catherd-cli 1.5.0 → 2.0.0-beta.20261022113309

package/plugin/skills/catherd-setup/SKILL.md

@@ -7,7 +7,7 @@ description: Use when the user wants to tune catherd — which models and effort
 
 You tune the user's catherd profile in conversation. A profile says, per role, which rungs it may run on (`backend:model#effort`, in ladder order) and what it may touch (its access mode); whether routing favours cost or speed; how each backend is billed; whether Jev picks the rung; which rung stands in when a backend hits its usage limit; the run budget and timeouts; whether each vendor harness runs with the user's customizations or isolated; how many heavy commands run at once; and when to push.
 
-**You never edit a file by hand.** Use `profile_set` for patches and the existing reviewed CLI reset below; both go through ProfileService, as do the `catherd profile` commands and the TUI.
+**You never edit a file by hand.** Use `profile({ action: "set" })` for patches and the existing reviewed CLI reset below; both go through ProfileService, as do the `catherd profile` commands and the panel.
 
 **Discover the host first with `status()`.** Use the host's available MCP discovery facility; names and deferred tools differ. Claude Code may use `ToolSearch`; Codex never needs invented Claude tools or native Claude agents. Pass the actual project `repo` explicitly to profile, setup and catalog calls that accept it: native Codex starts the MCP server in the installed plugin root, not the project. An unknown terminal can use `catherd init --host codex` or `--host claude-code` for setup; this does not create a conversation owner. Conflicting identity must be resolved before ownership or push.
 
@@ -15,7 +15,7 @@ You tune the user's catherd profile in conversation. A profile says, per role, w
 
 - **One question at a time.** Each question carries your recommended answer and one line on why, so the user can simply say yes.
 - **The user steers.** When they reverse a proposal, take the reversal and never re-argue it.
-- **Talk in their terms:** minutes, their subscriptions, how often a rung climbed on their own runs, tokens per run. Benchmark names only when they ask.
+- **Talk in their terms:** minutes, their subscriptions, how often a rung climbed on their own runs, tokens per run. Name the Slopalytics intelligence index only when they ask.
 - **Every number you quote comes from a tool result in this conversation.** When there is no data yet, say so instead of estimating.
 
 ## 1. Learn the goals
@@ -23,16 +23,17 @@ You tune the user's catherd profile in conversation. A profile says, per role, w
 Ask these, one at a time, each with its recommended answer:
 
 1. **Their order of speed, cost and quality.** Recommend cost first, the default `objective`: catherd climbs a rung when a cheap one cannot do the work, so the lanes that need speed get it anyway, and the reviewer and the verifier hold quality either way.
-2. **The subscriptions they hold:** a ChatGPT plan (Codex), a Claude plan, OpenCode Go, Zen credit or API keys. They set `billing` per key (`codex`, `claude`, `claude-code`, `opencode-go`, `opencode`, `cursor`, `grok`, `antigravity`): `chatgpt-plan`, `claude-plan`, `subscription` or `metered`. Recommend leaning on subscriptions before metered spend. Explain which workers share this conversation's quota from the actual host and billing facts.
-3. **The kind of work they orchestrate:** front-end screens, back-end services, terminal and ops work, docs. Recommend from their own runs when `runs_summary` has any.
+2. **The subscriptions they hold:** a ChatGPT plan (Codex), a Claude plan, OpenCode Go, Zen credit or API keys. They set `billing` per key (`codex`, `claude`, `claude-code`, `opencode-go`, `opencode`, `cursor`): `chatgpt-plan`, `claude-plan`, `subscription` or `metered`. Recommend leaning on subscriptions before metered spend. Explain which workers share this conversation's quota from the actual host and billing facts.
+3. **The kind of work they orchestrate:** front-end screens, back-end services, terminal and ops work, docs. Recommend from their own runs when the catalog's `runs:` evidence has any.
 
 ## 2. Read the facts before proposing
 
 In one message, call:
 
-- `catalog_query({ repo, role: "<role>" })` for each role you will discuss: the models that can fill it, their scored rungs, any "treat like", each rung's cost under their billing, and whether their backend's last listing offers it (`listed: false` means their account does not);
-- `runs_summary({})`: how each rung has done on their own runs (runs, refusals, climbs, time) and the harness cost line, for claude-code and opencode only: Codex reports no per-request input, so it has no harness figure;
-- `profile_get({ repo })`: where they stand now, with each role's `access` and `enforcement`. Pass the user's repo: without a name, the profile tools act on the profile this repo runs on (the one bound to it, else the active one), which `here` names; `active` is the global active profile.
+- `catherd catalog list --role <role> --json` (in a shell, from their repo) for each role you will discuss: the models that can fill it, their indexed rungs (each with its `intelligence`, the one number catherd ranks on), each rung's cost under their billing, whether their backend's last listing offers it (`listed: false` means their account does not), and the `runs:` evidence of how each rung has done on their own runs (runs, refusals, climbs, time). The session has no catalog tool;
+- `profile({ action: "get", repo })`: where they stand now, with each role's `access` and `enforcement`. Pass the user's repo: without a name, the profile tools act on the profile this repo runs on (the one bound to it, else the active one), which `here` names; `active` is the global active profile.
+
+There is no per-run harness figure in the session: say so when isolation comes up.
 
 Verify the exact omitted Codex model ID `gpt-6.1-sol` against native catalog discovery and validation. If its spelling differs, report the mismatch and resolve it explicitly with the owner; never silently normalize or substitute a model. Retain architect high and verifier low effort.
 
@@ -44,7 +45,7 @@ Go through these in order, and skip any the user does not care about:
 2. `billing`, from step 1;
 3. the worker's `rungs` and its `defaultRung`;
 4. the reviewer and the UI reviewer;
-5. the architect and the verifier. Recommend omitted host defaults: on Codex, exactly `codex:gpt-6.1-sol#high` and `codex:gpt-6.1-sol#low`; on Claude Code, the existing native Claude defaults. A `claude:` rung requires a Claude Code host and its native `Agent`; `claude-code:` runs headless through `dispatch` on either host. Codex architect/verifier use process `dispatch`/`result`. Preserve explicit model IDs, efforts, ladder order and all other fields. Never silently convert `claude:` into `claude-code:`;
+5. the architect and the verifier. Recommend omitted host defaults: on Codex, exactly `codex:gpt-6.1-sol#high` and `codex:gpt-6.1-sol#low`; on Claude Code, the existing native Claude defaults. A `claude:` rung requires a Claude Code host; the daemon runs it as its headless `claude-code:` twin, and `claude-code:` is that headless rung on either host. Codex architect and verifier run as headless processes the daemon starts. Preserve explicit model IDs, efforts, ladder order and all other fields. Never silently convert `claude:` into `claude-code:` in the profile;
 6. the writer, the researcher and the artist;
 7. each role's `access` (below);
 8. `failover` (below);
@@ -52,7 +53,7 @@ Go through these in order, and skip any the user does not care about:
 10. harness isolation, per harness (below);
 11. `lock.heavy` and `notify`.
 
-Existing materialized profiles remain unchanged on read, init, upgrade or host switch. To deliberately opt into host defaults, use the existing CLI from the project directory, naming the profile returned by `profile_get`:
+Existing materialized profiles remain unchanged on read, init, upgrade or host switch. To deliberately opt into host defaults, use the existing CLI from the project directory, naming the profile returned by `profile({ action: "get" })`:
 
 ```sh
 catherd profile reset-host-defaults <profile> --host codex --preview --json > /tmp/catherd-host-defaults-review.json
@@ -64,28 +65,28 @@ Use `--host claude-code` for that host. This reviewed reset removes only archite
 
 Each proposal has three parts: the change, a worked example from their facts, and the tradeoff in their terms. For instance: "Luna high on build lanes: about 5 min slower than Sol medium, no Claude quota, climbs on 1 in 5 of your runs so far."
 
-- Offer only the rungs `catalog_query` lists as capable for the role, written `backend:model#effort`.
-- An unscored model can be enabled only once it has a "treat like <scored rung>". There is no tool for that: give the user the command to run in a terminal, `catherd catalog treat-like <rung> <scored rung>`, then come back and propose again.
+- Offer only the rungs `catherd catalog list` shows as capable for the role, written `backend:model#effort`.
+- Offer only the indexed pairs `catherd catalog list` shows. A model or effort the Slopalytics index does not list is not offered, and a rung that names one is an error: if the user wants it, say it is not indexed yet and propose the nearest indexed pair. Never pick a worker rung below `#medium`. Use `maxEffort` to keep a model from its highest efforts, and `bars` to move a difficulty's bar for one role, rather than removing rungs.
 
-**Access.** Each role runs `read-only`, `workspace-write` or `full`. The defaults: architect, reviewer and researcher `read-only`; worker, writer and artist `workspace-write`; verifier and UI reviewer `full`. `profile_get` says per role whether its backend holds it to that mode (`enforced`: Codex's sandbox) or only asks (`advisory`: claude-code, opencode and native subagents, where the model can still reach past it). Recommend the defaults; when the user wants a role tighter or looser, say what it can no longer do (a read-only reviewer on claude-code or opencode has no shell, so it cannot run `git diff`) and that `profile_validate` will warn about it. A `workspace-write` role also writes catherd's lock dir and the temp dir, reaches the network, binds loopback ports and talks to a local Docker socket, so it runs its own installs and tests; `roles.<role>.network: false` takes the network, loopback and Docker away from that role (Codex enforces it; claude-code drops its web tools; opencode has no sandbox to enforce it). `catherd doctor` probes each of these per backend.
+**Access.** Each role runs `read-only`, `workspace-write` or `full`. The defaults: architect, reviewer and researcher `read-only`; worker, writer and artist `workspace-write`; verifier and UI reviewer `full`. `profile({ action: "get" })` says per role whether its backend holds it to that mode (`enforced`: Codex's sandbox) or only asks (`advisory`: claude-code, opencode and native subagents, where the model can still reach past it). Recommend the defaults; when the user wants a role tighter or looser, say what it can no longer do (a read-only reviewer on claude-code or opencode has no shell, so it cannot run `git diff`) and that `profile({ action: "validate" })` will warn about it. A `workspace-write` role also writes catherd's lock dir and the temp dir, reaches the network, binds loopback ports and talks to a local Docker socket, so it runs its own installs and tests; `roles.<role>.network: false` takes the network, loopback and Docker away from that role (Codex enforces it; claude-code drops its web tools; opencode has no sandbox to enforce it). `catherd doctor` probes each of these per backend.
 
-**Failover.** `failover` maps a rung to its stand-in when that rung's backend hits a usage limit. A stand-in must be scored and on another quota (Go and Zen bill apart; native `claude` and `claude-code` share the Claude plan). The default profile fails a Codex rung over only to a stand-in that clears the same bars at least as well: Go's GPT-6 Luna for Luna high, and Kimi K3 (its scores borrowed from Sol medium) for Sol medium. Sol high and xhigh have none, so a limit there pauses the lane rather than dropping it a tier. Say so, and offer to change it when they have no Go subscription. `null` removes an entry.
+**Failover.** `failover` maps a rung to its stand-in when that rung's backend hits a usage limit. A stand-in must be indexed, on another quota and at least as intelligent as its rung (Go and Zen bill apart; native `claude` and `claude-code` share the Claude plan). The default profile fails a Codex rung over only to an indexed stand-in at least as intelligent: Go's GPT-6 Luna for Luna high, and Kimi K3 for Sol medium. Sol high and xhigh have none in the profile. Beyond the profile's stand-ins, the daemon moves a unit that hit a limit to the nearest indexed rung, on a free quota, of any backend they have configured that is not weaker (a Claude rung last); when none qualifies, the lane waits for the hold rather than dropping a tier. Say so, and offer to change the profile's stand-ins when they have no Go subscription. `null` removes an entry.
 
 **Budget and timeouts.** `budget` (`minutes`, `tokens`, `usd`) is a soft cap: from 80 % routing starts at the cheapest rung that clears the bar, and at 100 % no new role starts. `timeouts.idleMin` (15) stops a role that has gone quiet, `timeouts.wallMin` (90) one that runs too long; `roles.<role>.timeouts.idleMin` and `wallMin` override them for one role (a verifier with a long gate), and `null` removes the override. `preflight.confirm: true` makes `preflight` show its commands for the user to approve first.
 
-**Notifications and readiness.** `notify` controls milestone, finish and blocked moments through whatever notification facility the host actually exposes; Claude Code may have `PushNotification`. Do not invent a Codex tool or a scheduling promise. Completion uses Claude's peer inbox or Codex's existing native queue (`--remote unix://`); a Codex busy session receives ordered next input after its active turn, not urgent next-tool-round delivery. Queue acceptance proves neither processing nor `result` collection; unloaded/interrupted sessions may retain input. `catherd doctor --host codex` checks capability without sending; only explicit `--test-push` sends a labeled smoke input. Use the orchestration skill's `peek`/`result` recovery and current-owner, exact-event `runs retry-push` decision for ambiguity.
+**Notifications.** `notify` controls the milestone, finish and blocked moments. Where a parked question reaches the owner is `notify.url`, an ntfy topic url: set it with `profile({ action: "set", notify_url })` (ask them for the url; never invent one). The daemon sends to it from the machine, so a question reaches the phone with no session open. `catherd doctor --test-push` sends a labeled test notice.
 
-**Harness isolation.** For each harness they use (`codex`, `claude-code`, `opencode`, `cursor`, `grok`, `antigravity`), offer `harness.<name>.isolated` with its harness line from `runs_summary` (Codex has none: it reports no per-request input, so say there is no figure for it instead of offering one) and this tradeoff: "native keeps your hooks, skills and AGENTS.md; isolated saves ~N tokens per run, but the role loses them." Recommend native. When they have no isolated runs yet, the number is the median first-turn input of their native runs: say that isolation would save some part of it, not all of it. When there are no runs at all, say there is no number yet, and recommend native until there is.
+**Harness isolation.** For each harness they use (`codex`, `claude-code`, `opencode`, `cursor`), offer `harness.<name>.isolated` and this tradeoff: "native keeps your hooks, skills and AGENTS.md; isolated saves some tokens per run, but the role loses them." Recommend native. The session reads no harness line, so quote no number. Codex reports no per-request input, so it has no harness figure (Codex has none: it reports no per-request input).
 
 ## 4. Write it
 
-- Call `profile_set({ repo, patch })` with only what changed; pass `name` only to edit a profile other than the one this repo runs on (a name that does not exist yet starts a new profile from the default one). Lists (`rungs`, `notify`) replace, maps (`billing`, `failover`, `budget`) merge, and `null` removes a key. A key it does not know is refused with `E_INPUT_INVALID`. It validates before it writes:
+- Call `profile({ action: "set", repo, patch })` with only what changed; pass `name` only to edit a profile other than the one this repo runs on (a name that does not exist yet starts a new profile from the default one). Lists (`rungs`, `notify`) replace, maps (`billing`, `failover`, `budget`) merge, and `null` removes a key. A key it does not know is refused with `E_INPUT_INVALID`. It validates before it writes:
   - `saved: false` comes with `errors`, each with a `path`, a `message` and often a `fix`. Explain each in their terms, fix the patch, and propose again.
   - `saved: true` comes with the `diff` (`path`, `before`, `after`) and any `warnings`. Read the diff back to the user, one line per change, and each warning with it.
-- Then call `profile_validate({ repo })`. `errors` block a save: the worker disabled, an enabled role with no usable rung, an unscored rung without a "treat like", a failover stand-in unscored or on the same quota, a backend catherd cannot run. `warnings` do not: an access mode other than the role's default, a model the backend's listing lacks, a stand-in that never runs, a stand-in that scores below its rung ("downgrade"), a Claude stand-in while another plan could stand in ("spends Claude quota"), a ladder whose rung scores below the one before it ("the ladder goes down"). Each has a `fix`; offer it.
+- Then call `profile({ action: "validate", repo })`. `errors` block a save: the worker disabled, an enabled role with no usable rung, a rung or failover stand-in the index does not list ("has no Slopalytics intelligence index"), a failover stand-in on the same quota, a backend catherd cannot run. `warnings` do not: an access mode other than the role's default, a model the backend's listing lacks, a stand-in that never runs, a stand-in less intelligent than its rung ("downgrade"), a Claude stand-in while another plan could stand in ("spends Claude quota"), a ladder whose rung is less intelligent than the one before it ("the ladder goes down"). Each has a `fix`; offer it.
 
 ## 5. Say what applies when
 
-- Codex, claude-code, opencode, Cursor, grok and Antigravity rung and ladder changes apply at the next dispatch, even in a run already under way. Access and isolation are pinned per run when it starts: a run under way keeps them (its `state.md` and `status` name the change) until its orchestrator re-pins it with `run_pin` (`catherd runs pin <run>`). Isolating Cursor needs `CURSOR_API_KEY` in the environment catherd runs in, isolating grok `XAI_API_KEY`, and isolating Antigravity `GEMINI_API_KEY`; `profile_validate` refuses each without. A read-only role (reviewer, architect, researcher) can run on Antigravity only isolated: agy has no read-only mode.
-- For native Claude roles, an agent listed in `newSessionNeededFor` applies from the next Claude Code session: Claude Code reads agent files when a session starts. Other Claude changes apply now. `record_agent_run` accounts only for native Claude Agent results on Claude Code; process records are automatic.
+- Rung and ladder changes apply at the next dispatch, even in a run already under way. Access and isolation are pinned per run when it starts: a run under way keeps them until it is re-pinned (`catherd runs pin <run>`). Isolating Cursor needs `CURSOR_API_KEY` in the environment catherd runs in; `profile` validation refuses it without.
+- Every role runs headless, so no agent file needs a new session: a change applies at the next dispatch. `newSessionNeededFor` stays empty unless a native Claude agent file is linked.
 - ProfileService manages Claude agent files/links only when native Claude roles are used. Codex-only setup and profile operations do not write under `~/.claude`; Claude CLI/login is needed only by an enabled selected role or reachable failover that uses it. Editing an inactive Claude-dependent profile writes its managed files but links none; they apply once active or repo-bound. Keep role-disabled, access, isolation, budget and failover choices intact.

package/src/adapters/all.ts

@@ -1,8 +1,6 @@
-import { antigravityAdapter } from "./antigravity/index.ts";
 import { claudeCodeAdapter } from "./claude-code/index.ts";
 import { codexAdapter } from "./codex/index.ts";
 import { cursorAdapter } from "./cursor/index.ts";
-import { grokAdapter } from "./grok/index.ts";
 import { opencodeAdapter } from "./opencode/index.ts";
 import { registerAdapter } from "./registry.ts";
 
@@ -10,5 +8,3 @@ registerAdapter(codexAdapter);
 registerAdapter(claudeCodeAdapter);
 registerAdapter(opencodeAdapter);
 registerAdapter(cursorAdapter);
-registerAdapter(grokAdapter);
-registerAdapter(antigravityAdapter);

package/src/adapters/backend.ts

@@ -179,8 +179,7 @@ export interface BackendAdapter {
    */
   isolationKey?: string;
   /**
-   * Spec 1.3 §9 Q2: the access modes this backend holds a role to only when isolated (agy has no read-only flag;
-   * its deny rules live in the settings catherd writes in its own home). A native role at one does not validate.
+   * Spec 1.3 §9 Q2: the access modes this backend holds a role to only when isolated (one with no read-only flag). A native role at one does not validate.
    */
   isolatedOnly?: Access[];
   /** Spec 1.3 §6.6: the plan quota left, in the CLI's words, read without spending a model turn (doctor's row). */

package/src/adapters/cursor/home.ts

@@ -18,7 +18,7 @@ export const isolatedCursorHome = (access: Access, network = true): string =>
 
 /**
  * The env of an isolated run: the moved HOME (the only thing that stops Cursor's hard-coded `~/.claude`,
- * `~/.codex`, `~/.grok` and `~/.agents` reads, research §2.8), and Cursor's config and data dirs inside it, so a
+ * `~/.codex` and `~/.agents` reads, research §2.8), and Cursor's config and data dirs inside it, so a
  * CURSOR_CONFIG_DIR or XDG_CONFIG_HOME of the user's cannot point it back. Its credentials stay in memory: on
  * macOS Cursor otherwise saves the CURSOR_API_KEY login to the moved HOME's keychain, which does not exist, and
  * the failed `security` call raises a "Keychain Not Found" dialog.

package/src/adapters/cursor/index.ts

@@ -39,7 +39,7 @@ export { isolatedCursorHome, isolatedCursorRoot } from "./home.ts";
 export const CURSOR_MIN_VERSION = "2026.09.28";
 export const CURSOR_INSTALL = "curl https://cursor.com/install -fsS | bash";
 const THREAD = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** Cursor's versions are a date and a hash (`2026.09.28-64d2043`); grok's `agent` prints `grok 1.0.44 (…)`. */
+/** Cursor's versions are a date and a hash (`2026.09.28-64d2043`). */
 const CURSOR_VERSION = /^\s*\d{4}\.\d{1,2}\.\d{1,2}-[0-9a-f]+\b/;
 const DAY_MS = 24 * 60 * 60_000;
 const LOGIN_FIX = "cursor-agent login, or export CURSOR_API_KEY=<key>";
@@ -50,7 +50,7 @@ export const cursorShell = { timeoutMs: 15_000 };
 const which = (bin: string): string | null => Bun.which(bin, { PATH: process.env.PATH ?? "" });
 
 /**
- * Spec 1.3 §4.1: `cursor-agent` first. The installers of Cursor and grok both link `agent` (research §2.1,
+ * Spec 1.3 §4.1: `cursor-agent` first. Another CLI's installer may also link `agent` (research §2.1,
  * §3.1), so `agent` is taken only when `cursor-agent` is missing, and the probe checks what it is.
  */
 export function cursorBin(): "cursor-agent" | "agent" {
@@ -101,7 +101,7 @@ function plan(r: RunRequest): SpawnPlan {
 
 async function listModels(): Promise<DiscoveredModel[]> {
   const bin = cursorBin();
-  // an `agent` that is not Cursor's (grok's, say) is never asked for models: nothing to list, as when absent
+  // an `agent` that is not Cursor's (another CLI's) is never asked for models: nothing to list, as when absent
   if (bin === "agent") {
     const v = await runCli(bin, ["--version"], cursorShell).catch(() => null);
     if (!v || !CURSOR_VERSION.test(v.out)) return [];
@@ -219,7 +219,7 @@ async function probe(): Promise<Probe> {
   try {
     v = await runCli(bin, ["--version"], cursorShell);
   } catch (e) {
-    // an `agent` that is not Cursor's may not even run here (the owner's is a Linux grok, research §3.1)
+    // an `agent` that is not Cursor's may not even run here (a Linux build on macOS, research §3.1)
     if (bin === "agent") v = { ok: false, out: "", err: String(e) };
     else throw e;
   }

package/src/cli.ts

@@ -20,29 +20,23 @@ const { VERSION } = await import("./infra/version.ts");
 
 type Command = ReturnType<typeof defineCommand>;
 
-/** The dashboard's flags, typed as any command's args so `main` stays a plain `Command`. */
-const dashboardArgs: ArgsDef = {
-  ...HOST_ARG,
-  plain: {
-    type: "boolean",
-    description: "the dashboard in ASCII without colour (NO_COLOR also drops colour)",
-  },
-  "reduced-motion": { type: "boolean", description: "the dashboard without animation" },
-};
+/** HOST_ARG typed as any command's args, so `main` stays a plain `Command`. */
+const MAIN_ARGS: ArgsDef = HOST_ARG;
 
 /**
- * Spec §8. Every subcommand loads lazily, so `mcp`, `lock` and `_supervise` never load OpenTUI or React
- * (spec §3.1); a bare `catherd` opens the TUI.
+ * Spec §8. Every subcommand loads lazily, so `mcp`, `lock` and `_supervise` never load the panel (spec §3.1);
+ * a bare `catherd` runs `catherd panel`.
  */
 export const main: Command = defineCommand({
   meta: {
     name: "catherd",
     version: VERSION,
-    description: "Herds coding agents",
+    description: "Herds coding agents. catherd (or catherd panel) opens the panel in your browser.",
   },
-  args: dashboardArgs,
+  args: MAIN_ARGS,
   subCommands: {
     init: () => import("./entry/init-command.ts").then((m) => m.initCommand),
+    panel: () => import("./entry/panel-command.ts").then((m) => m.panelCommand),
     status: () => import("./entry/runs-command.ts").then((m) => m.statusCommand),
     watch: () => import("./entry/runs-command.ts").then((m) => m.watchCommand),
     runs: () => import("./entry/runs-command.ts").then((m) => m.runsCommand),
@@ -54,18 +48,15 @@ export const main: Command = defineCommand({
     lock: () => import("./entry/lock-command.ts").then((m) => m.lockCommand),
     "run-file": () => import("./entry/role-cli-command.ts").then((m) => m.runFileCommand),
     gate: () => import("./entry/role-cli-command.ts").then((m) => m.gateCommand),
+    answer: () => import("./entry/answer-command.ts").then((m) => m.answerCommand),
     pause: () => import("./entry/pause-command.ts").then((m) => m.pauseCommand),
     resume: () => import("./entry/pause-command.ts").then((m) => m.resumeCommand),
     "capture-fixtures": () =>
       import("./entry/capture-fixtures-command.ts").then((m) => m.captureFixturesCommand),
+    scorecard: () => import("./entry/scorecard-command.ts").then((m) => m.scorecardCommand),
     mcp: () => import("./entry/mcp/command.ts").then((m) => m.mcpCommand),
     _supervise: () => import("./entry/supervise-command.ts").then((m) => m.superviseCommand),
   },
-  // citty runs this after any subcommand too; only a bare `catherd` loads and opens the dashboard
-  async run(ctx) {
-    if (ctx.args._.length > 0) return;
-    await (await import("./entry/tui/run.tsx")).tuiRun(ctx);
-  },
 });
 
 const resolve = async <T>(v: T | Promise<T> | (() => T | Promise<T>)): Promise<T> =>
@@ -141,13 +132,10 @@ export async function runCli(argv: string[]): Promise<number> {
     return EXIT.ok;
   }
   try {
-    const command = parseArgs(own, dashboardArgs)._[0];
-    // a bare `catherd` opens the dashboard, which takes only its own flags: a typo is not a terminal problem
+    const command = parseArgs(own, HOST_ARG)._[0];
+    // a bare `catherd` takes only --host: a typo is a usage error
     const flag = (a: string) => (a.startsWith("--") ? (a.slice(2).split("=")[0] ?? "") : "");
-    // citty negates a boolean as `--no-<name>`
-    const known = (name: string) =>
-      Object.hasOwn(dashboardArgs, name) ||
-      (name.startsWith("no-") && dashboardArgs[name.slice(3)]?.type === "boolean");
+    const known = (name: string) => Object.hasOwn(HOST_ARG, name);
     const unknown =
       command === undefined
         ? own.find((a, i) => a.startsWith("-") && !known(flag(a)) && own[i - 1] !== "--host")
@@ -157,9 +145,11 @@ export async function runCli(argv: string[]): Promise<number> {
       return EXIT.usage;
     }
     // `lock` forwards signals to its command itself; everything else stops at once on Ctrl-C. The command is
-    // the first word that is not a flag: `catherd --plain lock -- …` is `lock` too.
-    if (command !== "lock") process.once("SIGINT", () => process.exit(EXIT.interrupted));
-    const parsed = parseArgs(own, dashboardArgs);
+    // the first word that is not a flag: `catherd --host codex lock -- …` is `lock` too.
+    // the panel stops itself on Ctrl-C
+    if (command !== "lock" && command !== undefined)
+      process.once("SIGINT", () => process.exit(EXIT.interrupted));
+    const parsed = parseArgs(own, HOST_ARG);
     if (parsed.host !== undefined) {
       const forwarded = own.filter(
         (a, i) => a !== "--host" && own[i - 1] !== "--host" && !a.startsWith("--host="),
@@ -173,6 +163,11 @@ export async function runCli(argv: string[]): Promise<number> {
         ...(dashdash < 0 ? [] : argv.slice(dashdash)),
       );
     }
+    if (command === undefined) {
+      const { runPanel } = await import("./entry/panel-command.ts");
+      await runPanel({ port: 4317, open: true, host: parsed.host });
+      return EXIT.ok;
+    }
     await runCommand(main, { rawArgs });
     return Number(process.exitCode ?? EXIT.ok);
   } catch (e) {

package/src/domain/bars.ts

@@ -1,36 +1,33 @@
-import { type Dim, DIMS, type Score } from "./catalog.ts";
-import { DIFFICULTIES, type Difficulty, KINDS, type Kind } from "./lane.ts";
-
-/**
- * Spec 1.2 §5.1: the dimensions each kind's default bars span, for Track A (`copy`, `build`) and Track B
- * (`logic`, `hard`). `steer` has no default bar: it is shown, and a user may set one.
- */
-export const DEFAULT_BAR_DIMS: Record<Kind, { A: Dim[]; B: Dim[] }> = {
-  repo_code: { A: ["repo_code"], B: ["repo_code", "honesty", "agentic"] },
-  terminal: { A: ["terminal"], B: ["terminal", "honesty", "agentic"] },
-  ui: { A: ["frontend", "repo_code"], B: ["frontend", "repo_code", "honesty", "agentic"] },
-  prose: { A: ["repo_code"], B: ["repo_code", "honesty"] },
-  research: { A: ["repo_code"], B: ["repo_code", "honesty"] },
-};
-
-/** The dimensions a difficulty's default bar spans for a kind. */
-export const barDimsOf = (kind: Kind, d: Difficulty): Dim[] =>
-  d === "copy" || d === "build" ? DEFAULT_BAR_DIMS[kind].A : DEFAULT_BAR_DIMS[kind].B;
-
-/** Every dimension some default bar uses: the values an enabled rung needs (spec 1.2 §6.1). */
-export const BAR_DIMS: Dim[] = DIMS.filter((d) =>
-  KINDS.some((k) => DIFFICULTIES.some((x) => barDimsOf(k, x).includes(d))),
-);
-
-/** Spec 1.2 §5.2: the percentile of the scored rungs each difficulty's threshold sits at. */
-export const BAR_PERCENTILE: Record<Difficulty, number> = { copy: 25, build: 50, logic: 60, hard: 75 };
-
-const PERCENTILE_WORD: Record<Difficulty, string> = {
-  copy: "the 25th percentile",
-  build: "the median",
-  logic: "the 60th percentile",
-  hard: "the 75th percentile",
-};
+import { z } from "zod";
+import type { Catalog } from "./catalog.ts";
+import { DIFFICULTIES, type Difficulty } from "./lane.ts";
+
+/** The percentile of the shipped models' intelligences each difficulty's bar sits at. */
+export const BAR_PERCENTILE: Record<Difficulty, number> = { copy: 20, build: 45, logic: 60, hard: 65 };
+
+/** A profile's or a role's own percentiles (0 to 100), one difficulty at a time; a difficulty left out keeps its shipped percentile. */
+export const BarsSchema = z.partialRecord(z.enum(DIFFICULTIES), z.number().min(0).max(100));
+export type Bars = z.infer<typeof BarsSchema>;
+
+/** The percentiles in force as stored: the shipped ones, with `p.bars` laid over them; they may decrease. */
+export const effectiveBars = (p: { bars?: Bars }): Record<Difficulty, number> => ({
+  ...BAR_PERCENTILE,
+  ...p.bars,
+});
+
+/** Each pair `[easier, harder]` of neighbouring difficulties whose percentile goes down. */
+export const barInversions = (at: Record<Difficulty, number>): [Difficulty, Difficulty][] =>
+  DIFFICULTIES.slice(1).flatMap((d, i): [Difficulty, Difficulty][] =>
+    at[d] < at[DIFFICULTIES[i] as Difficulty] ? [[DIFFICULTIES[i] as Difficulty, d]] : [],
+  );
+
+/** The percentiles a route reads: the effective ones made non-decreasing, so a harder lane never routes weaker. */
+export function percentilesOf(p: { bars?: Bars }): Record<Difficulty, number> {
+  const at = effectiveBars(p);
+  let floor = 0;
+  for (const d of DIFFICULTIES) at[d] = floor = Math.max(at[d], floor);
+  return at;
+}
 
 /** The `p`th percentile of `xs`, interpolated linearly between the closest ranks; NaN for none. */
 export function percentile(xs: readonly number[], p: number): number {
@@ -42,78 +39,7 @@ export function percentile(xs: readonly number[], p: number): number {
   return (s[lo] as number) + ((s[hi] as number) - (s[lo] as number)) * (pos - lo);
 }
 
-/**
- * Spec 1.2 §5.2 "measured or better": a value published for this exact rung in the anchor's unit. That is a
- * `verified` or `measured` value, and a hand-typed `secondary` one (no `source`: the 1.0 word for a value
- * published by someone other than the vendor, which is 1.2's `measured`). Plan 14 Ruling 1.
- */
-export const measuredOrBetter = (s: Score): boolean =>
-  s.confidence === "verified" ||
-  s.confidence === "measured" ||
-  (s.confidence === "secondary" && s.source === undefined);
-
-/** Each dimension's values that bars are derived from: one per canonical rung, measured or better. */
-export function barPool(scores: readonly Score[]): Record<Dim, number[]> {
-  const out = Object.fromEntries(DIMS.map((d) => [d, [] as number[]])) as Record<Dim, number[]>;
-  const seen = new Set<string>();
-  for (const s of scores) {
-    const key = `${s.rung} ${s.dim}`;
-    if (!measuredOrBetter(s) || seen.has(key)) continue;
-    seen.add(key);
-    out[s.dim].push(s.value);
-  }
-  return out;
-}
-
-/** A bar value, kept to four significant digits (DeepSWE 60.95, an Arena rating 1668, agentic 0.08622). */
-const tidy = (v: number): number => Number(v.toPrecision(4));
-
-export type Bars = Record<Kind, Record<Difficulty, Partial<Record<Dim, number>>>>;
-/** `scores.json` `barsWhy`: per dimension and difficulty, where its threshold came from. */
-export type BarsWhy = Partial<Record<Dim, Partial<Record<Difficulty, string>>>>;
-
-/**
- * Spec 1.2 §5.1–§5.2: the default bars. Each dimension's threshold at a difficulty is that difficulty's
- * percentile of the pool (`barPool`), the same in every kind whose bar spans the dimension. A dimension with
- * no pooled value gets no threshold (and a `barsWhy` line saying so). `benchmark` names each dimension's unit
- * and `date` the day the data was read.
- */
-export function deriveBars(
-  pool: Record<Dim, number[]>,
-  benchmark: (d: Dim) => string,
-  date: string,
-): { bars: Bars; barsWhy: BarsWhy } {
-  const value: Partial<Record<Dim, Partial<Record<Difficulty, number>>>> = {};
-  const barsWhy: BarsWhy = {};
-  for (const dim of BAR_DIMS)
-    for (const d of DIFFICULTIES) {
-      if (!KINDS.some((k) => barDimsOf(k, d).includes(dim))) continue;
-      const xs = pool[dim];
-      const why = (barsWhy[dim] ??= {});
-      if (xs.length === 0) {
-        why[d] = `no rung is measured or better on ${benchmark(dim)} (${date}): no threshold`;
-        continue;
-      }
-      const v = tidy(percentile(xs, BAR_PERCENTILE[d]));
-      (value[dim] ??= {})[d] = v;
-      why[d] =
-        `${PERCENTILE_WORD[d]} of ${xs.length} rungs measured or better on ${benchmark(dim)} (${date}): ${v}`;
-    }
-  const bars = Object.fromEntries(
-    KINDS.map((k) => [
-      k,
-      Object.fromEntries(
-        DIFFICULTIES.map((d) => [
-          d,
-          Object.fromEntries(
-            barDimsOf(k, d).flatMap((dim) => {
-              const v = value[dim]?.[d];
-              return v === undefined ? [] : [[dim, v]];
-            }),
-          ),
-        ]),
-      ),
-    ]),
-  ) as Bars;
-  return { bars, barsWhy };
+/** A difficulty's bar: an intelligence percentile of the catalog's pool, 0 when there is no index. */
+export function barOf(c: Catalog, d: Difficulty, at: Record<Difficulty, number> = BAR_PERCENTILE): number {
+  return c.pool.length === 0 ? 0 : percentile(c.pool, at[d]);
 }

package/src/domain/blocked.ts

@@ -0,0 +1,72 @@
+/** Why a role stopped without finishing (spec 2.0 decision 3); the machine maps each to a transition. */
+export const BLOCKED_REASONS = [
+  "needs_user",
+  "too_hard",
+  "provider_error",
+  "no_access",
+  "check_broken",
+  "out_of_scope",
+] as const;
+export type BlockedReason = (typeof BLOCKED_REASONS)[number];
+
+export type StopAction = "climb" | "failover" | "park" | "wait";
+
+/** What the machine does with each reason (spec 2.0 decision 8): climb, retry then fail over, park, or wait. */
+export const REASON_ACTION: Readonly<Record<BlockedReason, StopAction>> = {
+  needs_user: "park",
+  too_hard: "climb",
+  provider_error: "failover",
+  no_access: "park",
+  check_broken: "wait",
+  out_of_scope: "park",
+};
+
+const REASON_AT_START = /^[`*\s]*([a-z][a-z_-]*)[`*]*\s*(?:[:—–-]\s*)?([\s\S]*)$/i;
+
+/** The reason a `STATUS: blocked — <reason>: <why>` line names, and its why; null when it names none. */
+export function parseBlockedReason(why: string | null): { reason: BlockedReason; why: string } | null {
+  const m = why === null ? null : REASON_AT_START.exec(why.trim());
+  if (!m) return null;
+  const word = (m[1] as string).toLowerCase().replace(/-/g, "_");
+  const reason = BLOCKED_REASONS.find((r) => r === word);
+  return reason ? { reason, why: (m[2] ?? "").trim() } : null;
+}
+
+/** The reply contract's blocked line, ported from t3herd `prompts/_no_questions.md`. */
+export const BLOCKED_LINE = `Nobody reads your thread until you finish: never ask a question and never wait for an answer. When you cannot finish, leave the finished work in place, say what is left, and end with STATUS: blocked — <reason>: <why>, where <reason> is one of: ${[
+  "needs_user (only the user can decide; <why> is the question)",
+  "too_hard (you tried and cannot solve it; a stronger model should)",
+  "provider_error (your model, tools or sandbox failed)",
+  "no_access (you cannot reach what you need: the running app, a service, credentials)",
+  "check_broken (the check cannot pass for a reason outside your task; name each failing file:line)",
+  "out_of_scope (the task needs changes outside the files you own)",
+].join(", ")}.`;
+
+const ANSI = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+
+/** An `Owns:` entry as a path: cut at the first glob, trailing slashes dropped. */
+const pathOf = (entry: string): string => entry.replace(/[*?[{].*$/, "").replace(/\/+$/, "");
+
+/**
+ * The sibling `Owns:` entries a failed check blames, or [] when it blames none, or also blames one of the lane's
+ * own. Output names a file by its tail (`pkg/x.go:3`, `src/a.tsx(4,2)`), so a sibling's entry counts from two
+ * path segments, and an own entry already from its base name (t3herd `foreignFailure`).
+ */
+export function foreignFailure(log: string, own: string[], siblings: string[]): string[] {
+  const lines = log
+    .replace(ANSI, "")
+    .split("\n")
+    .filter((l) => !/^\s*(✓|ok\s|PASS\b)/.test(l));
+  const named = (p: string, min: number): boolean => {
+    const parts = p.split("/");
+    for (let i = 0; i <= parts.length - min; i++) {
+      const tail = parts.slice(i).join("/");
+      if (lines.some((l) => l.includes(tail))) return true;
+    }
+    return false;
+  };
+  const mine = own.map(pathOf).filter(Boolean);
+  if (mine.some((f) => named(f, 1))) return [];
+  const theirs = siblings.map(pathOf).filter((f) => f && !mine.includes(f));
+  return [...new Set(theirs.filter((f) => named(f, Math.min(2, f.split("/").length))))];
+}

package/src/domain/branch.ts

@@ -0,0 +1,51 @@
+import { headerLine } from "./lane.ts";
+import { slug } from "./util.ts";
+import { BaseRefSchema } from "./workspace.ts";
+
+/** The run title as a folder and branch stem: at most 40 characters, `run` when nothing is left. */
+export const runSlug = (title: string): string => slug(title).slice(0, 40) || "run";
+
+/** A milestone's branch: the run's slug and the milestone, lower case (`wallet-split-m1`). */
+export const milestoneBranch = (title: string, m: string): string => `${runSlug(title)}-${m.toLowerCase()}`;
+
+/** A branch on origin as `run_start`'s base: a plain name, never a remote ref (`origin/…`) or a full ref. */
+export const BaseBranchSchema = BaseRefSchema.refine(
+  (s) => !s.startsWith("origin/") && !s.startsWith("refs/"),
+);
+
+/**
+ * The `Setup:` command in the lines right under plan.md's `# ` title, up to the first blank line or heading
+ * (backticks stripped); null without one. A blank line after the title ends the header, so body prose never counts.
+ */
+export function planSetup(planText: string): string | null {
+  const lines = planText.split("\n");
+  const start = lines.findIndex((l) => /^#\s+/.test(l)) + 1;
+  let end = start;
+  while (end < lines.length && (lines[end] ?? "").trim() !== "" && !(lines[end] ?? "").startsWith("#")) end++;
+  const re = headerLine("setup");
+  for (const line of lines.slice(start, end)) {
+    const m = re.exec(line);
+    if (m)
+      return (
+        (m[1] ?? "")
+          .trim()
+          .replace(/^`+|`+$/g, "")
+          .trim() || null
+      );
+  }
+  return null;
+}
+
+/** Whether the owner's answer to a landed milestone's question is the word that has catherd push its branch. */
+export const isPushAnswer = (answer: string): boolean => answer.trim().toLowerCase() === "push";
+
+/** The command that opens a milestone's MR, for the origin's host: gh on github.com, else glab. */
+export function mrCommand(o: { originUrl: string; base: string; branch: string; body: string }): string {
+  return /(^|[@/.])github\.com[:/]/.test(o.originUrl)
+    ? `gh pr create --base ${o.base} --head ${o.branch} --body-file ${o.body}`
+    : `glab mr create --source-branch ${o.branch} --target-branch ${o.base} --description-file ${o.body}`;
+}
+
+/** The milestone a unit (`run`, `M1`, `M1.L2`) belongs to; null for the run itself. */
+export const unitMilestone = (unit: string): string | null =>
+  unit === "run" ? null : (unit.split(".")[0] ?? null);