bullswarm 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # bullswarm changelog
 
+## Unreleased
+
+- Workflow timeline (PR #5) hardened after a 16-agent adversarial review against
+  real run state (23 findings, 21 confirmed): worker rows now name their phase
+  (`├─✓ [Verify] verify-impl`) because concurrent phases interleave in time
+  order and the tree glyph alone hung a row under the wrong phase; a phase whose
+  actions never started (a blocked tail) is shown as `[Phase: X] blocked`
+  instead of vanishing; the header line is truncated so widths down to 20
+  columns really hold; PgUp now scrolls the timeline to earlier rows (it was a
+  dead key at the newest view) and scroll state resets when the pane changes;
+  below 100 columns the footer and status line no longer advertise a timeline
+  the narrow layout does not render. Confirmed minors left open are listed on
+  PR #5.
+- Reworked the autonomous workflow TUI around a human-readable execution story:
+  the existing Workflow Planner and phase sidebar now sits beside a timestamped
+  timeline of completed preflight, planner, phase, and worker milestones; active
+  workers and the waiting/running planner are isolated in a Live section with
+  their latest normalized action and stream heartbeat, and future work stays in
+  a distinct Next section. `v` keeps raw action-ledger and event evidence one key
+  away without mixing it into the default view.
+- Rule 7: a verify checks the goal's own acceptance criteria and never adds a
+  process rule the goal does not state (append-only, existing tests
+  untouched); when the implementation changes what an existing assertion
+  pins, a worker must own updating it. Earned three times on goal 4 (attempt
+  3, `r2vu9i`, `euh622`): the planner wrote "EXTEND BY APPENDING only" into
+  the test worker and its verify while the goal said "do NOT modify existing
+  tests except to extend them" and item 5 forced `programFeatures` to grow,
+  so the assertion at `workflow-adaptive.test.js:206` had no owner, the
+  re-verify rejected the mandated extension, and a planner turn recovered.
+- Goal-4 rerun on v0.16.0 (`euh622`): 36 min 00 s, four stage phases in the TUI
+  (implement, tests, verify, report) instead of sixteen one-action rows, 22/24
+  dispatches on `kaihk/gpt-5.6-luna`, auto-completed, 319/319; two planner
+  turns because of the false rejection above (planner turn 2: "an append-only
+  rule that the goal itself makes unsatisfiable").
+
+## 0.16.0 — the planner sets the width; a re-verify judges the repair
+
+- A re-verify after a repair round now receives the concerns it raised and the
+  repair's report, and may return ok:false only for an unresolved listed
+  concern or a regression; anything newly noticed is informational. Earned on
+  `r2vu9i`: `verify-src` round 2 rejected on two concerns round 1 never raised;
+  `verify-tests-runtime` round 2 rejected the very edit its round 1 demanded.
+  Live-proven on `bizp4s`: the one re-verify rejection was an `ENOENT`
+  regression in the acceptance checks, and its verdict opens "the two
+  original concerns are repaired".
+- A phase is a pipeline stage: rule 3 now says one kebab-case name shared by
+  its actions, never one phase per action, and the complete-program example
+  uses five phases for eight actions (`verify` holds verify-fix, verify-tests
+  and verify-suite). Earned on `bizp4s`: the planner mirrored the example and
+  wrote sixteen one-action phases — no scheduling cost (phases never gate;
+  `dependsOn` does), but a TUI phase list carrying no information.
+- Goal-4 rerun on this release (`bizp4s`, runtime `9af8fdf`, workers on
+  `kaihk/gpt-5.6-luna`): **25 min 13 s** (attempt 3: 44 min; 0.15.0: 72 min;
+  audited contract alone: 37 min), one planner turn (247 s, 16 % of wall),
+  parallelism 1.77, 3 repair rounds each fixing a real defect, 0 schema
+  retries, 0 corrections, auto-completed, 319/319, existing tests +174/−0.
+- Goal-4 rerun on the audited contract (`r2vu9i`): 36 min 58 s (attempt 3:
+  44 min; 0.15.0: 72 min), 5 parallel writers, parallelism 1.55, tests depend
+  on the implementation run rather than its verify, 0 schema retries, 0
+  corrections, auto-completed, 314/314.
+- Planner contract audited against Claude Code's workflow-authoring reference
+  (three-lens review + adversarial verification, run on the real goal-4 task
+  text) and rewritten within the same caps (rules 3,999 / examples 2,938
+  chars). New in substance: a verdict is never data (depend on the run that
+  wrote your files, not on its verify); split to the width the tree allows
+  (one worker for N independent files is N chains in series); outputSchema
+  only where a later action reads the object, never on prose; a repair edits
+  files and cannot rewrite the answer under review; workers run their unit's
+  focused command, never the full suite; the planner sets `lane` and `effort`
+  per action. The complete-program example is now valid JSON and shows tests
+  running beside the src verify. `docs/planner-prompt-audit-2026-08-29.md` §6.
+- Planner-proposed `lane`/`effort`/`requiresCapabilities` now survive the
+  gate defaults (`runner.js` spread order let `lane: build` overwrite every
+  proposal); `lane` is validated like `effort`.
+- `outputSchema` output reading tolerates a closing markdown fence after the
+  trailing JSON object, and the schema instruction says the object is an
+  INSTANCE whose keys are the `properties` names (never the schema itself).
+  Earned on the goal-4 rerun `ydpjts` (0.15.0): a stray `"type"` key and then
+  a `}\n```` tail spent the single schema retry and a 279 s planner turn on
+  an otherwise complete report (≈ 11 min).
+- Goal-4 rerun recorded in `docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md`:
+  0 repairs (attempt 3: 6), planner 17 % of wall (39 %), 326/326 — but 72 min
+  vs 44 min because every worker landed on the slowest most-behind pool and
+  the program ran serially (parallelism 1.05).
+
 ## 0.15.0 — extra Claude Code logins as separate pools
 
 - Claude Code extra logins (`~/.claude-<slug>` / `$CLAUDE_CONFIG_DIR`) become

package/README.md

@@ -289,14 +289,19 @@ bullswarm workflow watch <shortId> --verbose     # detailed agent/action view
 ```
 
 `workflow tui` is the interactive, Claude-style `/workflows` view. For an
-autonomous goal its left navigation stacks a compact Orchestrator panel above
-the Phases panel; internal planner turns never appear as workers or phases.
-Select Orchestration and press Enter, or press `o`
-anywhere, to open a summary-first orchestration overview: what it is doing now,
+autonomous goal its left navigation stacks a compact Workflow Planner panel
+above the Phases panel; internal planner turns never appear as workers or phases.
+The default desktop main panel is a timestamped workflow timeline: completed
+preflight, planner-checkpoint, phase-transition, and worker-result events stay
+above a live section containing the waiting/running Workflow Planner and workers,
+each with its latest semantic action and stream heartbeat. Planned work is kept
+in a separate Next section so it cannot be mistaken for execution evidence.
+Select Workflow Planner and press Enter, or press `o`
+anywhere, to open a summary-first planner overview: what it is doing now,
 its latest decision in plain language, why it chose that path, what happens
-next, progress, and the last three semantic actions. Press `v` to toggle the
-technical view with provider session, every checkpoint turn, usage, prompt,
-and artifact paths. Status marks are consistent throughout the tree: `○` not started,
+next, progress, and the last three semantic actions. Press `v` from the timeline
+for workflow technical state, or from Workflow Planner for provider session,
+every checkpoint turn, usage, prompt, and artifact paths. Status marks are consistent throughout the tree: `○` not started,
 an animated Braille spinner for active work, `⧖` waiting, `✓` finished, and
 `✗` failed or interrupted. The non-emoji `⧖` avoids the inconsistent cell
 width of `⌛` across terminal fonts. It watches ongoing runs from disk and supports `j`/`k` or arrow-key selection, Enter for

package/docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md

@@ -169,3 +169,185 @@ report → verify-final, `completion: all-actions-ok`. Wall is within noise of b
 model time: probe 4.7 min, guards 5.1 min, verify-guards 4.7 min); the planner side is faster and 5× smaller.
 Zero observation crashes across four runs of TUI/watch/runs/result/static-tui polling and a 20 s stress loop
 (1,681 paints against the live writer, 0 torn, 0 throws).
+
+## Goal-4 rerun on 0.15.0 — `ydpjts` (wf-mte8azjz-bcb079), 10:19:31 → 11:31:48 Z — reliability PASS, speed FAIL
+
+Same goal text (`goal4.txt`), same flags (`--orchestrator claude-code --concurrency 8 --max-agents 40
+--max-expansion-rounds 8`), fresh fixture `g4-bs-v2` = `git archive a0f0965` (v0.13.2, 299/299, no `schema.js`) on
+branch `feat/output-schema`, default `~/.bullswarm` home, runtime `bullswarm-rt` @ 728231d (v0.15.0).
+
+| metric | attempt 3 (0.13.2) | **rerun (0.15.0)** |
+| --- | ---: | ---: |
+| outcome | auto-completed after planner turn 2 | **auto-completed** after a 2-action recovery program |
+| wall | 44 min 17 s | **72 min 14 s** (4 334 s) |
+| planner turns / plannerSec | 2 / 1 045 s (39 %; turn 1 = 634 s) | **2 / 755 s (17 %)** — 476 s + 279 s; completion recorded by the runtime |
+| planner context (turn 1 / turn 2) | — | 12.9 k / 41.5 k chars (`decision.context_built`) |
+| dispatches | 28 (26 opencode2 + 2 planner) | **13** — 2 planner (opus-5) + 11 workers (sonnet-5), all on `claude-code` |
+| max concurrent / parallelism | 5 / 1.5 | **2 / 1.05** |
+| repairs | 6 (4 unrepairable: process-criteria rejections) | **0** — every verify ok:true first round |
+| corrections / rejections / verdict re-asks | 0 / 0 / — | 0 / 0 / 0 |
+| schema retries | — | 1 (`report`; both attempts failed, see below) |
+| tests after | 318/318 (299 + 19) | **326/326** (299 + 27); existing test files extended only (+281 / −0); no commit; version untouched |
+
+Program (turn 1, 476 s): `impl-src` ∥ `docs` → `verify-src`(repair 2) / `verify-docs`(repair 1) → `tests` →
+`verify-tests`(repair 2) → `report`(outputSchema) → `verify-report`(repair 1, `review` defaulted), `completion`
+attached. Three verifies omitted `review` and were accepted (0.14.1 defaulting) — the same omission cost a 5-minute
+correction turn on proof runs 1 and 3. Rule 8 honoured (last worker covered by a verify).
+
+Verifier behaviour is what 0.14.x was meant to produce: `verify-src` passed with a disclosed deviation
+(`programFeatures` literal not extended because `tests/workflow-adaptive.test.js:206` regex-locks it and the goal
+forbids modifying existing assertions) instead of rejecting on a process criterion; `verify-tests` flagged the filler
+prose workaround as a concern, not a failure.
+
+**The one failure and its cost (≈ 11.4 min):** `report` carried an `outputSchema`. Attempt 1 ended with an object
+carrying a stray `"type"` key copied from the schema (`additionalProperties:false` → `type is not allowed`, correct).
+The single retry ended `}\n\`\`\`` — a closing markdown fence — and `readTrailingObject` refused it as "did not end
+with a JSON object" → `report` ok:false → `verify-report` blocked → `decision.completion_predicate_unmet` → planner
+turn 2 (279 s), which diagnosed it correctly and re-delivered the report without a schema. Fixed in `393a914`:
+trailing fences are stripped before the object is read, and the instruction says the object is an INSTANCE whose keys
+are the `properties` names. Unit-tested; not yet exercised live.
+
+**Where the 72 minutes went — the run was serial (parallelism 1.05):** scout 405 s → planner 476 s → `impl-src`
+**1 231 s** → `verify-src` 330 s → `tests` **951 s** → `verify-tests` 116 s → `report` 141 + 123 s → planner 279 s →
+`final-summary` 174 s → `verify-final-summary` 109 s. Two causes, neither a crash:
+1. Routing put every worker on `claude-code`/`claude-sonnet-5` because it was the most-behind capable pool
+   (pace +6.9 vs opencode2 0, `claude-code:wati` −14.8). The same `impl-src` took 398 s on `opencode2`
+   (`kaihk/gpt-5.6-luna`) in attempt 3; the read-only scout took 405 s vs 92 s. Worker model speed is not part of the
+   surplus formula.
+2. The planner proposed ONE `tests` worker after `verify-src` instead of three file-disjoint test writers in parallel
+   with the src verify (attempt 3's shape). Reliability-first, width-second: correct under the goal's single-implementer
+   constraint, but it lengthened the critical path by ~16 min.
+
+Pass conditions set before the run: ≤ 1 repair round ✓ (0); 0 process-criteria rejections ✓; auto-completed ✓;
+≤ 35 min ✗ (72 min). Reliability at 12-action complexity is now proven on ≥ 0.14.1; speed is worker-bound and
+routing-bound.
+
+## Goal-4 rerun on the audited contract — `r2vu9i` (wf-mtefmdie-b39e8f), 13:44:19 → 14:21:21 Z — **structural PASS, 36 min 58 s**
+
+Runtime `d14c1fa` (contract from the second audit, §6 of `docs/planner-prompt-audit-2026-08-29.md`, plus the runner
+lane fix); workers pinned to `opencode2`/`kaihk/gpt-5.6-luna` via `strategy assign high|medium|low` (cleared after);
+orchestrator `claude-code`/`claude-opus-5`; fresh fixture `g4-bs-v3` = a0f0965 (299/299).
+
+| metric | attempt 3 (0.13.2) | `ydpjts` (0.15.0) | **`r2vu9i` (audited contract)** |
+| --- | ---: | ---: | ---: |
+| wall | 44 min 17 s | 72 min 14 s | **36 min 58 s** (2 219 s) |
+| planner turns / plannerSec | 2 / 1 045 s (39 %) | 2 / 755 s (17 %) | 2 / 648 s (29 %) — 409 s + 238 s |
+| dispatches | 28 | 13 | 26 (24 gpt-5.6-luna workers + 2 opus planner) |
+| max concurrent / parallelism | 5 / 1.5 | 2 / 1.05 | **4 / 1.55** |
+| writers in parallel after planning | 2 (+3 test writers later) | 2 | **5** (impl-src ∥ 3 docs; 2 test writers as soon as impl-src landed) |
+| repairs (rounds / repaired ok / re-verify rejected) | 6 / 2 / 4 | 0 | 4 / 2 / 2 |
+| schema retries / corrections / verdict re-asks | — / 0 / — | 1 / 0 / 0 | **0 / 0 / 0** |
+| tests after | 318 | 326 | **314/314** (299 + 15); existing tests +167 / −1 (one assertion extended, as goal item 5 requires); no commit; version untouched |
+
+Structural pass conditions (set before launch): `tests-*` depend on `impl-src`, not `verify-src` ✓ (the planner's own
+reason: "two file-disjoint test workers depend on that run (not its verify)"); more than one file-disjoint writer ✓ (5);
+parallelism ≥ 1.5 ✓ (1.55); 0 corrections ✓; 0 schema retries ✓ (the report carried no schema); auto-completed ✓;
+≥ 299 tests, existing tests extended only ✓. Failed: 0 repairs ✗ (4 rounds). Lane/effort proposed by the planner reached
+dispatch (`docs-changelog` routed `chore`/`low`) — the runner merge fix is live. `accept-suite` was a verify with no
+dependsOn — the first live exercise of the repository-scope branch.
+
+Where the four repair rounds went, and what each says:
+- `verify-tests-schema` round 1: missing invalid-`minimum` case → repaired, re-verify ok. Legitimate; cost 49 + 30 s.
+- `verify-src` round 1: a real defect (`recordOutput` dropped `data`/`schemaOk`, breaking resume-safety) → repaired.
+  Legitimate. Round 2 then rejected on two concerns round 1 never raised (enum structural equality, root-path naming)
+  → repaired, re-verify ok. **Moving goalposts**: 92 + 268 s spent on nits that should have been round-1 concerns.
+- `verify-tests-runtime` round 1: acceptance command failed on the pre-existing `workflow-adaptive.test.js:206`
+  assertion (goal item 5 requires extending it) → the repair extended it → round 2 rejected BECAUSE an existing test
+  was modified — a process criterion the planner had written into the verify prompt ("append tests only") that
+  contradicts the goal. Unrepairable by construction → `verify-suite`/report blocked → planner turn 2 (238 s), which
+  diagnosed "a false rejection" and recovered in 207 s. Cost ≈ 10 min.
+Fix shipped after the run (`9af8fdf`, unit-tested, not yet live): a re-verify receives the concerns it raised and the
+repair's report and may reject only for an unresolved listed concern or a regression — both round-2 rejections above
+become informational under it.
+
+Speed accounting vs `ydpjts`: worker pool (gpt-5.6-luna vs sonnet-5) and width together took the critical path from
+72 to ~27 min of productive work; the remaining ~10 min is the verifier-behaviour waste above.
+
+## Goal-4 rerun with the re-verify fix — `bizp4s` (wf-mtehhbwd-7db3de), 14:36:26 → 15:01:39 Z — **PASS, 25 min 13 s**
+
+Runtime `9af8fdf` (audited contract + runner lane fix + re-verify scoping); workers pinned to
+`opencode2`/`kaihk/gpt-5.6-luna` via `strategy assign high|medium|low` (cleared after, assignments `{}`); orchestrator
+`claude-code`/`claude-opus-5`; fresh fixture `g4-bs-v4` = a0f0965 (299/299, cloned clean from the v3 fixture commit).
+
+| metric | attempt 3 (0.13.2) | `ydpjts` (0.15.0) | `r2vu9i` (audited contract) | **`bizp4s` (+ re-verify fix)** |
+| --- | ---: | ---: | ---: | ---: |
+| wall | 44 min 17 s | 72 min 14 s | 36 min 58 s | **25 min 13 s** (1 513 s) |
+| planner turns / plannerSec | 2 / 1 045 s (39 %) | 2 / 755 s (17 %) | 2 / 648 s (29 %) | **1 / 247 s (16 %)** |
+| dispatches | 28 | 13 | 26 | 23 (22 gpt-5.6-luna + 1 opus planner) |
+| max concurrent / parallelism | 5 / 1.5 | 2 / 1.05 | 4 / 1.55 | **4 / 1.77** |
+| writers in parallel after planning | 2 (+3) | 2 | 5 | 4 (impl-src ∥ 3 docs), then 2 test writers ∥ verify-src the moment impl-src landed |
+| repairs (rounds / repaired ok / re-verify rejected) | 6 / 2 / 4 | 0 | 4 / 2 / 2 | 3 / 2 / 1 — every rejection a real defect |
+| schema retries / corrections / verdict re-asks | — / 0 / — | 1 / 0 / 0 | 0 / 0 / 0 | **0 / 0 / 0** |
+| tests after | 318 | 326 | 314/314 | **319/319** (299 + 20); existing tests +174 / −0; no commit; version untouched |
+
+Program (one decision, 15 actions + completion): `impl-src`(build/high) ∥ `doc-changelog`(chore/low) ∥
+`doc-skill`(chore/low) ∥ `doc-mechanics`(chore/medium), each doc with its own analyze/low verify; `test-schema`
+(build/medium), `test-runtime`(build/high) and `verify-src`(analyze/high) all `dependsOn: ["impl-src"]`; `verify-suite`
+(analyze/low) on the six unit verifies; `report`(chore/low, no schema) → `verify-report`(analyze/medium);
+`completion: all-actions-ok`. Every planner-set effort tier reached dispatch (`configured <tier> assignment`).
+`decision.auto_completed` — the planner was consulted exactly once.
+
+The three repair rounds, and why none is verifier waste:
+- `verify-src` round 1 (ok:false): `validateWorkflow` did not check `stepTemplate.outputSchema` and the runtime ignored it
+  during fan-out — the fan-out half of the goal was unimplemented. Repair 197 s.
+- `verify-src` re-verify round 1 (ok:false, `action.reverify_rejected`): the repair's schema-retry path handed dispatch a
+  file name that dispatch re-suffixed `-attempt-2`, so the runtime read a nonexistent file (`ENOENT`; 3 focused tests
+  failing). A regression in the acceptance checks — exactly the rejection the new scoping still allows. The task text
+  carried `RE-VERIFY round 1 of 2 … Concerns you raised (verbatim):` with round 1's concerns, and the verdict's summary
+  opens "The two original fan-out concerns are repaired" — the verifier judged the repair, as instructed. Repair 177 s;
+  round 2 re-verify ok (52/52 focused).
+- `verify-test-schema` round 1 (ok:false): no invalid-value case per supported keyword. Repair 63 s, re-verify ok.
+- `verify-test-runtime` accepted first time: the goal's item-5 assertion was satisfied without touching an existing test
+  (+174 / −0), so the "append only" tension of `r2vu9i` never arose.
+
+Pass conditions (set before `r2vu9i`): tests depend on `impl-src` ✓; > 1 file-disjoint writer ✓ (4, then 2 more);
+parallelism ≥ 1.5 ✓ (1.77); 0 corrections ✓; 0 schema retries ✓; auto-completed ✓; ≥ 299 tests, existing tests only
+extended ✓. "0 repairs" ✗ as a literal count (3), but the condition's intent — no repair round that a verifier caused —
+is met: each round fixed a defect the deliverable needed fixed. Prediction before launch was "the two moving-goalpost
+rounds and the 10-min recovery turn vanish, wall ≈ 30 min"; observed 25 min 13 s with one planner turn.
+
+Cost: 22 of 23 dispatches on the unmetered opencode2 seat; Claude quota spent on one 247 s planner turn.
+
+## Goal-4 rerun on v0.16.0 (phase = stage) — `euh622` (wf-mtej85ws-18a3c0), 15:25:14 → 16:01:14 Z — **36 min 00 s, auto-completed; one planner-authored false rejection cost the recovery turn**
+
+Runtime `4bfd7f4` = released v0.16.0 (rule 3 "a phase is a pipeline stage … never one per action"); workers pinned to
+`opencode2`/`kaihk/gpt-5.6-luna` (cleared after); orchestrator `claude-code`/`claude-opus-5`; fresh fixture `g4-bs-v5`.
+
+| metric | `r2vu9i` | `bizp4s` | **`euh622`** |
+| --- | ---: | ---: | ---: |
+| wall | 36 min 58 s | 25 min 13 s | 36 min 00 s (2 157 s) |
+| planner turns / plannerSec | 2 / 648 s | 1 / 247 s | 2 / 728 s (34 %) — 462 s + 266 s |
+| dispatches | 26 | 23 | 24 (22 luna + 2 opus) |
+| max concurrent / parallelism | 4 / 1.55 | 4 / 1.77 | 4 / 1.5 |
+| phases in the TUI | 19 one-action rows | 16 one-action rows | **4 stages** (implement 2, tests 3, verify 6 + repairs, report 2) + 2 recovery phases |
+| repairs (rounds / repaired ok / re-verify rejected) | 4 / 2 / 2 | 3 / 2 / 1 | 4 / 2 / 2 |
+| tests after | 314 | 319 | **319/319**; existing tests +116/−1 (the mandated `:206` extension) and +153/−0 |
+
+What the phase change did: the planner wrote `implement` (impl ∥ docs), `tests` (three test writers), `verify` (six
+verifies), `report` — the layout asked for, with no scheduling change (impl ∥ docs started together; three test writers
+and verify-impl started the second impl landed; verify-docs ran while impl was still running). Width was one docs
+worker (three files merged; off the critical path) but three test writers — comparable to `bizp4s`.
+
+The four repair rounds:
+- `verify-impl` r1: fan-out items dispatched through plain `dispatch()`, so `stepTemplate.outputSchema` was never applied
+  — real. Re-verify rejected: the repair tested `step.outputSchema` instead of `itemStep.outputSchema` — the listed
+  concern still unresolved, exactly the rejection the re-verify rule permits. r2 repaired; re-verify ok.
+- `verify-test-runtime` r1: the retry case did not assert the `errors` payload of `action.output_schema_retry` — real.
+- `verify-test-refs` r1: the acceptance command failed on the pre-existing assertion at `workflow-adaptive.test.js:206`
+  (`programFeatures` pinned to three entries) because goal item 5 mandates adding `outputSchema` to it. The repair
+  extended the assertion (+116/−1). Re-verify rejected BECAUSE an existing assertion changed — the planner had written
+  "EXTEND BY APPENDING new test cases only" into `test-refs` and "shows APPENDED cases only" into `verify-test-refs`,
+  and "Do NOT modify existing tests" into `impl`, while the goal says "do NOT modify existing tests except to extend
+  them". No worker owned the assertion; the verifier treated its prompt's rule as an unresolved concern. `verify-suite`,
+  `report`, `verify-report` blocked → planner turn 2 (266 s), whose reason is exact: "verify-test-refs ended ok:false
+  on an append-only rule that the goal itself makes unsatisfiable — goal item 5 mandates adding 'outputSchema' to
+  programFeatures". Recovery program `verify-suite-full` → `final-report` → `verify-final-report`, auto-completed.
+  Third occurrence of this shape (attempt 3, `r2vu9i`, here); `bizp4s` avoided it only because its implementation
+  happened to keep the old assertion true.
+
+Cost of the false rejection: the 266 s planner turn plus the serialised tail ≈ 5–6 min; the rest of the gap to
+`bizp4s` is variance (planner turn 1 462 s vs 247 s on the same contract; `impl` 445 s vs 377 s).
+
+Fix committed after the run, unreleased (`71960ae`): rule 7 — "A verify checks the goal's own acceptance criteria …
+never add a process rule the goal does not state (append-only, tests untouched); when the implementation changes what
+an existing assertion pins, a worker must own updating it." Proof pending a rerun on that commit.

package/docs/planner-prompt-audit-2026-08-29.md

@@ -155,3 +155,36 @@ Deliverables:
   context and the separate run-state/TUI attempt view, but does not document a
   renamed/dropped planner-context field shape such as the old attempt records
   or an old `failures` representation.
+
+## 6. Second audit — after the goal-4 rerun on 0.15.0 (`ydpjts`)
+
+Method: a Claude Code dynamic workflow (12 agents, 16 min) reviewed the COMPLETE turn-1 task text of run `ydpjts`
+(19,577 chars; 6,199-char prefix) and the program the planner wrote, from three lenses — width/critical path,
+worker-prompt authoring, clarity vs Claude's own workflow-authoring reference — and adversarially verified every new
+finding (refute-framed, source-checked). 3 known + 6 new findings survived; 2 were refuted (one because `lane` was
+dead text — see the runtime defect below — one for deleting a must-keep rule).
+
+What the planner received said nothing wrong; it said too little in three places, and the example showed a linear
+program:
+
+| finding | evidence on `ydpjts` | contract change |
+| --- | --- | --- |
+| a verify's verdict was treated as a dependency | `tests` dependsOn `verify-src`; 330 s idle | rule 3: "a worker depends on the run that wrote its input files, never on that run's verify (a verdict is not data)" |
+| width framed only as "known N items" | one `tests` worker, 951 s, where three file-disjoint writers were allowed | rule 4: "each file-disjoint unit ... one worker for N independent files is N chains in series" |
+| outputSchema invited on a prose report | `report` schema → stray key, then fenced tail → retry + planner turn (≈ 685 s) | rule 6: schema only where a later action reads the object; prose gets none |
+| repair cannot rewrite an answer under review (new) | `verify-report` repair prompt asked the worker to "restate the report" — unreadable by design (`repairAndReverify` re-reads the original outFile) | rule 7: "the repair edits files and cannot rewrite the answer under review, so reject only what a file edit can fix" |
+| workers demanded `npm test` as acceptance (new) | `tests` prompt: "No other worker is editing the tree while you run" | shared-tree line: unit's focused command, never the full suite |
+| no guidance on `effort`/`lane` (new) | every action ran at build/medium | rule 10: planner sets lane and effort; they pick the model tier |
+| example program was linear and not valid JSON (new) | — | example rewritten: `{"actions":[…],"completion":…}`, tests depend on fix and run beside verify-fix, lane/effort shown |
+| runtime: planner `lane` silently overwritten (new) | `runner.js` merged `{...action, ...actionDefaults}` so `lane: build` won | fixed: action overrides gate defaults; addDir stays runtime-owned; `lane` validated |
+
+Sizes after: rules **3,999** (cap 4,000), examples **2,938** (cap 3,000). Every rule still stated once with its reason.
+Acceptance: goal-4 rerun on the new contract with workers pinned to `opencode2`/`kaihk/gpt-5.6-luna` (strategy
+assignments high/medium/low, cleared after) — structural pass conditions: tests depend on `impl-src` not
+`verify-src`; more than one file-disjoint writer; parallelism ≥ 1.5; 0 repairs / corrections / schema retries;
+auto-completed; ≥ 299 tests, existing tests extended only; wall reported with the pool mix.
+
+Outcome: `r2vu9i` (runtime `d14c1fa`) met every structural condition except "0 repairs" (4 rounds, 2 of them verifier
+moving-goalposts → re-verify scoping `9af8fdf`); `bizp4s` (runtime `9af8fdf`) then ran in 25 min 13 s with one planner
+turn (247 s), parallelism 1.77, 3 repair rounds each fixing a real defect, 0 schema retries / corrections, 319/319.
+Details in `docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bullswarm",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Route work across coding-agent CLI subscriptions — paced by live quota meters, verified by content, never trusting exit codes.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -277,8 +277,12 @@ supports explicit model selection, Bullswarm pins an allowed model in the same
 effort tier; otherwise that pool is excluded because its implicit default
 cannot be guaranteed. Restore eligibility with `strategy include-model`.
 
-In the human TUI, the autonomous orchestrator has a compact selectable panel
-stacked above the phase tree. Select it and press Enter, or press
+In the human TUI, the autonomous orchestrator is presented as Workflow Planner
+in a compact selectable panel stacked above the phase tree. The default desktop
+view pairs that unchanged navigation with a timestamped workflow timeline:
+finished events stay above a live Planner/worker section with each participant's
+latest semantic action, while unexecuted work stays in a separate Next section.
+Select Workflow Planner and press Enter, or press
 `o`, to see a summary-first overview of its current role, latest decision,
 reason, next action, progress, and recent semantic activity. Press `v` for the
 durable provider session, checkpoint prompts and turns, usage, and artifact

package/src/help.js

@@ -676,8 +676,9 @@ const workflowInspectText = rich({
 
 const workflowTuiText = rich({
   usage: 'bullswarm workflow tui [<runId>] [--json] [--all] [--show <runId>] [--cancel <runId>]',
-  purpose: 'Open the interactive full-screen phase → agent → step/detail browser for ongoing '
-    + 'and historical runs, or print a static/JSON snapshot for a non-interactive caller.',
+  purpose: 'Open the interactive full-screen workflow timeline with Workflow Planner, phase, '
+    + 'live-agent, and technical drill-down views for ongoing and historical runs, or print a '
+    + 'static/JSON snapshot for a non-interactive caller.',
   args: [{ name: '[<runId>]', desc: 'shortId or runId to open directly in detail view; omit to see the run picker' }],
   options: [
     { flag: '--json', desc: "print a JSON snapshot instead of opening the interactive browser (list of ongoing runs, or one run's state/report/events when a runId is given)", default: "opens the interactive browser on a TTY; without a TTY, a given runId instead prints one static text detail tree" },
@@ -689,6 +690,7 @@ const workflowTuiText = rich({
     'interactive mode and the --json/--show/--all views are read-only',
     '--cancel writes state.json (cancelRequested=true, status=cancelling) — cooperative, not a force-kill: the workflow stops at its next safe checkpoint',
     'inside the interactive browser, q detaches without stopping the underlying workflow; c requests the same cancellation with a confirmation prompt',
+    'the default timeline is derived from durable state and events; press v for raw action-ledger and event evidence',
   ],
   examples: [
     { cmd: 'bullswarm workflow tui', note: 'interactive run picker' },

package/src/workflow/dashboard.js

@@ -259,6 +259,8 @@ export function workflowPanelModel(row, {
   const isControlAction = (action) => orchestrator.autonomous
     && action.id === orchestrator.actionId
     && action.kind === 'decide';
+  const isPreflightAction = (action) => orchestrator.autonomous && action.id === 'scout';
+  const isNonPhaseAction = (action) => isControlAction(action) || isPreflightAction(action);
   const phaseNames = [];
   const addPhase = (name) => {
     if (name && !phaseNames.includes(name)) phaseNames.push(name);
@@ -266,12 +268,13 @@ export function workflowPanelModel(row, {
   for (const phase of state._doc?.phases ?? []) {
     const controlOnly = orchestrator.autonomous
       && (phase.steps ?? []).length
-      && (phase.steps ?? []).every((step) => step.id === orchestrator.actionId && step.type === 'decide');
+      && (phase.steps ?? []).every((step) =>
+        (step.id === orchestrator.actionId && step.type === 'decide') || step.id === 'scout');
     if (!controlOnly) addPhase(phase.name);
   }
-  for (const action of ledger) if (!isControlAction(action)) addPhase(action.phase);
-  for (const step of state.steps ?? []) if (step.stepId !== orchestrator.actionId) addPhase(step.phase);
-  if (state.currentStep?.id !== orchestrator.actionId) addPhase(state.currentStep?.phase);
+  for (const action of ledger) if (!isNonPhaseAction(action)) addPhase(action.phase);
+  for (const step of state.steps ?? []) if (step.stepId !== orchestrator.actionId && step.stepId !== 'scout') addPhase(step.phase);
+  if (state.currentStep?.id !== orchestrator.actionId && state.currentStep?.id !== 'scout') addPhase(state.currentStep?.phase);
   if (!orchestrator.autonomous) addPhase(state.currentPhase?.name);
   if (!phaseNames.length) phaseNames.push(orchestrator.autonomous ? 'execution' : 'starting');
 
@@ -283,7 +286,7 @@ export function workflowPanelModel(row, {
     phaseNames.length - 1,
   );
   const phases = phaseNames.map((name) => {
-    const actions = ledger.filter((action) => action.phase === name && !isControlAction(action));
+    const actions = ledger.filter((action) => action.phase === name && !isNonPhaseAction(action));
     const effectiveStatuses = actions.map((action) => effectiveActionStatus(action, state));
     const completed = effectiveStatuses.filter((status) => TERMINAL_ACTIONS.has(status)).length;
     const failed = effectiveStatuses.filter((status) => String(status).startsWith('failed')).length;
@@ -322,6 +325,11 @@ export function workflowPanelModel(row, {
   }
   for (const [key, active] of Object.entries(state.activeAgents ?? {})) {
     if (representedActiveKeys.has(key)) continue;
+    // The autonomous orchestrator is a control-plane thread, not a worker in
+    // whichever execution phase happens to be selected. It has its own panel.
+    // Without this guard, an active checkpoint is re-added below a completed
+    // phase when both share the durable `autonomous-delivery` phase name.
+    if (orchestrator.autonomous && active.stepId === orchestrator.actionId) continue;
     const action = ledger.find((entry) => entry.id === active.stepId || active.stepId?.startsWith(`${entry.id}[`));
     if ((action?.phase ?? state.currentPhase?.name) !== selectedPhase.name) continue;
     agents.push({
@@ -355,10 +363,12 @@ export function renderWorkflowTui(row, {
   width = 120, height = 36, focus = 0, phaseIndex = null, agentIndex = null,
   detailScroll = 0, message = null, confirmCancel = false,
   controlSelected = false, orchestratorDetail = false, orchestratorVerbose = false,
+  workflowVerbose = false,
   spinnerFrame = 0,
 } = {}) {
-  width = Math.max(38, Number(width) || 120);
+  width = Math.max(20, Number(width) || 120);
   height = Math.max(18, Number(height) || 36);
+  const narrow = width < 100;
   const model = workflowPanelModel(row, { phaseIndex, agentIndex });
   const state = model.state;
   const status = row?.status ?? state.status ?? 'starting';
@@ -372,17 +382,21 @@ export function renderWorkflowTui(row, {
   const terminalLabel = state.finishedAt ? ` · ${status === 'completed' ? 'done' : status}` : '';
   const runName = state.workflow ?? row?.shortId ?? state.shortId ?? row?.runId ?? 'workflow';
   const header = [
-    ` ${truncate(runName, Math.max(1, width - agentProgress.length - elapsed.length - terminalLabel.length - 5))} · ${agentProgress}${elapsed}${terminalLabel}`,
+    truncate(` ${truncate(runName, Math.max(1, width - agentProgress.length - elapsed.length - terminalLabel.length - 5))} · ${agentProgress}${elapsed}${terminalLabel}`, width),
     ` ${truncate(state.intent?.goal ?? state.workflow ?? 'workflow', width - 2)}`,
   ];
   const footer = confirmCancel
     ? ' Stop this workflow? y confirm · n/Esc keep running'
     : orchestratorDetail
       ? ` ↑/↓ scroll · v ${orchestratorVerbose ? 'overview' : 'technical details'} · Esc back · c stop · q detach`
-      : ` ↑/↓ select · Enter drill in · Esc back · o orchestrator · c stop · q detach`;
+      : workflowVerbose
+        ? ' ↑/↓ scroll · v overview · Esc back · c stop · q detach'
+        : narrow
+          ? ' ↑/↓ select · Enter inspect · Esc back · o planner · v technical · c stop · q detach'
+          : ' ↑/↓ select · PgUp/PgDn timeline · Enter inspect · ←/→ switch · v technical · q detach';
   const rawMessageLine = message
     ? ` ${truncate(message, width - 2)}`
-    : ` ${orchestratorDetail ? `Orchestrator ${orchestratorVerbose ? 'technical details' : 'overview'}` : focus === 0 ? 'Phases' : focus === 1 ? 'Agents' : 'Agent activity'} · r refresh · workflow continues after detach`;
+    : ` ${orchestratorDetail ? `Workflow Planner ${orchestratorVerbose ? 'technical details' : 'overview'}` : workflowVerbose ? 'Workflow technical details' : focus === 0 ? (narrow ? 'Phases' : 'Timeline · auto-following newest event') : focus === 1 ? 'Agents' : 'Agent activity'} · r refresh · workflow continues after detach`;
   const messageLine = truncate(rawMessageLine, width);
   const bodyHeight = Math.max(10, height - header.length - 3);
 
@@ -414,7 +428,6 @@ export function renderWorkflowTui(row, {
 
   // Two information-rich panes become counterproductive on typical 80-column
   // SSH/mobile terminals. Keep the drill-down full-width below 100 columns.
-  const narrow = width < 100;
   const leftWidth = narrow ? width : Math.max(24, Math.min(34, Math.floor(width * 0.27)));
   const rightWidth = narrow ? width : width - leftWidth;
   const orchestrationLines = orchestratorDetailLines(
@@ -426,8 +439,10 @@ export function renderWorkflowTui(row, {
   const detail = orchestratorDetail
     ? orchestrationLines
     : agentDetailLines(model, Math.max(20, rightWidth - 4), spinnerFrame);
+  const technical = workflowTechnicalLines(model, Math.max(20, rightWidth - 4));
   const contentHeight = bodyHeight - 2;
-  const maxScroll = Math.max(0, detail.length - contentHeight);
+  const scrollSource = workflowVerbose ? technical : detail;
+  const maxScroll = Math.max(0, scrollSource.length - contentHeight);
   const scroll = clamp(detailScroll, 0, maxScroll);
   const visiblePhases = panelWindow(['', ...phaseLines], model.phaseIndex, 1, contentHeight).slice(1);
   const visibleAgents = panelWindow(['', ...agentLines], model.agentIndex, 1, contentHeight).slice(1);
@@ -436,7 +451,7 @@ export function renderWorkflowTui(row, {
   const orchestrationNavLines = model.orchestrator.autonomous
     ? [
       selectLine(
-        `${statusIcon(model.orchestrator.active ? 'running' : model.orchestrator.status, spinnerFrame)} Orchestration · ${model.orchestrator.status}`,
+        `${statusIcon(model.orchestrator.active ? 'running' : model.orchestrator.status, spinnerFrame)} ${plannerDisplayStatus(model)}`,
         controlSelected,
         focus === 0 && !orchestratorDetail,
         leftWidth - 2,
@@ -445,6 +460,7 @@ export function renderWorkflowTui(row, {
         [model.orchestrator.pool, model.orchestrator.model].filter(Boolean).join(' · ') || 'select to inspect',
         leftWidth - 2,
       ),
+      dimLine(plannerUsageSummary(model), leftWidth - 2),
     ]
     : [];
   const narrowWorkflowLines = model.orchestrator.autonomous
@@ -457,7 +473,19 @@ export function renderWorkflowTui(row, {
 
   let body;
   if (orchestratorDetail) {
-    body = renderPanel(`Orchestrator · ${orchestratorVerbose ? 'technical details' : 'overview'}`, visibleDetail, width, bodyHeight);
+    body = renderPanel(`Workflow Planner · ${orchestratorVerbose ? 'technical details' : 'overview'}`, visibleDetail, width, bodyHeight);
+  } else if (workflowVerbose) {
+    const visibleTechnical = technical.slice(scroll, scroll + contentHeight);
+    if (narrow) body = renderPanel('Workflow technical details', visibleTechnical, width, bodyHeight);
+    else {
+      const left = model.orchestrator.autonomous
+        ? [
+          ...renderPanel('Workflow Planner', orchestrationNavLines, leftWidth, 5),
+          ...renderPanel(phaseTitle, visiblePhases, leftWidth, bodyHeight - 5),
+        ]
+        : renderPanel(phaseTitle, visiblePhases, leftWidth, bodyHeight);
+      body = joinPanels(left, renderPanel('Workflow technical details', visibleTechnical, rightWidth, bodyHeight));
+    }
   } else if (narrow) {
     const mobile = focus === 0
       ? {
@@ -473,15 +501,17 @@ export function renderWorkflowTui(row, {
   } else if (focus < 2) {
     const left = model.orchestrator.autonomous
       ? [
-        ...renderPanel('Orchestrator', orchestrationNavLines, leftWidth, 5),
+        ...renderPanel('Workflow Planner', orchestrationNavLines, leftWidth, 5),
         ...renderPanel(phaseTitle, visiblePhases, leftWidth, bodyHeight - 5),
       ]
       : renderPanel(phaseTitle, visiblePhases, leftWidth, bodyHeight);
     body = joinPanels(
       left,
       controlSelected
-        ? renderPanel(`Orchestration · ${model.orchestrator.status}`, orchestrationLines.slice(0, contentHeight), rightWidth, bodyHeight)
-        : renderPanel(agentTitle, visibleAgents, rightWidth, bodyHeight),
+        ? renderPanel(`Workflow Planner · ${model.orchestrator.status}`, orchestrationLines.slice(0, contentHeight), rightWidth, bodyHeight)
+        : focus === 0
+          ? renderWorkflowOverviewPanel(model, rightWidth, bodyHeight, spinnerFrame, detailScroll)
+          : renderPanel(agentTitle, visibleAgents, rightWidth, bodyHeight),
     );
   } else {
     body = joinPanels(
@@ -508,6 +538,349 @@ function joinPanels(left, right) {
   return left.map((line, index) => `${line}${right[index] ?? ''}`);
 }
 
+function renderWorkflowOverviewPanel(model, width, height, spinnerFrame, timelineScroll = 0) {
+  const inner = Math.max(1, width - 2);
+  const timeline = workflowTimelineLines(model, inner);
+  const live = workflowLiveLines(model, inner, spinnerFrame);
+  const next = workflowNextLines(model, inner);
+  const contentRows = Math.max(3, height - 4); // outer border + two section dividers
+  const nextRows = Math.min(next.length, 2);
+  const liveRows = Math.min(live.lines.length, Math.max(2, Math.floor(contentRows * 0.42)));
+  const timelineRows = Math.max(1, contentRows - liveRows - nextRows);
+  const maxTimelineScroll = Math.max(0, timeline.lines.length - timelineRows);
+  const scroll = clamp(timelineScroll, 0, maxTimelineScroll);
+  const start = Math.max(0, timeline.lines.length - timelineRows - scroll);
+  let visibleTimeline = timeline.lines.slice(start, start + timelineRows);
+  if (start > 0 && visibleTimeline.length) {
+    visibleTimeline[0] = dimText(`↑ ${start + 1} earlier timeline rows`, inner);
+  }
+  if (start + timelineRows < timeline.lines.length && visibleTimeline.length) {
+    visibleTimeline[visibleTimeline.length - 1] = dimText(`↓ ${timeline.lines.length - start - timelineRows + 1} newer timeline rows`, inner);
+  }
+  const visibleLive = live.lines.slice(0, liveRows);
+  const visibleNext = next.slice(0, nextRows);
+  const title = ` Workflow timeline · ${timeline.milestoneCount} milestone${timeline.milestoneCount === 1 ? '' : 's'} `;
+  const rows = [`┌${truncate(title, inner)}${'─'.repeat(Math.max(0, inner - truncate(title, inner).length))}┐`];
+  for (const line of visibleTimeline) rows.push(`│${panelCell(line, inner)}│`);
+  while (rows.length < 1 + timelineRows) rows.push(`│${panelCell('', inner)}│`);
+  rows.push(sectionDivider(`Live · ${live.running} running · ${live.waiting} waiting`, inner));
+  for (const line of visibleLive) rows.push(`│${panelCell(line, inner)}│`);
+  while (rows.length < 2 + timelineRows + liveRows) rows.push(`│${panelCell('', inner)}│`);
+  rows.push(sectionDivider('Next', inner));
+  for (const line of visibleNext) rows.push(`│${panelCell(line, inner)}│`);
+  while (rows.length < height - 1) rows.push(`│${panelCell('', inner)}│`);
+  rows.push(`└${'─'.repeat(inner)}┘`);
+  return rows.slice(0, height);
+}
+
+function sectionDivider(label, inner) {
+  const text = truncate(` ${label} `, inner);
+  return `├${text}${'─'.repeat(Math.max(0, inner - text.length))}┤`;
+}
+
+function workflowTimelineLines(model, width) {
+  const { state, orchestrator } = model;
+  const ledger = state.actionLedger ?? [];
+  const events = [];
+  const add = (at, lines, sequence = Number.MAX_SAFE_INTEGER) => {
+    if (!at) return;
+    events.push({ at, sequence, lines: Array.isArray(lines) ? lines : [lines] });
+  };
+  const scout = ledger.find((action) => action.id === 'scout');
+  add(state.startedAt, [
+    timelineRow(state.startedAt, '● Workflow initiated', '', width),
+    timelineDetail(scout ? 'Goal accepted; preparing repository reconnaissance' : 'Execution started', width),
+  ]);
+
+  const scoutStartedAt = actionStartedAt(state, scout);
+  const scoutFinishedAt = actionFinishedAt(state, scout);
+  if (scoutStartedAt) {
+    add(scoutStartedAt, [
+      timelineRow(scoutStartedAt, '● [Preflight: Scout] started', '', width),
+      timelineDetail('Read-only repository and capability inspection', width),
+    ]);
+  }
+  if (scoutFinishedAt && TERMINAL_ACTIONS.has(effectiveActionStatus(scout, state))) {
+    const attempt = latestAttemptForAction(state, scout);
+    const metadata = [attempt?.pool, attempt?.model, tokenText(attempt?.usage)].filter(Boolean).join(' · ');
+    add(scoutFinishedAt, [
+      timelineRow(scoutFinishedAt, `${statusIcon(effectiveActionStatus(scout, state))} [Preflight: Scout] completed`, durationText(scoutStartedAt, scoutFinishedAt), width),
+      ...(metadata ? [timelineDetail(metadata, width)] : []),
+    ]);
+  }
+
+  orchestrator.attempts.forEach((attempt, index) => {
+    if (!attempt.finishedAt || !TERMINAL_ACTIONS.has(attempt.status)) return;
+    const decision = decisionForPlannerAttempt(state, attempt, index, orchestrator.attempts);
+    const summary = decision?.reason ? sentencePreview(decision.reason, Math.max(30, width - 10))
+      : decision ? decisionLabel(decision.decision) : 'No accepted decision; correction or retry turn';
+    add(attempt.finishedAt, [
+      timelineRow(attempt.finishedAt, `◆ [Workflow Planner] checkpoint #${index + 1}`, durationText(attempt.startedAt, attempt.finishedAt), width),
+      timelineDetail(summary, width),
+    ]);
+  });
+
+  const phases = new Map();
+  for (const action of ledger) {
+    if (action.id === 'scout' || (orchestrator.autonomous && action.id === orchestrator.actionId && action.kind === 'decide')) continue;
+    if (!action.phase) continue;
+    if (!phases.has(action.phase)) phases.set(action.phase, []);
+    phases.get(action.phase).push(action);
+  }
+  for (const [name, actions] of phases) {
+    const realStart = earliestTimestamp(actions.map((action) => actionStartedAt(state, action)));
+    const startedAt = realStart ?? earliestTimestamp(actions.map((action) => actionFinishedAt(state, action)));
+    if (!startedAt) continue;
+    const label = phaseLabel(name, orchestrator);
+    add(startedAt, timelineRow(startedAt, `├─ [Phase: ${label}] ${realStart ? 'started' : 'blocked'}`, '', width));
+    const finished = actions
+      .filter((action) => actionFinishedAt(state, action) && TERMINAL_ACTIONS.has(effectiveActionStatus(action, state)))
+      .sort((a, b) => Date.parse(actionFinishedAt(state, a)) - Date.parse(actionFinishedAt(state, b)));
+    finished.forEach((action, index) => {
+      const terminalPhase = finished.length === actions.length && index === finished.length - 1;
+      const branch = terminalPhase ? '│  └─' : '│  ├─';
+      const actionFinished = actionFinishedAt(state, action);
+      const actionStarted = actionStartedAt(state, action);
+      add(actionFinished, timelineRow(
+        actionFinished,
+        `${branch}${statusIcon(effectiveActionStatus(action, state))} [${label}] ${action.id}`,
+        actionStarted ? durationText(actionStarted, actionFinished) : '',
+        width,
+      ));
+    });
+    if (finished.length === actions.length && actions.length) {
+      const finishedAt = latestTimestamp(actions.map((action) => actionFinishedAt(state, action)));
+      const failed = actions.some((action) => String(effectiveActionStatus(action, state)).startsWith('failed'));
+      add(finishedAt, timelineRow(finishedAt, `└─${failed ? '✗' : '✓'} [Phase: ${label}] completed`, `${finished.length}/${actions.length}`, width));
+    }
+  }
+
+  for (const event of model.events) {
+    const detail = timelineControlEvent(event, width);
+    if (detail) add(event.committedAt, detail, Number(event.sequence));
+  }
+
+  events.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.sequence - b.sequence);
+  const lines = [];
+  events.forEach((event, index) => {
+    if (index) lines.push('');
+    lines.push(...event.lines);
+  });
+  return { lines: lines.length ? lines : ['Waiting for the first durable workflow milestone'], milestoneCount: events.length };
+}
+
+function decisionForPlannerAttempt(state, attempt, index, attempts) {
+  const decisions = state.decisions ?? [];
+  if (attempt?.outFile) {
+    const artifactMatch = decisions.find((decision) => decision.artifact === attempt.outFile);
+    if (artifactMatch) return artifactMatch;
+  }
+  const started = Date.parse(attempt?.startedAt ?? '');
+  const finished = Date.parse(attempt?.finishedAt ?? '');
+  if (Number.isFinite(started) && Number.isFinite(finished)) {
+    const timeMatch = decisions.find((decision) => {
+      const created = Date.parse(decision.createdAt ?? '');
+      return Number.isFinite(created) && created >= started && created <= finished + 2_000;
+    });
+    if (timeMatch) return timeMatch;
+  }
+  const hasDurableCorrelation = decisions.some((decision) => decision.artifact || decision.createdAt)
+    || attempts.some((entry) => entry.outFile);
+  return hasDurableCorrelation ? null : decisions[index];
+}
+
+function timelineControlEvent(event, width) {
+  const labels = {
+    'decision.rejected': '✗ [Workflow Planner] decision rejected',
+    'decision.correction_requested': '⧖ [Workflow Planner] correction requested',
+    'decision.orchestrator_escalated': '◆ [Workflow Planner] provider escalated',
+    'run.cancellation_requested': '⧖ Workflow cancellation requested',
+    'run.cancelling': '⧖ Workflow cancellation requested',
+    'run.interruption_requested': '⧖ Workflow interruption requested',
+    'workflow.expansion_target_exceeded': '! Advisory expansion target exceeded',
+    'workflow.agent_target_exceeded': '! Advisory agent target exceeded',
+  };
+  const label = labels[event.type];
+  if (!label) return null;
+  const reason = event.payload?.why ?? event.payload?.reason;
+  return [
+    timelineRow(event.committedAt, label, '', width),
+    ...(reason ? [timelineDetail(sentencePreview(reason, Math.max(20, width - 8)), width)] : []),
+  ];
+}
+
+function workflowLiveLines(model, width, spinnerFrame) {
+  const { state, orchestrator } = model;
+  const activeWorkers = Object.values(state.activeAgents ?? {})
+    .filter((agent) => agent.stepId !== orchestrator.actionId)
+    .sort((a, b) => String(b.lastEventAt ?? b.lastActivityAt ?? '').localeCompare(String(a.lastEventAt ?? a.lastActivityAt ?? '')));
+  const lines = [];
+  let running = activeWorkers.length + (orchestrator.active ? 1 : 0);
+  let waiting = 0;
+  if (orchestrator.autonomous && !state.finishedAt) {
+    const plannerWaiting = !orchestrator.active && activeWorkers.length > 0;
+    if (plannerWaiting) waiting += 1;
+    const plannerStatus = orchestrator.active ? 'planning' : plannerWaiting ? 'waiting' : orchestrator.status;
+    lines.push(alignRight(
+      `${statusIcon(plannerStatus, spinnerFrame)} [Workflow Planner] · ${orchestrator.pool} · ${orchestrator.model}`,
+      plannerStatus,
+      width,
+    ));
+    if (plannerWaiting) lines.push(`   Waiting for ${activeWorkers.length === 1 ? activeWorkers[0].stepId : `${activeWorkers.length} workers`}`);
+    else if (orchestrator.active) lines.push('   Choosing the next smallest useful action');
+    else lines.push(`   ${humanStatus(orchestrator.status)}`);
+    const plannerAction = orchestrator.active?.lastActions?.at(-1) ?? orchestrator.latestAttempt?.lastActions?.at(-1);
+    if (plannerAction) lines.push(`   ↳ ${friendlyActionKind(plannerAction.kind)}${plannerAction.summary ? ` · ${friendlyActionSummary(plannerAction)}` : ''}`);
+    else if (orchestrator.latestDecision) lines.push(`   ↳ Decision · ${decisionLabel(orchestrator.latestDecision.decision)}`);
+    const plannerStream = streamActivityLine(orchestrator.active);
+    if (plannerStream) lines.push(`   ${plannerStream}`);
+    lines.push('');
+  }
+  for (const agent of activeWorkers) {
+    const action = (state.actionLedger ?? []).find((entry) => entry.id === agent.stepId || agent.stepId?.startsWith(`${entry.id}[`));
+    lines.push(alignRight(
+      `${statusIcon(agent.status ?? 'running', spinnerFrame)} ${agent.stepId} · ${agent.pool ?? 'unassigned'} · ${agent.model ?? 'connector model'}`,
+      durationText(action?.startedAt ?? agent.startedAt),
+      width,
+    ));
+    const latest = agent.lastActions?.at(-1);
+    lines.push(latest
+      ? `   ↳ ${friendlyActionKind(latest.kind)}${latest.summary ? ` · ${friendlyActionSummary(latest)}` : ''}`
+      : '   ↳ waiting for the first semantic action event');
+    const stream = streamActivityLine(agent);
+    if (stream) lines.push(`   ${stream}`);
+    lines.push('');
+  }
+  if (!lines.length) lines.push(state.finishedAt ? '✓ No live agents · workflow is terminal' : '⧖ Waiting for the next dispatch');
+  return { lines, running, waiting };
+}
+
+function workflowNextLines(model, width) {
+  const { state, orchestrator } = model;
+  if (state.finishedAt) return [truncate(`${statusIcon(state.status)} Workflow terminal · obtain the stable result envelope`, width)];
+  const ledger = state.actionLedger ?? [];
+  const pending = ledger.find((action) => action.id !== 'scout'
+    && action.id !== orchestrator.actionId
+    && !TERMINAL_ACTIONS.has(effectiveActionStatus(action, state))
+    && effectiveActionStatus(action, state) !== 'running');
+  if (pending) {
+    const blockers = (pending.dependsOn ?? []).filter((id) => state.outputs?.[id]?.ok !== true);
+    const wait = blockers.length ? ` · waiting for ${blockers.join(', ')}` : '';
+    return [truncate(`○ [Phase: ${phaseLabel(pending.phase, orchestrator)}] · ${pending.id}${wait}`, width)];
+  }
+  if (Object.keys(state.activeAgents ?? {}).some((key) => state.activeAgents[key]?.stepId !== orchestrator.actionId)) {
+    return ['○ [Workflow Planner] will reassess when current work finishes'];
+  }
+  if (orchestrator.active) return ['○ Awaiting the next [Workflow Planner] decision'];
+  return ['○ Awaiting the next [Workflow Planner] decision'];
+}
+
+function workflowTechnicalLines(model, width) {
+  const { state, orchestrator } = model;
+  const lines = [
+    `Status · ${state.status ?? 'starting'}`,
+    `Current · ${state.currentStep?.id ?? '—'} · ${state.currentStep?.phase ?? state.currentPhase?.name ?? '—'}`,
+    `Started · ${state.startedAt ?? '—'}`,
+    `Usage · ${compactUsage(state.usage)}`,
+    '',
+    'Action ledger',
+  ];
+  for (const action of state.actionLedger ?? []) {
+    const control = orchestrator.autonomous && action.id === orchestrator.actionId && action.kind === 'decide';
+    lines.push(`${statusIcon(effectiveActionStatus(action, state))} ${control ? '[Workflow Planner]' : action.id} · ${action.kind} · ${action.status ?? 'pending'} · ${action.phase ?? '—'}`);
+  }
+  if (!(state.actionLedger ?? []).length) lines.push('· no actions recorded');
+  lines.push('', 'Recent durable events');
+  for (const event of model.events.slice(-12)) lines.push(`#${event.sequence} ${event.type}`);
+  if (!model.events.length) lines.push('· no events recorded');
+  return wrapLines(lines, width);
+}
+
+function timelineRow(at, label, right, width) {
+  return alignRight(`${clockText(at)}  ${label}`, right, width);
+}
+
+function timelineDetail(text, width) {
+  return truncate(`       ${text}`, width);
+}
+
+function alignRight(left, right, width) {
+  const suffix = right ? String(right) : '';
+  if (!suffix) return truncate(left, width);
+  const room = Math.max(1, width - suffix.length - 1);
+  const lhs = truncate(left, room);
+  return `${lhs}${' '.repeat(Math.max(1, width - lhs.length - suffix.length))}${suffix}`;
+}
+
+function clockText(value) {
+  const date = new Date(value ?? '');
+  if (!Number.isFinite(date.getTime())) return '--:--';
+  return `${String(date.getHours()).padStart(2, '0')}:${String(date.getMinutes()).padStart(2, '0')}`;
+}
+
+function earliestTimestamp(values) {
+  return values.filter(Boolean).sort((a, b) => Date.parse(a) - Date.parse(b))[0] ?? null;
+}
+
+function latestTimestamp(values) {
+  return values.filter(Boolean).sort((a, b) => Date.parse(b) - Date.parse(a))[0] ?? null;
+}
+
+function latestAttemptForAction(state, action) {
+  if (!action) return null;
+  return (action.attempts ?? []).map((index) => state.attempts?.[index]).filter(Boolean).at(-1) ?? null;
+}
+
+function actionStartedAt(state, action) {
+  if (!action) return null;
+  const attempts = (action.attempts ?? []).map((index) => state.attempts?.[index]).filter(Boolean);
+  return action.startedAt ?? earliestTimestamp(attempts.map((attempt) => attempt.startedAt));
+}
+
+function actionFinishedAt(state, action) {
+  if (!action) return null;
+  const attempts = (action.attempts ?? []).map((index) => state.attempts?.[index]).filter(Boolean);
+  return action.finishedAt ?? latestTimestamp(attempts.map((attempt) => attempt.finishedAt));
+}
+
+function streamActivityLine(agent) {
+  if (!agent) return '';
+  const at = agent.lastEventAt ?? agent.lastActivityAt;
+  if (!at) return 'stream waiting for the first provider event';
+  return `stream active ${durationText(at)} ago · ${formatBytes(agent.outputBytesObserved ?? 0)} observed`;
+}
+
+function formatBytes(value) {
+  const bytes = Math.max(0, Number(value) || 0);
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${Math.round(bytes / 1024)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+function humanStatus(value) {
+  return String(value ?? 'waiting').replaceAll('_', ' ').replace(/^./, (char) => char.toUpperCase());
+}
+
+function plannerDisplayStatus(model) {
+  const { orchestrator, state } = model;
+  if (state.finishedAt) return state.status === 'completed' ? 'Completed' : humanStatus(state.status);
+  if (orchestrator.active) return 'Planning next actions';
+  const workers = Object.values(state.activeAgents ?? {}).filter((agent) => agent.stepId !== orchestrator.actionId);
+  if (workers.length) return 'Waiting for workers';
+  if (orchestrator.status === 'reviewing evidence') return 'Reviewing evidence';
+  return humanStatus(orchestrator.status);
+}
+
+function plannerUsageSummary(model) {
+  const checkpoints = model.orchestrator.attempts.length;
+  const cost = model.state.usage?.cost?.estimatedUsd ?? model.state.usage?.cost?.knownSubtotalUsd;
+  return `Checkpoints ${checkpoints}${Number.isFinite(cost) ? ` · $${cost.toFixed(2)}` : ''}`;
+}
+
+function dimText(value, width) {
+  return `\x1b[2m${truncate(value, width)}\x1b[0m`;
+}
+
 function orchestratorDetailLines(model, width, spinnerFrame, { verbose = false } = {}) {
   const { orchestrator, state } = model;
   if (!orchestrator.autonomous) {
@@ -520,6 +893,7 @@ function orchestratorDetailLines(model, width, spinnerFrame, { verbose = false }
   const conversations = Object.entries(state.orchestration?.conversations ?? {});
   const decisions = state.decisions ?? [];
   const latestDecision = decisions.at(-1);
+  const latestLiveAction = liveActions.at(-1) ?? null;
   const workerAttempts = (state.attempts ?? []).filter((attempt) => attempt.actionId !== orchestrator.actionId);
   const completedWorkers = workerAttempts.filter((attempt) => TERMINAL_ACTIONS.has(attempt.status)).length;
   const activeWorkers = Object.values(state.activeAgents ?? {})
@@ -538,6 +912,14 @@ function orchestratorDetailLines(model, width, spinnerFrame, { verbose = false }
     `Now · ${stateLabel}`,
     `Progress · ${completedWorkers}/${workerAttempts.length} worker attempts finished · ${orchestrator.attempts.length} planning checkpoint${orchestrator.attempts.length === 1 ? '' : 's'}`,
   ];
+  if (active) {
+    lines.push(latestLiveAction
+      ? `Latest action · ${friendlyActionKind(latestLiveAction.kind)}${latestLiveAction.summary ? ` · ${friendlyActionSummary(latestLiveAction)}` : ''}`
+      : 'Latest action · waiting for the first semantic event');
+    lines.push(active.lastEventAt
+      ? `Live stream · event ${durationText(active.lastEventAt)} ago · ${active.outputBytesObserved ?? 0} bytes observed`
+      : 'Live stream · waiting for the first provider event');
+  }
   if (latestDecision) {
     lines.push(`Latest decision · ${decisionLabel(latestDecision.decision)}`);
     if (latestDecision.reason) lines.push(`Why · ${sentencePreview(latestDecision.reason)}`);
@@ -581,7 +963,7 @@ function orchestratorDetailLines(model, width, spinnerFrame, { verbose = false }
   lines.push('', 'Checkpoint turns');
   if (!orchestrator.attempts.length) lines.push('· waiting for the first planning turn');
   orchestrator.attempts.forEach((attempt, index) => {
-    const decision = (state.decisions ?? [])[index];
+    const decision = decisionForPlannerAttempt(state, attempt, index, orchestrator.attempts);
     lines.push(`#${index + 1} ${statusIcon(attempt.status, spinnerFrame)} ${attempt.status} · ${attempt.pool ?? '—'} · ${attempt.model ?? 'connector model'} · ${durationText(attempt.startedAt, attempt.finishedAt)}`);
     lines.push(`  ${compactUsage(attempt.usage)}`);
     if (decision) lines.push(`  decision: ${decision.decision} · ${decision.reason}`);
@@ -845,6 +1227,7 @@ export async function runDashboard(bullswarmDir, {
     controlSelected: false,
     orchestratorDetail: false,
     orchestratorVerbose: false,
+    workflowVerbose: false,
     spinnerFrame: 0,
   };
   const paintUnsafe = () => {
@@ -915,7 +1298,7 @@ export async function runDashboard(bullswarmDir, {
       }
       const row = detailRow(bullswarmDir, selectedRunId);
       const model = workflowPanelModel(row, { phaseIndex: ui.phaseIndex, agentIndex: ui.agentIndex });
-      if (ui.orchestratorDetail) {
+      if (ui.orchestratorDetail || ui.workflowVerbose) {
         ui.detailScroll = Math.max(0, ui.detailScroll + delta);
         return paint();
       }
@@ -979,27 +1362,32 @@ export async function runDashboard(bullswarmDir, {
           ui.focus = 0;
           ui.controlSelected = true;
           ui.detailScroll = 0;
+        } else if (ui.workflowVerbose) {
+          ui.workflowVerbose = false;
+          ui.detailScroll = 0;
         } else if (detail && ui.focus > 0) ui.focus -= 1;
         else if (detail && !token) detail = false;
         else message = 'At phase level · press q to detach while the workflow keeps running.';
         return paint();
       }
       if (key === '\t' || key === '\u001b[C' || key === 'l') {
-        if (detail) ui.focus = (ui.focus + 1) % 3;
+        if (detail) { ui.focus = (ui.focus + 1) % 3; ui.detailScroll = 0; }
         return paint();
       }
       if (key === '\u001b[D' || key === 'h') {
-        if (detail) ui.focus = (ui.focus + 2) % 3;
+        if (detail) { ui.focus = (ui.focus + 2) % 3; ui.detailScroll = 0; }
         return paint();
       }
       if (key === '\u001b[A' || key === 'k') return moveVertical(-1);
       if (key === '\u001b[B' || key === 'j') return moveVertical(1);
-      if (key === '\u001b[5~') { ui.detailScroll = Math.max(0, ui.detailScroll - 8); return paint(); }
-      if (key === '\u001b[6~') { ui.detailScroll += 8; return paint(); }
+      const timelineScroll = detail && ui.focus === 0 && !ui.orchestratorDetail && !ui.workflowVerbose;
+      if (key === '\u001b[5~') { ui.detailScroll = timelineScroll ? ui.detailScroll + 8 : Math.max(0, ui.detailScroll - 8); return paint(); }
+      if (key === '\u001b[6~') { ui.detailScroll = timelineScroll ? Math.max(0, ui.detailScroll - 8) : ui.detailScroll + 8; return paint(); }
       if (key === 'o' && detail) {
         const row = detailRow(bullswarmDir, selectedRunId);
         const model = workflowPanelModel(row, { phaseIndex: ui.phaseIndex, agentIndex: ui.agentIndex });
         if (model.orchestrator.autonomous) {
+          ui.workflowVerbose = false;
           ui.orchestratorDetail = true;
           ui.orchestratorVerbose = false;
           ui.controlSelected = true;
@@ -1011,8 +1399,9 @@ export async function runDashboard(bullswarmDir, {
       if (key === '1' && detail) { ui.focus = 0; return paint(); }
       if (key === '2' && detail) { ui.focus = 1; return paint(); }
       if (key === '3' && detail) { ui.focus = 2; return paint(); }
-      if (key === 'v' && ui.orchestratorDetail) {
-        ui.orchestratorVerbose = !ui.orchestratorVerbose;
+      if (key === 'v' && detail) {
+        if (ui.orchestratorDetail) ui.orchestratorVerbose = !ui.orchestratorVerbose;
+        else ui.workflowVerbose = !ui.workflowVerbose;
         ui.detailScroll = 0;
         message = null;
         return paint();
@@ -1025,6 +1414,7 @@ export async function runDashboard(bullswarmDir, {
           ui.followActiveAgent = true;
         } else if (ui.focus === 0) {
           if (ui.controlSelected) {
+            ui.workflowVerbose = false;
             ui.orchestratorDetail = true;
             ui.orchestratorVerbose = false;
             ui.detailScroll = 0;

package/src/workflow/decision.js

@@ -181,6 +181,9 @@ export function validateDecisionProposal(proposal, {
       action.requiresCapabilities.some((capability) => typeof capability !== 'string' || !ID_RE.test(capability)))) {
       issues.push(`${at}.requiresCapabilities must contain kebab-case names`);
     }
+    if (action.lane != null && !['analyze', 'build', 'chore'].includes(action.lane)) {
+      issues.push(`${at}.lane must be analyze|build|chore`);
+    }
     if (action.effort != null && !['high', 'medium', 'low'].includes(action.effort)) {
       issues.push(`${at}.effort must be high|medium|low`);
     }

package/src/workflow/goal.js

@@ -8,25 +8,25 @@ import { resolve } from 'node:path';
 const NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 
 export const PLANNER_RULES_SECTION = [
-  '1. Compile the whole program in one decision: the runtime executes all proposed actions and consults you only at a finished-or-blocked boundary, so deferring decidable work costs another round trip.',
-  '2. Make every worker prompt self-contained: include the exact goal, absolute cwd, owned files and a no-other-files boundary, expected artifact, acceptance command, and report format, because workers see only their own prompt.',
-  '3. Use short kebab-case, forward-only phases and dependsOn only for real data or same-file ordering; recovery uses a new phase and never repeats an identical failed plan.',
-  '4. For known N items, create N run plus N verify actions, each verify depending only on its own run, then one suite verify depending on all; a verify judges the artifact in review (default: its single or last dependency; a verify with no dependsOn audits the repository directly).',
-  '5. For unknown items, create discovery ending with RETURN ONLY a JSON object containing an items array, then data-driven fan-out via itemsFrom outputs.<id>.outFile or outputs.<id>.data.<field>; the runtime extracts the list and retries once read-only if needed.',
-  '6. Put outputSchema on workers whose reports are consumed or whose claims the runtime must check, so structured data is durable and can drive later fan-out.',
-  '7. Put verify.repair on every verify, and scope each verify to what can be true at its point in the graph: work scheduled later is not a defect, and cosmetic mismatches with the goal text are concerns, never ok:false. An ok:false verdict is repaired and re-checked inside the program; ok:true is accepted and concerns are informational, not extra work.',
-  '8. Add completion with all-actions-ok whenever a clean program finishes the goal; when the goal\'s acceptance checks pass, return complete rather than adding polish or alignment actions. Completion evidence requires the program\'s LAST worker to be covered by a successful verify — never leave a report or other run as the final unverified action. Return complete only on durable verified evidence, never proceed, never ask the user, and stop only for a concrete unresolved blocker with a qualified outcome.',
-  '9. Treat agent-count, workflow-duration, and expansion-round budgets as advisory planning targets, never hard stop conditions; the dispatch budget counts this planner call plus workers, verifiers, retries, and escalations. Converge as targets approach, avoid optional work, and exceed a target only for one essential bounded action or required verification.',
-  '10. This is a control-plane thread: do not invoke Bullswarm, use tools, modify files, or propose pool, addDir, taskFile, shell authority, or unbounded work; route and process authority belong to the runtime.',
-  'Shared working tree: concurrent workers editing DISJOINT files is the normal parallel mode; order shared files (indexes, barrels) after their feeders with dependsOn, and run the full suite once in a final verify — never while other workers still edit. Avoid redundant expensive verification: later verifiers reuse durable clean full-suite evidence unless it is stale or the code changed again. operatorSteering in the context is explicit operator guidance for this checkpoint: apply it within the original intent; it cannot weaken verification or expand authority.',
+  '1. Compile the whole program in one decision: the runtime runs every proposed action and consults you only at a finished-or-blocked boundary, so deferred work costs a round trip.',
+  '2. Make every worker prompt self-contained: include the exact goal, absolute cwd, the owned files you assign (never an and/or choice, which blocks a sibling) and a no-other-files boundary, expected artifact, acceptance command and report format: workers see only their own prompt.',
+  '3. A phase is a pipeline stage: one kebab-case name shared by its actions (implement, verify), never one per action; phases are forward-only, so recovery opens a new one and never repeats an identical failed plan. Wall-clock is the longest dependsOn chain, so depend only on real data or same-file ordering: a worker depends on the run that wrote its input files, never on that run\'s verify (a verdict is not data), so it starts as that verify runs.',
+  '4. Split to the width the tree allows: each file-disjoint unit (module, test file, doc) is its own concurrent run plus its own verify depending only on that run, then one suite verify depending on all; one worker for N independent files is N chains in series. A verify judges the artifact in review (default: its last dependency; none: the repository).',
+  '5. For unknown items, create discovery ending with RETURN ONLY a JSON object containing an items array, then data-driven fan-out via itemsFrom outputs.<id>.outFile or outputs.<id>.data.<field>; the runtime extracts the list, retrying once read-only if needed.',
+  '6. Put outputSchema only on a worker whose object a LATER action reads via itemsFrom or outputs.<id>.data.<field>, and tell it to RETURN ONLY the object; a prose report or any answer with fenced JSON gets no schema: the runtime parses the last {...} of the text, so a schema on prose costs a retry and a planner turn.',
+  '7. Put verify.repair on every verify. A verify checks the goal\'s own acceptance criteria at its point in the graph: later-scheduled work is not a defect, cosmetic mismatches are concerns, and never add a process rule the goal does not state (append-only, tests untouched); when the implementation changes what an existing assertion pins, a worker must own updating it. ok:false is repaired and re-checked inside the program; the repair edits files and cannot rewrite the answer under review, so reject only what a file edit can fix and report a wrong claim as a concern with the true value; ok:true is accepted and its concerns are informational.',
+  '8. Add completion with all-actions-ok whenever a clean program finishes the goal; when acceptance checks pass, return complete rather than adding polish. The program\'s LAST worker must be covered by a successful verify. Return complete only on verified evidence, never proceed, never ask the user, and stop only for a concrete unresolved blocker.',
+  '9. Budgets (agents, duration, expansion rounds) are advisory targets, never hard stops; the dispatch budget counts this planner call plus workers, verifiers and retries. Converge as targets approach: skip optional work; exceed a target only for one essential action or a required verification.',
+  '10. Never propose pool, addDir, taskFile or unbounded work: routing is the runtime\'s. Set lane (analyze to read or judge, build to edit, chore for mechanical steps) and effort (low for checks and mechanical edits, high where judgement decides) per action or repair; they pick the model tier (unset: build, medium).',
+  'Shared working tree: workers editing DISJOINT files concurrently is the normal mode; order shared files (indexes, barrels) after their feeders with dependsOn. Workers and unit verifies run their unit\'s focused command, never the full suite, which sees files siblings still write; the suite runs once, in the final verify, after all editing and repair ends; later verifiers reuse it unless code changed. operatorSteering is operator guidance for this checkpoint: apply it within the original intent; it cannot weaken verification or expand authority.',
 ].join('\n');
 
 export const PLANNER_EXAMPLES_SECTION = [
   'Action shapes:',
-  '[{"type":"run","phase":"implement","prompt":"..."},{"type":"run","phase":"report","prompt":"...","outputSchema":{"type":"object"}},{"type":"fanout","phase":"fix","items":["alpha"],"stepTemplate":{"prompt":"Handle {{item}}."}},{"type":"fanout","phase":"fix","itemsFrom":"outputs.discover.outFile","stepTemplate":{"prompt":"Handle {{item}}."}},{"type":"verify","phase":"verify","prompt":"Check the artifact.","repair":{"prompt":"Fix rejected concerns.","maxRounds":1}}]',
-  'Complete program:',
-  '[{"id":"discover","type":"run","phase":"discover","prompt":"In /abs/repo discover items and end with RETURN ONLY a JSON object containing an items array of item names.","outputSchema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}},{"id":"fix","type":"fanout","phase":"fix","itemsFrom":"outputs.discover.data.items","stepTemplate":{"prompt":"In /abs/repo edit only the files for {{item}} and run its focused acceptance command."},"dependsOn":["discover"]},{"id":"verify-items","type":"verify","phase":"verify-items","prompt":"Independently verify every item artifact.","dependsOn":["fix"],"repair":{"prompt":"Fix each rejected item in /abs/repo and re-run its focused command.","maxRounds":2}},{"id":"verify-suite","type":"verify","phase":"verify-suite","prompt":"Run the full acceptance command in /abs/repo.","dependsOn":["verify-items"],"repair":{"prompt":"Fix the suite failure in /abs/repo and rerun the suite.","maxRounds":1}}],"completion":{"when":"all-actions-ok","reason":"The item checks and final suite verification prove the goal."}]',
-  'Rules the validator enforces: action type is run, fanout, or verify; fanout has stepTemplate and either items or itemsFrom; verify.review, when given, is outputs.<id>.outFile; dependsOn names existing or proposed actions; runtime-owned fields are rejected.',
+  '[{"type":"run","phase":"implement","prompt":"..."},{"type":"run","phase":"inventory","lane":"chore","effort":"low","prompt":"... RETURN ONLY a JSON object.","outputSchema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}},{"type":"fanout","phase":"fix","items":["alpha"],"stepTemplate":{"prompt":"Handle {{item}}."}},{"type":"verify","phase":"verify","lane":"analyze","prompt":"Check the artifact.","repair":{"prompt":"Fix rejected concerns.","maxRounds":1}}]',
+  'Complete program (tests depend on fix, not verify-fix, so both run at once; five phases for eight actions):',
+  '{"actions":[{"id":"discover","type":"run","phase":"discover","lane":"chore","effort":"low","prompt":"In /abs/repo list modules needing work; RETURN ONLY a JSON object with an items array.","outputSchema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}},{"id":"fix","type":"fanout","phase":"fix","itemsFrom":"outputs.discover.data.items","dependsOn":["discover"],"stepTemplate":{"prompt":"In /abs/repo edit only src/{{item}}.js and run node --test tests/{{item}}.test.js."}},{"id":"verify-fix","type":"verify","phase":"verify","dependsOn":["fix"],"prompt":"Check each fixed module against the spec.","repair":{"prompt":"Fix rejected concerns in /abs/repo and rerun that module\'s test.","maxRounds":2}},{"id":"tests","type":"fanout","phase":"tests","itemsFrom":"outputs.discover.data.items","dependsOn":["fix"],"stepTemplate":{"prompt":"In /abs/repo write only tests/{{item}}.guards.test.js and run node --test on it."}},{"id":"verify-tests","type":"verify","phase":"verify","dependsOn":["tests"],"prompt":"Check the new tests are non-vacuous.","repair":{"prompt":"Fix rejected tests in /abs/repo.","maxRounds":1}},{"id":"verify-suite","type":"verify","phase":"verify","dependsOn":["verify-fix","verify-tests"],"effort":"low","prompt":"Run npm test in /abs/repo.","repair":{"prompt":"Fix the suite failure in /abs/repo and rerun it.","maxRounds":1}},{"id":"report","type":"run","phase":"report","lane":"chore","effort":"low","dependsOn":["verify-suite"],"prompt":"In /abs/repo list each changed file with a reason and quote the suite tail; plain markdown."},{"id":"verify-report","type":"verify","phase":"report","dependsOn":["report"],"prompt":"Check each claim against git status and a fresh suite run; a wrong number is a concern with the true value.","repair":{"prompt":"Fix any real repository defect in /abs/repo.","maxRounds":1}}],"completion":{"when":"all-actions-ok","reason":"Fix, tests, suite and report are each verified."}}',
+  'Rules the validator enforces: action type is run, fanout, or verify; fanout has stepTemplate and either items or itemsFrom; verify.review, when given, is outputs.<id>.outFile; dependsOn names existing or proposed actions; lane is analyze|build|chore and effort is low|medium|high; runtime-owned fields are rejected.',
 ].join('\n');
 
 export const AUTONOMOUS_ORCHESTRATOR_PROMPT = [

package/src/workflow/runner.js

@@ -748,8 +748,14 @@ async function runDecisionLoop({ runtime, gate, phase, state, retryAttempts }) {
       runtime.emit('action.reverify_started', { verifyId: action.id, repairId, round });
       state.currentStep = { id: action.id, type: action.type, phase: executionPhase(action) };
       runtime.persist();
+      // The re-verify judges the repair, not the whole artifact afresh: it is
+      // told which concerns were raised and what the repair reports, and may
+      // reject only for an unresolved listed concern or a regression. Earned:
+      // goal-4 rerun r2vu9i — round 2 rejected on two concerns round 1 never
+      // raised although every round-1 concern was fixed (moving goalposts).
+      const repairExcerpt = String(state.outputs?.[repairId]?.outputExcerpt ?? '').slice(0, 1500);
       result = await runtime.runStep(
-        { ...action, parentId: gate.id, _dynamic: true },
+        { ...action, parentId: gate.id, _dynamic: true, _reverify: { round, maxRounds, repairId, concerns, repairExcerpt } },
         { phase: executionPhase(action), retryAttempts },
       );
       runtime.emit(result.ok ? 'action.repaired' : 'action.reverify_rejected', {
@@ -1021,9 +1027,15 @@ async function runDecisionLoop({ runtime, gate, phase, state, retryAttempts }) {
     const actionDefaults = { ...(gate.addDir != null ? { addDir: gate.addDir } : {}), ...(gate.actionDefaults ?? {}) };
     proposal = {
       ...proposal,
+      // The planner's lane/effort/requiresCapabilities win over the gate's
+      // defaults (contract rule 10 makes lane and effort the planner's);
+      // addDir stays runtime-owned and is spread last so a proposed null
+      // cannot clobber the target. Earned: every goal-4 action ran as lane
+      // "build" because this merge let the defaults overwrite the proposal.
       actions: proposal.actions.map((action) => ({
-        ...action,
         ...actionDefaults,
+        ...action,
+        ...(actionDefaults.addDir != null ? { addDir: actionDefaults.addDir } : {}),
         ...(action.type === 'fanout' && actionDefaults.addDir != null
           ? { stepTemplate: { ...action.stepTemplate, addDir: actionDefaults.addDir } }
           : {}),

package/src/workflow/runtime.js

@@ -916,7 +916,7 @@ export class WorkflowRuntime {
       '',
       retry
         ? `Your previous answer did not match the required schema: ${retry.errors.join('; ')}. Previous output tail: ${retry.tail}. Return the full answer again and END with a JSON object that matches.`
-        : 'END YOUR OUTPUT with exactly one JSON object matching this schema. No prose or markdown fences may appear after it.',
+        : 'END YOUR OUTPUT with exactly one JSON object that is an INSTANCE of this schema — its keys are the names under "properties" (never copy the schema itself or its "type"/"properties" keys). No prose or markdown fences may appear after it.',
       JSON.stringify(schema),
     ].join('\n');
   }
@@ -931,7 +931,11 @@ export class WorkflowRuntime {
   readTrailingObject(path, schema) {
     let text;
     try { text = readFileSync(path, 'utf8'); } catch (err) { return { ok: false, errors: [`output file could not be read: ${err.message}`] }; }
-    const trimmed = text.trimEnd();
+    // A closing markdown fence after the object is the most common way a
+    // worker disobeys "no fences": tolerate it rather than spend the single
+    // retry (or a planner turn) on an otherwise valid answer. Observed live
+    // on goal-4 run ydpjts (2026-08-29): the retry answer ended "}\n```".
+    const trimmed = text.replace(/(\s*```[\w-]*\s*)+$/u, '').trimEnd();
     if (!trimmed.endsWith('}')) return { ok: false, errors: ['output did not end with a JSON object'] };
     const close = trimmed.length - 1;
     // Walk "{" positions from the right. Inner braces of the trailing object
@@ -1083,8 +1087,17 @@ export class WorkflowRuntime {
       }
     })();
 
+    const reverify = step._reverify && typeof step._reverify === 'object' ? step._reverify : null;
     const reviewInstructions = [
       step.prompt ?? 'You are a skeptical reviewer. Independently inspect the work and its current repository state.',
+      ...(reverify ? [
+        '',
+        `RE-VERIFY round ${reverify.round} of ${reverify.maxRounds}: your previous verdict rejected this work and repair ${reverify.repairId} has since edited the repository. Judge the repair, not the work afresh.`,
+        ...(Array.isArray(reverify.concerns) && reverify.concerns.length
+          ? ['Concerns you raised (verbatim):', ...reverify.concerns.map((entry) => `- ${entry}`)] : []),
+        ...(reverify.repairExcerpt ? ['The repair reported:', reverify.repairExcerpt] : []),
+        'Return ok:false ONLY if a listed concern is still unresolved or the repair introduced a regression in the acceptance checks. Anything you notice now that was already true before the repair goes in concerns as informational and never makes ok false: the first verdict was the moment to raise it.',
+      ] : []),
       '',
       'RETURN ONLY a single JSON object of the form',
       '{"ok": <true|false>, "concerns": [<string>...], "summary": <string>}.',
@@ -1364,7 +1377,7 @@ export class WorkflowRuntime {
       `Return ONLY JSON with schemaVersion "${DECISION_SCHEMA_VERSION}", decision, reason, and actions.`,
       'Allowed decisions: proceed, complete, needs_more_work, retry, escalate, wait_for_approval, stop.',
       'Every proposed action MUST use the field "type" (never "kind").',
-      'Every action MUST include a forward-only kebab-case "phase". Never reuse a name listed in closedPhases.',
+      'Every action MUST include a forward-only kebab-case "phase" shared by the actions of its stage. Never reuse a name listed in closedPhases.',
       '',
       ...(rendered.prompt.includes(AUTONOMOUS_ORCHESTRATOR_PROMPT) ? [] : [AUTONOMOUS_ORCHESTRATOR_PROMPT]),
       '',