bullswarm 0.17.0 → 0.18.1

package/CHANGELOG.md

@@ -1,6 +1,85 @@
 # bullswarm changelog
 
-## Unreleased
+## 0.18.1 — original-goal verification and denser timeline
+
+- Goal workflows now derive a durable requirement ledger from the original
+  user goal. Planner verify actions declare which requirements they cover, and
+  neither explicit nor program-level completion is accepted until every
+  requirement has a successful verifier with specific evidence. The verifier
+  receives the original goal from the runtime, so a reduced planner scope can
+  no longer silently omit requested APIs, events, tests, or documentation.
+- Successful verifier concerns are preserved in a verified
+  `completed_with_concerns` result instead of being discarded or triggering
+  unnecessary follow-up spending.
+- The human timeline calls its first accepted planner decision `plan created`,
+  later decisions `plan updated`, and the final one `completion confirmed`.
+  Execution milestones are rendered as one dense block without blank rows.
+  Finished workflows now say `No agents running · workflow finished` and
+  `Workflow finished · result ready` instead of control-plane terminology.
+
+## 0.18.0 — exact routes, cheaper plans, clearer results
+
+- `workflow goal` can now guarantee an exact planner model and a separate exact
+  worker route with `--orchestrator-model`, `--worker-pool`, and
+  `--worker-model`. The worker lock is runtime-owned and propagates through the
+  scout, ordinary actions, fan-out items, verification repairs, reverification,
+  and extraction helpers; unsupported or excluded models fail closed instead
+  of silently substituting another model.
+- An action-bearing planner `proceed` is normalized to the schema-equivalent
+  `needs_more_work` program before validation. This removes a redundant
+  correction turn without changing the proposed graph or weakening any safety
+  check (the prior real run spent four frontier planner turns correcting this
+  exact representation mismatch).
+- `workflow runs result` now selects the latest successful verifier that
+  transitively covers the delivery, so a final suite verifier depending on
+  unit verifiers is surfaced ahead of a narrower direct unit check.
+- The same result envelope now adds a backward-compatible `deliveries[]`
+  frontier for parallel multi-worker outcomes while preserving the singular
+  `delivery` field for existing callers.
+- The autonomous planner now batches cheap homogeneous edits instead of paying
+  for a worker and unit verifier per tiny file; substantial independent units
+  still fan out and retain focused verification before the final suite.
+- Narrow SSH and phone terminals now open on a full-width workflow timeline;
+  `t` toggles between that overview and the phase browser without affecting the
+  existing Enter/Esc agent drill-down.
+- Goal-level `--orchestrator <pool>` is now a preference with immediate
+  fallback when that pool is quota-gated, ineligible, or unavailable. Exact
+  provider testing moves to `--strict-orchestrator <pool>`. Quota waits now
+  refresh the durable runner heartbeat at least every 30 seconds, preventing a
+  live waiting run from being falsely reconciled as interrupted and making
+  cooperative cancellation responsive during long meter-poll intervals.
+
+- The runtime now owns the acceptance bar for every verify and re-verify. Each
+  verifier's instructions end with a fixed "Acceptance standard (runtime-owned;
+  it overrides any stricter rule in the instructions above)": `ok:false` means
+  the work is unusable — its acceptance command fails, a required deliverable
+  is missing, or the answer is nonsense — and everything else (style, scope,
+  cosmetic mismatches, process rules the goal never stated such as append-only,
+  files changed by other actions in the shared tree) goes in `concerns` under
+  `ok:true`. A re-verify rejects only when the work is still unusable or the
+  repair broke the acceptance checks. Direction from the user after `8ebi8a`:
+  "unless it is completely nonsense or unable to finish I don't see a reason to
+  reject so easily".
+- Repair prompts carry a runtime-owned shared-tree rule: edit only the files
+  the reviewed work owns; a concern about other files is not the repair's to
+  resolve; never revert, checkout or delete other actions' changes. Earned on
+  `8ebi8a`: `verify-docs` rejected on a repo-wide `git diff --stat` scope check
+  while siblings were writing, and its repair reverted five `src/` files it did
+  not own to satisfy the concern.
+- Planner contract: rule 2 requires exactly one owner per file, including any
+  existing test the change breaks (the `workflow-adaptive.test.js:206` gap for
+  the fourth time); rule 7 restates the lenient bar above; the validator line
+  now says ids are unique across the whole run, finished and failed actions
+  included (turn 2 of `8ebi8a` re-proposed the blocked id `verify-suite` and
+  spent a 97 s correction turn on it).
+- Goal-4 rerun on `7724da1` (`8ebi8a`, rule 7 + PR #5): 42 min 03 s, three
+  planner turns (775 s, 31 %), parallelism 1.34, 23 dispatches (20 on
+  `kaihk/gpt-5.6-luna`), three repair rounds each rejected on re-verify for
+  reasons the prompts caused, tail of five actions blocked, recovery program
+  auto-completed, 315/315, existing tests +179/−1. Goal-4 line:
+  44 → 72 → 37 → 25 → 36 → 42 min.
+
+## 0.17.0 — the timeline tells the execution story
 
 - Workflow timeline (PR #5) hardened after a 16-agent adversarial review against
   real run state (23 findings, 21 confirmed): worker rows now name their phase

package/README.md

@@ -188,8 +188,23 @@ Resume a process-interrupted autonomous run from its persisted workflow:
 bullswarm workflow goal --resume <shortId> --json
 ```
 
-`--orchestrator <pool>` exists for controlled testing; ordinary use should
-leave selection on `auto`. `--max-agents` and `--max-workflow-seconds` are
+`--orchestrator <pool>` expresses a preference and immediately falls back to
+another eligible pool if that provider is quota-gated or unavailable. Ordinary
+use can leave selection on `auto`. For controlled provider QA only,
+`--strict-orchestrator <pool>` requires that exact pool and may wait for its
+quota window. Controlled comparisons can additionally pin the exact planner
+and worker routes without changing global strategy:
+
+```bash
+bullswarm workflow goal "Implement and verify the change" --cwd . \
+  --strict-orchestrator codex --orchestrator-model gpt-5.6-sol \
+  --worker-pool opencode2 --worker-model kaihk/gpt-5.6-luna
+```
+
+The worker lock covers the scout, ordinary runs, fan-out items, repairs,
+re-verification, and runtime extraction helpers. A pool that cannot guarantee
+the requested model is ineligible rather than silently substituting another
+model. `--max-agents` and `--max-workflow-seconds` are
 advisory planning targets; `--max-expansion-rounds` is also an advisory
 convergence target. Hard structural safeguards are adjusted with
 `--max-actions` and `--max-items-per-expansion`.
@@ -258,8 +273,9 @@ Values accept ISO timestamps, local `YYYY-MM-DD` dates, `today`, `yesterday`,
 After a workflow reaches a terminal state, agents should consume
 `workflow runs result <id> --json` instead of probing `state.json`, task files,
 or provider-specific output. The versioned `bullswarm.workflow.result.v1`
-envelope identifies the final delivery artifact and its matching verification
-verdict, and includes progress, step logs, tokens, and an explicitly
+envelope retains the primary `delivery`, adds a `deliveries[]` frontier when
+parallel workers jointly form the outcome, and identifies their strongest
+matching verification verdict. It also includes progress, step logs, tokens, and an explicitly
 complete-or-partial tool-call total. `runs show` remains the low-level debugging
 surface.
 Goal launch output includes an `instructions` handoff with four named paths:
@@ -308,7 +324,8 @@ width of `⌛` across terminal fonts. It watches ongoing runs from disk and supp
 details, Esc to go back, `c` to request a confirmed cooperative stop, `r` to
 refresh, and `q` to detach. Its responsive drill-down fits both desktop and
 mobile SSH terminals without squeezing phase, agent, and activity into three
-narrow columns.
+narrow columns. Below 100 columns it opens on a full-width timeline; press `t`
+to toggle Timeline and Phases, then use Enter/Esc for agents and activity.
 
 ```bash
 bullswarm workflow tui
@@ -436,7 +453,7 @@ appending anything. It executes ready actions, observes their durable results,
 and calls the planner again. `events.jsonl`, `state.json`, the TUI, and JSON
 inspection expose the same plan, actions, attempts, decisions, budgets, and
 artifacts. See `workflows/adaptive-code-review.json` for a complete example.
-Planner actions cannot set `pool`, `addDir`, or `taskFile`. If those need to be
+Planner actions cannot set `pool`, `model`, `addDir`, or `taskFile`. If those need to be
 fixed by the initiator, declare them under the `decide` step's `actionDefaults`;
 otherwise eligible capable pools are ranked by live quota surplus.
 

package/docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md

@@ -351,3 +351,41 @@ Cost of the false rejection: the 266 s planner turn plus the serialised tail ≈
 Fix committed after the run, unreleased (`71960ae`): rule 7 — "A verify checks the goal's own acceptance criteria …
 never add a process rule the goal does not state (append-only, tests untouched); when the implementation changes what
 an existing assertion pins, a worker must own updating it." Proof pending a rerun on that commit.
+
+## Run `8ebi8a` — runtime `7724da1` (rule 7 `71960ae` + PR #5 merge), luna pinned, fixture g4-bs-v6
+
+Launched 2026-08-29 16:42 Z as the live proof of rule 7. Result: **42 min 03 s**, worse than `euh622` (36 min) and
+`bizp4s` (25 min). Measured (`bs-g4-v6-metrics.json`): 3 planner turns / 775 s (31 % of wall; turn 2 430 s, correction
+turn 97 s, turn 1 ≈ 248 s derived), parallelism 1.34, max 3 concurrent, 23 dispatches (20 workers on
+`kaihk/gpt-5.6-luna`, 3 planner turns on claude-code/opus), 3 repair rounds — every re-verify rejected — 1 validator
+correction, auto-completed by `program-completion`, `npm test` 315/315, existing tests +179/−1 (the mandated `:206`
+extension, finally done by a named action `fix-pinned-test`).
+
+The three rejections were each legitimate under the re-verify rule of `9af8fdf`; the defect was in the prompts the
+planner wrote, and rule 7 did not stop it:
+- `verify-impl` r1: real concern. Repair 1 removed `outputSchema` from `programFeatures` so the OLD assertion at
+  `workflow-adaptive.test.js:206` would pass — because `impl` was told "do NOT modify existing tests", `tests-runtime`
+  (owner of that file) was never told to extend `:206`, and `verify-impl` expected `impl` to have done it. Re-verify
+  rejected (a regression: item 5 mandates the entry). r2 re-added it; the old assertion failed again; rejected.
+  Turn 2's reason names it: "my round-1 prompt asked for it". Nobody owned the assertion — the fourth run with this gap.
+- `verify-docs` r1: its prompt said "only those three doc files were changed by this worker (`git diff --stat`)"; the
+  repo-wide diff showed `impl`'s files, so it rejected on scope. The repair, told "Do not touch src/", still reverted
+  five `src/` files to make `git diff --name-only` show three files (its report: "git diff --name-only reports exactly
+  the three requested documentation files… 299 tests"). Re-verify rejected on the missing implementation.
+- Tail blocked: `verify-tests-schema`, `verify-tests-runtime`, `verify-suite`, `report`, `verify-report` depended on
+  `verify-impl` (a verdict, chosen so repairs would not edit the same files) → `failed_terminal` → planner turn 2,
+  which re-proposed the blocked id `verify-suite` → validator rejection → 97 s correction → recovery program
+  `restore-src` → `fix-pinned-test` → `verify-src` / `verify-tests` → `verify-full-suite` → `final-report` →
+  `verify-final-report`, all ok.
+
+Where the extra time went (vs `bizp4s`): ≈ 17 min in the two failed verify loops, the blocked tail, turn 2 and the
+correction; `impl` 493 s vs 377 s is variance.
+
+Conclusion and fix (unreleased, committed after the run): three runs in a row failed on a different planner-authored
+constraint the goal never stated (append-only → contradictory ownership → repo-wide scope check), so contract text
+alone is whack-a-mole. The runtime now owns the bar: every verify/re-verify instruction ends with a fixed acceptance
+standard (ok:false = unusable; everything else is a concern under ok:true; other actions' files are never this unit's
+defect), every repair prompt says to edit only the reviewed work's files and never revert others' changes, rule 2
+requires one owner per file including an existing test the change breaks, and the validator line states run-wide id
+uniqueness. Direction from the user: "unless it is completely nonsense or unable to finish I don't see a reason to
+reject so easily". Claim to test on the next rerun: none of the three `8ebi8a` rejection reasons can produce ok:false.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bullswarm",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Route work across coding-agent CLI subscriptions — paced by live quota meters, verified by content, never trusting exit codes.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -130,8 +130,15 @@ terminal-owned execution.
 The detached runner does not depend on the initiating CLI remaining alive.
 Resume a process-interrupted run from its persisted definition with
 `bullswarm workflow goal --resume <shortId> --json`. Leave orchestrator
-selection automatic in normal use; `--orchestrator=<pool>` is for controlled
-provider QA. `SIGTERM`/`SIGINT` cooperatively terminate the active delegate and
+selection automatic in normal use. `--orchestrator=<pool>` is a preference
+that falls back when the pool is quota-gated or unavailable;
+`--strict-orchestrator=<pool>` is the exact-provider control for QA and may
+wait for that pool's quota window. For a controlled model comparison, add
+`--orchestrator-model=<model>`, `--worker-pool=<pool>`, and
+`--worker-model=<model>`. The worker constraints cover scout, runs, fan-out
+items, repairs, re-verification, and extraction helpers; a pool that cannot
+guarantee the model is excluded rather than silently substituting it.
+`SIGTERM`/`SIGINT` cooperatively terminate the active delegate and
 persist `interrupted`; later workflow commands also reconcile dead or stale
 owners into that explicit resumable state.
 
@@ -223,8 +230,9 @@ ISO timestamps, local dates, today/yesterday/tomorrow/now, or durations such as
 normal ongoing-only scope.
 
 When the run is terminal, use `workflow runs result <id> --json` as the
-handoff contract. Its versioned result envelope points to the selected delivery
-artifact, the dependent verification verdict, progress, and usage. Do not guess
+handoff contract. Its versioned result envelope keeps one primary `delivery`,
+adds every jointly delivered parallel artifact under `deliveries[]`, and points
+to the strongest dependent verification verdict, progress, and usage. Do not guess
 the output schema by scraping task files or assume the last provider response is
 the deliverable; `runs show` is for low-level debugging.
 
@@ -287,6 +295,8 @@ Select Workflow Planner and press Enter, or press
 reason, next action, progress, and recent semantic activity. Press `v` for the
 durable provider session, checkpoint prompts and turns, usage, and artifact
 paths; `v` returns to the overview and Esc returns to phases.
+Below 100 columns the TUI opens on a full-width timeline; `t` toggles Timeline
+and Phases, and Enter/Esc continues through agents and activity.
 The shared state marks are `○` not started, animated Braille spinner active,
 `⧖` waiting, `✓` finished, and `✗` failed or interrupted.
 
@@ -404,7 +414,7 @@ orchestrator for the rest of the run and tries one other eligible pool
 `completed_with_concerns` with a ready best-effort artifact when useful work
 exists, or `blocked` when it does not; neither hides failed verification.
 Use `workflows/adaptive-code-review.json` as the starting template.
-Planner proposals cannot choose `pool`, `addDir`, or `taskFile`. Those fields
+Planner proposals cannot choose `pool`, `model`, `addDir`, or `taskFile`. Those fields
 are runtime-owned. An initiator may constrain them with a decide step's
 `actionDefaults`; absent a pinned default, normal capability and quota routing
 selects the worker.

package/src/help.js

@@ -581,7 +581,11 @@ const workflowGoalText = rich({
     { flag: '--watch', desc: 'immediately follow low-noise progress until terminal; only valid for a new human-readable independent launch — cannot combine with --detach, --foreground, --json, --resume, or --request', default: 'off' },
     { flag: '--foreground', desc: 'keep execution attached to this terminal instead of detaching', default: 'off (detaches into a background process)' },
     { flag: '--json', desc: 'print the launch/report document as JSON', default: 'human-readable launch instructions' },
-    { flag: '--orchestrator <pool|auto>', desc: 'pin the orchestrator pool for a new goal, or override it when combined with --resume', default: 'auto (capability- and quota-based selection)' },
+    { flag: '--orchestrator <pool|auto>', desc: 'prefer this orchestrator pool for a new goal or resumed run, falling back immediately when it is quota-gated, ineligible, or unavailable', default: 'auto (capability- and quota-based selection)' },
+    { flag: '--strict-orchestrator <pool>', desc: 'require exactly this orchestrator pool for controlled provider QA; waits when that pool is quota-gated instead of falling back; mutually exclusive with --orchestrator', default: 'off' },
+    { flag: '--orchestrator-model <model|auto>', desc: 'pin the exact model used by the autonomous planner; only pools that can guarantee this model remain eligible', default: 'auto (effort-tier strategy or connector default)' },
+    { flag: '--worker-pool <pool|auto>', desc: 'pin every non-planner dispatch, including scout, fan-out items, repairs, and verifiers, to one pool', default: 'auto (normal routing)' },
+    { flag: '--worker-model <model|auto>', desc: 'pin the exact model for every non-planner dispatch; only pools that can guarantee it remain eligible', default: 'auto (effort-tier strategy or connector default)' },
     { flag: '--max-agents <n>', desc: 'planning target for total dispatched agents (soft, not a hard stop)', default: '30 (max 500)' },
     { flag: '--max-expansion-rounds <n>', desc: 'planning target for planner replanning rounds', default: '8 (max 50)' },
     { flag: '--max-actions <n>', desc: 'planning target for total dispatched actions', default: '40 (max 1000)' },
@@ -605,6 +609,7 @@ const workflowGoalText = rich({
   ],
   examples: [
     { cmd: 'bullswarm workflow goal "Audit this repo for TODOs and file a one-page summary" --cwd .' },
+    { cmd: 'bullswarm workflow goal "Implement and verify the change" --cwd . --strict-orchestrator codex --orchestrator-model gpt-5.6-sol --worker-pool opencode2 --worker-model kaihk/gpt-5.6-luna', note: 'controlled Sol-planner/Luna-worker run' },
   ],
   next: 'bullswarm workflow watch <shortId> to follow progress, or bullswarm workflow tui for the interactive browser.',
 });
@@ -660,7 +665,7 @@ const workflowCapabilitiesText = rich({
   options: [{ flag: '--json', desc: 'accepted for consistency with other commands, but has no effect', default: 'output is always JSON regardless of this flag' }],
   safety: ['read-only — performs live pool discovery to populate pool/meter state; nothing is written'],
   examples: [{ cmd: 'bullswarm workflow capabilities' }],
-  next: 'bullswarm workflow goal "<goal>" --orchestrator <pool> to pin one of the reported pools, or bullswarm strategy show to review model tier assignments.',
+  next: 'bullswarm workflow goal "<goal>" --orchestrator <pool> to prefer one of the reported pools with fallback, or bullswarm strategy show to review model tier assignments.',
 });
 
 const workflowInspectText = rich({
@@ -691,6 +696,7 @@ const workflowTuiText = rich({
     '--cancel writes state.json (cancelRequested=true, status=cancelling) — cooperative, not a force-kill: the workflow stops at its next safe checkpoint',
     'inside the interactive browser, q detaches without stopping the underlying workflow; c requests the same cancellation with a confirmation prompt',
     'the default timeline is derived from durable state and events; press v for raw action-ledger and event evidence',
+    'below 100 columns the timeline remains full-width; press t to toggle Timeline and Phases, then Enter/Esc to drill into agents and activity',
   ],
   examples: [
     { cmd: 'bullswarm workflow tui', note: 'interactive run picker' },
@@ -869,8 +875,8 @@ const workflowRunsShowText = rich({
 
 const workflowRunsResultText = rich({
   usage: 'bullswarm workflow runs result <shortId|runId> [--json]',
-  purpose: 'Print the stable, caller-facing delivery content, verification verdict, progress, '
-    + 'and usage envelope for one run — the intended integration point for scripts and agents.',
+  purpose: 'Print the stable caller envelope: primary delivery, parallel deliveries[] frontier, '
+    + 'strongest verification verdict, progress, and usage for one run — the intended integration point for scripts and agents.',
   args: [{ name: '<shortId|runId>', desc: 'run identifier' }],
   options: [{ flag: '--json', desc: 'print the full result document as JSON', default: 'human-readable summary (delivery preview truncated to 64KB)' }],
   safety: ['read-only'],

package/src/workflow/cli.js

@@ -295,21 +295,83 @@ export function shouldAutoWatchGoal(opts) {
     opts.json !== true && opts.resume == null && opts.request == null;
 }
 
-export function applyResumeOrchestratorOverride(doc, requested) {
-  if (!requested) return doc;
-  const pool = requested === 'auto' ? null : requested;
+export function applyResumeOrchestratorOverride(doc, requested, strictRequested = null) {
+  if (!requested && !strictRequested) return doc;
+  if (requested && strictRequested) {
+    throw new Error('--orchestrator and --strict-orchestrator are mutually exclusive');
+  }
+  const strict = Boolean(strictRequested);
+  const selected = strictRequested ?? requested;
+  const pool = selected === 'auto' ? null : selected;
   doc.intent ??= {};
   doc.orchestration ??= {};
   doc.intent.requestedOrchestrator = pool ?? 'auto';
   doc.orchestration.requestedPool = pool;
+  doc.orchestration.strictPool = strict ? pool : null;
   doc.orchestration.selection = pool
-    ? 'user-pinned-for-testing'
+    ? (strict ? 'user-strict-for-testing' : 'user-preferred-with-fallback')
     : 'capability-strategy-and-quota';
   for (const phase of doc.phases ?? []) {
     for (const step of phase.steps ?? []) {
       if (step.type !== 'decide') continue;
-      if (pool) step.pool = pool;
-      else delete step.pool;
+      delete step.pool;
+      delete step.preferredPool;
+      if (pool) step[strict ? 'pool' : 'preferredPool'] = pool;
+    }
+  }
+  return doc;
+}
+
+export function applyResumeModelOverrides(doc, {
+  orchestratorModel = null,
+  workerPool = null,
+  workerModel = null,
+} = {}) {
+  const normalize = (value) => value === 'auto' ? null : value;
+  const plannerModel = normalize(orchestratorModel);
+  const workers = normalize(workerPool);
+  const workerModelLock = normalize(workerModel);
+  if (orchestratorModel == null && workerPool == null && workerModel == null) return doc;
+  doc.intent ??= {};
+  doc.orchestration ??= {};
+  if (orchestratorModel != null) {
+    doc.intent.requestedOrchestratorModel = plannerModel ?? 'auto';
+    doc.orchestration.requestedModel = plannerModel;
+  }
+  if (workerPool != null) {
+    doc.intent.requestedWorkerPool = workers ?? 'auto';
+    doc.orchestration.workerPool = workers;
+  }
+  if (workerModel != null) {
+    doc.intent.requestedWorkerModel = workerModelLock ?? 'auto';
+    doc.orchestration.workerModel = workerModelLock;
+  }
+  for (const phase of doc.phases ?? []) {
+    for (const step of phase.steps ?? []) {
+      if (step.type === 'decide') {
+        step.actionDefaults ??= {};
+        if (orchestratorModel != null) {
+          if (plannerModel) step.model = plannerModel;
+          else delete step.model;
+        }
+        if (workerPool != null) {
+          if (workers) step.actionDefaults.pool = workers;
+          else delete step.actionDefaults.pool;
+        }
+        if (workerModel != null) {
+          if (workerModelLock) step.actionDefaults.model = workerModelLock;
+          else delete step.actionDefaults.model;
+        }
+        continue;
+      }
+      if (workerPool != null) {
+        if (workers) step.pool = workers;
+        else delete step.pool;
+      }
+      if (workerModel != null) {
+        if (workerModelLock) step.model = workerModelLock;
+        else delete step.model;
+      }
     }
   }
   return doc;
@@ -324,6 +386,10 @@ async function wfGoal(opts) {
     console.error('✗ --watch is only valid for a new human-readable independent launch; do not combine it with --detach, --foreground, --json, --resume, or --request');
     return 2;
   }
+  if (opts.orchestrator && opts['strict-orchestrator']) {
+    console.error('✗ --orchestrator and --strict-orchestrator are mutually exclusive');
+    return 2;
+  }
   const { names, pools } = await livePoolNames();
   let doc;
   let resumeRunId = null;
@@ -345,7 +411,17 @@ async function wfGoal(opts) {
       console.error(`✗ cannot load durable workflow for ${resumeRunId}: ${err.message}`);
       return 1;
     }
-    applyResumeOrchestratorOverride(doc, opts.orchestrator);
+    try {
+      applyResumeOrchestratorOverride(doc, opts.orchestrator, opts['strict-orchestrator']);
+      applyResumeModelOverrides(doc, {
+        orchestratorModel: opts['orchestrator-model'],
+        workerPool: opts['worker-pool'],
+        workerModel: opts['worker-model'],
+      });
+    } catch (err) {
+      console.error(`✗ invalid goal options: ${err.message}`);
+      return 2;
+    }
   } else if (opts.request) {
     try {
       const request = JSON.parse(readFileSync(resolve(opts.request), 'utf8'));
@@ -364,13 +440,24 @@ async function wfGoal(opts) {
       console.error(goalUsage());
       return 2;
     }
-    const orchestrator = opts.orchestrator && opts.orchestrator !== 'auto'
-      ? opts.orchestrator : null;
+    const requestedOrchestrator = opts['strict-orchestrator'] ?? opts.orchestrator;
+    const orchestrator = requestedOrchestrator && requestedOrchestrator !== 'auto'
+      ? requestedOrchestrator : null;
+    const workerPool = opts['worker-pool'] && opts['worker-pool'] !== 'auto'
+      ? opts['worker-pool'] : null;
+    const workerModel = opts['worker-model'] && opts['worker-model'] !== 'auto'
+      ? opts['worker-model'] : null;
+    const orchestratorModel = opts['orchestrator-model'] && opts['orchestrator-model'] !== 'auto'
+      ? opts['orchestrator-model'] : null;
     try {
       doc = buildGoalWorkflow({
         goal,
         cwd: opts.cwd ?? process.cwd(),
         orchestrator,
+        strictOrchestrator: Boolean(opts['strict-orchestrator']),
+        orchestratorModel,
+        workerPool,
+        workerModel,
         settings: goalSettings(opts),
         scout: !opts.noScout,
         worktreeIsolation: loadState(BULLSWARM_DIR()).config?.worktreeIsolation ?? 'agent-decides',
@@ -616,7 +703,8 @@ async function wfInspect(opts) {
 function parseFlags(argv) {
   const out = { inputs: {}, rest: [] };
   const valueFlags = new Set([
-    'resume', 'after', 'cwd', 'orchestrator', 'request', 'run-id',
+    'resume', 'after', 'cwd', 'orchestrator', 'strict-orchestrator', 'orchestrator-model',
+    'worker-pool', 'worker-model', 'request', 'run-id',
     'max-agents', 'max-expansion-rounds', 'max-actions',
     'max-items-per-expansion', 'max-workflow-seconds', 'concurrency',
     'retry-attempts', 'interval', 'heartbeat', 'message',

package/src/workflow/dashboard.js

@@ -363,7 +363,7 @@ export function renderWorkflowTui(row, {
   width = 120, height = 36, focus = 0, phaseIndex = null, agentIndex = null,
   detailScroll = 0, message = null, confirmCancel = false,
   controlSelected = false, orchestratorDetail = false, orchestratorVerbose = false,
-  workflowVerbose = false,
+  workflowVerbose = false, mobileTimeline = true,
   spinnerFrame = 0,
 } = {}) {
   width = Math.max(20, Number(width) || 120);
@@ -392,11 +392,13 @@ export function renderWorkflowTui(row, {
       : workflowVerbose
         ? ' ↑/↓ scroll · v overview · Esc back · c stop · q detach'
         : narrow
-          ? ' ↑/↓ select · Enter inspect · Esc back · o planner · v technical · c stop · q detach'
+          ? mobileTimeline && focus === 0
+            ? ' ↑/↓ timeline · t phases · Enter agents · o planner · v technical · q detach'
+            : ' ↑/↓ select · t timeline · Enter inspect · Esc back · o planner · v technical · q detach'
           : ' ↑/↓ select · PgUp/PgDn timeline · Enter inspect · ←/→ switch · v technical · q detach';
   const rawMessageLine = message
     ? ` ${truncate(message, width - 2)}`
-    : ` ${orchestratorDetail ? `Workflow Planner ${orchestratorVerbose ? 'technical details' : 'overview'}` : workflowVerbose ? 'Workflow technical details' : focus === 0 ? (narrow ? 'Phases' : 'Timeline · auto-following newest event') : focus === 1 ? 'Agents' : 'Agent activity'} · r refresh · workflow continues after detach`;
+    : ` ${orchestratorDetail ? `Workflow Planner ${orchestratorVerbose ? 'technical details' : 'overview'}` : workflowVerbose ? 'Workflow technical details' : focus === 0 ? (narrow && !mobileTimeline ? 'Phases' : 'Timeline · auto-following newest event') : focus === 1 ? 'Agents' : 'Agent activity'} · r refresh · workflow continues after detach`;
   const messageLine = truncate(rawMessageLine, width);
   const bodyHeight = Math.max(10, height - header.length - 3);
 
@@ -487,7 +489,9 @@ export function renderWorkflowTui(row, {
       body = joinPanels(left, renderPanel('Workflow technical details', visibleTechnical, rightWidth, bodyHeight));
     }
   } else if (narrow) {
-    const mobile = focus === 0
+    const mobile = focus === 0 && mobileTimeline
+      ? null
+      : focus === 0
       ? {
         title: model.orchestrator.autonomous
           ? `Workflow · ${model.phases.length} phase${model.phases.length === 1 ? '' : 's'}`
@@ -497,7 +501,9 @@ export function renderWorkflowTui(row, {
       : focus === 1
         ? { title: agentTitle, lines: visibleAgents }
         : { title: detailTitle, lines: visibleDetail };
-    body = renderPanel(mobile.title, mobile.lines, width, bodyHeight);
+    body = mobile
+      ? renderPanel(mobile.title, mobile.lines, width, bodyHeight)
+      : renderWorkflowOverviewPanel(model, width, bodyHeight, spinnerFrame, detailScroll);
   } else if (focus < 2) {
     const left = model.orchestrator.autonomous
       ? [
@@ -582,9 +588,9 @@ function workflowTimelineLines(model, width) {
   const { state, orchestrator } = model;
   const ledger = state.actionLedger ?? [];
   const events = [];
-  const add = (at, lines, sequence = Number.MAX_SAFE_INTEGER) => {
+  const add = (at, lines, sequence = Number.MAX_SAFE_INTEGER, group = null) => {
     if (!at) return;
-    events.push({ at, sequence, lines: Array.isArray(lines) ? lines : [lines] });
+    events.push({ at, sequence, group, lines: Array.isArray(lines) ? lines : [lines] });
   };
   const scout = ledger.find((action) => action.id === 'scout');
   add(state.startedAt, [
@@ -614,10 +620,17 @@ function workflowTimelineLines(model, width) {
     const decision = decisionForPlannerAttempt(state, attempt, index, orchestrator.attempts);
     const summary = decision?.reason ? sentencePreview(decision.reason, Math.max(30, width - 10))
       : decision ? decisionLabel(decision.decision) : 'No accepted decision; correction or retry turn';
+    const acceptedBefore = orchestrator.attempts.slice(0, index).filter((entry, priorIndex) =>
+      decisionForPlannerAttempt(state, entry, priorIndex, orchestrator.attempts)).length;
+    const plannerLabel = !decision
+      ? `planning retry #${index + 1}`
+      : decision.decision === 'complete'
+        ? 'completion confirmed'
+        : acceptedBefore === 0 ? 'plan created' : `plan updated #${acceptedBefore + 1}`;
     add(attempt.finishedAt, [
-      timelineRow(attempt.finishedAt, `◆ [Workflow Planner] checkpoint #${index + 1}`, durationText(attempt.startedAt, attempt.finishedAt), width),
+      timelineRow(attempt.finishedAt, `◆ [Workflow Planner] ${plannerLabel}`, durationText(attempt.startedAt, attempt.finishedAt), width),
       timelineDetail(summary, width),
-    ]);
+    ], Number.MAX_SAFE_INTEGER, 'execution');
   });
 
   const phases = new Map();
@@ -632,7 +645,7 @@ function workflowTimelineLines(model, width) {
     const startedAt = realStart ?? earliestTimestamp(actions.map((action) => actionFinishedAt(state, action)));
     if (!startedAt) continue;
     const label = phaseLabel(name, orchestrator);
-    add(startedAt, timelineRow(startedAt, `├─ [Phase: ${label}] ${realStart ? 'started' : 'blocked'}`, '', width));
+    add(startedAt, timelineRow(startedAt, `├─ [Phase: ${label}] ${realStart ? 'started' : 'blocked'}`, '', width), Number.MAX_SAFE_INTEGER, 'execution');
     const finished = actions
       .filter((action) => actionFinishedAt(state, action) && TERMINAL_ACTIONS.has(effectiveActionStatus(action, state)))
       .sort((a, b) => Date.parse(actionFinishedAt(state, a)) - Date.parse(actionFinishedAt(state, b)));
@@ -646,24 +659,24 @@ function workflowTimelineLines(model, width) {
         `${branch}${statusIcon(effectiveActionStatus(action, state))} [${label}] ${action.id}`,
         actionStarted ? durationText(actionStarted, actionFinished) : '',
         width,
-      ));
+      ), Number.MAX_SAFE_INTEGER, 'execution');
     });
     if (finished.length === actions.length && actions.length) {
       const finishedAt = latestTimestamp(actions.map((action) => actionFinishedAt(state, action)));
       const failed = actions.some((action) => String(effectiveActionStatus(action, state)).startsWith('failed'));
-      add(finishedAt, timelineRow(finishedAt, `└─${failed ? '✗' : '✓'} [Phase: ${label}] completed`, `${finished.length}/${actions.length}`, width));
+      add(finishedAt, timelineRow(finishedAt, `└─${failed ? '✗' : '✓'} [Phase: ${label}] completed`, `${finished.length}/${actions.length}`, width), Number.MAX_SAFE_INTEGER, 'execution');
     }
   }
 
   for (const event of model.events) {
     const detail = timelineControlEvent(event, width);
-    if (detail) add(event.committedAt, detail, Number(event.sequence));
+    if (detail) add(event.committedAt, detail, Number(event.sequence), event.type.startsWith('decision.') ? 'execution' : null);
   }
 
   events.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.sequence - b.sequence);
   const lines = [];
   events.forEach((event, index) => {
-    if (index) lines.push('');
+    if (index && (!event.group || event.group !== events[index - 1].group)) lines.push('');
     lines.push(...event.lines);
   });
   return { lines: lines.length ? lines : ['Waiting for the first durable workflow milestone'], milestoneCount: events.length };
@@ -751,13 +764,35 @@ function workflowLiveLines(model, width, spinnerFrame) {
     if (stream) lines.push(`   ${stream}`);
     lines.push('');
   }
-  if (!lines.length) lines.push(state.finishedAt ? '✓ No live agents · workflow is terminal' : '⧖ Waiting for the next dispatch');
+  if (!lines.length) lines.push(state.finishedAt
+    ? `${statusIcon(state.status)} No agents running · ${terminalWorkflowLabel(state.status)}`
+    : '⧖ Waiting for the next dispatch');
   return { lines, running, waiting };
 }
 
+function terminalWorkflowLabel(status) {
+  if (status === 'completed') return 'workflow finished';
+  if (status === 'completed_with_concerns') return 'workflow finished with concerns';
+  if (status === 'blocked') return 'workflow stopped with blockers';
+  if (status === 'failed') return 'workflow failed';
+  if (status === 'cancelled') return 'workflow cancelled';
+  if (status === 'interrupted') return 'workflow interrupted';
+  return 'workflow stopped';
+}
+
 function workflowNextLines(model, width) {
   const { state, orchestrator } = model;
-  if (state.finishedAt) return [truncate(`${statusIcon(state.status)} Workflow terminal · obtain the stable result envelope`, width)];
+  if (state.finishedAt) {
+    const next = state.status === 'completed' || state.status === 'completed_with_concerns'
+      ? 'result ready'
+      : state.status === 'blocked' ? 'review blockers and partial work'
+        : state.status === 'failed' ? 'inspect the failure before using partial work'
+          : state.status === 'cancelled' ? 'review any partial work'
+            : state.status === 'interrupted' ? 'resume the workflow or inspect partial work'
+              : 'inspect the workflow result';
+    const label = terminalWorkflowLabel(state.status);
+    return [truncate(`${statusIcon(state.status)} ${label[0].toUpperCase()}${label.slice(1)} · ${next}`, width)];
+  }
   const ledger = state.actionLedger ?? [];
   const pending = ledger.find((action) => action.id !== 'scout'
     && action.id !== orchestrator.actionId
@@ -1228,6 +1263,7 @@ export async function runDashboard(bullswarmDir, {
     orchestratorDetail: false,
     orchestratorVerbose: false,
     workflowVerbose: false,
+    mobileTimeline: true,
     spinnerFrame: 0,
   };
   const paintUnsafe = () => {
@@ -1298,8 +1334,10 @@ export async function runDashboard(bullswarmDir, {
       }
       const row = detailRow(bullswarmDir, selectedRunId);
       const model = workflowPanelModel(row, { phaseIndex: ui.phaseIndex, agentIndex: ui.agentIndex });
-      if (ui.orchestratorDetail || ui.workflowVerbose) {
-        ui.detailScroll = Math.max(0, ui.detailScroll + delta);
+      const narrowTimeline = output.columns < 100 && ui.mobileTimeline && ui.focus === 0;
+      if (ui.orchestratorDetail || ui.workflowVerbose || narrowTimeline) {
+        if (narrowTimeline) ui.detailScroll = Math.max(0, ui.detailScroll - delta);
+        else ui.detailScroll = Math.max(0, ui.detailScroll + delta);
         return paint();
       }
       if (ui.focus === 0) {
@@ -1396,6 +1434,14 @@ export async function runDashboard(bullswarmDir, {
         } else message = 'This workflow has no autonomous orchestrator thread.';
         return paint();
       }
+      if (key === 't' && detail && output.columns < 100 && !ui.orchestratorDetail && !ui.workflowVerbose) {
+        ui.mobileTimeline = !ui.mobileTimeline;
+        ui.focus = 0;
+        ui.controlSelected = false;
+        ui.detailScroll = 0;
+        message = null;
+        return paint();
+      }
       if (key === '1' && detail) { ui.focus = 0; return paint(); }
       if (key === '2' && detail) { ui.focus = 1; return paint(); }
       if (key === '3' && detail) { ui.focus = 2; return paint(); }