bullswarm 0.38.6 → 0.38.7

package/AGENTS.md

@@ -57,6 +57,9 @@ before doing anything. Their readers and stored formats are unchanged.
    price, not a spent or dead pool: the pool stays pickable with its other
    models, and the record ends when the subscription changes or the operator
    turns the model back on (`src/lib/strategy.js`).
+   A pool whose latest meter reading is a sign-in failure (a 401, or a 403
+   its provider calls an auth error) is out of picks until a later reading
+   succeeds; it is that latest reading, not a remembered state.
    Recursion depth is core-owned via env (`BULLSWARM_DEPTH`).
 5. Workflow dispatches honor the same guarantees as single runs, in
    `src/workflow/v2-dispatch.js`: `BULLSWARM_DEPTH` is checked and propagated
@@ -67,7 +70,12 @@ before doing anything. Their readers and stored formats are unchanged.
    only and never stored. A step's `route`, the run's pin and the step's
    capability tier are hard filters applied before pace ranks what is left. The failure rule is one automatic retry per step (a
    process failure on another eligible pool, a gate failure on the same pool
-   with the failure attached), then the caller. An `act` step is never retried
+   with the failure attached), then the caller. A refusal at start (a sign-in
+   failure or a model the plan does not include, before any file change or
+   tool call) is picked again at once and does not use the step's one retry,
+   at most 3 times per step, only for an analyze, build or chore step with a
+   retry (never an `act` or `outward` step, nor one with `retry: 0`).
+   An `act` step is never retried
    once its worker started. A usage limit (a spent 5-hour or weekly window, or
    no credit left) ends the step and sends it to the caller: no wait, no
    automatic move, no retry. The pool's meter is re-read after it

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.38.7 — honest reviews by default; dead sign-ins and instant refusals no longer cost a retry
+
+- pick: a pool whose latest meter read was refused for its sign-in (HTTP 401, or a 403 its provider calls an auth error) is out of the pick with the reason `sign-in failed (meter read 401)`, however old its cached numbers are, and `bullswarm pools` and the strategy preview show it as not ready (no tier's route). Nothing is remembered beyond that reading: when its hold ends the next pick reads again, and a successful read makes the pool pickable. A 429 or a network error on the meter read changes nothing.
+- retry: a refusal at start (failure kind `auth` or `model-not-in-plan` with no file changed and no tool call) is picked again at once and does not use the step's one automatic retry: a dead sign-in skips that credential's pools, a model the plan does not include lets the same pool run another model of the tier. At most 3 such re-picks per step, counted from its stored attempts so a resume does not reset them; only for an analyze, build or chore step with a retry, never an `act` or `outward` step; any tool-call record in the stream counts as work whatever its name (a codex `mcp_tool_call`, any Claude Code tool, MCP tools included), an empty stream is no work, and a missing or unreadable one is not a refusal; the needs-you try line and the step page read `refused at start: sign-in failed · picked again`.
+- guidance: a review is now placed by quota like any step, kept honest by `blindTo` and numbered checks; `route.independentOf` is documented as an opt-in for when you want another provider (which may still serve the same model). Examples in the skill, the docs and `plan contract` no longer use it. No behaviour change.
+
 ## 0.38.6 — no import cycles
 
 - internal: no module under `src/` imports itself back through its imports any more (13 import cycles removed by moving four small helpers into their own files; `reprice`'s command-line part is now `src/workflow/reprice-cli.js`). Behaviour is unchanged; a new test fails if a cycle comes back.