bullswarm 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,102 @@
 # bullswarm changelog
 
+## 0.18.0 — exact routes, cheaper plans, clearer results
+
+- `workflow goal` can now guarantee an exact planner model and a separate exact
+  worker route with `--orchestrator-model`, `--worker-pool`, and
+  `--worker-model`. The worker lock is runtime-owned and propagates through the
+  scout, ordinary actions, fan-out items, verification repairs, reverification,
+  and extraction helpers; unsupported or excluded models fail closed instead
+  of silently substituting another model.
+- An action-bearing planner `proceed` is normalized to the schema-equivalent
+  `needs_more_work` program before validation. This removes a redundant
+  correction turn without changing the proposed graph or weakening any safety
+  check (the prior real run spent four frontier planner turns correcting this
+  exact representation mismatch).
+- `workflow runs result` now selects the latest successful verifier that
+  transitively covers the delivery, so a final suite verifier depending on
+  unit verifiers is surfaced ahead of a narrower direct unit check.
+- The same result envelope now adds a backward-compatible `deliveries[]`
+  frontier for parallel multi-worker outcomes while preserving the singular
+  `delivery` field for existing callers.
+- The autonomous planner now batches cheap homogeneous edits instead of paying
+  for a worker and unit verifier per tiny file; substantial independent units
+  still fan out and retain focused verification before the final suite.
+- Narrow SSH and phone terminals now open on a full-width workflow timeline;
+  `t` toggles between that overview and the phase browser without affecting the
+  existing Enter/Esc agent drill-down.
+- Goal-level `--orchestrator <pool>` is now a preference with immediate
+  fallback when that pool is quota-gated, ineligible, or unavailable. Exact
+  provider testing moves to `--strict-orchestrator <pool>`. Quota waits now
+  refresh the durable runner heartbeat at least every 30 seconds, preventing a
+  live waiting run from being falsely reconciled as interrupted and making
+  cooperative cancellation responsive during long meter-poll intervals.
+
+- The runtime now owns the acceptance bar for every verify and re-verify. Each
+  verifier's instructions end with a fixed "Acceptance standard (runtime-owned;
+  it overrides any stricter rule in the instructions above)": `ok:false` means
+  the work is unusable — its acceptance command fails, a required deliverable
+  is missing, or the answer is nonsense — and everything else (style, scope,
+  cosmetic mismatches, process rules the goal never stated such as append-only,
+  files changed by other actions in the shared tree) goes in `concerns` under
+  `ok:true`. A re-verify rejects only when the work is still unusable or the
+  repair broke the acceptance checks. Direction from the user after `8ebi8a`:
+  "unless it is completely nonsense or unable to finish I don't see a reason to
+  reject so easily".
+- Repair prompts carry a runtime-owned shared-tree rule: edit only the files
+  the reviewed work owns; a concern about other files is not the repair's to
+  resolve; never revert, checkout or delete other actions' changes. Earned on
+  `8ebi8a`: `verify-docs` rejected on a repo-wide `git diff --stat` scope check
+  while siblings were writing, and its repair reverted five `src/` files it did
+  not own to satisfy the concern.
+- Planner contract: rule 2 requires exactly one owner per file, including any
+  existing test the change breaks (the `workflow-adaptive.test.js:206` gap for
+  the fourth time); rule 7 restates the lenient bar above; the validator line
+  now says ids are unique across the whole run, finished and failed actions
+  included (turn 2 of `8ebi8a` re-proposed the blocked id `verify-suite` and
+  spent a 97 s correction turn on it).
+- Goal-4 rerun on `7724da1` (`8ebi8a`, rule 7 + PR #5): 42 min 03 s, three
+  planner turns (775 s, 31 %), parallelism 1.34, 23 dispatches (20 on
+  `kaihk/gpt-5.6-luna`), three repair rounds each rejected on re-verify for
+  reasons the prompts caused, tail of five actions blocked, recovery program
+  auto-completed, 315/315, existing tests +179/−1. Goal-4 line:
+  44 → 72 → 37 → 25 → 36 → 42 min.
+
+## 0.17.0 — the timeline tells the execution story
+
+- Workflow timeline (PR #5) hardened after a 16-agent adversarial review against
+  real run state (23 findings, 21 confirmed): worker rows now name their phase
+  (`├─✓ [Verify] verify-impl`) because concurrent phases interleave in time
+  order and the tree glyph alone hung a row under the wrong phase; a phase whose
+  actions never started (a blocked tail) is shown as `[Phase: X] blocked`
+  instead of vanishing; the header line is truncated so widths down to 20
+  columns really hold; PgUp now scrolls the timeline to earlier rows (it was a
+  dead key at the newest view) and scroll state resets when the pane changes;
+  below 100 columns the footer and status line no longer advertise a timeline
+  the narrow layout does not render. Confirmed minors left open are listed on
+  PR #5.
+- Reworked the autonomous workflow TUI around a human-readable execution story:
+  the existing Workflow Planner and phase sidebar now sits beside a timestamped
+  timeline of completed preflight, planner, phase, and worker milestones; active
+  workers and the waiting/running planner are isolated in a Live section with
+  their latest normalized action and stream heartbeat, and future work stays in
+  a distinct Next section. `v` keeps raw action-ledger and event evidence one key
+  away without mixing it into the default view.
+- Rule 7: a verify checks the goal's own acceptance criteria and never adds a
+  process rule the goal does not state (append-only, existing tests
+  untouched); when the implementation changes what an existing assertion
+  pins, a worker must own updating it. Earned three times on goal 4 (attempt
+  3, `r2vu9i`, `euh622`): the planner wrote "EXTEND BY APPENDING only" into
+  the test worker and its verify while the goal said "do NOT modify existing
+  tests except to extend them" and item 5 forced `programFeatures` to grow,
+  so the assertion at `workflow-adaptive.test.js:206` had no owner, the
+  re-verify rejected the mandated extension, and a planner turn recovered.
+- Goal-4 rerun on v0.16.0 (`euh622`): 36 min 00 s, four stage phases in the TUI
+  (implement, tests, verify, report) instead of sixteen one-action rows, 22/24
+  dispatches on `kaihk/gpt-5.6-luna`, auto-completed, 319/319; two planner
+  turns because of the false rejection above (planner turn 2: "an append-only
+  rule that the goal itself makes unsatisfiable").
+
 ## 0.16.0 — the planner sets the width; a re-verify judges the repair
 
 - A re-verify after a repair round now receives the concerns it raised and the

package/README.md

@@ -188,8 +188,23 @@ Resume a process-interrupted autonomous run from its persisted workflow:
 bullswarm workflow goal --resume <shortId> --json
 ```
 
-`--orchestrator <pool>` exists for controlled testing; ordinary use should
-leave selection on `auto`. `--max-agents` and `--max-workflow-seconds` are
+`--orchestrator <pool>` expresses a preference and immediately falls back to
+another eligible pool if that provider is quota-gated or unavailable. Ordinary
+use can leave selection on `auto`. For controlled provider QA only,
+`--strict-orchestrator <pool>` requires that exact pool and may wait for its
+quota window. Controlled comparisons can additionally pin the exact planner
+and worker routes without changing global strategy:
+
+```bash
+bullswarm workflow goal "Implement and verify the change" --cwd . \
+  --strict-orchestrator codex --orchestrator-model gpt-5.6-sol \
+  --worker-pool opencode2 --worker-model kaihk/gpt-5.6-luna
+```
+
+The worker lock covers the scout, ordinary runs, fan-out items, repairs,
+re-verification, and runtime extraction helpers. A pool that cannot guarantee
+the requested model is ineligible rather than silently substituting another
+model. `--max-agents` and `--max-workflow-seconds` are
 advisory planning targets; `--max-expansion-rounds` is also an advisory
 convergence target. Hard structural safeguards are adjusted with
 `--max-actions` and `--max-items-per-expansion`.
@@ -258,8 +273,9 @@ Values accept ISO timestamps, local `YYYY-MM-DD` dates, `today`, `yesterday`,
 After a workflow reaches a terminal state, agents should consume
 `workflow runs result <id> --json` instead of probing `state.json`, task files,
 or provider-specific output. The versioned `bullswarm.workflow.result.v1`
-envelope identifies the final delivery artifact and its matching verification
-verdict, and includes progress, step logs, tokens, and an explicitly
+envelope retains the primary `delivery`, adds a `deliveries[]` frontier when
+parallel workers jointly form the outcome, and identifies their strongest
+matching verification verdict. It also includes progress, step logs, tokens, and an explicitly
 complete-or-partial tool-call total. `runs show` remains the low-level debugging
 surface.
 Goal launch output includes an `instructions` handoff with four named paths:
@@ -289,21 +305,27 @@ bullswarm workflow watch <shortId> --verbose     # detailed agent/action view
 ```
 
 `workflow tui` is the interactive, Claude-style `/workflows` view. For an
-autonomous goal its left navigation stacks a compact Orchestrator panel above
-the Phases panel; internal planner turns never appear as workers or phases.
-Select Orchestration and press Enter, or press `o`
-anywhere, to open a summary-first orchestration overview: what it is doing now,
+autonomous goal its left navigation stacks a compact Workflow Planner panel
+above the Phases panel; internal planner turns never appear as workers or phases.
+The default desktop main panel is a timestamped workflow timeline: completed
+preflight, planner-checkpoint, phase-transition, and worker-result events stay
+above a live section containing the waiting/running Workflow Planner and workers,
+each with its latest semantic action and stream heartbeat. Planned work is kept
+in a separate Next section so it cannot be mistaken for execution evidence.
+Select Workflow Planner and press Enter, or press `o`
+anywhere, to open a summary-first planner overview: what it is doing now,
 its latest decision in plain language, why it chose that path, what happens
-next, progress, and the last three semantic actions. Press `v` to toggle the
-technical view with provider session, every checkpoint turn, usage, prompt,
-and artifact paths. Status marks are consistent throughout the tree: `○` not started,
+next, progress, and the last three semantic actions. Press `v` from the timeline
+for workflow technical state, or from Workflow Planner for provider session,
+every checkpoint turn, usage, prompt, and artifact paths. Status marks are consistent throughout the tree: `○` not started,
 an animated Braille spinner for active work, `⧖` waiting, `✓` finished, and
 `✗` failed or interrupted. The non-emoji `⧖` avoids the inconsistent cell
 width of `⌛` across terminal fonts. It watches ongoing runs from disk and supports `j`/`k` or arrow-key selection, Enter for
 details, Esc to go back, `c` to request a confirmed cooperative stop, `r` to
 refresh, and `q` to detach. Its responsive drill-down fits both desktop and
 mobile SSH terminals without squeezing phase, agent, and activity into three
-narrow columns.
+narrow columns. Below 100 columns it opens on a full-width timeline; press `t`
+to toggle Timeline and Phases, then use Enter/Esc for agents and activity.
 
 ```bash
 bullswarm workflow tui
@@ -431,7 +453,7 @@ appending anything. It executes ready actions, observes their durable results,
 and calls the planner again. `events.jsonl`, `state.json`, the TUI, and JSON
 inspection expose the same plan, actions, attempts, decisions, budgets, and
 artifacts. See `workflows/adaptive-code-review.json` for a complete example.
-Planner actions cannot set `pool`, `addDir`, or `taskFile`. If those need to be
+Planner actions cannot set `pool`, `model`, `addDir`, or `taskFile`. If those need to be
 fixed by the initiator, declare them under the `decide` step's `actionDefaults`;
 otherwise eligible capable pools are ranked by live quota surplus.
 

package/docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md

@@ -307,3 +307,85 @@ is met: each round fixed a defect the deliverable needed fixed. Prediction befor
 rounds and the 10-min recovery turn vanish, wall ≈ 30 min"; observed 25 min 13 s with one planner turn.
 
 Cost: 22 of 23 dispatches on the unmetered opencode2 seat; Claude quota spent on one 247 s planner turn.
+
+## Goal-4 rerun on v0.16.0 (phase = stage) — `euh622` (wf-mtej85ws-18a3c0), 15:25:14 → 16:01:14 Z — **36 min 00 s, auto-completed; one planner-authored false rejection cost the recovery turn**
+
+Runtime `4bfd7f4` = released v0.16.0 (rule 3 "a phase is a pipeline stage … never one per action"); workers pinned to
+`opencode2`/`kaihk/gpt-5.6-luna` (cleared after); orchestrator `claude-code`/`claude-opus-5`; fresh fixture `g4-bs-v5`.
+
+| metric | `r2vu9i` | `bizp4s` | **`euh622`** |
+| --- | ---: | ---: | ---: |
+| wall | 36 min 58 s | 25 min 13 s | 36 min 00 s (2 157 s) |
+| planner turns / plannerSec | 2 / 648 s | 1 / 247 s | 2 / 728 s (34 %) — 462 s + 266 s |
+| dispatches | 26 | 23 | 24 (22 luna + 2 opus) |
+| max concurrent / parallelism | 4 / 1.55 | 4 / 1.77 | 4 / 1.5 |
+| phases in the TUI | 19 one-action rows | 16 one-action rows | **4 stages** (implement 2, tests 3, verify 6 + repairs, report 2) + 2 recovery phases |
+| repairs (rounds / repaired ok / re-verify rejected) | 4 / 2 / 2 | 3 / 2 / 1 | 4 / 2 / 2 |
+| tests after | 314 | 319 | **319/319**; existing tests +116/−1 (the mandated `:206` extension) and +153/−0 |
+
+What the phase change did: the planner wrote `implement` (impl ∥ docs), `tests` (three test writers), `verify` (six
+verifies), `report` — the layout asked for, with no scheduling change (impl ∥ docs started together; three test writers
+and verify-impl started the second impl landed; verify-docs ran while impl was still running). Width was one docs
+worker (three files merged; off the critical path) but three test writers — comparable to `bizp4s`.
+
+The four repair rounds:
+- `verify-impl` r1: fan-out items dispatched through plain `dispatch()`, so `stepTemplate.outputSchema` was never applied
+  — real. Re-verify rejected: the repair tested `step.outputSchema` instead of `itemStep.outputSchema` — the listed
+  concern still unresolved, exactly the rejection the re-verify rule permits. r2 repaired; re-verify ok.
+- `verify-test-runtime` r1: the retry case did not assert the `errors` payload of `action.output_schema_retry` — real.
+- `verify-test-refs` r1: the acceptance command failed on the pre-existing assertion at `workflow-adaptive.test.js:206`
+  (`programFeatures` pinned to three entries) because goal item 5 mandates adding `outputSchema` to it. The repair
+  extended the assertion (+116/−1). Re-verify rejected BECAUSE an existing assertion changed — the planner had written
+  "EXTEND BY APPENDING new test cases only" into `test-refs` and "shows APPENDED cases only" into `verify-test-refs`,
+  and "Do NOT modify existing tests" into `impl`, while the goal says "do NOT modify existing tests except to extend
+  them". No worker owned the assertion; the verifier treated its prompt's rule as an unresolved concern. `verify-suite`,
+  `report`, `verify-report` blocked → planner turn 2 (266 s), whose reason is exact: "verify-test-refs ended ok:false
+  on an append-only rule that the goal itself makes unsatisfiable — goal item 5 mandates adding 'outputSchema' to
+  programFeatures". Recovery program `verify-suite-full` → `final-report` → `verify-final-report`, auto-completed.
+  Third occurrence of this shape (attempt 3, `r2vu9i`, here); `bizp4s` avoided it only because its implementation
+  happened to keep the old assertion true.
+
+Cost of the false rejection: the 266 s planner turn plus the serialised tail ≈ 5–6 min; the rest of the gap to
+`bizp4s` is variance (planner turn 1 462 s vs 247 s on the same contract; `impl` 445 s vs 377 s).
+
+Fix committed after the run, unreleased (`71960ae`): rule 7 — "A verify checks the goal's own acceptance criteria …
+never add a process rule the goal does not state (append-only, tests untouched); when the implementation changes what
+an existing assertion pins, a worker must own updating it." Proof pending a rerun on that commit.
+
+## Run `8ebi8a` — runtime `7724da1` (rule 7 `71960ae` + PR #5 merge), luna pinned, fixture g4-bs-v6
+
+Launched 2026-08-29 16:42 Z as the live proof of rule 7. Result: **42 min 03 s**, worse than `euh622` (36 min) and
+`bizp4s` (25 min). Measured (`bs-g4-v6-metrics.json`): 3 planner turns / 775 s (31 % of wall; turn 2 430 s, correction
+turn 97 s, turn 1 ≈ 248 s derived), parallelism 1.34, max 3 concurrent, 23 dispatches (20 workers on
+`kaihk/gpt-5.6-luna`, 3 planner turns on claude-code/opus), 3 repair rounds — every re-verify rejected — 1 validator
+correction, auto-completed by `program-completion`, `npm test` 315/315, existing tests +179/−1 (the mandated `:206`
+extension, finally done by a named action `fix-pinned-test`).
+
+The three rejections were each legitimate under the re-verify rule of `9af8fdf`; the defect was in the prompts the
+planner wrote, and rule 7 did not stop it:
+- `verify-impl` r1: real concern. Repair 1 removed `outputSchema` from `programFeatures` so the OLD assertion at
+  `workflow-adaptive.test.js:206` would pass — because `impl` was told "do NOT modify existing tests", `tests-runtime`
+  (owner of that file) was never told to extend `:206`, and `verify-impl` expected `impl` to have done it. Re-verify
+  rejected (a regression: item 5 mandates the entry). r2 re-added it; the old assertion failed again; rejected.
+  Turn 2's reason names it: "my round-1 prompt asked for it". Nobody owned the assertion — the fourth run with this gap.
+- `verify-docs` r1: its prompt said "only those three doc files were changed by this worker (`git diff --stat`)"; the
+  repo-wide diff showed `impl`'s files, so it rejected on scope. The repair, told "Do not touch src/", still reverted
+  five `src/` files to make `git diff --name-only` show three files (its report: "git diff --name-only reports exactly
+  the three requested documentation files… 299 tests"). Re-verify rejected on the missing implementation.
+- Tail blocked: `verify-tests-schema`, `verify-tests-runtime`, `verify-suite`, `report`, `verify-report` depended on
+  `verify-impl` (a verdict, chosen so repairs would not edit the same files) → `failed_terminal` → planner turn 2,
+  which re-proposed the blocked id `verify-suite` → validator rejection → 97 s correction → recovery program
+  `restore-src` → `fix-pinned-test` → `verify-src` / `verify-tests` → `verify-full-suite` → `final-report` →
+  `verify-final-report`, all ok.
+
+Where the extra time went (vs `bizp4s`): ≈ 17 min in the two failed verify loops, the blocked tail, turn 2 and the
+correction; `impl` 493 s vs 377 s is variance.
+
+Conclusion and fix (unreleased, committed after the run): three runs in a row failed on a different planner-authored
+constraint the goal never stated (append-only → contradictory ownership → repo-wide scope check), so contract text
+alone is whack-a-mole. The runtime now owns the bar: every verify/re-verify instruction ends with a fixed acceptance
+standard (ok:false = unusable; everything else is a concern under ok:true; other actions' files are never this unit's
+defect), every repair prompt says to edit only the reviewed work's files and never revert others' changes, rule 2
+requires one owner per file including an existing test the change breaks, and the validator line states run-wide id
+uniqueness. Direction from the user: "unless it is completely nonsense or unable to finish I don't see a reason to
+reject so easily". Claim to test on the next rerun: none of the three `8ebi8a` rejection reasons can produce ok:false.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bullswarm",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Route work across coding-agent CLI subscriptions — paced by live quota meters, verified by content, never trusting exit codes.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -130,8 +130,15 @@ terminal-owned execution.
 The detached runner does not depend on the initiating CLI remaining alive.
 Resume a process-interrupted run from its persisted definition with
 `bullswarm workflow goal --resume <shortId> --json`. Leave orchestrator
-selection automatic in normal use; `--orchestrator=<pool>` is for controlled
-provider QA. `SIGTERM`/`SIGINT` cooperatively terminate the active delegate and
+selection automatic in normal use. `--orchestrator=<pool>` is a preference
+that falls back when the pool is quota-gated or unavailable;
+`--strict-orchestrator=<pool>` is the exact-provider control for QA and may
+wait for that pool's quota window. For a controlled model comparison, add
+`--orchestrator-model=<model>`, `--worker-pool=<pool>`, and
+`--worker-model=<model>`. The worker constraints cover scout, runs, fan-out
+items, repairs, re-verification, and extraction helpers; a pool that cannot
+guarantee the model is excluded rather than silently substituting it.
+`SIGTERM`/`SIGINT` cooperatively terminate the active delegate and
 persist `interrupted`; later workflow commands also reconcile dead or stale
 owners into that explicit resumable state.
 
@@ -223,8 +230,9 @@ ISO timestamps, local dates, today/yesterday/tomorrow/now, or durations such as
 normal ongoing-only scope.
 
 When the run is terminal, use `workflow runs result <id> --json` as the
-handoff contract. Its versioned result envelope points to the selected delivery
-artifact, the dependent verification verdict, progress, and usage. Do not guess
+handoff contract. Its versioned result envelope keeps one primary `delivery`,
+adds every jointly delivered parallel artifact under `deliveries[]`, and points
+to the strongest dependent verification verdict, progress, and usage. Do not guess
 the output schema by scraping task files or assume the last provider response is
 the deliverable; `runs show` is for low-level debugging.
 
@@ -277,12 +285,18 @@ supports explicit model selection, Bullswarm pins an allowed model in the same
 effort tier; otherwise that pool is excluded because its implicit default
 cannot be guaranteed. Restore eligibility with `strategy include-model`.
 
-In the human TUI, the autonomous orchestrator has a compact selectable panel
-stacked above the phase tree. Select it and press Enter, or press
+In the human TUI, the autonomous orchestrator is presented as Workflow Planner
+in a compact selectable panel stacked above the phase tree. The default desktop
+view pairs that unchanged navigation with a timestamped workflow timeline:
+finished events stay above a live Planner/worker section with each participant's
+latest semantic action, while unexecuted work stays in a separate Next section.
+Select Workflow Planner and press Enter, or press
 `o`, to see a summary-first overview of its current role, latest decision,
 reason, next action, progress, and recent semantic activity. Press `v` for the
 durable provider session, checkpoint prompts and turns, usage, and artifact
 paths; `v` returns to the overview and Esc returns to phases.
+Below 100 columns the TUI opens on a full-width timeline; `t` toggles Timeline
+and Phases, and Enter/Esc continues through agents and activity.
 The shared state marks are `○` not started, animated Braille spinner active,
 `⧖` waiting, `✓` finished, and `✗` failed or interrupted.
 
@@ -400,7 +414,7 @@ orchestrator for the rest of the run and tries one other eligible pool
 `completed_with_concerns` with a ready best-effort artifact when useful work
 exists, or `blocked` when it does not; neither hides failed verification.
 Use `workflows/adaptive-code-review.json` as the starting template.
-Planner proposals cannot choose `pool`, `addDir`, or `taskFile`. Those fields
+Planner proposals cannot choose `pool`, `model`, `addDir`, or `taskFile`. Those fields
 are runtime-owned. An initiator may constrain them with a decide step's
 `actionDefaults`; absent a pinned default, normal capability and quota routing
 selects the worker.

package/src/help.js

@@ -581,7 +581,11 @@ const workflowGoalText = rich({
     { flag: '--watch', desc: 'immediately follow low-noise progress until terminal; only valid for a new human-readable independent launch — cannot combine with --detach, --foreground, --json, --resume, or --request', default: 'off' },
     { flag: '--foreground', desc: 'keep execution attached to this terminal instead of detaching', default: 'off (detaches into a background process)' },
     { flag: '--json', desc: 'print the launch/report document as JSON', default: 'human-readable launch instructions' },
-    { flag: '--orchestrator <pool|auto>', desc: 'pin the orchestrator pool for a new goal, or override it when combined with --resume', default: 'auto (capability- and quota-based selection)' },
+    { flag: '--orchestrator <pool|auto>', desc: 'prefer this orchestrator pool for a new goal or resumed run, falling back immediately when it is quota-gated, ineligible, or unavailable', default: 'auto (capability- and quota-based selection)' },
+    { flag: '--strict-orchestrator <pool>', desc: 'require exactly this orchestrator pool for controlled provider QA; waits when that pool is quota-gated instead of falling back; mutually exclusive with --orchestrator', default: 'off' },
+    { flag: '--orchestrator-model <model|auto>', desc: 'pin the exact model used by the autonomous planner; only pools that can guarantee this model remain eligible', default: 'auto (effort-tier strategy or connector default)' },
+    { flag: '--worker-pool <pool|auto>', desc: 'pin every non-planner dispatch, including scout, fan-out items, repairs, and verifiers, to one pool', default: 'auto (normal routing)' },
+    { flag: '--worker-model <model|auto>', desc: 'pin the exact model for every non-planner dispatch; only pools that can guarantee it remain eligible', default: 'auto (effort-tier strategy or connector default)' },
     { flag: '--max-agents <n>', desc: 'planning target for total dispatched agents (soft, not a hard stop)', default: '30 (max 500)' },
     { flag: '--max-expansion-rounds <n>', desc: 'planning target for planner replanning rounds', default: '8 (max 50)' },
     { flag: '--max-actions <n>', desc: 'planning target for total dispatched actions', default: '40 (max 1000)' },
@@ -605,6 +609,7 @@ const workflowGoalText = rich({
   ],
   examples: [
     { cmd: 'bullswarm workflow goal "Audit this repo for TODOs and file a one-page summary" --cwd .' },
+    { cmd: 'bullswarm workflow goal "Implement and verify the change" --cwd . --strict-orchestrator codex --orchestrator-model gpt-5.6-sol --worker-pool opencode2 --worker-model kaihk/gpt-5.6-luna', note: 'controlled Sol-planner/Luna-worker run' },
   ],
   next: 'bullswarm workflow watch <shortId> to follow progress, or bullswarm workflow tui for the interactive browser.',
 });
@@ -660,7 +665,7 @@ const workflowCapabilitiesText = rich({
   options: [{ flag: '--json', desc: 'accepted for consistency with other commands, but has no effect', default: 'output is always JSON regardless of this flag' }],
   safety: ['read-only — performs live pool discovery to populate pool/meter state; nothing is written'],
   examples: [{ cmd: 'bullswarm workflow capabilities' }],
-  next: 'bullswarm workflow goal "<goal>" --orchestrator <pool> to pin one of the reported pools, or bullswarm strategy show to review model tier assignments.',
+  next: 'bullswarm workflow goal "<goal>" --orchestrator <pool> to prefer one of the reported pools with fallback, or bullswarm strategy show to review model tier assignments.',
 });
 
 const workflowInspectText = rich({
@@ -676,8 +681,9 @@ const workflowInspectText = rich({
 
 const workflowTuiText = rich({
   usage: 'bullswarm workflow tui [<runId>] [--json] [--all] [--show <runId>] [--cancel <runId>]',
-  purpose: 'Open the interactive full-screen phase → agent → step/detail browser for ongoing '
-    + 'and historical runs, or print a static/JSON snapshot for a non-interactive caller.',
+  purpose: 'Open the interactive full-screen workflow timeline with Workflow Planner, phase, '
+    + 'live-agent, and technical drill-down views for ongoing and historical runs, or print a '
+    + 'static/JSON snapshot for a non-interactive caller.',
   args: [{ name: '[<runId>]', desc: 'shortId or runId to open directly in detail view; omit to see the run picker' }],
   options: [
     { flag: '--json', desc: "print a JSON snapshot instead of opening the interactive browser (list of ongoing runs, or one run's state/report/events when a runId is given)", default: "opens the interactive browser on a TTY; without a TTY, a given runId instead prints one static text detail tree" },
@@ -689,6 +695,8 @@ const workflowTuiText = rich({
     'interactive mode and the --json/--show/--all views are read-only',
     '--cancel writes state.json (cancelRequested=true, status=cancelling) — cooperative, not a force-kill: the workflow stops at its next safe checkpoint',
     'inside the interactive browser, q detaches without stopping the underlying workflow; c requests the same cancellation with a confirmation prompt',
+    'the default timeline is derived from durable state and events; press v for raw action-ledger and event evidence',
+    'below 100 columns the timeline remains full-width; press t to toggle Timeline and Phases, then Enter/Esc to drill into agents and activity',
   ],
   examples: [
     { cmd: 'bullswarm workflow tui', note: 'interactive run picker' },
@@ -867,8 +875,8 @@ const workflowRunsShowText = rich({
 
 const workflowRunsResultText = rich({
   usage: 'bullswarm workflow runs result <shortId|runId> [--json]',
-  purpose: 'Print the stable, caller-facing delivery content, verification verdict, progress, '
-    + 'and usage envelope for one run — the intended integration point for scripts and agents.',
+  purpose: 'Print the stable caller envelope: primary delivery, parallel deliveries[] frontier, '
+    + 'strongest verification verdict, progress, and usage for one run — the intended integration point for scripts and agents.',
   args: [{ name: '<shortId|runId>', desc: 'run identifier' }],
   options: [{ flag: '--json', desc: 'print the full result document as JSON', default: 'human-readable summary (delivery preview truncated to 64KB)' }],
   safety: ['read-only'],

package/src/workflow/cli.js

@@ -295,21 +295,83 @@ export function shouldAutoWatchGoal(opts) {
     opts.json !== true && opts.resume == null && opts.request == null;
 }
 
-export function applyResumeOrchestratorOverride(doc, requested) {
-  if (!requested) return doc;
-  const pool = requested === 'auto' ? null : requested;
+export function applyResumeOrchestratorOverride(doc, requested, strictRequested = null) {
+  if (!requested && !strictRequested) return doc;
+  if (requested && strictRequested) {
+    throw new Error('--orchestrator and --strict-orchestrator are mutually exclusive');
+  }
+  const strict = Boolean(strictRequested);
+  const selected = strictRequested ?? requested;
+  const pool = selected === 'auto' ? null : selected;
   doc.intent ??= {};
   doc.orchestration ??= {};
   doc.intent.requestedOrchestrator = pool ?? 'auto';
   doc.orchestration.requestedPool = pool;
+  doc.orchestration.strictPool = strict ? pool : null;
   doc.orchestration.selection = pool
-    ? 'user-pinned-for-testing'
+    ? (strict ? 'user-strict-for-testing' : 'user-preferred-with-fallback')
     : 'capability-strategy-and-quota';
   for (const phase of doc.phases ?? []) {
     for (const step of phase.steps ?? []) {
       if (step.type !== 'decide') continue;
-      if (pool) step.pool = pool;
-      else delete step.pool;
+      delete step.pool;
+      delete step.preferredPool;
+      if (pool) step[strict ? 'pool' : 'preferredPool'] = pool;
+    }
+  }
+  return doc;
+}
+
+export function applyResumeModelOverrides(doc, {
+  orchestratorModel = null,
+  workerPool = null,
+  workerModel = null,
+} = {}) {
+  const normalize = (value) => value === 'auto' ? null : value;
+  const plannerModel = normalize(orchestratorModel);
+  const workers = normalize(workerPool);
+  const workerModelLock = normalize(workerModel);
+  if (orchestratorModel == null && workerPool == null && workerModel == null) return doc;
+  doc.intent ??= {};
+  doc.orchestration ??= {};
+  if (orchestratorModel != null) {
+    doc.intent.requestedOrchestratorModel = plannerModel ?? 'auto';
+    doc.orchestration.requestedModel = plannerModel;
+  }
+  if (workerPool != null) {
+    doc.intent.requestedWorkerPool = workers ?? 'auto';
+    doc.orchestration.workerPool = workers;
+  }
+  if (workerModel != null) {
+    doc.intent.requestedWorkerModel = workerModelLock ?? 'auto';
+    doc.orchestration.workerModel = workerModelLock;
+  }
+  for (const phase of doc.phases ?? []) {
+    for (const step of phase.steps ?? []) {
+      if (step.type === 'decide') {
+        step.actionDefaults ??= {};
+        if (orchestratorModel != null) {
+          if (plannerModel) step.model = plannerModel;
+          else delete step.model;
+        }
+        if (workerPool != null) {
+          if (workers) step.actionDefaults.pool = workers;
+          else delete step.actionDefaults.pool;
+        }
+        if (workerModel != null) {
+          if (workerModelLock) step.actionDefaults.model = workerModelLock;
+          else delete step.actionDefaults.model;
+        }
+        continue;
+      }
+      if (workerPool != null) {
+        if (workers) step.pool = workers;
+        else delete step.pool;
+      }
+      if (workerModel != null) {
+        if (workerModelLock) step.model = workerModelLock;
+        else delete step.model;
+      }
     }
   }
   return doc;
@@ -324,6 +386,10 @@ async function wfGoal(opts) {
     console.error('✗ --watch is only valid for a new human-readable independent launch; do not combine it with --detach, --foreground, --json, --resume, or --request');
     return 2;
   }
+  if (opts.orchestrator && opts['strict-orchestrator']) {
+    console.error('✗ --orchestrator and --strict-orchestrator are mutually exclusive');
+    return 2;
+  }
   const { names, pools } = await livePoolNames();
   let doc;
   let resumeRunId = null;
@@ -345,7 +411,17 @@ async function wfGoal(opts) {
       console.error(`✗ cannot load durable workflow for ${resumeRunId}: ${err.message}`);
       return 1;
     }
-    applyResumeOrchestratorOverride(doc, opts.orchestrator);
+    try {
+      applyResumeOrchestratorOverride(doc, opts.orchestrator, opts['strict-orchestrator']);
+      applyResumeModelOverrides(doc, {
+        orchestratorModel: opts['orchestrator-model'],
+        workerPool: opts['worker-pool'],
+        workerModel: opts['worker-model'],
+      });
+    } catch (err) {
+      console.error(`✗ invalid goal options: ${err.message}`);
+      return 2;
+    }
   } else if (opts.request) {
     try {
       const request = JSON.parse(readFileSync(resolve(opts.request), 'utf8'));
@@ -364,13 +440,24 @@ async function wfGoal(opts) {
       console.error(goalUsage());
       return 2;
     }
-    const orchestrator = opts.orchestrator && opts.orchestrator !== 'auto'
-      ? opts.orchestrator : null;
+    const requestedOrchestrator = opts['strict-orchestrator'] ?? opts.orchestrator;
+    const orchestrator = requestedOrchestrator && requestedOrchestrator !== 'auto'
+      ? requestedOrchestrator : null;
+    const workerPool = opts['worker-pool'] && opts['worker-pool'] !== 'auto'
+      ? opts['worker-pool'] : null;
+    const workerModel = opts['worker-model'] && opts['worker-model'] !== 'auto'
+      ? opts['worker-model'] : null;
+    const orchestratorModel = opts['orchestrator-model'] && opts['orchestrator-model'] !== 'auto'
+      ? opts['orchestrator-model'] : null;
     try {
       doc = buildGoalWorkflow({
         goal,
         cwd: opts.cwd ?? process.cwd(),
         orchestrator,
+        strictOrchestrator: Boolean(opts['strict-orchestrator']),
+        orchestratorModel,
+        workerPool,
+        workerModel,
         settings: goalSettings(opts),
         scout: !opts.noScout,
         worktreeIsolation: loadState(BULLSWARM_DIR()).config?.worktreeIsolation ?? 'agent-decides',
@@ -616,7 +703,8 @@ async function wfInspect(opts) {
 function parseFlags(argv) {
   const out = { inputs: {}, rest: [] };
   const valueFlags = new Set([
-    'resume', 'after', 'cwd', 'orchestrator', 'request', 'run-id',
+    'resume', 'after', 'cwd', 'orchestrator', 'strict-orchestrator', 'orchestrator-model',
+    'worker-pool', 'worker-model', 'request', 'run-id',
     'max-agents', 'max-expansion-rounds', 'max-actions',
     'max-items-per-expansion', 'max-workflow-seconds', 'concurrency',
     'retry-attempts', 'interval', 'heartbeat', 'message',