bullswarm 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,6 +1,68 @@
 # bullswarm changelog
 
-## Unreleased
+## 0.18.0 — exact routes, cheaper plans, clearer results
+
+- `workflow goal` can now guarantee an exact planner model and a separate exact
+  worker route with `--orchestrator-model`, `--worker-pool`, and
+  `--worker-model`. The worker lock is runtime-owned and propagates through the
+  scout, ordinary actions, fan-out items, verification repairs, reverification,
+  and extraction helpers; unsupported or excluded models fail closed instead
+  of silently substituting another model.
+- An action-bearing planner `proceed` is normalized to the schema-equivalent
+  `needs_more_work` program before validation. This removes a redundant
+  correction turn without changing the proposed graph or weakening any safety
+  check (the prior real run spent four frontier planner turns correcting this
+  exact representation mismatch).
+- `workflow runs result` now selects the latest successful verifier that
+  transitively covers the delivery, so a final suite verifier depending on
+  unit verifiers is surfaced ahead of a narrower direct unit check.
+- The same result envelope now adds a backward-compatible `deliveries[]`
+  frontier for parallel multi-worker outcomes while preserving the singular
+  `delivery` field for existing callers.
+- The autonomous planner now batches cheap homogeneous edits instead of paying
+  for a worker and unit verifier per tiny file; substantial independent units
+  still fan out and retain focused verification before the final suite.
+- Narrow SSH and phone terminals now open on a full-width workflow timeline;
+  `t` toggles between that overview and the phase browser without affecting the
+  existing Enter/Esc agent drill-down.
+- Goal-level `--orchestrator <pool>` is now a preference with immediate
+  fallback when that pool is quota-gated, ineligible, or unavailable. Exact
+  provider testing moves to `--strict-orchestrator <pool>`. Quota waits now
+  refresh the durable runner heartbeat at least every 30 seconds, preventing a
+  live waiting run from being falsely reconciled as interrupted and making
+  cooperative cancellation responsive during long meter-poll intervals.
+
+- The runtime now owns the acceptance bar for every verify and re-verify. Each
+  verifier's instructions end with a fixed "Acceptance standard (runtime-owned;
+  it overrides any stricter rule in the instructions above)": `ok:false` means
+  the work is unusable — its acceptance command fails, a required deliverable
+  is missing, or the answer is nonsense — and everything else (style, scope,
+  cosmetic mismatches, process rules the goal never stated such as append-only,
+  files changed by other actions in the shared tree) goes in `concerns` under
+  `ok:true`. A re-verify rejects only when the work is still unusable or the
+  repair broke the acceptance checks. Direction from the user after `8ebi8a`:
+  "unless it is completely nonsense or unable to finish I don't see a reason to
+  reject so easily".
+- Repair prompts carry a runtime-owned shared-tree rule: edit only the files
+  the reviewed work owns; a concern about other files is not the repair's to
+  resolve; never revert, checkout or delete other actions' changes. Earned on
+  `8ebi8a`: `verify-docs` rejected on a repo-wide `git diff --stat` scope check
+  while siblings were writing, and its repair reverted five `src/` files it did
+  not own to satisfy the concern.
+- Planner contract: rule 2 requires exactly one owner per file, including any
+  existing test the change breaks (the `workflow-adaptive.test.js:206` gap for
+  the fourth time); rule 7 restates the lenient bar above; the validator line
+  now says ids are unique across the whole run, finished and failed actions
+  included (turn 2 of `8ebi8a` re-proposed the blocked id `verify-suite` and
+  spent a 97 s correction turn on it).
+- Goal-4 rerun on `7724da1` (`8ebi8a`, rule 7 + PR #5): 42 min 03 s, three
+  planner turns (775 s, 31 %), parallelism 1.34, 23 dispatches (20 on
+  `kaihk/gpt-5.6-luna`), three repair rounds each rejected on re-verify for
+  reasons the prompts caused, tail of five actions blocked, recovery program
+  auto-completed, 315/315, existing tests +179/−1. Goal-4 line:
+  44 → 72 → 37 → 25 → 36 → 42 min.
+
+## 0.17.0 — the timeline tells the execution story
 
 - Workflow timeline (PR #5) hardened after a 16-agent adversarial review against
   real run state (23 findings, 21 confirmed): worker rows now name their phase

package/README.md

@@ -188,8 +188,23 @@ Resume a process-interrupted autonomous run from its persisted workflow:
 bullswarm workflow goal --resume <shortId> --json
 ```
 
-`--orchestrator <pool>` exists for controlled testing; ordinary use should
-leave selection on `auto`. `--max-agents` and `--max-workflow-seconds` are
+`--orchestrator <pool>` expresses a preference and immediately falls back to
+another eligible pool if that provider is quota-gated or unavailable. Ordinary
+use can leave selection on `auto`. For controlled provider QA only,
+`--strict-orchestrator <pool>` requires that exact pool and may wait for its
+quota window. Controlled comparisons can additionally pin the exact planner
+and worker routes without changing global strategy:
+
+```bash
+bullswarm workflow goal "Implement and verify the change" --cwd . \
+  --strict-orchestrator codex --orchestrator-model gpt-5.6-sol \
+  --worker-pool opencode2 --worker-model kaihk/gpt-5.6-luna
+```
+
+The worker lock covers the scout, ordinary runs, fan-out items, repairs,
+re-verification, and runtime extraction helpers. A pool that cannot guarantee
+the requested model is ineligible rather than silently substituting another
+model. `--max-agents` and `--max-workflow-seconds` are
 advisory planning targets; `--max-expansion-rounds` is also an advisory
 convergence target. Hard structural safeguards are adjusted with
 `--max-actions` and `--max-items-per-expansion`.
@@ -258,8 +273,9 @@ Values accept ISO timestamps, local `YYYY-MM-DD` dates, `today`, `yesterday`,
 After a workflow reaches a terminal state, agents should consume
 `workflow runs result <id> --json` instead of probing `state.json`, task files,
 or provider-specific output. The versioned `bullswarm.workflow.result.v1`
-envelope identifies the final delivery artifact and its matching verification
-verdict, and includes progress, step logs, tokens, and an explicitly
+envelope retains the primary `delivery`, adds a `deliveries[]` frontier when
+parallel workers jointly form the outcome, and identifies their strongest
+matching verification verdict. It also includes progress, step logs, tokens, and an explicitly
 complete-or-partial tool-call total. `runs show` remains the low-level debugging
 surface.
 Goal launch output includes an `instructions` handoff with four named paths:
@@ -308,7 +324,8 @@ width of `⌛` across terminal fonts. It watches ongoing runs from disk and supp
 details, Esc to go back, `c` to request a confirmed cooperative stop, `r` to
 refresh, and `q` to detach. Its responsive drill-down fits both desktop and
 mobile SSH terminals without squeezing phase, agent, and activity into three
-narrow columns.
+narrow columns. Below 100 columns it opens on a full-width timeline; press `t`
+to toggle Timeline and Phases, then use Enter/Esc for agents and activity.
 
 ```bash
 bullswarm workflow tui
@@ -436,7 +453,7 @@ appending anything. It executes ready actions, observes their durable results,
 and calls the planner again. `events.jsonl`, `state.json`, the TUI, and JSON
 inspection expose the same plan, actions, attempts, decisions, budgets, and
 artifacts. See `workflows/adaptive-code-review.json` for a complete example.
-Planner actions cannot set `pool`, `addDir`, or `taskFile`. If those need to be
+Planner actions cannot set `pool`, `model`, `addDir`, or `taskFile`. If those need to be
 fixed by the initiator, declare them under the `decide` step's `actionDefaults`;
 otherwise eligible capable pools are ranked by live quota surplus.
 

package/docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md

@@ -351,3 +351,41 @@ Cost of the false rejection: the 266 s planner turn plus the serialised tail ≈
 Fix committed after the run, unreleased (`71960ae`): rule 7 — "A verify checks the goal's own acceptance criteria …
 never add a process rule the goal does not state (append-only, tests untouched); when the implementation changes what
 an existing assertion pins, a worker must own updating it." Proof pending a rerun on that commit.
+
+## Run `8ebi8a` — runtime `7724da1` (rule 7 `71960ae` + PR #5 merge), luna pinned, fixture g4-bs-v6
+
+Launched 2026-08-29 16:42 Z as the live proof of rule 7. Result: **42 min 03 s**, worse than `euh622` (36 min) and
+`bizp4s` (25 min). Measured (`bs-g4-v6-metrics.json`): 3 planner turns / 775 s (31 % of wall; turn 2 430 s, correction
+turn 97 s, turn 1 ≈ 248 s derived), parallelism 1.34, max 3 concurrent, 23 dispatches (20 workers on
+`kaihk/gpt-5.6-luna`, 3 planner turns on claude-code/opus), 3 repair rounds — every re-verify rejected — 1 validator
+correction, auto-completed by `program-completion`, `npm test` 315/315, existing tests +179/−1 (the mandated `:206`
+extension, finally done by a named action `fix-pinned-test`).
+
+The three rejections were each legitimate under the re-verify rule of `9af8fdf`; the defect was in the prompts the
+planner wrote, and rule 7 did not stop it:
+- `verify-impl` r1: real concern. Repair 1 removed `outputSchema` from `programFeatures` so the OLD assertion at
+  `workflow-adaptive.test.js:206` would pass — because `impl` was told "do NOT modify existing tests", `tests-runtime`
+  (owner of that file) was never told to extend `:206`, and `verify-impl` expected `impl` to have done it. Re-verify
+  rejected (a regression: item 5 mandates the entry). r2 re-added it; the old assertion failed again; rejected.
+  Turn 2's reason names it: "my round-1 prompt asked for it". Nobody owned the assertion — the fourth run with this gap.
+- `verify-docs` r1: its prompt said "only those three doc files were changed by this worker (`git diff --stat`)"; the
+  repo-wide diff showed `impl`'s files, so it rejected on scope. The repair, told "Do not touch src/", still reverted
+  five `src/` files to make `git diff --name-only` show three files (its report: "git diff --name-only reports exactly
+  the three requested documentation files… 299 tests"). Re-verify rejected on the missing implementation.
+- Tail blocked: `verify-tests-schema`, `verify-tests-runtime`, `verify-suite`, `report`, `verify-report` depended on
+  `verify-impl` (a verdict, chosen so repairs would not edit the same files) → `failed_terminal` → planner turn 2,
+  which re-proposed the blocked id `verify-suite` → validator rejection → 97 s correction → recovery program
+  `restore-src` → `fix-pinned-test` → `verify-src` / `verify-tests` → `verify-full-suite` → `final-report` →
+  `verify-final-report`, all ok.
+
+Where the extra time went (vs `bizp4s`): ≈ 17 min in the two failed verify loops, the blocked tail, turn 2 and the
+correction; `impl` 493 s vs 377 s is variance.
+
+Conclusion and fix (unreleased, committed after the run): three runs in a row failed on a different planner-authored
+constraint the goal never stated (append-only → contradictory ownership → repo-wide scope check), so contract text
+alone is whack-a-mole. The runtime now owns the bar: every verify/re-verify instruction ends with a fixed acceptance
+standard (ok:false = unusable; everything else is a concern under ok:true; other actions' files are never this unit's
+defect), every repair prompt says to edit only the reviewed work's files and never revert others' changes, rule 2
+requires one owner per file including an existing test the change breaks, and the validator line states run-wide id
+uniqueness. Direction from the user: "unless it is completely nonsense or unable to finish I don't see a reason to
+reject so easily". Claim to test on the next rerun: none of the three `8ebi8a` rejection reasons can produce ok:false.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bullswarm",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Route work across coding-agent CLI subscriptions — paced by live quota meters, verified by content, never trusting exit codes.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -130,8 +130,15 @@ terminal-owned execution.
 The detached runner does not depend on the initiating CLI remaining alive.
 Resume a process-interrupted run from its persisted definition with
 `bullswarm workflow goal --resume <shortId> --json`. Leave orchestrator
-selection automatic in normal use; `--orchestrator=<pool>` is for controlled
-provider QA. `SIGTERM`/`SIGINT` cooperatively terminate the active delegate and
+selection automatic in normal use. `--orchestrator=<pool>` is a preference
+that falls back when the pool is quota-gated or unavailable;
+`--strict-orchestrator=<pool>` is the exact-provider control for QA and may
+wait for that pool's quota window. For a controlled model comparison, add
+`--orchestrator-model=<model>`, `--worker-pool=<pool>`, and
+`--worker-model=<model>`. The worker constraints cover scout, runs, fan-out
+items, repairs, re-verification, and extraction helpers; a pool that cannot
+guarantee the model is excluded rather than silently substituting it.
+`SIGTERM`/`SIGINT` cooperatively terminate the active delegate and
 persist `interrupted`; later workflow commands also reconcile dead or stale
 owners into that explicit resumable state.
 
@@ -223,8 +230,9 @@ ISO timestamps, local dates, today/yesterday/tomorrow/now, or durations such as
 normal ongoing-only scope.
 
 When the run is terminal, use `workflow runs result <id> --json` as the
-handoff contract. Its versioned result envelope points to the selected delivery
-artifact, the dependent verification verdict, progress, and usage. Do not guess
+handoff contract. Its versioned result envelope keeps one primary `delivery`,
+adds every jointly delivered parallel artifact under `deliveries[]`, and points
+to the strongest dependent verification verdict, progress, and usage. Do not guess
 the output schema by scraping task files or assume the last provider response is
 the deliverable; `runs show` is for low-level debugging.
 
@@ -287,6 +295,8 @@ Select Workflow Planner and press Enter, or press
 reason, next action, progress, and recent semantic activity. Press `v` for the
 durable provider session, checkpoint prompts and turns, usage, and artifact
 paths; `v` returns to the overview and Esc returns to phases.
+Below 100 columns the TUI opens on a full-width timeline; `t` toggles Timeline
+and Phases, and Enter/Esc continues through agents and activity.
 The shared state marks are `○` not started, animated Braille spinner active,
 `⧖` waiting, `✓` finished, and `✗` failed or interrupted.
 
@@ -404,7 +414,7 @@ orchestrator for the rest of the run and tries one other eligible pool
 `completed_with_concerns` with a ready best-effort artifact when useful work
 exists, or `blocked` when it does not; neither hides failed verification.
 Use `workflows/adaptive-code-review.json` as the starting template.
-Planner proposals cannot choose `pool`, `addDir`, or `taskFile`. Those fields
+Planner proposals cannot choose `pool`, `model`, `addDir`, or `taskFile`. Those fields
 are runtime-owned. An initiator may constrain them with a decide step's
 `actionDefaults`; absent a pinned default, normal capability and quota routing
 selects the worker.

package/src/help.js

@@ -581,7 +581,11 @@ const workflowGoalText = rich({
     { flag: '--watch', desc: 'immediately follow low-noise progress until terminal; only valid for a new human-readable independent launch — cannot combine with --detach, --foreground, --json, --resume, or --request', default: 'off' },
     { flag: '--foreground', desc: 'keep execution attached to this terminal instead of detaching', default: 'off (detaches into a background process)' },
     { flag: '--json', desc: 'print the launch/report document as JSON', default: 'human-readable launch instructions' },
-    { flag: '--orchestrator <pool|auto>', desc: 'pin the orchestrator pool for a new goal, or override it when combined with --resume', default: 'auto (capability- and quota-based selection)' },
+    { flag: '--orchestrator <pool|auto>', desc: 'prefer this orchestrator pool for a new goal or resumed run, falling back immediately when it is quota-gated, ineligible, or unavailable', default: 'auto (capability- and quota-based selection)' },
+    { flag: '--strict-orchestrator <pool>', desc: 'require exactly this orchestrator pool for controlled provider QA; waits when that pool is quota-gated instead of falling back; mutually exclusive with --orchestrator', default: 'off' },
+    { flag: '--orchestrator-model <model|auto>', desc: 'pin the exact model used by the autonomous planner; only pools that can guarantee this model remain eligible', default: 'auto (effort-tier strategy or connector default)' },
+    { flag: '--worker-pool <pool|auto>', desc: 'pin every non-planner dispatch, including scout, fan-out items, repairs, and verifiers, to one pool', default: 'auto (normal routing)' },
+    { flag: '--worker-model <model|auto>', desc: 'pin the exact model for every non-planner dispatch; only pools that can guarantee it remain eligible', default: 'auto (effort-tier strategy or connector default)' },
     { flag: '--max-agents <n>', desc: 'planning target for total dispatched agents (soft, not a hard stop)', default: '30 (max 500)' },
     { flag: '--max-expansion-rounds <n>', desc: 'planning target for planner replanning rounds', default: '8 (max 50)' },
     { flag: '--max-actions <n>', desc: 'planning target for total dispatched actions', default: '40 (max 1000)' },
@@ -605,6 +609,7 @@ const workflowGoalText = rich({
   ],
   examples: [
     { cmd: 'bullswarm workflow goal "Audit this repo for TODOs and file a one-page summary" --cwd .' },
+    { cmd: 'bullswarm workflow goal "Implement and verify the change" --cwd . --strict-orchestrator codex --orchestrator-model gpt-5.6-sol --worker-pool opencode2 --worker-model kaihk/gpt-5.6-luna', note: 'controlled Sol-planner/Luna-worker run' },
   ],
   next: 'bullswarm workflow watch <shortId> to follow progress, or bullswarm workflow tui for the interactive browser.',
 });
@@ -660,7 +665,7 @@ const workflowCapabilitiesText = rich({
   options: [{ flag: '--json', desc: 'accepted for consistency with other commands, but has no effect', default: 'output is always JSON regardless of this flag' }],
   safety: ['read-only — performs live pool discovery to populate pool/meter state; nothing is written'],
   examples: [{ cmd: 'bullswarm workflow capabilities' }],
-  next: 'bullswarm workflow goal "<goal>" --orchestrator <pool> to pin one of the reported pools, or bullswarm strategy show to review model tier assignments.',
+  next: 'bullswarm workflow goal "<goal>" --orchestrator <pool> to prefer one of the reported pools with fallback, or bullswarm strategy show to review model tier assignments.',
 });
 
 const workflowInspectText = rich({
@@ -691,6 +696,7 @@ const workflowTuiText = rich({
     '--cancel writes state.json (cancelRequested=true, status=cancelling) — cooperative, not a force-kill: the workflow stops at its next safe checkpoint',
     'inside the interactive browser, q detaches without stopping the underlying workflow; c requests the same cancellation with a confirmation prompt',
     'the default timeline is derived from durable state and events; press v for raw action-ledger and event evidence',
+    'below 100 columns the timeline remains full-width; press t to toggle Timeline and Phases, then Enter/Esc to drill into agents and activity',
   ],
   examples: [
     { cmd: 'bullswarm workflow tui', note: 'interactive run picker' },
@@ -869,8 +875,8 @@ const workflowRunsShowText = rich({
 
 const workflowRunsResultText = rich({
   usage: 'bullswarm workflow runs result <shortId|runId> [--json]',
-  purpose: 'Print the stable, caller-facing delivery content, verification verdict, progress, '
-    + 'and usage envelope for one run — the intended integration point for scripts and agents.',
+  purpose: 'Print the stable caller envelope: primary delivery, parallel deliveries[] frontier, '
+    + 'strongest verification verdict, progress, and usage for one run — the intended integration point for scripts and agents.',
   args: [{ name: '<shortId|runId>', desc: 'run identifier' }],
   options: [{ flag: '--json', desc: 'print the full result document as JSON', default: 'human-readable summary (delivery preview truncated to 64KB)' }],
   safety: ['read-only'],

package/src/workflow/cli.js

@@ -295,21 +295,83 @@ export function shouldAutoWatchGoal(opts) {
     opts.json !== true && opts.resume == null && opts.request == null;
 }
 
-export function applyResumeOrchestratorOverride(doc, requested) {
-  if (!requested) return doc;
-  const pool = requested === 'auto' ? null : requested;
+export function applyResumeOrchestratorOverride(doc, requested, strictRequested = null) {
+  if (!requested && !strictRequested) return doc;
+  if (requested && strictRequested) {
+    throw new Error('--orchestrator and --strict-orchestrator are mutually exclusive');
+  }
+  const strict = Boolean(strictRequested);
+  const selected = strictRequested ?? requested;
+  const pool = selected === 'auto' ? null : selected;
   doc.intent ??= {};
   doc.orchestration ??= {};
   doc.intent.requestedOrchestrator = pool ?? 'auto';
   doc.orchestration.requestedPool = pool;
+  doc.orchestration.strictPool = strict ? pool : null;
   doc.orchestration.selection = pool
-    ? 'user-pinned-for-testing'
+    ? (strict ? 'user-strict-for-testing' : 'user-preferred-with-fallback')
     : 'capability-strategy-and-quota';
   for (const phase of doc.phases ?? []) {
     for (const step of phase.steps ?? []) {
       if (step.type !== 'decide') continue;
-      if (pool) step.pool = pool;
-      else delete step.pool;
+      delete step.pool;
+      delete step.preferredPool;
+      if (pool) step[strict ? 'pool' : 'preferredPool'] = pool;
+    }
+  }
+  return doc;
+}
+
+export function applyResumeModelOverrides(doc, {
+  orchestratorModel = null,
+  workerPool = null,
+  workerModel = null,
+} = {}) {
+  const normalize = (value) => value === 'auto' ? null : value;
+  const plannerModel = normalize(orchestratorModel);
+  const workers = normalize(workerPool);
+  const workerModelLock = normalize(workerModel);
+  if (orchestratorModel == null && workerPool == null && workerModel == null) return doc;
+  doc.intent ??= {};
+  doc.orchestration ??= {};
+  if (orchestratorModel != null) {
+    doc.intent.requestedOrchestratorModel = plannerModel ?? 'auto';
+    doc.orchestration.requestedModel = plannerModel;
+  }
+  if (workerPool != null) {
+    doc.intent.requestedWorkerPool = workers ?? 'auto';
+    doc.orchestration.workerPool = workers;
+  }
+  if (workerModel != null) {
+    doc.intent.requestedWorkerModel = workerModelLock ?? 'auto';
+    doc.orchestration.workerModel = workerModelLock;
+  }
+  for (const phase of doc.phases ?? []) {
+    for (const step of phase.steps ?? []) {
+      if (step.type === 'decide') {
+        step.actionDefaults ??= {};
+        if (orchestratorModel != null) {
+          if (plannerModel) step.model = plannerModel;
+          else delete step.model;
+        }
+        if (workerPool != null) {
+          if (workers) step.actionDefaults.pool = workers;
+          else delete step.actionDefaults.pool;
+        }
+        if (workerModel != null) {
+          if (workerModelLock) step.actionDefaults.model = workerModelLock;
+          else delete step.actionDefaults.model;
+        }
+        continue;
+      }
+      if (workerPool != null) {
+        if (workers) step.pool = workers;
+        else delete step.pool;
+      }
+      if (workerModel != null) {
+        if (workerModelLock) step.model = workerModelLock;
+        else delete step.model;
+      }
     }
   }
   return doc;
@@ -324,6 +386,10 @@ async function wfGoal(opts) {
     console.error('✗ --watch is only valid for a new human-readable independent launch; do not combine it with --detach, --foreground, --json, --resume, or --request');
     return 2;
   }
+  if (opts.orchestrator && opts['strict-orchestrator']) {
+    console.error('✗ --orchestrator and --strict-orchestrator are mutually exclusive');
+    return 2;
+  }
   const { names, pools } = await livePoolNames();
   let doc;
   let resumeRunId = null;
@@ -345,7 +411,17 @@ async function wfGoal(opts) {
       console.error(`✗ cannot load durable workflow for ${resumeRunId}: ${err.message}`);
       return 1;
     }
-    applyResumeOrchestratorOverride(doc, opts.orchestrator);
+    try {
+      applyResumeOrchestratorOverride(doc, opts.orchestrator, opts['strict-orchestrator']);
+      applyResumeModelOverrides(doc, {
+        orchestratorModel: opts['orchestrator-model'],
+        workerPool: opts['worker-pool'],
+        workerModel: opts['worker-model'],
+      });
+    } catch (err) {
+      console.error(`✗ invalid goal options: ${err.message}`);
+      return 2;
+    }
   } else if (opts.request) {
     try {
       const request = JSON.parse(readFileSync(resolve(opts.request), 'utf8'));
@@ -364,13 +440,24 @@ async function wfGoal(opts) {
       console.error(goalUsage());
       return 2;
     }
-    const orchestrator = opts.orchestrator && opts.orchestrator !== 'auto'
-      ? opts.orchestrator : null;
+    const requestedOrchestrator = opts['strict-orchestrator'] ?? opts.orchestrator;
+    const orchestrator = requestedOrchestrator && requestedOrchestrator !== 'auto'
+      ? requestedOrchestrator : null;
+    const workerPool = opts['worker-pool'] && opts['worker-pool'] !== 'auto'
+      ? opts['worker-pool'] : null;
+    const workerModel = opts['worker-model'] && opts['worker-model'] !== 'auto'
+      ? opts['worker-model'] : null;
+    const orchestratorModel = opts['orchestrator-model'] && opts['orchestrator-model'] !== 'auto'
+      ? opts['orchestrator-model'] : null;
     try {
       doc = buildGoalWorkflow({
         goal,
         cwd: opts.cwd ?? process.cwd(),
         orchestrator,
+        strictOrchestrator: Boolean(opts['strict-orchestrator']),
+        orchestratorModel,
+        workerPool,
+        workerModel,
         settings: goalSettings(opts),
         scout: !opts.noScout,
         worktreeIsolation: loadState(BULLSWARM_DIR()).config?.worktreeIsolation ?? 'agent-decides',
@@ -616,7 +703,8 @@ async function wfInspect(opts) {
 function parseFlags(argv) {
   const out = { inputs: {}, rest: [] };
   const valueFlags = new Set([
-    'resume', 'after', 'cwd', 'orchestrator', 'request', 'run-id',
+    'resume', 'after', 'cwd', 'orchestrator', 'strict-orchestrator', 'orchestrator-model',
+    'worker-pool', 'worker-model', 'request', 'run-id',
     'max-agents', 'max-expansion-rounds', 'max-actions',
     'max-items-per-expansion', 'max-workflow-seconds', 'concurrency',
     'retry-attempts', 'interval', 'heartbeat', 'message',

package/src/workflow/dashboard.js

@@ -363,7 +363,7 @@ export function renderWorkflowTui(row, {
   width = 120, height = 36, focus = 0, phaseIndex = null, agentIndex = null,
   detailScroll = 0, message = null, confirmCancel = false,
   controlSelected = false, orchestratorDetail = false, orchestratorVerbose = false,
-  workflowVerbose = false,
+  workflowVerbose = false, mobileTimeline = true,
   spinnerFrame = 0,
 } = {}) {
   width = Math.max(20, Number(width) || 120);
@@ -392,11 +392,13 @@ export function renderWorkflowTui(row, {
       : workflowVerbose
         ? ' ↑/↓ scroll · v overview · Esc back · c stop · q detach'
         : narrow
-          ? ' ↑/↓ select · Enter inspect · Esc back · o planner · v technical · c stop · q detach'
+          ? mobileTimeline && focus === 0
+            ? ' ↑/↓ timeline · t phases · Enter agents · o planner · v technical · q detach'
+            : ' ↑/↓ select · t timeline · Enter inspect · Esc back · o planner · v technical · q detach'
           : ' ↑/↓ select · PgUp/PgDn timeline · Enter inspect · ←/→ switch · v technical · q detach';
   const rawMessageLine = message
     ? ` ${truncate(message, width - 2)}`
-    : ` ${orchestratorDetail ? `Workflow Planner ${orchestratorVerbose ? 'technical details' : 'overview'}` : workflowVerbose ? 'Workflow technical details' : focus === 0 ? (narrow ? 'Phases' : 'Timeline · auto-following newest event') : focus === 1 ? 'Agents' : 'Agent activity'} · r refresh · workflow continues after detach`;
+    : ` ${orchestratorDetail ? `Workflow Planner ${orchestratorVerbose ? 'technical details' : 'overview'}` : workflowVerbose ? 'Workflow technical details' : focus === 0 ? (narrow && !mobileTimeline ? 'Phases' : 'Timeline · auto-following newest event') : focus === 1 ? 'Agents' : 'Agent activity'} · r refresh · workflow continues after detach`;
   const messageLine = truncate(rawMessageLine, width);
   const bodyHeight = Math.max(10, height - header.length - 3);
 
@@ -487,7 +489,9 @@ export function renderWorkflowTui(row, {
       body = joinPanels(left, renderPanel('Workflow technical details', visibleTechnical, rightWidth, bodyHeight));
     }
   } else if (narrow) {
-    const mobile = focus === 0
+    const mobile = focus === 0 && mobileTimeline
+      ? null
+      : focus === 0
       ? {
         title: model.orchestrator.autonomous
           ? `Workflow · ${model.phases.length} phase${model.phases.length === 1 ? '' : 's'}`
@@ -497,7 +501,9 @@ export function renderWorkflowTui(row, {
       : focus === 1
         ? { title: agentTitle, lines: visibleAgents }
         : { title: detailTitle, lines: visibleDetail };
-    body = renderPanel(mobile.title, mobile.lines, width, bodyHeight);
+    body = mobile
+      ? renderPanel(mobile.title, mobile.lines, width, bodyHeight)
+      : renderWorkflowOverviewPanel(model, width, bodyHeight, spinnerFrame, detailScroll);
   } else if (focus < 2) {
     const left = model.orchestrator.autonomous
       ? [
@@ -1228,6 +1234,7 @@ export async function runDashboard(bullswarmDir, {
     orchestratorDetail: false,
     orchestratorVerbose: false,
     workflowVerbose: false,
+    mobileTimeline: true,
     spinnerFrame: 0,
   };
   const paintUnsafe = () => {
@@ -1298,8 +1305,10 @@ export async function runDashboard(bullswarmDir, {
       }
       const row = detailRow(bullswarmDir, selectedRunId);
       const model = workflowPanelModel(row, { phaseIndex: ui.phaseIndex, agentIndex: ui.agentIndex });
-      if (ui.orchestratorDetail || ui.workflowVerbose) {
-        ui.detailScroll = Math.max(0, ui.detailScroll + delta);
+      const narrowTimeline = output.columns < 100 && ui.mobileTimeline && ui.focus === 0;
+      if (ui.orchestratorDetail || ui.workflowVerbose || narrowTimeline) {
+        if (narrowTimeline) ui.detailScroll = Math.max(0, ui.detailScroll - delta);
+        else ui.detailScroll = Math.max(0, ui.detailScroll + delta);
         return paint();
       }
       if (ui.focus === 0) {
@@ -1396,6 +1405,14 @@ export async function runDashboard(bullswarmDir, {
         } else message = 'This workflow has no autonomous orchestrator thread.';
         return paint();
       }
+      if (key === 't' && detail && output.columns < 100 && !ui.orchestratorDetail && !ui.workflowVerbose) {
+        ui.mobileTimeline = !ui.mobileTimeline;
+        ui.focus = 0;
+        ui.controlSelected = false;
+        ui.detailScroll = 0;
+        message = null;
+        return paint();
+      }
       if (key === '1' && detail) { ui.focus = 0; return paint(); }
       if (key === '2' && detail) { ui.focus = 1; return paint(); }
       if (key === '3' && detail) { ui.focus = 2; return paint(); }

package/src/workflow/decision.js

@@ -57,8 +57,15 @@ export function looksLikeReviewPath(value) {
 
 export function normalizeDecisionProposal(proposal) {
   if (!proposal || typeof proposal !== 'object' || !Array.isArray(proposal.actions)) return proposal;
+  // An action-bearing "proceed" is unambiguously an executable program. The
+  // schema calls that `needs_more_work`; repairing the representation here
+  // avoids an otherwise identical frontier-model correction turn.
+  const decision = proposal.decision === 'proceed' && proposal.actions.length > 0
+    ? 'needs_more_work'
+    : proposal.decision;
   return {
     ...proposal,
+    decision,
     actions: proposal.actions.map((action) => {
       if (action?.type === 'fanout' && !Array.isArray(action.items) && looksLikeItemsFromPath(action.itemsFrom)) {
         // A fanout fed by an artifact implicitly depends on the producer.
@@ -187,7 +194,7 @@ export function validateDecisionProposal(proposal, {
     if (action.effort != null && !['high', 'medium', 'low'].includes(action.effort)) {
       issues.push(`${at}.effort must be high|medium|low`);
     }
-    for (const runtimeOwned of ['pool', 'addDir', 'taskFile']) {
+    for (const runtimeOwned of ['pool', 'preferredPool', 'model', 'addDir', 'taskFile']) {
       if (action[runtimeOwned] != null) issues.push(`${at}.${runtimeOwned} is runtime-owned and cannot be proposed by a planner`);
     }
     if (action.type === 'run' && typeof action.prompt !== 'string') {
@@ -220,7 +227,7 @@ export function validateDecisionProposal(proposal, {
         }
       }
       if (!action.stepTemplate || typeof action.stepTemplate !== 'object') issues.push(`${at}.stepTemplate is required`);
-       for (const runtimeOwned of ['pool', 'addDir', 'taskFile']) {
+       for (const runtimeOwned of ['pool', 'preferredPool', 'model', 'addDir', 'taskFile']) {
         if (action.stepTemplate?.[runtimeOwned] != null) {
           issues.push(`${at}.stepTemplate.${runtimeOwned} is runtime-owned and cannot be proposed by a planner`);
        }
@@ -248,7 +255,7 @@ export function validateDecisionProposal(proposal, {
         if (repair.effort != null && !['high', 'medium', 'low'].includes(repair.effort)) {
           issues.push(`${at}.repair.effort must be high|medium|low`);
         }
-        for (const runtimeOwned of ['pool', 'addDir', 'taskFile']) {
+        for (const runtimeOwned of ['pool', 'preferredPool', 'model', 'addDir', 'taskFile']) {
           if (repair[runtimeOwned] != null) issues.push(`${at}.repair.${runtimeOwned} is runtime-owned and cannot be proposed by a planner`);
         }
       }

package/src/workflow/goal.js

@@ -6,27 +6,28 @@
 import { resolve } from 'node:path';
 
 const NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+const MODEL_RE = /^[a-zA-Z0-9][a-zA-Z0-9._:/~-]*$/;
 
 export const PLANNER_RULES_SECTION = [
   '1. Compile the whole program in one decision: the runtime runs every proposed action and consults you only at a finished-or-blocked boundary, so deferred work costs a round trip.',
-  '2. Make every worker prompt self-contained: include the exact goal, absolute cwd, the owned files you assign (never an and/or choice, which blocks a sibling) and a no-other-files boundary, expected artifact, acceptance command and report format: workers see only their own prompt.',
+  '2. Make every worker prompt self-contained: include the exact goal, absolute cwd, the owned files you assign (exactly one owner per file, including any existing test the change breaks; never an and/or choice, which blocks a sibling) and a no-other-files boundary, expected artifact, acceptance command and report format: workers see only their own prompt.',
   '3. A phase is a pipeline stage: one kebab-case name shared by its actions (implement, verify), never one per action; phases are forward-only, so recovery opens a new one and never repeats an identical failed plan. Wall-clock is the longest dependsOn chain, so depend only on real data or same-file ordering: a worker depends on the run that wrote its input files, never on that run\'s verify (a verdict is not data), so it starts as that verify runs.',
-  '4. Split to the width the tree allows: each file-disjoint unit (module, test file, doc) is its own concurrent run plus its own verify depending only on that run, then one suite verify depending on all; one worker for N independent files is N chains in series. A verify judges the artifact in review (default: its last dependency; none: the repository).',
+  '4. Split only when parallel time saved repays dispatch cost. Give substantial file-disjoint units concurrent workers and focused verifies, but batch cheap homogeneous edits into one worker owning all named files and one final verify; never pay one worker plus verifier per tiny file. A verify judges its review artifact (default: last dependency; none: repository).',
   '5. For unknown items, create discovery ending with RETURN ONLY a JSON object containing an items array, then data-driven fan-out via itemsFrom outputs.<id>.outFile or outputs.<id>.data.<field>; the runtime extracts the list, retrying once read-only if needed.',
   '6. Put outputSchema only on a worker whose object a LATER action reads via itemsFrom or outputs.<id>.data.<field>, and tell it to RETURN ONLY the object; a prose report or any answer with fenced JSON gets no schema: the runtime parses the last {...} of the text, so a schema on prose costs a retry and a planner turn.',
-  '7. Put verify.repair on every verify. A verify checks the goal\'s own acceptance criteria at its point in the graph: later-scheduled work is not a defect, cosmetic mismatches are concerns, and never add a process rule the goal does not state (append-only, tests untouched); when the implementation changes what an existing assertion pins, a worker must own updating it. ok:false is repaired and re-checked inside the program; the repair edits files and cannot rewrite the answer under review, so reject only what a file edit can fix and report a wrong claim as a concern with the true value; ok:true is accepted and its concerns are informational.',
+  '7. Put verify.repair on every verify. ok:false means unusable: the goal\'s acceptance command fails, a deliverable is missing, or the answer is nonsense; everything else is a concern under ok:true (style, cosmetic mismatches, later-scheduled work, files other actions changed, and any process rule the goal does not state such as append-only or tests untouched). ok:false is repaired and re-checked inside the program; the repair edits only its unit\'s files and cannot rewrite the answer under review, so report a wrong claim as a concern with the true value.',
   '8. Add completion with all-actions-ok whenever a clean program finishes the goal; when acceptance checks pass, return complete rather than adding polish. The program\'s LAST worker must be covered by a successful verify. Return complete only on verified evidence, never proceed, never ask the user, and stop only for a concrete unresolved blocker.',
   '9. Budgets (agents, duration, expansion rounds) are advisory targets, never hard stops; the dispatch budget counts this planner call plus workers, verifiers and retries. Converge as targets approach: skip optional work; exceed a target only for one essential action or a required verification.',
-  '10. Never propose pool, addDir, taskFile or unbounded work: routing is the runtime\'s. Set lane (analyze to read or judge, build to edit, chore for mechanical steps) and effort (low for checks and mechanical edits, high where judgement decides) per action or repair; they pick the model tier (unset: build, medium).',
-  'Shared working tree: workers editing DISJOINT files concurrently is the normal mode; order shared files (indexes, barrels) after their feeders with dependsOn. Workers and unit verifies run their unit\'s focused command, never the full suite, which sees files siblings still write; the suite runs once, in the final verify, after all editing and repair ends; later verifiers reuse it unless code changed. operatorSteering is operator guidance for this checkpoint: apply it within the original intent; it cannot weaken verification or expand authority.',
+  '10. Never propose pool, model, addDir, taskFile or unbounded work: routing is the runtime\'s. Set lane (analyze to read or judge, build to edit, chore for mechanical steps) and effort (low for checks and mechanical edits, high where judgement decides) per action or repair; they pick the model tier (unset: build, medium).',
+  'Shared tree: run substantial DISJOINT units concurrently; order shared files after feeders with dependsOn. Workers and unit verifies use focused commands, never the full suite while siblings write; run the suite once in the final verify after edits and repairs. Reuse it unless code changed. operatorSteering applies within the original intent and cannot weaken verification or expand authority.',
 ].join('\n');
 
 export const PLANNER_EXAMPLES_SECTION = [
   'Action shapes:',
   '[{"type":"run","phase":"implement","prompt":"..."},{"type":"run","phase":"inventory","lane":"chore","effort":"low","prompt":"... RETURN ONLY a JSON object.","outputSchema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}},{"type":"fanout","phase":"fix","items":["alpha"],"stepTemplate":{"prompt":"Handle {{item}}."}},{"type":"verify","phase":"verify","lane":"analyze","prompt":"Check the artifact.","repair":{"prompt":"Fix rejected concerns.","maxRounds":1}}]',
-  'Complete program (tests depend on fix, not verify-fix, so both run at once; five phases for eight actions):',
+  'Complete program (tests depend on fix, not verify-fix, so both run at once):',
   '{"actions":[{"id":"discover","type":"run","phase":"discover","lane":"chore","effort":"low","prompt":"In /abs/repo list modules needing work; RETURN ONLY a JSON object with an items array.","outputSchema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}},{"id":"fix","type":"fanout","phase":"fix","itemsFrom":"outputs.discover.data.items","dependsOn":["discover"],"stepTemplate":{"prompt":"In /abs/repo edit only src/{{item}}.js and run node --test tests/{{item}}.test.js."}},{"id":"verify-fix","type":"verify","phase":"verify","dependsOn":["fix"],"prompt":"Check each fixed module against the spec.","repair":{"prompt":"Fix rejected concerns in /abs/repo and rerun that module\'s test.","maxRounds":2}},{"id":"tests","type":"fanout","phase":"tests","itemsFrom":"outputs.discover.data.items","dependsOn":["fix"],"stepTemplate":{"prompt":"In /abs/repo write only tests/{{item}}.guards.test.js and run node --test on it."}},{"id":"verify-tests","type":"verify","phase":"verify","dependsOn":["tests"],"prompt":"Check the new tests are non-vacuous.","repair":{"prompt":"Fix rejected tests in /abs/repo.","maxRounds":1}},{"id":"verify-suite","type":"verify","phase":"verify","dependsOn":["verify-fix","verify-tests"],"effort":"low","prompt":"Run npm test in /abs/repo.","repair":{"prompt":"Fix the suite failure in /abs/repo and rerun it.","maxRounds":1}},{"id":"report","type":"run","phase":"report","lane":"chore","effort":"low","dependsOn":["verify-suite"],"prompt":"In /abs/repo list each changed file with a reason and quote the suite tail; plain markdown."},{"id":"verify-report","type":"verify","phase":"report","dependsOn":["report"],"prompt":"Check each claim against git status and a fresh suite run; a wrong number is a concern with the true value.","repair":{"prompt":"Fix any real repository defect in /abs/repo.","maxRounds":1}}],"completion":{"when":"all-actions-ok","reason":"Fix, tests, suite and report are each verified."}}',
-  'Rules the validator enforces: action type is run, fanout, or verify; fanout has stepTemplate and either items or itemsFrom; verify.review, when given, is outputs.<id>.outFile; dependsOn names existing or proposed actions; lane is analyze|build|chore and effort is low|medium|high; runtime-owned fields are rejected.',
+  'Rules the validator enforces: action type is run, fanout, or verify; fanout has stepTemplate and either items or itemsFrom; verify.review, when given, is outputs.<id>.outFile; ids are unique across the whole run, finished and failed actions included; dependsOn names existing or proposed actions; lane is analyze|build|chore and effort is low|medium|high; runtime-owned fields are rejected.',
 ].join('\n');
 
 export const AUTONOMOUS_ORCHESTRATOR_PROMPT = [
@@ -78,6 +79,10 @@ export function buildGoalWorkflow({
   goal,
   cwd = process.cwd(),
   orchestrator = null,
+  strictOrchestrator = false,
+  orchestratorModel = null,
+  workerPool = null,
+  workerModel = null,
   name = null,
   settings = {},
   scout = true,
@@ -89,6 +94,17 @@ export function buildGoalWorkflow({
   if (orchestrator != null && (typeof orchestrator !== 'string' || !NAME_RE.test(orchestrator))) {
     throw new Error(`invalid orchestrator pool "${orchestrator}"`);
   }
+  if (typeof strictOrchestrator !== 'boolean') {
+    throw new Error('strictOrchestrator must be a boolean');
+  }
+  if (workerPool != null && (typeof workerPool !== 'string' || !NAME_RE.test(workerPool))) {
+    throw new Error(`invalid worker pool "${workerPool}"`);
+  }
+  for (const [label, model] of [['orchestrator', orchestratorModel], ['worker', workerModel]]) {
+    if (model != null && (typeof model !== 'string' || !MODEL_RE.test(model))) {
+      throw new Error(`invalid ${label} model "${model}"`);
+    }
+  }
 
   const targetDir = resolve(cwd);
   const workflowName = name ?? `goal-${Date.now().toString(36)}`;
@@ -120,12 +136,21 @@ export function buildGoalWorkflow({
       cwd: targetDir,
       autonomous: true,
       requestedOrchestrator: orchestrator ?? 'auto',
+      requestedOrchestratorModel: orchestratorModel ?? 'auto',
+      requestedWorkerPool: workerPool ?? 'auto',
+      requestedWorkerModel: workerModel ?? 'auto',
       worktreeIsolation,
     },
     orchestration: {
       mode: 'autonomous',
       requestedPool: orchestrator ?? null,
-      selection: orchestrator ? 'user-pinned-for-testing' : 'capability-strategy-and-quota',
+      requestedModel: orchestratorModel ?? null,
+      workerPool: workerPool ?? null,
+      workerModel: workerModel ?? null,
+      strictPool: orchestrator && strictOrchestrator ? orchestrator : null,
+      selection: orchestrator
+        ? (strictOrchestrator ? 'user-strict-for-testing' : 'user-preferred-with-fallback')
+        : 'capability-strategy-and-quota',
       completionPolicy: {
         requireSuccessfulWorker: true,
         requireSuccessfulVerification: true,
@@ -159,16 +184,23 @@ export function buildGoalWorkflow({
         id: 'scout',
         type: 'run',
         lane: 'analyze',
+        ...(workerPool ? { pool: workerPool } : {}),
+        ...(workerModel ? { model: workerModel } : {}),
         addDir: targetDir,
         prompt: scoutPrompt('{{inputs.goal}}', targetDir),
       }] : []), {
         id: 'orchestrator',
         type: 'decide',
-        ...(orchestrator ? { pool: orchestrator } : {}),
+        ...(orchestrator
+          ? (strictOrchestrator ? { pool: orchestrator } : { preferredPool: orchestrator })
+          : {}),
+        ...(orchestratorModel ? { model: orchestratorModel } : {}),
         lane: 'analyze',
         requiresCapabilities: ['strong-analysis', 'workflow-planning'],
         addDir: targetDir,
         actionDefaults: {
+          ...(workerPool ? { pool: workerPool } : {}),
+          ...(workerModel ? { model: workerModel } : {}),
           lane: 'build',
           requiresCapabilities: ['code-reading', 'file-editing'],
           addDir: targetDir,

package/src/workflow/result.js

@@ -18,6 +18,28 @@ export function buildWorkflowResult({ state, report, runId, shortId, ongoing })
   const artifact = readDelivery(outFile, deliveryOutput);
   const verificationAction = selectVerificationAction(ledger, deliveryAction?.id);
   const verificationOutput = verificationAction ? state?.outputs?.[verificationAction.id] : null;
+  const deliveryActions = selectDeliveryActions(
+    ledger,
+    state?.outputs,
+    verificationAction,
+    deliveryAction,
+  );
+  const deliveryRecord = (action) => {
+    const attempt = selectAttempt(attempts, action.id);
+    const output = state?.outputs?.[action.id];
+    const path = output?.outFile ?? attempt?.outFile ?? null;
+    const content = readDelivery(path, output);
+    return {
+      actionId: action.id,
+      phase: action.phase ?? null,
+      kind: action.kind ?? null,
+      outFile: path,
+      format: content.format,
+      content: content.content,
+      truncated: content.truncated,
+      bytes: content.bytes,
+    };
+  };
   const finishedAttempts = attempts.filter(
     (attempt) => attempt?.finishedAt || isTerminalAttempt(attempt?.status),
   ).length;
@@ -61,6 +83,10 @@ export function buildWorkflowResult({ state, report, runId, shortId, ongoing })
       truncated: artifact.truncated,
       bytes: artifact.bytes,
     } : null,
+    // Backward-compatible multi-delivery view. `delivery` remains the primary
+    // artifact, while this frontier contains every independently completed
+    // worker artifact covered by the selected final verifier.
+    deliveries: deliveryActions.map(deliveryRecord),
     verification: verificationAction ? {
       actionId: verificationAction.id,
       outFile: verificationOutput?.outFile ?? selectAttempt(attempts, verificationAction.id)?.outFile ?? null,
@@ -76,6 +102,39 @@ export function buildWorkflowResult({ state, report, runId, shortId, ongoing })
   };
 }
 
+function ancestorIds(ledger, action) {
+  const byId = new Map(ledger.map((entry) => [entry?.id, entry]));
+  const ancestors = new Set();
+  const pending = [...(action?.dependsOn ?? [])];
+  while (pending.length) {
+    const id = pending.pop();
+    if (ancestors.has(id)) continue;
+    ancestors.add(id);
+    pending.push(...(byId.get(id)?.dependsOn ?? []));
+  }
+  return ancestors;
+}
+
+function selectDeliveryActions(ledger, outputs, verificationAction, primary) {
+  if (!primary) return [];
+  const verifiedAncestors = ancestorIds(ledger, verificationAction);
+  if (!verificationAction || !verifiedAncestors.has(primary.id)) return [primary];
+  const candidates = ledger.filter(
+    (action) => action?.id !== 'scout'
+      && action?.status === 'succeeded'
+      && !CONTROL_KINDS.has(action.kind)
+      && outputs?.[action.id]?.ok !== false
+      && verifiedAncestors.has(action.id),
+  );
+  const ancestorCache = new Map(candidates.map((action) => [action.id, ancestorIds(ledger, action)]));
+  const frontier = candidates.filter(
+    (action) => !candidates.some(
+      (other) => other.id !== action.id && ancestorCache.get(other.id)?.has(action.id),
+    ),
+  );
+  return frontier.length ? frontier : [primary];
+}
+
 function selectDeliveryAction(ledger, outputs, preferredActionId) {
   const succeeded = ledger.filter(
     (action) => action?.status === 'succeeded'
@@ -90,8 +149,26 @@ function selectVerificationAction(ledger, deliveryId) {
   const verifications = ledger.filter(
     (action) => action?.status === 'succeeded' && action.kind === 'verify',
   );
+  const byId = new Map(ledger.map((action) => [action?.id, action]));
+  const coversDelivery = (action) => {
+    if (!deliveryId) return false;
+    const pending = [...(action?.dependsOn ?? [])];
+    const seen = new Set();
+    while (pending.length) {
+      const id = pending.pop();
+      if (id === deliveryId) return true;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      pending.push(...(byId.get(id)?.dependsOn ?? []));
+    }
+    return false;
+  };
+  // Prefer the latest successful verifier that transitively covers the
+  // delivery. A final suite verify commonly depends on unit verifiers rather
+  // than directly on each worker; selecting only a direct edge hid the
+  // strongest acceptance evidence in the stable caller envelope.
   return [...verifications].reverse().find(
-    (action) => deliveryId && Array.isArray(action.dependsOn) && action.dependsOn.includes(deliveryId),
+    coversDelivery,
   ) ?? [...verifications].reverse()[0] ?? null;
 }
 

package/src/workflow/runner.js

@@ -677,6 +677,8 @@ async function runDecisionLoop({ runtime, gate, phase, state, retryAttempts }) {
         type: 'run',
         phase: action.phase,
         ...(action.lane != null ? { lane: action.lane } : {}),
+        ...(action.pool != null ? { pool: action.pool } : {}),
+        ...(action.model != null ? { model: action.model } : {}),
         ...(action.addDir != null ? { addDir: action.addDir } : {}),
         ...(action.timeoutSec != null ? { timeoutSec: action.timeoutSec } : {}),
         dependsOn: producerId ? [producerId] : [],
@@ -724,6 +726,8 @@ async function runDecisionLoop({ runtime, gate, phase, state, retryAttempts }) {
         type: 'run',
         phase: action.phase,
         ...(action.lane != null ? { lane: action.lane } : {}),
+        ...(action.pool != null ? { pool: action.pool } : {}),
+        ...(action.model != null ? { model: action.model } : {}),
         ...(action.addDir != null ? { addDir: action.addDir } : {}),
         ...(action.timeoutSec != null ? { timeoutSec: action.timeoutSec } : {}),
         ...(action.repair.effort != null ? { effort: action.repair.effort } : {}),
@@ -736,7 +740,7 @@ async function runDecisionLoop({ runtime, gate, phase, state, retryAttempts }) {
             typeof verdict.summary === 'string' && verdict.summary.trim() ? `: ${verdict.summary.trim()}` : '.'}`,
           ...(concerns.length ? ['Concerns to resolve (verbatim from the verifier):', ...concerns.map((entry) => `- ${entry}`)] : []),
           '',
-          `Repair round ${round} of ${maxRounds}. Resolve every concern above, re-run the acceptance command yourself, and report exactly what changed with evidence.`,
+          `Repair round ${round} of ${maxRounds}. This is a shared working tree: edit only the files the reviewed work owns; a concern about files outside them is not yours to resolve, and never revert, checkout or delete other actions' changes. Resolve the concerns above that a file edit inside the reviewed work can fix, re-run the acceptance command yourself, and report exactly what changed with evidence.`,
         ].join('\n'),
       };
       runtime.emit('action.repair_started', { verifyId: action.id, repairId, round, maxRounds, concerns });
@@ -949,7 +953,16 @@ async function runDecisionLoop({ runtime, gate, phase, state, retryAttempts }) {
         rejection = { why: planner.why, issues: [planner.parseError ?? planner.why] };
       } else {
         try {
-          proposal = validateDecisionProposal(normalizeDecisionProposal(planner.proposal), {
+          const normalizedProposal = normalizeDecisionProposal(planner.proposal);
+          if (normalizedProposal?.decision !== planner.proposal?.decision) {
+            runtime.emit('decision.normalized', {
+              gateId: gate.id,
+              from: planner.proposal?.decision ?? null,
+              to: normalizedProposal?.decision ?? null,
+              reason: 'action-bearing proceed is an executable needs_more_work program',
+            });
+          }
+          proposal = validateDecisionProposal(normalizedProposal, {
             knownActionIds: (state.plan?.actions ?? []).map((action) => action.id),
             closedPhases: (state.plan?.actions ?? [])
               .filter((action) => action.source === 'planner')

package/src/workflow/runtime.js

@@ -35,7 +35,7 @@ import { DECISION_SCHEMA_VERSION, parseDecisionText } from './decision.js';
 import { aggregateUsage } from '../lib/usage.js';
 import { classifyAgentProgress, recordAgentAction } from '../lib/agent-events.js';
 import { deliverSteering } from './steering.js';
-import { resolveDispatchModel } from '../lib/strategy.js';
+import { isModelExcluded, resolveDispatchModel } from '../lib/strategy.js';
 import { getMeterReading } from '../meters/registry.js';
 import { validateAgainstSchema } from './schema.js';
 import { AUTONOMOUS_ORCHESTRATOR_PROMPT } from './goal.js';
@@ -302,7 +302,9 @@ export class WorkflowRuntime {
           callerSession: false, // workflow context: every pool is a worker
           now: Date.now(),
           requiredCapabilities: step.requiresCapabilities ?? [],
-          preferredPool: assignment?.pool ?? null,
+          // A goal-level user preference wins while it remains eligible, but
+          // unlike step.pool it never removes healthy fallback candidates.
+          preferredPool: step.preferredPool ?? assignment?.pool ?? null,
           effortTier,
         });
         if (!route.pick) {
@@ -313,6 +315,8 @@ export class WorkflowRuntime {
             keepOnClaude: false,
             why: stillGated.length
               ? `no eligible pool: every candidate is burst-gated (${WorkflowRuntime.describeBurstGate(stillGated)}) and the wait for the window expired`
+              : step.model != null
+                ? `no eligible pool can guarantee requested model ${step.model}${step.pool ? ` on pool ${step.pool}` : ''}`
               : `no eligible pool (${route.why})`,
             pick: { pool: null },
             meta: { exitCode: null },
@@ -325,7 +329,7 @@ export class WorkflowRuntime {
         }
         const poolView = route.pick.connector;
         const connector = poolView?.connector ?? poolView;
-        const selectedModel = poolView?.modelPolicy?.model
+        const selectedModel = step.model ?? poolView?.modelPolicy?.model
           ?? (assignment?.pool === connector.name && !poolView?.strategyExcludedModels?.includes(assignment.model)
             ? assignment.model : null);
         const runtimeConnector = {
@@ -718,10 +722,34 @@ export class WorkflowRuntime {
           (p.capabilities ?? p.connector?.capabilities ?? []).includes(capability)),
     ).map((pool) => {
       const assignment = pool.strategyAssignments?.[effortTier] ?? null;
-      const modelPolicy = resolveDispatchModel(pool.connector ?? pool, effortTier, {
+      const connector = pool.connector ?? pool;
+      const excludedModels = pool.strategyExcludedModels ?? [];
+      let modelPolicy = resolveDispatchModel(connector, effortTier, {
         assignment,
-        excludedModels: pool.strategyExcludedModels ?? [],
+        excludedModels,
       });
+      if (step.model != null) {
+        const requested = String(step.model).trim();
+        const configuredIndex = connector.spawn?.cmd?.indexOf('--model') ?? -1;
+        const configured = connector.model
+          ?? (configuredIndex >= 0 ? connector.spawn.cmd[configuredIndex + 1] ?? null : null);
+        const known = new Set([...(connector.knownModels ?? []), configured].filter(Boolean));
+        const selectable = Boolean(connector.modelSelection?.flag);
+        if (isModelExcluded(requested, excludedModels)) {
+          modelPolicy = { eligible: false, model: null, source: 'step-model-lock', reason: `requested model ${requested} is excluded` };
+        } else if (requested === configured || (selectable && (known.size === 0 || known.has(requested)))) {
+          modelPolicy = { eligible: true, model: requested, source: 'step-model-lock' };
+        } else {
+          modelPolicy = {
+            eligible: false,
+            model: null,
+            source: 'step-model-lock',
+            reason: selectable
+              ? `connector ${connector.name} does not advertise requested model ${requested}`
+              : `connector ${connector.name} cannot select requested model ${requested}`,
+          };
+        }
+      }
       return { ...pool, modelPolicy };
     }).filter((pool) => pool.modelPolicy.eligible);
   }
@@ -778,9 +806,19 @@ export class WorkflowRuntime {
       if (this.state.cancelRequested) return true;
       try { return JSON.parse(readFileSync(join(this.runDir, 'state.json'), 'utf8')).cancelRequested === true; } catch { return false; }
     };
+    const heartbeat = () => {
+      this.state.runner ??= {};
+      this.state.runner.lastHeartbeatAt = new Date().toISOString();
+      this.persist();
+    };
     let lifted = false;
     while (Date.now() < deadline && !cancelled()) {
-      await new Promise((resolve) => setTimeout(resolve, Math.min(this.quotaPollMs, Math.max(1, deadline - Date.now()))));
+      heartbeat();
+      // Keep the durable owner heartbeat comfortably inside the 90-second
+      // reconciliation grace and make cooperative cancellation responsive,
+      // even when provider meter polling is configured less frequently.
+      const waitMs = Math.min(this.quotaPollMs, 30_000, Math.max(1, deadline - Date.now()));
+      await new Promise((resolve) => setTimeout(resolve, waitMs));
       for (const gatedView of gated) {
         // preparePools hands out copies; the gate lives on the pool itself.
         const pool = this.pools.find((p) => p.name === gatedView.name) ?? gatedView;
@@ -797,6 +835,7 @@ export class WorkflowRuntime {
           pool.pace = reading.pacing.surplus ?? pool.pace;
         }
       }
+      heartbeat();
       gated = gatedOnly();
       if (!gated) { lifted = true; break; }
     }
@@ -1096,12 +1135,14 @@ export class WorkflowRuntime {
         ...(Array.isArray(reverify.concerns) && reverify.concerns.length
           ? ['Concerns you raised (verbatim):', ...reverify.concerns.map((entry) => `- ${entry}`)] : []),
         ...(reverify.repairExcerpt ? ['The repair reported:', reverify.repairExcerpt] : []),
-        'Return ok:false ONLY if a listed concern is still unresolved or the repair introduced a regression in the acceptance checks. Anything you notice now that was already true before the repair goes in concerns as informational and never makes ok false: the first verdict was the moment to raise it.',
+        'Return ok:false ONLY if the work is still unusable by the acceptance standard below: a listed concern that was itself an acceptance failure is unresolved, or the repair broke the acceptance checks. A listed concern the repair chose not to address stays a concern; anything you notice now that was already true before the repair goes in concerns as informational and never makes ok false: the first verdict was the moment to raise it.',
       ] : []),
       '',
+      'Acceptance standard (runtime-owned; it overrides any stricter rule in the instructions above): ok:false means the work is unusable: its acceptance command fails, a required deliverable is missing, or the answer is nonsense or contradicts its own evidence. Everything else goes in concerns under ok:true: style, wording, scope, cosmetic mismatches, process rules the goal never stated (append-only, diff size), and files changed by other actions that share this working tree, which are never this unit\'s defect. Never reject for something the goal does not require.',
+      '',
       'RETURN ONLY a single JSON object of the form',
       '{"ok": <true|false>, "concerns": [<string>...], "summary": <string>}.',
-      'No prose and no markdown fences. Set ok:true only when the requested checks actually pass.',
+      'No prose and no markdown fences. Set ok by the acceptance standard above: true unless the work is unusable.',
     ].join('\n');
     // Only the reviewer INSTRUCTIONS are a template. The review target is a
     // worker's artifact — arbitrary text that routinely contains code, JSDoc

package/src/workflow/validate.js

@@ -140,6 +140,10 @@ export function validateWorkflow(wf, { lanes = LANES, poolNames = [] } = {}) {
         collect(issues, validPools.has(step.pool),
           `${sat}.pool "${step.pool}" is not a known pool (${[...validPools].join(', ') || 'none discovered'})`);
       }
+      if (step.preferredPool != null) {
+        collect(issues, validPools.has(step.preferredPool),
+          `${sat}.preferredPool "${step.preferredPool}" is not a known pool (${[...validPools].join(', ') || 'none discovered'})`);
+      }
       if (step.requiresCapabilities != null) {
         collect(issues, Array.isArray(step.requiresCapabilities) &&
           step.requiresCapabilities.length > 0 &&
@@ -203,7 +207,7 @@ export function validateWorkflow(wf, { lanes = LANES, poolNames = [] } = {}) {
         if (step.actionDefaults != null) {
           collect(issues, step.actionDefaults && typeof step.actionDefaults === 'object' && !Array.isArray(step.actionDefaults),
             `${sat}.actionDefaults must be an object`);
-          const allowedDefaults = new Set(['pool', 'lane', 'effort', 'requiresCapabilities', 'addDir', 'timeoutSec']);
+          const allowedDefaults = new Set(['pool', 'model', 'lane', 'effort', 'requiresCapabilities', 'addDir', 'timeoutSec']);
           for (const key of Object.keys(step.actionDefaults ?? {})) {
             collect(issues, allowedDefaults.has(key), `${sat}.actionDefaults.${key} is not runtime-controlled metadata`);
           }
@@ -211,6 +215,10 @@ export function validateWorkflow(wf, { lanes = LANES, poolNames = [] } = {}) {
             collect(issues, validPools.has(step.actionDefaults.pool),
               `${sat}.actionDefaults.pool "${step.actionDefaults.pool}" is not a known pool`);
           }
+          if (step.actionDefaults?.model != null) {
+            collect(issues, typeof step.actionDefaults.model === 'string' && step.actionDefaults.model.trim().length > 0,
+              `${sat}.actionDefaults.model must be a non-empty model identifier`);
+          }
           if (step.actionDefaults?.lane != null) {
             collect(issues, validLanes.has(step.actionDefaults.lane),
               `${sat}.actionDefaults.lane "${step.actionDefaults.lane}" is not a lane`);
@@ -241,6 +249,10 @@ export function validateWorkflow(wf, { lanes = LANES, poolNames = [] } = {}) {
         collect(issues, Number.isFinite(step.timeoutSec) && step.timeoutSec > 0,
           `${sat}.timeoutSec must be a positive number`);
       }
+      if (step.model != null) {
+        collect(issues, typeof step.model === 'string' && step.model.trim().length > 0,
+          `${sat}.model must be a non-empty model identifier`);
+      }
     });
   });