dorfl 0.11.0 → 0.11.1

package/src/do-config.ts

@@ -17,6 +17,8 @@ import type {
 export interface HarnessFlags {
 	agentCmd?: string;
 	model?: string;
+	/** `--build-model <id>` — the builder-specific model override (falls back to `--model`). */
+	buildModel?: string;
 	harness?: string;
 	piBin?: string;
 	/**
@@ -43,6 +45,9 @@ export function harnessFlagOverrides(flags: HarnessFlags): PartialConfig {
 	if (flags.model !== undefined) {
 		overrides.model = flags.model;
 	}
+	if (flags.buildModel !== undefined) {
+		overrides.buildModel = flags.buildModel;
+	}
 	if (flags.harness === 'null' || flags.harness === 'pi') {
 		overrides.harness = flags.harness;
 	}
@@ -69,6 +74,7 @@ export function doFlagOverrides(
 	flags: HarnessFlags &
 		ReviewFlags &
 		TaskerLoopFlags &
+		TriageModelFlags &
 		FreshWorktreeGateFlags &
 		SelectionOrderFlags &
 		ObservationTriageFlags &
@@ -115,6 +121,10 @@ export function doFlagOverrides(
 		// family from the gate's `--review*`, never sharing a flag/key/field name.
 		// The flag fields bridge onto the `taskerLoop*` config keys.
 		...taskerLoopFlagOverrides(flags),
+		// `--triage-model <id>` (the advance lifecycle gates' model — surface, apply,
+		// triage) rides the SAME chain. DISTINCT from `--review-model`/
+		// `--tasker-loop-model`; falls back to `model` when unset at all levels.
+		...triageModelFlagOverrides(flags),
 		// `--fresh-worktree-gate`/`--no-fresh-worktree-gate` (run the acceptance gate
 		// against the REBASED tip in a clean throwaway worktree, ON by default) rides
 		// the SAME chain — a DISTINCT family from `--review*`/`--tasker-loop*`.
@@ -232,6 +242,34 @@ export function taskerLoopFlagOverrides(flags: TaskerLoopFlags): PartialConfig {
 	return overrides;
 }
 
+/**
+ * The `--triage-model` flag — the model the advance lifecycle gates (surface,
+ * apply, triage) run on. A single string flag, distinct from the harness
+ * `--model`/`--build-model` family and from `--review-model`/
+ * `--tasker-loop-model`. Resolved through the SAME `flag > env > per-repo >
+ * global > default` chain; falls back to `model` when unset at all levels (via
+ * `applyModelFallbacks`).
+ */
+export interface TriageModelFlags {
+	/** `--triage-model <id>` — the advance lifecycle gates' model (routing intent). */
+	triageModel?: string;
+}
+
+/**
+ * Map the `--triage-model` flag into a {@link PartialConfig} override. Only
+ * contributes when the flag is actually present (absent flag => absent key), so
+ * the override layer never clobbers a lower-precedence source with `undefined`.
+ */
+export function triageModelFlagOverrides(
+	flags: TriageModelFlags,
+): PartialConfig {
+	const overrides: PartialConfig = {};
+	if (flags.triageModel !== undefined) {
+		overrides.triageModel = flags.triageModel;
+	}
+	return overrides;
+}
+
 /**
  * The fresh-worktree acceptance-gate CLI flag (`do`/`complete`/`run`):
  * `--fresh-worktree-gate` / `--no-fresh-worktree-gate`, the POSITIVE boolean

package/src/do.ts

@@ -549,7 +549,9 @@ export interface DoOptions {
 	watch?: boolean;
 	/** The configured agent command the harness shells out to (null adapter). */
 	agentCmd?: string;
-	/** The model routing intent forwarded to the harness (ADR §13). */
+	/** The model routing intent forwarded to the harness (ADR §13). Sourced
+	 * from `config.buildModel` (which inherits the general `config.model` when
+	 * unset via `applyModelFallbacks`). */
 	model?: string;
 	/**
 	 * The HOST-ONLY root folder under which this run's pi session FILE is generated

package/src/env-config.ts

@@ -152,6 +152,9 @@ const KEY_COERCIONS: {[K in keyof Config]?: Coercion} = {
 	// A non-string / empty value is normalised at load (`validateDorflCmdConfig`).
 	dorflCmd: 'string',
 	model: 'string',
+	buildModel: 'string',
+	triageModel: 'string',
+	intakeModel: 'string',
 	harness: {enum: ['null', 'pi']},
 	piBin: 'string',
 	sessionsDir: 'string',

package/src/repo-config.ts

@@ -2,6 +2,7 @@ import {readFileSync, existsSync} from 'node:fs';
 import {join} from 'node:path';
 import {
 	mergeConfig,
+	applyModelFallbacks,
 	validateDeadlineConfig,
 	validateDorflCmdConfig,
 	warnDeprecatedConfigKeys,
@@ -209,8 +210,12 @@ export const REPO_ALLOWED_KEYS = [
 	// `model` (which model this repo's work runs on) and `harness` (which adapter)
 	// are legitimate repo properties (ADR §13) — model is routing intent, not auth,
 	// and a repo may prefer a given harness. `piBin`/`agentCmd` stay host-only
-	// (machine paths/commands), so they are rejected below.
+	// (machine paths/commands), so they are rejected below. `buildModel` is the
+	// builder-specific override of the general `model` (falls back to `model` when
+	// unset at all levels — see `applyModelFallbacks`); like `model` it is routing
+	// intent (not auth), so it is repo-appropriate.
 	'model',
+	'buildModel',
 	'harness',
 	// Gate 2 (PR/code review) policy is a genuine repo property (GATES spec
 	// `work/specs/tasked/review.md`), resolved per-repo like `integration`/`autoBuild`:
@@ -230,6 +235,14 @@ export const REPO_ALLOWED_KEYS = [
 	'taskerLoop',
 	'taskerLoopMax',
 	'taskerLoopModel',
+	// `triageModel` (the model the advance lifecycle gates — surface, apply,
+	// triage — run on) is a genuine repo property like `reviewModel`/
+	// `taskerLoopModel`: routing intent (not auth), resolved per-repo through the
+	// same chain. `intakeModel` (the front-door intake decision agent's model) is
+	// likewise repo-appropriate. Each falls back to `model` when unset at all
+	// levels (see `applyModelFallbacks`).
+	'triageModel',
+	'intakeModel',
 	// `freshWorktreeGate` (run the acceptance gate against the REBASED tip in a
 	// clean throwaway worktree, ON by default) is a genuine repo property exactly
 	// like `verify`/`prepare`/`review`: whether this repo's gate tests the merged
@@ -646,6 +659,11 @@ export function resolveRepoConfigFromLoaded(
 	// (flag / env / per-repo / global) surfaces the same clear error (ADR
 	// `dorfl-cmd-repo-settable-exception-to-host-only`).
 	validateDorflCmdConfig(config);
+	// Apply the per-role model fallbacks: `buildModel`, `reviewModel`, and
+	// `taskerLoopModel` each inherit the general `model` when unset at EVERY level
+	// (flag / env / per-repo / global). Applied HERE — the resolution FINAL point —
+	// so the fallback uses the FULLY resolved `model`, never an intermediate layer.
+	applyModelFallbacks(config);
 	return {
 		config,
 		rejected: repo.rejected,

package/src/run.ts

@@ -834,8 +834,9 @@ async function runOneItem(
 
 		// 4. Run the agent — via the injected runner (tests) or the harness seam
 		//    (null adapter by default), shelling out to the configured agentCmd. The
-		//    resolved per-repo `model` (ADR §13) flows through the seam to the adapter;
-		//    a `{model}`-in-agentCmd misconfiguration surfaces as agent-failed.
+		//    resolved per-repo `buildModel` (ADR §13, which inherits the general
+		//    `model` when unset) flows through the seam to the adapter; a
+		//    `{model}`-in-agentCmd misconfiguration surfaces as agent-failed.
 		let agent: {ok: boolean; detail?: string; output?: string};
 		try {
 			agent = runAgent(
@@ -844,7 +845,7 @@ async function runOneItem(
 				prompt,
 				slug,
 				config.agentCmd,
-				config.model,
+				config.buildModel,
 				config.sessionsDir,
 			);
 		} catch (err) {