bullswarm 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -1,12 +1,70 @@
 # bullswarm changelog
 
+## 0.21.0 — unified TUI shell and LLM-first delegation
+
+- The interactive workflow viewer is now one application shell instead of
+  several screens with their own rules. The workflows list, a run, a phase and
+  an agent are four depths of one hierarchy: every screen carries the same
+  persistent breadcrumb at the top (`Workflows › hdtdxs · timeline-segments ›
+  Verify › verify-renderer`), which drops its deepest segments first when the
+  terminal is too narrow to hold the whole path. All four depths share key
+  bindings generated from a single key-map definition: Up/Down (or k/j) move
+  within the current level, Enter and Right (or l) go one level in, Esc and
+  Left (or h) go one level out, and Tab/Shift+Tab jump to the next or previous
+  workflow, re-entering the sibling at the same depth when the equivalent phase
+  exists. The drill-down layout is uniform too — a left sidebar listing the
+  current level beside a right pane previewing the highlighted item — at every
+  depth and on narrow terminals as well, including the run list, which was a
+  full-width table with no preview pane before.
+
+- Workflow timelines now render in phase-segmented sections with continued
+  headers for interleaved phases, grouped Preflight scout/planner milestones,
+  elapsed or running phase state, and consistent desktop, narrow, and scroll
+  continuation behavior without per-line phase prefixes. Phase-completion
+  summary rows are retained, so rows such as `└─✓ completed 4/4` remain visible
+  beneath their phase headers.
+
+- Non-interactive `workflow tui <run-id>` output now includes the same static
+  segmented timeline as the interactive viewer, alongside the historical detail
+  tree, so real command output can be used to inspect and verify the layout.
+
+- Documentation now describes concerns as an attribute of a completed
+  outcome — `outcome.concerns` on a delivered result — rather than
+  presenting `completed_with_concerns` as its own terminal status to handle
+  separately from `completed`. Run records that carry the
+  `completed_with_concerns` status value, including legacy runs recorded
+  before this framing, remain fully readable: `runs result`, the TUI, and
+  `workflow watch` still read it exactly like `completed` — a delivered
+  result with concerns to review, never a failure.
+
+- Delegation classification now starts with deterministic signals and, in
+  automatic execution, lets an LLM refine the choice between a single delegate
+  and a workflow. `--dry-run` performs that same bounded low-effort
+  classification request (one analyze-lane, low-effort dispatch) before
+  printing the plan, so the preview matches what a live run would decide — it
+  never dispatches the work itself. `--classify deterministic` bypasses that
+  refinement and remains the instant, no-dispatch preview; `--classify llm`
+  requires the refinement and fails if no usable LLM decision is available.
+  An explicit `--mode single|workflow` remains the caller's choice and bypasses
+  automatic LLM classification.
+
+- OpenCode connector portability: `connectors/opencode2.json` no longer
+  hardcodes `--model kaihk/gpt-5.6-luna` in `spawn.cmd`. A plain OpenCode
+  install with no KaiHK provider configured now dispatches with OpenCode's
+  own default model instead of failing to resolve a KaiHK-only model.
+  `src/lib/opencode-kaihk.js` still injects the explicit
+  `--model <providerId>/gpt-5.6-luna` for each discovered KaiHK provider, so
+  the primary `opencode2` pool and any extra `opencode2:<id>` pools keep
+  dispatching with their pinned per-provider model exactly as before.
+
 ## 0.20.0 — common agent delegation entry point
 
 - `/bullswarm` and `bullswarm delegate` now give agents one transparent entry
   point for arbitrary self-contained tasks: classify the request as one bounded
   delegate or an autonomous workflow, show the reason and conceptual plan, then
   execute the selected engine. Explicit mode and lane overrides remain
-  available, and `--dry-run --json` exposes the decision without dispatching.
+  available, and `--dry-run --json` exposes the decision after its bounded
+  classification request without dispatching the work itself.
 - Workflow decisions persist the suggested conceptual plan alongside the
   original intent, while the packaged skill keeps the common path concise and
   moves operational detail into a focused reference.

package/README.md

@@ -73,7 +73,7 @@ bullswarm pools    # meter state, pace position, quarantine status
 bullswarm strategy refresh --apply --yes  # approve capability-aware tier autopilot
 bullswarm delegate --cwd ~/some-repo --prompt "Explain the parser"            # one agent
 bullswarm delegate --cwd ~/some-repo --prompt "Audit all commands, fix help, and independently verify"  # workflow
-bullswarm delegate --dry-run --json --cwd ~/some-repo --prompt "Your task"     # decision + plan only
+bullswarm delegate --dry-run --json --cwd ~/some-repo --prompt "Your task"     # bounded classification + decision/plan; no work dispatch
 bullswarm run --lane analyze --add-dir ~/some-repo --task-file /tmp/t.md --json
 bullswarm run --lane analyze --add-dir ~/some-repo --prompt "Inspect the parser" --json
 bullswarm workflow goal "Fix the failing tests and verify the change" --cwd ~/some-repo
@@ -94,6 +94,22 @@ bullswarm health   # re-judge saved outputs; catch gate failures
 | `doctor` | Machine-readable readiness report; self-heals on first call |
 | `workflow` | Start an autonomous goal, or run / validate / draft / inspect explicit workflows and their live instances. |
 
+### Delegate classification
+
+With the default `--mode auto`, `delegate` first uses deterministic task
+signals, then uses an LLM to refine the choice between a single delegate and a
+workflow during execution. If that optional refinement is unavailable or
+unusable, automatic mode uses the deterministic decision.
+
+Use `--classify deterministic` to bypass the LLM refinement — this is the
+instant, no-dispatch preview. Use `--classify llm` when an LLM decision is
+required: the command fails if it cannot obtain a usable one. In automatic
+mode, `--dry-run` still performs that same bounded low-effort classification
+request (one analyze-lane, low-effort dispatch) and prints the resulting
+decision — it never dispatches the work itself. An explicit `--mode single` or
+`--mode workflow` is the caller's decision and bypasses automatic LLM
+classification.
+
 Discover and validate workflow definitions without executing them:
 
 ```bash
@@ -213,7 +229,18 @@ bullswarm workflow goal "Implement and verify the change" --cwd . \
 The worker lock covers the scout, ordinary runs, fan-out items, repairs,
 re-verification, and runtime extraction helpers. A pool that cannot guarantee
 the requested model is ineligible rather than silently substituting another
-model. `--max-agents` and `--max-workflow-seconds` are
+model.
+
+The `opencode2` connector itself does not require a KaiHK provider: its base
+spawn command carries no hardcoded model, so a plain OpenCode installation
+dispatches with OpenCode's own configured default. When
+`~/.config/opencode/opencode.json` has one or more KaiHK providers configured,
+Bullswarm discovers them and pins an explicit `--model <providerId>/gpt-5.6-luna`
+per provider — the first as the primary `opencode2` pool, each additional one
+as its own `opencode2:<id>` pool — which is what the `--worker-model
+kaihk/gpt-5.6-luna` example above locks onto.
+
+`--max-agents` and `--max-workflow-seconds` are
 advisory planning targets; `--max-expansion-rounds` is also an advisory
 convergence target. Hard structural safeguards are adjusted with
 `--max-actions` and `--max-items-per-expansion`.
@@ -449,11 +476,16 @@ rather than discarding the run as a blanket failure. Delegates have no
 implicit wall-clock timeout; set a step's `timeoutSec` (or direct-run
 `--timeout`) only when an operator explicitly wants a hard termination timer.
 
-An autonomous `complete` remains strictly verified. A planner `stop` produces
-`completed_with_concerns` when a useful delivery exists, including unresolved
-verification concerns and the stopping reason; it produces `blocked` only
-when no useful delivery exists. `workflow runs result` treats the qualified
-delivery as ready while reporting `verified:false`.
+An autonomous `complete` remains strictly verified. A planner `stop` still
+delivers a completed outcome when a useful delivery exists: unresolved
+verification concerns and the stopping reason ride along as `outcome.concerns`
+and `outcome.reason`, attributes of that completed outcome rather than a
+separate terminal status. `stop` produces `blocked` only when no useful
+delivery exists. `workflow runs result` treats the completed outcome as ready
+while reporting `verified:false`. The status value `completed_with_concerns`
+still appears on some runs — including legacy ones recorded before this
+framing — and every consumer reads it exactly like `completed`: a delivered
+result with concerns to review, never a failure.
 
 The planner returns versioned JSON. It may propose `needs_more_work` with
 bounded `run`, inline-`fanout`, or `verify` actions. The deterministic runtime

package/connectors/opencode2.json

@@ -3,7 +3,7 @@
   "bin": "opencode",
   "configDirs": ["~/.config/opencode"],
   "spawn": {
-    "cmd": ["opencode", "run", "--auto", "--model", "kaihk/gpt-5.6-luna", "{taskFile}"],
+    "cmd": ["opencode", "run", "--auto", "{taskFile}"],
     "cwdMode": "pwd",
     "$comment-cwdMode": "QUIRK: resolves its project from $PWD, not the spawn cwd. The watcher MUST set env.PWD and spawn with cwd inside the target repo, or it will silently analyse the wrong repository and answer confidently about it."
   },
@@ -21,7 +21,7 @@
       { "match": { "path": "type", "equals": "text" }, "path": "part.text", "mode": "concat", "separator": "\n" }
     ]
   },
-  "$comment-auto": "--auto is required for headless workflow dispatch: task files live under ~/.bullswarm, outside the target repo, and OpenCode otherwise pauses for an interactive permission approval. --model pins the QA/runtime pool to Luna instead of the CLI default.",
+  "$comment-auto": "--auto is required for headless workflow dispatch: task files live under ~/.bullswarm, outside the target repo, and OpenCode otherwise pauses for an interactive permission approval. The base connector intentionally leaves --model unset so a plain OpenCode installation uses its own default; opencode-kaihk.js adds --model <providerId>/gpt-5.6-luna only for discovered KaiHK providers, after which modelSelection can replace it for assignments and step locks.",
   "$comment-exit1": "known failure mode: writes a complete correct answer, then dies with a Console-sync auth error and exit 1. The verdict sets contentUsableDespiteExit instead of discarding the work.",
   "meter": { "type": "none" },
   "costRank": 1,

package/docs/experiments/2026-08-29-dogfood-bullswarm-builds-bullswarm.md

@@ -389,3 +389,165 @@ defect), every repair prompt says to edit only the reviewed work's files and nev
 requires one owner per file including an existing test the change breaks, and the validator line states run-wide id
 uniqueness. Direction from the user: "unless it is completely nonsense or unable to finish I don't see a reason to
 reject so easily". Claim to test on the next rerun: none of the three `8ebi8a` rejection reasons can produce ok:false.
+
+## Run `5cvj72` — bullswarm 0.20.0 builds bullswarm's next release (2026-08-31, real repo, installed runtime)
+
+Goal: (R1) remove the hardcoded `kaihk/gpt-5.6-luna` from `connectors/opencode2.json` while keeping KaiHK per-provider
+model injection, (R2) LLM-refined delegation classification on top of the deterministic guess, (R3) docs, (R4) full
+suite green. Launched through `bullswarm delegate` itself (dry-run preview → executed pinned `--mode=workflow`).
+
+Result: **13 min 58 s** (838 s), 1 planner turn (73 s, 8.7 %), 12 dispatches, parallelism 1.69, max 3 concurrent,
+9-action program (3 implementers ∥ → 3 unit verifies covering R1–R3 → suite verify covering R1–R4), auto-completed
+`completed_with_concerns` (1 informational concern), 388/388 tests — verified independently by the operator.
+
+Reliability events, all self-healed: `update-documentation` on claude-code/sonnet-5 failed the output substance gate
+("announcement without substance") → escalated to codex/gpt-5.6-terra, succeeded. `verify-classifier` rejected once —
+legitimately under the lenient bar (R2 demanded BOTH reasons in the decision; `refineDecision()` dropped the
+deterministic one; the focused tests themselves passed 18/18) — one repair round fixed it, re-verify accepted. The
+coverage-evidence flip fired only alongside that real concern; no false rejection this run.
+
+Routing: soft `preferredConcurrency:1` spillover worked as designed — 9/12 dispatches on `opencode2 kaihk-2/gpt-5.6-luna`
+(the all-tier assignment), while parallel siblings spilled to claude-code (fable-5 for `implement-classifier`,
+sonnet-5 for the failed docs attempt) and codex (terra). Note: the per-pool assignment pins the model only on its own
+pool; spillover pools use their connector default, so a luna-only run needs either per-pool assignments or no
+concurrent siblings.
+
+Post-run verification by the operator: repo connector via a temp home — KaiHK off ⇒ `["opencode","run","--auto",
+"{taskFile}"]` (no `--model`); KaiHK on ⇒ `--model kaihk/gpt-5.6-luna`, `kaihk-2/…`, `kaihk-3/…` injected per provider.
+Live `--classify=llm` end-to-end: decision came back `source: llm-classifier` with both reasons and a sensible verdict.
+Two observations recorded, not fixed: (a) `--dry-run` never consults the LLM, so the canonical skill flow
+(dry-run preview → pinned re-execute) exercises only the deterministic classifier; (b) the substance gate rejected a
+correct 16-char answer ("bullswarm 0.20.0") from the tiny smoke delegation — legitimately terse outputs still fail the
+40/80-char floors. Installed homes keep the old connector until a setup upgrade copies the new file.
+
+## Run p3jbha — always-LLM classification + cross-agent integration audit (2026-08-31)
+
+Goal (4 numbered requirements): make the LLM the deciding classifier for every auto-mode
+`delegate` call including `--dry-run` (deterministic stays as the pre-pass hint fed into the
+LLM prompt); make LLM fallback visible in the envelope instead of silent; update every doc
+that claimed dry-run was deterministic-only; write a read-only cross-agent integration audit
+for Claude/Codex/Grok. Launched through the **repo binary at 8908ef8** (installed 0.20.0
+predates the LLM classifier) via the canonical flow: `delegate --dry-run` preview → pinned
+`--mode=workflow`. Before launch: `claude-fable-5` added to `strategy exclude-model`
+(recorded no-Fable pref; last run's spillover violation), and three dangling
+`bullswarm.broken-20260830` symlinks removed from all three CLIs' skill dirs.
+
+**Preview accuracy specimen:** the deterministic classifier scored the goal correctly
+(workflow, score 7) but the phrase "read-only cross-agent integration audit" tripped
+`READ_ONLY_LABEL_RE`, so `hasMutationIntent` returned false and the suggested plan dropped
+its Execute phase entirely (Inspect→Verify→Deliver for a mostly-code-edit task). A live
+one-regex misfire — exactly the case for LLM-decided classification.
+
+**Outcome: completed_with_concerns (verified: true), auto-completed.** Wall 1,292 s
+(21m32s), attempt-busy 2,050 s, parallelism 1.59, max 3 concurrent, zero quota wait.
+14 dispatches: 2 planner turns (99 s total = 7.7%) + 12 worker attempts. Diff: 6 files
++72/−25 plus the new 411-line audit doc. Independently re-verified by the operator:
+`npm test` 389/389; live `--dry-run` auto → `source: llm-classifier` in 23.6 s with the
+deterministic sub-object preserved; `--dry-run --classify=deterministic` → 0.12 s, no
+dispatch.
+
+**Routing:** implement/verify work on opencode2 (kaihk-2/gpt-5.6-luna); docs on
+claude-code/claude-sonnet-5; the audit on claude-code/claude-opus-5 (822 s, the critical
+path). The only "fable" string in the run state is the exclusion entry itself — the
+mitigation held.
+
+**Reliability tally — 3 ok:false verdicts, 1 genuinely earned:**
+1. `verify-integration-audit` round 1: legitimate — the audit really ended with the
+   command appendix and lacked the required recommendations section; repair added §7
+   (five evidence-linked recommendations).
+2. `verify-documentation` round 1: cross-ownership overreach — it rejected R3's docs
+   because R4's `docs/integration-audit-2026-08-31.md` (owned by a *different, still
+   running* action, 822 s) did not exist yet. Under the runtime's lenient acceptance
+   standard, later-scheduled work and other actions' files are concerns, not rejections.
+3. `verify-integration-audit` re-verify after repair: **factually false** — it claimed
+   "no concrete recommendations appear at the end" and cited lines 384–411 as the final
+   section, while the repaired file (mtime 05:01:14Z, before the verifier started at
+   05:01:50Z) held §7 Recommendations at lines 345–383. The verifier anchored on its
+   previous verdict instead of re-reading. This exhausted maxRounds=1, failed the action,
+   blocked `verify-suite`, and forced planner turn 2 — which proposed a fresh
+   `verify-completion` that passed all four requirements with line-level evidence, then
+   auto-completed. Recovery cost ≈ 2 min of wall time.
+
+**Observations recorded, not yet fixed:** (a) re-verify verdict anchoring — the reverify
+prompt could require the verifier to re-read the changed files and address the repair's
+report before repeating a rejection; (b) requirement-coverage entanglement keeps making
+verifiers judge files other actions own (second run in a row); (c) the run's own audit
+deliverable found a real product defect: `integrate status` computes skill-link identity
+against the *invoking checkout's* path, so any other valid Bullswarm install reports
+`conflict`/exit 1 and `integrate install` refuses to repair it — stale skill symlinks are
+sticky until removed by hand (see docs/integration-audit-2026-08-31.md §2, §7).
+
+## Run wxfwda — retire completed_with_concerns + two dashboard truthfulness fixes (2026-08-31)
+
+User directive: "having concern is not a problem of bullswarm itself but part of the agent
+lifecycle, I do not think we need to formalize it as a feature" — plus two screenshot
+defects from viewing run p3jbha: permanent ✗ phase marks on a delivered run, and
+"Final Verification · 1/1 complete" over a pane saying "Not started yet" for the
+never-dispatched verify-suite. Launched through the repo binary at f11e544; the preview was
+the **first live canonical-flow use of the always-LLM classifier** — `source:
+llm-classifier` in 20.6 s, agreeing with the deterministic hint (workflow, score 7).
+
+**Outcome: auto-completed, verified: true.** Wall 1,541 s (25m41s), busy 3,110 s,
+**parallelism 2.02** (best of the series), max 4 concurrent, planner 80 s (5.2%),
+15 attempts, zero quota wait. Diff: 11 files +444/−67. Operator-verified: `npm test`
+**394/394** (5 new tests), and both defects proven fixed by rendering the real
+wf-mtgr56l1-167281 run dir with the new code — phase 6 renders `✓ Audit Verification 2/2`,
+phase 7 renders `⊘ Final Verification 0/1` with pane "⊘ verify-suite · never dispatched ·
+blocked by verify-integration-audit", planner panel "! Completed with 5 concerns" from the
+outcome envelope.
+
+**Design as landed:** new runs always terminate `completed` (or blocked/failed/…); the
+qualification lives in `outcome` (`verified`, `bestEffort`, `concerns`, new
+`qualification: 'verified'|'qualified'`). The stage `delivered_with_concerns` and event
+`run.completed_with_concerns` are gone for new runs. `completed_with_concerns` remains
+parse-only for legacy run dirs (the `budget_exhausted` precedent), rendered through the same
+outcome-driven sentences. Dashboard invariants: a delivered run's phase list carries no
+failure marks (attempt rows keep true history; failed/blocked/interrupted runs keep ✗);
+a never-dispatched dependency-blocked action gets `⊘`, is excluded from "N/N complete",
+and its pane names the failed dependency (`outputs[id].dependencyBlocked`, which the real
+runner already writes).
+
+**Reliability tally:** 1 rejection (verify-watcher-compatibility round 1) — cross-ownership
+again: its concerns *praised* the reviewed work (10/10 focused tests, correctly refused to
+touch unowned files) and complained about a missing `// legacy runs` comment in status.js,
+a file the action did not own. Repaired in 36 s, re-verified ok. Third run in a row where
+the only rejections judge files outside the reviewed work's ownership — the
+requirement-coverage entanglement follow-up is now clearly the top reliability fix.
+This run itself was labeled `completed_with_concerns` by the pre-change runtime it ran on —
+expected artifact, not a failed fix; the label class it removes dies with the next release.
+
+## Run hdtdxs — phase-segmented timeline (2026-08-31)
+
+User picked the segmented layout from a three-way mockup (headers on phase boundaries,
+`· continued` on interleave, per-line `[Phase: …]` prefixes dropped, chronology preserved).
+Launched through the repo binary at 5064c0f; preview `source: llm-classifier` in 16.6 s.
+**First run executing on the post-removal runtime: it terminated plain `completed`
+(qualification: qualified, 1 concern) — live validation of the wxfwda status collapse.**
+
+**Outcome: auto-completed, verified: true.** Wall 2,290 s (38m10s), busy 3,038 s,
+parallelism 1.33, max 2 concurrent, planner 214 s across 4 checkpoints + 1 correction
+(9.3%), 23 attempts. Diff: 3 files +440/−49. Operator-verified: `npm test` **400/400**
+(6 new tests) and `node --test tests/workflow-dashboard.test.js` 32/32 — which makes the
+run's single recorded concern (a focused-test failure on the narrow-width continuation
+header) stale by the time of handoff; the repair that closed verify-final-acceptance fixed
+it. Rendering both real run dirs shows 0 `[Phase:` prefixes and correct headers:
+`── Suite ─── 1m08s ──`, `── Verify · continued ─── 16m13s ──`,
+`── Final Acceptance Verify ─── 6m58s ──`; scrolled viewports re-emit a continuation
+header. Non-interactive `workflow tui <runId>` now prints the same segmented timeline
+(added mid-run after a verifier rejected the render evidence as unverifiable).
+
+**Reliability tally — the best verifier showing of the series: 5 rejections, ALL
+legitimate.** verify-renderer r1 (3 stale tests genuinely failing under the acceptance
+command), r2 (narrow variant genuinely still emitted `[Phase:` prefixes), verify-tests r1
+(CHANGELOG entry genuinely missing — this one cascaded: 8 downstream actions
+dependency-blocked across two recovery attempts before planner turn 4 landed the fix),
+verify-final-changelog r1 (the goal's required documentation choice genuinely absent),
+verify-final-acceptance r1 (render evidence genuinely invalid — non-interactive tui had no
+timeline; the repair added it). Zero cross-ownership rejections for the first time in four
+runs. Cost of the cascade: 2 extra planner turns + 1 planner correction (it tried to reuse
+a finished phase name), ~8 min of wall. Routing clean: opencode2/luna everywhere except
+add-tests on claude-code (856 s); the only "fable" string in state is the exclusion entry.
+
+**Cosmetic observations for a later pass:** an empty `── Planner · continued ──` header can
+render with no rows beneath it when its events fall outside the viewport; the top status
+line now reads `· done` for a plain completed run (new wording from the status collapse).