faberun 0.26.0 → 0.26.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/cli/brand.mjs

@@ -199,7 +199,7 @@ export function renderUsage() {
     "contract validate <contract.json>",
     "spec validate <file> [--strict-traceability] [--json]",
     "spec scaffold <path> [--id <id>]",
-    "plan <spec.md> --campaign <id> [--phase <phase>] [--review-rounds <n>] [--approve-below standard|high|none] [--runtime-defaults worker=<id>,judge=<id>] [--detach] [--json]",
+    "plan <spec.md> --campaign <id> [--phase <phase>] [--review-rounds <n>] [--approve-below standard|high|none] [--runtime-defaults worker=<id>,judge=<id>] [--judge-independence same-vendor] [--detach] [--json]",
     "metrics <campaign-id> [--cwd <dir>] [--json]",
     "campaign <init|watch|attach|note|resolve|close|supervise|show|list|sync|ack> ...",
     "seat <start|attach|status|stop> [<campaign-id>] [--cwd <dir>] ...",

package/src/cli/launch.mjs

@@ -24,6 +24,7 @@ import { readRunNodes } from "../run/node-store.mjs";
 import { spawn } from "node:child_process";
 import { validateContract } from "../contract/index.mjs";
 import { runDirectory } from "../run/paths.mjs";
+import { livePreflightCeilingSec } from "../engine/live-preflight.mjs";
 
 /**
  * The file a detached child is spawned as. It must be the CLI and not this
@@ -94,7 +95,7 @@ export function detachArgv(argv, options = {}) {
  * @param {number} [timeoutMs]
  * @returns {Promise<BootstrapRecord>}
  */
-export async function waitForBootstrap(runDir, pid, child = null, timeoutMs = 30_000) {
+export async function waitForBootstrap(runDir, pid, child = null, timeoutMs = bootstrapReadyTimeoutMs()) {
   const deadline = Date.now() + timeoutMs;
   const nonce = child?.bootstrapNonce;
   if (!nonce) throw new Error(`detached bootstrap has no start nonce for pid ${pid}`);
@@ -157,6 +158,18 @@ export async function waitForBootstrap(runDir, pid, child = null, timeoutMs = 30
   cleanupBootstrapAttempts(runDir);
   throw new Error(`detached bootstrap did not become ready for pid ${pid}`);
 }
+/**
+ * The controller answers ready only after the dispatch gate's live preflight,
+ * so the launcher waits for that ask on top of its own 30s start-up margin.
+ * Measured 2026-09-27: with a fixed 30s wait, a gate asking Opus at `xhigh`
+ * made `run --detach` and `plan --detach` report "did not become ready" for
+ * controllers that then came up and ran.
+ *
+ * @returns {number}
+ */
+export function bootstrapReadyTimeoutMs() {
+  return 30_000 + livePreflightCeilingSec() * 1000;
+}
 /**
  * @param {string} runDir
  * @param {BootstrapRecord} bootstrap

package/src/cli/plan.mjs

@@ -4,6 +4,7 @@
  * contested. This file only owns the wire — `src/plan/pipeline.mjs` owns the
  * sequencing and every decision the pipeline makes.
  */
+import { validateJudgeIndependence } from "../contract/judge-independence.mjs";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { detachArgv, detachSelf, waitForBootstrap } from "./launch.mjs";
@@ -144,7 +145,7 @@ export function loadVerificationSuites(path) {
 
 /**
  * @param {string} target
- * @param {{campaign?: string, phase?: string, "review-rounds"?: string, "approve-below"?: string, "runtime-defaults"?: string, reviewers?: string, runtimes?: string, verification?: string, package?: string, "targeted-fix"?: boolean, detach?: boolean, resolve?: string, answer?: string[], json?: boolean}} values
+ * @param {{campaign?: string, phase?: string, "review-rounds"?: string, "approve-below"?: string, "runtime-defaults"?: string, reviewers?: string, runtimes?: string, verification?: string, package?: string, "targeted-fix"?: boolean, "judge-independence"?: string, detach?: boolean, resolve?: string, answer?: string[], json?: boolean}} values
  * @returns {Promise<void>}
  */
 export async function planCli(target, values) {
@@ -166,6 +167,9 @@ export async function planCli(target, values) {
     ? loadVerificationSuites(values.verification)
     : {};
   const packageMode = packageModeOf(values.package);
+  const judgeIndependence = values["judge-independence"] === undefined
+    ? undefined
+    : validateJudgeIndependence(values["judge-independence"], "--judge-independence");
 
   if (values.detach === true) {
     const argv = ["plan", specPath, "--campaign", campaignId, "--phase", phase, "--review-rounds", String(reviewRounds)];
@@ -176,6 +180,7 @@ export async function planCli(target, values) {
     if (typeof values.verification === "string" && values.verification) argv.push("--verification", resolve(values.verification));
     if (packageMode !== "implementation") argv.push("--package", packageMode);
     if (values["targeted-fix"] === true) argv.push("--targeted-fix");
+    if (judgeIndependence !== undefined) argv.push("--judge-independence", judgeIndependence);
     const failurePath = planBootstrapFailurePath(process.cwd(), campaignId, phase);
     // Read the campaign before creating anything: the failure record lives
     // inside the campaign tree, so a typo in --campaign would otherwise leave
@@ -222,6 +227,7 @@ export async function planCli(target, values) {
       verification,
       targetedFix: values["targeted-fix"] === true,
       packageMode,
+      ...(judgeIndependence === undefined ? {} : { judgeIndependence }),
       launch: async (contractPath, contract) => {
         const child = detachSelf("run", contractPath);
         if (child.pid === undefined) throw new Error("detached planning run has no pid");

package/src/cli.mjs

@@ -128,6 +128,7 @@ export const COMMAND_OPTIONS = {
     verification: { type: "string" },
     package: { type: "string" },
     "targeted-fix": { type: "boolean" },
+    "judge-independence": { type: "string" },
     detach: { type: "boolean" },
     resolve: { type: "string" },
     answer: { type: "string", multiple: true },

package/src/engine/live-preflight.mjs

@@ -46,7 +46,7 @@ const LIVE_PREFLIGHT_OUTPUT_LIMIT_BYTES = 512 * 1024;
  * whole is part of the answer.
  *
  * @param {string} contractPath
- * @param {{static?: boolean, liveTimeoutSec?: number, persisted?: boolean}} [options]
+ * @param {{static?: boolean, liveTimeoutSec?: number, minimumTimeoutSec?: number, persisted?: boolean}} [options]
  * @returns {Promise<ProbeResult[]>}
  */
 export async function preflightContract(contractPath, options = {}) {
@@ -70,7 +70,7 @@ export async function preflightContract(contractPath, options = {}) {
  * once, so a caller cannot accidentally ask a different question.
  *
  * @param {{runtime: RuntimeSnapshot, requiredCapabilitySets?: import("../harnesses/index.mjs").CapabilityRequirements[]}[]} entries
- * @param {{static?: boolean, liveTimeoutSec?: number, cwd?: string}} [options]
+ * @param {{static?: boolean, liveTimeoutSec?: number, minimumTimeoutSec?: number, cwd?: string}} [options]
  * @returns {Promise<ProbeResult[]>}
  */
 export async function preflightRuntimes(entries, options = {}) {
@@ -80,7 +80,7 @@ export async function preflightRuntimes(entries, options = {}) {
   ));
   if (options.static === true) return staticChecks;
 
-  const timeoutSec = livePreflightTimeout(options.liveTimeoutSec);
+  const configuredTimeoutSec = configuredLivePreflightTimeout(options.liveTimeoutSec);
   let liveRepo;
   try {
     liveRepo = createLivePreflightRepo();
@@ -95,7 +95,7 @@ export async function preflightRuntimes(entries, options = {}) {
   }
   try {
     return await Promise.all(staticChecks.map(async (check, index) => {
-      const live = await livePreflight(runtimes[index], liveRepo, timeoutSec);
+      const live = await livePreflight(runtimes[index], liveRepo, configuredTimeoutSec ?? Math.max(options.minimumTimeoutSec ?? 0, defaultLivePreflightTimeout(runtimes[index])));
       const liveDetail = live.status === "done"
         ? `live done · usage ${formatUsage(live.usage)} · cost ${formatCost(live.costUsd)}`
         : `live ${live.status} · ${live.error?.code ?? "provider_error"}: ${redactProviderText(live.error?.message ?? "generation failed")} · usage ${formatUsage(live.usage)} · cost ${formatCost(live.costUsd)}`;
@@ -116,16 +116,54 @@ export async function preflightRuntimes(entries, options = {}) {
     rmSync(liveRepo, { recursive: true, force: true });
   }
 }
-/** @param {number|undefined} configured */
-function livePreflightTimeout(configured) {
+/**
+ * An explicit budget (option, then environment) applies to every runtime.
+ *
+ * @param {number|undefined} configured
+ * @returns {number|null}
+ */
+function configuredLivePreflightTimeout(configured) {
   const raw = configured ?? (process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC === undefined
-    ? 15
+    ? null
     : Number(process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC));
+  if (raw === null) return null;
   if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) {
     throw new TypeError("preflight live timeout must be a positive number of seconds");
   }
   return raw;
 }
+/**
+ * Without an explicit budget, the wait follows the runtime's reasoning effort:
+ * a model at high effort thinks before answering even a one-word prompt.
+ * Measured 2026-09-26: Opus 5.5 at `xhigh` failed every `faberun plan`
+ * preflight at 15 s and passed once the budget was raised, so the planning
+ * pipeline was refusing a runtime that was healthy.
+ *
+ * @param {RuntimeSnapshot} runtime
+ * @returns {number}
+ */
+export function defaultLivePreflightTimeout(runtime) {
+  // Keep LIVE_PREFLIGHT_CEILING_SEC equal to the largest value returned here.
+  const reasoning = /** @type {{reasoning?: unknown}} */ (runtime).reasoning;
+  if (reasoning === "xhigh" || reasoning === "max") return 180;
+  if (reasoning === "high") return 60;
+  return 15;
+}
+/**
+ * The longest a live preflight can take without an explicit budget: what a
+ * detached launcher must be willing to wait before the controller it spawned
+ * can report ready, because the dispatch gate asks before it does.
+ */
+export const LIVE_PREFLIGHT_CEILING_SEC = 180;
+/**
+ * The longest one live preflight ask may take under the current environment.
+ *
+ * @returns {number}
+ */
+export function livePreflightCeilingSec() {
+  const override = Number(process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC);
+  return process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC !== undefined && Number.isFinite(override) && override > 0 ? override : LIVE_PREFLIGHT_CEILING_SEC;
+}
 /** @returns {string} */
 function createLivePreflightRepo() {
   const directory = mkdtempSync(join(tmpdir(), "faberun-preflight-"));

package/src/engine/run-identity.mjs

@@ -507,11 +507,12 @@ export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
   // worker and no judge, and can spend no availability.
   if (blocking === null && launchMayDispatch(runDir)) {
     // measured 2026-09-22: asking four routed runtimes in parallel took about
-    // 18s, so the default budget is 60s. FABERUN_PREFLIGHT_TIMEOUT_SEC stays
-    // the operator override; preflightContract validates it, so only a valid
-    // number is lifted here.
+    // 18s, so no runtime is given less than 60s here; a runtime at high
+    // reasoning effort gets its longer default (defaultLivePreflightTimeout).
+    // FABERUN_PREFLIGHT_TIMEOUT_SEC stays the operator override for every
+    // runtime; preflightContract validates it, so only a valid number is lifted.
     const override = Number(process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC);
-    const timeoutSec = process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC !== undefined && Number.isFinite(override) && override > 0 ? override : 60;
+    const timeoutSec = process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC !== undefined && Number.isFinite(override) && override > 0 ? override : undefined;
     const probes = await livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec);
     const silent = probes.filter((probe) => liveSilenceCause(probe) !== null);
     writeJsonAtomic(join(runDir, "env-preflight.json"), evidence(silent.length === 0, probes));
@@ -536,6 +537,8 @@ export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
   throw Object.assign(new Error(`env_preflight_failed: ${blocking} · the run stays resumable: fix the environment and resume ${runDir}`), { code: "env_preflight_failed" });
 }
 
+/** No routed runtime is given less than this by the dispatch gate. */
+const GATE_MINIMUM_PREFLIGHT_SEC = 60;
 /**
  * The live half of the gate for one launch. Every routed runtime either holds
  * a verdict this machine recorded inside its freshness window -- reused, the
@@ -552,7 +555,7 @@ export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
  * @param {ValidatedContract} contract
  * @param {string} runDir
  * @param {SourceIdentity|undefined} sourceIdentity
- * @param {number} timeoutSec
+ * @param {number|undefined} timeoutSec
  * @returns {Promise<ProbeResult[]>}
  */
 async function livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec) {
@@ -628,7 +631,7 @@ async function livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec)
       };
     });
   }
-  const probes = await preflightContract(join(runDir, "contract.json"), { liveTimeoutSec: timeoutSec, persisted: true });
+  const probes = await preflightContract(join(runDir, "contract.json"), { ...(timeoutSec === undefined ? {} : { liveTimeoutSec: timeoutSec }), minimumTimeoutSec: GATE_MINIMUM_PREFLIGHT_SEC, persisted: true });
   // What this launch bought is durable from here on: every ask that reached a
   // provider -- a refusal included, an answer being an answer -- is recorded
   // under the provider's own identity. Silence and a command that never

package/src/plan/contest.mjs

@@ -44,6 +44,7 @@ import { writeJsonAtomic } from "../run/store.mjs";
  *   targetedFix: boolean,
  *   approveBelow: "standard"|"high"|"none",
  *   repoFacts: import("./repo-facts.mjs").RepoFacts,
+ *   judgeIndependence?: "same-vendor",
  * }} ContestResumeContext
  */
 /** @typedef {{formatVersion: 1, status: "contested", rounds: number, findings: PlanFindingOutput[], plan: PlanOutput|null, resume: ContestResumeContext}} ContestedPlanRecord */

package/src/plan/pipeline.mjs

@@ -26,6 +26,7 @@ import { campaignCli } from "../cli/campaign.mjs";
 import { appendJsonl } from "../run/store.mjs";
 import { allowanceDelta, allowanceEventFields, sampleAllowance } from "../seat/allowance.mjs";
 import { askPlanningRuntimes, refusePlanningSilence, refuseUnplannableRuntimes } from "./preflight.mjs";
+import { validateJudgeIndependence } from "../contract/judge-independence.mjs";
 import { firstEligibleReviewer, reviewerProvenanceOf } from "./reviewer.mjs";
 import { parseSpec, validateSpec } from "./spec.mjs";
 import { collectRepoFacts } from "./repo-facts.mjs";
@@ -96,7 +97,7 @@ export const DEFAULT_NODE_BUDGET_MS = 600_000;
 const APPROVE_BELOW_VALUES = new Set(["standard", "high", "none"]);
 
 /**
- * @param {{specPath: string, campaignId: string, phase: string, cwd?: string, reviewRounds?: number, approveBelow?: ApproveBelow, runtimeDefaults?: {worker?: string, judge?: string}, reviewers?: string[], runtimes: Record<string, JsonObject>, verification?: VerificationSuites, packageMode?: import("./sizing.mjs").PackageMode, targetedFix?: boolean, launch: LaunchFn, wait: WaitFn, ask?: AskFn}} options
+ * @param {{specPath: string, campaignId: string, phase: string, cwd?: string, reviewRounds?: number, approveBelow?: ApproveBelow, runtimeDefaults?: {worker?: string, judge?: string}, reviewers?: string[], runtimes: Record<string, JsonObject>, verification?: VerificationSuites, packageMode?: import("./sizing.mjs").PackageMode, targetedFix?: boolean, judgeIndependence?: "same-vendor", launch: LaunchFn, wait: WaitFn, ask?: AskFn}} options
  *   `targetedFix` allows a plan with a single node. Sizing refuses one by
  *   default because a phase that decomposes into one node is usually a plan
  *   that was never decomposed; a targeted fix is the case where one node is
@@ -106,8 +107,9 @@ const APPROVE_BELOW_VALUES = new Set(["standard", "high", "none"]);
 export async function runPlanningPipeline(options) {
   const {
     specPath, campaignId, phase, runtimes, launch, wait,
-    reviewRounds = 2, runtimeDefaults = {}, reviewers = [], verification = {}, targetedFix = false,
+    reviewRounds = 2, runtimeDefaults = {}, reviewers = [], verification = {}, targetedFix = false, judgeIndependence,
   } = options;
+  if (judgeIndependence !== undefined) validateJudgeIndependence(judgeIndependence, "judgeIndependence");
   const ask = options.ask ?? askPlanningRuntimes;
   // Implementation work is sized by what it writes; exploratory work -- an
   // audit, a review, a survey -- by what it reads, because it writes one
@@ -123,7 +125,7 @@ export async function runPlanningPipeline(options) {
   const campaignPath = campaignTree(cwd, campaignId);
   const campaign = readCampaign(campaignPath);
   if (campaign.status !== "active") throw new Error(`campaign is closed: ${campaignId}`);
-  refuseUnplannableRuntimes(runtimes, runtimeDefaults, packageMode);
+  refuseUnplannableRuntimes(runtimes, runtimeDefaults, packageMode, judgeIndependence);
   refusePlanningSilence(await ask(runtimes, runtimeDefaults, cwd), cwd);
 
   const relativeSpecPath = repoRelativePath(cwd, specPath, "specPath");
@@ -275,6 +277,7 @@ export async function runPlanningPipeline(options) {
     resume: {
       campaignId, phase, specPath: relativeSpecPath, specDigest, reviewRounds,
       runtimeDefaults, reviewers, runtimes, verification, packageMode, targetedFix, approveBelow, repoFacts,
+      ...(judgeIndependence === undefined ? {} : { judgeIndependence }),
     },
   });
 
@@ -297,7 +300,7 @@ export async function runPlanningPipeline(options) {
    * @param {PlanOutput} currentPlan
    * @returns {AssembledPlan}
    */
-  const assembleFrozenNodes = (currentPlan) => assembleFrozenPlan(currentPlan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults });
+  const assembleFrozenNodes = (currentPlan) => assembleFrozenPlan(currentPlan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence });
 
   /**
    * The raw contract exactly as `freezePlan` will assemble and validate it.
@@ -307,7 +310,7 @@ export async function runPlanningPipeline(options) {
    * @param {AssembledPlan} assembly
    * @returns {JsonObject}
    */
-  const frozenContractRaw = (assembly) => frozenContractRawOf(assembly, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, verification });
+  const frozenContractRaw = (assembly) => frozenContractRawOf(assembly, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, verification, judgeIndependence });
 
   const roundsResult = await runReviewRounds({
     reviewRounds, plan, rejectedDraft: plan === null ? draft.output.plan : undefined, findings, cwd, plansDir, scratchDir, workingPlanPath, relativeWorkingPlanPath,
@@ -559,11 +562,11 @@ function taggedStageError(planStage, error) {
  * `plan.json`.
  *
  * @param {PlanOutput} currentPlan
- * @param {{repoFacts: import("./repo-facts.mjs").RepoFacts, packageMode: import("./sizing.mjs").PackageMode, targetedFix: boolean, phase: string, cwd: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}}} ctx
+ * @param {{repoFacts: import("./repo-facts.mjs").RepoFacts, packageMode: import("./sizing.mjs").PackageMode, targetedFix: boolean, phase: string, cwd: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, judgeIndependence?: "same-vendor"}} ctx
  * @returns {AssembledPlan}
  */
 export function assembleFrozenPlan(currentPlan, ctx) {
-  const { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults } = ctx;
+  const { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence } = ctx;
   let sizing;
   try {
     sizing = applySizingRules(
@@ -580,6 +583,7 @@ export function assembleFrozenPlan(currentPlan, ctx) {
       runtimes: /** @type {Record<string, import("./routing.mjs").RoutingRuntime>} */ (runtimes),
       availability: availabilityOf(runtimes),
       runtimeDefaults,
+      ...(judgeIndependence === undefined ? {} : { judgeIndependence }),
     });
   } catch (error) {
     throw taggedStageError("routing", error);
@@ -605,11 +609,11 @@ export function assembleFrozenPlan(currentPlan, ctx) {
  * for the same reason.
  *
  * @param {AssembledPlan} assembly
- * @param {{campaignId: string, phase: string, campaignGoal: string, cwd: string, plansDir: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, verification: VerificationSuites}} ctx
+ * @param {{campaignId: string, phase: string, campaignGoal: string, cwd: string, plansDir: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, verification: VerificationSuites, judgeIndependence?: "same-vendor"}} ctx
  * @returns {JsonObject}
  */
 export function frozenContractRawOf({ sizing, nodes }, ctx) {
-  const { campaignId, phase, campaignGoal, cwd, plansDir, runtimes, runtimeDefaults, verification } = ctx;
+  const { campaignId, phase, campaignGoal, cwd, plansDir, runtimes, runtimeDefaults, verification, judgeIndependence } = ctx;
   return {
     schemaVersion: PROTOCOL_SCHEMA_VERSION,
     contractVersion: CONTRACT_VERSION,
@@ -628,6 +632,9 @@ export function frozenContractRawOf({ sizing, nodes }, ctx) {
     maxParallel: provenParallelism(sizing.plan),
     runtimes,
     runtimeDefaults,
+    // The operator's opt-in, carried verbatim: the frozen contract is
+    // validated under the same judge-independence rule its routing used.
+    ...(judgeIndependence === undefined ? {} : { judgeIndependence }),
     // The operator's ratchets, carried verbatim: which suites a repository
     // runs on every node is the operator's policy, supplied through
     // `--verification`, never derived from repository facts. Validated at the

package/src/plan/preflight.mjs

@@ -11,6 +11,7 @@ import { liveSilenceCause } from "../engine/live-silence.mjs";
 import { harnessCapabilities } from "../harnesses/index.mjs";
 import { assertRuntimeExecutesCommands, validateRuntime } from "../contract/runtime.mjs";
 import { effectiveProvider } from "../contract/provider.mjs";
+import { SAME_VENDOR_REVIEW_MODE, sameVendorTierRefusal } from "../contract/judge-independence.mjs";
 
 /**
  * The runtimes a planning run will spend, asked once before its first stage.
@@ -90,10 +91,18 @@ export function refusePlanningSilence(checks, cwd) {
  *
  * @param {Record<string, Record<string, unknown>>} runtimes
  * @param {{worker?: string, judge?: string}} runtimeDefaults
+ * In same-vendor mode (`--judge-independence same-vendor`) a shared vendor is
+ * admitted exactly as the contract validator admits it: the judge's tier is
+ * declared and at or above that of the worker and of every fallback runtime of
+ * the same vendor. Measured 2026-09-27: without the mode on `plan`, a
+ * single-provider catalogue (Sonnet worker, Opus planner and judge) could not
+ * plan at all, though its frozen contract would have validated in the mode.
+ *
  * @param {"implementation"|"exploratory"} packageMode
+ * @param {"same-vendor"} [judgeIndependence]
  * @returns {void}
  */
-export function refuseUnplannableRuntimes(runtimes, runtimeDefaults, packageMode) {
+export function refuseUnplannableRuntimes(runtimes, runtimeDefaults, packageMode, judgeIndependence) {
   const worker = runtimeDefaults.worker;
   if (!worker || !runtimes[worker]) return;
   if (packageMode === "implementation") {
@@ -105,16 +114,19 @@ export function refuseUnplannableRuntimes(runtimes, runtimeDefaults, packageMode
   }
   const judge = runtimeDefaults.judge;
   if (!judge || !runtimes[judge]) return;
-  /** @type {Set<string>} */
-  const vendors = new Set();
+  const judgeVendor = effectiveProvider(/** @type {import("../contract/provider.mjs").ProviderInput & {vendor?: string}} */ (runtimes[judge]));
+  if (judgeVendor === undefined) return;
   const seen = new Set();
   for (let id = /** @type {string|undefined} */ (worker); id && runtimes[id] && !seen.has(id); id = /** @type {string|undefined} */ (runtimes[id].fallback)) {
     seen.add(id);
     const provider = effectiveProvider(/** @type {import("../contract/provider.mjs").ProviderInput & {vendor?: string}} */ (runtimes[id]));
-    if (provider !== undefined) vendors.add(provider);
-  }
-  const judgeVendor = effectiveProvider(/** @type {import("../contract/provider.mjs").ProviderInput & {vendor?: string}} */ (runtimes[judge]));
-  if (judgeVendor !== undefined && vendors.has(judgeVendor)) {
-    throw new Error(`--runtime-defaults judge=${judge} shares vendor ${judgeVendor} with worker ${worker} or its fallback, so no frozen node could route its judge; name a judge of another vendor`);
+    if (provider !== judgeVendor) continue;
+    if (judgeIndependence !== SAME_VENDOR_REVIEW_MODE) {
+      throw new Error(`--runtime-defaults judge=${judge} shares vendor ${judgeVendor} with worker ${worker} or its fallback, so no frozen node could route its judge; name a judge of another vendor, or pass --judge-independence same-vendor`);
+    }
+    const refusal = sameVendorTierRefusal(/** @type {{harness: string, model: string}} */ (runtimes[id]), /** @type {{harness: string, model: string}} */ (runtimes[judge]));
+    if (refusal) {
+      throw new Error(`--runtime-defaults judge=${judge} shares vendor ${judgeVendor} with ${id === worker ? "worker" : "worker fallback"} ${id} under --judge-independence same-vendor, but ${refusal.message}`);
+    }
   }
 }

package/src/plan/resolve.mjs

@@ -98,7 +98,7 @@ export async function resolvePlanningPipeline({ plansDir, cwd, answers }) {
   if (record.status !== "contested") throw new Error(`plan at ${planPath} is not contested (status: ${record.status})`);
   if (!record.plan) throw new Error(`plan at ${planPath} has no plan to resume: the draft or revise that produced it never validated; run faberun plan again instead of --resolve`);
   if (!record.resume) throw new Error(`plan at ${planPath} predates faberun plan --resolve and carries no resume context; run faberun plan again`);
-  const { campaignId, phase, specPath, specDigest, runtimeDefaults, reviewers, runtimes, verification, packageMode, targetedFix, approveBelow, repoFacts } = record.resume;
+  const { campaignId, phase, specPath, specDigest, runtimeDefaults, reviewers, runtimes, verification, packageMode, targetedFix, approveBelow, repoFacts, judgeIndependence } = record.resume;
   // R16: recomputed from the same spec bytes the contest recorded, so a plan
   // resumed through --resolve carries the same declared operator steps a
   // fresh freeze would.
@@ -137,12 +137,12 @@ export async function resolvePlanningPipeline({ plansDir, cwd, answers }) {
     : ["the frozen contract carries neither sharedVerification nor finalVerification, so no repository ratchet runs on its nodes and no final check closes the phase; pass --verification <file> if the target repository has ratchets every node must run"];
   let stage = "sizing";
   try {
-    const assembled = assembleFrozenPlan(plan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults });
+    const assembled = assembleFrozenPlan(plan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence });
     stage = "freeze";
     logStage("sizing", { transformations: assembled.sizing.transformations.length, nodeCount: assembled.sizing.plan.nodes.length, overheadMinutes: assembled.sizing.estimate.overheadMinutes });
     logStage("routing", { assignments: Object.keys(assembled.routing.assignments).length });
     const highestRiskTier = highestOf(assembled.sizing.plan.nodes.map((node) => node.riskTier ?? RISK_TIERS[0]));
-    const frozen = freezePlan(frozenContractRawOf(assembled, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, verification }), {
+    const frozen = freezePlan(frozenContractRawOf(assembled, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, verification, judgeIndependence }), {
       outDir: plansDir,
       phases: assembled.phases,
       spec: { path: specPath, digest: specDigest },

package/src/plan/routing.mjs

@@ -14,6 +14,7 @@
 import { ROUTING_STRATEGIES } from "../contract/runtime.mjs";
 import { cheapest, isRuntimeAvailable, strongest } from "../engine/runtime-discovery.mjs";
 import { effectiveProvider } from "../contract/provider.mjs";
+import { SAME_VENDOR_REVIEW_MODE, sameVendorTierRefusal } from "../contract/judge-independence.mjs";
 
 /** @typedef {import("../contract/runtime.mjs").RoutingStrategy} RoutingStrategy */
 /** @typedef {RoutingStrategy|"declared"} AppliedStrategy */
@@ -27,12 +28,18 @@ import { effectiveProvider } from "../contract/provider.mjs";
  * reader, `isRuntimeAvailable` in runtime-discovery.mjs.
  * @typedef {{available: boolean, exhaustedUntil: string|null, observedAt?: string|null, window?: string|null, remaining?: number|null, [key: string]: unknown}} RoutingAvailability
  */
-/** @typedef {{vendor: string, tier?: number|string, costRank?: number, fallback?: string, [key: string]: unknown}} RoutingRuntime */
+/** @typedef {{vendor: string, harness?: string, model?: string, tier?: number|string, costRank?: number, fallback?: string, [key: string]: unknown}} RoutingRuntime */
 /** @typedef {{id: string, taskKind?: string, riskTier?: string}} RoutingNode */
 /** @typedef {{taskKind?: string, riskTier?: string}} RoutingWhen */
 /** @typedef {{name?: string, when: RoutingWhen, prefer: string[], role: "worker"|"judge", strategy?: RoutingStrategy}} RoutingRule */
 /** @typedef {{worker?: string, judge?: string}} RoutingRoleMap */
-/** @typedef {{table?: RoutingRule[], runtimes: Record<string, RoutingRuntime>, availability?: Record<string, RoutingAvailability>, runtimeDefaults?: RoutingRoleMap, overrides?: Record<string, RoutingRoleMap>}} RoutingConfig */
+/**
+ * Why a runtime may not take a role on a node, or `null` when it may: the
+ * judge's bar follows the worker actually chosen (its vendor, its fallback
+ * chain, and in same-vendor mode the tier rule); the worker has none.
+ * @typedef {(id: string, runtime: RoutingRuntime) => string|null} JudgeBar
+ */
+/** @typedef {{table?: RoutingRule[], runtimes: Record<string, RoutingRuntime>, availability?: Record<string, RoutingAvailability>, runtimeDefaults?: RoutingRoleMap, overrides?: Record<string, RoutingRoleMap>, judgeIndependence?: "same-vendor"}} RoutingConfig */
 /** @typedef {{worker: string|null, judge: string|null, rule: {worker: string, judge: string}, strategy: {worker: AppliedStrategy|null, judge: AppliedStrategy|null}, reason: {worker: string, judge: string}}} RoutingAssignment */
 /** @typedef {{nodeId: string, role: "worker"|"judge", rule: string}} RoutingUnmet */
 /** @typedef {{assignments: Record<string, RoutingAssignment>, unmet: RoutingUnmet[]}} RoutingResult */
@@ -53,6 +60,7 @@ export function resolveRuntimes(nodes, config, options = {}) {
   const runtimeDefaults = config.runtimeDefaults ?? {};
   const overrides = config.overrides ?? {};
   const previous = options.previous ?? {};
+  const judgeIndependence = config.judgeIndependence;
 
   // A strategy name outside the vocabulary is an authored-table defect, not an
   // unobservable datum: it fails fast, before any node is resolved.
@@ -69,13 +77,13 @@ export function resolveRuntimes(nodes, config, options = {}) {
 
   for (const node of nodes) {
     const override = overrides[node.id] ?? {};
-    const worker = resolveRole(node, "worker", { runtimes, availability, runtimeDefaults, table, override, forbiddenVendors: EMPTY_VENDORS, previousId: previous[node.id]?.worker });
+    const worker = resolveRole(node, "worker", { runtimes, availability, runtimeDefaults, table, override, judgeBar: NO_BAR, previousId: previous[node.id]?.worker });
     if (worker.runtimeId === null) unmet.push({ nodeId: node.id, role: "worker", rule: worker.rule });
-    // The judge's forbidden vendors follow the worker runtime that was
-    // actually chosen, never the row that named it — a worker unmet leaves
-    // nothing to conflict with, so the judge resolves without restriction.
-    const forbiddenVendors = worker.runtimeId ? forbiddenJudgeVendors(worker.runtimeId, runtimes) : EMPTY_VENDORS;
-    const judge = resolveRole(node, "judge", { runtimes, availability, runtimeDefaults, table, override, forbiddenVendors, previousId: previous[node.id]?.judge });
+    // The judge's bar follows the worker runtime that was actually chosen,
+    // never the row that named it — a worker unmet leaves nothing to
+    // conflict with, so the judge resolves without restriction.
+    const judgeBar = worker.runtimeId ? judgeBarFor(worker.runtimeId, runtimes, judgeIndependence) : NO_BAR;
+    const judge = resolveRole(node, "judge", { runtimes, availability, runtimeDefaults, table, override, judgeBar, previousId: previous[node.id]?.judge });
     if (judge.runtimeId === null) unmet.push({ nodeId: node.id, role: "judge", rule: judge.rule });
     assignments[node.id] = {
       worker: worker.runtimeId,
@@ -94,8 +102,8 @@ export function resolveRuntimes(nodes, config, options = {}) {
   return { assignments, unmet };
 }
 
-/** @type {ReadonlySet<string>} */
-const EMPTY_VENDORS = Object.freeze(new Set());
+/** @type {JudgeBar} */
+const NO_BAR = () => null;
 
 /**
  * Precedence for one role on one node: an explicit node override, then the
@@ -110,16 +118,16 @@ const EMPTY_VENDORS = Object.freeze(new Set());
  *
  * @param {RoutingNode} node
  * @param {"worker"|"judge"} role
- * @param {{runtimes: Record<string, RoutingRuntime>, availability: Record<string, RoutingAvailability>, runtimeDefaults: RoutingRoleMap, table: RoutingRule[], override: RoutingRoleMap, forbiddenVendors: ReadonlySet<string>, previousId: string|undefined}} context
+ * @param {{runtimes: Record<string, RoutingRuntime>, availability: Record<string, RoutingAvailability>, runtimeDefaults: RoutingRoleMap, table: RoutingRule[], override: RoutingRoleMap, judgeBar: JudgeBar, previousId: string|undefined}} context
  * @returns {{runtimeId: string|null, rule: string, strategy: AppliedStrategy|null, reason: string}}
  */
 function resolveRole(node, role, context) {
-  const { runtimes, availability, runtimeDefaults, table, override, forbiddenVendors, previousId } = context;
+  const { runtimes, availability, runtimeDefaults, table, override, judgeBar, previousId } = context;
 
   if (override[role] !== undefined) {
     const id = override[role];
     return {
-      runtimeId: admits(id, runtimes, availability, forbiddenVendors) ? id : null,
+      runtimeId: admits(id, runtimes, availability, judgeBar) ? id : null,
       rule: "override",
       strategy: "declared",
       reason: `operator override on node ${node.id}`,
@@ -129,7 +137,7 @@ function resolveRole(node, role, context) {
   if (runtimeDefaults[role] !== undefined) {
     const id = runtimeDefaults[role];
     return {
-      runtimeId: admits(id, runtimes, availability, forbiddenVendors) ? id : null,
+      runtimeId: admits(id, runtimes, availability, judgeBar) ? id : null,
       rule: "runtimeDefaults",
       strategy: "declared",
       reason: "operator runtimeDefaults",
@@ -141,13 +149,13 @@ function resolveRole(node, role, context) {
     && (candidate.when.riskTier === undefined || candidate.when.riskTier === node.riskTier));
   if (row) {
     const strategy = row.strategy ?? "priority";
-    const decision = chooseByStrategy(strategy, row.prefer, { runtimes, availability, forbiddenVendors, previousId });
+    const decision = chooseByStrategy(strategy, row.prefer, { runtimes, availability, judgeBar, previousId });
     return { runtimeId: decision.runtimeId, rule: ruleLabel(row), strategy, reason: decision.reason };
   }
 
   const discovered = role === "worker"
-    ? cheapestAvailable(runtimes, availability, forbiddenVendors)
-    : strongestAvailable(runtimes, availability, forbiddenVendors);
+    ? cheapestAvailable(runtimes, availability, judgeBar)
+    : strongestAvailable(runtimes, availability, judgeBar);
   return {
     runtimeId: discovered,
     rule: "discovery",
@@ -168,12 +176,12 @@ function resolveRole(node, role, context) {
  *
  * @param {RoutingStrategy} strategy
  * @param {string[]} prefer
- * @param {{runtimes: Record<string, RoutingRuntime>, availability: Record<string, RoutingAvailability>, forbiddenVendors: ReadonlySet<string>, previousId: string|undefined}} context
+ * @param {{runtimes: Record<string, RoutingRuntime>, availability: Record<string, RoutingAvailability>, judgeBar: JudgeBar, previousId: string|undefined}} context
  * @returns {{runtimeId: string|null, reason: string}}
  */
 function chooseByStrategy(strategy, prefer, context) {
-  const { runtimes, availability, forbiddenVendors, previousId } = context;
-  const candidates = prefer.map((id) => ({ id, admissible: admits(id, runtimes, availability, forbiddenVendors) }));
+  const { runtimes, availability, judgeBar, previousId } = context;
+  const candidates = prefer.map((id) => ({ id, admissible: admits(id, runtimes, availability, judgeBar) }));
   const admissible = candidates.filter((candidate) => candidate.admissible);
   if (admissible.length === 0) return { runtimeId: null, reason: "no admissible candidate in the prefer list" };
 
@@ -185,10 +193,10 @@ function chooseByStrategy(strategy, prefer, context) {
     // where the prefer list does not name it -- reusing it is the strategy's
     // whole point. It yields by name whenever it would violate availability
     // or vendor distinction, the yields `admits` already speaks.
-    if (admits(previousId, runtimes, availability, forbiddenVendors)) {
+    if (admits(previousId, runtimes, availability, judgeBar)) {
       return { runtimeId: previousId, reason: `attempt-affinity: previous attempt's runtime ${previousId} still admissible` };
     }
-    return { runtimeId: admissible[0].id, reason: `attempt-affinity yielded: ${previousId} ${blockedWhy(previousId, runtimes, availability, forbiddenVendors)}; prefer order decided` };
+    return { runtimeId: admissible[0].id, reason: `attempt-affinity yielded: ${previousId} ${blockedWhy(previousId, runtimes, availability, judgeBar)}; prefer order decided` };
   }
 
   if (strategy === "cost") {
@@ -222,54 +230,68 @@ function chooseByStrategy(strategy, prefer, context) {
  * @param {string} id
  * @param {Record<string, RoutingRuntime>} runtimes
  * @param {Record<string, RoutingAvailability>} availability
- * @param {ReadonlySet<string>} forbiddenVendors
+ * @param {JudgeBar} judgeBar
  * @returns {string}
  */
-function blockedWhy(id, runtimes, availability, forbiddenVendors) {
+function blockedWhy(id, runtimes, availability, judgeBar) {
   const runtime = runtimes[id];
   if (!runtime) return "is not declared in runtimes";
-  const provider = effectiveProvider(runtime);
-  if (provider !== undefined && forbiddenVendors.has(provider)) return `carries forbidden vendor ${provider}`;
-  return "is unavailable";
+  return judgeBar(id, runtime) ?? "is unavailable";
 }
 
 /**
  * @param {string} id
  * @param {Record<string, RoutingRuntime>} runtimes
  * @param {Record<string, RoutingAvailability>} availability
- * @param {ReadonlySet<string>} forbiddenVendors
+ * @param {JudgeBar} judgeBar
  * @returns {boolean}
  */
-function admits(id, runtimes, availability, forbiddenVendors) {
+function admits(id, runtimes, availability, judgeBar) {
   const runtime = runtimes[id];
   if (!runtime) return false;
-  const provider = effectiveProvider(runtime);
-  if (provider !== undefined && forbiddenVendors.has(provider)) return false;
+  if (judgeBar(id, runtime) !== null) return false;
   return isRuntimeAvailable(availability[id]);
 }
 
 /**
- * Every vendor a judge may not carry: the worker's own vendor, plus the
- * vendor of each runtime reachable through the worker's declared `fallback`
- * chain — the same independence the contract validator enforces statically
- * once a worker is actually chosen dynamically here.
+ * The judge's bar for one chosen worker: the worker's own vendor, plus the
+ * vendor of each runtime reachable through its declared `fallback` chain —
+ * the same independence the contract validator enforces statically
+ * (`markSameProviderReviewNodes`), applied here once a worker is chosen.
+ * Outside same-vendor mode any of those vendors bars the judge. In
+ * same-vendor mode a shared vendor admits the judge only when the tier rule
+ * does against every chain runtime of that vendor, and the worker's own
+ * runtime never judges itself (`runtime-discovery.mjs` excludes it too).
  *
  * @param {string} workerId
  * @param {Record<string, RoutingRuntime>} runtimes
- * @returns {Set<string>}
+ * @param {"same-vendor"|undefined} judgeIndependence
+ * @returns {JudgeBar}
  */
-function forbiddenJudgeVendors(workerId, runtimes) {
-  const vendors = new Set();
+function judgeBarFor(workerId, runtimes, judgeIndependence) {
+  /** @type {RoutingRuntime[]} */
+  const chain = [];
   const seen = new Set();
   /** @type {string|undefined} */
   let id = workerId;
   while (id !== undefined && runtimes[id] && !seen.has(id)) {
     seen.add(id);
-    const provider = effectiveProvider(runtimes[id]);
-    if (provider !== undefined) vendors.add(provider);
+    chain.push(runtimes[id]);
     id = runtimes[id].fallback;
   }
-  return vendors;
+  const vendors = new Set(chain.map((runtime) => effectiveProvider(runtime)).filter((provider) => provider !== undefined));
+  return (candidateId, candidate) => {
+    const provider = effectiveProvider(candidate);
+    if (provider === undefined || !vendors.has(provider)) return null;
+    if (judgeIndependence !== SAME_VENDOR_REVIEW_MODE) return `carries forbidden vendor ${provider}`;
+    if (candidateId === workerId) return "is the worker runtime itself";
+    for (const member of chain) {
+      if (effectiveProvider(member) !== provider) continue;
+      const refusal = sameVendorTierRefusal(/** @type {{harness: string, model: string}} */ (member), /** @type {{harness: string, model: string}} */ (candidate));
+      if (refusal) return `shares vendor ${provider} and ${refusal.message}`;
+    }
+    return null;
+  };
 }
 
 /** @param {RoutingRule} row @returns {string} */
@@ -281,16 +303,13 @@ function ruleLabel(row) {
 /**
  * @param {Record<string, RoutingRuntime>} runtimes
  * @param {Record<string, RoutingAvailability>} availability
- * @param {ReadonlySet<string>} forbiddenVendors
+ * @param {JudgeBar} judgeBar
  * @returns {{id: string, runtime: RoutingRuntime, order: number}[]}
  */
-function candidateEntries(runtimes, availability, forbiddenVendors) {
+function candidateEntries(runtimes, availability, judgeBar) {
   return Object.entries(runtimes)
     .map(([id, runtime], order) => ({ id, runtime, order }))
-    .filter(({ id, runtime }) => {
-      const provider = effectiveProvider(runtime);
-      return (provider === undefined || !forbiddenVendors.has(provider)) && isRuntimeAvailable(availability[id]);
-    });
+    .filter(({ id, runtime }) => judgeBar(id, runtime) === null && isRuntimeAvailable(availability[id]));
 }
 
 /**
@@ -301,11 +320,11 @@ function candidateEntries(runtimes, availability, forbiddenVendors) {
  *
  * @param {Record<string, RoutingRuntime>} runtimes
  * @param {Record<string, RoutingAvailability>} availability
- * @param {ReadonlySet<string>} forbiddenVendors
+ * @param {JudgeBar} judgeBar
  * @returns {string|null}
  */
-function cheapestAvailable(runtimes, availability, forbiddenVendors) {
-  return cheapest(candidateEntries(runtimes, availability, forbiddenVendors))?.id ?? null;
+function cheapestAvailable(runtimes, availability, judgeBar) {
+  return cheapest(candidateEntries(runtimes, availability, judgeBar))?.id ?? null;
 }
 
 /**
@@ -317,9 +336,9 @@ function cheapestAvailable(runtimes, availability, forbiddenVendors) {
  *
  * @param {Record<string, RoutingRuntime>} runtimes
  * @param {Record<string, RoutingAvailability>} availability
- * @param {ReadonlySet<string>} forbiddenVendors
+ * @param {JudgeBar} judgeBar
  * @returns {string|null}
  */
-function strongestAvailable(runtimes, availability, forbiddenVendors) {
-  return strongest(candidateEntries(runtimes, availability, forbiddenVendors), "")?.id ?? null;
+function strongestAvailable(runtimes, availability, judgeBar) {
+  return strongest(candidateEntries(runtimes, availability, judgeBar), "")?.id ?? null;
 }