bullswarm 0.35.1 → 0.35.3

package/CHANGELOG.md

@@ -1,5 +1,215 @@
 # bullswarm changelog
 
+## 0.35.3 — whole right edges in Ghostty and herdr, Enter opens the row you are on, named phases
+
+- dashboard: every row is erased before it is painted instead of after, so a
+  row that fills the terminal keeps its last cell in Ghostty and herdr (both
+  cleared it, turning `50%` into `50` and `16` into `1` on Home's right edge).
+- home: from 110 columns the spent-per-day chart grows to the height of the
+  stacked breakdowns beside it; the summary band sizes `Spent` to its text and
+  wraps at ` · ` rather than cutting a figure; the closing sentence wraps too.
+- runs: Enter and a click open exactly the row the cursor is on. Tasks recorded
+  before the task ledger have no id, and all of them shared one empty key, so
+  Enter on a workflow row could open one of those tasks instead.
+- run: phase rules name the phase: `Phase 2 · Build · time-box · docs`
+  (Build, Integrate, Verify, Digest, Design, Repair from the steps' kinds,
+  joined with ` + ` when a phase mixes them); the phase number and name are
+  never cut, step names shorten first.
+- home: day keys no longer build an `Intl.DateTimeFormat` per call to learn
+  the zone (it is cached against `TZ`); a Home paint takes about 40% less time.
+
+## 0.35.2 — the Step page reads like a transcript; prices without a command, honest totals, a home that stops growing
+
+- step: detail is now a scrollable transcript of every turn in order: the full
+  response followed by one row per command or tool call; opening a turn or
+  tool row still reaches every captured event field, argument, result and exit.
+- step: overview opens on the latest ten turns on desktop and five on phones,
+  newest at the bottom, with one `turns 1–N · … · click for detail` line for
+  earlier work; a followed live window slides until the reader moves it.
+- step: `overview · detail` sits in the activity heading, right after the
+  heading word, each word a click target; `v`, the footer and Help name the
+  same views, and standalone tasks use the same page.
+- step: clicking a turn head toggles it exactly like Enter, and hover lights
+  only the turn's text rather than its padding or desktop side column.
+- run: each timeline attempt row opens Step on that exact attempt; step and
+  phase rows that name no attempt continue to open the latest one.
+- grok: `tool_call_update` captures merge into the `tool_call` with the same id,
+  so a call has one named row and one count instead of extra nameless `agent`
+  rows, while every update remains reachable from transcript detail.
+- providers: every shipped connector declares `eventStream.toolKinds`, mapping
+  its tool vocabulary to command, read, search, edit or other; the Step model
+  contains no provider-specific tool-name table.
+- design: the Step v2 record adds transcript, latest-turn-window and toggle
+  rules with before/after frames at 55 and 200 columns; committed real text and
+  colour frames are regenerated from scrubbed fixtures.
+- mod: the Claude Code Step pane draws the same v2 header, turns, result, task,
+  cost, phone order, colours, transcript toggle and latest-turn window from
+  `action show --json`, for workflow steps and standalone tasks alike.
+- mod: Usage opens with `u` or a click even with no workflow running, and back
+  returns to idle; validated temporary chunks carry large Step records within
+  hook limits and are removed immediately.
+- reprice: an incremental reconciler prices every terminal attempt that is
+  still unknown or a bytes/4 estimate, with no user command. The kernel prices
+  its own run at quiet boundaries and before the result and rollup are
+  written; a single `bullswarm run` whose usage is unmeasured starts a detached
+  pass 30 s after it ends (only when the pool's provider keeps transcripts);
+  the dashboard starts one detached, throttled pass (one per 5 minutes, one at
+  a time) after its first paint and says `pricing N older records…` while it
+  runs. A per-attempt ledger in `pricing/reconcile.json` retries recent
+  attempts after 1 and 10 minutes, gives older ones one try, and reopens an
+  attempt only when a new or grown transcript covers its window, so a second
+  pass does nothing. The automatic pass never makes an attempt worse: no match
+  or an ambiguous match leaves it as it was. `workflow reprice` stays the
+  manual full backfill and gains `--incremental` (with `--trigger`,
+  `--transcript-home`, `--delay-ms`). On a copy of a real home the first pass
+  priced 165 of 281 eligible attempts; the second took milliseconds and wrote
+  nothing.
+- transcripts: Codex and Claude matching tries the session id, then the task
+  text (the task-file path or exact text in the first user message), then cwd
+  + time window; more than one candidate stays unknown, and the cwd/time step
+  skips transcripts that quote a different task file. On the same copy the
+  formerly ambiguous attempts resolved by task text: codex 100, claude-code 19,
+  claude-code:acme 14. Indexes store prompt paths and hashes, never the text.
+  Single tasks are priced too; a task's window now ends at its `endedAt`.
+- capture: each attempt records an immutable `capture` block when its worker
+  exits — provider session id and its source, model, exclusive token classes,
+  provider-reported cost, exit code and signal — before the end meter read and
+  the transcript lookup, and persists it at once. Later pricing may upgrade an
+  estimate but never downgrades provider-reported usage. Planner and scout
+  attempts are captured too.
+- grok: the final `end` event is decoded (session id, token classes, cost),
+  proven on a real grok 1.0.13 stream checked in scrubbed as
+  `tests/fixtures/stream/grok-capture.jsonl`; `"rate limit"` is no longer a
+  grok auth signature, so a grok 429 is a throttle, not a 10-minute auth pause.
+- command-code: launched without `--no-session`, so its session transcript
+  exists afterwards and the reader matches it by session id.
+- money: every money total on Home, Runs, Run, Stats and Budget that includes
+  unmeasured attempts reads `at least $X · N unmeasured`; a scope with no
+  recorded amount reads `api unknown`. Budget prints a `spent …` line per pool,
+  and the Stats hover, axis and coverage note use the same words. One month
+  length, `DAYS_PER_MONTH = 30.4375` (365.25/12), is used everywhere.
+- home: the window-share cell shows the measured share from
+  `calibration/<pool>.json` (`5.0% measured`) when samples attribute a window
+  drop to today's runs, the labelled pace estimate only when none do, and a
+  dash otherwise. The recent list shows finished runs only — a reopened run
+  leaves it — and each row's mark is the Run page header's mark; a
+  non-terminal run's index row no longer carries a finish time.
+- retention: `state.json.retention` `{ "enabled": true, "workspacesDays": 7 }`
+  removes the `workspaces/` copies inside terminal runs older than the limit,
+  in a detached background sweep started by the kernel, watch completion and
+  the dashboard (at most every 6 hours, one at a time, only when a run holds a
+  workspace copy). Records, reports, streams, task/out markdown, interrupted
+  runs and any leased run are never touched. `bullswarm home prune
+  [--dry-run|--yes] [--days n]` lists or removes the same set with bytes, and
+  `bullswarm home status` shows the policy, bytes on disk and the last prune
+  and reprice results.
+- pauses: a limit notice pauses a pool for quota only on proof — the pool's
+  own meter at 95% or more on a running window, or a provider line that says a
+  usage window is spent and names its reset. Everything else, such as
+  `Rate limit exceeded. Please wait a moment and try again.`, is a transient
+  throttle: the same pool is retried after 20 s and 60 s (or the wait it
+  named), then the attempt moves on, and the pool is never paused. `pools`
+  prints `PAUSED until <time> · <proof> · provider: "<line>" · meter then: … ·
+  lift now: bullswarm pools resume <pool>`; `bullswarm pools resume <pool>`
+  lifts a pause, and `bullswarm strategy set-pausing off|on` turns automatic
+  pausing off or back on.
+- pauses: `bullswarm strategy set-pausing off` now stops every automatic
+  pause, not only quota — auth, the credential-group siblings an auth pause
+  benches with it, and the soft bench a second strike writes — so with the
+  switch off nothing is taken out of service by a command's own judgement;
+  routing still reads meters and a failed attempt still moves to another pool.
+  It is stored as `strategy.pausing: "off"`. `pools` opens with `automatic
+  pausing: off`, and `pools resume` still lifts a pause that was already in
+  place. Quota and auth signatures are matched against the provider's own
+  error channel only — its stderr, the events it flags as errors and its
+  terminal `result` record — never an assistant's reply or a tool result: on
+  2026-09-21 a pool was paused for a sentence an agent wrote about
+  `usage_credits_required` in its own report.
+- routing: an evidence step may run on the pool that wrote the judged work
+  when that pool is urgent; the reason then says `independence waived: <pool>
+  resets in <clock>`. Independence is judged by model family, so
+  `claude-code` and `claude-code:acme` are the same writer; with nothing
+  urgent, independence stays the tie-breaker.
+- watch: `bullswarm workflow watch <run> --until outcome|trouble` prints only
+  trouble lines (failed, rejected, paused, stalled, stale, steering) and the
+  outcome; `trouble` exits at the first one with a `next:` relaunch line. A
+  running attempt gets a stale score (quiet with no command running, no file
+  change while commands continue, the same command repeated, wall time over 3×
+  the expected minutes) and one `⚠ <step> looks stale: <reasons>` line.
+  `bullswarm workflow step restart <run> <step> [--pool <pool>]` stops that
+  attempt and requeues the step with its durable handoff; nothing restarts on
+  its own. The packaged skill teaches one background `--until trouble` watch
+  per run and one tool call per wake.
+- providers: OpenCode and Command Code expose the same durable-transcript
+  reader contract as the first-class providers. OpenCode reads its SQLite
+  sessions read-only; Command Code reads persisted project JSONL only when a
+  session transcript exists and carries usage.
+- reprice: transcript lookup follows the loaded provider registry, so
+  `opencode2*`, `opencode2:kaihk-*`, and `command-code` pools reach their
+  provider-owned readers without a hard-coded provider list. Ambiguous,
+  missing, and checkpoint-only records stay unknown rather than becoming
+  zero-cost attempts.
+- command-code: the 116 historical attempts studied for this release used
+  `--no-session`, so their checkpoints are documented as non-recoverable
+  history.
+- pricing: public model cards are retained only with a source and date (the
+  cards were checked 2026-09-20). `kaihk/*` and `opencode/union-alpha` relay
+  identifiers have no public card, so the underlying OpenAI card is not
+  substituted; observed Command Code models use the cited Command Code card.
+- evidence: live OpenCode and Command Code streams captured on 2026-09-20 are
+  checked in as `tests/fixtures/streams/opencode-hello.jsonl` and
+  `tests/fixtures/streams/command-code-hello.jsonl`; each contrib connector
+  claims the `eventStream.usage` rules those captures prove.
+- tests: detached reprice and prune children never recreate a home that was
+  deleted under them, and the OpenCode read-only test runs everywhere against
+  the exported rows instead of skipping without a local database.
+- time box: every work and evidence step's task ends with a soft time box: the
+  box in minutes, the start clock, a wrap-up point at 70% of the box, and an
+  invitation to stop and report `## Done`, `## Not done` and `## Suggested next
+  step`. The box is the action's `timeBox` (whole minutes, 0-240), else
+  `defaults.timeBox`, else 1.5 × the median wall minutes of this home's
+  succeeded attempts for the pool and kind (5 or more attempts), else for the
+  kind, else 20, rounded to 5 and kept within 10-60; `opencode` attempts never
+  feed it, and `timeBox: 0` leaves the paragraph out. It is a guide: timeouts,
+  stall detection, cancellation and routing are unchanged and nothing stops at
+  the box. On the fixture home the (codex, implement) pair has a median of
+  18.86 minutes over 80 attempts, so its box is 30. In an experiment on one
+  task (two runs per arm) a 15-minute box ran 10m54s and 10m03s against 23m30s
+  and 48m44s without one, with honest partial reports: a direction, not a
+  measurement.
+- early return: a work step whose `## Not done` lists items still succeeds and
+  records `returnedEarly` with the count and the items. The Step page header and
+  the Run timeline row read `returned early · N not done`, the Step page shows
+  `box 20m · ran 34m` when an attempt ran past its box, `workflow watch` prints
+  `◐ <step> returned early · N not done`, and the items reach the verifiers with
+  the rest of the evidence.
+- verify rounds: a failed verify no longer waits for the caller. The kernel runs
+  a bounded repair loop of at most 3 verify rounds (`defaults.verifyRounds`
+  1-3, default 3, 1 = the old single round): round 1 judges every requirement,
+  each failure starts a kernel `repair-<n>` step built from the verifier's
+  evidence, the not-done items and the handoffs of the steps that affect it,
+  round 2 re-checks the failures and looks for regressions and the same defect
+  elsewhere, and round 3 is final closure. A requirement that passed carries
+  forward and is judged again only when a repair changed a file its evidence
+  names. There is never a fourth round and a program still cannot declare a
+  repair step; the planner contract allows `timeBox` and says the kernel adds
+  `repair-<n>` and `verify-round-<n>`.
+- verify rounds: the run ends `completed · verified`, or `completed · not
+  verified · verify rounds 3/3` with a caller-decision block (each requirement
+  still failing, its latest evidence and one suggested next step) in
+  `workflow runs result <run> --json --summary`. The result also lists each
+  verify round and each repair with its wall minutes, pool and cost. The Run
+  page, Home, Runs and `workflow watch` show each round and repair; the events
+  are `workflow.verify-round` and `workflow.repair`. A plan revision during the
+  loop is still accepted and never adds or refunds a round; its
+  `defaults.verifyRounds` sets the cap for the rest of the run, and a revision
+  that changes only the cap is accepted.
+- docs: the skill, its operations and program references, the program and result
+  references and `docs/design/step-economy-0.35.2/README.md` teach `timeBox`,
+  `verifyRounds`, the early-return report and the caller-decision block; the
+  skill's "Observe and judge" no longer tells the caller to hand-add a fix step
+  for an ordinary failed check.
+
 ## 0.35.1 — a calmer dashboard with honest active time
 
 - durations: Home, Runs, Run, Step, and Stats use the union-based
@@ -178,7 +388,7 @@
   colour codes, so every bar came out grey while the legend beside it stayed
   coloured — a chart titled "by pool" painted all five pools identically.
 - stats: no two series in one chart share a hue. Colours were hashed per name,
-  which put `claude-code:wati` and `codex` on the same blue.
+  which put `claude-code:acme` and `codex` on the same blue.
 
 ## 0.33.1 — say what a number is, or say you do not know
 
@@ -307,8 +517,8 @@
   price exactly as it spends a declared one and labels which it is —
   `detected` or `declared` — so an operator's own figure is never confused with
   one bullswarm inferred. The plan table is keyed by provider, not by pool, so a
-  discovered per-account pool such as `claude-code:wati` resolves against
-  `claude-code`'s plans; it used to ask for `claude-code:wati`'s own plans and
+  discovered per-account pool such as `claude-code:acme` resolves against
+  `claude-code`'s plans; it used to ask for `claude-code:acme`'s own plans and
   find nothing, which left exactly the pools with one login per account
   without a price.
 - Mod: the pane's `usage` button works with no run in flight — it renders the
@@ -374,7 +584,7 @@ drawn from the real pool figures of 2026-09-18.
 - dashboard: the phone `Home` no longer hides data behind its width. The
   `budget · this week` block draws every pool the desktop draws — four today —
   or ends with `+N more` when the rows genuinely do not fit, and its names are
-  wide enough that `claude-code:wati` and `claude-code` read as two pools
+  wide enough that `claude-code:acme` and `claude-code` read as two pools
   rather than one truncated one. The by-pool, by-model and by-project lists
   keep at least their top three rows (`+N more` for the rest) and always paint
   the whole percentage, never `24…`. The summary figures sit one per line, so
@@ -949,7 +1159,7 @@ drawn from the real pool figures of 2026-09-18.
   from a reset the operator declares —
   `bullswarm strategy set-subscription <pool> --resets-at <iso|unknown>`.
   The Relay token API stopped returning `expires_at` for the `1` and `Moham`
-  wallets on 2026-09-03 (the fleetlens log holds 28 dated snapshots between
+  wallets on 2026-09-03 (the project-n log holds 28 dated snapshots between
   2026-08-31 and 2026-09-03, then only nulls), so `opencode2` and
   `opencode2:relay-3` printed `unmetered` at 73.8% and 10.7% of their $50
   wallets and ranked as neutral. With a declared reset the used% stays the
@@ -982,8 +1192,8 @@ drawn from the real pool figures of 2026-09-18.
   — its effective surplus divided by the fraction of the window still to run —
   ahead of every pool whose window is not about to close, instead of on the
   surplus alone. At 2026-09-11 12:26 HKT the medium lane went to
-  `claude-code:wati` (+22.9 points, 13h33m and 8.1% of its week left) over
-  `grok` (+13.8 points, 2h02m and 1.2% left, urgency ~1150 against wati's
+  `claude-code:acme` (+22.9 points, 13h33m and 8.1% of its week left) over
+  `grok` (+13.8 points, 2h02m and 1.2% left, urgency ~1150 against acme's
   ~283), and grok's points expired unspent two hours later; the owner had been
   pinning grok by hand for such runs. Three states for an expiring pool:
   `urgent` (surplus still to spend and a pacing forecast — the reading plus
@@ -1004,17 +1214,17 @@ drawn from the real pool figures of 2026-09-18.
 - routing: the 5-hour near-limit line is now clock-relative. A pool is
   deprioritized only when its 5h forecast is at/above 75% AND ahead of the
   share of the 5h window that has already elapsed. On 2026-09-10 at 22:19Z a
-  high-tier integrator skipped `claude-code:wati` (81% used, 23 minutes to the
+  high-tier integrator skipped `claude-code:acme` (81% used, 23 minutes to the
   reset — 92.3% of the window elapsed, 88.1% projected) and
-  `claude-code:petsona` (75.3% projected, 85.7% elapsed) and went to the one
-  account already ahead of its weekly pace, while wati still held 34% of its
+  `claude-code:initech` (75.3% projected, 85.7% elapsed) and went to the one
+  account already ahead of its weekly pace, while acme still held 34% of its
   weekly quota unspent with 13% of the week left to spend it. Both pools now keep the lane:
   88.1% with 23 minutes left is a pool spending at the clock's pace, not a pool
   about to hit a wall. Pools with no `resets_at`, an unparsable one, or a reset
   already past keep the fixed 75% line, and the 90% burst gate is unchanged —
   it ignores the clock. The routing reason and the `candidates[]` rows say
   which case applied: `5h used 81% -> 88.1% projected, under the clock (92.3%
-  elapsed)`, `skipped near 5h limit (projected): claude-code:wati 88.1% (20.0%
+  elapsed)`, `skipped near 5h limit (projected): claude-code:acme 88.1% (20.0%
   elapsed)`, and a new `fiveHourElapsedPct` field. `bullswarm pools` shows the
   same clock: `5h=81% (92% elapsed)`.
 - routing: 5-hour spend is clipped at the reset. Quota spent after the window
@@ -1720,7 +1930,7 @@ drawn from the real pool figures of 2026-09-18.
 
 - All of it is visible after the fact. The routing reason names the in-flight
   counts and projections that moved the pick (`5h used 30% -> 41% projected, 2
-  in flight`, `skipped near 5h limit (projected): wati 76%`, `forecast-gated
+  in flight`, `skipped near 5h limit (projected): acme 76%`, `forecast-gated
   at/above 90%: …`, `preferred over busier: …`), every candidate row carries
   `pace`, `effectiveSurplus`, `inflight`, `projectedFiveHourPct`,
   `forecastFiveHourPct`, `projectedWeeklyPct`, `ratePerMinute`,
@@ -2776,7 +2986,7 @@ Adopts the driving mechanics of Claude Code's dynamic workflow (documented in
   former 900-second planner/action timeout defaults.
 - Fixed adaptive completion policy, current-action metadata, provider routing
   history, usage aggregation, latest-worker verification, and truthful partial
-  token/cost accounting found during the Kipwise battle test.
+  token/cost accounting found during the project-b battle test.
 - Added connector-owned native JSONL event adapters for Codex, Claude, Grok,
   Command Code, and OpenCode. Workflows now retain and display the latest three
   semantic shell/read/edit/write/response actions for every active agent.

package/GOAL.md

@@ -2,7 +2,7 @@
 
 > Historical (2026-08-21): accurate when written; see CHANGELOG for what changed since.
 
-**Status:** HISTORICAL PROTOTYPE CHARTER · **Owner:** cowcow02 · **Created:** 2026-08-21
+**Status:** HISTORICAL PROTOTYPE CHARTER · **Owner:** dev · **Created:** 2026-08-21
 
 ## One sentence