audit-tools 0.32.68 → 0.33.1

package/dist/shared/types/auditorDescriptor.d.ts

@@ -0,0 +1,120 @@
+import type { HostModelRosterEntry } from "../quota/scheduler.js";
+import type { AntigravityConfig, ClaudeCodeConfig, DispatchableSource, ProviderName, VSCodeTaskConfig } from "./sessionConfig.js";
+/**
+ * The host-emitted description of the auditor DRIVING this run — its provider
+ * identity, own launch transport, and dispatch-capability handshake for its own
+ * model/context. All optional: a field is present only when the host declared it
+ * this invocation. (G1: collapsed the former `--host-*` flag bag onto
+ * `descriptor.self`. G2: folded the driver's provider identity + its own launch
+ * blocks onto `self`, so the descriptor fully describes WHO drives + HOW to launch
+ * it, with the reachable dispatch pool on {@link AuditorDescriptor.sources}.)
+ */
+export interface AuditorSelf {
+    /**
+     * The driver's provider identity — the conversation-host/quota-attribution key
+     * for THIS run (collapsed from the retired inventory's `provider` /
+     * `host_provider`, which were the same identity). Absent ⇒ resolve() leaves the
+     * effective provider to env auto-detection (`resolveConversationHostProvider`).
+     */
+    provider?: ProviderName;
+    /** Opaque model identity (was `--host-model-id`); a quota-key segment only. */
+    model_id?: string;
+    /** Ordered model roster, lowest rank first (was `--host-models`). */
+    roster?: HostModelRosterEntry[];
+    /** Context-window (input) tokens the host reports (was `--host-context-tokens`). */
+    context_tokens?: number;
+    /** Output-token cap the host reports (was `--host-output-tokens`). */
+    output_tokens?: number;
+    /** Operator override for in-flight subagent cap (was `--host-max-active-subagents`). */
+    max_active_subagents?: number;
+    /**
+     * The driver's declared parallel-worker concurrency cap (the former
+     * `sessionConfig.parallel_workers`) — dispatch capability, so it rides the
+     * descriptor, not the repo config. Feeds `resolveHostConcurrencyLimit` /
+     * `resolveHostActiveSubagentLimit` via the resolved effective config.
+     */
+    parallel_workers?: number;
+    /** Tristate: host can dispatch subagents (was `--host-can-dispatch-subagents`). */
+    can_dispatch_subagents?: boolean;
+    /** Host can restrict subagent tools (was `--host-can-restrict-subagent-tools`). */
+    can_restrict_subagent_tools?: boolean;
+    /** Host can select subagent model (was `--host-can-select-subagent-model`). */
+    can_select_subagent_model?: boolean;
+    /**
+     * This host's own subagents are proxy-fronted (the session was started behind the
+     * repair-proxy, so anything the host spawns through its Agent tool inherits that
+     * front). Consumed by the FUTURE Agent-tool carrier — nothing reads it this
+     * commit; it rides the handshake so a proxy-fronted session can declare itself
+     * (docs/reviews/commit3-proxy-kind1-transport-plan-2026-07-16.md §Descriptor).
+     */
+    proxy_transport?: boolean;
+    /**
+     * The driver's OWN launch transport, for the host/IDE providers that are NOT
+     * generic dispatchable sources ({@link DispatchableSource} excludes exactly
+     * `claude-code`/`vscode-task`/`antigravity`, which are driven through their
+     * host/IDE, not an endpoint+parameters source). The dispatchable backends'
+     * launch config rides `sources[]` instead. Present only for a configured
+     * non-default host command or IDE-task template; absent ⇒ the driver
+     * self-launches with defaults.
+     */
+    claude_code?: ClaudeCodeConfig;
+    vscode_task?: VSCodeTaskConfig;
+    antigravity?: AntigravityConfig;
+}
+/**
+ * The current driver's dispatch handshake, carried as ONE `--auditor <json>` flag
+ * (G1 replaced the N `--host-*` flags with this single JSON transport). Re-emitted
+ * onto every continue-command so the descriptor RIDES the command the driver runs
+ * to advance — surviving that driver's own steps without the host re-appending
+ * flags each time (auditor-agnostic robustness; the founding capability-inheritance
+ * bug was that a bare continue-command dropped the handshake, so a resume fell back
+ * to the stored session config). A *different* driver entering through its own
+ * loader supplies its own `--auditor`, overriding this descriptor.
+ * [[capability-is-per-auditor-not-per-audit]] [[unified-dispatch-worker-model]]
+ */
+export interface AuditorDescriptor {
+    /** Never-inherit auditor id STAMP — wired in G5; optional/unused in G1. */
+    auditor_id?: string;
+    /** When the descriptor was resolved — wired in G5; optional/unused in G1. */
+    resolved_at?: number;
+    /** The driving auditor's identity, own launch transport, and model scalars. */
+    self: AuditorSelf;
+    /**
+     * The reachable dispatch pool the CURRENT auditor can spill work onto — the
+     * uniform `DispatchableSource[]` (NIM/vLLM endpoints, headless CLIs, subprocess
+     * templates), each with its own endpoint/parameters/quota. Resolved from the
+     * auditor's OWN environment (the deterministic source-emitter's `declared ∩
+     * ambient-verifiable` intersection), never the repo session-config
+     * ([[capability-is-per-auditor-not-per-audit]]). Absent/empty ⇒ the driver
+     * self-drives with no additional backends. (G2 resliced the retired
+     * `inventory` — provider + host/IDE launch blocks moved to {@link self}, the
+     * per-backend dispatch blocks folded here as sources.)
+     */
+    sources?: DispatchableSource[];
+}
+/**
+ * The descriptor for a driver that had NO host handshake — it can report nothing
+ * about itself, but it still has an environment.
+ *
+ * The descriptor's fields split along a verified line, and this helper is that line
+ * made explicit:
+ * - **ENVIRONMENT-class** (`sources[]`, provider identity, dispatch capability) — the
+ *   backends THIS PROCESS can spawn. Resolved in-process; a handshake was never
+ *   needed for them (`resolveAmbientSources`: `declared ∩ ambient-verifiable`).
+ * - **HOST-SELF-class** (`model_id` / `context_tokens` / `output_tokens` / `roster`) —
+ *   "I am model X with an N-token window." Genuinely unknowable to a spawned CLI: the
+ *   running agent's model identity is not on PATH, not an env var, not a file. Absent
+ *   here, so the host pool sizes to the conservative floor. That is a fidelity
+ *   degradation, never a block.
+ *
+ * ⚠ NOT interchangeable with a `null` descriptor. `resolveSessionConfig(intent, null)`
+ * FAILS CLOSED to driver-self-only — "resolve no pool at all" — and short-circuits
+ * before ambient resolution. This says "resolve my pool from ambient reach; I just
+ * can't tell you about myself." Remediate passing `null` (it has no `--auditor` flag)
+ * is what made it dispatch with NO pool — an un-released capability regression vs
+ * v0.32.68, where `sources[]` was read straight off disk. Returns a FRESH object per
+ * call so no caller can mutate a shared literal.
+ * [[capability-is-per-auditor-not-per-audit]]
+ */
+export declare function ambientAuditorDescriptor(): AuditorDescriptor;
+//# sourceMappingURL=auditorDescriptor.d.ts.map

package/dist/shared/types/auditorDescriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditorDescriptor.d.ts","sourceRoot":"","sources":["../../../src/shared/types/auditorDescriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,mFAAmF;IACnF,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,WAAW,CAAC;IAClB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,IAAI,iBAAiB,CAE5D"}

package/dist/shared/types/auditorDescriptor.js

@@ -0,0 +1,28 @@
+/**
+ * The descriptor for a driver that had NO host handshake — it can report nothing
+ * about itself, but it still has an environment.
+ *
+ * The descriptor's fields split along a verified line, and this helper is that line
+ * made explicit:
+ * - **ENVIRONMENT-class** (`sources[]`, provider identity, dispatch capability) — the
+ *   backends THIS PROCESS can spawn. Resolved in-process; a handshake was never
+ *   needed for them (`resolveAmbientSources`: `declared ∩ ambient-verifiable`).
+ * - **HOST-SELF-class** (`model_id` / `context_tokens` / `output_tokens` / `roster`) —
+ *   "I am model X with an N-token window." Genuinely unknowable to a spawned CLI: the
+ *   running agent's model identity is not on PATH, not an env var, not a file. Absent
+ *   here, so the host pool sizes to the conservative floor. That is a fidelity
+ *   degradation, never a block.
+ *
+ * ⚠ NOT interchangeable with a `null` descriptor. `resolveSessionConfig(intent, null)`
+ * FAILS CLOSED to driver-self-only — "resolve no pool at all" — and short-circuits
+ * before ambient resolution. This says "resolve my pool from ambient reach; I just
+ * can't tell you about myself." Remediate passing `null` (it has no `--auditor` flag)
+ * is what made it dispatch with NO pool — an un-released capability regression vs
+ * v0.32.68, where `sources[]` was read straight off disk. Returns a FRESH object per
+ * call so no caller can mutate a shared literal.
+ * [[capability-is-per-auditor-not-per-audit]]
+ */
+export function ambientAuditorDescriptor() {
+    return { self: {} };
+}
+//# sourceMappingURL=auditorDescriptor.js.map

package/dist/shared/types/auditorDescriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditorDescriptor.js","sourceRoot":"","sources":["../../../src/shared/types/auditorDescriptor.ts"],"names":[],"mappings":"AAuGA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}

package/dist/shared/types/providerConfirmation.d.ts

@@ -25,7 +25,7 @@ export declare const PROVIDER_CONFIRMATION_RESULT_VERSION: "1.1.0";
  * plain input; the tool owns the canonical envelope it is promoted into (the
  * per-tool `provider_confirmation.json` seam + the shared
  * `provider-confirmation.json`) — the input/envelope split so the tool stays the
- * sole writer of the roster snapshot + cost annotation.
+ * sole writer of the discovered pool + cost annotation.
  */
 export declare const PROVIDER_CONFIRMATION_INPUT_VERSION: "provider-confirmation-input/v1";
 /**
@@ -58,8 +58,14 @@ export interface ProviderConfirmationInput {
      * both provider pools and host models so one total cost order drives dispatch.
      */
     cost_order?: string[];
-    /** Provider names to exclude from the dispatchable pool. */
-    exclude?: ResolvedProviderName[];
+    /**
+     * Exclusion patterns ruling backends out of the dispatchable pool
+     * (`DispatchExclusionPattern`): `provider:model` (the default granularity — the
+     * operator confirms *model* choices), the coarser bare `provider`, or an
+     * endpoint host. Kept verbatim: the grammar is open, so an unrecognized pattern
+     * is inert rather than dropped.
+     */
+    exclude?: string[];
     /** Self-spawn-blocked provider names the operator opts back IN. */
     include?: ResolvedProviderName[];
     /**
@@ -127,6 +133,60 @@ export interface SourcePoolCostEntry {
     cost_order: number;
 }
 /** One entry in the confirmed provider pool. */
+/**
+ * One entry of the PERSISTED confirmed pool — the operator's DECISION, and nothing
+ * else (G3 B+D).
+ *
+ * Deliberately a strict subset of {@link ConfirmedPoolEntry}: the reach half
+ * (`capability_tier` / `self_spawn_blocked` / `excluded` / `reason` /
+ * `blended_price_usd_per_mtok`) is the WRITING auditor's assessment of its own
+ * environment and must never be inherited by a reading auditor — reach is
+ * re-resolved per-auditor at the moment of use. Those fields live only on the
+ * in-memory render DTO, which never reaches disk.
+ *
+ * This is enforced by TYPE, not by a projection at the write site: if the persisted
+ * field were typed `ConfirmedPoolEntry[]`, `writeJsonFile` would serialize the reach
+ * fields regardless of intent. Unrepresentable, not guarded.
+ */
+export interface PersistedPoolEntry {
+    /** Canonical provider name. Half of the gate's `model_id ?? name` compare key. */
+    name: ResolvedProviderName;
+    /**
+     * The reach half, branded `never` so it is genuinely UNREPRESENTABLE here.
+     *
+     * ⚠ These are load-bearing, not documentation. `PersistedPoolEntry` is otherwise a
+     * structural SUBSET of {@link ConfirmedPoolEntry}, and TypeScript's excess-property
+     * check fires only on fresh object literals — so without these, a `ConfirmedPoolEntry`
+     * (or a `RenderedProviderConfirmation`) assigns cleanly to the persisted type and the
+     * writer's whole reach assessment serializes to disk with NO compiler signal. An
+     * independent review proved exactly that against this file. The two builders take
+     * identical parameter lists and differ by one word, so a swapped call site is a real
+     * hazard; this is what makes the swap a type error instead of a silent leak.
+     */
+    capability_tier?: never;
+    self_spawn_blocked?: never;
+    excluded?: never;
+    reason?: never;
+    blended_price_usd_per_mtok?: never;
+    /**
+     * Representative model id this entry is priced/ordered by. The dispatch
+     * cost-position key, and the finer half of the gate's compare key. Absent when the
+     * model is not knowable at confirmation time (a CLI backend's model arrives only
+     * at the dispatch handshake).
+     */
+    model_id?: string;
+    /**
+     * Operator-confirmed 0-based cost position (rung 1 of costRank). Lower routes
+     * first. Read back at dispatch via `resolveConfirmedCostPositions`.
+     */
+    cost_order?: number;
+}
+/**
+ * The FULL in-memory pool entry — the Gate-0 RENDER DTO. Carries the persisted
+ * decision ({@link PersistedPoolEntry}) plus this auditor's freshly-derived reach,
+ * which the operator needs to SEE (tier, price, why a backend is excluded) but which
+ * must never be persisted for another auditor to inherit.
+ */
 export interface ConfirmedPoolEntry {
     /** Canonical provider name. */
     name: ResolvedProviderName;
@@ -143,11 +203,9 @@ export interface ConfirmedPoolEntry {
      * active session of that same agent (claude-code under `CLAUDECODE`, codex
      * under `CODEX`). Such an entry is `excluded: true` by default — and so out of
      * the dispatchable pool — unless the operator explicitly re-includes it. This
-     * flag is the security signal; `reason` is advisory text only.
+     * flag is the security signal.
      */
     self_spawn_blocked?: boolean;
-    /** Optional reason for exclusion or detection restriction. */
-    reason?: string;
     /**
      * Representative model id this entry is priced/ordered by (cost-first routing;
      * spec/cost-first-routing.md). For a configured API pool it is the configured

package/dist/shared/types/providerConfirmation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,EAC9C,gCAAyC,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,cAAc,EAAE,OAAO,mCAAmC,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC,mEAAmE;IACnE,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,uFAAuF;IACvF,cAAc,EAAE,OAAO,CAAC;IACxB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,EAC9C,gCAAyC,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,cAAc,EAAE,OAAO,mCAAmC,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,uFAAuF;IACvF,cAAc,EAAE,OAAO,CAAC;IACxB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,gDAAgD;AAChD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,kBAAkB,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,0BAA0B,CAAC,EAAE,KAAK,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}

package/dist/shared/types/providerConfirmation.js

@@ -29,7 +29,7 @@ export const PROVIDER_CONFIRMATION_RESULT_VERSION = "1.1.0";
  * plain input; the tool owns the canonical envelope it is promoted into (the
  * per-tool `provider_confirmation.json` seam + the shared
  * `provider-confirmation.json`) — the input/envelope split so the tool stays the
- * sole writer of the roster snapshot + cost annotation.
+ * sole writer of the discovered pool + cost annotation.
  */
 export const PROVIDER_CONFIRMATION_INPUT_VERSION = "provider-confirmation-input/v1";
 //# sourceMappingURL=providerConfirmation.js.map

package/dist/shared/types/rollingDispatch.d.ts

@@ -33,7 +33,7 @@ export interface RollingDispatchEnginePacket<TPacket = unknown> {
 /** Outcome returned after each packet completes. */
 export interface RollingDispatchEngineResult<TPacket = unknown> {
     packet: RollingDispatchEnginePacket<TPacket>;
-    outcome: "success" | "rate_limited" | "timeout" | "error" | "credit_exhausted" | "quota_unclassified";
+    outcome: "success" | "rate_limited" | "timeout" | "error" | "credit_exhausted" | "model_unavailable" | "packet_too_large" | "quota_unclassified";
     actualTokens?: number;
     error?: unknown;
     /**
@@ -56,6 +56,26 @@ export interface RollingDispatchEngineResult<TPacket = unknown> {
         text: string;
         rawMatch: string | null;
     };
+    /**
+     * Worker ERROR/STATUS channel evidence that classified a `model_unavailable`
+     * outcome (HTTP 404, model not found — permanent pool exclusion). Absent on
+     * non-model_unavailable outcomes.
+     */
+    modelUnavailable?: {
+        channel: "error" | "status" | "result";
+        text: string;
+        rawMatch: string | null;
+    };
+    /**
+     * Worker ERROR/STATUS channel evidence that classified a `packet_too_large`
+     * outcome (HTTP 413, request/payload too large — per-packet sizing fault).
+     * Absent on non-packet_too_large outcomes.
+     */
+    packetTooLarge?: {
+        channel: "error" | "status" | "result";
+        text: string;
+        rawMatch: string | null;
+    };
     /**
      * Worker ERROR/STATUS channel VERBATIM evidence that classified a
      * `quota_unclassified` outcome (Slice A2b, TIER 2): the broad
@@ -140,5 +160,29 @@ export interface RollingDispatchEngineContract<TPacket = unknown> {
         poolId: string;
         text: string;
     }) => void;
+    /**
+     * Model-unavailable exclusion (HTTP 404 class — the model is not served by
+     * this provider; availability analog of cost drift): invoked once per pool
+     * the first time a `model_unavailable` result lands, after the engine has
+     * already permanently excluded the pool from this run's admissible set. The
+     * consumer wires it to friction emission. Optional — omit to leave the
+     * exclusion silent (no friction, exclusion still happens).
+     */
+    onModelUnavailable?: (info: {
+        poolId: string;
+        rawMatch: string | null;
+    }) => void;
+    /**
+     * Packet-too-large (HTTP 413 class — a per-packet sizing fault): invoked once
+     * per (packet, pool) pair, after the engine has already recorded the
+     * per-packet pool skip (the pool is NOT excluded and no cooldown applies).
+     * The consumer wires it to friction emission. Optional — omit to leave the
+     * skip silent (no friction, skip still happens).
+     */
+    onPacketTooLarge?: (info: {
+        poolId: string;
+        packetId: string;
+        rawMatch: string | null;
+    }) => void;
 }
 //# sourceMappingURL=rollingDispatch.d.ts.map

package/dist/shared/types/rollingDispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollingDispatch.d.ts","sourceRoot":"","sources":["../../../src/shared/types/rollingDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAG,OAAgB,CAAC;AAMhE,mEAAmE;AACnE,MAAM,WAAW,2BAA2B,CAAC,OAAO,GAAG,OAAO;IAC5D,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,2BAA2B,CAAC,OAAO,GAAG,OAAO;IAC5D,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;IACtG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACrG;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B,CAAC,OAAO,GAAG,OAAO;IAC9D,iEAAiE;IACjE,aAAa,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC;IACzE,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/E,wFAAwF;IACxF,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,gBAAgB,EACZ,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,OAAO,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,GAC3F,SAAS,CAAC;IACd;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAC5C,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,KACzC,IAAI,CAAC;IACV;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAClD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,KAAK,IAAI,CAAC;IACX;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAChF;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACxE"}
+{"version":3,"file":"rollingDispatch.d.ts","sourceRoot":"","sources":["../../../src/shared/types/rollingDispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAG,OAAgB,CAAC;AAMhE,mEAAmE;AACnE,MAAM,WAAW,2BAA2B,CAAC,OAAO,GAAG,OAAO;IAC5D,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,2BAA2B,CAAC,OAAO,GAAG,OAAO;IAC5D,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,EACH,SAAS,GACT,cAAc,GACd,SAAS,GACT,OAAO,GACP,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACrG;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACrG;;;;OAIG;IACH,cAAc,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACnG;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B,CAAC,OAAO,GAAG,OAAO;IAC9D,iEAAiE;IACjE,aAAa,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC;IACzE,sDAAsD;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/E,wFAAwF;IACxF,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,gBAAgB,EACZ,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,OAAO,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,GAC3F,SAAS,CAAC;IACd;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAC5C,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC,KACzC,IAAI,CAAC;IACV;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAClD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,KAAK,IAAI,CAAC;IACX;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IAChF;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvE;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;IACjF;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,IAAI,CAAC;CAClG"}