catherd-cli 1.5.0 → 2.0.0-beta.20261022113309

package/src/services/preflight.ts

@@ -2,15 +2,20 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { CatherdError, errorMessage } from "../domain/errors.ts";
 import { assertLaneHeader, LANE_HEADER_FIX, onlyAllowedHits, parseLaneHeader } from "../domain/lane.ts";
+import { coverageProblems } from "../domain/plan-doc.ts";
+import { lintLanes } from "../domain/plan-lint.ts";
 import { checkEnv } from "../infra/env.ts";
 import { heavySlots, withHeavySlotWithin } from "../infra/heavy-lock.ts";
 import { loginEnv } from "../infra/login-env.ts";
 import { killGroup } from "../infra/proc.ts";
 import { readGateEnv, resolveGateEnv } from "./gate-env.ts";
 import { landedMilestones } from "./milestones.ts";
+import { planDocs } from "./plan-input.ts";
 import type { Deps } from "./ports.ts";
+import { isDaemonRun, replayRun } from "./run-events-store.ts";
 import { TAIL_LINES } from "./run-debug.ts";
 import { findRun, type Run, runPaths } from "./run-store.ts";
+import { treeOf } from "./tree-path.ts";
 
 /** Spec §4.7. Only `cannot-start` blocks the run; `lock-busy` (plan 23) means: run preflight again. */
 export type PreflightOutcome = "pass" | "fails-as-expected" | "skipped" | "cannot-start" | "lock-busy";
@@ -25,7 +30,12 @@ interface PreflightResult {
 }
 
 export type PreflightReport =
-  | { needsConfirmation: true; commands: { lane: string; check: string | null }[] }
+  | {
+      needsConfirmation: true;
+      commands: { lane: string; check: string | null }[];
+      /** plan 34: the plan lint's warnings */
+      lint: string[];
+    }
   | {
       needsConfirmation: false;
       commands: { lane: string; check: string | null }[];
@@ -33,6 +43,8 @@ export type PreflightReport =
       blocked: boolean;
       /** plan 23: lanes whose fast check runs no linter while the repo has one */
       warnings: string[];
+      /** plan 34: the plan lint's warnings */
+      lint: string[];
     };
 
 const CHECK_TIMEOUT_MS = 120_000;
@@ -57,6 +69,10 @@ interface LaneCheck {
   problem: string | null;
   /** spec 1.1 §6: why its Kind: or Difficulty: line is refused */
   invalid: string | null;
+  /** plan 32: the plan tasks it names on its `Tasks:` line */
+  tasks: string[];
+  /** plan 34: the lane file's text; null when it cannot be read */
+  text: string | null;
 }
 
 function laneChecks(run: Run): LaneCheck[] {
@@ -83,9 +99,20 @@ function laneChecks(run: Run): LaneCheck[] {
           allow: h.allow,
           problem: h.fastCheck ? null : `lanes/${f} has no Fast check: line`,
           invalid,
+          tasks: h.tasks,
+          text,
         };
       } catch (e) {
-        return { lane, check: null, owns: [], allow: [], problem: (e as Error).message, invalid };
+        return {
+          lane,
+          check: null,
+          owns: [],
+          allow: [],
+          problem: (e as Error).message,
+          invalid,
+          tasks: [],
+          text: null,
+        };
       }
     });
 }
@@ -280,8 +307,43 @@ export async function preflight(
   const invalid = lanes.flatMap((l) => (l.invalid ? [l.invalid] : []));
   if (invalid.length) throw new CatherdError("E_LANE_INVALID", invalid.join("; "), { fix: LANE_HEADER_FIX });
   const commands = lanes.map((l) => ({ lane: l.lane, check: l.check }));
-  if (profile.preflight.confirm && !i.confirmed) return { needsConfirmation: true, commands };
+  const { warnings: lint, stuck } = lintLanes(
+    lanes.flatMap((l) => (l.text === null ? [] : [{ id: l.lane, text: l.text }])),
+    laneChecks(run).map((l) => l.lane),
+    // a base run's milestone starts after the ones it names are merged, not only landed (plan 35)
+    run.meta.base
+      ? replayRun(run)
+          .milestones.filter((m) => m.status === "merged")
+          .map((m) => m.id)
+      : [...landed],
+  );
+  // plan 32: a daemon run starts no lane the plan does not back, before the confirm list and before any check
+  if (isDaemonRun(run)) {
+    const problems = coverageProblems(
+      planDocs(run),
+      lanes.map((l) => ({ id: l.lane, tasks: l.tasks })),
+    );
+    if (problems.length)
+      return {
+        needsConfirmation: false,
+        commands,
+        results: problems.map((p) => ({
+          lane: p.lane || (i.milestone ?? "plan"),
+          check: null,
+          outcome: "cannot-start" as const,
+          exitCode: null,
+          tail: [],
+          note: p.note,
+        })),
+        blocked: true,
+        warnings: [],
+        lint,
+      };
+  }
+  if (profile.preflight.confirm && !i.confirmed) return { needsConfirmation: true, commands, lint };
   const timeoutMs = i.timeoutMs ?? CHECK_TIMEOUT_MS;
+  // plan 35: a base run's milestone is checked in its own worktree
+  const cwd = treeOf(run, i.milestone ?? null);
   const results: PreflightResult[] = [];
   // the login env is captured once per server; the gate env is read once per preflight
   let env: Record<string, string> | undefined;
@@ -302,9 +364,7 @@ export async function preflight(
       results.push({ lane: l.lane, check, outcome: "skipped", exitCode: null, tail: [], note: AS_ROOT });
       continue;
     }
-    const unborn = l.owns.filter(
-      (p) => check.includes(p.replace(/\/$/, "")) && !existsSync(join(run.meta.repo, p)),
-    );
+    const unborn = l.owns.filter((p) => check.includes(p.replace(/\/$/, "")) && !existsSync(join(cwd, p)));
     if (unborn.length) {
       const note = `${unborn.join(", ")} does not exist yet; the lane creates it`;
       results.push({ lane: l.lane, check, outcome: "skipped", exitCode: null, tail: [], note });
@@ -313,8 +373,11 @@ export async function preflight(
     env ??= await checkEnvFor(run.meta.repo);
     const checkEnvironment = env;
     // plan 23: each check waits for its slot within its own budget, and says lock-busy past it
-    const slot = await withHeavySlotWithin(heavySlots(profile.heavy), preflightLimits.lockWaitMs, () =>
-      runCheck(run.meta.repo, check, timeoutMs, checkEnvironment),
+    const slot = await withHeavySlotWithin(
+      heavySlots(profile.heavy),
+      preflightLimits.lockWaitMs,
+      (_slot, tmp) => runCheck(cwd, check, timeoutMs, { ...checkEnvironment, TMPDIR: tmp, GOTMPDIR: tmp }),
+      { tmpBase: process.env.TMPDIR },
     );
     if (slot.busy) {
       const note = `every heavy slot stayed busy for ${preflightLimits.lockWaitMs / 1000} s (other lanes' checks); run preflight again when they finish`;
@@ -335,6 +398,16 @@ export async function preflight(
       note: allowed ? `every hit is an Allow: exception (${r.lines.length})` : noteOf(r, outcome, timeoutMs),
     });
   }
+  // plan 34: an After: that can never finish stops the milestone, so the daemon parks it instead of waiting forever
+  for (const s of stuck)
+    results.push({
+      lane: s.lane,
+      check: null,
+      outcome: "cannot-start",
+      exitCode: null,
+      tail: [],
+      note: s.note,
+    });
   // plan 23: lint reaches the worker only through its fast check
   const linter = repoLinter(run.meta.repo);
   const warnings = linter
@@ -351,5 +424,6 @@ export async function preflight(
     results,
     blocked: results.some((r) => r.outcome === "cannot-start"),
     warnings,
+    lint,
   };
 }

package/src/services/profile-service.ts

@@ -1,5 +1,6 @@
 import type { HostContext, OrchestrationHost } from "../domain/host.ts";
 import { agentFiles } from "../domain/agents.ts";
+import { type MemoryLimits, memoryLimitsOf } from "../domain/milestone-memory.ts";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
@@ -78,7 +79,7 @@ function saveAndLink(name: string, doc: ProfileDoc, host: OrchestrationHost, rep
 
 const validate = (doc: ProfileDoc, name: string, host: OrchestrationHost): Validation => {
   try {
-    return validateHere(resolveProfile(doc, name, host), loadCatalog({ timings: false }), doc, host);
+    return validateHere(resolveProfile(doc, name, host), loadCatalog(), doc, host);
   } catch (e) {
     if (!(e instanceof CatherdError)) throw e;
     return { errors: [{ path: "roles", message: e.message, fix: e.fix }], warnings: [] };
@@ -105,7 +106,7 @@ function syncFor(
   return allowPrune ? pruneProfileAgents(name) : { linked: [], pruned: [], newSessionNeededFor: [] };
 }
 
-/** What a save returns: the port's ProfileSaved (one type for the CLI, the TUI and the MCP tools). */
+/** What a save returns: the port's ProfileSaved (one type for the CLI, the panel and the MCP tools). */
 export type Saved = ProfileSaved;
 
 const unsaved = (v: Validation): Saved => ({
@@ -121,7 +122,7 @@ const unsaved = (v: Validation): Saved => ({
 export const CHANGED_ON_DISK = "profile";
 
 /**
- * Spec §7.3 `patch` (profile_set, `catherd profile set`, the TUI's save): validates first and writes
+ * Spec §7.3 `patch` (profile_set, `catherd profile set`, the panel's save): validates first and writes
  * nothing when invalid, unless the save repairs the profile (spec 1.2 §6.2): it removes at least one error
  * the stored profile had and adds none. Then it saves, and the result's `errors` are those still open. A
  * profile that does not exist yet starts from the default profile. With `expect` (the profile as a preview
@@ -301,14 +302,23 @@ function viewOf(p: Profile): ProfileView {
     jev: p.jev,
     isolated: Object.fromEntries(Object.entries(p.harness).map(([k, h]) => [k, h.isolated])),
     failover: p.failover,
+    maxEffort: p.maxEffort,
+    bars: p.bars,
     budget: p.budget,
     timeouts: p.timeouts,
     preflight: p.preflight,
     heavy: p.lock.heavy,
     notify: p.notify,
+    limits: { memory: pickMemory(memoryLimitsOf(p)) },
   };
 }
 
+const pickMemory = ({ reserveMb, perMilestoneMb, floorMb }: MemoryLimits) => ({
+  reserveMb,
+  perMilestoneMb,
+  floorMb,
+});
+
 /** The ProfilePort the run engine and the MCP tools use (spec §7.3: the single writer). */
 export function profileService(host: () => HostContext): ProfilePort {
   // without a name, each tool acts on the profile `repo` runs on (the active one outside a repo)
@@ -341,6 +351,23 @@ export function profileService(host: () => HostContext): ProfilePort {
     set: (name, patch, repo = null) => patchProfile(name ?? activeName(repo), patch, { host: host().host }),
     agentFor: (repo, role, rung) =>
       parseRung(rung).backend === "claude" ? agentName(activeName(repo), role, rung) : null,
+    notifyUrl: () =>
+      locked(() => {
+        const config = readConfig();
+        if (config.notify?.url) return config.notify.url;
+        const url = `https://ntfy.sh/catherd-${Buffer.from(crypto.getRandomValues(new Uint8Array(10))).toString("hex")}`;
+        writeJsonAtomic(configFile(), { ...config, schema: 1, notify: { ...config.notify, url } });
+        return url;
+      }),
+    setNotifyUrl: (url) =>
+      locked(() => {
+        if (!/^https?:\/\//.test(url) || !URL.canParse(url))
+          throw new CatherdError("E_INPUT_INVALID", `"${url}" is not an http(s) url`, {
+            fix: "give the ntfy topic's url, like https://ntfy.sh/<topic>",
+          });
+        const config = readConfig();
+        writeJsonAtomic(configFile(), { ...config, schema: 1, notify: { ...config.notify, url } });
+      }),
   };
 }
 

package/src/services/profile-store.ts

@@ -39,7 +39,12 @@ export const projectsFile = (): string => join(configDir(), "projects.json");
 export const agentsRoot = (): string => join(configDir(), "agents");
 export const profileFile = (name: string): string => join(profilesDir(), `${name}.json`);
 
-const ConfigSchema = z.looseObject({ schema: z.literal(1), activeProfile: z.string().optional() });
+const ConfigSchema = z.looseObject({
+  schema: z.literal(1),
+  activeProfile: z.string().optional(),
+  /** where the phone messages go (an ntfy topic), made at the first run */
+  notify: z.looseObject({ url: z.string().optional() }).optional(),
+});
 const ProjectsSchema = z.looseObject({
   schema: z.literal(1),
   bindings: z.record(z.string(), z.string()).default({}),
@@ -149,7 +154,7 @@ export function isolationKeyErrors(
 
 /**
  * Spec 1.3 §9 Q2: each enabled role whose rung, or a failover stand-in of one, runs natively on a backend that
- * holds the role's access only when isolated (agy has no read-only flag).
+ * holds the role's access only when isolated (one with no read-only flag).
  */
 export function isolatedOnlyErrors(p: Profile): Issue[] {
   const out: Issue[] = [];
@@ -243,7 +248,7 @@ export function validateNamed(
 ): Validation {
   const n = name ?? activeName(repo);
   const doc = readProfileDoc(n);
-  const catalog = loadCatalog({ timings: false, ...(repo === null ? {} : { repo }) });
+  const catalog = loadCatalog(repo === null ? {} : { repo });
   try {
     return validateHere(resolveProfile(doc, n, host), catalog, doc, host, o);
   } catch (e) {

package/src/services/protocol.ts

@@ -50,6 +50,10 @@ function laneIds(run: Run): string[] {
     .sort(byNumber);
 }
 
+/** Plan 28: the milestones the run's lane files name, in number order. */
+export const runMilestones = (run: Run): string[] =>
+  [...new Set(laneIds(run).map(milestoneOf))].sort(byNumber);
+
 /** What laneDone reads of the run, read once for every lane of the milestone. */
 interface LaneEvidence {
   routes: RouteRow[];

package/src/services/provenance.ts

@@ -1,81 +1,28 @@
-import { type Catalog, type Confidence, DIMS, type Dim, rungInfo, scoresOf } from "../domain/catalog.ts";
+import { barOf, BAR_PERCENTILE } from "../domain/bars.ts";
+import { type Catalog, type Pair, rungInfo } from "../domain/catalog.ts";
 import { type BillingMode, type Cost, costOf, DEFAULT_BILLING } from "../domain/cost.ts";
 import type { Difficulty, Kind } from "../domain/lane.ts";
 import { type EvidenceTable, evidenceLine, evidenceOf } from "./run-evidence.ts";
 
-/** Spec 1.2 §5.3: one value routing uses for a rung, with where it came from. */
-export interface ValueUsed {
-  dim: Dim;
-  value: number;
-  confidence: Confidence;
-  /** the source a synced value came from; `shipped` for a hand-typed one, `override` for the user's */
-  source: string;
-  benchmark: string;
-  date: string;
-  url: string;
-  /** catherd's guess for this rung: lent by a treat-like or an inferred stand-in (spec 1.2 §6.1) */
-  inferred: boolean;
-  /** the rung the value belongs to, when it is not this one */
-  from: string | null;
-  /** what lent it: a treat-like (a mapping, `like X`) or an inferred stand-in (a guess); null for its own */
-  lent: "treat-like" | "stand-in" | null;
-}
-
-/** Spec 1.2 §5.3: one threshold of the lane's bar, the value used against it, and whether it clears. */
-export interface Threshold {
-  dim: Dim;
-  min: number;
-  used: ValueUsed | null;
-  clears: boolean;
-  /** where the default threshold came from (`barsWhy`) */
-  why: string | null;
-}
-
-/** Spec 1.2 §5.3, §8: what `route` reports about the rung it chose. */
+/** What `route` reports about the rung it chose: the one number it ranked on, the bar, and what it costs. */
 export interface Provenance {
   rung: string;
   canonical: string;
-  /** the lane's bar, threshold by threshold; empty when the route read no bar (the default rung) */
-  thresholds: Threshold[];
-  /** every value the rung has */
-  values: ValueUsed[];
-  /** facts that never carry a bar (spec 1.2 §4.1): `<source>.<field>` → value */
-  speed: Record<string, number>;
+  /** the rung's Slopalytics intelligence index; null when it is not indexed */
+  intelligence: number | null;
+  /** the difficulty's bar, with the percentile it sits at; null when the route read no bar (the default rung) */
+  bar: { difficulty: Difficulty; percentile: number; min: number; clears: boolean } | null;
+  price: Pair["price"];
+  /** tokens per second; null when Slopalytics has none */
+  speed: number | null;
   cost: Cost;
-  /**
-   * spec 1.2 §8: its runs for the lane's kind (or every kind) and over every kind; never used for routing;
-   * null when the runs could not be read
-   */
+  /** when the proxy fetched the index the route read; null with no index */
+  indexedAt: string | null;
+  /** spec 1.2 §8: its runs for the lane's kind (or every kind) and over every kind; null when they could not be read */
   evidence: { kind: string | null; all: string | null } | null;
 }
 
-/** Spec 1.2 §5.3: each value a canonical rung has, with its confidence and source, borrowed ones marked. */
-export function valuesUsed(c: Catalog, canonical: string): ValueUsed[] {
-  const s = scoresOf(c, canonical);
-  if (!s) return [];
-  return DIMS.flatMap((dim) => {
-    const r = s.records[dim];
-    if (!r) return [];
-    const borrowed = s.borrowed.includes(dim);
-    const from = borrowed ? s.via : (s.standIns[dim] ?? null);
-    return [
-      {
-        dim,
-        value: r.value,
-        confidence: r.confidence,
-        source: r.source ?? "shipped",
-        benchmark: `${r.benchmark} ${r.version}`,
-        date: r.date,
-        url: r.url,
-        inferred: from !== null,
-        from,
-        lent: from === null ? null : borrowed ? "treat-like" : "stand-in",
-      },
-    ];
-  });
-}
-
-/** Spec 1.2 §5.3: the chosen rung's thresholds for the lane's kind and difficulty, its values and facts. */
+/** The chosen rung's intelligence, the difficulty's bar and whether it clears it, its price, speed and cost. */
 export function provenanceOf(
   c: Catalog,
   rung: string,
@@ -83,34 +30,28 @@ export function provenanceOf(
   difficulty: Difficulty | null,
   billing: Partial<Record<string, BillingMode>>,
   evidence: EvidenceTable | null,
+  at: Record<Difficulty, number> = BAR_PERCENTILE,
 ): Provenance {
   const info = rungInfo(c, rung);
-  const values = valuesUsed(c, info.canonical);
-  const bar = kind && difficulty ? c.bars[kind][difficulty] : {};
-  const thresholds: Threshold[] = DIMS.flatMap((dim) => {
-    const min = bar[dim];
-    if (min === undefined || !kind || !difficulty) return [];
-    const used = values.find((v) => v.dim === dim) ?? null;
-    return [
-      {
-        dim,
-        min,
-        used,
-        clears: used !== null && used.value >= min,
-        // a threshold the user's override set is theirs, whatever the default's why says (1.2 minor)
-        why: c.userBars?.includes(`${kind}/${difficulty}/${dim}`)
-          ? "your override"
-          : (c.barsWhy[dim]?.[difficulty] ?? null),
-      },
-    ];
-  });
+  const intelligence = info.pair?.intelligence ?? null;
+  const min = difficulty ? barOf(c, difficulty, at) : null;
   return {
     rung,
     canonical: info.canonical,
-    thresholds,
-    values,
-    speed: info.family?.speed ?? {},
-    cost: costOf(info.family, info.parsed.effort, billing[info.key] ?? DEFAULT_BILLING[info.key]),
+    intelligence,
+    bar:
+      difficulty && min !== null
+        ? {
+            difficulty,
+            percentile: at[difficulty],
+            min,
+            clears: intelligence !== null && intelligence >= min,
+          }
+        : null,
+    price: info.pair?.price ?? null,
+    speed: info.pair?.speed ?? null,
+    cost: costOf(info.family, info.pair, info.parsed.effort, billing[info.key] ?? DEFAULT_BILLING[info.key]),
+    indexedAt: c.indexedAt,
     evidence: evidence && {
       kind: evidenceLine(evidenceOf(evidence, info.canonical, kind)),
       all: evidenceLine(evidenceOf(evidence, info.canonical)),

package/src/services/questions.ts

@@ -29,6 +29,15 @@ const rows = (run: Run): QuestionRow[] =>
     (r) => typeof r?.milestone === "string" && typeof r.text === "string",
   );
 
+/** Plan 28: how many questions the run parked on and how many were answered. */
+export const questionCounts = (run: Run): { questions: number; answers: number } => {
+  const all = rows(run);
+  return {
+    questions: all.filter((r) => r.kind === "question").length,
+    answers: all.filter((r) => r.kind === "answer").length,
+  };
+};
+
 /** The questions not answered yet, oldest first; a milestone answered after its question is no longer open. */
 export function openQuestions(run: Run): OpenQuestion[] {
   const open = new Map<string, OpenQuestion>();

package/src/services/reconcile.ts

@@ -3,10 +3,12 @@ import { errorMessage } from "../domain/errors.ts";
 import { dispatchPaths } from "../infra/dispatch-dir.ts";
 import { log } from "../infra/log.ts";
 import { writeJsonAtomic } from "../infra/store.ts";
+import { ensureDaemon } from "./daemon.ts";
 import { recoverOwned, settle, stallPoll, unsettledLimits, watching } from "./dispatch-service.ts";
 import { type Dispatch, listDispatches, pendingDispatches } from "./dispatches.ts";
 import { finalizeDispatch, waitForFinish } from "./finalize.ts";
 import type { Deps } from "./ports.ts";
+import { isDaemonRun } from "./run-events-store.ts";
 import { listRuns, type Run } from "./run-store.ts";
 import { ownsRun } from "./sessions.ts";
 
@@ -100,6 +102,15 @@ export async function reconcileAll(deps: Deps): Promise<ReconcileReport> {
     if (!report.warnings.includes(w)) report.warnings.push(w);
   };
   for (const run of runs) {
+    // a 2.0 run is its daemon's: an unfinished one gets its daemon back, and nothing here settles its roles
+    if (isDaemonRun(run)) {
+      try {
+        ensureDaemon(run);
+      } catch (e) {
+        warn(run, e);
+      }
+      continue;
+    }
     let pending;
     try {
       const scrubbed = scrubOldSpecs(run);

package/src/services/routing-service.ts

@@ -1,4 +1,5 @@
 import { assertNativeHost } from "./backends.ts";
+import { percentilesOf } from "../domain/bars.ts";
 import { BUDGET_CHEAP_AT } from "../domain/budget.ts";
 import { errorMessage } from "../domain/errors.ts";
 import {
@@ -21,10 +22,11 @@ import {
   type Pick,
   quotaUsage,
   type RoutingProfile,
+  rolesWithoutRung,
   select,
 } from "../domain/select.ts";
 import { log } from "../infra/log.ts";
-import { catalogQuery, freshenDiscovery, loadCatalog } from "./catalog-service.ts";
+import { catalogQuery, freshenDiscovery, loadCatalog, startIndex } from "./catalog-service.ts";
 import { type Asked, askJev, type JevOpts, jevQuestions, logJev } from "./jev-service.ts";
 import type { ProfileView, RouteAnswer, RouteRequest, RoutingPort, Verdict } from "./ports.ts";
 import { provenanceOf } from "./provenance.ts";
@@ -42,6 +44,8 @@ function routingProfile(
     // spec §4.6: from 80 % of the budget on, start at the cheapest rung that clears the bar
     objective: spentFraction >= BUDGET_CHEAP_AT ? "cost" : v.objective,
     billing: v.billing,
+    maxEffort: v.maxEffort ?? {},
+    bars: { ...v.bars, ...rc?.bars },
     role: {
       enabled: rc?.enabled ?? false,
       rungs: rc?.rungs ?? [],
@@ -142,7 +146,7 @@ interface Prepared {
 async function prepare(req: RouteRequest, o: RoutingOpts): Promise<Prepared> {
   const p = routingProfile(req.profile, req.role, req.spentFraction, req.usage);
   await freshenWithin(p.role.rungs, req.repo, o.discoveryBudgetMs ?? DISCOVERY_BUDGET_MS);
-  return { p, c: loadCatalog({ repo: req.repo }) };
+  return { p, c: loadCatalog({ repo: req.repo, runDir: req.runDir }) };
 }
 
 /** Jev's answer about a lane; null when the route reads no lane, empty when it asks nothing (Jev off, one usable rung). */
@@ -172,7 +176,15 @@ function decide(req: RouteRequest, { p, c }: Prepared, j: Judged | null): RouteA
   const fallback = () => defaultLadder(c, p, req.role);
   const finish = (out: RouteAnswer): RouteAnswer => {
     out.why = whyOf(out, req.laneText !== null);
-    out.provenance = provenanceOf(c, out.rung, out.kind, out.difficulty, p.billing, evidenceOrNone(c));
+    out.provenance = provenanceOf(
+      c,
+      out.rung,
+      out.kind,
+      out.difficulty,
+      p.billing,
+      evidenceOrNone(c),
+      percentilesOf(p),
+    );
     return out;
   };
   if (req.laneText === null || j === null)
@@ -184,21 +196,14 @@ function decide(req: RouteRequest, { p, c }: Prepared, j: Judged | null): RouteA
     : null;
   let out: RouteAnswer;
   if (lane.kind && lane.difficulty) {
-    out = answer(
-      select(c, p, req.role, lane.kind, lane.difficulty),
-      "lane",
-      lane.kind,
-      lane.difficulty,
-      asked,
-      jev,
-    );
+    out = answer(select(c, p, req.role, lane.difficulty), "lane", lane.kind, lane.difficulty, asked, jev);
   } else if (judged?.track && judged.difficulty) {
     const kind = lane.kind ?? judged.kind ?? "repo_code";
-    out = answer(select(c, p, req.role, kind, judged.difficulty), "jev", kind, judged.difficulty, asked, jev);
+    out = answer(select(c, p, req.role, judged.difficulty), "jev", kind, judged.difficulty, asked, jev);
   } else if (judged?.kind || (judged && lane.kind)) {
     const kind = (lane.kind ?? judged.kind) as Kind;
-    const difficulty = lane.difficulty ?? defaultDifficulty(c, p, req.role, kind);
-    out = answer(select(c, p, req.role, kind, difficulty), "jev-kind", kind, difficulty, asked, jev);
+    const difficulty = lane.difficulty ?? defaultDifficulty(c, p, req.role);
+    out = answer(select(c, p, req.role, difficulty), "jev-kind", kind, difficulty, asked, jev);
   } else {
     out = answer(fallback(), "default", null, null, asked, jev);
   }
@@ -248,7 +253,7 @@ async function routeMany(reqs: RouteRequest[], o: RoutingOpts): Promise<RouteAns
 
 async function verdict<T extends string>(
   runDir: string,
-  set: Extract<SetName, "finding" | "same-defect">,
+  set: Extract<SetName, "finding" | "same-defect" | "stop">,
   state: Record<string, unknown>,
   options: readonly T[],
   use: "auto" | "off",
@@ -303,6 +308,12 @@ export function routingService(o: RoutingOpts = {}): RoutingPort {
         use,
         o,
       ),
+    stopCause: (runDir, status, reply, use) =>
+      verdict(runDir, "stop", { status, reply: scrubFree(reply.slice(-4000)) }, VERDICT_OPTIONS.stop, use, o),
+    checkStart: async (view, repo) => {
+      const { catalog, index } = await startIndex(repo);
+      return { unusable: rolesWithoutRung(catalog, view), index };
+    },
     catalog: (filter, billing) => catalogQuery(filter, billing),
   };
 }