faberun 0.25.1 → 0.26.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.25.1",
+  "version": "0.26.1",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/skills/faberun/references/contract.md

@@ -22,9 +22,9 @@ typecheck`). Schema version is `3`.
       "vendor": "deepseek", "sandbox": "danger-full-access",
       "config": { "provider": "deepseek-official", "api_key.env_key": "DEEPSEEK_API_KEY" } },
     "luna": { "harness": "codex", "model": "gpt-5.6-luna", "reasoning": "xhigh" },
-    "sol": { "harness": "codex", "model": "gpt-5.6-sol", "reasoning": "xhigh", "vendor": "openai-sol" },
+    "sol": { "harness": "codex", "model": "gpt-5.6-sol", "reasoning": "xhigh" },
     "opus": { "harness": "claude", "model": "opus", "permissionMode": "acceptEdits" },
-    "zcode-flash": { "harness": "zcode", "model": "glm-5.3-flash", "vendor": "zhipu-flash", "permissionMode": "edit" },
+    "zcode-flash": { "harness": "zcode", "model": "glm-5.3-flash", "permissionMode": "edit" },
     "agy-flash": { "harness": "agy", "model": "gemini-3.8-flash-low" }
   },
   "nodes": [
@@ -148,32 +148,36 @@ to its `readFiles` (every planning stage) delivers through `output`, `artifacts`
 ## Runtimes and routing
 
 Resolve a worker as `nodes[].runtime`, then `runtimeDefaults.worker`; a judge
-as `nodes[].gate.runtime`, then `runtimeDefaults.judge`. When `runtimes` and
-`runtimeDefaults` are both omitted, the factory composes them from the
-discovery catalogue (`DISCOVERY_RUNTIME_DEFINITIONS`: `dsh-deepseek`,
-`zcode-glm`, `agy-gemini` at tier 1, `codex-gpt` and `claude-sonnet` at tier 2;
-available when the binary answers and every `config["*.env_key"]` it names is
-set): the cheapest available runtime executes, the strongest runtime of a
-*different vendor* judges, persisted in `routing.assignments`; no admissible
-cross-vendor judge fails by name (`runtime_assignment_judge_unavailable`).
+as `nodes[].gate.runtime`, then `runtimeDefaults.judge`, then a contract's (or
+absent one, the machine config's) ordered `judges` list: its first entry off
+the worker's provider and its fallback chain's, unrefused and under a 90%
+usage window, hopping the same way on a later refusal without repeats,
+replacing any declared `fallback` edge outright, and blocking the node by name
+when every entry is skipped (R18).
+When `runtimes` and `runtimeDefaults` are both omitted, the factory composes
+them from the discovery catalogue (`DISCOVERY_RUNTIME_DEFINITIONS`:
+`dsh-deepseek`, `zcode-glm`, `agy-gemini` at tier 1, `codex-gpt` and
+`claude-sonnet` at tier 2; available when the binary answers and every
+`config["*.env_key"]` it names is set): the cheapest available runtime
+executes, the strongest runtime of a *different vendor* judges, persisted in
+`routing.assignments`; no admissible cross-vendor judge fails by name
+(`runtime_assignment_judge_unavailable`).
 
 `harness` names the adapter that runs the turn (`claude`, `codex`, `agy`,
-`dsh`, `zcode`, `exec-jsonl`, `replay`) and `model` what it asks; the two
-vary independently — DeepSeek answers through `dsh`, GLM through `zcode`. Name
-a runtime id `<harness>-<model>` so a recorded run says which harness produced
-it; ids take letters, numbers, dot, underscore, dash only. Vendor is resolved (`resolveVendor` in `harnesses/index.mjs`), not the
-harness name: an explicit `vendor`, else a provider-config override (a codex
-runtime with `config.model_provider: "deepseek"` is vendor `deepseek`), else
-the harness default (`claude`→anthropic, `codex`→openai, `agy`→google,
-`zcode`→zhipu); `dsh`/`replay`/`exec-jsonl` have no default and must declare
-`vendor`. Validation rejects a gate-enabled node whose worker and judge
-resolve to the same vendor, and does the same for every runtime in the
-worker's declared fallback chain (rejecting a cycle in that chain outright)
-— all statically knowable from the contract alone. The symmetric case, a
-judge fallback landing on the vendor of the worker runtime that actually ran,
-cannot be checked statically (it depends on which worker runtime ran this
-attempt) and is instead refused at execution; see Failover below. Two models of one family (a GLM 5.3-flash worker judged by GLM 5.3) pair only by
-declaring distinct `vendor` strings — a claim about review independence.
+`dsh`, `zcode`, `exec-jsonl`, `replay`) and `model` what it asks; the two vary
+independently — DeepSeek answers through `dsh`, GLM through `zcode`. Name a
+runtime id `<harness>-<model>` so a recorded run says which harness produced
+it; ids take letters, numbers, dot, underscore, dash only. Vendor is the
+canonical provider (`canonicalProvider` in `src/contract/provider.mjs`)
+derived from route, model family, or harness default (`claude`→anthropic,
+`codex`→openai, `agy`→google, `zcode`→zhipu; `dsh`/`replay`/`exec-jsonl` have
+none and must declare `vendor`), falling back to `resolveVendor` only when it
+derives none; a declared `vendor` that contradicts it is refused. Validation
+rejects a gate-enabled node whose worker and judge resolve to the same
+vendor, and does the same for every runtime in the worker's declared fallback
+chain (rejecting a cycle outright). The symmetric case for a judge fallback
+depends on which worker runtime ran and is refused at execution instead; see
+Failover below.
 
 An optional `runtimes[<id>].pricing` object declares `inputPerMTok`,
 `cachedInputPerMTok`, and `outputPerMTok` (each finite and >= 0, at

package/src/campaign/campaign-brief-graph.mjs

@@ -0,0 +1,218 @@
+/**
+ * The Campaign Brief's work graph: dependency edges, per-node worker/judge
+ * runtimes, per-runtime concurrency caps and the schedule they allow. Split
+ * out of `campaign-brief.mjs` (R20), already at this repository's 800-line
+ * ceiling, so the same-provider review marking (R20) had a file with room to
+ * land in.
+ *
+ * The frozen contract this reads has already passed `validateContract`, which
+ * is the one place that enforces same-vendor mode's tier rule
+ * (`contract/judge-independence.mjs`); a node this module marks
+ * `sameProviderReview` could only exist here because that check already
+ * passed, so the mark is a plain vendor-and-opt-in comparison, not a second
+ * enforcement of the rule.
+ */
+import { asArray } from "./brief-text.mjs";
+import { sharesVendorThroughFallback } from "../contract/judge-independence.mjs";
+
+/** @typedef {Record<string, any>} AnyRecord */
+/** @typedef {{id: string, runtimeId: string|null, model: string|null, judgeRuntimeId?: string|null, sameProviderReview?: boolean, dependsOn: string[], requirementIds: string[]}} BriefGraphNode */
+/** @typedef {{from: string, to: string}} BriefGraphEdge */
+/** @typedef {{node: string, prerequisites: string[]}} BriefBlockingNode */
+/** @typedef {{nodes: BriefGraphNode[], edges: BriefGraphEdge[], independent: string[], blocking: BriefBlockingNode[], maxParallel: number, maxConcurrent: Record<string, number>, effectiveConcurrency: number, dispatchableTogether: string[], dispatchNote: string, gaps: string[]}} BriefGraph */
+
+/**
+ * @param {AnyRecord} contract
+ * @param {AnyRecord[]} nodes
+ * @returns {BriefGraph}
+ */
+export function buildGraph(contract, nodes) {
+  const runtimes = contract.runtimes && typeof contract.runtimes === "object" && !Array.isArray(contract.runtimes)
+    ? /** @type {Record<string, AnyRecord>} */ (contract.runtimes)
+    : {};
+  const ids = new Set(nodes.map((node) => String(node.id ?? "")));
+  /** @type {string[]} */
+  const gaps = [];
+  /** @type {BriefGraphEdge[]} */
+  const edges = [];
+  /** @type {BriefGraphNode[]} */
+  const graphNodes = nodes.map((node) => {
+    const id = String(node.id ?? "");
+    const dependsOn = asArray(node.dependsOn).map(String);
+    for (const dependency of dependsOn) {
+      if (dependency === id) {
+        gaps.push(`node ${id} depends on itself`);
+      } else if (!ids.has(dependency)) {
+        gaps.push(`node ${id} depends on unknown node ${dependency}`);
+      } else {
+        edges.push({ from: dependency, to: id });
+      }
+    }
+    const runtimeId = typeof node.runtime === "string"
+      ? node.runtime
+      : typeof contract.runtimeDefaults?.worker === "string" ? contract.runtimeDefaults.worker : null;
+    const runtime = runtimeId !== null && typeof runtimes[runtimeId] === "object" ? runtimes[runtimeId] : null;
+    return {
+      id,
+      runtimeId,
+      model: runtime && typeof runtime.model === "string" ? runtime.model : null,
+      judgeRuntimeId: judgeRuntimeIdOf(contract, node),
+      sameProviderReview: sameProviderReviewOf(contract, runtimes, runtimeId, node),
+      dependsOn,
+      requirementIds: asArray(node.requirementIds).map(String),
+    };
+  });
+  const independent = graphNodes.filter((node) => node.dependsOn.length === 0).map((node) => node.id);
+  const blocking = graphNodes.filter((node) => node.dependsOn.length > 0).map((node) => ({ node: node.id, prerequisites: node.dependsOn }));
+  /** @type {Record<string, number>} */
+  const maxConcurrent = {};
+  for (const node of graphNodes) {
+    if (node.runtimeId === null) continue;
+    const runtime = runtimes[node.runtimeId];
+    const limit = runtime && Number.isInteger(runtime.maxConcurrent) && runtime.maxConcurrent > 0 ? runtime.maxConcurrent : 1;
+    maxConcurrent[node.runtimeId] = maxConcurrent[node.runtimeId] === undefined ? limit : Math.min(maxConcurrent[node.runtimeId], limit);
+  }
+  const maxParallel = Number.isInteger(contract.maxParallel) && contract.maxParallel > 0 ? contract.maxParallel : 1;
+  // Effective concurrency, and the workers that can actually be in flight
+  // together, are properties of the graph and the capacities -- not the size of
+  // the dependency-independent set. Two independent nodes still cannot run
+  // together when maxParallel is 1 or their shared runtime is at its cap.
+  const schedule = scheduleUnderCapacity(
+    graphNodes.map((node) => ({ id: node.id, runtimeId: node.runtimeId, dependsOn: node.dependsOn })),
+    () => 1,
+    maxParallel,
+    maxConcurrent,
+  );
+  const effectiveConcurrency = Math.max(1, schedule.peakConcurrency);
+  const dispatchableTogether = schedule.peakNodeIds;
+  return {
+    nodes: graphNodes,
+    edges,
+    independent,
+    blocking,
+    maxParallel,
+    maxConcurrent,
+    effectiveConcurrency,
+    dispatchableTogether,
+    dispatchNote: dispatchNoteFor(dispatchableTogether, graphNodes.length, maxParallel),
+    gaps,
+  };
+}
+
+/**
+ * @param {AnyRecord} contract
+ * @param {AnyRecord} node
+ * @returns {string|null}
+ */
+function judgeRuntimeIdOf(contract, node) {
+  const gate = node.gate;
+  const gateEnabled = gate !== false && gate !== undefined && (gate.enabled === undefined || gate.enabled === true);
+  if (!gateEnabled) return null;
+  if (typeof gate.runtime === "string") return gate.runtime;
+  return typeof contract.runtimeDefaults?.judge === "string" ? contract.runtimeDefaults.judge : null;
+}
+
+/**
+ * Whether the frozen contract already marked this node's pairing admitted
+ * under same-vendor mode (R20): the worker's declared runtime, or its one-hop
+ * fallback, shares a vendor with the judge, and only `judgeIndependence:
+ * "same-vendor"` on the contract admits that -- `validateContract` refuses
+ * every other same-vendor pairing (primary or fallback) before it can reach a
+ * frozen `contract.json`. The fallback is included because it is a real way
+ * this node lands a same-provider review, not only the primary pairing: a
+ * plan-time surface has no run to read, so it reports every reachable
+ * pairing rather than only the one dispatch happens to pick.
+ *
+ * @param {AnyRecord} contract
+ * @param {Record<string, AnyRecord>} runtimes
+ * @param {string|null} workerRuntimeId
+ * @param {AnyRecord} node
+ * @returns {boolean}
+ */
+function sameProviderReviewOf(contract, runtimes, workerRuntimeId, node) {
+  if (contract.judgeIndependence !== "same-vendor") return false;
+  const judgeRuntimeId = judgeRuntimeIdOf(contract, node);
+  if (workerRuntimeId === null || judgeRuntimeId === null) return false;
+  const judgeVendor = runtimes[judgeRuntimeId]?.vendor;
+  return sharesVendorThroughFallback(runtimes, workerRuntimeId, judgeVendor);
+}
+
+/**
+ * Why capacity does or does not let two workers run at the same time. The note
+ * is the model's honest reading of the limits, so a renderer never has to
+ * decide whether an independent pair is "simultaneously dispatchable": with
+ * `maxParallel` 1 the answer is always no.
+ *
+ * @param {string[]} dispatchableTogether
+ * @param {number} nodeCount
+ * @param {number} maxParallel
+ * @returns {string}
+ */
+function dispatchNoteFor(dispatchableTogether, nodeCount, maxParallel) {
+  if (dispatchableTogether.length >= 2) {
+    return `up to ${dispatchableTogether.length} workers run together under maxParallel ${maxParallel} and the per-runtime maxConcurrent caps`;
+  }
+  if (nodeCount < 2) return "fewer than two nodes are planned";
+  if (maxParallel <= 1) return "maxParallel is 1, so dependency-independent nodes are not simultaneously dispatchable";
+  return "each assigned runtime's maxConcurrent admits only one worker at a time";
+}
+
+/**
+ * Schedule a dependency graph under a global `maxParallel` ceiling and each
+ * runtime's own `maxConcurrent` ceiling, reporting the wall-clock makespan and
+ * the peak number of nodes running at once. `durationOf` supplies each node's
+ * duration, so scheduling the graph with lower and upper per-node durations
+ * turns a per-node range into a plan-level elapsed range. The peak is a
+ * property of the graph and the capacities, not of the dependency-independent
+ * set.
+ *
+ * @param {{id: string, runtimeId: string|null, dependsOn: string[]}[]} nodes
+ * @param {(node: {id: string}) => number} durationOf
+ * @param {number} maxParallel
+ * @param {Record<string, number>} maxConcurrent
+ * @returns {{makespanMs: number, peakConcurrency: number, peakNodeIds: string[]}}
+ */
+export function scheduleUnderCapacity(nodes, durationOf, maxParallel, maxConcurrent) {
+  const byId = new Map(nodes.map((node) => [node.id, node]));
+  const remaining = new Map();
+  const dependents = new Map();
+  for (const node of nodes) {
+    const dependencies = node.dependsOn.filter((id) => byId.has(id));
+    remaining.set(node.id, dependencies.length);
+    for (const dependency of dependencies) dependents.set(dependency, [...(dependents.get(dependency) ?? []), node.id]);
+  }
+  const running = new Map();
+  const runtimeRunning = new Map();
+  const done = new Set();
+  const limit = Number.isInteger(maxParallel) && maxParallel > 0 ? maxParallel : 1;
+  let time = 0;
+  let peak = 0;
+  /** @type {string[]} */
+  let peakNodeIds = [];
+  while (done.size < nodes.length) {
+    for (const node of nodes) {
+      if (done.has(node.id) || running.has(node.id) || (remaining.get(node.id) ?? 0) > 0) continue;
+      if (running.size >= limit) break;
+      const runtimeKey = node.runtimeId ?? "";
+      const width = node.runtimeId !== null && Number.isInteger(maxConcurrent[node.runtimeId]) && maxConcurrent[node.runtimeId] > 0 ? maxConcurrent[node.runtimeId] : 1;
+      if ((runtimeRunning.get(runtimeKey) ?? 0) >= width) continue;
+      const duration = durationOf(node);
+      running.set(node.id, time + (Number.isFinite(duration) ? Math.max(0, duration) : 0));
+      runtimeRunning.set(runtimeKey, (runtimeRunning.get(runtimeKey) ?? 0) + 1);
+      if (running.size > peak) {
+        peak = running.size;
+        peakNodeIds = [...running.keys()];
+      }
+    }
+    if (running.size === 0) break; // a cycle or nothing dispatchable
+    time = Math.min(...running.values());
+    for (const [id, finish] of [...running]) {
+      if (finish !== time) continue;
+      running.delete(id);
+      runtimeRunning.set(byId.get(id)?.runtimeId ?? "", Math.max(0, (runtimeRunning.get(byId.get(id)?.runtimeId ?? "") ?? 1) - 1));
+      done.add(id);
+      for (const dependent of dependents.get(id) ?? []) remaining.set(dependent, Math.max(0, (remaining.get(dependent) ?? 1) - 1));
+    }
+  }
+  return { makespanMs: time, peakConcurrency: peak, peakNodeIds };
+}

package/src/campaign/campaign-brief.mjs

@@ -26,6 +26,7 @@ import { contentDigest, fileDigest } from "../plan/freeze.mjs";
 import { parseSpec } from "../plan/spec.mjs";
 import { errorCode } from "../util.mjs";
 import { asArray, bulletLines, firstSentence, riskRows, successCriteriaRows, unique } from "./brief-text.mjs";
+import { buildGraph } from "./campaign-brief-graph.mjs";
 import { projectCampaignDecisions } from "./projection.mjs";
 
 /** @typedef {import("../plan/spec.mjs").ParsedSpec} ParsedSpec */
@@ -41,10 +42,7 @@ import { projectCampaignDecisions } from "./projection.mjs";
 /** @typedef {{id: string, proof: string}} BriefProofNode */
 /** @typedef {{requirementId: string, title: string, declaredNodeIds: string[], nodes: BriefProofNode[], state: CoverageState, reasons: string[]}} BriefCoverageRow */
 /** @typedef {{rows: BriefCoverageRow[], unknownIds: string[], unknownDeclared: string[], unknownStamped: string[], gaps: string[], specPath: string, planPath: string, covered: number, uncovered: number, outside: number, traceabilityMissing: number, total: number}} BriefCoverage */
-/** @typedef {{id: string, runtimeId: string|null, model: string|null, dependsOn: string[], requirementIds: string[]}} BriefGraphNode */
-/** @typedef {{from: string, to: string}} BriefGraphEdge */
-/** @typedef {{node: string, prerequisites: string[]}} BriefBlockingNode */
-/** @typedef {{nodes: BriefGraphNode[], edges: BriefGraphEdge[], independent: string[], blocking: BriefBlockingNode[], maxParallel: number, maxConcurrent: Record<string, number>, effectiveConcurrency: number, dispatchableTogether: string[], dispatchNote: string, gaps: string[]}} BriefGraph */
+/** @typedef {import("./campaign-brief-graph.mjs").BriefGraph} BriefGraph */
 /** @typedef {{status: "range"|"insufficient data", min: number|null, max: number|null, samples: number|null, reason: string|null, sourceRuns: string[], method: string|null, provenance: string|null}} BriefMeasure */
 /** @typedef {{status?: "range"|"insufficient data", min?: number|null, max?: number|null, samples?: number|null, reason?: string|null, sourceRuns?: string[], method?: string|null, provenance?: string|null}} BriefMeasureInput */
 /** @typedef {{cost?: BriefMeasureInput, duration?: BriefMeasureInput, runtimes?: string[], models?: string[], effectiveConcurrency?: number, nodeCount?: number, workerCount?: number, sampleCutoff?: string|null, method?: string[], assumptions?: string[]}} BriefEstimateInput */
@@ -156,7 +154,12 @@ export function buildBriefModel(options) {
   const coverage = buildCoverage(parsedSpec, declarations, contractNodes, specPath, planPath);
   const graph = buildGraph(contract, contractNodes);
   const journalDecisions = options.projection ? projectCampaignDecisions(options.projection) : [];
-  const decisions = buildDecisions(parsedSpec, journalDecisions);
+  // R16: an operator step the frozen plan carries as an explicit stop
+  // (`plan.humanSteps`, `src/plan/human-step.mjs`) is a human decision the
+  // spec's own "Human decisions" bullets cannot list, since it is declared on
+  // a requirement's constraints instead of that section.
+  const humanSteps = asArray(plan.humanSteps);
+  const decisions = buildDecisions(parsedSpec, journalDecisions, humanSteps);
   const estimate = buildEstimate(options.estimate, graph, options.usageSampleCutoff ?? null);
   const opening = buildOpening(parsedSpec, coverage, graph, estimate, decisions);
   const identity = buildIdentity({
@@ -391,166 +394,6 @@ function buildCoverage(parsedSpec, declarations, nodes, specPath, planPath) {
   };
 }
 
-/**
- * The actual `dependsOn` graph plus the contract's capacity limits. The
- * dependency-independent set is distinct from the workers capacity actually
- * lets dispatch together.
- *
- * @param {AnyRecord} contract
- * @param {AnyRecord[]} nodes
- * @returns {BriefGraph}
- */
-function buildGraph(contract, nodes) {
-  const runtimes = contract.runtimes && typeof contract.runtimes === "object" && !Array.isArray(contract.runtimes)
-    ? /** @type {Record<string, AnyRecord>} */ (contract.runtimes)
-    : {};
-  const ids = new Set(nodes.map((node) => String(node.id ?? "")));
-  /** @type {string[]} */
-  const gaps = [];
-  /** @type {BriefGraphEdge[]} */
-  const edges = [];
-  /** @type {BriefGraphNode[]} */
-  const graphNodes = nodes.map((node) => {
-    const id = String(node.id ?? "");
-    const dependsOn = asArray(node.dependsOn).map(String);
-    for (const dependency of dependsOn) {
-      if (dependency === id) {
-        gaps.push(`node ${id} depends on itself`);
-      } else if (!ids.has(dependency)) {
-        gaps.push(`node ${id} depends on unknown node ${dependency}`);
-      } else {
-        edges.push({ from: dependency, to: id });
-      }
-    }
-    const runtimeId = typeof node.runtime === "string"
-      ? node.runtime
-      : typeof contract.runtimeDefaults?.worker === "string" ? contract.runtimeDefaults.worker : null;
-    const runtime = runtimeId !== null && typeof runtimes[runtimeId] === "object" ? runtimes[runtimeId] : null;
-    return {
-      id,
-      runtimeId,
-      model: runtime && typeof runtime.model === "string" ? runtime.model : null,
-      dependsOn,
-      requirementIds: asArray(node.requirementIds).map(String),
-    };
-  });
-  const independent = graphNodes.filter((node) => node.dependsOn.length === 0).map((node) => node.id);
-  const blocking = graphNodes.filter((node) => node.dependsOn.length > 0).map((node) => ({ node: node.id, prerequisites: node.dependsOn }));
-  /** @type {Record<string, number>} */
-  const maxConcurrent = {};
-  for (const node of graphNodes) {
-    if (node.runtimeId === null) continue;
-    const runtime = runtimes[node.runtimeId];
-    const limit = runtime && Number.isInteger(runtime.maxConcurrent) && runtime.maxConcurrent > 0 ? runtime.maxConcurrent : 1;
-    maxConcurrent[node.runtimeId] = maxConcurrent[node.runtimeId] === undefined ? limit : Math.min(maxConcurrent[node.runtimeId], limit);
-  }
-  const maxParallel = Number.isInteger(contract.maxParallel) && contract.maxParallel > 0 ? contract.maxParallel : 1;
-  // Effective concurrency, and the workers that can actually be in flight
-  // together, are properties of the graph and the capacities -- not the size of
-  // the dependency-independent set. Two independent nodes still cannot run
-  // together when maxParallel is 1 or their shared runtime is at its cap.
-  const schedule = scheduleUnderCapacity(
-    graphNodes.map((node) => ({ id: node.id, runtimeId: node.runtimeId, dependsOn: node.dependsOn })),
-    () => 1,
-    maxParallel,
-    maxConcurrent,
-  );
-  const effectiveConcurrency = Math.max(1, schedule.peakConcurrency);
-  const dispatchableTogether = schedule.peakNodeIds;
-  return {
-    nodes: graphNodes,
-    edges,
-    independent,
-    blocking,
-    maxParallel,
-    maxConcurrent,
-    effectiveConcurrency,
-    dispatchableTogether,
-    dispatchNote: dispatchNoteFor(dispatchableTogether, graphNodes.length, maxParallel),
-    gaps,
-  };
-}
-
-/**
- * Why capacity does or does not let two workers run at the same time. The note
- * is the model's honest reading of the limits, so a renderer never has to
- * decide whether an independent pair is "simultaneously dispatchable": with
- * `maxParallel` 1 the answer is always no.
- *
- * @param {string[]} dispatchableTogether
- * @param {number} nodeCount
- * @param {number} maxParallel
- * @returns {string}
- */
-function dispatchNoteFor(dispatchableTogether, nodeCount, maxParallel) {
-  if (dispatchableTogether.length >= 2) {
-    return `up to ${dispatchableTogether.length} workers run together under maxParallel ${maxParallel} and the per-runtime maxConcurrent caps`;
-  }
-  if (nodeCount < 2) return "fewer than two nodes are planned";
-  if (maxParallel <= 1) return "maxParallel is 1, so dependency-independent nodes are not simultaneously dispatchable";
-  return "each assigned runtime's maxConcurrent admits only one worker at a time";
-}
-
-/**
- * Schedule a dependency graph under a global `maxParallel` ceiling and each
- * runtime's own `maxConcurrent` ceiling, reporting the wall-clock makespan and
- * the peak number of nodes running at once. `durationOf` supplies each node's
- * duration, so scheduling the graph with lower and upper per-node durations
- * turns a per-node range into a plan-level elapsed range. The peak is a
- * property of the graph and the capacities, not of the dependency-independent
- * set.
- *
- * @param {{id: string, runtimeId: string|null, dependsOn: string[]}[]} nodes
- * @param {(node: {id: string}) => number} durationOf
- * @param {number} maxParallel
- * @param {Record<string, number>} maxConcurrent
- * @returns {{makespanMs: number, peakConcurrency: number, peakNodeIds: string[]}}
- */
-export function scheduleUnderCapacity(nodes, durationOf, maxParallel, maxConcurrent) {
-  const byId = new Map(nodes.map((node) => [node.id, node]));
-  const remaining = new Map();
-  const dependents = new Map();
-  for (const node of nodes) {
-    const dependencies = node.dependsOn.filter((id) => byId.has(id));
-    remaining.set(node.id, dependencies.length);
-    for (const dependency of dependencies) dependents.set(dependency, [...(dependents.get(dependency) ?? []), node.id]);
-  }
-  const running = new Map();
-  const runtimeRunning = new Map();
-  const done = new Set();
-  const limit = Number.isInteger(maxParallel) && maxParallel > 0 ? maxParallel : 1;
-  let time = 0;
-  let peak = 0;
-  /** @type {string[]} */
-  let peakNodeIds = [];
-  while (done.size < nodes.length) {
-    for (const node of nodes) {
-      if (done.has(node.id) || running.has(node.id) || (remaining.get(node.id) ?? 0) > 0) continue;
-      if (running.size >= limit) break;
-      const runtimeKey = node.runtimeId ?? "";
-      const width = node.runtimeId !== null && Number.isInteger(maxConcurrent[node.runtimeId]) && maxConcurrent[node.runtimeId] > 0 ? maxConcurrent[node.runtimeId] : 1;
-      if ((runtimeRunning.get(runtimeKey) ?? 0) >= width) continue;
-      const duration = durationOf(node);
-      running.set(node.id, time + (Number.isFinite(duration) ? Math.max(0, duration) : 0));
-      runtimeRunning.set(runtimeKey, (runtimeRunning.get(runtimeKey) ?? 0) + 1);
-      if (running.size > peak) {
-        peak = running.size;
-        peakNodeIds = [...running.keys()];
-      }
-    }
-    if (running.size === 0) break; // a cycle or nothing dispatchable
-    time = Math.min(...running.values());
-    for (const [id, finish] of [...running]) {
-      if (finish !== time) continue;
-      running.delete(id);
-      runtimeRunning.set(byId.get(id)?.runtimeId ?? "", Math.max(0, (runtimeRunning.get(byId.get(id)?.runtimeId ?? "") ?? 1) - 1));
-      done.add(id);
-      for (const dependent of dependents.get(id) ?? []) remaining.set(dependent, Math.max(0, (remaining.get(dependent) ?? 1) - 1));
-    }
-  }
-  return { makespanMs: time, peakConcurrency: peak, peakNodeIds };
-}
-
 /**
  * Human decisions and delegated decisions from the explicit spec sections and
  * the active campaign journal projection; risks and planned evals only from
@@ -561,12 +404,17 @@ export function scheduleUnderCapacity(nodes, durationOf, maxParallel, maxConcurr
  *
  * @param {ParsedSpec} parsedSpec
  * @param {ProjectedDecision[]} journal
+ * @param {AnyRecord[]} [humanSteps] the frozen plan's `humanSteps` (R16)
  * @returns {BriefDecisions}
  */
-function buildDecisions(parsedSpec, journal) {
+function buildDecisions(parsedSpec, journal, humanSteps = []) {
   /** @param {string} name @returns {string} */
   const section = (name) => parsedSpec.sections.get(name)?.body ?? "";
-  const human = [...bulletLines(section("human decisions")), ...bulletLines(section("settled owner decisions"))];
+  const human = [
+    ...bulletLines(section("human decisions")),
+    ...bulletLines(section("settled owner decisions")),
+    ...humanSteps.map((step) => `${step.requirementId}: ${step.step}`),
+  ];
   const delegated = bulletLines(section("delegable decisions"));
   const evals = bulletLines(section("planned evals"));
   const risks = riskRows(section("risks"));

package/src/campaign/metrics-command.mjs

@@ -15,7 +15,7 @@ import { listNodeSnapshots, nodeSnapshotPath } from "../run/node-store.mjs";
 import { runsRoot } from "../run/paths.mjs";
 
 /** @typedef {Record<string, unknown>} JsonObject */
-/** @typedef {{runId: string, id: string, status: string, attempt?: number|null, revisions?: number|null, review?: string|null}} RunNode */
+/** @typedef {{runId: string, id: string, status: string, attempt?: number|null, revisions?: number|null, review?: string|null, sameProviderReview?: boolean|null}} RunNode */
 
 /** Flags of `faberun metrics`, declared here so the router only names them. */
 /** @type {import("node:util").ParseArgsOptionsConfig} */
@@ -153,6 +153,7 @@ function readLedgerNodeSnapshots(path) {
         attempt: typeof object.attempt === "number" ? object.attempt : null,
         revisions: typeof object.revisions === "number" ? object.revisions : null,
         review: typeof object.review === "string" ? object.review : null,
+        sameProviderReview: typeof object.sameProviderReview === "boolean" ? object.sameProviderReview : null,
       }];
     });
   } catch {
@@ -187,6 +188,7 @@ export function readMetricNodeSnapshots(runDir) {
       attempt: typeof record.attempt === "number" ? record.attempt : null,
       revisions: typeof record.revisions === "number" ? record.revisions : null,
       review: typeof record.review === "string" ? record.review : null,
+      sameProviderReview: typeof record.sameProviderReview === "boolean" ? record.sameProviderReview : null,
     });
   }
   return nodes;

package/src/cli/brand.mjs

@@ -192,6 +192,7 @@ export function renderUsage() {
     "update [--check] [--json]",
     "project <new-path> [--from <old-path>]",
     "migrate [--cwd <dir>]",
+    "prune [--cwd <dir>] [--parked] [--json]",
     "models [--probe] [--json]",
     "next [--cwd <dir>] [--json]",
     "bulk-read --question <text> --paths <a,b,c> [--json]",

package/src/cli/launch.mjs

@@ -24,6 +24,7 @@ import { readRunNodes } from "../run/node-store.mjs";
 import { spawn } from "node:child_process";
 import { validateContract } from "../contract/index.mjs";
 import { runDirectory } from "../run/paths.mjs";
+import { livePreflightCeilingSec } from "../engine/live-preflight.mjs";
 
 /**
  * The file a detached child is spawned as. It must be the CLI and not this
@@ -94,7 +95,7 @@ export function detachArgv(argv, options = {}) {
  * @param {number} [timeoutMs]
  * @returns {Promise<BootstrapRecord>}
  */
-export async function waitForBootstrap(runDir, pid, child = null, timeoutMs = 30_000) {
+export async function waitForBootstrap(runDir, pid, child = null, timeoutMs = bootstrapReadyTimeoutMs()) {
   const deadline = Date.now() + timeoutMs;
   const nonce = child?.bootstrapNonce;
   if (!nonce) throw new Error(`detached bootstrap has no start nonce for pid ${pid}`);
@@ -157,6 +158,18 @@ export async function waitForBootstrap(runDir, pid, child = null, timeoutMs = 30
   cleanupBootstrapAttempts(runDir);
   throw new Error(`detached bootstrap did not become ready for pid ${pid}`);
 }
+/**
+ * The controller answers ready only after the dispatch gate's live preflight,
+ * so the launcher waits for that ask on top of its own 30s start-up margin.
+ * Measured 2026-09-27: with a fixed 30s wait, a gate asking Opus at `xhigh`
+ * made `run --detach` and `plan --detach` report "did not become ready" for
+ * controllers that then came up and ran.
+ *
+ * @returns {number}
+ */
+export function bootstrapReadyTimeoutMs() {
+  return 30_000 + livePreflightCeilingSec() * 1000;
+}
 /**
  * @param {string} runDir
  * @param {BootstrapRecord} bootstrap