bullswarm 0.26.0 → 0.27.1

package/AGENTS.md

@@ -20,37 +20,31 @@ content. Published as `bullswarm` on npm.
 5. Workflow dispatches must honor the same guarantees as single runs:
    `BULLSWARM_DEPTH` is propagated, burst-gated pools are excluded, and
    auth verdicts quarantine the pool + append to the shared decision log
-   (R6/R7/R8 in `src/workflow/runtime.js`).
-6. Adversarial verification is a first-class primitive: a `verify` step
-   reads a prior outFile and demands a JSON `{ok, concerns, summary}`
-   verdict before downstream steps can trust the work (R-skeptic).
-7. Workflows can be built incrementally from the shell
-   (`bullswarm workflow draft create/phase/step/set/...`). Drafts are
-   stored under `~/.bullswarm/drafts/<name>/` and are runnable by name
-   without an upfront JSON. JSON is still the durable artifact — drafts
-   are JSON documents, just built one mutation at a time.
-8. New goal workflows are caller-planned programs in a shared workspace.
+   (R6/R7/R8 in `src/workflow/v2-dispatch.js`).
+6. Adversarial verification is a first-class primitive: an action naming
+   requirements in `evidenceFor` is dispatched under an evidence contract and
+   judges them from the durable artifact, so a requirement is only verified by
+   work someone else inspected (R-skeptic).
+7. New goal workflows are caller-planned programs in a shared workspace.
    `bullswarm workflow goal --program` executes the graph; `--orchestrator`
    explicitly delegates planning. File territories are advisory scheduling
    hints, and the graph finishes without automatic gap rounds. `verified`
    separately records requirement evidence. `--isolation` opts into strict
    per-worker worktrees. Saved V2 runs preserve their original semantics.
+8. Historical authored-graph runs remain visible as read-only `legacy` rows.
+   Their executor was removed in 0.27.0; driving commands fail closed before
+   dispatch and historical run directories remain untouched.
 
 ## Development
 
 ```bash
 npm test            # full suite, no network needed (meters read from cache)
 node bin/bullswarm.js doctor --json   # readiness report
-node bin/bullswarm.js workflow list   # discover workflows
+node bin/bullswarm.js workflow goal "Fix the failing tests" --program plan.json
 node bin/bullswarm.js workflow runs   # ongoing workflow instances
 node bin/bullswarm.js workflow runs --all   # including historical
-node bin/bullswarm.js workflow validate <file>  # dry-run
-BULLSWARM_HOME=/tmp/bs node bin/bullswarm.js workflow run <file>   # sandboxed run
-# Build a workflow from the shell:
-bullswarm workflow draft create my-audit
-bullswarm workflow draft phase add my-audit discover
-bullswarm workflow draft step add my-audit discover list-files --type run --prompt 'List files'
-bullswarm workflow draft run my-audit
+# Validate a caller-authored program before launch:
+bullswarm workflow plan validate "Fix the failing tests" --program plan.json
 # Operate on a run by shortId (6 chars) or full runId (`wf-...`):
 bullswarm workflow runs show <shortId>
 bullswarm workflow runs delete <shortId> --yes

package/CHANGELOG.md

@@ -1,5 +1,183 @@
 # bullswarm changelog
 
+## 0.27.1 — audit cleanup
+
+- Deleted the remaining dead symbols the 2026-09-09 audit listed as Tier A:
+  `recordAgentAction` and `classifyAgentProgress`, `aggregateUsage`,
+  `parseEvidenceOutput`, `fiveHourTier`, `REASONING_DEFAULT_TIERS`, the twelve
+  alias re-exports around `runAutonomousV2` /
+  `assertV2ResumeCompatible` / `validateEvidenceEnvelope`, and
+  `integrationBlock`. `'workflow-v1'` is no longer an assignment source.
+  `currentUsedPct` no longer reads a `weeklyUsedPct` field no producer writes,
+  and the identical `--json` ternary in `strategy-cli` collapsed to one
+  `JSON.stringify`. `fixtures/openrouter/` stays; a new
+  `tests/refresh-openrouter-benchmarks.test.js` runs the refresh script against
+  those fixtures instead of deleting them.
+
+- `state.json` is no longer last-writer-wins (D5). EVERY state writer goes
+  through one locked read-modify-write — take `state.lock`, reload FRESH,
+  mutate, atomically replace the file, release. That is `run`, `pools`,
+  `health` and the fixture migration plus the twenty-two remaining
+  load-mutate-save sites: fifteen in `strategy-cli` (set-rung, set-model,
+  reset-tier, set/reset-reasoning, configure, apply, auto off, assign,
+  clear-assignment, exclude/include-model, set-subscription and the persisted
+  refresh report), three in the strategy TUI, and four in `setup`
+  (`setup --yes`, both writing steps of the wizard, and the reasoning step).
+  `grep -n 'saveState(' src/` now finds only `src/lib/state.js`, which defines
+  it and calls it once, inside `updateState`. Waiters retry for 10 s and a lock
+  older than 30 s is taken over so a killed process cannot bench the file
+  forever. `run --dry-run` no longer refreshes strategy or hits the network
+  (D3). The fixture migration no longer force-disables a pool the operator
+  explicitly enabled (D1). Disabled pools are no longer polled (D6). When every
+  lane-capable pool was dropped by an empty tier allow-list, the routing reason
+  now says so instead of blaming missing capabilities (D7). `pools`, `health`
+  and `run --dry-run` leave `state.json` byte-for-byte alone when they have
+  nothing to change. `src/workflow/fsjson.js` — the re-export shim that carried
+  the workflow importers through the move of the atomic writer into
+  `src/lib/fsjson.js` — is deleted; both layers import `src/lib/fsjson.js`
+  directly.
+
+- The content gate no longer treats an error-shaped JSON object as an answer,
+  and long outputs are scanned at both the head and the tail for failure
+  patterns.
+
+- An unrecognized `--flag` is a usage error on every command: Bullswarm prints
+  `unknown flag --name` plus that command's synopsis and exits 2, before
+  self-initializing, routing, or spawning anything. `--lane` is required on
+  `run` (omitting it, or passing anything else, exits 2). `--limit` on
+  `workflow runs` must be a positive integer. `health --json` now selects the
+  machine-readable report; the default is a human summary of the same facts.
+  Help for `run --no-caller`, the always-JSON verbs, and the plan-contract /
+  plan-validate worker flags matches what the parsers actually accept.
+
+- A dead kernel is visible: `watch`, `runs show`, `runs result --json`, and the
+  TUI surface the last 20 lines of `stderr.log` instead of a silent stall.
+
+- Four small refactors from the audit's C1–C4 list: `TIER_LANES` is derived
+  from the 0.26 kind/effort tables so the strategy preview cannot disagree with
+  the validator; `clearTierAssignment` is the one writer of a cleared tier pin;
+  `finiteOrNull` is the one numeric coercion (blank/null prices and scores stay
+  unmeasured instead of becoming 0); quota signatures live in one table.
+
+- The OpenRouter datapack no longer pretends to have a bundled last-resort
+  file. Loaders try `~/.bullswarm/cache/` then the rolling GitHub Release; a
+  cache miss with no network yields an empty catalog. Epoch still ships
+  `data/epoch-benchmarks.json`.
+
+- Documentation made true: README no longer lists `runs cleanup`; bare
+  `bullswarm` is a TTY wizard and non-TTY callers self-initialize; the
+  OpenRouter/Epoch datapack fallback is described as it actually works; the
+  duplicated planning-targets paragraph appears once; `--name` is an exact
+  goal/name filter; `--classic` is V2-only and legacy watch exits 2;
+  `workflow-v1` is gone from the skill; `workflow goal` is no longer described
+  as an LLM-at-every-checkpoint loop; `delegate` is marked historical in the
+  2026-09-06 design note; GOAL.md and the ten dated `docs/` files that needed
+  a banner carry one.
+
+- Tests: 661 -> 713, 0 failures. Eight new files carry the new behaviour:
+  `unknown-flags` (11 — one bogus flag per parser, the two typed inputs, and a
+  drift guard that re-extracts every documented command form), `cli-run` (6 —
+  the D3/D1/D7 CLI contracts), `config` (5 — D6), `num` (4 — strict
+  `finiteOrNull`), `workflow-dead-kernel` (4), `state-race` (1 — an operator
+  write during a live run), `state-lock-sites` (3 — two real `strategy`
+  processes racing one home, four issued at once, and a `configure` document
+  that throws mid-mutation, writing nothing and freeing the lock) and
+  `refresh-openrouter-benchmarks` (1 — the refresh script against
+  `fixtures/openrouter/`). Existing files lost the
+  cases that only covered deleted symbols (`agent-events` 19 -> 13, and the
+  `fiveHourTier` case in `route`, which kept its
+  `FIVE_HOUR_NEAR_LIMIT_PCT === 75` assertion) and gained coverage for the
+  locked state writers, the fixture-migration rule, and the content gate.
+
+## 0.27.0 — one workflow engine
+
+- Fixed: a worker that floods its stdout could kill the kernel. Every chunk of a
+  worker's stdout and stderr was appended to one string; a command-code worker
+  whose transcript outgrew Node's maximum string length threw
+  `RangeError: Invalid string length` inside the stream handler, the kernel died
+  as an uncaught exception, and every worker it supervised died with it (seen
+  twice on the same action in one day; the trace is in
+  `~/.bullswarm/goals/<runId>/stderr.log`). Streams are now captured through a
+  bounded buffer that keeps the first and last 16 MiB of each stream, counts what
+  it dropped (`captureTruncated` on the attempt observation), and any exception
+  raised while reading a worker now fails that attempt instead of the kernel.
+  Fatal-signature matching already looked only at the last 4,000 characters, so
+  quota and auth detection are unchanged.
+
+- There is now one workflow engine. The authored-graph verbs `workflow run`,
+  `validate`, `list`, `draft`, `inspect` and `approval` are gone — each falls to
+  the workflow-level unknown-verb message, exits 2 and spawns nothing — and with
+  them the eleven V1 modules they drove: `runtime.js` (1,902 lines),
+  `runner.js` (1,304), `draft-cli.js` (434), `validate.js` (366),
+  `decision.js` (357), `tui.js` (297), `draft.js` (268), `result.js` (239),
+  `template.js` (146), `schema.js` (81) and `semaphore.js` (56). The V1 panel
+  model, timeline and orchestrator-detail twins came out of `dashboard.js`
+  (−965), the V1 branches out of `cli.js` (−291), `runs-cli.js` (−141),
+  `short-id.js` (−127) and `watch-cli.js` (−132). `src/workflow/*.js` goes from
+  16,941 lines to 10,257. Also deleted: the five saved definitions
+  `workflows/adaptive-code-review.json`, `agent-model-comparison.json`,
+  `connector-audit.json`, `smoke-two-step.json` and `verify-and-cap.json`
+  (257 lines) together with the `workflows/` entry in package.json `files`;
+  `scripts/sanity-multi-claude.mjs` (131), which only exercised `runWorkflow`;
+  and two more tools that could only reach deleted modules —
+  `bin/check-output-schema.js` (30, the V1 `outputSchema` worker preflight) and
+  `scripts/planner-contract-probe.mjs` (175, a probe for the V1 `decide`
+  planner). `workflow capabilities` now reports `engines.authoredGraphs` as
+  `{ retired: '0.27.0', command: null }` instead of advertising a verb that
+  exits 2. `bullswarm workflow --help` describes one engine.
+
+- `newRunId` moved from `runner.js` into `src/workflow/short-id.js`, same
+  behaviour, exported; `v2-runtime.js` imports it from there.
+
+- Removed the last V1 remnants that no gate caught because they named no
+  deleted symbol: the dead authored-graph planner prompt in
+  `src/workflow/goal.js` (`AUTONOMOUS_ORCHESTRATOR_PROMPT`,
+  `PLANNER_RULES_SECTION`, `PLANNER_EXAMPLES_SECTION` — 36 lines whose only
+  consumer was the deleted `runtime.js`, and which still taught `type`,
+  `stepTemplate`, `itemsFrom`, `outputSchema`, `covers` and `completion.when`
+  to a planner the V2 validator would reject), and the permanently-zero
+  `fanout: { total, ok, failed }` counter that `dashboard.js` still put on every
+  row and rendered behind an unreachable branch. `outputSchema`, `itemsFrom` and
+  `stepTemplate` now appear nowhere in `src/`. The `skill/references/operations.md`
+  "Adversarial verification" section described the removed `{ok, concerns,
+  summary}` verify verdict; it now documents the `bullswarm.workflow.evidence.v2`
+  envelope the kernel actually enforces. `AGENTS.md` doctrine item 5 pointed at
+  the deleted `runtime.js` and now points at `v2-dispatch.js`.
+
+- Historical authored-graph runs stay readable, read-only, and nothing tries to
+  drive them. A run directory whose `state.json` lacks
+  `schemaVersion: 'bullswarm.workflow.state.v2'` is a legacy run: `workflow runs`
+  (with `--all` and `--json`) lists it as one row — short id, run id, name or
+  goal, status, age — marked `legacy`, reading only those five fields and never
+  throwing on a missing one, and the workflow home lists the same row. Every
+  driving command — `runs show`, `runs result`, `watch`, `cancel`, `resume`,
+  `steer`, `action show`, `tui <runId>` — prints exactly one line, `legacy
+  authored-graph run <shortId>: its executor was removed in 0.27.0; files remain
+  under <dir>`, and exits 2 before touching anything — including on the older
+  directories that hold only a `workflow.json` and never had a `state.json` at
+  all; the workflow home shows
+  that same line in its detail pane. `events <runId>` still replays the durable
+  JSONL and `runs delete <id> --yes` still removes the directory. Historical
+  directories are never modified. The stale-owner reconciliation that used to
+  run before every dispatch is gone with the V1 liveness model it served.
+
+- Tests: 818 -> 661. Six V1-only files were deleted
+  (`workflow-adaptive`, `workflow-gaps`, `workflow-draft`, `workflow-schema`,
+  `workflow-validate`, `workflow-run` — 151 tests); `workflow-runs`,
+  `workflow-watch`, `assignments`, `workflow-interruption`, `workflow-steering`
+  and `workflow-goal` were rewritten onto the V2 kernel keeping every assertion
+  about shared behaviour; `workflow-dashboard` went from 48 cases to 35 — 21
+  V1-only cases removed and 2 added with the rewrite, then 6 re-added against V2
+  fixtures for the rendering behaviours the removal had dropped (blocked-action
+  naming, one segment header per phase or dependency level, the mid-segment
+  continuation header, parallel levels grouped in declared order, the narrow
+  layout, and auto-follow); and a new `workflow-legacy-runs` (11 tests) proves
+  the legacy contract against a synthetic legacy `state.json`.
+  `tests/manual-dynamic-real.mjs` (330 lines), a
+  manual real-provider matrix for authored `run`/`decide` graphs, went with the
+  executor; it was never part of the suite count. No test dispatches a real
+  provider.
+
 ## 0.26.0 — two entry points, kinds and rungs
 
 - There are now exactly two ways to start work, and `bullswarm delegate` is

package/GOAL.md

@@ -1,6 +1,8 @@
 # bullswarm — Goal Statement
 
-**Status:** PROTOTYPE · **Owner:** cowcow02 · **Created:** 2026-08-21
+> Historical (2026-08-21): accurate when written; see CHANGELOG for what changed since.
+
+**Status:** HISTORICAL PROTOTYPE CHARTER · **Owner:** cowcow02 · **Created:** 2026-08-21
 
 ## One sentence
 

package/README.md

@@ -30,8 +30,8 @@ without initializing state or executing the command:
 
 ```bash
 bullswarm --help
-bullswarm workflow run --help
-bullswarm workflow draft step add --help
+bullswarm workflow goal --help
+bullswarm workflow runs show --help
 ```
 
 `workflow goal` launches a durable background runner, prints operating commands,
@@ -88,7 +88,7 @@ re-delegating and creating recursive swarms.
 ## Quick start
 
 ```bash
-bullswarm          # first run: interactive setup wizard
+bullswarm          # first run: interactive setup wizard on a TTY; non-TTY callers self-initialize
 bullswarm setup    # interactive provider/model configuration
 bullswarm setup --wizard  # broader worktree + integration questionnaire
 bullswarm pools    # meter state, pace position, quarantine status
@@ -98,7 +98,7 @@ bullswarm run --lane analyze --add-dir ~/some-repo --prompt "Inspect the parser"
 bullswarm workflow plan contract "Fix the failing tests and verify the change" --cwd ~/some-repo --json  # you are the planner
 bullswarm workflow goal "Fix the failing tests and verify the change" --cwd ~/some-repo --program plan.json
 bullswarm workflow goal "Fix the failing tests and verify the change" --cwd ~/some-repo --orchestrator auto  # dispatch a planner agent
-bullswarm health   # re-judge saved outputs; catch gate failures
+bullswarm health --json   # re-judge saved outputs; catch gate failures (omit --json for a human summary)
 ```
 
 ## Verbs
@@ -112,19 +112,11 @@ bullswarm health   # re-judge saved outputs; catch gate failures
 | `pools` | Show each pool's meter state, pace position, 5-hour utilization (`5h=<n>%`, flagged `NEAR-5H-LIMIT` at or above 75%), quarantine status |
 | `strategy` | Interactive provider/model control center with live high/medium/low route previews and an agent-facing JSON API |
 | `doctor` | Machine-readable readiness report; self-heals on first call |
-| `workflow` | Start an autonomous goal, or run / validate / draft / inspect explicit workflows and their live instances. |
-| `runs` | Short alias for `workflow runs`, including list, show, result, delete, and cleanup operations. |
+| `workflow` | Plan, execute, observe, and operate one autonomous workflow engine and its live instances. |
+| `runs` | Short alias for `workflow runs`, including list, show, result, and delete operations. |
 | `version` / `--version` | Print the installed Bullswarm version. |
 | `release` | Run the guarded local version-bump, commit, and tag workflow used before CI publishes to npm. |
 
-Discover and validate workflow definitions without executing them:
-
-```bash
-bullswarm workflow list
-bullswarm workflow list --json
-bullswarm workflow validate workflows/my-workflow.json
-```
-
 `workflow goal --request <path>` and `--run-id <id>` are internal detached-runner
 resume plumbing. Normal callers should provide a goal or use `--resume <shortId|runId>`.
 
@@ -141,7 +133,7 @@ bullswarm strategy routes --json           # compact effective choices
 bullswarm strategy set-provider codex off --yes
 bullswarm strategy set-model opencode2 kaihk/gpt-5.6-luna \
   --tiers high,medium,low --yes
-bullswarm strategy configure --file strategy.json --yes  # atomic agent-authored policy
+bullswarm strategy configure --file strategy.json --yes  # atomic agent-created policy
 bullswarm strategy reset-tier low --yes     # restore one tier to automatic
 bullswarm strategy set-reasoning --tier high --level xhigh --yes
 bullswarm strategy set-reasoning --tier high --level high --pool codex --yes
@@ -202,8 +194,8 @@ any routing change. Press `Y` to apply them or `N` to retain the current policy.
 The analysis selects at most one default model for each provider and effort
 tier. It uses OpenRouter's agentic, coding, and intelligence indices as quality
 signals and API-equivalent pricing as the budget signal. A repository-owned
-GitHub Actions job (`.github/workflows/refresh-benchmarks.yml`) refreshes two
-public assets on the rolling `benchmark-data-latest` GitHub Release:
+benchmark refresh job refreshes two public assets on the rolling
+`benchmark-data-latest` GitHub Release:
 `openrouter-benchmarks.json` from the authenticated OpenRouter APIs, and
 `epoch-benchmarks.json` from Epoch AI's CC BY 4.0 benchmark export, which is
 what `strategy rungs` reads for per-model-per-reasoning-level evidence.
@@ -211,9 +203,12 @@ Installed CLIs download only those public files and never need or receive an
 OpenRouter key.
 The sources are OpenRouter's [benchmarks API](https://openrouter.ai/docs/api/api-reference/benchmarks/list-benchmarks)
 and [models API](https://openrouter.ai/docs/api/api-reference/models/list-all-models-and-their-properties).
-The CLI caches the datapack under `~/.bullswarm/cache/`; network failure falls
-back to a stale or bundled datapack, then connector metadata, without blocking
-setup.
+The CLI caches each datapack under `~/.bullswarm/cache/`. OpenRouter is
+cache-or-network only: a fresh cache is used as-is, otherwise the rolling
+release is fetched, and a cache miss with no network yields an empty catalog
+plus connector metadata — there is no bundled `data/openrouter-benchmarks.json`.
+Epoch keeps `data/epoch-benchmarks.json` as a bundled last-resort, so a missing
+network never blocks setup when that file exists.
 
 The TUI lists every detected provider/account separately so its toggle matches
 its own quota meter. Enter drills into that provider's detected models. In the
@@ -321,7 +316,7 @@ phase/step/attempt tree.
 
 ## One-command autonomous goals
 
-For normal multi-step work, give Bullswarm the goal and the program you authored
+For normal multi-step work, give Bullswarm the goal and the program you author
 for it—not a JSON graph of phases:
 
 ```bash
@@ -351,7 +346,9 @@ caller asks for it by name.
 planning targets. They encourage the Workflow Planner to consolidate optional
 work, but the kernel never stops or rejects essential work merely because a
 target was reached. `--concurrency` still bounds simultaneous dispatches so
-the scheduler can batch a wider useful program safely.
+the scheduler can batch a wider useful program safely. There is no default
+wall-clock timeout: fresh semantic/transport heartbeats allow a useful worker
+to continue, while silence is inspected rather than blindly killed.
 
 The caller authors a complete program, or explicitly asks for a dispatched
 planner. The kernel validates the graph, executes it, and returns every action
@@ -433,9 +430,7 @@ The planner does not author phases or declare success/failure. The kernel
 derives stable presentation stages for the TUI and computes the final V2
 result. Saved V2 runs retain their original execution and workspace policy on
 resume. V1 autonomous run directories are not migrated or resumed;
-explicitly naming one fails before any paid dispatch. Fixed JSON workflows and
-drafts remain a separate authored-graph feature with their existing step
-types.
+explicitly naming one fails before any paid dispatch.
 
 The detached response includes a short ID and exact observation commands:
 
@@ -512,12 +507,6 @@ per provider — the first as the primary `opencode2` pool, each additional one
 as its own `opencode2:<id>` pool — which is what the `--worker-model
 kaihk/gpt-5.6-luna` example above locks onto.
 
-`--max-agents`, `--max-actions`, and `--max-expansion-rounds` are soft V2
-planning targets: they guide the planner toward a small program but do not
-hard-stop useful work. `--concurrency` is the actual bound on simultaneous
-dependency-ready dispatches. There is no default wall-clock timeout: fresh
-semantic/transport heartbeats allow a useful worker to continue, while silence
-is inspected rather than blindly killed.
 New goal runs use the shared workspace regardless of the older setup
 worktree-isolation preference. Add `--isolation` to `workflow goal` when you
 explicitly want per-worker worktrees and strict ownership before integration.
@@ -570,33 +559,6 @@ runs still support their original gap boundaries and `--exhausted` submissions.
 the caller plans against a real survey; scout units are advisory for a caller
 planner.
 
-Use an explicit draft when the graph itself is a durable contract and should
-not be planner-defined. `bullswarm workflow draft ...` lets you assemble it one
-mutation at a time. No upfront JSON required. Drafts persist under
-`~/.bullswarm/drafts/<name>/` and become first-class workflows
-(discoverable, runnable by name) the moment they exist.
-
-```bash
-bullswarm workflow draft create audit-code \
-    --description "Audit the source code" --input targetDir=.
-bullswarm workflow draft phase add audit-code discover
-bullswarm workflow draft phase add audit-code review
-bullswarm workflow draft step add audit-code discover list-files \
-    --type run --lane chore --prompt "List every .js file in src/" \
-    --add-dir '{{inputs.targetDir}}'
-bullswarm workflow draft step add audit-code review per-file \
-    --type fanout --items-from 'outputs.list-files.outFile' \
-    --lane analyze --concurrency 2 \
-    --step-template '{"lane":"analyze","addDir":"{{inputs.targetDir}}","prompt":"Review {{item}}"}'
-bullswarm workflow draft show audit-code    # inspect the JSON
-bullswarm workflow draft run audit-code     # execute it
-bullswarm workflow draft export audit-code workflows/audit-code.json   # promote to file
-```
-
-`step add` re-validates after every mutation; partial drafts (zero
-phases, etc.) are treated as building, not invalid. `set` and
-`step set` patch fields in place. `delete` requires `--yes`.
-
 ## Operating on workflow runs
 
 Every run gets a 6-character shortId (Crockford-style alphabet,
@@ -606,7 +568,7 @@ no `0/1/i/l/o`). The full `wf-...` runId stays the durable handle.
 bullswarm workflow runs                    # ongoing only (default)
 bullswarm workflow runs --all              # ongoing + historical
 bullswarm workflow runs --historical       # only historical
-bullswarm workflow runs --name audit-code  # filter by workflow
+bullswarm workflow runs --name audit-code  # filter by exact goal/name
 bullswarm workflow runs --all --since 7d   # initiated in the last 7 days
 bullswarm workflow runs --historical --since yesterday --until today
 bullswarm workflow runs --all --from 2026-08-20 --to 2026-08-27
@@ -615,11 +577,13 @@ bullswarm workflow runs show <shortId>     # state + report + summary
 bullswarm workflow runs result <shortId> --json  # stable result for the calling agent
 bullswarm runs show <shortId>              # top-level shorthand
 bullswarm workflow runs delete <shortId> --yes    # remove the run dir
-
-# Resume by shortId — runs the same logic as the full runId
-bullswarm workflow run audit-code --resume <shortId>
 ```
 
+Legacy authored-graph runs are listed as read-only rows marked `legacy`. Every
+driving command prints `legacy authored-graph run <shortId>: its executor was
+removed in 0.27.0; files remain under <dir>` and exits 2; historical directories
+are untouched.
+
 Run-history time filters always compare when the workflow was initiated
 (`startedAt`), never when it finished. `--since` is inclusive and `--until` is
 exclusive; `--started-after`/`--from` and `--started-before`/`--to` are aliases.
@@ -635,8 +599,7 @@ usage, and verification qualification. New programs include `executionMode:
 "program"` and a `workspace` report with `changedFiles`, `baselineChangedFiles`,
 and warnings. This is a Git status inventory, not attribution to individual
 workers; files stay in the target directory. A completed program may be
-unverified and contain negative evidence. Fixed authored workflows retain their existing
-result envelope. `runs show` remains the low-level debugging surface.
+unverified and contain negative evidence. `runs show` remains the low-level debugging surface.
 Goal launch output includes an `instructions` handoff with four named paths:
 `agentInspect` for a machine-readable snapshot, `watch` for low-noise progress,
 `humanTui` for the interactive browser, and `result` for the terminal delivery.
@@ -661,10 +624,9 @@ periodic heartbeat is off unless you pass `--heartbeat <seconds>`;
 `--stall-after <seconds>` (default 300) reports a running agent that has
 gone silent. Pass `--classic` to force the older heartbeat-based watcher
 instead (the transition-on-change snapshot stream plus a periodic
-heartbeat, every 60 seconds unless `--heartbeat <seconds>` is given) —
-legacy (non-V2) runs already behave this way and `--classic` is a no-op for
-them; `--classic` cannot combine with `--next`, which exists only for event
-mode. `--next` prints no attach line and
+heartbeat, every 60 seconds unless `--heartbeat <seconds>` is given).
+`--classic` applies only to V2 runs and cannot combine with `--next`, which
+exists only for event mode. `--next` prints no attach line and
 exits after the first notable event so a background terminal can wake the
 caller; relaunch until the outcome line reports a pause or a terminal
 status (exit 0 while the run continues or delivered, 1 when it ended
@@ -684,9 +646,9 @@ prints). `--jsonl` emits one JSON object per notable event with a stable
 `interrupted`, and with `--verbose` `action.started`, `attempt.retrying`,
 `steering.delivered`); in that mode the relaunch line is not printed and
 every object instead carries the `sequence` it was emitted at, which is the
-value to pass as `--after`. `--once` still prints one current snapshot. Legacy
-(non-V2) runs keep the compact transition-plus-heartbeat stream unchanged,
-the same stream `--classic` opts a V2 run into.
+value to pass as `--after`. `--once` still prints one current snapshot. A legacy
+(pre-0.27.0 authored-graph) run cannot be watched at all: the watcher prints
+the legacy line and exits 2 before it polls anything.
 
 ```bash
 bullswarm workflow watch <shortId>
@@ -736,16 +698,14 @@ bullswarm workflow tui --json --all           # ongoing + historical runs
 bullswarm workflow tui --json <shortId>       # inspect one run
 bullswarm workflow tui --json --cancel <id>   # request cooperative stop
 bullswarm workflow capabilities --json       # pools, lanes, models, meters, limits
-bullswarm workflow inspect <file-or-name>     # workflow shape and semantics
 bullswarm workflow events --json <id> --after 20
 bullswarm workflow steer <id> --message "Prefer focused tests before another full suite"
 bullswarm workflow action show --json <id> <actionId>
-bullswarm workflow approval approve --json <id>  # then resume the run
 ```
 
 Cancellation stops active delegates and commits `cancelled`. V2 goal workflows
 keep the operator request in a separate durable file so kernel progress cannot
-overwrite it; authored V1 graphs additionally expose a `cancelling` state.
+overwrite it.
 `SIGTERM` and `SIGINT` stop delegate process groups and commit a resumable
 `interrupted` state. A V2 resume holds an exclusive kernel lease, stops recorded
 surviving delegates from the previous kernel, and finishes post-processing from
@@ -817,71 +777,6 @@ runtime value and uses its matching connector rate metadata for the attempt's
 cost estimate. Unknown or provider-hidden model identity remains explicitly
 unknown.
 
-### Authored adaptive graphs
-
-This is part of the separately authored fixed-graph engine, not the autonomous
-V2 `workflow goal` path. A graph may add an explicit `decide` step, advisory
-resource targets, and structural expansion limits:
-
-```json
-{
-  "mode": "adaptive",
-  "settings": {
-    "maxAgents": 12,
-    "maxExpansionRounds": 3,
-    "maxActions": 20,
-    "maxItemsPerExpansion": 8,
-    "maxWorkflowSeconds": 1800
-  },
-  "phases": [{
-    "name": "review",
-    "steps": [
-      { "id": "initial", "type": "run", "prompt": "Inspect the code." },
-      {
-        "id": "planner",
-        "type": "decide",
-        "requiresCapabilities": ["workflow-planning", "strong-analysis"],
-        "prompt": "Judge sufficiency and propose only bounded missing work."
-      }
-    ]
-  }]
-}
-```
-
-For an authored adaptive graph, `maxAgents`, `maxWorkflowSeconds`, and
-`maxExpansionRounds` are advisory inputs to its decide step. Approaching them
-strongly biases that step toward
-consolidating existing artifacts and returning the best useful outcome;
-crossing them is recorded but never stops a worker, skips verification, or
-fails a run. `maxActions` and `maxItemsPerExpansion` remain hard structural
-safeguards. Reaching one returns a qualified outcome when useful work exists,
-rather than discarding the run as a blanket failure. Delegates have no
-implicit wall-clock timeout; set a step's `timeoutSec` (or direct-run
-`--timeout`) only when an operator explicitly wants a hard termination timer.
-
-Within this authored-graph engine, `complete` remains strictly verified. A
-decide-step `stop` still
-delivers a completed outcome when a useful delivery exists: unresolved
-verification concerns and the stopping reason ride along as `outcome.concerns`
-and `outcome.reason`, attributes of that completed outcome rather than a
-separate terminal status. `stop` produces `blocked` only when no useful
-delivery exists. `workflow runs result` treats the completed outcome as ready
-while reporting `verified:false`. The status value `completed_with_concerns`
-still appears on some runs — including legacy ones recorded before this
-framing — and every consumer reads it exactly like `completed`: a delivered
-result with concerns to review, never a failure.
-
-The planner returns versioned JSON. It may propose `needs_more_work` with
-bounded `run`, inline-`fanout`, or `verify` actions. The deterministic runtime
-validates IDs, dependencies, operation types, capabilities, and budgets before
-appending anything. It executes ready actions, observes their durable results,
-and calls the planner again. `events.jsonl`, `state.json`, the TUI, and JSON
-inspection expose the same plan, actions, attempts, decisions, budgets, and
-artifacts. See `workflows/adaptive-code-review.json` for a complete example.
-Planner actions cannot set `pool`, `model`, `addDir`, or `taskFile`. If those need to be
-fixed by the initiator, declare them under the `decide` step's `actionDefaults`;
-otherwise eligible capable pools are ranked by live quota surplus.
-
 ## The verdict
 
 ```json

package/data/README.md

@@ -7,9 +7,14 @@ secrets and are never written here or shipped with the CLI.
 Both datapacks are published as replaceable assets on the
 `benchmark-data-latest` GitHub Release by
 `.github/workflows/refresh-benchmarks.yml`. Installed CLIs try
-`~/.bullswarm/cache/` first, then the copy bundled in this directory, then
-that release URL. A missing network never blocks setup when a bundled file
-exists.
+`~/.bullswarm/cache/` first, then that release URL.
+
+OpenRouter is cache-or-network only: there is no bundled
+`data/openrouter-benchmarks.json`. A cache miss with no network yields an
+empty catalog (and connector metadata), and never blocks setup.
+
+Epoch keeps `data/epoch-benchmarks.json` as a bundled last-resort, so a
+missing network never blocks setup when that file exists.
 
 ## `openrouter-benchmarks.json`