dorfl 0.10.1 → 0.11.1

package/src/cli.ts

@@ -99,6 +99,7 @@ import {
 	freshWorktreeGateFlagOverrides,
 	mergeRetriesFlagOverrides,
 	noPRFlagOverrides,
+	triageModelFlagOverrides,
 } from './do-config.js';
 import {harnessReviewGate, harnessTaskAcceptanceGate} from './review-gate.js';
 import {harnessSurfaceGate} from './surface-gate.js';
@@ -107,8 +108,13 @@ import {harnessApplyDecider} from './apply-decide.js';
 import {harnessTaskReviewGate} from './tasker-review-loop.js';
 import {runVerify} from './verify.js';
 import {renderPrompt} from './prompt.js';
-import {resolvePromptGuidance} from './config.js';
-import {gc, RETAIN_REASON_TEXT} from './gc.js';
+import {resolvePromptGuidance, applyModelFallbacks} from './config.js';
+import {
+	gc,
+	resolveArbiterKeyFromCwd,
+	enumerateWorkspaceArbiters,
+	RETAIN_REASON_TEXT,
+} from './gc.js';
 import {
 	runPrdToSpec,
 	type PrdToSpecResult,
@@ -211,7 +217,9 @@ function resolveGlobalConfig(
 	fileConfig: PartialConfig,
 	flags: PartialConfig,
 ): Config {
-	return mergeConfig({...fileConfig, ...envOverrides(), ...flags});
+	const config = mergeConfig({...fileConfig, ...envOverrides(), ...flags});
+	applyModelFallbacks(config);
+	return config;
 }
 
 /**
@@ -418,7 +426,7 @@ function buildRegistrySetAdvanceTick(options: {
 				noPR: config.noPR,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.buildModel,
 				sessionsDir: config.sessionsDir,
 				review: config.review,
 				reviewModel: config.reviewModel,
@@ -443,12 +451,12 @@ function buildRegistrySetAdvanceTick(options: {
 				arbiter: arbiter ?? config.defaultArbiter,
 				doOptions,
 				surfaceGate: harnessSurfaceGate({harness, agentCmd: config.agentCmd}),
-				surfaceModel: config.model,
+				surfaceModel: config.triageModel,
 				applyDecide: harnessApplyDecider({harness, agentCmd: config.agentCmd}),
-				applyModel: config.model,
+				applyModel: config.triageModel,
 				observationTriage: config.observationTriage,
 				triageGate: harnessTriageGate({harness, agentCmd: config.agentCmd}),
-				triageModel: config.model,
+				triageModel: config.triageModel,
 				// The ANSWERED-MERGE LAND DISPATCH context (task
 				// `apply-rung-merge-disposition`, spec `land-time-reverify-and-parallel-
 				// merge-ceiling`): the dispatcher cuts a per-job worktree via
@@ -546,6 +554,8 @@ interface RunFlags extends ScanFlags {
 	pr?: boolean;
 	agentCmd?: string;
 	model?: string;
+	/** `--build-model <id>` — the builder-specific model override (falls back to `--model`). */
+	buildModel?: string;
 	harness?: string;
 	piBin?: string;
 	sessionsDir?: string;
@@ -553,6 +563,8 @@ interface RunFlags extends ScanFlags {
 	review?: boolean;
 	reviewModel?: string;
 	reviewMaxRounds?: string;
+	/** `--triage-model <id>` — the advance lifecycle gates' model (surface, apply, triage). */
+	triageModel?: string;
 	/** `--fresh-worktree-gate` / `--no-fresh-worktree-gate` — gate the REBASED tip in a clean throwaway worktree (ON by default). */
 	freshWorktreeGate?: boolean;
 	/** `--merge-retries <n>` — the cross-job merge-serialiser CAS-retry cap (spec `land-time-reverify-and-parallel-merge-ceiling` Story 5 / Applied Answer q1 (a)). */
@@ -588,6 +600,8 @@ function runFlagOverrides(flags: RunFlags, command?: Commander): PartialConfig {
 	// flag > env > per-repo > global > default — mirroring the `do` command (the
 	// fleet inherits the review gate via the converged `performIntegration` core).
 	Object.assign(overrides, reviewFlagOverrides(flags));
+	// `--triage-model` (the advance lifecycle gates' model) rides the SAME chain.
+	Object.assign(overrides, triageModelFlagOverrides(flags));
 	// `--fresh-worktree-gate`/`--no-fresh-worktree-gate` rides the SAME chain: gate
 	// the REBASED tip in a clean throwaway worktree (ON by default). The `run` fleet
 	// caller additionally downgrades it to today's gate at `perRepoMax > 1` (the
@@ -764,6 +778,8 @@ interface DoFlags {
 	allowBacklog?: boolean;
 	agentCmd?: string;
 	model?: string;
+	/** `--build-model <id>` — the builder-specific model override (falls back to `--model`). */
+	buildModel?: string;
 	harness?: string;
 	piBin?: string;
 	sessionsDir?: string;
@@ -771,6 +787,8 @@ interface DoFlags {
 	review?: boolean;
 	reviewModel?: string;
 	reviewMaxRounds?: string;
+	/** `--triage-model <id>` — the advance lifecycle gates' model (surface, apply, triage). */
+	triageModel?: string;
 	/** `--tasker-loop` / `--no-tasker-loop` — the tasker improver loop on/off toggle (`do spec:` path). Resolves into the `taskerLoop` config key. */
 	taskerLoop?: boolean;
 	/** `--tasker-loop-max <n>` — the tasker improver loop's in-context convergence cap (`do spec:` path). Resolves into the `taskerLoopMax` config key. */
@@ -808,6 +826,8 @@ interface IntakeFlags {
 	tasksLandIn?: string;
 	agentCmd?: string;
 	model?: string;
+	/** `--intake-model <id>` — the intake decision agent's model (falls back to `--model`). */
+	intakeModel?: string;
 	harness?: string;
 	piBin?: string;
 	sessionsDir?: string;
@@ -822,6 +842,7 @@ interface GcFlags {
 	ledger?: string;
 	remoteBranches?: boolean;
 	arbiter?: string;
+	allArbiters?: boolean;
 	cwd?: string;
 	dryRun?: boolean;
 	reapStaleLocks?: boolean;
@@ -1485,6 +1506,10 @@ export function buildProgram(): Command {
 			'--model <id>',
 			'model the agent runs on (routing intent; auth/keys stay the harness\u2019s job). pi: passed as --model; null/shell: substitutes a {model} placeholder in agentCmd. Resolved flag > env > per-repo > global > default (unset).',
 		)
+		.option(
+			'--build-model <id>',
+			'model the BUILD agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--harness <adapter>',
 			'harness adapter that launches the agent + reports liveness: null (default, shells out to agentCmd) or pi (the pi CLI)',
@@ -1510,6 +1535,10 @@ export function buildProgram(): Command {
 			'--review-model <id>',
 			'model the Gate-2 review agent runs on (de-correlated from the builder; routing intent). Resolved flag > env > per-repo > global > default.',
 		)
+		.option(
+			'--triage-model <id>',
+			'model the advance lifecycle gates (surface, apply, triage) run on. Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--review-max-rounds <n>',
 			'bound the revise/review loop; on exhaustion force needs-attention (default 2)',
@@ -2317,6 +2346,10 @@ export function buildProgram(): Command {
 			'--model <id>',
 			'model the agent runs on (routing intent; resolved flag > env > per-repo > global > default)',
 		)
+		.option(
+			'--build-model <id>',
+			'model the BUILD agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--harness <adapter>',
 			'harness adapter that launches the agent: null (default, shells out to agentCmd) or pi (the pi CLI)',
@@ -2345,6 +2378,10 @@ export function buildProgram(): Command {
 			'--review-model <id>',
 			'model the Gate-2 review agent runs on (de-correlated from the builder; routing intent). Resolved flag > env > per-repo > global > default.',
 		)
+		.option(
+			'--triage-model <id>',
+			'model the advance lifecycle gates (surface, apply, triage) run on. Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--review-max-rounds <n>',
 			'bound the revise/review loop; on exhaustion force needs-attention (default 2)',
@@ -2614,7 +2651,7 @@ export function buildProgram(): Command {
 					noPR: remoteConfig.noPR,
 					harness: remoteHarness,
 					agentCmd: remoteConfig.agentCmd,
-					model: remoteConfig.model,
+					model: remoteConfig.buildModel,
 					sessionsDir: remoteConfig.sessionsDir,
 					review: remoteConfig.review,
 					reviewModel: remoteConfig.reviewModel,
@@ -2793,7 +2830,7 @@ export function buildProgram(): Command {
 				noPR: config.noPR,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.buildModel,
 				// The HOST-ONLY sessions root (resolved Config → DoOptions bridge, like
 				// model/agentCmd): the path generator turns it into
 				// `<sessionsDir>/<id>.jsonl` for `--session`. Without this map the key
@@ -3126,7 +3163,7 @@ export function buildProgram(): Command {
 					noPR: remoteConfig.noPR,
 					harness: isoHarness,
 					agentCmd: remoteConfig.agentCmd,
-					model: remoteConfig.model,
+					model: remoteConfig.buildModel,
 					sessionsDir: remoteConfig.sessionsDir,
 					review: remoteConfig.review,
 					reviewModel: remoteConfig.reviewModel,
@@ -3168,18 +3205,18 @@ export function buildProgram(): Command {
 						harness: isoHarness,
 						agentCmd: remoteConfig.agentCmd,
 					}),
-					surfaceModel: remoteConfig.model,
+					surfaceModel: remoteConfig.triageModel,
 					applyDecide: harnessApplyDecider({
 						harness: isoHarness,
 						agentCmd: remoteConfig.agentCmd,
 					}),
-					applyModel: remoteConfig.model,
+					applyModel: remoteConfig.triageModel,
 					observationTriage: remoteConfig.observationTriage,
 					triageGate: harnessTriageGate({
 						harness: isoHarness,
 						agentCmd: remoteConfig.agentCmd,
 					}),
-					triageModel: remoteConfig.model,
+					triageModel: remoteConfig.triageModel,
 					note: (message) => console.error(`>> ${message}`),
 					env: process.env,
 				};
@@ -3270,7 +3307,7 @@ export function buildProgram(): Command {
 				noPR: config.noPR,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.buildModel,
 				sessionsDir: config.sessionsDir,
 				review: config.review,
 				reviewModel: config.reviewModel,
@@ -3306,12 +3343,12 @@ export function buildProgram(): Command {
 				arbiter: flags.arbiter ?? config.defaultArbiter,
 				doOptions,
 				surfaceGate: harnessSurfaceGate({harness, agentCmd: config.agentCmd}),
-				surfaceModel: config.model,
+				surfaceModel: config.triageModel,
 				applyDecide: harnessApplyDecider({harness, agentCmd: config.agentCmd}),
-				applyModel: config.model,
+				applyModel: config.triageModel,
 				observationTriage: config.observationTriage,
 				triageGate: harnessTriageGate({harness, agentCmd: config.agentCmd}),
-				triageModel: config.model,
+				triageModel: config.triageModel,
 				note: (message) => console.error(`>> ${message}`),
 			};
 
@@ -3391,7 +3428,7 @@ export function buildProgram(): Command {
 		.command('gc')
 		.helpGroup(ADVANCED_GROUP)
 		.description(
-			'Re-apply the provably-safe deletion predicate (ADR \u00a74) across every job worktree under workspacesDir/work/*: reap the provably-safe ones (clean tree AND branch tip reachable on the arbiter \u2014 merged or pushed) via git worktree remove (+ prune, never rm -rf), and report each RETAINED one with a reason. The catch-up for when end-of-job auto-reap did not run (runner crash/kill). --force overrides the predicate (discards un-saved work) \u2014 loud, never default.',
+			'Re-apply the provably-safe deletion predicate (ADR \u00a74) to job worktrees under workspacesDir/work/*: reap the provably-safe ones (clean tree AND branch tip reachable on the arbiter \u2014 merged or pushed) via git worktree remove (+ prune, never rm -rf), and report each RETAINED one with a reason. The catch-up for when end-of-job auto-reap did not run (runner crash/kill). SCOPE: by DEFAULT this is ARBITER-SCOPED \u2014 it acts ONLY on worktrees belonging to the arbiter resolved from the cwd (the same arbiter do --isolated/the mirror uses), so a gc in repo A can never reap repo B\u2019s worktrees. Pass --all-arbiters to sweep across EVERY arbiter (loud + global), or --arbiter <remote-or-url> to target a specific one. --force overrides the predicate (discards un-saved work) and requires --yes \u2014 loud, never default; --all-arbiters --force must be opted into explicitly, never reached by default.',
 		)
 		.option('-c, --config <path>', 'config file path', defaultConfigPath())
 		.option(
@@ -3416,8 +3453,12 @@ export function buildProgram(): Command {
 			'SWEEP the arbiter’s remote work/* BRANCHES instead of job worktrees: delete (via git push --delete, NEVER --force) exactly those PROVABLY MERGED into <arbiter>/main (git merge-base --is-ancestor, the SAME predicate the worktree reaper uses), and RETAIN the rest with a reason. An in-flight/un-merged branch (the recovery point) is NEVER touched. Provider-agnostic plain git — works on a --bare arbiter. The merged-only complement of `requeue --reset`.',
 		)
 		.option(
-			'--arbiter <remote>',
-			'(with --remote-branches) the arbiter git remote whose work/* branches to sweep (default: origin); resolved from --cwd',
+			'--arbiter <remote-or-url>',
+			'SCOPE the worktree sweep to a SPECIFIC arbiter (a remote NAME resolved from --cwd, or a direct arbiter URL) instead of the cwd\u2019s. (With --remote-branches / --ledger it names the arbiter git remote whose work/* branches / locks to sweep; default there: origin.)',
+		)
+		.option(
+			'--all-arbiters',
+			'GLOBAL, LOUD override: sweep worktrees across EVERY arbiter under workspacesDir/work/* (today\u2019s pre-scoping behaviour), not just the cwd\u2019s. Prints a banner naming every arbiter it will act on before doing anything; combining it with --force still requires --yes. This is the destructive cross-repo path \u2014 opt into it explicitly.',
 		)
 		.option(
 			'--cwd <dir>',
@@ -3614,6 +3655,77 @@ export function buildProgram(): Command {
 				return;
 			}
 
+			// SCOPE RESOLUTION (this task): the worktree reaper is ARBITER-SCOPED by
+			// default. `--all-arbiters` restores the GLOBAL (cross-arbiter) sweep behind
+			// a LOUD banner; `--arbiter <remote-or-url>` targets a specific arbiter; the
+			// bare default resolves the arbiter from the cwd (the SAME resolution
+			// `do --isolated` / the mirror uses). With NO resolvable cwd arbiter and
+			// neither flag, we REFUSE (never silently fall back to global) — gc used to
+			// default to global, and a global `gc --force --yes` from repo A could
+			// irreversibly discard repo B's un-pushed work.
+			let arbiterKey: string | undefined;
+			if (flags.allArbiters !== true) {
+				if (flags.arbiter !== undefined && flags.arbiter.trim() !== '') {
+					// An explicit arbiter: a direct URL (contains `://`, a scp-like `:`,
+					// or an absolute path) is keyed directly; otherwise it is a remote NAME
+					// resolved from the cwd (default `origin`).
+					const spec = flags.arbiter.trim();
+					const looksLikeUrl =
+						spec.includes('://') ||
+						spec.startsWith('/') ||
+						/^[^/]+@/.test(spec);
+					// A remote NAME resolves from --cwd if given (consistent with the
+					// other gc sub-modes), else the process cwd.
+					const resolveFrom = flags.cwd ?? process.cwd();
+					arbiterKey = looksLikeUrl
+						? encodeRepoKey(spec)
+						: resolveArbiterKeyFromCwd(resolveFrom, spec, process.env);
+					if (arbiterKey === undefined) {
+						console.error(
+							`refusing: could not resolve arbiter '${spec}' \u2014 not a URL and ` +
+								'no git remote with that name in the cwd. Pass a remote name that ' +
+								'exists here, an arbiter URL, or --all-arbiters.',
+						);
+						process.exit(1);
+					}
+				} else {
+					arbiterKey = resolveArbiterKeyFromCwd(
+						flags.cwd ?? process.cwd(),
+						config.defaultArbiter,
+						process.env,
+					);
+					if (arbiterKey === undefined) {
+						console.error(
+							'refusing: `gc` is now ARBITER-SCOPED and could not resolve an ' +
+								`arbiter from the current directory (no '${config.defaultArbiter}' ` +
+								'git remote, or not inside a repo). It will NOT fall back to a ' +
+								'global cross-arbiter sweep. Run it from a repo with an arbiter ' +
+								'remote, pass --arbiter <remote-or-url>, or --all-arbiters to sweep ' +
+								'every arbiter.',
+						);
+						process.exit(1);
+					}
+				}
+			} else {
+				// GLOBAL sweep: LOUD banner naming EVERY arbiter it will act on before
+				// doing anything (this task's "loud" requirement). Global + --force must be
+				// opted into explicitly (the --yes gate below still applies), never reached
+				// by default.
+				const arbiters = enumerateWorkspaceArbiters(workspacesDir, process.env);
+				console.error(
+					'>> --all-arbiters: operating GLOBALLY across ALL arbiters under ' +
+						`${workspacesDir}/work/* (NOT scoped to the current repo).`,
+				);
+				if (arbiters.length > 0) {
+					console.error('>> arbiters in scope:');
+					for (const a of arbiters) {
+						console.error(`>>   - ${a.url ?? a.key ?? '(malformed mirror)'}`);
+					}
+				} else {
+					console.error('>> (no worktrees found under any arbiter)');
+				}
+			}
+
 			// `--force` discards un-saved work, so it is gated behind an explicit
 			// confirmation (`--yes`) — loud + intentional, NEVER the default (ADR §4).
 			if (flags.force && !flags.yes) {
@@ -3633,6 +3745,7 @@ export function buildProgram(): Command {
 
 			const result = gc({
 				workspacesDir,
+				arbiterKey,
 				force: flags.force === true,
 				note: (message) => console.error(`>> ${message}`),
 			});
@@ -4304,6 +4417,10 @@ export function buildProgram(): Command {
 			'--model <id>',
 			'model the decision agent runs on (routing intent; resolved flag > env > per-repo > global > default)',
 		)
+		.option(
+			'--intake-model <id>',
+			'model the intake decision agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--harness <adapter>',
 			'harness adapter that launches the decision agent: null (default) or pi',
@@ -4338,6 +4455,11 @@ export function buildProgram(): Command {
 					...harnessFlagOverrides(flags),
 					// `--no-pr` (the PR-INTENT axis) rides the SAME chain.
 					...noPRFlagOverrides(flags),
+					// `--intake-model` rides the SAME chain (falls back to `model`
+					// when unset at all levels via `applyModelFallbacks`).
+					...(flags.intakeModel !== undefined
+						? {intakeModel: flags.intakeModel}
+						: {}),
 				},
 			});
 			if (resolved.message) {
@@ -4452,7 +4574,7 @@ export function buildProgram(): Command {
 				explicitTasksLandIn,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.intakeModel,
 				sessionsDir: config.sessionsDir,
 				// Host-only runner IDENTITY — scopes intake's `gh`/git ops (not the
 				// decision/review AGENT launches); absent ⇒ ambient.

package/src/config.ts

@@ -528,9 +528,25 @@ export interface Config {
 	 * (`LaunchInput.model`); the ADAPTER decides HOW it reaches its tool — the pi
 	 * adapter passes `--model <model>` natively, the null/shell adapter substitutes
 	 * a `{model}` placeholder in `agentCmd`. Resolved per-repo like `integration`:
-	 * flag (`--model`) > env > per-repo > global > default (unset).
+	 * flag (`--model`) > env > per-repo > global > default (unset). The fallback
+	 * to this field from `buildModel` / `reviewModel` / `taskerLoopModel` is
+	 * applied AFTER the full precedence chain resolves (in `applyModelFallbacks`),
+	 * so a per-role knob set at ANY level (even global config) is NEVER reset by a
+	 * higher-precedence `--model`.
 	 */
 	model?: string;
+	/**
+	 * The model the BUILD agent runs on (the builder-specific override of the
+	 * general `model`). Optional with NO default so "unset" means "inherit the
+	 * general `model`" (via `applyModelFallbacks`, applied at the resolution FINAL
+	 * point — after the full flag > env > per-repo > global chain). Carried to the
+	 * build launch through the same harness seam (`LaunchInput.model`). Resolved
+	 * per-repo like `model`: flag (`--build-model`) > env (`DORFL_BUILD_MODEL`) >
+	 * per-repo > global > fallback to `model` > default (unset). DISTINCT from
+	 * `reviewModel` (Gate 2) and `taskerLoopModel` (the improver loop) — each has
+	 * its OWN knob and each falls back to `model` independently.
+	 */
+	buildModel?: string;
 	/**
 	 * Which harness adapter launches + reports liveness for a job's agent (the
 	 * harness seam, ADR §5): `null` (default — shells out to `agentCmd`,
@@ -600,11 +616,14 @@ export interface Config {
 	review: boolean;
 	/**
 	 * The model the REVIEW agent runs on (de-correlation from the builder's
-	 * `model`). Optional with NO default so "unset" means "no forced review model"
-	 * (the harness's own default). Carried to the review-agent launch through the
-	 * EXISTING harness seam (`LaunchInput.model` / `substituteModel`) — NOT a new
-	 * mechanism. Resolved like `model`: flag (`--review-model`) > env > per-repo >
-	 * global > default (unset). Distinct from the builder's `model`.
+	 * `buildModel` when explicitly set). Optional with NO default so "unset" means
+	 * "inherit the general `model`" (via `applyModelFallbacks`, applied at the
+	 * resolution FINAL point — after the full flag > env > per-repo > global chain).
+	 * Carried to the review-agent launch through the EXISTING harness seam
+	 * (`LaunchInput.model` / `substituteModel`) — NOT a new mechanism. Resolved like
+	 * `model`: flag (`--review-model`) > env > per-repo > global > fallback to
+	 * `model` > default (unset). Distinct from the builder's `buildModel` — each
+	 * has its OWN knob and each falls back to `model` independently.
 	 */
 	reviewModel?: string;
 	/**
@@ -650,14 +669,44 @@ export interface Config {
 	taskerLoopMax: number;
 	/**
 	 * The model the tasker IMPROVER loop's review agent runs on (de-correlation
-	 * from the tasker). Optional with NO default so "unset" means "no forced model"
-	 * (the harness's own default). Carried to the review-agent launch through the
-	 * EXISTING harness seam (`LaunchInput.model` / `substituteModel`). Resolved like
-	 * `model`: flag (`--tasker-loop-model`) > env > per-repo > global > default
-	 * (unset). DISTINCT from the acceptance gate's `reviewModel` (build
-	 * `--review-model`).
+	 * from the tasker when explicitly set). Optional with NO default so "unset"
+	 * means "inherit the general `model`" (via `applyModelFallbacks`, applied at
+	 * the resolution FINAL point — after the full flag > env > per-repo > global
+	 * chain). Carried to the review-agent launch through the EXISTING harness seam
+	 * (`LaunchInput.model` / `substituteModel`). Resolved like `model`: flag
+	 * (`--tasker-loop-model`) > env > per-repo > global > fallback to `model` >
+	 * default (unset). DISTINCT from the acceptance gate's `reviewModel` (build
+	 * `--review-model`) and from `buildModel` — each has its OWN knob and each falls
+	 * back to `model` independently.
 	 */
 	taskerLoopModel?: string;
+	/**
+	 * The model the ADVANCE LIFECYCLE GATES (surface, apply, triage) run on —
+	 * the fresh-context judgement agents that surface questions from blocked work
+	 * (`surface`), interpret answered questions and decide what to mint (`apply`),
+	 * and auto-disposition no-question observations (`triage`). Optional with NO
+	 * default so "unset" means "inherit the general `model`" (via
+	 * `applyModelFallbacks`, applied at the resolution FINAL point). Carried to each
+	 * gate's launch through the EXISTING harness seam (`LaunchInput.model`). Resolved
+	 * like `model`: flag (`--triage-model`) > env (`DORFL_TRIAGE_MODEL`) > per-repo >
+	 * global > fallback to `model` > default (unset). DISTINCT from `reviewModel`,
+	 * `taskerLoopModel`, `buildModel`, and `intakeModel` — each has its OWN knob and
+	 * each falls back to `model` independently.
+	 */
+	triageModel?: string;
+	/**
+	 * The model the INTAKE decision agent runs on — the front-door fresh-context
+	 * agent that reads an issue/PR and decides whether to mint a task, mint a spec,
+	 * or ask a follow-up question. Optional with NO default so "unset" means
+	 * "inherit the general `model`" (via `applyModelFallbacks`, applied at the
+	 * resolution FINAL point). Carried to the intake-agent launch through the
+	 * EXISTING harness seam (`LaunchInput.model`). Resolved like `model`: flag
+	 * (`--intake-model`) > env (`DORFL_INTAKE_MODEL`) > per-repo > global > fallback
+	 * to `model` > default (unset). DISTINCT from the advance lifecycle gates'
+	 * `triageModel` and from `buildModel`/`reviewModel`/`taskerLoopModel` — each has
+	 * its OWN knob and each falls back to `model` independently.
+	 */
+	intakeModel?: string;
 	/**
 	 * **The fresh-worktree acceptance-gate toggle** (`--fresh-worktree-gate` /
 	 * `--no-fresh-worktree-gate`). When ON (the default), the acceptance gate
@@ -1078,6 +1127,35 @@ export function mergeConfig(overrides: PartialConfig): Config {
 	return merged;
 }
 
+/**
+ * Apply the per-role model fallbacks IN PLACE on a FULLY RESOLVED {@link Config}:
+ * `buildModel`, `reviewModel`, and `taskerLoopModel` each inherit the general
+ * `model` when they are unset (i.e. were not set at ANY precedence level — flag,
+ * env, per-repo, or global). This is the single place the fallback lives; it is
+ * called at the resolution FINAL points (`resolveRepoConfigFromLoaded` for the
+ * per-repo chain; `resolveGlobalConfig` for the global-only chain) so the
+ * fallback uses the FINAL resolved `model`, never an intermediate layer's. A
+ * per-role knob set at ANY level is NEVER reset — `applyModelFallbacks` only
+ * touches fields that are still `undefined` after the full chain resolved.
+ */
+export function applyModelFallbacks(config: Config): void {
+	if (config.buildModel === undefined) {
+		config.buildModel = config.model;
+	}
+	if (config.reviewModel === undefined) {
+		config.reviewModel = config.model;
+	}
+	if (config.taskerLoopModel === undefined) {
+		config.taskerLoopModel = config.model;
+	}
+	if (config.triageModel === undefined) {
+		config.triageModel = config.model;
+	}
+	if (config.intakeModel === undefined) {
+		config.intakeModel = config.model;
+	}
+}
+
 /**
  * Persist `config` to `path` as pretty JSON (creating the parent dir). Used by
  * `work-on` to SAVE the prompted `humanWorktreesDir` on first use so the human is

package/src/do-config.ts

@@ -17,6 +17,8 @@ import type {
 export interface HarnessFlags {
 	agentCmd?: string;
 	model?: string;
+	/** `--build-model <id>` — the builder-specific model override (falls back to `--model`). */
+	buildModel?: string;
 	harness?: string;
 	piBin?: string;
 	/**
@@ -43,6 +45,9 @@ export function harnessFlagOverrides(flags: HarnessFlags): PartialConfig {
 	if (flags.model !== undefined) {
 		overrides.model = flags.model;
 	}
+	if (flags.buildModel !== undefined) {
+		overrides.buildModel = flags.buildModel;
+	}
 	if (flags.harness === 'null' || flags.harness === 'pi') {
 		overrides.harness = flags.harness;
 	}
@@ -69,6 +74,7 @@ export function doFlagOverrides(
 	flags: HarnessFlags &
 		ReviewFlags &
 		TaskerLoopFlags &
+		TriageModelFlags &
 		FreshWorktreeGateFlags &
 		SelectionOrderFlags &
 		ObservationTriageFlags &
@@ -115,6 +121,10 @@ export function doFlagOverrides(
 		// family from the gate's `--review*`, never sharing a flag/key/field name.
 		// The flag fields bridge onto the `taskerLoop*` config keys.
 		...taskerLoopFlagOverrides(flags),
+		// `--triage-model <id>` (the advance lifecycle gates' model — surface, apply,
+		// triage) rides the SAME chain. DISTINCT from `--review-model`/
+		// `--tasker-loop-model`; falls back to `model` when unset at all levels.
+		...triageModelFlagOverrides(flags),
 		// `--fresh-worktree-gate`/`--no-fresh-worktree-gate` (run the acceptance gate
 		// against the REBASED tip in a clean throwaway worktree, ON by default) rides
 		// the SAME chain — a DISTINCT family from `--review*`/`--tasker-loop*`.
@@ -232,6 +242,34 @@ export function taskerLoopFlagOverrides(flags: TaskerLoopFlags): PartialConfig {
 	return overrides;
 }
 
+/**
+ * The `--triage-model` flag — the model the advance lifecycle gates (surface,
+ * apply, triage) run on. A single string flag, distinct from the harness
+ * `--model`/`--build-model` family and from `--review-model`/
+ * `--tasker-loop-model`. Resolved through the SAME `flag > env > per-repo >
+ * global > default` chain; falls back to `model` when unset at all levels (via
+ * `applyModelFallbacks`).
+ */
+export interface TriageModelFlags {
+	/** `--triage-model <id>` — the advance lifecycle gates' model (routing intent). */
+	triageModel?: string;
+}
+
+/**
+ * Map the `--triage-model` flag into a {@link PartialConfig} override. Only
+ * contributes when the flag is actually present (absent flag => absent key), so
+ * the override layer never clobbers a lower-precedence source with `undefined`.
+ */
+export function triageModelFlagOverrides(
+	flags: TriageModelFlags,
+): PartialConfig {
+	const overrides: PartialConfig = {};
+	if (flags.triageModel !== undefined) {
+		overrides.triageModel = flags.triageModel;
+	}
+	return overrides;
+}
+
 /**
  * The fresh-worktree acceptance-gate CLI flag (`do`/`complete`/`run`):
  * `--fresh-worktree-gate` / `--no-fresh-worktree-gate`, the POSITIVE boolean

package/src/do.ts

@@ -549,7 +549,9 @@ export interface DoOptions {
 	watch?: boolean;
 	/** The configured agent command the harness shells out to (null adapter). */
 	agentCmd?: string;
-	/** The model routing intent forwarded to the harness (ADR §13). */
+	/** The model routing intent forwarded to the harness (ADR §13). Sourced
+	 * from `config.buildModel` (which inherits the general `config.model` when
+	 * unset via `applyModelFallbacks`). */
 	model?: string;
 	/**
 	 * The HOST-ONLY root folder under which this run's pi session FILE is generated

package/src/env-config.ts

@@ -152,6 +152,9 @@ const KEY_COERCIONS: {[K in keyof Config]?: Coercion} = {
 	// A non-string / empty value is normalised at load (`validateDorflCmdConfig`).
 	dorflCmd: 'string',
 	model: 'string',
+	buildModel: 'string',
+	triageModel: 'string',
+	intakeModel: 'string',
 	harness: {enum: ['null', 'pi']},
 	piBin: 'string',
 	sessionsDir: 'string',