devcouncil 0.3.1 → 0.4.1

package/src/devcouncil/cli/commands/check.py

@@ -10,9 +10,11 @@ from the stated intent and runs them as evidence.
 from __future__ import annotations
 
 import asyncio
-import json
+from devcouncil.utils.json_persist import dump_json
 import logging
-import subprocess
+import os
+import time
+from datetime import datetime
 from pathlib import Path
 
 import typer
@@ -27,8 +29,14 @@ from devcouncil.integrations.github_intent import resolve_goal_intent
 from devcouncil.llm.provider import ProviderRequestError, create_provider, validate_model_provider
 from devcouncil.llm.router import ModelRouter, StructuredOutputError
 from devcouncil.verification.ad_hoc_check import AdHocCheckResult, run_working_tree_check
+from devcouncil.verification.gate_cache import GateResultCache
+from devcouncil.verification.incremental_check import (
+    run_incremental_gates,
+    selected_gate_specs,
+)
 from devcouncil.verification.implementation_reviewer import ImplementationReviewer
 from devcouncil.verification.verifier import Verifier
+from devcouncil.telemetry.stages import log_stage, log_step
 
 console = Console()
 logger = logging.getLogger(__name__)
@@ -37,12 +45,9 @@ logger = logging.getLogger(__name__)
 def _diff(root: Path, base: str | None) -> str:
     if not base:
         return Verifier(root).get_diff()
-    try:
-        return subprocess.check_output(
-            ["git", "diff", base, "--"], cwd=root, text=True, encoding="utf-8", errors="replace"
-        )
-    except Exception:
-        return ""
+    from devcouncil.utils.proc import git_output
+
+    return git_output(["diff", base, "--"], cwd=root, default="")
 
 
 def check(
@@ -50,8 +55,11 @@ def check(
     base: str | None = typer.Option(None, "--base", help="Diff against this git ref instead of the uncommitted working tree."),
     test_commands: list[str] | None = typer.Option(None, "--test", "-t", help="A verification command proving the change works (repeatable). Switches to the deterministic evidence gate."),
     verify: bool = typer.Option(False, "--verify", help="Run the deterministic evidence gate (orphan-diff, acceptance evidence, diff↔coverage, next actions) instead of the LLM audit. No provider keys needed."),
+    watch: bool = typer.Option(False, "--watch", help="Keep watching the project tree and re-run the deterministic evidence gate on every change (implies --verify). Prints one compact verdict line per run; Ctrl-C to stop."),
+    list_gates: bool = typer.Option(False, "--list-gates", help="Preview which incremental stack gates would run for the current working-tree changes (no execution)."),
     enforce_coverage: bool = typer.Option(False, "--enforce-coverage", help="Evidence gate: block when the tests do not exercise the changed lines."),
     min_coverage: float = typer.Option(0.0, "--min-coverage", help="Evidence gate: minimum fraction of changed lines that must be exercised (implies --enforce-coverage)."),
+    persist: bool = typer.Option(False, "--persist", help="Evidence gate: persist gaps/evidence for dev report (typical in CI)."),
     json_format: bool = typer.Option(False, "--json", help="Machine-readable output."),
     project_root: Path = typer.Option(Path("."), "--project-root", help="Repository root."),
 ):
@@ -59,8 +67,66 @@ def check(
     root = project_root.expanduser().resolve()
     from devcouncil.telemetry.logging_setup import set_log_dir
     set_log_dir(root)
+    logger.info(
+        "dev check: verify=%s goal=%s base=%s watch=%s list_gates=%s",
+        verify, bool(goal), base or "working-tree", watch, list_gates,
+    )
     initialize_project(root, quiet=True)
 
+    with log_stage("check", project_root=root, verify=verify):
+        if list_gates:
+            _list_gates(root, test_commands, json_format)
+            return
+        _run_check_body(
+            root, goal, base, test_commands, verify, enforce_coverage,
+            min_coverage, json_format, watch, persist,
+        )
+
+
+def _list_gates(root: Path, test_commands: list[str] | None, json_format: bool) -> None:
+    """Dry-run: show incremental gates for the current working-tree diff."""
+    from devcouncil.verification.incremental_check import (
+        _default_changed_files,
+        _default_commands,
+    )
+
+    changed = _default_changed_files(root)
+    cmds = _default_commands(root)
+    if test_commands:
+        cmds = {**cmds, "test": list(cmds.get("test") or []) + list(test_commands)}
+    gates = selected_gate_specs(root, changed, commands=cmds, narrow=True)
+    payload = {
+        "changed_files": changed,
+        "gates": [
+            {
+                "name": g.name,
+                "kind": g.kind,
+                "command": list(g.command),
+                "narrowed": g.narrowed,
+            }
+            for g in gates
+        ],
+    }
+    if json_format:
+        typer.echo(dump_json(payload, indent=2))
+        return
+    if not changed:
+        console.print("[dim]No working-tree changes — no gates selected.[/dim]")
+        return
+    if not gates:
+        console.print(f"[dim]{len(changed)} changed file(s), no matching stack gates.[/dim]")
+        return
+    console.print(f"[bold]{len(gates)}[/bold] gate(s) for {len(changed)} changed file(s):")
+    for g in gates:
+        narrow = " [narrowed]" if g.narrowed else ""
+        console.print(f"  • {g.kind}/{g.name}{narrow}: {' '.join(g.command)}")
+
+
+def _run_check_body(
+    root, goal, base, test_commands, verify, enforce_coverage, min_coverage, json_format, watch, persist,
+):
+    log_step("check/1: resolving diff scope", project_root=root, trace=True)
+
     # A --goal of "#142" or a GitHub issue/PR URL is a reference, not a spec —
     # expand it into the issue/PR title + body so acceptance checks and the review
     # are grounded in the real intent (same behavior as `dev go`).
@@ -70,6 +136,20 @@ def check(
             console.print(f"[dim]{intent_note}[/dim]")
         goal = expanded_goal
 
+    # Watch mode: run the deterministic gate, then re-run it whenever the project tree
+    # changes, printing one compact verdict line per run. Implies --verify — looping the
+    # LLM audit would burn provider tokens on every save.
+    if watch:
+        if json_format:
+            raise typer.BadParameter("--watch is interactive; it cannot be combined with --json.")
+        _watch_gate(
+            root, goal,
+            test_commands=list(test_commands or []),
+            enforce_coverage=enforce_coverage,
+            min_coverage=min_coverage,
+        )
+        return
+
     # Evidence-gate mode: deterministic verification of the working-tree diff against an
     # inline requirement (--goal), with the diff↔coverage gate and the typed next-actions
     # contract. Provider-key-free — this is the lite path that lets you taste the gate.
@@ -77,16 +157,19 @@ def check(
         result = run_working_tree_check(
             root,
             goal,
+            base=base,
             test_commands=list(test_commands or []),
             enforce_coverage=enforce_coverage,
             min_ratio=min_coverage,
+            persist=persist,
         )
         if json_format:
-            typer.echo(json.dumps(result.to_dict(), indent=2))
+            typer.echo(dump_json(result.to_dict(), indent=2))
         else:
             _render_gate(result)
         raise typer.Exit(code=0 if result.passed else 1)
 
+    log_step("check/2: running LLM audit", project_root=root)
     verifier = Verifier(root)
 
     logger.info("dev check (LLM audit): base=%s goal=%s", base or "working-tree", "set" if goal else "none")
@@ -94,7 +177,7 @@ def check(
     if not diff.strip():
         logger.info("dev check: clean working tree; nothing to audit")
         msg = "No changes to check (clean working tree)."
-        typer.echo(json.dumps({"ok": True, "message": msg}) if json_format else msg)
+        typer.echo(dump_json({"ok": True, "message": msg}) if json_format else msg)
         return
 
     changed_files = verifier.get_changed_files()
@@ -136,7 +219,7 @@ def check(
     logger.info("dev check audit complete: %d secret finding(s), %d review finding(s)", len(secret_gaps), len(findings))
 
     if json_format:
-        typer.echo(json.dumps({
+        typer.echo(dump_json({
             "ok": not secret_gaps,
             "changed_files": changed_files,
             "secret_findings": [g.model_dump() for g in secret_gaps],
@@ -180,12 +263,15 @@ def check(
         "[dim]Tip: `dev check --verify --test \"<cmd>\"` runs the deterministic evidence gate "
         "(no provider keys).[/dim]"
     )
+    log_step("check/complete", project_root=root, trace=True)
 
 
 def _render_gate(result: AdHocCheckResult) -> None:
     """Render the deterministic evidence-gate result for humans."""
     if result.reason == "no_changes":
-        console.print("[yellow]No working-tree changes to verify. Make a change first, then re-run.[/yellow]")
+        console.print(
+            "[yellow]No changes to verify. Make a change or pass --base for PR-scoped diff.[/yellow]"
+        )
         return
 
     console.print(f"[bold]Checking:[/bold] {result.requirement}")
@@ -218,3 +304,130 @@ def _render_gate(result: AdHocCheckResult) -> None:
         console.print("\n[green]Verified with non-blocking signals only.[/green]")
     else:
         console.print("\n[red]Not verified: blocking gaps must be resolved.[/red]")
+
+
+# --watch plumbing. execution/fs_watcher.FilesystemWatcher was considered and rejected:
+# it exists to ATTRIBUTE changes to a leased task (needs a task_id; records file-change
+# events and orphan-diff gaps in the DB through the policy engine), not to signal
+# "something changed". A 2s mtime scan plus a short settle debounce is the genuinely
+# simpler fit here — no watchdog dependency, identical behavior on every platform.
+_WATCH_IGNORED_DIRS = frozenset({
+    ".git", ".hg", ".svn", ".devcouncil", "__pycache__", ".pytest_cache", ".mypy_cache",
+    ".ruff_cache", "node_modules", "dist", "build", "target", ".venv", "venv", ".tox",
+    ".idea", ".vscode",
+})
+_WATCH_POLL_SECONDS = 2.0
+_WATCH_DEBOUNCE_SECONDS = 1.5
+
+
+def _watch_snapshot(root: Path) -> dict:
+    """One cheap pass over the tree: ``{path: mtime_ns}`` for non-ignored files."""
+    snapshot: dict = {}
+    stack = [str(root)]
+    while stack:
+        directory = stack.pop()
+        try:
+            with os.scandir(directory) as entries:
+                for entry in entries:
+                    try:
+                        if entry.is_dir(follow_symlinks=False):
+                            if entry.name not in _WATCH_IGNORED_DIRS:
+                                stack.append(entry.path)
+                        elif entry.is_file(follow_symlinks=False):
+                            snapshot[entry.path] = entry.stat(follow_symlinks=False).st_mtime_ns
+                    except OSError:
+                        continue
+        except OSError:
+            continue
+    return snapshot
+
+
+def _watch_evidence_once(root: Path, goal, test_commands, enforce_coverage, min_coverage, stamp) -> None:
+    """Full deterministic evidence gate — the fallback when no stack gate applies."""
+    try:
+        result = run_working_tree_check(
+            root, goal,
+            test_commands=test_commands,
+            enforce_coverage=enforce_coverage,
+            min_ratio=min_coverage,
+        )
+    except Exception as exc:  # keep watching through transient failures (git hiccups, ...)
+        logger.warning("dev check --watch: run failed: %s", exc)
+        console.print(f"[dim]{stamp}[/dim] [red]ERROR[/red] — {str(exc)[:120]}")
+        return
+    verdict = "[green]PASS[/green]" if result.passed else "[red]FAIL[/red]"
+    blocking = len([g for g in result.gaps if g.blocking])
+    detail = f"{len(result.gaps)} gap(s)" + (f", {blocking} blocking" if blocking else "")
+    if result.reason == "no_changes":
+        detail = "no working-tree changes"
+    console.print(f"[dim]{stamp}[/dim] {verdict} — {detail} [dim](evidence gate)[/dim]")
+
+
+def _watch_gate_once(root: Path, goal, test_commands, enforce_coverage, min_coverage, cache) -> None:
+    """Run the incremental gate once and print a compact one-line verdict.
+
+    Only the gates whose inputs actually changed are executed; the rest are served from
+    the content-hash cache, so iterative edits stay sub-second. When no stack-relevant
+    gate is configured for the change, fall back to the full evidence gate so the user
+    still gets orphan/secret/coverage feedback."""
+    stamp = datetime.now().strftime("%H:%M:%S")
+    try:
+        result = run_incremental_gates(
+            root, extra_test_commands=test_commands, cache=cache,
+        )
+    except Exception as exc:  # keep watching through transient failures (git hiccups, ...)
+        logger.warning("dev check --watch: incremental run failed: %s", exc)
+        console.print(f"[dim]{stamp}[/dim] [red]ERROR[/red] — {str(exc)[:120]}")
+        return
+
+    if result.no_changes:
+        console.print(f"[dim]{stamp}[/dim] [dim]— no working-tree changes[/dim]")
+        return
+    if result.no_gates:
+        # No configured command targets the changed stack(s); give the full picture.
+        _watch_evidence_once(root, goal, test_commands, enforce_coverage, min_coverage, stamp)
+        return
+
+    verdict = "[green]PASS[/green]" if result.passed else "[red]FAIL[/red]"
+    ran, cached = len(result.ran), len(result.cached)
+    detail = f"{ran} gate(s) run, {cached} cached"
+    failing = [o for o in result.outcomes if not o.passed]
+    if failing:
+        detail += " — failed: " + ", ".join(o.kind for o in failing[:4])
+    ms = result.duration_s * 1000
+    console.print(f"[dim]{stamp}[/dim] {verdict} — {detail} [dim]({ms:.0f}ms)[/dim]")
+    if result.narrowed:
+        logger.info("dev check --watch: narrowed — full verify recommended before commit")
+        console.print(
+            "[dim]narrowed — full verify recommended before commit[/dim]"
+        )
+
+
+def _watch_gate(root: Path, goal, *, test_commands, enforce_coverage, min_coverage) -> None:
+    """Initial gate run, then a poll/debounce loop re-running it until Ctrl-C.
+
+    A single :class:`GateResultCache` is shared across iterations so a gate whose inputs
+    did not change between saves is skipped rather than re-run."""
+    console.print(
+        f"[dim]Watching {root} — re-running only the gates affected by each change "
+        f"(poll {_WATCH_POLL_SECONDS:.0f}s, debounce {_WATCH_DEBOUNCE_SECONDS:.1f}s). "
+        "Ctrl-C to stop. Run without --watch for full findings.[/dim]"
+    )
+    cache = GateResultCache(root)
+    try:
+        _watch_gate_once(root, goal, test_commands, enforce_coverage, min_coverage, cache)
+        baseline = _watch_snapshot(root)
+        while True:
+            time.sleep(_WATCH_POLL_SECONDS)
+            current = _watch_snapshot(root)
+            if current == baseline:
+                continue
+            # Debounce: let an editor save-storm settle before burning a run.
+            time.sleep(_WATCH_DEBOUNCE_SECONDS)
+            _watch_gate_once(root, goal, test_commands, enforce_coverage, min_coverage, cache)
+            # Re-baseline AFTER the run so artifacts the gate itself writes (coverage
+            # data, logs outside .devcouncil/) can never re-trigger it. Trade-off:
+            # edits made while the gate was running are absorbed — save again.
+            baseline = _watch_snapshot(root)
+    except KeyboardInterrupt:
+        console.print("\n[dim]Watch stopped.[/dim]")

package/src/devcouncil/cli/commands/config.py

@@ -1,4 +1,6 @@
+import logging
 import typer
+from typing import cast
 import yaml
 from pathlib import Path
 from rich.console import Console
@@ -10,9 +12,143 @@ from devcouncil.llm.provider import (
     build_role_model_config,
     validate_model_provider,
 )
+from devcouncil.telemetry.stages import log_stage, log_step
 
 app = typer.Typer(help="Manage DevCouncil configuration")
 console = Console()
+logger = logging.getLogger(__name__)
+
+_CONFIG_SETTABLE_KEYS = {
+    "execution.default_executor": ("execution", "default_executor", str),
+    "execution.max_repair_attempts": ("execution", "max_repair_attempts", int),
+    "execution.command_timeout": ("execution", "command_timeout", int),
+    "execution.verify_on_post_task": ("execution", "verify_on_post_task", bool),
+    "execution.stop_gate.mode": ("execution", "stop_gate", "mode", str),
+    "execution.stop_gate.check_claims": ("execution", "stop_gate", "check_claims", bool),
+    "execution.stop_gate.verify_active_task": ("execution", "stop_gate", "verify_active_task", bool),
+    "execution.stop_gate.max_blocks": ("execution", "stop_gate", "max_blocks", int),
+    "verification.diff_coverage.enforce": ("verification", "diff_coverage", "enforce", bool),
+    "semantic_layer.enabled": ("semantic_layer", "enabled", bool),
+    "semantic_layer.cache.enabled": ("semantic_layer", "cache", "enabled", bool),
+    "semantic_layer.router.enabled": ("semantic_layer", "router", "enabled", bool),
+    "semantic_layer.compressor.enabled": ("semantic_layer", "compressor", "enabled", bool),
+}
+
+
+def _parse_config_value(raw: str, typ: type) -> object:
+    if typ is bool:
+        normalized = raw.strip().lower()
+        if normalized in {"true", "1", "yes", "on"}:
+            return True
+        if normalized in {"false", "0", "no", "off"}:
+            return False
+        raise ValueError(f"Expected boolean (true/false), got {raw!r}")
+    if typ is int:
+        return int(raw)
+    return raw
+
+
+def _nested_get(raw: dict, path: tuple[str, ...]) -> object | None:
+    current: object = raw
+    for key in path:
+        if not isinstance(current, dict):
+            return None
+        current = current.get(key)
+    return current
+
+
+def _nested_set(raw: dict, path: tuple[str, ...], value: object) -> None:
+    current = raw
+    for key in path[:-1]:
+        if key not in current or not isinstance(current[key], dict):
+            current[key] = {}
+        current = current[key]
+    current[path[-1]] = value
+
+
+@app.command("show")
+def show_config(
+    project_root: Path = typer.Option(Path("."), "--project-root", help="Repository root containing .devcouncil/."),
+):
+    """Display key DevCouncil settings."""
+    root = project_root.expanduser().resolve()
+    from devcouncil.telemetry.logging_setup import set_log_dir
+    set_log_dir(root)
+
+    with log_stage("config", project_root=root, subcommand="show"):
+        try:
+            cfg = load_config(root)
+        except FileNotFoundError as e:
+            console.print(f"[red]{e}[/red]")
+            raise typer.Exit(code=1) from e
+
+        console.print("[bold]DevCouncil Settings[/bold]")
+        console.print(f"  [cyan]execution.default_executor[/cyan]: {cfg.execution.default_executor}")
+        console.print(f"  [cyan]execution.max_repair_attempts[/cyan]: {cfg.execution.max_repair_attempts}")
+        console.print(f"  [cyan]execution.command_timeout[/cyan]: {cfg.execution.command_timeout}")
+        console.print(f"  [cyan]execution.verify_on_post_task[/cyan]: {cfg.execution.verify_on_post_task} [dim](deprecated alias)[/dim]")
+        sg = cfg.execution.stop_gate
+        console.print(f"  [cyan]execution.stop_gate.mode[/cyan]: {sg.mode}")
+        console.print(f"  [cyan]execution.stop_gate.check_claims[/cyan]: {sg.check_claims}")
+        console.print(f"  [cyan]execution.stop_gate.verify_active_task[/cyan]: {sg.verify_active_task}")
+        console.print(f"  [cyan]execution.stop_gate.max_blocks[/cyan]: {sg.max_blocks}")
+        console.print(f"  [cyan]verification.diff_coverage.enforce[/cyan]: {cfg.verification.diff_coverage.enforce}")
+        console.print(f"  [cyan]verification.rigor.enabled[/cyan]: {cfg.verification.rigor.enabled}")
+        console.print(f"  [cyan]verification.rigor.stub_detection[/cyan]: {cfg.verification.rigor.stub_detection}")
+        console.print(f"  [cyan]gates.block_orphan_diffs[/cyan]: {cfg.gates.block_orphan_diffs}")
+        console.print(f"  [cyan]semantic_layer.enabled[/cyan]: {cfg.semantic_layer.enabled}")
+        if cfg.semantic_layer.enabled:
+            console.print(f"  [cyan]semantic_layer.cache.enabled[/cyan]: {cfg.semantic_layer.cache.enabled}")
+            console.print(f"  [cyan]semantic_layer.router.enabled[/cyan]: {cfg.semantic_layer.router.enabled}")
+            console.print(f"  [cyan]semantic_layer.compressor.enabled[/cyan]: {cfg.semantic_layer.compressor.enabled}")
+            console.print(
+                f"  [cyan]semantic_layer.embedding.model_name[/cyan]: {cfg.semantic_layer.embedding.model_name}"
+            )
+            console.print(
+                "  [dim]Enable: dev config set semantic_layer.enabled true "
+                "(requires uv sync --group semantic). "
+                "Check: dev doctor.[/dim]"
+            )
+
+
+@app.command("set")
+def set_config(
+    key: str = typer.Argument(..., help="Dotted config key (e.g. execution.command_timeout)."),
+    value: str = typer.Argument(..., help="New value."),
+    project_root: Path = typer.Option(Path("."), "--project-root", help="Repository root containing .devcouncil/."),
+):
+    """Set a common DevCouncil config key."""
+    root = project_root.expanduser().resolve()
+    from devcouncil.telemetry.logging_setup import set_log_dir
+    set_log_dir(root)
+
+    mapping = _CONFIG_SETTABLE_KEYS.get(key)
+    if mapping is None:
+        supported = ", ".join(sorted(_CONFIG_SETTABLE_KEYS))
+        console.print(f"[red]Unsupported key {key!r}. Supported: {supported}[/red]")
+        raise typer.Exit(code=2)
+
+    config_path = root / ".devcouncil" / "config.yaml"
+    if not config_path.exists():
+        console.print(f"[red]Config not found at {config_path}[/red]")
+        raise typer.Exit(code=1)
+
+    typ = cast(type, mapping[-1])
+    path = cast(tuple[str, ...], mapping[:-1])
+    try:
+        parsed = _parse_config_value(value, typ)
+    except ValueError as exc:
+        console.print(f"[red]{exc}[/red]")
+        raise typer.Exit(code=2) from exc
+
+    with log_stage("config", project_root=root, subcommand="set"):
+        with open(config_path) as f:
+            raw_config = yaml.safe_load(f) or {}
+        _nested_set(raw_config, path, parsed)
+        with open(config_path, "w") as f:
+            yaml.dump(raw_config, f, default_flow_style=False)
+        console.print(f"[green]Updated {key} = {parsed!r}[/green]")
+
 
 @app.command("models")
 def models(
@@ -28,88 +164,99 @@ def models(
 ):
     """View or edit model role configuration."""
     root = project_root.expanduser().resolve()
-    try:
-        load_config(root)
-    except FileNotFoundError as e:
-        console.print(f"[red]{e}[/red]")
-        return
+    from devcouncil.telemetry.logging_setup import set_log_dir
+    set_log_dir(root)
+    logger.info("dev config models: role=%s provider=%s", role, provider)
 
-    config_path = root / ".devcouncil" / "config.yaml"
-    
-    with open(config_path) as f:
-        raw_config = yaml.safe_load(f) or {}
+    with log_stage("config", project_root=root, subcommand="models"):
+        log_step("config/1: loading configuration", project_root=root, trace=True)
+        try:
+            load_config(root)
+        except FileNotFoundError as e:
+            console.print(f"[red]{e}[/red]")
+            return
 
-    try:
-        role_models = parse_role_model_overrides(role_model)
-    except ValueError as e:
-        console.print(f"[red]{e}[/red]")
-        raise typer.Exit(code=2) from e
+        config_path = root / ".devcouncil" / "config.yaml"
+
+        with open(config_path) as f:
+            raw_config = yaml.safe_load(f) or {}
 
-    if provider:
         try:
-            normalized_provider = validate_model_provider(provider)
+            role_models = parse_role_model_overrides(role_model)
         except ValueError as e:
             console.print(f"[red]{e}[/red]")
             raise typer.Exit(code=2) from e
-        raw_config.setdefault("models", {})
-        previous = raw_config["models"].get("provider", "openrouter")
-        raw_config["models"]["provider"] = normalized_provider
-        updated_role_defaults = apply_provider_default_role_models(raw_config, previous, normalized_provider)
-        with open(config_path, "w") as f:
-            yaml.dump(raw_config, f, default_flow_style=False)
-        if previous == normalized_provider:
-            console.print(f"[green]Model provider remains '{normalized_provider}'.[/green]")
-        else:
-            console.print(f"[green]Updated model provider from '{previous}' to '{normalized_provider}'.[/green]")
-        if updated_role_defaults:
-            console.print(f"[green]Updated default role models for '{normalized_provider}'.[/green]")
-        if not model and not role_models:
+
+        if provider:
+            try:
+                normalized_provider = validate_model_provider(provider)
+            except ValueError as e:
+                console.print(f"[red]{e}[/red]")
+                raise typer.Exit(code=2) from e
+            raw_config.setdefault("models", {})
+            previous = raw_config["models"].get("provider", "openrouter")
+            raw_config["models"]["provider"] = normalized_provider
+            updated_role_defaults = apply_provider_default_role_models(raw_config, previous, normalized_provider)
+            with open(config_path, "w") as f:
+                yaml.dump(raw_config, f, default_flow_style=False)
+            if previous == normalized_provider:
+                console.print(f"[green]Model provider remains '{normalized_provider}'.[/green]")
+            else:
+                console.print(f"[green]Updated model provider from '{previous}' to '{normalized_provider}'.[/green]")
+            if updated_role_defaults:
+                console.print(f"[green]Updated default role models for '{normalized_provider}'.[/green]")
+            if not model and not role_models:
+                log_step("config/complete", project_root=root, trace=True)
+                return
+
+        if not role and (model or role_models):
+            raw_config.setdefault("models", {})
+            configured_provider = validate_model_provider(raw_config["models"].get("provider", "openrouter"))
+            raw_config["models"]["roles"] = build_role_model_config(
+                configured_provider,
+                model=model,
+                role_models=role_models,
+            )
+            with open(config_path, "w") as f:
+                yaml.dump(raw_config, f, default_flow_style=False)
+            if model:
+                console.print(f"[green]Updated all model roles to use '{model}'.[/green]")
+            for selected_role, selected_model in role_models.items():
+                console.print(f"[green]Updated '{selected_role}' to use model '{selected_model}'.[/green]")
+            log_step("config/complete", project_root=root, trace=True)
+            return
+
+        if not role:
+            console.print("[bold]Model Configuration[/bold]")
+            configured_provider = raw_config.get("models", {}).get("provider", "openrouter")
+            supported = ", ".join(SUPPORTED_MODEL_PROVIDERS)
+            console.print(f"  [cyan]provider[/cyan]: {configured_provider} (supported: {supported})")
+            for r, m in raw_config.get("models", {}).get("roles", {}).items():
+                console.print(f"  [cyan]{r}[/cyan]: {m.get('model')}")
+            log_step("config/complete", project_root=root, trace=True)
             return
 
-    if not role and (model or role_models):
-        raw_config.setdefault("models", {})
-        configured_provider = validate_model_provider(raw_config["models"].get("provider", "openrouter"))
-        raw_config["models"]["roles"] = build_role_model_config(
-            configured_provider,
-            model=model,
-            role_models=role_models,
-        )
+        if not model:
+            m = raw_config.get("models", {}).get("roles", {}).get(role)
+            if m:
+                console.print(f"[cyan]{role}[/cyan]: {m.get('model')}")
+            else:
+                console.print(f"[red]Role '{role}' not found.[/red]")
+            log_step("config/complete", project_root=root, trace=True)
+            return
+
+        if "models" not in raw_config:
+            raw_config["models"] = {"roles": {}}
+        if "roles" not in raw_config["models"]:
+            raw_config["models"]["roles"] = {}
+
+        if role not in raw_config["models"]["roles"]:
+            raw_config["models"]["roles"][role] = {}
+
+        raw_config["models"]["roles"][role]["model"] = model
+
         with open(config_path, "w") as f:
             yaml.dump(raw_config, f, default_flow_style=False)
-        if model:
-            console.print(f"[green]Updated all model roles to use '{model}'.[/green]")
-        for selected_role, selected_model in role_models.items():
-            console.print(f"[green]Updated '{selected_role}' to use model '{selected_model}'.[/green]")
-        return
-
-    if not role:
-        console.print("[bold]Model Configuration[/bold]")
-        configured_provider = raw_config.get("models", {}).get("provider", "openrouter")
-        supported = ", ".join(SUPPORTED_MODEL_PROVIDERS)
-        console.print(f"  [cyan]provider[/cyan]: {configured_provider} (supported: {supported})")
-        for r, m in raw_config.get("models", {}).get("roles", {}).items():
-            console.print(f"  [cyan]{r}[/cyan]: {m.get('model')}")
-        return
-
-    if not model:
-        m = raw_config.get("models", {}).get("roles", {}).get(role)
-        if m:
-            console.print(f"[cyan]{role}[/cyan]: {m.get('model')}")
-        else:
-            console.print(f"[red]Role '{role}' not found.[/red]")
-        return
-
-    if "models" not in raw_config:
-        raw_config["models"] = {"roles": {}}
-    if "roles" not in raw_config["models"]:
-        raw_config["models"]["roles"] = {}
-        
-    if role not in raw_config["models"]["roles"]:
-        raw_config["models"]["roles"][role] = {}
-        
-    raw_config["models"]["roles"][role]["model"] = model
-    
-    with open(config_path, "w") as f:
-        yaml.dump(raw_config, f, default_flow_style=False)
-        
-    console.print(f"[green]Updated '{role}' to use model '{model}'[/green]")
+
+        console.print(f"[green]Updated '{role}' to use model '{model}'[/green]")
+        log_step("config/complete", project_root=root, trace=True)