDERS, } from "../types/sessionConfig.js";
+import { sourceProviderConfig } from "../quota/apiPool.js";
+import { resolveAmbientSources, } from "../providers/auditorSources.js";
+const DISPATCHABLE_PROVIDER_SET = new Set(DISPATCHABLE_SOURCE_PROVIDERS);
+/**
+ * Produce the in-memory EFFECTIVE {@link SessionConfig} every dispatch/provider
+ * consumer reads, from the persisted {@link RepoSessionIntent} (audit intent +
+ * policy, NO dispatch inventory) overlaid with the per-invocation
+ * {@link AuditorDescriptor} (the driver's identity + own launch transport +
+ * reachable `sources[]`). This is the single seam that replaces the retired
+ * `applyDispatchInventory`: the backend/launch set now comes from the per-auditor
+ * descriptor, never the repo session-config, and is never inherited across auditors
+ * ([[capability-is-per-auditor-not-per-audit]], `spec/unified-dispatch-worker-model.md`, G2).
+ *
+ * - `descriptor == null` → FAIL CLOSED to driver-self-only: the intent is returned
+ *   with no resolved backends. The driver is definitionally reachable and
+ *   self-launches; there is NO stored dispatch value to fall back to. This is the
+ *   deliberate G2 behavior change from `applyDispatchInventory(cfg, null) ⇒ cfg`.
+ *   Ambient resolution deliberately does NOT apply here — `null` means "resolve NO
+ *   pool", which is a stronger statement than "no handshake happened".
+ *
+ *   ⚠ A caller that HAS no handshake but DOES have an environment wants
+ *   {@link ambientAuditorDescriptor}, NOT `null`. Passing `null` there is a silent
+ *   capability loss: it short-circuits before {@link resolveAmbientSources}, so a
+ *   declared + reachable lane never becomes a pool. Remediate did exactly that at all
+ *   three of its dispatch sites and consequently could not dispatch to any non-self
+ *   pool; it now routes through `loadRemediateSessionConfig`, which always supplies the
+ *   ambient descriptor.
+ * - `descriptor` present → the driver's `self.provider` becomes the effective
+ *   provider + conversation-host attribution key; its own host/IDE launch blocks
+ *   (`claude_code` / `vscode_task` / `antigravity`) overlay; and `sources[]` becomes
+ *   the effective dispatch pool. When the DRIVER itself is a dispatchable-source
+ *   backend (headless single-lane), its flat per-backend block is reconstructed from
+ *   the matching source so `createFreshSessionProvider` can build the primary
+ *   provider — the pool machinery reads `effective.sources` directly (dedup by
+ *   source id), so there is no double-count.
+ *
+ * **Where `sources[]` comes from (G2.5).** The cut is WHO LAUNCHES: `self` is what only
+ * the host can know (can-dispatch-subagents, can_proxy, roster, ceilings) and is
+ * irreducibly handshake-reported; `sources[]` are the six backends THIS PROCESS spawns
+ * (CLI subprocess or HTTP POST), so they are resolved in-process by
+ * `resolveAmbientSources` — `declared ∩ ambient-verifiable` over the operator's
+ * machine-level declaration — and never routed through the host. An explicit
+ * `descriptor.sources` still wins (the operator's escape hatch).
+ *
+ *   Deliberate deviation from `spec/unified-dispatch-worker-model.md`'s G2.5 sketch (a
+ *   pre-`next-step` shell-out printing `sources[]` for the host to merge): that merge is
+ *   an LLM hand-composing JSON — the host-discretion anti-pattern the commit exists to
+ *   kill, whose failure mode is a silently-empty pool indistinguishable from an
+ *   unreachable machine. The spec's shell-out conflated POPULATE (expensive, network-
+ *   bound, cacheable) with RESOLVE (local, cheap, must run at the moment of use).
+ *   G2.5 builds RESOLVE; POPULATE lands later behind this same seam.
+ *
+ * Every INTENT field (synthesis / analyzers / graph / quota / block_quota /
+ * design_review / dispatch fan-out knobs / …) is preserved identically. Never mutates
+ * its inputs.
+ *
+ * NOT pure since G2.5: when a descriptor omits `sources`, this READS the ambient
+ * environment (the declaration file, env vars, PATH). That is deliberate and is the
+ * whole point — resolving anywhere else would let the reach check and the launch read
+ * different environments. It stays cheap (one small JSON read, and only on the
+ * descriptor-present path; `descriptor == null` short-circuits before it) and every
+ * probe is injectable via {@link ResolveSessionConfigOptions} for tests.
+ */
+export function resolveSessionConfig(intent, descriptor, options) {
+    // The intent carries NO dispatch-inventory fields and no `dispatch.rolling_engine`
+    // (RepoDispatchConfig), so the base effective config is the intent verbatim; its
+    // narrower `dispatch` is structurally assignable to DispatchConfig.
+    const effective = { ...intent };
+    if (descriptor == null) {
+        return effective;
+    }
+    const self = descriptor.self ?? {};
+    if (self.provider !== undefined) {
+        effective.provider = self.provider;
+        effective.host_provider = self.provider;
+    }
+    if (self.claude_code !== undefined)
+        effective.claude_code = self.claude_code;
+    if (self.vscode_task !== undefined)
+        effective.vscode_task = self.vscode_task;
+    if (self.antigravity !== undefined)
+        effective.antigravity = self.antigravity;
+    if (self.parallel_workers !== undefined) {
+        effective.parallel_workers = self.parallel_workers;
+    }
+    // `declared ∩ ambient-verifiable`, resolved IN-PROCESS (G2.5). An explicit
+    // hand-authored `--auditor sources[]` still wins — it is the operator's escape
+    // hatch and the only way to force a lane this process cannot prove.
+    let sources;
+    if (descriptor.sources) {
+        sources = descriptor.sources;
+    }
+    else {
+        const ambient = resolveAmbientSources(options);
+        // A dropped lane must be LOUD at every draw — the reasons existed since G2.5
+        // but were discarded here, so a declared-but-unresolvable lane was silently
+        // absent (the [[silent-fail-closed-on-one-draw]] class). Default = stderr;
+        // callers with a better channel inject `onDroppedSources`.
+        if (ambient.dropped.length > 0) {
+            const report = options?.onDroppedSources ??
+                ((dropped) => {
+                    for (const d of dropped) {
+                        process.stderr.write(`[audit-tools] declared source "${d.id}" not resolved: ${d.reason}\n`);
+                    }
+                });
+            report(ambient.dropped);
+        }
+        sources = ambient.sources;
+    }
+    if (sources.length > 0) {
+        effective.sources = sources;
+        if (self.provider && DISPATCHABLE_PROVIDER_SET.has(self.provider)) {
+            // The FIRST source matching the driver's provider supplies its flat block. With
+            // multiple same-provider sources (e.g. two NIM endpoints), the operator orders
+            // `sources[]` so the driver's own endpoint is first; the non-primary ones still
+            // become their own pools via `effective.sources`.
+            const primary = sources.find((s) => s.provider === self.provider);
+            if (primary)
+                Object.assign(effective, sourceProviderConfig(primary));
+        }
+    }
+    return effective;
+}
+//# sourceMappingURL=resolveSessionConfig.js.map

package/dist/shared/config/resolveSessionConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSessionConfig.js","sourceRoot":"","sources":["../../../src/shared/config/resolveSessionConfig.ts"],"names":[],"mappings":"AACA,OAAO,EACL,6BAA6B,GAI9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAGL,qBAAqB,GACtB,MAAM,gCAAgC,CAAC;AAaxC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAC5D,6BAA6B,CAC9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,EACzB,UAAgD,EAChD,OAAqC;IAErC,mFAAmF;IACnF,iFAAiF;IACjF,oEAAoE;IACpE,MAAM,SAAS,GAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/C,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACnC,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7E,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACrD,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,OAA6B,CAAC;IAClC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/C,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GACV,OAAO,EAAE,gBAAgB;gBACzB,CAAC,CAAC,OAAwB,EAAE,EAAE;oBAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,MAAM,IAAI,CACtE,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,gFAAgF;YAChF,+EAA+E;YAC/E,gFAAgF;YAChF,kDAAkD;YAClD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,OAAO;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/shared/dispatch/admissionLoop.d.ts

@@ -100,15 +100,15 @@ export declare const AdmissionGrantSchema: z.ZodObject<{
     lease_id: z.ZodString;
     cost: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
+    pool_id: string;
     cost: number;
     packet_id: string;
-    pool_id: string;
     resource_key: string;
     lease_id: string;
 }, {
+    pool_id: string;
     cost: number;
     packet_id: string;
-    pool_id: string;
     resource_key: string;
     lease_id: string;
 }>;
@@ -126,19 +126,19 @@ export declare const AdmissionExplainSchema: z.ZodObject<{
     cost: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
     reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+    pool_id: string | null;
     cost: number;
     admitted: boolean;
     packet_id: string;
-    pool_id: string | null;
     resource_key: string | null;
     headroom_before?: number | undefined;
     outstanding_before?: number | undefined;
 }, {
     reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+    pool_id: string | null;
     cost: number;
     admitted: boolean;
     packet_id: string;
-    pool_id: string | null;
     resource_key: string | null;
     headroom_before?: number | undefined;
     outstanding_before?: number | undefined;
@@ -162,15 +162,15 @@ export declare const DispatchAdmissionSchema: z.ZodObject<{
         lease_id: z.ZodString;
         cost: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
+        pool_id: string;
         cost: number;
         packet_id: string;
-        pool_id: string;
         resource_key: string;
         lease_id: string;
     }, {
+        pool_id: string;
         cost: number;
         packet_id: string;
-        pool_id: string;
         resource_key: string;
         lease_id: string;
     }>, "many">;
@@ -187,28 +187,28 @@ export declare const DispatchAdmissionSchema: z.ZodObject<{
         cost: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
         reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        pool_id: string | null;
         cost: number;
         admitted: boolean;
         packet_id: string;
-        pool_id: string | null;
         resource_key: string | null;
         headroom_before?: number | undefined;
         outstanding_before?: number | undefined;
     }, {
         reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        pool_id: string | null;
         cost: number;
         admitted: boolean;
         packet_id: string;
-        pool_id: string | null;
         resource_key: string | null;
         headroom_before?: number | undefined;
         outstanding_before?: number | undefined;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
     leases: {
+        pool_id: string;
         cost: number;
         packet_id: string;
-        pool_id: string;
         resource_key: string;
         lease_id: string;
     }[];
@@ -216,19 +216,19 @@ export declare const DispatchAdmissionSchema: z.ZodObject<{
     declared_cap: number | null;
     explains: {
         reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        pool_id: string | null;
         cost: number;
         admitted: boolean;
         packet_id: string;
-        pool_id: string | null;
         resource_key: string | null;
         headroom_before?: number | undefined;
         outstanding_before?: number | undefined;
     }[];
 }, {
     leases: {
+        pool_id: string;
         cost: number;
         packet_id: string;
-        pool_id: string;
         resource_key: string;
         lease_id: string;
     }[];
@@ -236,10 +236,10 @@ export declare const DispatchAdmissionSchema: z.ZodObject<{
     declared_cap: number | null;
     explains: {
         reason: "admitted" | "no_capable_pool" | "budget_exhausted" | "cap_reached";
+        pool_id: string | null;
         cost: number;
         admitted: boolean;
         packet_id: string;
-        pool_id: string | null;
         resource_key: string | null;
         headroom_before?: number | undefined;
         outstanding_before?: number | undefined;

package/dist/shared/dispatch/coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAM/D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,6BAA6B;IAC5C,kEAAkE;IAClE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,mBAAmB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAMD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA2C;gBAEzD,IAAI,EAAE,6BAA6B;IAQ/C,4EAA4E;IAC5E,OAAO,CAAC,WAAW;IAKnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAkDvE;;;;;;;;OAQG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD;;;;;;OAMG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,yBAAyB;CASjE"}
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAMpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAM/D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,WAAW,6BAA6B;IAC5C,kEAAkE;IAClE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,mBAAmB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAiBD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA2C;gBAEzD,IAAI,EAAE,6BAA6B;IAQ/C,4EAA4E;IAC5E,OAAO,CAAC,WAAW;IAKnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAyFvE;;;;;;;;OAQG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C;;;;;;OAMG;IACG,OAAO,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD;;;;;;OAMG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,yBAAyB;CASjE"}

package/dist/shared/dispatch/coordinator.js

@@ -43,7 +43,18 @@
  * provider coupling, so it runs identically on win32 / darwin / linux and under
  * either driver.
  */
-import { computeDispatchCapacity, buildEmptyPoolTerminal } from "../quota/capacity.js";
+import { computeDispatchCapacity, buildEmptyPoolTerminal, AGENTIC_WORKER_HARNESS_OVERHEAD_TOKENS, } from "../quota/capacity.js";
+/**
+ * Whether a node fits a pool's declared per-request/context token cap, including
+ * the agentic-harness overhead a CLI worker adds on top of the packet prompt.
+ * A pool with no declared cap (null/absent — host pools, undeclared sources) is
+ * always admissible: unknown means no fit filtering, the status quo.
+ */
+function nodeContextFits(node, pool) {
+    if (pool.contextCapTokens == null)
+        return true;
+    return node.estimatedTokens + AGENTIC_WORKER_HARNESS_OVERHEAD_TOKENS <= pool.contextCapTokens;
+}
 // ---------------------------------------------------------------------------
 // HybridSpillCoordinator
 // ---------------------------------------------------------------------------
@@ -101,7 +112,13 @@ export class HybridSpillCoordinator {
         });
         const poolById = new Map(active.map((p) => [p.id, p]));
         const assignments = [];
-        let cursor = 0;
+        // Per-pool packet-fit gate (U2): the claim walk consumes a shared queue with a
+        // FIRST-FIT scan instead of a linear cursor, so a node too large for THIS pool's
+        // declared context cap stays available for a later (larger or cap-less) pool in
+        // the same walk — the claim itself is the fit guarantee (a node is never claimed
+        // to a pool it cannot fit; post-hoc repartitioning would strand the claim on the
+        // wrong pool id).
+        const unassigned = [...ordered];
         for (const alloc of capacity.pools) {
             const pool = poolById.get(alloc.pool_id);
             // Defensive: the fold echoes the input pools, but never assign to a pool
@@ -109,9 +126,16 @@ export class HybridSpillCoordinator {
             if (!pool)
                 continue;
             let placed = 0;
-            while (placed < alloc.slots && cursor < ordered.length) {
-                const node = ordered[cursor];
-                cursor += 1;
+            let scan = 0;
+            while (placed < alloc.slots && scan < unassigned.length) {
+                const node = unassigned[scan];
+                if (!nodeContextFits(node, pool)) {
+                    // Too large for this pool — leave it queued for a later pool this walk
+                    // (or unclaimed for the next cycle); the slot stays open for the next node.
+                    scan += 1;
+                    continue;
+                }
+                unassigned.splice(scan, 1);
                 // Claim BEFORE returning the node in any assignment (CE-001). A node
                 // another driver already holds is skipped — it is theirs to run — and the
                 // slot is freed for the next node so capacity is not wasted on a contested id.
@@ -127,9 +151,31 @@ export class HybridSpillCoordinator {
                 });
                 placed += 1;
             }
-            if (cursor >= ordered.length)
+            if (unassigned.length === 0)
                 break;
         }
+        // Loud never-fits surface (spec F1): a node whose size exceeds EVERY active
+        // pool's declared cap can never be claimed by this coordinator — re-offering
+        // is correct only while a cap-less (host) pool may appear; silent re-offer
+        // against a fixed all-capped pool set would look like an idle wedge. One
+        // structured line per plan so the caller/operator can see exactly which
+        // nodes are unplaceable and why.
+        const neverFits = unassigned.filter((n) => active.every((p) => !nodeContextFits(n, p)));
+        if (neverFits.length > 0) {
+            try {
+                process.stderr.write(JSON.stringify({
+                    ts: new Date().toISOString(),
+                    kind: "hybrid_dispatch_node_never_fits",
+                    node_ids: neverFits.map((n) => n.id).sort(),
+                    active_pool_caps: active
+                        .map((p) => ({ pool_id: p.id, context_cap_tokens: p.contextCapTokens ?? null }))
+                        .sort((a, b) => a.pool_id.localeCompare(b.pool_id)),
+                }) + "\n");
+            }
+            catch {
+                // Observability must never abort a plan.
+            }
+        }
         return assignments;
     }
     /**

package/dist/shared/dispatch/coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../../../src/shared/dispatch/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AA0EvF,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAiB;IACtB,aAAa,CAAgB;IAC7B,aAAa,CAAgB;IAC7B,WAAW,CAA4B;IACvC,QAAQ,CAA4C;IAErE,YAAY,IAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,4EAA4E;IACpE,WAAW;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,eAAe,CAAC,KAAqB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEzD,yEAAyE;QACzE,kFAAkF;QAClF,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;QAEjF,0EAA0E;QAC1E,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,KAAK,EAAE,MAAM;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,WAAW,GAAqB,EAAE,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,yEAAyE;YACzE,+CAA+C;YAC/C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,CAAC;gBACZ,qEAAqE;gBACrE,0EAA0E;gBAC1E,+EAA+E;gBAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ;oBAAE,SAAS;gBAC9B,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM;QACtC,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC3C,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,UAA0B;QACtC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,WAAqB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACnD,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,sBAAsB,CAAC,WAAW,CAAC;SAC9C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../../../src/shared/dispatch/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,sCAAsC,GACvC,MAAM,sBAAsB,CAAC;AA0E9B;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAkB,EAAE,IAAkB;IAC7D,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,IAAI,CAAC,eAAe,GAAG,sCAAsC,IAAI,IAAI,CAAC,gBAAgB,CAAC;AAChG,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAiB;IACtB,aAAa,CAAgB;IAC7B,aAAa,CAAgB;IAC7B,WAAW,CAA4B;IACvC,QAAQ,CAA4C;IAErE,YAAY,IAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,4EAA4E;IACpE,WAAW;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,eAAe,CAAC,KAAqB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEzD,yEAAyE;QACzE,kFAAkF;QAClF,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;QAEjF,0EAA0E;QAC1E,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,uBAAuB,CAAC;YACvC,KAAK,EAAE,MAAM;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,WAAW,GAAqB,EAAE,CAAC;QACzC,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,iFAAiF;QACjF,iFAAiF;QACjF,kBAAkB;QAClB,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,yEAAyE;YACzE,+CAA+C;YAC/C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAE,CAAC;gBAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;oBACjC,uEAAuE;oBACvE,4EAA4E;oBAC5E,IAAI,IAAI,CAAC,CAAC;oBACV,SAAS;gBACX,CAAC;gBACD,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3B,qEAAqE;gBACrE,0EAA0E;gBAC1E,+EAA+E;gBAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK,CAAC,QAAQ;oBAAE,SAAS;gBAC9B,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;QACrC,CAAC;QAED,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACxC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAC5C,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;oBACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC5B,IAAI,EAAE,iCAAiC;oBACvC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;oBAC3C,gBAAgB,EAAE,MAAM;yBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC,CAAC;yBAC/E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;iBACtD,CAAC,GAAG,IAAI,CACV,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC3C,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,UAA0B;QACtC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,WAAqB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACnD,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,sBAAsB,CAAC,WAAW,CAAC;SAC9C,CAAC;IACJ,CAAC;CACF"}

package/dist/shared/dispatch/hybridDispatch.d.ts

@@ -61,6 +61,12 @@ export interface HybridDispatchInput {
  * claiming each node to exactly one pool, and partition the claimed assignments by the
  * caller's in-process classification.
  *
+ * Per-pool packet-fit gate (U2): fit is enforced INSIDE the coordinator's claim walk
+ * (`nodeContextFits` in coordinator.ts) — a node is never CLAIMED to a pool whose
+ * declared context cap (plus agentic-harness overhead) it exceeds, so every assignment
+ * returned here is fit-guaranteed by construction. Repartitioning after the claim would
+ * strand the claim on the wrong pool id; that is why the gate is not here.
+ *
  * Behaviour falls out of the pool set with no special-casing:
  *  - host-only pools → every node lands in `host`; `inProcess` empty.
  *  - backend-only pools → every node lands in `inProcess`; `host` empty.

package/dist/shared/dispatch/hybridDispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hybridDispatch.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/hybridDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,yFAAyF;AACzF,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB;;;;OAIG;IACH,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,gFAAgF;IAChF,WAAW,EAAE,MAAM,mBAAmB,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;OAIG;IACH,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAerG"}
+{"version":3,"file":"hybridDispatch.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/hybridDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,yFAAyF;AACzF,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB;;;;OAIG;IACH,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,gFAAgF;IAChF,WAAW,EAAE,MAAM,mBAAmB,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;OAIG;IACH,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAerG"}

package/dist/shared/dispatch/hybridDispatch.js

@@ -26,6 +26,12 @@ import { HybridSpillCoordinator } from "./coordinator.js";
  * claiming each node to exactly one pool, and partition the claimed assignments by the
  * caller's in-process classification.
  *
+ * Per-pool packet-fit gate (U2): fit is enforced INSIDE the coordinator's claim walk
+ * (`nodeContextFits` in coordinator.ts) — a node is never CLAIMED to a pool whose
+ * declared context cap (plus agentic-harness overhead) it exceeds, so every assignment
+ * returned here is fit-guaranteed by construction. Repartitioning after the claim would
+ * strand the claim on the wrong pool id; that is why the gate is not here.
+ *
  * Behaviour falls out of the pool set with no special-casing:
  *  - host-only pools → every node lands in `host`; `inProcess` empty.
  *  - backend-only pools → every node lands in `inProcess`; `host` empty.

package/dist/shared/dispatch/hybridDispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"hybridDispatch.js","sourceRoot":"","sources":["../../../src/shared/dispatch/hybridDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,sBAAsB,EAA0C,MAAM,kBAAkB,CAAC;AAqClG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0B;IACjE,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC;QAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"hybridDispatch.js","sourceRoot":"","sources":["../../../src/shared/dispatch/hybridDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,sBAAsB,EAA0C,MAAM,kBAAkB,CAAC;AAqClG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0B;IACjE,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC;QAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC"}

package/dist/shared/dispatch/providerLaunchFinalize.d.ts

@@ -33,7 +33,8 @@ export interface ProviderLaunchFinalizeContext<TPacket> {
  * read-only-vs-git-mutating / AuditResult-vs-ImplementWorkerResult divergences.
  *
  * In order:
- *  1. not-accepted → error;
+ *  1. not-accepted → classify the failure text via the shared `classifyFailureChannels`
+ *     helper (mirrors the accepted-but-no-result-file branch so both cannot drift);
  *  2. channel-isolated credit-exhaustion (TIER 1) then session-limit (TIER 1)
  *     detection on stderr (CE-003) → credit_exhausted / non-consuming
  *     rate_limited re-queue (the result file is never scanned for these strings);

package/dist/shared/dispatch/providerLaunchFinalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerLaunchFinalize.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/providerLaunchFinalize.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEzF,MAAM,WAAW,6BAA6B,CAAC,OAAO;IACpD,4EAA4E;IAC5E,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACvC,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EACxD,MAAM,EAAE,wBAAwB,EAChC,GAAG,EAAE,6BAA6B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAsHzC"}
+{"version":3,"file":"providerLaunchFinalize.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/providerLaunchFinalize.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEzF,MAAM,WAAW,6BAA6B,CAAC,OAAO;IACpD,4EAA4E;IAC5E,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACvC,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAiHD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EACxD,MAAM,EAAE,wBAAwB,EAChC,GAAG,EAAE,6BAA6B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAyEzC"}