mixdog 0.9.43 → 0.9.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.43",
+  "version": "0.9.44",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -58,8 +58,9 @@
     "test:placeholder": "node --test scripts/compacted-placeholder-scrub-test.mjs",
     "test:providers": "node --test scripts/provider-toolcall-test.mjs",
     "test:anthropic-oauth-race": "node --test scripts/anthropic-oauth-refresh-race-test.mjs",
+    "test:grok-oauth-race": "node --test scripts/grok-oauth-refresh-race-test.mjs",
     "test:atomiclock": "node --test scripts/atomic-lock-tryonce-test.mjs",
-    "test:memory-routing": "node --test scripts/memory-cycle-routing-test.mjs scripts/memory-rule-contract-test.mjs",
+    "test:memory-routing": "node --test scripts/memory-cycle-routing-test.mjs scripts/memory-rule-contract-test.mjs scripts/maintenance-default-routes-test.mjs",
     "test:tui-queue": "node --test scripts/submit-commandbusy-race-test.mjs scripts/steering-drain-buckets-test.mjs scripts/abort-recovery-test.mjs scripts/execution-pending-resume-kick-test.mjs scripts/execution-resume-esc-integration-test.mjs",
     "test:session": "node --test scripts/session-orphan-sweep-test.mjs",
     "test:rebindtail": "node --test scripts/forwarder-rebind-tail-test.mjs",

package/scripts/ansi-color-capability-test.mjs

@@ -0,0 +1,90 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  brightGreen,
+  refreshColorSupport,
+  rgb,
+  rgbBg,
+  rgbSgr,
+  rgbToAnsi256,
+  supportsTruecolor,
+} from '../src/ui/ansi.mjs';
+import {
+  remapCanonicalStatuslineTruecolor,
+  STATUSLINE_CANONICAL_TRUECOLOR,
+} from '../src/tui/statusline-ansi-bridge.mjs';
+
+const savedEnv = {
+  COLORTERM: process.env.COLORTERM,
+  FORCE_COLOR: process.env.FORCE_COLOR,
+  NO_COLOR: process.env.NO_COLOR,
+  TERM: process.env.TERM,
+  TERM_PROGRAM: process.env.TERM_PROGRAM,
+  WT_SESSION: process.env.WT_SESSION,
+};
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  refreshColorSupport();
+}
+
+test.after(restoreEnv);
+
+test('truecolor capability detection preserves known positives and defaults unknown to truecolor', () => {
+  assert.equal(supportsTruecolor({ TERM_PROGRAM: 'Apple_Terminal', COLORTERM: 'truecolor' }, 'darwin'), false);
+  assert.equal(supportsTruecolor({ COLORTERM: 'truecolor' }, 'darwin'), true);
+  assert.equal(supportsTruecolor({ COLORTERM: '24bit' }, 'linux'), true);
+  assert.equal(supportsTruecolor({ WT_SESSION: 'abc' }, 'linux'), true);
+  assert.equal(supportsTruecolor({ TERM_PROGRAM: 'iTerm.app' }, 'darwin'), true);
+  assert.equal(supportsTruecolor({ TERM_PROGRAM: 'WezTerm' }, 'darwin'), true);
+  assert.equal(supportsTruecolor({ TERM_PROGRAM: 'ghostty' }, 'darwin'), true);
+  assert.equal(supportsTruecolor({ TERM_PROGRAM: 'vscode' }, 'darwin'), true);
+  assert.equal(supportsTruecolor({ TERM: 'xterm-direct' }, 'linux'), true);
+  assert.equal(supportsTruecolor({}, 'win32'), true);
+  assert.equal(supportsTruecolor({}, 'linux'), true);
+});
+
+test('RGB helpers are byte-identical in truecolor mode and downsample foreground/background on Apple Terminal', () => {
+  process.env.FORCE_COLOR = '1';
+  delete process.env.NO_COLOR;
+  process.env.COLORTERM = 'truecolor';
+  delete process.env.TERM_PROGRAM;
+  refreshColorSupport();
+
+  assert.equal(rgb(215, 119, 87)('x'), '\x1b[38;2;215;119;87mx\x1b[0m');
+  assert.equal(rgbBg(55, 55, 55)('x'), '\x1b[48;2;55;55;55mx\x1b[0m');
+
+  process.env.TERM_PROGRAM = 'Apple_Terminal';
+  assert.equal(rgbSgr(215, 119, 87), '\x1b[38;5;173m');
+  assert.equal(rgb(215, 119, 87)('x'), '\x1b[38;5;173mx\x1b[0m');
+  assert.equal(rgbBg(55, 55, 55)('x'), '\x1b[48;5;237mx\x1b[0m');
+  assert.equal(brightGreen('x'), '\x1b[38;5;35mx\x1b[0m');
+});
+
+test('RGB to ANSI-256 conversion selects the nearest cube or grayscale entry', () => {
+  assert.equal(rgbToAnsi256(0, 170, 75), 35);
+  assert.equal(rgbToAnsi256(198, 198, 198), 251);
+  assert.equal(rgbToAnsi256(136, 136, 136), 102);
+  assert.equal(rgbToAnsi256(255, 255, 255), 231);
+});
+
+test('statusline theme remap recognizes canonical 256-color variants', () => {
+  const colors = {
+    STATUS: '<status>',
+    SUBTLE: '<subtle>',
+    SUCCESS: '<success>',
+    WARNING: '<warning>',
+    ERROR: '<error>',
+  };
+  const success256 = `\x1b[38;5;${rgbToAnsi256(...STATUSLINE_CANONICAL_TRUECOLOR.success)}m`;
+  const warning256 = `\x1b[38;5;${rgbToAnsi256(...STATUSLINE_CANONICAL_TRUECOLOR.warningBright)}m`;
+  const input = `${success256}ok ${warning256}warn`;
+  assert.equal(
+    remapCanonicalStatuslineTruecolor(input, colors),
+    '<success>ok <warning>warn',
+  );
+});

package/scripts/generate-runtime-manifest.mjs

@@ -3,13 +3,13 @@
 // Aggregator step run after all matrix build jobs succeed.
 // Reads release assets via gh CLI, filters mixdog-runtime-*.tar.gz,
 // fetches sha256 from .sha256 sidecar files, and emits runtime-manifest.json
-// to both dist/ and src/runtime/memory/data/ (for the auto-PR).
+// to both dist/ and src/runtime/memory/data/ (for the workflow branch sync).
 //
 // Environment:
 //   GITHUB_TOKEN  — PAT or GITHUB_TOKEN secret with contents:read
 //   RELEASE_TAG   — e.g. "runtime-v0.4.0" (falls back to process.argv[2])
 //   GITHUB_REPOSITORY — auto-set by Actions (e.g. "owner/repo")
-//   RUNTIME_RELEASE_REPOSITORY — override repo for gh commands (legacy trib-plugin/mixdog)
+//   RUNTIME_RELEASE_REPOSITORY — override repo for gh commands
 
 import { execSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -77,23 +77,23 @@ for (const t of tarballs) {
 async function fetchSha256(sha256AssetName, _downloadUrl) {
   // Try matching .sha256 sidecar from the asset list first
   const sidecar = assets.find(a => a.name === sha256AssetName);
-  if (sidecar) {
-    // Download the sidecar file text
-    try {
-      const tmpDir = resolve(tmpdir(), 'mixdog-manifest-sha256');
-      mkdirSync(tmpDir, { recursive: true });
-      execSync(
-        `gh release download ${RELEASE_TAG} --repo ${REPO} --pattern ${sha256AssetName} --dir "${tmpDir}" --clobber`,
-        { encoding: 'utf8', env: process.env }
-      );
-      const content = readFileSync(resolve(tmpDir, sha256AssetName), 'utf8').trim();
-      // Format: "<hex>  <filename>"
-      return content.split(/\s+/)[0];
-    } catch (e) {
-      console.warn(`Could not download sidecar ${sha256AssetName}: ${e.message}`);
-    }
+  if (!sidecar) {
+    throw new Error(`Missing required checksum sidecar: ${sha256AssetName}`);
   }
-  return 'TBD'; // fallback if sidecar not present
+
+  const tmpDir = resolve(tmpdir(), 'mixdog-manifest-sha256');
+  mkdirSync(tmpDir, { recursive: true });
+  execSync(
+    `gh release download ${RELEASE_TAG} --repo ${REPO} --pattern ${sha256AssetName} --dir "${tmpDir}" --clobber`,
+    { encoding: 'utf8', env: process.env }
+  );
+  const content = readFileSync(resolve(tmpDir, sha256AssetName), 'utf8').trim();
+  // Format: "<hex>  <filename>"
+  const checksum = content.split(/\s+/)[0];
+  if (!/^[a-f0-9]{64}$/i.test(checksum)) {
+    throw new Error(`Invalid checksum in sidecar ${sha256AssetName}: ${checksum}`);
+  }
+  return checksum.toLowerCase();
 }
 
 // ---------------------------------------------------------------------------
@@ -118,12 +118,29 @@ for (const tarball of tarballs) {
   };
 }
 
-// Ensure all expected platforms are present (fill missing with TBD)
+// A partial release must never produce a publishable or bundled manifest.
 const EXPECTED = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'win32-x64'];
+const missing = EXPECTED.filter(p => !assetsMap[p]);
+if (missing.length > 0) {
+  console.error(`Missing required runtime asset(s): ${missing.join(', ')}`);
+  process.exit(1);
+}
+
 for (const p of EXPECTED) {
-  if (!assetsMap[p]) {
-    console.warn(`WARNING: No asset found for platform ${p} — filling with TBD`);
-    assetsMap[p] = { url: 'TBD', sha256: 'TBD', size: 0 };
+  const asset = assetsMap[p];
+  let url;
+  try {
+    url = new URL(asset.url);
+  } catch {
+    console.error(`Invalid asset URL for ${p}: ${asset.url}`);
+    process.exit(1);
+  }
+  if (url.protocol !== 'https:' ||
+      !/^[a-f0-9]{64}$/.test(asset.sha256) ||
+      !Number.isSafeInteger(asset.size) ||
+      asset.size <= 0) {
+    console.error(`Invalid release metadata for ${p}: ${JSON.stringify(asset)}`);
+    process.exit(1);
   }
 }
 

package/scripts/grok-oauth-refresh-race-test.mjs

@@ -0,0 +1,198 @@
+import test, { after } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    readdirSync,
+    rmSync,
+    statSync,
+    writeFileSync,
+} from 'node:fs';
+import { spawn } from 'node:child_process';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { writeJsonAtomicSync } from '../src/runtime/shared/atomic-file.mjs';
+
+const root = mkdtempSync(join(tmpdir(), 'mixdog-grok-race-'));
+const tokenPath = join(root, 'grok-oauth.json');
+const moduleUrl = new URL(
+    '../src/runtime/agent/orchestrator/providers/grok-oauth.mjs',
+    import.meta.url,
+).href;
+
+after(() => {
+    rmSync(root, { recursive: true, force: true });
+});
+
+function writeTokens(accessToken, refreshToken, expiresAt) {
+    writeJsonAtomicSync(tokenPath, {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: expiresAt,
+        token_endpoint: 'https://auth.x.ai/oauth/token',
+    }, { lock: true, fsyncDir: true, mode: 0o600, secret: true });
+}
+
+function waitForExit(child, label) {
+    return new Promise((resolve, reject) => {
+        let stderr = '';
+        child.stderr.setEncoding('utf8');
+        child.stderr.on('data', (chunk) => { stderr += chunk; });
+        child.on('error', reject);
+        child.on('exit', (code) => {
+            if (code === 0) resolve();
+            else reject(new Error(`${label} exited ${code}: ${stderr}`));
+        });
+    });
+}
+
+async function waitForFiles(dir, count) {
+    const deadline = Date.now() + 30_000;
+    while (readdirSync(dir).length < count) {
+        if (Date.now() >= deadline) throw new Error('Grok race children did not become ready');
+        await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+}
+
+test('contending Grok processes adopt a refresh-only token rotation', async () => {
+    const readyDir = join(root, 'ready');
+    const exchangeDir = join(root, 'exchanges');
+    const resultDir = join(root, 'results');
+    const startPath = join(root, 'start');
+    mkdirSync(readyDir);
+    mkdirSync(exchangeDir);
+    mkdirSync(resultDir);
+    writeTokens('fixture-old-access', 'fixture-old-refresh', Date.now() + 1_000);
+
+    const childSource = `
+import { writeFileSync } from 'node:fs';
+const { GrokOAuthProvider } = await import(${JSON.stringify(moduleUrl)});
+const provider = Object.create(GrokOAuthProvider.prototype);
+provider.config = {};
+provider.tokens = {
+  ...JSON.parse(await (await import('node:fs/promises')).readFile(process.env.TOKEN_PATH, 'utf8')),
+  mtimeMs: (await (await import('node:fs/promises')).stat(process.env.TOKEN_PATH)).mtimeMs,
+  source: 'own'
+};
+provider._lastDiskScan = provider.tokens.mtimeMs;
+provider._refreshFallbackUntil = 0;
+writeFileSync(process.env.READY_PATH, 'ready');
+while (!(await (await import('node:fs/promises')).stat(process.env.START_PATH).catch(() => null))) {
+  await new Promise((resolve) => setTimeout(resolve, 10));
+}
+globalThis.fetch = async () => {
+  const owner = String(process.pid);
+  writeFileSync(process.env.EXCHANGE_DIR + '/' + owner, 'exchange', { flag: 'wx' });
+  await new Promise((resolve) => setTimeout(resolve, 75));
+  return {
+    ok: true,
+    status: 200,
+    async text() {
+      return JSON.stringify({
+        access_token: 'fixture-old-access',
+        refresh_token: 'fixture-new-refresh-' + owner,
+        expires_in: 600
+      });
+    }
+  };
+};
+const tokens = await provider.ensureAuth();
+writeFileSync(process.env.RESULT_PATH, tokens.refresh_token);
+`;
+
+    const exits = [];
+    for (let index = 0; index < 10; index += 1) {
+        const child = spawn(process.execPath, ['--input-type=module', '--eval', childSource], {
+            env: {
+                ...process.env,
+                MIXDOG_DATA_DIR: root,
+                TOKEN_PATH: tokenPath,
+                READY_PATH: join(readyDir, String(index)),
+                START_PATH: startPath,
+                EXCHANGE_DIR: exchangeDir,
+                RESULT_PATH: join(resultDir, String(index)),
+            },
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        exits.push(waitForExit(child, `contention child ${index}`));
+    }
+
+    await waitForFiles(readyDir, 10);
+    writeFileSync(startPath, 'start');
+    await Promise.all(exits);
+
+    const exchanges = readdirSync(exchangeDir);
+    assert.equal(exchanges.length, 1);
+    const expectedRefresh = `fixture-new-refresh-${exchanges[0]}`;
+    const persisted = JSON.parse(readFileSync(tokenPath, 'utf8'));
+    assert.equal(persisted.access_token, 'fixture-old-access');
+    assert.equal(persisted.refresh_token, expectedRefresh);
+    for (const result of readdirSync(resultDir)) {
+        assert.equal(readFileSync(join(resultDir, result), 'utf8'), expectedRefresh);
+    }
+});
+
+test('invalid_grant adopts a valid token written by a peer without rotating it', async () => {
+    const requestStarted = join(root, 'invalid-request-started');
+    const peerWritten = join(root, 'invalid-peer-written');
+    const resultPath = join(root, 'invalid-result');
+    writeTokens('fixture-invalid-old-access', 'fixture-invalid-old-refresh', Date.now() + 1_000);
+
+    const childSource = `
+import { writeFileSync } from 'node:fs';
+const { GrokOAuthProvider } = await import(${JSON.stringify(moduleUrl)});
+const provider = Object.create(GrokOAuthProvider.prototype);
+provider.config = {};
+provider.tokens = {
+  ...JSON.parse(await (await import('node:fs/promises')).readFile(process.env.TOKEN_PATH, 'utf8')),
+  mtimeMs: (await (await import('node:fs/promises')).stat(process.env.TOKEN_PATH)).mtimeMs,
+  source: 'own'
+};
+provider._lastDiskScan = provider.tokens.mtimeMs;
+provider._refreshFallbackUntil = 0;
+let calls = 0;
+globalThis.fetch = async () => {
+  calls += 1;
+  writeFileSync(process.env.REQUEST_STARTED, 'started');
+  while (!(await (await import('node:fs/promises')).stat(process.env.PEER_WRITTEN).catch(() => null))) {
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  return {
+    ok: false,
+    status: 400,
+    async text() { return JSON.stringify({ error: 'invalid_grant' }); }
+  };
+};
+const tokens = await provider.ensureAuth();
+writeFileSync(process.env.RESULT_PATH, JSON.stringify({
+  adopted: tokens.access_token === 'fixture-peer-access',
+  calls
+}));
+`;
+    const child = spawn(process.execPath, ['--input-type=module', '--eval', childSource], {
+        env: {
+            ...process.env,
+            MIXDOG_DATA_DIR: root,
+            TOKEN_PATH: tokenPath,
+            REQUEST_STARTED: requestStarted,
+            PEER_WRITTEN: peerWritten,
+            RESULT_PATH: resultPath,
+        },
+        stdio: ['ignore', 'ignore', 'pipe'],
+    });
+    const exit = waitForExit(child, 'invalid_grant child');
+    const deadline = Date.now() + 30_000;
+    while (!existsSync(requestStarted)) {
+        if (Date.now() >= deadline) throw new Error('invalid_grant request did not start');
+        await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+
+    writeTokens('fixture-peer-access', 'fixture-peer-refresh', Date.now() + 10 * 60_000);
+    writeFileSync(peerWritten, 'written');
+    await exit;
+
+    assert.deepEqual(JSON.parse(readFileSync(resultPath, 'utf8')), { adopted: true, calls: 1 });
+    assert.ok(statSync(tokenPath).size > 0);
+});

package/scripts/internal-comms-smoke.mjs

@@ -62,7 +62,7 @@ const leadTool = readSrc('rules', 'lead', 'lead-tool.md');
 const core = readSrc('rules', 'agent', '00-core.md');
 const common = readSrc('rules', 'agent', '00-common.md');
 const skip = readSrc('rules', 'agent', '20-skip-protocol.md');
-const OPTIONAL_BRIEF_FIELDS = ['Anchors:', 'Allow/Forbid:', 'Deliver:', 'Verify:'];
+const OPTIONAL_BRIEF_FIELDS = ['Anchors:', 'Allow/Forbid:', 'Deliver:'];
 const TOKEN_PRINCIPLE = /minimum (?:characters|chars), maximum (?:information|info)/i;
 function requireAll(text, label, patterns) {
   for (const pattern of patterns) assert(pattern.test(normalize(text).toLowerCase()), `${label}: missing ${pattern}`);
@@ -71,16 +71,21 @@ assert(TOKEN_PRINCIPLE.test(normalize(leadBrief)), 'lead-brief.md: brief must st
 assert(leadBrief.includes('Task:'), 'lead-brief.md: brief must require labeled field Task:');
 assert(!leadBrief.includes('Goal:'), 'lead-brief.md: Goal: must be replaced by Task:');
 for (const field of OPTIONAL_BRIEF_FIELDS) assert(leadBrief.includes(field), `lead-brief.md: brief missing optional labeled field ${field}`);
+assert(!leadBrief.includes('Verify:'), 'lead-brief.md: must not prescribe Verify:');
+assert(
+  !/copy a prior role(?:'s)? brief|worker\s*(?:->|→)\s*debugger\s*(?:->|→)\s*reviewer|\blead\s*\/\s*worker\b/i.test(leadBrief),
+  'lead-brief.md: must not restore cross-role Task copying or lineage',
+);
 requireAll(leadBrief, 'Lead brief task', [
   /`task:` is mandatory and lossless/, /intent/, /required outcomes/, /negative outcomes/,
   /completion\/stop boundary/, /all other fields are optional task-specific deltas/,
   /preserve user-supplied exact targets and exact replacements\/outputs in `task:`/,
   /never infer exactness from a task name, file count, or perceived difficulty/,
-  /exact same `task:` across worker -> debugger -> reviewer/,
-  /never summarize, rewrite, or replace it/,
+  /each role independently constructs a role-appropriate, lossless `task:` from/,
+  /the original request and official spec\/test acceptance criteria/,
 ]);
 assert(/role-known|already (?:owns|knows)|wasted cost|wasted/i.test(normalize(leadBrief)), 'lead-brief.md: brief must ban restating known rules/background as cost');
-assert(/spec\/test beats its summary/i.test(normalize(leadBrief)), 'lead-brief.md: spec/test must beat summary');
+assert(/original request and official spec\/test acceptance criteria/i.test(normalize(leadBrief)), 'lead-brief.md: original request and official acceptance criteria must beat summary');
 requireAll(leadBrief, 'Lead brief lifecycle', [
   /full brief only for fresh spawn\/`respawned: true`/, /live follow-ups are delta/,
   /dead-tag send is cold: re-supply anchors/, /never `send` mid-run/,
@@ -109,6 +114,15 @@ const roles = {
   'reviewer/AGENT.md': readSrc('agents', 'reviewer', 'AGENT.md'),
   'debugger/AGENT.md': readSrc('agents', 'debugger', 'AGENT.md'),
 };
+const reviewerRole = roles['reviewer/AGENT.md'];
+assert(
+  !/construct the review\s*`task:` independently/i.test(reviewerRole),
+  'reviewer/AGENT.md: must not restore Reviewer-specific Task construction',
+);
+assert(
+  !/treat prior reports as unverified claims rather than evidence/i.test(reviewerRole),
+  'reviewer/AGENT.md: must not restore prior-report framing',
+);
 
 // Semantic contracts deliberately avoid prose snapshots.
 function snapshot(actual, expected, label) {
@@ -208,9 +222,12 @@ Self-verify each checkpoint and the final slice with shell (targeted test/build)
   'reviewer/AGENT.md': `# Reviewer
 Independent regression/risk review agent.
 
-Review the approved intent, diff, and tests with independent judgment. Prioritize
-actionable correctness, regression, security, and verification risks; inspect
-affected boundaries. Do not reimplement the change or report non-risky nits.
+Review the diff and tests with independent judgment. Prioritize actionable
+correctness, regression, security, and verification risks; inspect affected
+boundaries. Do not reimplement the change or report non-risky nits. Independently
+evaluate the final deliverable with a critical lens, actively seeking errors,
+unsupported assumptions, and counterexamples before confirming.
+
 Report findings first, severity-ordered, with one line per \`file:line\`. If clean,
 say so in one line and include only material residual risk.
 

package/scripts/maintenance-default-routes-test.mjs

@@ -0,0 +1,164 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { DEFAULT_MAINTENANCE } from '../src/runtime/agent/orchestrator/config.mjs';
+import { resolveMaintenanceRoute } from '../src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs';
+import { resolveAgentSpawnPreset } from '../src/standalone/agent-tool.mjs';
+import { exploreResultCacheKey, resolveExploreRoute } from '../src/standalone/explore-tool.mjs';
+
+const main = { id: 'main', name: 'MAIN', type: 'agent', provider: 'main-provider', model: 'main-model', tools: 'full' };
+const configWithMain = (overrides = {}) => ({
+  default: 'main',
+  presets: [main],
+  maintenance: { ...DEFAULT_MAINTENANCE },
+  ...overrides,
+});
+const normalizedRoute = (route, provider = route.provider || 'anthropic-oauth') => ({
+  provider,
+  model: route.model,
+  effort: undefined,
+  fast: false,
+});
+
+test('empty Explore and Maintainer routes inherit Main in hidden and public dispatch', () => {
+  assert.equal(DEFAULT_MAINTENANCE.explore, undefined);
+  assert.equal(DEFAULT_MAINTENANCE.memory, undefined);
+  assert.deepEqual(DEFAULT_MAINTENANCE.scheduler, DEFAULT_MAINTENANCE.webhook);
+  assert.equal(DEFAULT_MAINTENANCE.scheduler.provider, 'anthropic-oauth');
+  assert.match(DEFAULT_MAINTENANCE.scheduler.model, /haiku/i);
+
+  const config = configWithMain();
+  assert.equal(resolveMaintenanceRoute({ agent: 'explorer', config }), 'main');
+  assert.equal(resolveMaintenanceRoute({ agent: 'cycle1-agent', config }), 'main');
+  assert.equal(resolveMaintenanceRoute({ agent: 'scheduler-task', config }), DEFAULT_MAINTENANCE.scheduler);
+  assert.equal(resolveAgentSpawnPreset(config, { agent: 'explore' }).preset, main);
+  assert.equal(resolveAgentSpawnPreset(config, { agent: 'maintainer' }).preset, main);
+});
+
+test('public agent, workflow, and maintenance routes override Main inheritance', () => {
+  const exploreAgent = { provider: 'agent-provider', model: 'agent-model' };
+  const maintainerWorkflow = { provider: 'workflow-provider', model: 'workflow-model' };
+  const exploreMaintenance = { provider: 'maintenance-provider', model: 'maintenance-model' };
+  assert.deepEqual(
+    resolveAgentSpawnPreset(configWithMain({ agents: { explore: exploreAgent } }), { agent: 'explore' }).preset,
+    { id: 'agent-explore', name: 'AGENT EXPLORE', type: 'agent', ...exploreAgent, effort: undefined, fast: false, tools: 'full' },
+  );
+  assert.deepEqual(
+    resolveAgentSpawnPreset(configWithMain({
+      workflowRoutes: { memory: maintainerWorkflow },
+      maintenance: { ...DEFAULT_MAINTENANCE, memory: { provider: 'ignored-provider', model: 'ignored-model' } },
+    }), { agent: 'maintainer' }).preset,
+    { id: 'agent-maintainer', name: 'AGENT MAINTAINER', type: 'agent', ...maintainerWorkflow, effort: undefined, fast: false, tools: 'full' },
+  );
+  const config = configWithMain({
+    maintenance: {
+      ...DEFAULT_MAINTENANCE,
+      explore: exploreMaintenance,
+    },
+  });
+  assert.deepEqual(resolveMaintenanceRoute({ agent: 'explorer', config }), normalizedRoute(exploreMaintenance));
+  assert.deepEqual(
+    resolveAgentSpawnPreset(config, { agent: 'explore' }).preset,
+    { id: 'agent-explore', name: 'AGENT EXPLORE', type: 'agent', ...exploreMaintenance, effort: undefined, fast: false, tools: 'full' },
+  );
+});
+
+test('hidden Explore and Maintainer routes use public precedence, including the legacy maintainer alias', () => {
+  const agentRoute = { provider: 'agent-provider', model: 'agent-model' };
+  const workflowRoute = { provider: 'workflow-provider', model: 'workflow-model' };
+  const maintenanceRoute = { provider: 'maintenance-provider', model: 'maintenance-model' };
+  assert.deepEqual(resolveMaintenanceRoute({
+    agent: 'explorer',
+    config: configWithMain({
+      agents: { explore: agentRoute },
+      workflowRoutes: { explorer: workflowRoute },
+      maintenance: { ...DEFAULT_MAINTENANCE, explore: maintenanceRoute },
+    }),
+  }), normalizedRoute(agentRoute));
+  assert.deepEqual(resolveMaintenanceRoute({
+    agent: 'cycle1-agent',
+    config: configWithMain({
+      workflowRoutes: { memory: workflowRoute },
+      maintenance: { ...DEFAULT_MAINTENANCE, memory: maintenanceRoute },
+    }),
+  }), normalizedRoute(workflowRoute));
+  assert.deepEqual(resolveMaintenanceRoute({
+    agent: 'cycle2-agent',
+    config: configWithMain({
+      maintenance: { ...DEFAULT_MAINTENANCE, memory: maintenanceRoute },
+    }),
+  }), normalizedRoute(maintenanceRoute));
+  assert.deepEqual(resolveMaintenanceRoute({
+    agent: 'cycle3-agent',
+    config: configWithMain({ agents: { maintenance: agentRoute } }),
+  }), normalizedRoute(agentRoute));
+});
+
+test('Explore cache identity follows the effective route when Main changes', () => {
+  const first = configWithMain();
+  const secondMain = { ...main, model: 'replacement-main-model' };
+  const second = configWithMain({ presets: [secondMain] });
+  const query = 'locate the route';
+  const cwd = '/tmp/project';
+  assert.deepEqual(resolveExploreRoute(first), main);
+  assert.deepEqual(resolveExploreRoute(second), secondMain);
+  assert.notEqual(
+    exploreResultCacheKey({ cwd, route: resolveExploreRoute(first), query }),
+    exploreResultCacheKey({ cwd, route: resolveExploreRoute(second), query }),
+  );
+});
+
+test('hidden precedence normalizes model-only routes with the public provider fallback', () => {
+  const modelOnly = { model: 'model-only' };
+  assert.deepEqual(
+    resolveMaintenanceRoute({ agent: 'explorer', config: configWithMain({ defaultProvider: 'openai', agents: { explore: modelOnly } }) }),
+    normalizedRoute(modelOnly, 'openai'),
+  );
+  assert.deepEqual(
+    resolveMaintenanceRoute({ agent: 'cycle1-agent', config: configWithMain({ defaultProvider: 'gemini', agents: { maintenance: modelOnly } }) }),
+    normalizedRoute(modelOnly, 'gemini'),
+  );
+  assert.deepEqual(
+    resolveMaintenanceRoute({ agent: 'explorer', config: configWithMain({ defaultProvider: 'xai', workflowRoutes: { explorer: modelOnly } }) }),
+    normalizedRoute(modelOnly, 'xai'),
+  );
+  assert.deepEqual(
+    resolveMaintenanceRoute({ agent: 'cycle2-agent', config: configWithMain({ maintenance: { ...DEFAULT_MAINTENANCE, memory: modelOnly } }) }),
+    normalizedRoute(modelOnly),
+  );
+});
+
+test('loadConfig preserves persisted model-only Explore and Maintainer routes with the configured provider', () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'mixdog-maintenance-config-'));
+  writeFileSync(join(dataDir, 'mixdog-config.json'), JSON.stringify({
+    agent: {
+      defaultProvider: 'openai',
+      maintenance: {
+        explore: { model: 'gpt-test' },
+        memory: { model: 'gpt-maintainer-test' },
+      },
+    },
+  }));
+  const runner = [
+    "import { loadConfig } from './src/runtime/agent/orchestrator/config.mjs';",
+    "console.log(JSON.stringify(loadConfig({ secrets: false }).maintenance));",
+  ].join(' ');
+  const result = spawnSync(process.execPath, ['--input-type=module', '--eval', runner], {
+    cwd: process.cwd(),
+    env: { ...process.env, MIXDOG_DATA_DIR: dataDir },
+    encoding: 'utf8',
+  });
+  assert.equal(result.status, 0, result.stderr);
+  const maintenance = JSON.parse(result.stdout);
+  assert.deepEqual(maintenance.explore, { provider: 'openai', model: 'gpt-test' });
+  assert.deepEqual(maintenance.memory, { provider: 'openai', model: 'gpt-maintainer-test' });
+});
+
+test('config maintenance migration has no standalone provider runtime dependency', () => {
+  const source = readFileSync(new URL('../src/runtime/agent/orchestrator/config.mjs', import.meta.url), 'utf8');
+  assert.doesNotMatch(source, /standalone\/provider-admin/);
+  assert.match(source, /CONFIG_PROVIDER_IDS/);
+});