flowviant 0.116.0 → 0.117.0

package/bin/lib/workAgentTurnBegun.mjs

@@ -13,8 +13,8 @@
  * through the one turn-done wire (workAgentTurnReports.mjs). Null means go on.
  */
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { git } from './git.mjs';
+import { git, sessionBranchRef } from './git.mjs';
+import { worktreePath } from './workPlaces.mjs';
 
 /**
  * WORK THAT HAS BEGUN LIVES ON EXACTLY ONE BOX, AND THIS MAY NOT BE IT.
@@ -45,7 +45,11 @@ import { git } from './git.mjs';
  * remedy somebody cannot carry out is worse than none.
  */
 export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublishedBranch }) {
-  const wtDir = join(baseDir, 'sessions', place);
+  // The caller validated `place` (workAgentTurns); an unsafe one would give a
+  // null directory AND a null ref below, and the null ref stands the guard
+  // down — the same fail-open direction as an unreadable repo.
+  const wtDir = worktreePath(baseDir, place);
+  const ref = sessionBranchRef(place);
   let hasBranch = false;
   /**
    * THREE STATES, AND THE MIDDLE ONE IS WHY THIS IS NOT A BARE CATCH.
@@ -63,14 +67,14 @@ export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublished
    * `placeWtFor` is about to fail on the same unreadable repo and say so
    * in its own words, which is the honest sentence.
    */
-  let branchMeasured = true;
-  try {
-    hasBranch = Boolean(
-      git(['rev-parse', '--verify', '--quiet', `refs/heads/session/${place}`], repoRoot)
-    );
-  } catch (e) {
-    if (e?.status === 1) hasBranch = false;
-    else branchMeasured = false;
+  let branchMeasured = ref !== null;
+  if (branchMeasured) {
+    try {
+      hasBranch = Boolean(git(['rev-parse', '--verify', '--quiet', ref], repoRoot));
+    } catch (e) {
+      if (e?.status === 1) hasBranch = false;
+      else branchMeasured = false;
+    }
   }
   if (branchMeasured && !existsSync(wtDir) && !hasBranch) {
     /**

package/bin/lib/workAgentTurnExecution.mjs

@@ -19,7 +19,7 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { PROJECT_ID } from './config.mjs';
 import { setRuntimeLimit } from './daemonState.mjs';
-import { git } from './git.mjs';
+import { gitOrNull } from './git.mjs';
 import { stashCard } from './agentCards.mjs';
 import { c } from './ui.mjs';
 import { runTurn } from './runTurn.mjs';
@@ -27,12 +27,12 @@ import { SYSTEM_AGENT_FOR, AGENT_TASK_KICKOFF, AGENT_TASK_SPEC, AGENT_HUMAN_KICK
 import { AGENT_TASK_KINDS, agentTaskKindOf, unknownAgentTaskKind } from './agentTaskKinds.mjs';
 import { knowledgeDirFor } from './knowledgeFiles.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
-import { canRun, RUNTIMES } from './runtimes.mjs';
-import { recordSkills, recordMcpServers } from './runtimeCapabilities.mjs';
+import { canRun, runtimeById } from './runtimes.mjs';
 import { toolEventOf, CLAUDE_TOOL_PROSE_KINDS } from './runtimeEvents.mjs';
 import { makeTraceRelay } from './trace.mjs';
 import { readBaseTools, prepareAgentTools } from './projectTools.mjs';
 import { runTurnResumingOnce } from './resumeLost.mjs';
+import { INTERNAL_WAIT_CONTRACT, runAgentWithInternalWaits } from './agentInternalWait.mjs';
 import { CODEX_THREAD_RE } from './workSessionRuntime.mjs';
 import { brainFor } from './workBrain.mjs';
 import { begunTurnRefusal } from './workAgentTurnBegun.mjs';
@@ -95,15 +95,8 @@ export function createAgentTurnExecution({
      * reconciliation books whatever no card claimed. Missing beats fabricated
      * and both beat a stall.
      */
-    let out;
-    try {
-      out = git(['log', '--format=%H', '--no-merges', `${from}..HEAD`, '--not', baseRef()], wt);
-    } catch {
-      return [];
-    }
-    return typeof out === 'string'
-      ? out.split('\n').map((x) => x.trim()).filter(Boolean).slice(0, 50)
-      : [];
+    const out = gitOrNull(['log', '--format=%H', '--no-merges', `${from}..HEAD`, '--not', baseRef()], wt);
+    return out?.split('\n').map((x) => x.trim()).filter(Boolean).slice(0, 50) ?? [];
   };
 
   /**
@@ -147,19 +140,13 @@ export function createAgentTurnExecution({
      * `runAgentMerge` learned this two commits ago and says so in its own
      * comment; this is the same call, in the same file, left unguarded. Both
      * facts are OPTIONAL to a turn — they describe the branch, they do not
-     * gate the work — so failing to read them costs a null, not the turn.
+     * gate the work — so failing to read them costs a null, not the turn:
+     * git.mjs's `gitOrNull`, the one spelling of that rule.
      */
-    const readGit = (args) => {
-      try {
-        return (git(args, wt) || '').trim() || null;
-      } catch {
-        return null;
-      }
-    };
     // WHERE THE BRANCH WAS BEFORE THIS TURN, so the commits reported are the
     // ones this turn actually made.
-    const before = readGit(['rev-parse', 'HEAD']);
-    const branch = readGit(['symbolic-ref', '--quiet', '--short', 'HEAD']);
+    const before = gitOrNull(['rev-parse', 'HEAD'], wt);
+    const branch = gitOrNull(['symbolic-ref', '--quiet', '--short', 'HEAD'], wt);
     // …and the same three facts for the lane's catch: a turn that throws past
     // here is still settled with what was measured (workAgentTurns.mjs).
     measured.wt = wt;
@@ -176,9 +163,9 @@ export function createAgentTurnExecution({
      * posture, which can write ONLY `.flowviant/artifacts/` (claudePosture.mjs).
      *
      * A RUNTIME THAT CANNOT EXPRESS THE POSTURE IS REFUSED, NOT IMPROVISED.
-     * Antigravity declares none of them and Codex declares `design` (since
-     * 0.115.0) and `image` but not `research` (runtimeCodex.mjs,
-     * runtimeAntigravity.mjs), and the only
+     * Antigravity declares none of them; Codex declares `design` (since
+     * 0.115.0), `image` and `research` (0.117.0, over an isolated copy —
+     * codexResearch.mjs) (runtimeCodex.mjs, runtimeAntigravity.mjs), and the only
      * alternative to refusing is running the card as a BUILD turn with
      * permissions skipped — an agent writing code for an ask that was a
      * mockup, reporting success. `nothing` puts the agent in Stuck saying so.
@@ -220,7 +207,7 @@ export function createAgentTurnExecution({
     // entry in agentTaskKinds.mjs; nothing below branches on the kind name.
     const kind = AGENT_TASK_KINDS[taskKind];
     const posture = kind.posture;
-    if (!canRun(RUNTIMES[rt], posture)) {
+    if (!canRun(runtimeById(rt), posture)) {
       await postAgentTurn({
         turnId,
         outcome: 'nothing',
@@ -393,7 +380,7 @@ export function createAgentTurnExecution({
      * `parse: null` is exactly the claudeStream.mjs stream path. See
      * CLAUDE_TOOL_PROSE_KINDS.
      */
-    const doubledKinds = RUNTIMES[rt]?.parse ? null : CLAUDE_TOOL_PROSE_KINDS;
+    const doubledKinds = runtimeById(rt)?.parse ? null : CLAUDE_TOOL_PROSE_KINDS;
 
     /**
      * WHICH BRAIN THIS CONTAINER WAS PINNED TO — the same `brainFor` the tab
@@ -489,12 +476,12 @@ export function createAgentTurnExecution({
         // different things about the same directory.
         // Spoken to the CLI that runs it (0.115.0): a mockup on Codex is
         // told it is Codex, never Claude.
-        system: withProjectContext(SYSTEM_AGENT_FOR(taskKind, RUNTIMES[rt]?.label), {
+        system: withProjectContext(SYSTEM_AGENT_FOR(taskKind, runtimeById(rt)?.label), {
           knowledgeDir: knowledgeDirFor(repoRoot),
           // ARTIFACTS (0.94.0), while the server can show one — an agent's
           // land on its page, under the facts row.
           artifacts: getArtifactsAccepted(),
-        }) + (projectTools.instructions ? `\n\n${projectTools.instructions}` : ''),
+        }) + `\n\n${INTERNAL_WAIT_CONTRACT}` + (projectTools.instructions ? `\n\n${projectTools.instructions}` : ''),
         agentTools: projectTools,
         ...(projectTools.codexHome ? { mcpEnv: { CODEX_HOME: projectTools.codexHome } } : {}),
         // NOBODY IS AT THIS SCREEN (2026-09-29): no display, BROWSER=none, and
@@ -502,11 +489,13 @@ export function createAgentTurnExecution({
         // so a Chrome it starts to look at its page never reaches the
         // person's (noWindowEnv.mjs).
         browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
+        // The base branch's MCP servers, for a code card: Claude's in this
+        // turn's own 0600 file, strictly; Codex's already in its private
+        // home's config.toml (projectToolRuntimes.mjs, 2026-10-10), which
+        // its fenced postures ignore — never `-c` pairs on argv.
         ...(posture === 'build' && rt === 'claude'
           ? { mcpArgs: ['--strict-mcp-config', '--mcp-config', projectTools.mcpPath] }
-          : posture === 'build' && rt === 'codex'
-            ? { mcpArgs: projectTools.codexArgs }
-            : {}),
+          : {}),
         knowledgeDir: knowledgeDirFor(repoRoot),
         // The kind's posture, as the one turn profile (turnProfile.mjs):
         // build for code, the fenced design/research postures otherwise.
@@ -523,7 +512,6 @@ export function createAgentTurnExecution({
         },
         // Present only when the container named one — see brainFor.
         ...brain,
-        streamJson: true,
         answerFromResult: true,
         label: c.cyan('[agent]'),
         // The CLI's own tail, relayed. Throttled by the same rule the tab's
@@ -559,8 +547,9 @@ export function createAgentTurnExecution({
           trace.tool(toolEventOf(name, input, wt, envScrub));
         },
         // The CLI's own per-turn token counts, off the `result` event. One
-        // result per turn, so this is a set and not an accumulate — the
-        // adding-up happens SERVER-side, behind the settle's idempotent win,
+        // result per CLI invocation. Internal-wait recovery combines those
+        // counts before this callback; project accounting still happens
+        // SERVER-side, behind the settle's idempotent win,
         // because a retried settle must not charge the same turn twice.
         // …tagged with WHICH CLI counted it (2026-09-24), so the server can
         // split an agent's spend per CLI rather than labelling a codex
@@ -571,16 +560,11 @@ export function createAgentTurnExecution({
         onModel: (m) => {
           model = m;
         },
-        // WHAT THE CLI SAYS IT CAN BE ASKED FOR, AND WHICH CONNECTORS NEED A
-        // LOGIN — the same free fact off the same init event the tab lane
-        // records (2026-09-23). Without it a box that only ever runs agents
-        // taught the app its skills and connectors ONCE, from the startup
-        // probe, and never again: a connector signed into at the box kept
-        // reading "needs authorization" for the life of the process.
-        onInit: (i) => {
-          recordSkills(i.skills);
-          recordMcpServers(i.mcpServers);
-        },
+        // No skills or connectors are harvested here (2026-10-10): every
+        // agent turn narrows them — `--setting-sources user` and the reviewed
+        // plugin, `--strict-mcp-config` — so its init is not the machine's
+        // (runTurn.mjs, `initHarvestFor`). An agent-only box learns from the
+        // startup probe and its Terminal tabs.
         onSpawn: (ch) => {
           child = ch;
           spawnedChildren.add(ch);
@@ -612,15 +596,24 @@ export function createAgentTurnExecution({
        * (resumeLost.mjs, SOLID F001): a successful answer that merely
        * MENTIONS a missing session is never run twice.
        */
-      out = await runTurnResumingOnce(runTurn, agentTurnArgs, {
-        resume,
-        runtime: rt,
-        beforeFresh: () => {
-          seenThreadId = null;
+      out = await runAgentWithInternalWaits(
+        (args, continuing) => continuing ? runTurn(args) : runTurnResumingOnce(runTurn, args, {
+          // A Codex write-up always runs fresh over its copy (codexResearch
+          // .mjs), so there is no lost conversation to retry it for.
+          resume: rt === 'codex' && posture === 'research' ? false : args.resume,
+          runtime: rt,
+          beforeFresh: () => {
+            seenThreadId = null;
+            lastAnswer = null;
+            model = null;
+          },
+        }),
+        { ...agentTurnArgs, onContinuation: (n) => {
           lastAnswer = null;
-          model = null;
-        },
-      });
+          trace.prose('text', `The machine resumed this card after an internal wait (continuation ${n}).`);
+          void postAgentActivity(agentId, 'resuming after an internal wait');
+        } }
+      );
     } finally {
       // What the CLI counted, for the lane's catch if anything below throws.
       measured.usage = usage;

package/bin/lib/workAgentTurnReports.mjs

@@ -14,8 +14,9 @@
  * Daemon→server reports, every one of them: no version floor, and a permanent
  * 4xx is the server saying it will never take the body (see each POST).
  */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { fleetEndpoint } from './fleetWire.mjs';
+import { FLEET_URL } from './config.mjs';
+import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
+import { fleetHeaders, postFleetJson } from './fleetPost.mjs';
 
 export function createAgentTurnReports({ REJECT_RETRY_MS }) {
   const AGENT_TURN_DONE_URL = fleetEndpoint('agent-turn-done', FLEET_URL);
@@ -53,16 +54,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
     const turnId = String(body.turnId);
     agentReported.set(turnId, { body, at: Date.now() });
     try {
-      const res = await fetch(AGENT_TURN_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify(body),
-      });
+      const res = await postFleetJson(AGENT_TURN_DONE_URL, body, { timeoutMs: 30_000 });
       const j = await res.json().catch(() => null);
       /**
        * ONLY A 2xx IS DELIVERED. The server answers an already-settled,
@@ -79,7 +71,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
       if (res.ok) {
         agentReported.delete(turnId);
         agentRejectedUntil.delete(turnId);
-      } else if (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429) {
+      } else if (isConsideredRefusal(res.status)) {
         agentRejectedUntil.set(turnId, Date.now() + REJECT_RETRY_MS);
       }
       return j?.data ?? null;
@@ -102,20 +94,8 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
    */
   const postAgentTrace = async (body) => {
     try {
-      const res = await fetch(AGENT_TRACE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify(body),
-      });
-      return (
-        res.ok ||
-        (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
-      );
+      const res = await postFleetJson(AGENT_TRACE_URL, body, { timeoutMs: 15_000 });
+      return res.ok || isConsideredRefusal(res.status);
     } catch {
       return false; // a blip — the same entries go again at the same seq
     }
@@ -125,11 +105,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
     try {
       await fetch(AGENT_ACTIVITY_URL, {
         method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
+        headers: fleetHeaders(),
         signal: AbortSignal.timeout(15_000),
         body: JSON.stringify({ agentId, text }),
       });
@@ -142,11 +118,7 @@ export function createAgentTurnReports({ REJECT_RETRY_MS }) {
     try {
       await fetch(AGENT_PARKED_URL, {
         method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
+        headers: fleetHeaders(),
         signal: AbortSignal.timeout(15_000),
         // `runtime` scopes the park to that CLI's agents; a server that does
         // not know the key parks every agent, which is what it always did.

package/bin/lib/workAgentTurns.mjs

@@ -318,9 +318,10 @@ export function createWorkAgentTurns({
   /**
    * SETTLE EVERYTHING IN FLIGHT, because this process is about to go away.
    *
-   * The one caller is the displacement stand-down: the project's machine moved
-   * to another box, so nothing here will be re-offered to us and nothing else
-   * knows these turns were running. An abandoned turn sits pending until the
+   * The one caller is the roster's stand-down (holder.mjs): the project's
+   * machine moved to another box, this box was removed from the project, or
+   * Flowviant stopped it (2026-10-10) — so nothing here will be re-offered to
+   * us and nothing else knows these turns were running. An abandoned turn sits pending until the
    * server's six-hour expiry while the board shows an agent working on a machine
    * that has gone — the wedge every settle path in this lane exists to avoid.
    *

package/bin/lib/workAttachments.mjs

@@ -9,8 +9,9 @@
  * serves both, so the two lanes cannot disagree about what a safe name is.
  * The name rule itself is safeFileName.mjs's.
  */
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { ensureRealSubdir, realDirState } from './ownedDirs.mjs';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
 import { excludeInWorktree } from './git.mjs';
 import { FLOWVIANT_OWN_PATHS } from './knowledgeLibrary.mjs';
@@ -59,13 +60,60 @@ export function createWorkAttachments() {
   // and the two sides never disagree about the cut. An empty name is
   // `attachment`, the server's own fallback.
   const safeUploadName = (raw) => safeFileName(raw, 'attachment');
-  /** The file at `path` holds exactly `buf` — read only when the sizes agree. */
+  /**
+   * NO LINK UNDER `.flowviant/` IS FOLLOWED, AND NOTHING THERE IS REPLACED
+   * (2026-10-10, the audit's F080). This lane writes a MEMBER'S bytes under a
+   * member's name, and it was the one `.flowviant/` writer with no guard:
+   * `mkdirSync` and `writeFileSync` went through a committed `.flowviant ->
+   * ~/.ssh` or `.flowviant/uploads -> ../../../.ssh`, and `existsSync` answered
+   * "absent" for a dangling link at the file's own name, which the write then
+   * followed to create its target — an attachment named `authorized_keys`
+   * landing in the operator's `~/.ssh`. Now: both directories must be real
+   * (ownedDirs.mjs `ensureRealSubdir`, the artifacts directory's rule — refused,
+   * never replaced), every look at a name is an `lstat` or an `O_NOFOLLOW`
+   * open, and each file is CREATED (`O_EXCL`): anything already at the name,
+   * a dangling link included, is never written through.
+   */
+  const NEW_FILE = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+  /** Anything at all at `path` — a dangling link too. */
+  const taken = (path) => {
+    try {
+      lstatSync(path);
+      return true;
+    } catch (e) {
+      return e?.code !== 'ENOENT';
+    }
+  };
+  /** The REGULAR file at `path` holds exactly `buf` — read only when the sizes
+   *  agree, and never through a link. Non-blocking, so a fifo at the name is
+   *  answered "no" rather than waited on. */
   const holds = (path, buf) => {
+    let fd;
     try {
-      return statSync(path).size === buf.byteLength && readFileSync(path).equals(buf);
+      const at = lstatSync(path);
+      if (!at.isFile() || at.size !== buf.byteLength) return false;
+      fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+      const st = fstatSync(fd);
+      return st.isFile() && st.size === buf.byteLength && readFileSync(fd).equals(buf);
     } catch {
       return false;
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+    }
+  };
+  /** A NEW regular file at `path` holding `buf`, at the mode `writeFileSync`
+   *  used. Throws (EEXIST) when anything is already there; a write that fails
+   *  part-way takes its own half-file with it. */
+  const createFile = (path, buf) => {
+    const fd = openSync(path, NEW_FILE, 0o666);
+    try {
+      writeFileSync(fd, buf);
+    } catch (e) {
+      closeSync(fd);
+      rmSync(path, { force: true });
+      throw e;
     }
+    closeSync(fd);
   };
   /**
    * THE ONE DOWNLOAD LOOP. Each entry's relative path, or null where it did
@@ -81,11 +129,10 @@ export function createWorkAttachments() {
    */
   const landFiles = async (wt, list, endpoint, sameBytesKept) => {
     const dir = join(wt, UPLOAD_DIR);
-    try {
-      mkdirSync(dir, { recursive: true });
-    } catch {
-      return list.map(() => null);
-    }
+    // A `.flowviant` or `uploads` that is a link or not a directory refuses
+    // the whole batch before anything is fetched: every file is a miss the
+    // turn is told about, and the repository's content is left as it is.
+    if (!ensureRealSubdir(wt, UPLOAD_DIR)) return list.map(() => null);
     // "Never committed by us" has to be true for GIT, not just for this code:
     // an untracked `.flowviant/` makes the whole worktree dirty, which refuses
     // every ship, exempts the tree from closed-tab retirement forever, and
@@ -115,14 +162,22 @@ export function createWorkAttachments() {
         // silently overwriting one with the other loses a file the human sent.
         let name = safeUploadName(a.name);
         let already = sameBytesKept && holds(join(dir, name), buf);
-        if (!already && existsSync(join(dir, name))) {
+        if (!already && taken(join(dir, name))) {
           const dot = name.lastIndexOf('.');
           const stem = dot > 0 ? name.slice(0, dot) : name;
           const ext = dot > 0 ? name.slice(dot) : '';
           name = `${stem}-${String(a.id).slice(0, 6)}${ext}`;
-          already = sameBytesKept && holds(join(dir, name), buf);
+          // The id-suffixed name is this file's own: holding these bytes, it
+          // IS this file, on either lane (it used to be rewritten with them).
+          // Anything else there is a miss — never replaced, never followed.
+          already = holds(join(dir, name), buf);
+        }
+        if (!already) {
+          // Looked at again right before the write: the batch's first check
+          // is up to a download old.
+          if (realDirState(join(wt, '.flowviant')) !== 'dir' || realDirState(dir) !== 'dir') continue;
+          createFile(join(dir, name), buf);
         }
-        if (!already) writeFileSync(join(dir, name), buf);
         landed[landed.length - 1] = `${UPLOAD_DIR}/${name}`;
       } catch {
         /* one file failing must not fail the turn — the prompt lists what

package/bin/lib/workBrain.mjs

@@ -7,7 +7,7 @@
  * — each importing it directly — and it is pure over the job and the runtime
  * table, so its home is a module of its own rather than either lane.
  */
-import { RUNTIMES } from './runtimes.mjs';
+import { runtimeById } from './runtimes.mjs';
 
 /**
  * The shape a per-tab model name must have before it rides argv as
@@ -15,8 +15,13 @@ import { RUNTIMES } from './runtimes.mjs';
  * (below): it comes off the wire and lands in a child process's arguments —
  * alphanumerics plus dot/dash/underscore, at most 40 characters, and NEVER a
  * leading dash, which is an argv that parses as a flag.
+ *
+ * The server's route schemas copy it as `AGENT_MODEL_RE` (shared
+ * agent-runner.schema.ts), and the release parity gate holds the two equal
+ * (2026-10-10, audit F613): a server that accepts a name this drops has the
+ * board assert a pin the machine silently replaces with its default.
  */
-const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
+export const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
 
 /**
  * WHICH BRAIN, AT WHICH EFFORT — the tab's own pick, off the roster.
@@ -39,7 +44,7 @@ const WORK_MODEL_RE = /^[a-zA-Z0-9._][a-zA-Z0-9._-]{0,39}$/;
  * One global ladder once accepted `max` for every runtime, and Codex has no
  * `max`: a skewed or previously queued Codex job reached argv as a
  * `model_reasoning_effort` its CLI refuses. The per-CLI list lives beside each
- * runtime's argv builder (`RUNTIMES[id].efforts`, runtime{Claude,Codex,Antigravity}.mjs); a runtime this
+ * runtime's argv builder (`runtimeById(id).efforts`, runtime{Claude,Codex,Antigravity}.mjs); a runtime this
  * daemon does not define runs nothing, so it spells no effort either.
  */
 export function brainFor(job, runtimeId) {
@@ -47,7 +52,7 @@ export function brainFor(job, runtimeId) {
   const model = typeof job?.model === 'string' ? job.model.trim() : '';
   if (model && WORK_MODEL_RE.test(model)) out.model = model;
   const effort = typeof job?.effort === 'string' ? job.effort.trim() : '';
-  const efforts = RUNTIMES[runtimeId]?.efforts ?? [];
+  const efforts = runtimeById(runtimeId)?.efforts ?? [];
   if (effort && efforts.includes(effort)) out.effort = effort;
   return out;
 }

package/bin/lib/workCappedTurn.mjs

@@ -0,0 +1,109 @@
+/**
+ * ONE CAPPED READ-ONLY CONSULT TURN — the process plumbing the unattended
+ * one-shot lanes share: the Deploy-press planner (workAgentPlans.mjs), the AI
+ * pre-review (workAgentPrecheck.mjs) and intake (workIntake.mjs).
+ *
+ * ONE HOME (2026-10-10, the audit). Each lane carried its own forty-to-eighty
+ * lines of this, and the copies had already begun to drift. Every step below
+ * is a rule some incident taught, and a lane that copied the wrong one would
+ * show it only as a daemon that never auto-updates again:
+ *  · THE CHILD IS REGISTERED IN `workChildren`, AND REMOVED IN A `finally`.
+ *    It is what `workBusy()` counts and what counts against the machine's
+ *    ceiling (liveTurnCount); a leaked entry keeps the daemon "busy" forever,
+ *    which blocks every auto-update, silently, until a restart. No task id: a
+ *    consult turn belongs to no card, and the snapshot's per-task rows must
+ *    not invent one.
+ *  · THE ADMISSION RESERVATION IS RELEASED AT THE SPAWN, and again in the
+ *    `finally` for a turn that never spawned — release is idempotent, so
+ *    doing both is the normal case (admission.mjs).
+ *  · THE CAP IS ARMED AT THE SPAWN, not at entry: time spent waiting for a
+ *    checkout lock is not a wedged CLI. It SIGKILLs the CHILD and never its
+ *    group — the rule teardown keeps: a read-only turn starts no server, so
+ *    there is nothing behind it worth signalling and everything to lose by
+ *    signalling somebody else's.
+ *  · THE CAP RESOLVES THE WAIT ITSELF rather than waiting for `close` after
+ *    the kill: a SIGKILLed process whose stdio a grandchild still holds can be
+ *    slow to emit `close`, or never emit it, and the caller is holding a
+ *    claimed job (or a place's writer lock) open behind this promise.
+ *  · THE TURN'S TRANSCRIPT IS REMOVED ON EVERY EXIT — settled, wedged or
+ *    thrown. `claude -p` writes `~/.claude/projects/<munged-cwd>/<id>.jsonl`,
+ *    and the CLI's `--continue` is cwd-keyed: left in the checkout it displaces
+ *    the operator's own conversation from the `+` adopt menu and is what their
+ *    `claude --continue` resumes; left in an agent's worktree it is what the
+ *    agent's next turn resumes, under build permissions. The id is the one the
+ *    CLI reports at `system.init`, so the file is ours by name.
+ *
+ * WHAT STAYS WITH EACH LANE is policy, never plumbing: its lock, its prompt,
+ * profile and brain, its usage callback (set or accumulate is a per-lane
+ * choice), its cap length, its narration, and the words it settles with.
+ */
+import { removeTranscriptSoon } from './runtimeCapabilities.mjs';
+
+/**
+ * Run `runTurn(turnArgs)` under a `capMs` cap. Resolves
+ * `{ out, wedged, spawned, sessionId }`: `out` is the turn's answer, or `''`
+ * when the cap fired (`wedged`); `spawned` says a CLI process existed; the
+ * session id is the conversation the CLI named, or null. A turn that throws
+ * rethrows here, after the same cleanup.
+ *
+ * `onSpawn` and `onInit` are the caller's own hooks, run after this file's
+ * bookkeeping — which is why they ride beside `turnArgs` and never inside it.
+ * `removeTranscript` is a test's.
+ */
+export async function runCappedTurn({
+  runTurn,
+  turnArgs,
+  capMs,
+  workChildren,
+  releaseSlot = () => {},
+  transcriptCwd,
+  onSpawn = () => {},
+  onInit = () => {},
+  removeTranscript = removeTranscriptSoon,
+}) {
+  // Wiring mistakes, refused before anything spawns: a hook inside turnArgs
+  // would be silently replaced below, and a missing cap would fire at once.
+  if (turnArgs && ('onSpawn' in turnArgs || 'onInit' in turnArgs))
+    throw new TypeError('runCappedTurn: pass onSpawn/onInit beside turnArgs, never inside it');
+  if (!(Number.isFinite(capMs) && capMs > 0)) throw new TypeError('runCappedTurn: capMs must be a positive number');
+  let child = null;
+  let timer = null;
+  let wedged = false;
+  let sessionId = null;
+  let stopWaiting = () => {};
+  const capped = new Promise((resolve) => {
+    stopWaiting = resolve;
+  });
+  try {
+    const turn = runTurn({
+      ...turnArgs,
+      onInit: (i) => {
+        if (typeof i?.sessionId === 'string' && i.sessionId.trim()) sessionId = i.sessionId.trim();
+        onInit(i);
+      },
+      onSpawn: (ch) => {
+        child = ch;
+        workChildren.set(ch, null);
+        releaseSlot();
+        timer = setTimeout(() => {
+          wedged = true;
+          try {
+            ch.kill('SIGKILL');
+          } catch {
+            /* already gone */
+          }
+          stopWaiting('');
+        }, capMs);
+        timer.unref?.();
+        onSpawn(ch);
+      },
+    });
+    const out = await Promise.race([turn, capped]);
+    return { out, wedged, spawned: child !== null, sessionId };
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (child) workChildren.delete(child);
+    releaseSlot();
+    if (sessionId) removeTranscript(transcriptCwd, sessionId);
+  }
+}

package/bin/lib/workChildren.mjs

@@ -10,6 +10,7 @@
  * on this box" belong together — and apart from any one lane.
  */
 import { createAdmission } from './admission.mjs';
+import { killGroup } from './processGroup.mjs';
 
 export function createWorkChildren({ extraLiveTurns }) {
   /**
@@ -54,11 +55,10 @@ export function createWorkChildren({ extraLiveTurns }) {
   const groupKillChildren = new Set();
   const shutdownWork = () => {
     for (const [ch] of workChildren) {
-      try {
-        if (groupKillChildren.has(ch) && ch.pid) process.kill(-ch.pid, 'SIGTERM');
-        else ch.kill('SIGTERM');
-      } catch {
-        // A group that has already gone, or a pid that is no longer a leader.
+      // A group that has already gone, or a pid that is no longer a leader,
+      // falls back to the child (processGroup.mjs).
+      if (groupKillChildren.has(ch)) killGroup(ch, 'SIGTERM');
+      else {
         try {
           ch.kill('SIGTERM');
         } catch {