catherd-cli 1.4.0 → 2.0.0-beta.20261022113309

package/src/services/ports.ts

@@ -1,5 +1,7 @@
+import type { BlockedReason } from "../domain/blocked.ts";
 import type { HostContext } from "../domain/host.ts";
 import type { Provenance } from "./provenance.ts";
+import type { Bars } from "../domain/bars.ts";
 import type { Budget } from "../domain/budget.ts";
 import type { SessionEnv } from "../infra/claude-session.ts";
 import type { BillingMode } from "../domain/cost.ts";
@@ -7,10 +9,12 @@ import type { Verdict } from "../domain/jev.ts";
 import type { Difficulty, Kind } from "../domain/lane.ts";
 import type { Access } from "../domain/record.ts";
 import type { Role } from "../domain/roles.ts";
+import type { RoleScope } from "../domain/role-scope.ts";
 import type { Change, ProfileDoc, ProfilePatch } from "../domain/profile.ts";
 import type { Issue } from "../domain/profile-rules.ts";
 import type { RouteJev, RouteSource } from "../domain/route.ts";
-import type { SyncReport } from "./source-sync.ts";
+import type { IndexFile } from "../domain/slopalytics.ts";
+import type { IndexStatus } from "./catalog-service.ts";
 
 /** What the run lifecycle reads from a profile. Rungs are `backend:model#effort`; a role's in ladder order. */
 export interface ProfileView {
@@ -18,7 +22,20 @@ export interface ProfileView {
   objective: "cost" | "speed";
   /** `defaultRung`, when set, is where a lane starts without a kind and difficulty (spec §5.4) */
   roles: Partial<
-    Record<Role, { enabled: boolean; access: Access; rungs: string[]; defaultRung?: string; network?: false }>
+    Record<
+      Role,
+      {
+        enabled: boolean;
+        access: Access;
+        rungs: string[];
+        defaultRung?: string;
+        network?: false;
+        /** plan 23: the role's own timeouts over the profile's */
+        timeouts?: { idleMin?: number; wallMin?: number };
+        /** plan 33: the role's own bar percentiles over the profile's */
+        bars?: Bars;
+      }
+    >
   >;
   /** per billing key (spec §7.1); a missing key bills as DEFAULT_BILLING */
   billing: Partial<Record<string, BillingMode>>;
@@ -27,11 +44,17 @@ export interface ProfileView {
   isolated: Partial<Record<string, boolean>>;
   /** rung → its stand-in on a usage limit (spec §4.5) */
   failover: Record<string, string>;
+  /** `<backend>:<model>` → the highest effort routing starts it at (plan 33) */
+  maxEffort?: Record<string, string>;
+  /** plan 33: bar percentiles per difficulty (0 to 100) over the shipped ones */
+  bars?: Bars;
   budget: Budget;
   timeouts: { idleMin: number; wallMin: number };
   preflight: { confirm: boolean };
   heavy: number | "cpus/2";
   notify: string[];
+  /** plan 35: the memory numbers that cap milestones side by side, defaults filled */
+  limits: { memory: { reserveMb: number; perMilestoneMb: number; floorMb: number } };
 }
 
 /** What a profile write returns (spec §7.3): whether it saved, why not, what changed, and the agents it touched. */
@@ -70,6 +93,10 @@ export interface ProfilePort {
   set(name: string | undefined, patch: ProfilePatch, repo?: string | null): ProfileSaved;
   /** The native agent that runs `rung` for `role` under `repo`'s profile; null unless it is a `claude:` rung. */
   agentFor(repo: string | null, role: Role, rung: string): string | null;
+  /** The ntfy topic url of the phone messages: config's `notify.url`, a random ntfy.sh topic made once. */
+  notifyUrl(): string;
+  /** Replaces it; an http(s) url only. */
+  setNotifyUrl(url: string): void;
 }
 
 export interface RouteRequest {
@@ -82,6 +109,8 @@ export interface RouteRequest {
   lane: string | null;
   laneText: string | null;
   spentFraction: number;
+  /** spec 1.5 plan 24: the run's dispatches so far per quota, for a tie between rungs of equal scores */
+  usage?: Record<string, number>;
 }
 
 export interface RouteAnswer {
@@ -93,6 +122,14 @@ export interface RouteAnswer {
   /** the Jev question set asked, and its summed probabilities, for outcomes.jsonl (spec §5.6) */
   questionSet: string | null;
   jev: RouteJev | null;
+  /** spec 1.5 plan 24: where Jev disagreed with a declared lane header (`Jev said logic/hard`), else null */
+  jevSaid: string | null;
+  /** spec 1.5 plan 24: no rung clears the lane's bar, and the closest one */
+  noClear?: string;
+  /** spec 1.5 plan 24: rungs of equal scores on other quotas competed for the start, and what decided */
+  tie?: string;
+  /** spec 1.5 plan 24: the decision in one line, for the coordinator */
+  why: string;
   /** spec 1.2 §5.3, §8: the chosen rung's thresholds, values, sources, facts and run evidence */
   provenance?: Provenance;
 }
@@ -103,7 +140,6 @@ export interface CatalogFilter {
   role?: Role;
   backend?: string;
   text?: string;
-  scoredOnly: boolean;
   limit: number;
   /** the git toplevel whose per-repository listings (opencode's) to read; none reads the global ones */
   repo?: string;
@@ -111,6 +147,8 @@ export interface CatalogFilter {
 
 export interface RoutingPort {
   route(req: RouteRequest): Promise<RouteAnswer>;
+  /** spec 1.5 plan 24: the lanes of one role in one call; Jev is asked about all of them at once */
+  routeMany(reqs: RouteRequest[]): Promise<RouteAnswer[]>;
   /** `use` is the repo profile's `jev.use`: "off" answers with the rule's default and never asks Jev */
   finding(
     runDir: string,
@@ -124,6 +162,18 @@ export interface RoutingPort {
     after: string,
     use: "auto" | "off",
   ): Promise<Verdict<"yes" | "no">>;
+  /** plan 30b: why a role stopped that gave no reason; `other` and an unsure answer are the rule's fallback */
+  stopCause(
+    runDir: string,
+    status: string,
+    reply: string,
+    use: "auto" | "off",
+  ): Promise<Verdict<BlockedReason | "other">>;
+  /**
+   * A run's start check: refreshes the index if it is due, reads it once, and names the enabled roles of `view`
+   * that no indexed pair can fill; `index` is what the run pins (null when there is none).
+   */
+  checkStart(view: ProfileView, repo: string): Promise<{ unusable: Role[]; index: IndexFile | null }>;
   /** `billing` prices the rungs (spec §5.3); absent keys bill as DEFAULT_BILLING */
   catalog(
     filter: CatalogFilter,
@@ -142,6 +192,11 @@ export interface Deps {
   /** Claude transport credentials and registry refresh; host identity lives in `host`. */
   session: SessionEnv | null;
   now: () => number;
-  /** spec 1.2 §3.2 `catalog_sync`; default: the real sync (tests inject one that never reaches the network) */
-  sync?: (o: { force: boolean }) => Promise<SyncReport>;
+  /** `catalog_sync`; default: the real refresh (tests inject one that never reaches the network) */
+  sync?: (o: { force: boolean }) => Promise<IndexStatus>;
+  /**
+   * Spec 1.5 plan 21: the role this process works for (CATHERD_ROLE, or a role's scratch TMPDIR); null or
+   * absent for the orchestrator's own server. A role never claims a run and never reaches a coordinator tool.
+   */
+  role?: RoleScope | null;
 }

package/src/services/preflight.ts

@@ -1,16 +1,24 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { CatherdError, errorMessage } from "../domain/errors.ts";
-import { assertLaneHeader, LANE_HEADER_FIX, parseLaneHeader } from "../domain/lane.ts";
+import { assertLaneHeader, LANE_HEADER_FIX, onlyAllowedHits, parseLaneHeader } from "../domain/lane.ts";
+import { coverageProblems } from "../domain/plan-doc.ts";
+import { lintLanes } from "../domain/plan-lint.ts";
 import { checkEnv } from "../infra/env.ts";
-import { heavySlots, withHeavySlot } from "../infra/heavy-lock.ts";
+import { heavySlots, withHeavySlotWithin } from "../infra/heavy-lock.ts";
+import { loginEnv } from "../infra/login-env.ts";
 import { killGroup } from "../infra/proc.ts";
+import { readGateEnv, resolveGateEnv } from "./gate-env.ts";
+import { landedMilestones } from "./milestones.ts";
+import { planDocs } from "./plan-input.ts";
 import type { Deps } from "./ports.ts";
+import { isDaemonRun, replayRun } from "./run-events-store.ts";
 import { TAIL_LINES } from "./run-debug.ts";
 import { findRun, type Run, runPaths } from "./run-store.ts";
+import { treeOf } from "./tree-path.ts";
 
-/** Spec §4.7. Only `cannot-start` blocks the run. */
-export type PreflightOutcome = "pass" | "fails-as-expected" | "skipped" | "cannot-start";
+/** Spec §4.7. Only `cannot-start` blocks the run; `lock-busy` (plan 23) means: run preflight again. */
+export type PreflightOutcome = "pass" | "fails-as-expected" | "skipped" | "cannot-start" | "lock-busy";
 
 interface PreflightResult {
   lane: string;
@@ -22,12 +30,21 @@ interface PreflightResult {
 }
 
 export type PreflightReport =
-  | { needsConfirmation: true; commands: { lane: string; check: string | null }[] }
+  | {
+      needsConfirmation: true;
+      commands: { lane: string; check: string | null }[];
+      /** plan 34: the plan lint's warnings */
+      lint: string[];
+    }
   | {
       needsConfirmation: false;
       commands: { lane: string; check: string | null }[];
       results: PreflightResult[];
       blocked: boolean;
+      /** plan 23: lanes whose fast check runs no linter while the repo has one */
+      warnings: string[];
+      /** plan 34: the plan lint's warnings */
+      lint: string[];
     };
 
 const CHECK_TIMEOUT_MS = 120_000;
@@ -47,9 +64,15 @@ interface LaneCheck {
   lane: string;
   check: string | null;
   owns: string[];
+  /** spec 1.5: the Allow: exceptions of the lane's absence check */
+  allow: string[];
   problem: string | null;
   /** spec 1.1 §6: why its Kind: or Difficulty: line is refused */
   invalid: string | null;
+  /** plan 32: the plan tasks it names on its `Tasks:` line */
+  tasks: string[];
+  /** plan 34: the lane file's text; null when it cannot be read */
+  text: string | null;
 }
 
 function laneChecks(run: Run): LaneCheck[] {
@@ -73,15 +96,30 @@ function laneChecks(run: Run): LaneCheck[] {
           lane,
           check: h.fastCheck,
           owns: h.owns,
+          allow: h.allow,
           problem: h.fastCheck ? null : `lanes/${f} has no Fast check: line`,
           invalid,
+          tasks: h.tasks,
+          text,
         };
       } catch (e) {
-        return { lane, check: null, owns: [], problem: (e as Error).message, invalid };
+        return {
+          lane,
+          check: null,
+          owns: [],
+          allow: [],
+          problem: (e as Error).message,
+          invalid,
+          tasks: [],
+          text: null,
+        };
       }
     });
 }
 
+/** How many output lines a check's Allow: exceptions are matched against; past it, the check fails as before. */
+const ALLOW_LINES = 1_000;
+
 /** How long the pipes may stay open after the check's own process exits. */
 export const DRAIN_MS = 500;
 
@@ -116,10 +154,11 @@ export async function runCheck(
   repo: string,
   check: string,
   timeoutMs: number,
-): Promise<{ code: number | null; timedOut: boolean; tail: string[] }> {
+  env: Record<string, string> = checkEnv(process.env, repo),
+): Promise<{ code: number | null; timedOut: boolean; tail: string[]; lines: string[] }> {
   const p = Bun.spawn(["sh", "-c", check], {
     cwd: repo,
-    env: checkEnv(process.env, repo),
+    env,
     stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
@@ -141,11 +180,10 @@ export async function runCheck(
       Bun.sleep(DRAIN_MS).then(() => false),
     ]);
     if (!drained) killGroup(p.pid, "SIGKILL"); // leftovers still in the check's group
-    const tail = `${out.text()}${err.text()}`
-      .split("\n")
-      .filter((l) => l.trim())
-      .slice(-TAIL_LINES);
-    return { code: timedOut ? null : code, timedOut, tail };
+    // every line, up to a bound, for a lane's Allow: exceptions; the tail is what the report shows
+    const all = `${out.text()}${err.text()}`.split("\n").filter((l) => l.trim());
+    const lines = all.length <= ALLOW_LINES ? all : [];
+    return { code: timedOut ? null : code, timedOut, tail: all.slice(-TAIL_LINES), lines };
   } finally {
     clearTimeout(timer);
     out.stop();
@@ -153,10 +191,100 @@ export async function runCheck(
   }
 }
 
-export function classify(r: { code: number | null; timedOut: boolean; tail: string[] }): PreflightOutcome {
+/**
+ * Plan 23: a check that failed on the machine, not on the code: no Docker (or none at DOCKER_HOST), no DNS, a
+ * permission the sandbox or the OS denied. Such a check cannot start; it never fails as expected.
+ */
+const ENVIRONMENT = [
+  /command not found/i,
+  /Cannot connect to the Docker daemon/i,
+  /rootless Docker not found/i,
+  /Could not find a valid Docker environment/i,
+  /docker\.sock: connect: no such file or directory/i,
+  /Temporary failure in name resolution|Could not resolve host|no such host|Name or service not known|nodename nor servname|getaddrinfo (ENOTFOUND|EAI_AGAIN)/i,
+  /permission denied|operation not permitted|\bEACCES\b|\bEPERM\b/i,
+];
+
+/** pnpm exits 0 on a `--filter` that matches no package: the lane creates it, so there is nothing to run yet. */
+const EMPTY_FILTER = /No projects matched the filters/i;
+
+/** The first tail line an ENVIRONMENT pattern matches, or null. */
+export const environmentLine = (tail: string[]): string | null =>
+  tail.find((l) => ENVIRONMENT.some((re) => re.test(l))) ?? null;
+
+/** One `pnpm … --filter …` command, nothing chained, piped or backgrounded beside it. */
+const SINGLE_PNPM_FILTER = /^\s*pnpm\s(?:[^;&|\n`$()<>]*\s)?(?:--filter|-F)(?:[\s=])[^;&|\n`$()<>]*$/;
+
+/**
+ * An unmatched pnpm filter is "skipped" only when it is provably the check's sole failure: the whole check
+ * exited 0, or the check is a single pnpm --filter command. In a compound check (`pnpm --filter new test;
+ * docker compose up`) a later command's failure decides.
+ */
+export function classify(
+  r: { code: number | null; timedOut: boolean; tail: string[] },
+  command?: string,
+): PreflightOutcome {
   if (r.timedOut || r.code === 126 || r.code === 127) return "cannot-start";
+  const soleFailure = r.code === 0 || (command !== undefined && SINGLE_PNPM_FILTER.test(command));
+  if (soleFailure && r.tail.some((l) => EMPTY_FILTER.test(l))) return "skipped";
   if (r.code === 0) return "pass";
-  return r.tail.some((l) => /command not found/i.test(l)) ? "cannot-start" : "fails-as-expected";
+  return environmentLine(r.tail) !== null ? "cannot-start" : "fails-as-expected";
+}
+
+/** Why a classified result says what it says, for its note. */
+function noteOf(
+  r: { code: number | null; timedOut: boolean; tail: string[] },
+  outcome: PreflightOutcome,
+  timeoutMs: number,
+): string | null {
+  if (r.timedOut) return `timed out after ${timeoutMs / 1000} s`;
+  if (outcome === "skipped") return "the pnpm filter matches no package yet; the lane creates it";
+  const env = outcome === "cannot-start" ? environmentLine(r.tail) : null;
+  return env ? `environment: ${env.trim()}` : null;
+}
+
+/** How long one check waits for a heavy slot before it reports lock-busy; tests shorten it. */
+export const preflightLimits = { lockWaitMs: 60_000 };
+
+/**
+ * Plan 23: a check runs in the user's login environment (DOCKER_HOST and the rest a login shell sets), through
+ * the allowlist, plus the repo's gate environment. A login PATH comes first, with the server's own after it.
+ */
+export async function checkEnvFor(repo: string): Promise<Record<string, string>> {
+  const login = loginEnv();
+  const base: Record<string, string | undefined> = { ...process.env, ...login };
+  const path = [
+    ...new Set([...(login.PATH ?? "").split(":"), ...(process.env.PATH ?? "").split(":")].filter(Boolean)),
+  ];
+  if (path.length) base.PATH = path.join(":");
+  return { ...checkEnv(base, repo), ...resolveGateEnv(await readGateEnv(repo), base).env };
+}
+
+/** What a fast check names when it lints: a lint script, or a linter by name. */
+const LINT_STEP = /\b(lint|eslint|biome|oxlint|golangci-lint|ruff|clippy|vet|check)\b/i;
+
+/** Root files that say the repo has a linter, by the linter they configure. */
+const LINT_CONFIGS: [RegExp, string][] = [
+  [/^\.golangci\.(ya?ml|toml|json)$/, "golangci-lint"],
+  [/^(biome\.jsonc?)$/, "biome"],
+  [/^(eslint\.config\.[cm]?[jt]s|\.eslintrc(\.[a-z]+)?)$/, "eslint"],
+  [/^\.?oxlintrc\.json$/, "oxlint"],
+  [/^\.?ruff\.toml$/, "ruff"],
+];
+
+/** The linter the repo has, by name, or null: a root lint config, or a `lint` script in package.json. */
+export function repoLinter(repo: string): string | null {
+  for (const name of existsSync(repo) ? readdirSync(repo) : [])
+    for (const [re, linter] of LINT_CONFIGS) if (re.test(name)) return linter;
+  try {
+    const pkg = JSON.parse(readFileSync(join(repo, "package.json"), "utf8")) as {
+      scripts?: Record<string, unknown>;
+    };
+    if (typeof pkg.scripts?.lint === "string") return "the lint script";
+  } catch {
+    // no package.json, or one that does not parse: no lint script
+  }
+  return null;
 }
 
 /**
@@ -165,18 +293,60 @@ export function classify(r: { code: number | null; timedOut: boolean; tail: stri
  */
 export async function preflight(
   deps: Deps,
-  i: { run: string; confirmed?: boolean; timeoutMs?: number },
+  i: { run: string; confirmed?: boolean; timeoutMs?: number; milestone?: string },
 ): Promise<PreflightReport> {
   const run = findRun(i.run);
   const profile = deps.profiles.forRepo(run.meta.repo);
-  const lanes = laneChecks(run);
+  // plan 23: one milestone's lanes, or by default every lane whose milestone has not landed
+  const landed = new Set(landedMilestones(run));
+  const milestoneOf = (lane: string) => lane.split(".")[0] as string;
+  const lanes = laneChecks(run).filter((l) =>
+    i.milestone ? milestoneOf(l.lane) === i.milestone : !landed.has(milestoneOf(l.lane)),
+  );
   // spec 1.1 §6: refuse before running anything, naming every lane whose header the catalog cannot route
   const invalid = lanes.flatMap((l) => (l.invalid ? [l.invalid] : []));
   if (invalid.length) throw new CatherdError("E_LANE_INVALID", invalid.join("; "), { fix: LANE_HEADER_FIX });
   const commands = lanes.map((l) => ({ lane: l.lane, check: l.check }));
-  if (profile.preflight.confirm && !i.confirmed) return { needsConfirmation: true, commands };
+  const { warnings: lint, stuck } = lintLanes(
+    lanes.flatMap((l) => (l.text === null ? [] : [{ id: l.lane, text: l.text }])),
+    laneChecks(run).map((l) => l.lane),
+    // a base run's milestone starts after the ones it names are merged, not only landed (plan 35)
+    run.meta.base
+      ? replayRun(run)
+          .milestones.filter((m) => m.status === "merged")
+          .map((m) => m.id)
+      : [...landed],
+  );
+  // plan 32: a daemon run starts no lane the plan does not back, before the confirm list and before any check
+  if (isDaemonRun(run)) {
+    const problems = coverageProblems(
+      planDocs(run),
+      lanes.map((l) => ({ id: l.lane, tasks: l.tasks })),
+    );
+    if (problems.length)
+      return {
+        needsConfirmation: false,
+        commands,
+        results: problems.map((p) => ({
+          lane: p.lane || (i.milestone ?? "plan"),
+          check: null,
+          outcome: "cannot-start" as const,
+          exitCode: null,
+          tail: [],
+          note: p.note,
+        })),
+        blocked: true,
+        warnings: [],
+        lint,
+      };
+  }
+  if (profile.preflight.confirm && !i.confirmed) return { needsConfirmation: true, commands, lint };
   const timeoutMs = i.timeoutMs ?? CHECK_TIMEOUT_MS;
+  // plan 35: a base run's milestone is checked in its own worktree
+  const cwd = treeOf(run, i.milestone ?? null);
   const results: PreflightResult[] = [];
+  // the login env is captured once per server; the gate env is read once per preflight
+  let env: Record<string, string> | undefined;
   for (const l of lanes) {
     const check = l.check;
     if (!check) {
@@ -194,28 +364,66 @@ export async function preflight(
       results.push({ lane: l.lane, check, outcome: "skipped", exitCode: null, tail: [], note: AS_ROOT });
       continue;
     }
-    const unborn = l.owns.filter(
-      (p) => check.includes(p.replace(/\/$/, "")) && !existsSync(join(run.meta.repo, p)),
-    );
+    const unborn = l.owns.filter((p) => check.includes(p.replace(/\/$/, "")) && !existsSync(join(cwd, p)));
     if (unborn.length) {
       const note = `${unborn.join(", ")} does not exist yet; the lane creates it`;
       results.push({ lane: l.lane, check, outcome: "skipped", exitCode: null, tail: [], note });
       continue;
     }
-    const r = await withHeavySlot(heavySlots(profile.heavy), () => runCheck(run.meta.repo, check, timeoutMs));
+    env ??= await checkEnvFor(run.meta.repo);
+    const checkEnvironment = env;
+    // plan 23: each check waits for its slot within its own budget, and says lock-busy past it
+    const slot = await withHeavySlotWithin(
+      heavySlots(profile.heavy),
+      preflightLimits.lockWaitMs,
+      (_slot, tmp) => runCheck(cwd, check, timeoutMs, { ...checkEnvironment, TMPDIR: tmp, GOTMPDIR: tmp }),
+      { tmpBase: process.env.TMPDIR },
+    );
+    if (slot.busy) {
+      const note = `every heavy slot stayed busy for ${preflightLimits.lockWaitMs / 1000} s (other lanes' checks); run preflight again when they finish`;
+      results.push({ lane: l.lane, check, outcome: "lock-busy", exitCode: null, tail: [], note });
+      continue;
+    }
+    const r = slot.value;
+    // spec 1.5: an absence check whose every hit is one of the lane's Allow: exceptions has passed
+    const classified = classify(r, check);
+    const allowed = classified === "fails-as-expected" && onlyAllowedHits(r.lines, l.allow);
+    const outcome = allowed ? "pass" : classified;
     results.push({
       lane: l.lane,
       check,
-      outcome: classify(r),
+      outcome,
       exitCode: r.code,
       tail: r.tail,
-      note: r.timedOut ? `timed out after ${timeoutMs / 1000} s` : null,
+      note: allowed ? `every hit is an Allow: exception (${r.lines.length})` : noteOf(r, outcome, timeoutMs),
     });
   }
+  // plan 34: an After: that can never finish stops the milestone, so the daemon parks it instead of waiting forever
+  for (const s of stuck)
+    results.push({
+      lane: s.lane,
+      check: null,
+      outcome: "cannot-start",
+      exitCode: null,
+      tail: [],
+      note: s.note,
+    });
+  // plan 23: lint reaches the worker only through its fast check
+  const linter = repoLinter(run.meta.repo);
+  const warnings = linter
+    ? lanes
+        .filter((l) => l.check && !LINT_STEP.test(l.check))
+        .map(
+          (l) =>
+            `${l.lane}: its fast check runs no linter, and the repo has one (${linter}): add the linter of every package the lane touches to its Fast check: line`,
+        )
+    : [];
   return {
     needsConfirmation: false,
     commands,
     results,
     blocked: results.some((r) => r.outcome === "cannot-start"),
+    warnings,
+    lint,
   };
 }

package/src/services/profile-service.ts

@@ -1,5 +1,6 @@
 import type { HostContext, OrchestrationHost } from "../domain/host.ts";
 import { agentFiles } from "../domain/agents.ts";
+import { type MemoryLimits, memoryLimitsOf } from "../domain/milestone-memory.ts";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
@@ -78,7 +79,7 @@ function saveAndLink(name: string, doc: ProfileDoc, host: OrchestrationHost, rep
 
 const validate = (doc: ProfileDoc, name: string, host: OrchestrationHost): Validation => {
   try {
-    return validateHere(resolveProfile(doc, name, host), loadCatalog({ timings: false }), doc, host);
+    return validateHere(resolveProfile(doc, name, host), loadCatalog(), doc, host);
   } catch (e) {
     if (!(e instanceof CatherdError)) throw e;
     return { errors: [{ path: "roles", message: e.message, fix: e.fix }], warnings: [] };
@@ -105,7 +106,7 @@ function syncFor(
   return allowPrune ? pruneProfileAgents(name) : { linked: [], pruned: [], newSessionNeededFor: [] };
 }
 
-/** What a save returns: the port's ProfileSaved (one type for the CLI, the TUI and the MCP tools). */
+/** What a save returns: the port's ProfileSaved (one type for the CLI, the panel and the MCP tools). */
 export type Saved = ProfileSaved;
 
 const unsaved = (v: Validation): Saved => ({
@@ -121,7 +122,7 @@ const unsaved = (v: Validation): Saved => ({
 export const CHANGED_ON_DISK = "profile";
 
 /**
- * Spec §7.3 `patch` (profile_set, `catherd profile set`, the TUI's save): validates first and writes
+ * Spec §7.3 `patch` (profile_set, `catherd profile set`, the panel's save): validates first and writes
  * nothing when invalid, unless the save repairs the profile (spec 1.2 §6.2): it removes at least one error
  * the stored profile had and adds none. Then it saves, and the result's `errors` are those still open. A
  * profile that does not exist yet starts from the default profile. With `expect` (the profile as a preview
@@ -301,14 +302,23 @@ function viewOf(p: Profile): ProfileView {
     jev: p.jev,
     isolated: Object.fromEntries(Object.entries(p.harness).map(([k, h]) => [k, h.isolated])),
     failover: p.failover,
+    maxEffort: p.maxEffort,
+    bars: p.bars,
     budget: p.budget,
     timeouts: p.timeouts,
     preflight: p.preflight,
     heavy: p.lock.heavy,
     notify: p.notify,
+    limits: { memory: pickMemory(memoryLimitsOf(p)) },
   };
 }
 
+const pickMemory = ({ reserveMb, perMilestoneMb, floorMb }: MemoryLimits) => ({
+  reserveMb,
+  perMilestoneMb,
+  floorMb,
+});
+
 /** The ProfilePort the run engine and the MCP tools use (spec §7.3: the single writer). */
 export function profileService(host: () => HostContext): ProfilePort {
   // without a name, each tool acts on the profile `repo` runs on (the active one outside a repo)
@@ -333,6 +343,7 @@ export function profileService(host: () => HostContext): ProfilePort {
         name === undefined ? activeName(repo) : requireProfile(name),
         repo,
         host().host,
+        { reach: true },
       );
       return { valid: v.errors.length === 0, ...v };
     },
@@ -340,6 +351,23 @@ export function profileService(host: () => HostContext): ProfilePort {
     set: (name, patch, repo = null) => patchProfile(name ?? activeName(repo), patch, { host: host().host }),
     agentFor: (repo, role, rung) =>
       parseRung(rung).backend === "claude" ? agentName(activeName(repo), role, rung) : null,
+    notifyUrl: () =>
+      locked(() => {
+        const config = readConfig();
+        if (config.notify?.url) return config.notify.url;
+        const url = `https://ntfy.sh/catherd-${Buffer.from(crypto.getRandomValues(new Uint8Array(10))).toString("hex")}`;
+        writeJsonAtomic(configFile(), { ...config, schema: 1, notify: { ...config.notify, url } });
+        return url;
+      }),
+    setNotifyUrl: (url) =>
+      locked(() => {
+        if (!/^https?:\/\//.test(url) || !URL.canParse(url))
+          throw new CatherdError("E_INPUT_INVALID", `"${url}" is not an http(s) url`, {
+            fix: "give the ntfy topic's url, like https://ntfy.sh/<topic>",
+          });
+        const config = readConfig();
+        writeJsonAtomic(configFile(), { ...config, schema: 1, notify: { ...config.notify, url } });
+      }),
   };
 }
 

package/src/services/profile-store.ts

@@ -15,7 +15,12 @@ import {
   ProfileDocSchema,
   resolveProfile,
 } from "../domain/profile.ts";
-import { type Issue, type Validation, validateProfile } from "../domain/profile-rules.ts";
+import {
+  type Issue,
+  type ValidateOptions,
+  type Validation,
+  validateProfile,
+} from "../domain/profile-rules.ts";
 import type { Catalog } from "../domain/catalog.ts";
 import type { Access } from "../domain/record.ts";
 import { ROLES, type Role } from "../domain/roles.ts";
@@ -34,7 +39,12 @@ export const projectsFile = (): string => join(configDir(), "projects.json");
 export const agentsRoot = (): string => join(configDir(), "agents");
 export const profileFile = (name: string): string => join(profilesDir(), `${name}.json`);
 
-const ConfigSchema = z.looseObject({ schema: z.literal(1), activeProfile: z.string().optional() });
+const ConfigSchema = z.looseObject({
+  schema: z.literal(1),
+  activeProfile: z.string().optional(),
+  /** where the phone messages go (an ntfy topic), made at the first run */
+  notify: z.looseObject({ url: z.string().optional() }).optional(),
+});
 const ProjectsSchema = z.looseObject({
   schema: z.literal(1),
   bindings: z.record(z.string(), z.string()).default({}),
@@ -144,7 +154,7 @@ export function isolationKeyErrors(
 
 /**
  * Spec 1.3 §9 Q2: each enabled role whose rung, or a failover stand-in of one, runs natively on a backend that
- * holds the role's access only when isolated (agy has no read-only flag).
+ * holds the role's access only when isolated (one with no read-only flag).
  */
 export function isolatedOnlyErrors(p: Profile): Issue[] {
   const out: Issue[] = [];
@@ -220,8 +230,9 @@ export function validateHere(
   c: Catalog,
   doc?: ProfileDoc,
   host: OrchestrationHost = "unknown",
+  o: ValidateOptions = {},
 ): Validation {
-  const v = validateProfile(p, c, runnableBackends(), doc, host);
+  const v = validateProfile(p, c, runnableBackends(), doc, host, o);
   return {
     errors: [...v.errors, ...isolationKeyErrors(p), ...isolatedOnlyErrors(p)],
     warnings: [...v.warnings, ...budgetUsdWarnings(p)],
@@ -233,12 +244,13 @@ export function validateNamed(
   name: string | undefined,
   repo: string | null,
   host: OrchestrationHost,
+  o: ValidateOptions = {},
 ): Validation {
   const n = name ?? activeName(repo);
   const doc = readProfileDoc(n);
-  const catalog = loadCatalog({ timings: false, ...(repo === null ? {} : { repo }) });
+  const catalog = loadCatalog(repo === null ? {} : { repo });
   try {
-    return validateHere(resolveProfile(doc, n, host), catalog, doc, host);
+    return validateHere(resolveProfile(doc, n, host), catalog, doc, host, o);
   } catch (e) {
     if (!(e instanceof CatherdError)) throw e;
     return { errors: [{ path: "roles", message: e.message, fix: e.fix }], warnings: [] };