dorfl 0.11.0 → 0.11.2

package/dist/worktree-writer-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-writer-lock.js","sourceRoot":"","sources":["../src/worktree-writer-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAC,OAAO,EAAE,IAAI,EAAC,MAAM,WAAW,CAAC;AACxC,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAC,QAAQ,EAAC,MAAM,cAAc,CAAC;AACtC,OAAO,EAAC,iBAAiB,EAAC,MAAM,sBAAsB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AA6B5D;;;;GAIG;AACH,SAAS,cAAc,CACtB,GAAW,EACX,GAAkC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CACjC,GAAW,EACX,GAAuB;IAEvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,MAAM,KAAK,SAAS;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAC3C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CACjC,GAAW,EACX,GAAuB;IAEvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;QACxE,OAAO,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,4EAA4E;QAC5E,2EAA2E;QAC3E,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAsB;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAMzC;IACA,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAC,GAAG,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAC,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,IACC,QAAQ,KAAK,SAAS;QACtB,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QAC5B,WAAW,CAAC,QAAQ,CAAC,EACpB,CAAC;QACF,OAAO;YACN,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EACL,YAAY,GAAG,yCAAyC,QAAQ,CAAC,GAAG,EAAE;gBACtE,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,cAAc,QAAQ,CAAC,IAAI,WAAW,QAAQ,CAAC,SAAS,gBAAgB;gBACxE,YAAY,IAAI,uDAAuD;gBACvE,qEAAqE;gBACrE,wEAAwE;gBACxE,8CAA8C;SAC/C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACN,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAS,EAAE;YACnB,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;YACR,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dorfl",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/wighawag/dorfl.git",

package/src/arbiter-refs.ts

@@ -0,0 +1,222 @@
+import {runAsync} from './git.js';
+
+/**
+ * **The ONE arbiter-ref refresh + authoritative-read seam** (observation
+ * `checkpoint-path-reports-its-own-write-as-absent`).
+ *
+ * Every "did my own write land?" / "is the branch on the arbiter?" question in
+ * the checkpoint + surface paths used to be answered the same wrong way: run a
+ * PLAIN `git fetch <arbiter>`, then `git rev-parse <arbiter>/<branch>` — i.e.
+ * read a REMOTE-TRACKING ref (`refs/remotes/<arbiter>/…`) and trust it. That is
+ * unsound in the configuration dorfl itself creates for `--isolated` runs, and
+ * it produced two field defects where dorfl reported its OWN successful write as
+ * absent:
+ *
+ *  1. A job worktree is `git worktree add`ed from the BARE HUB MIRROR
+ *     (`workspace.ts` `createJob` → `repo-mirror.ts` `ensureMirror`), whose
+ *     `origin` carries the MIRROR-style refspec `+refs/heads/*:refs/heads/*`.
+ *     So a plain fetch there writes `refs/heads/main`, and **never populates**
+ *     `refs/remotes/origin/main` at all. `rev-parse origin/main` then returns
+ *     whatever a PRIOR explicit-refspec fetch happened to leave behind — a value
+ *     that PREDATES the write being verified. A push that genuinely landed reads
+ *     back as "not our commit ⇒ rejected".
+ *  2. Worse, in that same worktree a plain `git fetch origin` **fails outright**
+ *     (`fatal: refusing to fetch into branch 'refs/heads/work/<slug>' checked out
+ *     at …`), because the mirror refspec's destination IS the branch the worktree
+ *     has checked out. So it refreshes NOTHING, and a follow-up
+ *     `rev-parse <arbiter>/work/<slug>` fails against a ref that never existed —
+ *     reported as "no work branch on <arbiter>" while the branch (and an hour of
+ *     agent work) sits on the arbiter.
+ *
+ * Both call sites now route through this module, which fixes the class rather
+ * than the two instances:
+ *
+ *   - {@link refreshArbiterRefs} prune-fetches with an EXPLICIT, per-branch
+ *     refspec into the `refs/remotes/<arbiter>/…` namespace the readers actually
+ *     read, tolerating the checked-out-branch refusal instead of being silently
+ *     defeated by it.
+ *   - {@link resolveArbiterBranch} answers the sha question from the ARBITER
+ *     ITSELF (`git ls-remote`), so no local ref-namespace/refspec accident can
+ *     make a landed write look absent. The local tracking ref is only a FALLBACK,
+ *     used when the arbiter cannot be reached at all.
+ *
+ * The `ls-remote`-is-authoritative stance is not new — it is the same one
+ * `continue-branch.ts` (`branchAheadOfArbiter`), `workspace.ts`, `integrator.ts`
+ * and `reap-branches.ts` already take for continue-detection and branch reaping.
+ * This module makes it the SHARED default for the post-write verification too,
+ * instead of each site re-deciding.
+ */
+
+/** How a {@link ResolvedArbiterBranch} sha was obtained — the read's PROVENANCE. */
+export type ArbiterRefAuthority =
+	/** Read from the arbiter itself (`git ls-remote`): AUTHORITATIVE. */
+	| 'arbiter'
+	/**
+	 * The arbiter could not be reached (offline / broken remote), so the local
+	 * remote-tracking ref was used. Best-effort: it may be stale, so a caller
+	 * deciding "did MY write land?" must NOT treat a mismatch here as proof of
+	 * a loss (see {@link ResolvedArbiterBranch.trustworthy}).
+	 */
+	| 'local-fallback'
+	/** Neither the arbiter nor any local ref has this branch. */
+	| 'absent';
+
+/** The resolved state of ONE branch on the arbiter (a single, coherent read). */
+export interface ResolvedArbiterBranch {
+	/** The unqualified branch name that was resolved (e.g. `main`, `work/task-x`). */
+	branch: string;
+	/** Its sha, or `undefined` when the branch exists nowhere we could look. */
+	sha?: string;
+	/** Where {@link sha} came from. */
+	authority: ArbiterRefAuthority;
+	/**
+	 * True iff the arbiter answered (`authority` is `arbiter` or `absent` off a
+	 * REACHABLE arbiter). When false the read is a stale-capable local fallback,
+	 * so a mismatch proves nothing and callers must not report a loss from it.
+	 */
+	trustworthy: boolean;
+	/** The `ls-remote` stderr when the arbiter could not be reached (diagnostics). */
+	unreachableDetail?: string;
+}
+
+/** The explicit refspec that maps an arbiter branch into the namespace we READ. */
+function trackingRefspec(arbiter: string, branch: string): string {
+	return `+refs/heads/${branch}:refs/remotes/${arbiter}/${branch}`;
+}
+
+/**
+ * PRUNE-FETCH the named arbiter branches into `refs/remotes/<arbiter>/<branch>`
+ * — the namespace every reader in this codebase actually reads — using an
+ * EXPLICIT per-branch refspec.
+ *
+ * Three properties matter, and all three are the reason this is not just
+ * `git fetch <arbiter>`:
+ *
+ *  - **Explicit refspec.** A bare-hub-mirror worktree's `origin` maps
+ *    `+refs/heads/*:refs/heads/*`, so a plain fetch never writes
+ *    `refs/remotes/<arbiter>/*`. Naming the destination makes the refresh work
+ *    identically in a normal clone AND in a mirror worktree.
+ *  - **`--prune`.** A branch DELETED on the arbiter (a `requeue --reset`, a
+ *    merge-reap, a cross-machine `gc`) must disappear from our view too;
+ *    otherwise a stale tracking ref answers a liveness question with a ghost.
+ *  - **Per-branch and SOFT.** Fetching branch-at-a-time means the one refspec
+ *    git refuses (the destination that is checked out in THIS worktree — see the
+ *    module doc) cannot abort the refresh of the others, which is exactly how the
+ *    single combined fetch silently refreshed nothing. Every failure is
+ *    tolerated and reported rather than thrown: this is a REFRESH, and the
+ *    authoritative answer comes from {@link resolveArbiterBranch} anyway.
+ *
+ * Returns the branches that could not be refreshed (for diagnostics only — a
+ * caller should not gate on it, because the authoritative read does not depend
+ * on the refresh succeeding).
+ */
+export async function refreshArbiterRefs(params: {
+	cwd: string;
+	arbiter: string;
+	/** Unqualified branch names to refresh (e.g. `['main', 'work/task-x']`). */
+	branches: readonly string[];
+	env?: NodeJS.ProcessEnv;
+}): Promise<{failed: string[]}> {
+	const {cwd, arbiter, branches, env} = params;
+	const failed: string[] = [];
+	for (const branch of branches) {
+		const fetched = await runAsync(
+			'git',
+			[
+				'fetch',
+				'--quiet',
+				'--prune',
+				arbiter,
+				trackingRefspec(arbiter, branch),
+			],
+			cwd,
+			{env},
+		);
+		if (fetched.status !== 0) {
+			failed.push(branch);
+		}
+	}
+	return {failed};
+}
+
+/**
+ * Resolve ONE branch's sha on the arbiter, ARBITER-AUTHORITATIVELY.
+ *
+ * `git ls-remote --heads <arbiter> <branch>` asks the arbiter directly, so the
+ * answer cannot be defeated by a local refspec/namespace accident — which is the
+ * whole point: this is the read a post-write verification uses to decide whether
+ * its OWN push landed, and that decision must never be made from a view that
+ * predates the push.
+ *
+ * Decision order:
+ *   - `ls-remote` exits 0 with a sha ⇒ `{sha, authority: 'arbiter'}` (trustworthy).
+ *   - `ls-remote` exits 0 with EMPTY output ⇒ the arbiter genuinely does not have
+ *     the branch ⇒ `{authority: 'absent'}` (trustworthy: a definite "no").
+ *   - `ls-remote` exits non-zero (unreachable / no such remote) ⇒ fall back to the
+ *     local `refs/remotes/<arbiter>/<branch>`, flagged `trustworthy: false` so a
+ *     caller cannot mistake a stale local read for proof of anything.
+ *
+ * Always call {@link refreshArbiterRefs} first when the caller ALSO needs the
+ * objects locally (a CAS base, a `merge-base` / `rev-list` comparison): a sha
+ * from `ls-remote` names a commit this repo may not have yet.
+ */
+export async function resolveArbiterBranch(params: {
+	cwd: string;
+	arbiter: string;
+	branch: string;
+	env?: NodeJS.ProcessEnv;
+}): Promise<ResolvedArbiterBranch> {
+	const {cwd, arbiter, branch, env} = params;
+	const ls = await runAsync(
+		'git',
+		['ls-remote', '--heads', arbiter, branch],
+		cwd,
+		{env},
+	);
+	if (ls.status === 0) {
+		// `<sha>\t<ref>` lines. `--heads <branch>` can match several refs when the
+		// name is a glob-ish prefix, so take the line whose ref is EXACTLY ours.
+		const sha = ls.stdout
+			.split('\n')
+			.map((line) => line.trim())
+			.filter((line) => line !== '')
+			.map((line) => line.split(/\s+/))
+			.find(([, ref]) => ref === `refs/heads/${branch}`)?.[0];
+		if (sha !== undefined && sha !== '') {
+			return {branch, sha, authority: 'arbiter', trustworthy: true};
+		}
+		// Reachable arbiter that does NOT have the branch: a definite, trustworthy
+		// "absent" (a stale local ref must not be able to resurrect it).
+		return {branch, authority: 'absent', trustworthy: true};
+	}
+	// Unreachable arbiter: best-effort local read, explicitly NOT trustworthy.
+	const local = await runAsync(
+		'git',
+		[
+			'rev-parse',
+			'--verify',
+			'--quiet',
+			`refs/remotes/${arbiter}/${branch}^{commit}`,
+		],
+		cwd,
+		{env},
+	);
+	const localSha = local.status === 0 ? local.stdout.trim() : '';
+	const unreachableDetail =
+		ls.stderr.trim() || `git ls-remote exit ${ls.status}`;
+	if (localSha !== '') {
+		return {
+			branch,
+			sha: localSha,
+			authority: 'local-fallback',
+			trustworthy: false,
+			unreachableDetail,
+		};
+	}
+	return {
+		branch,
+		authority: 'absent',
+		trustworthy: false,
+		unreachableDetail,
+	};
+}

package/src/cli.ts

@@ -99,6 +99,7 @@ import {
 	freshWorktreeGateFlagOverrides,
 	mergeRetriesFlagOverrides,
 	noPRFlagOverrides,
+	triageModelFlagOverrides,
 } from './do-config.js';
 import {harnessReviewGate, harnessTaskAcceptanceGate} from './review-gate.js';
 import {harnessSurfaceGate} from './surface-gate.js';
@@ -107,7 +108,7 @@ import {harnessApplyDecider} from './apply-decide.js';
 import {harnessTaskReviewGate} from './tasker-review-loop.js';
 import {runVerify} from './verify.js';
 import {renderPrompt} from './prompt.js';
-import {resolvePromptGuidance} from './config.js';
+import {resolvePromptGuidance, applyModelFallbacks} from './config.js';
 import {
 	gc,
 	resolveArbiterKeyFromCwd,
@@ -216,7 +217,9 @@ function resolveGlobalConfig(
 	fileConfig: PartialConfig,
 	flags: PartialConfig,
 ): Config {
-	return mergeConfig({...fileConfig, ...envOverrides(), ...flags});
+	const config = mergeConfig({...fileConfig, ...envOverrides(), ...flags});
+	applyModelFallbacks(config);
+	return config;
 }
 
 /**
@@ -423,7 +426,7 @@ function buildRegistrySetAdvanceTick(options: {
 				noPR: config.noPR,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.buildModel,
 				sessionsDir: config.sessionsDir,
 				review: config.review,
 				reviewModel: config.reviewModel,
@@ -448,12 +451,12 @@ function buildRegistrySetAdvanceTick(options: {
 				arbiter: arbiter ?? config.defaultArbiter,
 				doOptions,
 				surfaceGate: harnessSurfaceGate({harness, agentCmd: config.agentCmd}),
-				surfaceModel: config.model,
+				surfaceModel: config.triageModel,
 				applyDecide: harnessApplyDecider({harness, agentCmd: config.agentCmd}),
-				applyModel: config.model,
+				applyModel: config.triageModel,
 				observationTriage: config.observationTriage,
 				triageGate: harnessTriageGate({harness, agentCmd: config.agentCmd}),
-				triageModel: config.model,
+				triageModel: config.triageModel,
 				// The ANSWERED-MERGE LAND DISPATCH context (task
 				// `apply-rung-merge-disposition`, spec `land-time-reverify-and-parallel-
 				// merge-ceiling`): the dispatcher cuts a per-job worktree via
@@ -551,6 +554,8 @@ interface RunFlags extends ScanFlags {
 	pr?: boolean;
 	agentCmd?: string;
 	model?: string;
+	/** `--build-model <id>` — the builder-specific model override (falls back to `--model`). */
+	buildModel?: string;
 	harness?: string;
 	piBin?: string;
 	sessionsDir?: string;
@@ -558,6 +563,8 @@ interface RunFlags extends ScanFlags {
 	review?: boolean;
 	reviewModel?: string;
 	reviewMaxRounds?: string;
+	/** `--triage-model <id>` — the advance lifecycle gates' model (surface, apply, triage). */
+	triageModel?: string;
 	/** `--fresh-worktree-gate` / `--no-fresh-worktree-gate` — gate the REBASED tip in a clean throwaway worktree (ON by default). */
 	freshWorktreeGate?: boolean;
 	/** `--merge-retries <n>` — the cross-job merge-serialiser CAS-retry cap (spec `land-time-reverify-and-parallel-merge-ceiling` Story 5 / Applied Answer q1 (a)). */
@@ -593,6 +600,8 @@ function runFlagOverrides(flags: RunFlags, command?: Commander): PartialConfig {
 	// flag > env > per-repo > global > default — mirroring the `do` command (the
 	// fleet inherits the review gate via the converged `performIntegration` core).
 	Object.assign(overrides, reviewFlagOverrides(flags));
+	// `--triage-model` (the advance lifecycle gates' model) rides the SAME chain.
+	Object.assign(overrides, triageModelFlagOverrides(flags));
 	// `--fresh-worktree-gate`/`--no-fresh-worktree-gate` rides the SAME chain: gate
 	// the REBASED tip in a clean throwaway worktree (ON by default). The `run` fleet
 	// caller additionally downgrades it to today's gate at `perRepoMax > 1` (the
@@ -769,6 +778,8 @@ interface DoFlags {
 	allowBacklog?: boolean;
 	agentCmd?: string;
 	model?: string;
+	/** `--build-model <id>` — the builder-specific model override (falls back to `--model`). */
+	buildModel?: string;
 	harness?: string;
 	piBin?: string;
 	sessionsDir?: string;
@@ -776,6 +787,8 @@ interface DoFlags {
 	review?: boolean;
 	reviewModel?: string;
 	reviewMaxRounds?: string;
+	/** `--triage-model <id>` — the advance lifecycle gates' model (surface, apply, triage). */
+	triageModel?: string;
 	/** `--tasker-loop` / `--no-tasker-loop` — the tasker improver loop on/off toggle (`do spec:` path). Resolves into the `taskerLoop` config key. */
 	taskerLoop?: boolean;
 	/** `--tasker-loop-max <n>` — the tasker improver loop's in-context convergence cap (`do spec:` path). Resolves into the `taskerLoopMax` config key. */
@@ -813,6 +826,8 @@ interface IntakeFlags {
 	tasksLandIn?: string;
 	agentCmd?: string;
 	model?: string;
+	/** `--intake-model <id>` — the intake decision agent's model (falls back to `--model`). */
+	intakeModel?: string;
 	harness?: string;
 	piBin?: string;
 	sessionsDir?: string;
@@ -1491,6 +1506,10 @@ export function buildProgram(): Command {
 			'--model <id>',
 			'model the agent runs on (routing intent; auth/keys stay the harness\u2019s job). pi: passed as --model; null/shell: substitutes a {model} placeholder in agentCmd. Resolved flag > env > per-repo > global > default (unset).',
 		)
+		.option(
+			'--build-model <id>',
+			'model the BUILD agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--harness <adapter>',
 			'harness adapter that launches the agent + reports liveness: null (default, shells out to agentCmd) or pi (the pi CLI)',
@@ -1516,6 +1535,10 @@ export function buildProgram(): Command {
 			'--review-model <id>',
 			'model the Gate-2 review agent runs on (de-correlated from the builder; routing intent). Resolved flag > env > per-repo > global > default.',
 		)
+		.option(
+			'--triage-model <id>',
+			'model the advance lifecycle gates (surface, apply, triage) run on. Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--review-max-rounds <n>',
 			'bound the revise/review loop; on exhaustion force needs-attention (default 2)',
@@ -2323,6 +2346,10 @@ export function buildProgram(): Command {
 			'--model <id>',
 			'model the agent runs on (routing intent; resolved flag > env > per-repo > global > default)',
 		)
+		.option(
+			'--build-model <id>',
+			'model the BUILD agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--harness <adapter>',
 			'harness adapter that launches the agent: null (default, shells out to agentCmd) or pi (the pi CLI)',
@@ -2351,6 +2378,10 @@ export function buildProgram(): Command {
 			'--review-model <id>',
 			'model the Gate-2 review agent runs on (de-correlated from the builder; routing intent). Resolved flag > env > per-repo > global > default.',
 		)
+		.option(
+			'--triage-model <id>',
+			'model the advance lifecycle gates (surface, apply, triage) run on. Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--review-max-rounds <n>',
 			'bound the revise/review loop; on exhaustion force needs-attention (default 2)',
@@ -2620,7 +2651,7 @@ export function buildProgram(): Command {
 					noPR: remoteConfig.noPR,
 					harness: remoteHarness,
 					agentCmd: remoteConfig.agentCmd,
-					model: remoteConfig.model,
+					model: remoteConfig.buildModel,
 					sessionsDir: remoteConfig.sessionsDir,
 					review: remoteConfig.review,
 					reviewModel: remoteConfig.reviewModel,
@@ -2799,7 +2830,7 @@ export function buildProgram(): Command {
 				noPR: config.noPR,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.buildModel,
 				// The HOST-ONLY sessions root (resolved Config → DoOptions bridge, like
 				// model/agentCmd): the path generator turns it into
 				// `<sessionsDir>/<id>.jsonl` for `--session`. Without this map the key
@@ -3132,7 +3163,7 @@ export function buildProgram(): Command {
 					noPR: remoteConfig.noPR,
 					harness: isoHarness,
 					agentCmd: remoteConfig.agentCmd,
-					model: remoteConfig.model,
+					model: remoteConfig.buildModel,
 					sessionsDir: remoteConfig.sessionsDir,
 					review: remoteConfig.review,
 					reviewModel: remoteConfig.reviewModel,
@@ -3174,18 +3205,18 @@ export function buildProgram(): Command {
 						harness: isoHarness,
 						agentCmd: remoteConfig.agentCmd,
 					}),
-					surfaceModel: remoteConfig.model,
+					surfaceModel: remoteConfig.triageModel,
 					applyDecide: harnessApplyDecider({
 						harness: isoHarness,
 						agentCmd: remoteConfig.agentCmd,
 					}),
-					applyModel: remoteConfig.model,
+					applyModel: remoteConfig.triageModel,
 					observationTriage: remoteConfig.observationTriage,
 					triageGate: harnessTriageGate({
 						harness: isoHarness,
 						agentCmd: remoteConfig.agentCmd,
 					}),
-					triageModel: remoteConfig.model,
+					triageModel: remoteConfig.triageModel,
 					note: (message) => console.error(`>> ${message}`),
 					env: process.env,
 				};
@@ -3276,7 +3307,7 @@ export function buildProgram(): Command {
 				noPR: config.noPR,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.buildModel,
 				sessionsDir: config.sessionsDir,
 				review: config.review,
 				reviewModel: config.reviewModel,
@@ -3312,12 +3343,12 @@ export function buildProgram(): Command {
 				arbiter: flags.arbiter ?? config.defaultArbiter,
 				doOptions,
 				surfaceGate: harnessSurfaceGate({harness, agentCmd: config.agentCmd}),
-				surfaceModel: config.model,
+				surfaceModel: config.triageModel,
 				applyDecide: harnessApplyDecider({harness, agentCmd: config.agentCmd}),
-				applyModel: config.model,
+				applyModel: config.triageModel,
 				observationTriage: config.observationTriage,
 				triageGate: harnessTriageGate({harness, agentCmd: config.agentCmd}),
-				triageModel: config.model,
+				triageModel: config.triageModel,
 				note: (message) => console.error(`>> ${message}`),
 			};
 
@@ -4386,6 +4417,10 @@ export function buildProgram(): Command {
 			'--model <id>',
 			'model the decision agent runs on (routing intent; resolved flag > env > per-repo > global > default)',
 		)
+		.option(
+			'--intake-model <id>',
+			'model the intake decision agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).',
+		)
 		.option(
 			'--harness <adapter>',
 			'harness adapter that launches the decision agent: null (default) or pi',
@@ -4420,6 +4455,11 @@ export function buildProgram(): Command {
 					...harnessFlagOverrides(flags),
 					// `--no-pr` (the PR-INTENT axis) rides the SAME chain.
 					...noPRFlagOverrides(flags),
+					// `--intake-model` rides the SAME chain (falls back to `model`
+					// when unset at all levels via `applyModelFallbacks`).
+					...(flags.intakeModel !== undefined
+						? {intakeModel: flags.intakeModel}
+						: {}),
 				},
 			});
 			if (resolved.message) {
@@ -4534,7 +4574,7 @@ export function buildProgram(): Command {
 				explicitTasksLandIn,
 				harness,
 				agentCmd: config.agentCmd,
-				model: config.model,
+				model: config.intakeModel,
 				sessionsDir: config.sessionsDir,
 				// Host-only runner IDENTITY — scopes intake's `gh`/git ops (not the
 				// decision/review AGENT launches); absent ⇒ ambient.

package/src/config.ts

@@ -528,9 +528,25 @@ export interface Config {
 	 * (`LaunchInput.model`); the ADAPTER decides HOW it reaches its tool — the pi
 	 * adapter passes `--model <model>` natively, the null/shell adapter substitutes
 	 * a `{model}` placeholder in `agentCmd`. Resolved per-repo like `integration`:
-	 * flag (`--model`) > env > per-repo > global > default (unset).
+	 * flag (`--model`) > env > per-repo > global > default (unset). The fallback
+	 * to this field from `buildModel` / `reviewModel` / `taskerLoopModel` is
+	 * applied AFTER the full precedence chain resolves (in `applyModelFallbacks`),
+	 * so a per-role knob set at ANY level (even global config) is NEVER reset by a
+	 * higher-precedence `--model`.
 	 */
 	model?: string;
+	/**
+	 * The model the BUILD agent runs on (the builder-specific override of the
+	 * general `model`). Optional with NO default so "unset" means "inherit the
+	 * general `model`" (via `applyModelFallbacks`, applied at the resolution FINAL
+	 * point — after the full flag > env > per-repo > global chain). Carried to the
+	 * build launch through the same harness seam (`LaunchInput.model`). Resolved
+	 * per-repo like `model`: flag (`--build-model`) > env (`DORFL_BUILD_MODEL`) >
+	 * per-repo > global > fallback to `model` > default (unset). DISTINCT from
+	 * `reviewModel` (Gate 2) and `taskerLoopModel` (the improver loop) — each has
+	 * its OWN knob and each falls back to `model` independently.
+	 */
+	buildModel?: string;
 	/**
 	 * Which harness adapter launches + reports liveness for a job's agent (the
 	 * harness seam, ADR §5): `null` (default — shells out to `agentCmd`,
@@ -600,11 +616,14 @@ export interface Config {
 	review: boolean;
 	/**
 	 * The model the REVIEW agent runs on (de-correlation from the builder's
-	 * `model`). Optional with NO default so "unset" means "no forced review model"
-	 * (the harness's own default). Carried to the review-agent launch through the
-	 * EXISTING harness seam (`LaunchInput.model` / `substituteModel`) — NOT a new
-	 * mechanism. Resolved like `model`: flag (`--review-model`) > env > per-repo >
-	 * global > default (unset). Distinct from the builder's `model`.
+	 * `buildModel` when explicitly set). Optional with NO default so "unset" means
+	 * "inherit the general `model`" (via `applyModelFallbacks`, applied at the
+	 * resolution FINAL point — after the full flag > env > per-repo > global chain).
+	 * Carried to the review-agent launch through the EXISTING harness seam
+	 * (`LaunchInput.model` / `substituteModel`) — NOT a new mechanism. Resolved like
+	 * `model`: flag (`--review-model`) > env > per-repo > global > fallback to
+	 * `model` > default (unset). Distinct from the builder's `buildModel` — each
+	 * has its OWN knob and each falls back to `model` independently.
 	 */
 	reviewModel?: string;
 	/**
@@ -650,14 +669,44 @@ export interface Config {
 	taskerLoopMax: number;
 	/**
 	 * The model the tasker IMPROVER loop's review agent runs on (de-correlation
-	 * from the tasker). Optional with NO default so "unset" means "no forced model"
-	 * (the harness's own default). Carried to the review-agent launch through the
-	 * EXISTING harness seam (`LaunchInput.model` / `substituteModel`). Resolved like
-	 * `model`: flag (`--tasker-loop-model`) > env > per-repo > global > default
-	 * (unset). DISTINCT from the acceptance gate's `reviewModel` (build
-	 * `--review-model`).
+	 * from the tasker when explicitly set). Optional with NO default so "unset"
+	 * means "inherit the general `model`" (via `applyModelFallbacks`, applied at
+	 * the resolution FINAL point — after the full flag > env > per-repo > global
+	 * chain). Carried to the review-agent launch through the EXISTING harness seam
+	 * (`LaunchInput.model` / `substituteModel`). Resolved like `model`: flag
+	 * (`--tasker-loop-model`) > env > per-repo > global > fallback to `model` >
+	 * default (unset). DISTINCT from the acceptance gate's `reviewModel` (build
+	 * `--review-model`) and from `buildModel` — each has its OWN knob and each falls
+	 * back to `model` independently.
 	 */
 	taskerLoopModel?: string;
+	/**
+	 * The model the ADVANCE LIFECYCLE GATES (surface, apply, triage) run on —
+	 * the fresh-context judgement agents that surface questions from blocked work
+	 * (`surface`), interpret answered questions and decide what to mint (`apply`),
+	 * and auto-disposition no-question observations (`triage`). Optional with NO
+	 * default so "unset" means "inherit the general `model`" (via
+	 * `applyModelFallbacks`, applied at the resolution FINAL point). Carried to each
+	 * gate's launch through the EXISTING harness seam (`LaunchInput.model`). Resolved
+	 * like `model`: flag (`--triage-model`) > env (`DORFL_TRIAGE_MODEL`) > per-repo >
+	 * global > fallback to `model` > default (unset). DISTINCT from `reviewModel`,
+	 * `taskerLoopModel`, `buildModel`, and `intakeModel` — each has its OWN knob and
+	 * each falls back to `model` independently.
+	 */
+	triageModel?: string;
+	/**
+	 * The model the INTAKE decision agent runs on — the front-door fresh-context
+	 * agent that reads an issue/PR and decides whether to mint a task, mint a spec,
+	 * or ask a follow-up question. Optional with NO default so "unset" means
+	 * "inherit the general `model`" (via `applyModelFallbacks`, applied at the
+	 * resolution FINAL point). Carried to the intake-agent launch through the
+	 * EXISTING harness seam (`LaunchInput.model`). Resolved like `model`: flag
+	 * (`--intake-model`) > env (`DORFL_INTAKE_MODEL`) > per-repo > global > fallback
+	 * to `model` > default (unset). DISTINCT from the advance lifecycle gates'
+	 * `triageModel` and from `buildModel`/`reviewModel`/`taskerLoopModel` — each has
+	 * its OWN knob and each falls back to `model` independently.
+	 */
+	intakeModel?: string;
 	/**
 	 * **The fresh-worktree acceptance-gate toggle** (`--fresh-worktree-gate` /
 	 * `--no-fresh-worktree-gate`). When ON (the default), the acceptance gate
@@ -1078,6 +1127,35 @@ export function mergeConfig(overrides: PartialConfig): Config {
 	return merged;
 }
 
+/**
+ * Apply the per-role model fallbacks IN PLACE on a FULLY RESOLVED {@link Config}:
+ * `buildModel`, `reviewModel`, and `taskerLoopModel` each inherit the general
+ * `model` when they are unset (i.e. were not set at ANY precedence level — flag,
+ * env, per-repo, or global). This is the single place the fallback lives; it is
+ * called at the resolution FINAL points (`resolveRepoConfigFromLoaded` for the
+ * per-repo chain; `resolveGlobalConfig` for the global-only chain) so the
+ * fallback uses the FINAL resolved `model`, never an intermediate layer's. A
+ * per-role knob set at ANY level is NEVER reset — `applyModelFallbacks` only
+ * touches fields that are still `undefined` after the full chain resolved.
+ */
+export function applyModelFallbacks(config: Config): void {
+	if (config.buildModel === undefined) {
+		config.buildModel = config.model;
+	}
+	if (config.reviewModel === undefined) {
+		config.reviewModel = config.model;
+	}
+	if (config.taskerLoopModel === undefined) {
+		config.taskerLoopModel = config.model;
+	}
+	if (config.triageModel === undefined) {
+		config.triageModel = config.model;
+	}
+	if (config.intakeModel === undefined) {
+		config.intakeModel = config.model;
+	}
+}
+
 /**
  * Persist `config` to `path` as pretty JSON (creating the parent dir). Used by
  * `work-on` to SAVE the prompted `humanWorktreesDir` on first use so the human is