model-orchestrator 1.0.2 → 1.0.4

package/docs/catalog.md

@@ -207,7 +207,7 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 - **What it is:** A local model runtime; work sent here stays on the machine
 - **Install:** https://ollama.com/download (or `brew install ollama`)
 - **Sign in:** none
-- **Built against:** 0.33.3
+- **Built against:** 0.34.4
 
 **Capability facts.** An unverified value needs a current capability check before use. Role assignments come from the selected stack, using these facts.
 

package/docs/part-2-intermediate.md

@@ -50,7 +50,7 @@ Optional companions can help: codecalc for execution and calculations, obsidian-
 
 ## Measure your own routing
 
-`aunx route-metrics --summary` reads your local Claude Code routing log. It reports where work went, route-marker coverage and subagent durations. Your own measurements are the basis for changing assignments and checking whether the rules are being followed.
+`aunx route-metrics --summary` reads your local Claude Code routing log. It reports where work went, route-marker coverage, subagent durations, and whether the route each reply named matches the delegation that followed. Your own measurements are the basis for changing assignments and checking whether the rules are being followed.
 
 ## What the installer gives you at this level
 

package/llms.txt

@@ -29,6 +29,7 @@ Pick a model proxy (LiteLLM, Portkey, OpenRouter, claude-code-router) for per-re
 - [Claude Code plugin](https://github.com/aunysillyme/model-orchestrator/blob/main/plugin/README.md): installing read-only routing hooks and subagents through the plugin marketplace
 - [Proof](https://github.com/aunysillyme/model-orchestrator/blob/main/proof/README.md): dated measurements, methods, sample sizes, expiry and reproduction scripts
 - [Security review history](https://github.com/aunysillyme/model-orchestrator/blob/main/docs/security-review-history.md): completed review rounds, incident summaries and regression evidence
+- [Catalog advisory checks](https://github.com/aunysillyme/model-orchestrator/blob/main/docs/catalog-advisories.md): package and container inventory, coverage, report statuses, exceptions and manual verification
 - [Changelog](https://github.com/aunysillyme/model-orchestrator/blob/main/CHANGELOG.md): release changes and upgrade notes
 - [Agent instructions](https://github.com/aunysillyme/model-orchestrator/blob/main/AGENTS.md): headless setup and contributor checks
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-orchestrator",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Model router for AI coding agents: installs routing rules, 8 subagents, hooks and a CLI runner so your AI picks model and effort per task and saves tokens",
   "type": "module",
   "bin": {

package/src/README.md

@@ -3,7 +3,7 @@
 | File | Job |
 |---|---|
 | `bounded-file.js` | shared regular-file reader for manifests and check configuration: no-follow/nonblocking open, identity checks and a fixed byte cap even if a file grows. Unsafe files are refused; callers decide how to handle missing or malformed data. |
-| `catalog.js` | the single list of levels and AIs. Add an AI here and the prompts, docs tables, delegation matrix, gateway config and installer all pick it up. Nothing else lists AIs. |
+| `catalog.js` | the single list of levels and AIs. Add an AI here and the prompts, docs tables, delegation matrix, gateway config and installer all pick it up. Nothing else lists AIs. Package pins, companion advisory metadata and image references also supply the repository's advisory inventory. |
 | `roles.js` | pure role assignment from selected catalog capability facts, billing and selection order. Renders the stack table and manifest roles, and infers the main agent from its supported surfaces. Unknown facts remain unverified; review requires a known different model family and private work requires local execution. |
 | `aunx.js` | command dispatch for briefs, context, checks, routing and runner calls. Route suggestions read manifest roles through a capped regular-file JSON reader; symlinks and malformed files are ignored. Route lookup executes no project code. A project's runner requires explicit `--dir`. |
 | `detect.js` | PATH lookup for a binary, plus the few places vendor installers drop binaries without touching PATH. No shell-outs. |

package/src/catalog.js

@@ -300,7 +300,7 @@ export const AIS = [
     summary: 'A local model runtime; work sent here stays on the machine',
     minLevel: 2,
     install: { url: 'https://ollama.com/download', brew: 'ollama' },
-    builtAgainst: '0.33.3',
+    builtAgainst: '0.34.4',
     auth: 'none',
     rulesFile: null,
   },
@@ -402,6 +402,7 @@ export const TOOLS = [
     role: 'exact arithmetic, code execution in 31 languages, SMT logic checks, complexity and equivalence proofs; offline, no key, no telemetry',
     get install() { return `uvx 'codecalc[full]==${this.pin}' setup --write`; },
     pin: '0.5.0',
+    advisory: { ecosystem: 'PyPI', package: 'codecalc', extras: ['full'] },
     mcpSnippets: { 'claude-code': 'mcp/mcpServers.json', codex: 'mcp/codex.config.toml', agy: 'mcp/agy.mcp_config.json', qwen: 'mcp/mcpServers.json' },
     requires: 'uv (https://docs.astral.sh/uv/) and Python 3.10+',
     autoClients: ['Claude Code', 'Claude Desktop', 'Cursor', 'VS Code', 'Zed'],
@@ -415,6 +416,7 @@ export const TOOLS = [
     role: 'durable memory and record for your agents: hybrid retrieval (BM25 + dense + link graph), backlinks, compare-and-swap writes with a confirmation gate, folder ACLs, a poison scan on inferred writes; 163 tools, local by default',
     get install() { return `npm install -g obsidian-tc@${this.pin} && obsidian-tc /path/to/your/vault`; },
     pin: '1.26.0',
+    advisory: { ecosystem: 'npm', package: 'obsidian-tc' },
     mcpSnippets: { 'claude-code': 'mcp/obsidian-tc.mcpServers.json', codex: 'mcp/obsidian-tc.codex.config.toml', agy: 'mcp/obsidian-tc.agy.mcp_config.json', qwen: 'mcp/obsidian-tc.mcpServers.json' },
     requires: 'an Obsidian vault folder (the Obsidian app itself is only needed for live plugin bridges); Node 24+ or Bun 1.1+ (stricter than this installer); Ollama with `nomic-embed-text` for local embeddings, or a cloud embeddings key; the Local REST API plugin only for bridge tools',
     autoClients: ['Cursor', 'VS Code'],
@@ -428,6 +430,7 @@ export const TOOLS = [
     role: 'up-to-date, version-specific documentation and code examples for libraries, SDKs, APIs and CLIs, pulled into the prompt; tells the agent what the code is SUPPOSED to do. Paired with codecalc, which runs the code and proves what it actually does: docs never stand as proof, and where they disagree the run wins',
     get install() { return `npx -y @upstash/context7-mcp@${this.pin}`; },
     pin: '4.1.1',
+    advisory: { ecosystem: 'npm', package: '@upstash/context7-mcp' },
     mcpSnippets: { 'claude-code': 'mcp/context7.claude-code.mcp.json', codex: 'mcp/context7.codex.config.toml', agy: 'mcp/context7.agy.mcp_config.json', qwen: 'mcp/context7.qwen.settings.json' },
     requires: 'Node.js 18+ for the local server or the ctx7 CLI; a free CONTEXT7_API_KEY is optional, for higher rate limits (it works anonymously at the base rate)',
     autoClients: [], // The pinned MCP server does not register itself; merge its snippets.
@@ -454,8 +457,8 @@ export const providerById = Object.fromEntries(PROVIDERS.map((p) => [p.id, p]));
 // Container image pins for the level 3 templates. Bump deliberately; a
 // reviewed box should not change underneath the user on a restart.
 export const IMAGES = {
-  litellm: 'ghcr.io/berriai/litellm:v1.99.1',
-  ollama: 'ollama/ollama:0.33.3'
+  litellm: 'ghcr.io/berriai/litellm:v1.100.3',
+  ollama: 'ollama/ollama:0.34.4'
 };
 
 export const byId = Object.fromEntries(AIS.map((a) => [a.id, a]));

package/templates/advanced/vm/ENVIRONMENT.md

@@ -12,11 +12,17 @@ These are variable **names**. The values live in a secrets manager and are injec
 
 ## Gateway and scheduled audit environments
 
-Inject the provider names above only into the environment used to launch the gateway with Compose. The weekly audit service instead reads `~/.config/ai-orchestrator/weekly-audit.env`, outside the installation and mode 600, containing only `GATEWAY_MASTER_KEY`. Do not point that service at the gateway's provider-key file. Existing installations must update and reload their copied systemd unit when adopting this template.
+Inject the provider names above only into the environment used to launch the gateway with Compose. The weekly audit service instead reads `~/.config/ai-orchestrator/weekly-audit.env`, outside the installation and mode 600, containing `GATEWAY_MASTER_KEY` and optional documented runtime/location settings. Do not point that service at the gateway's provider-key file. Existing installations must update and reload their copied systemd unit when adopting this template.
 
-The audit script removes `GATEWAY_MASTER_KEY`, `LITELLM_MASTER_KEY`, and the gateway provider names `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `XAI_API_KEY`, and `OPENROUTER_API_KEY` from child environments. It supplies the gateway header to curl through stdin, without a credential temp file or an argv value. Newlines anywhere in the key are rejected before collection.
+The audit script builds an explicit allowed environment with shell builtins before its first external command. It supplies the gateway header to curl through stdin, without a credential temp file or an argv value. Newlines anywhere in the key are rejected before collection. All provider keys, unrelated exported names, token variables and exported shell functions are absent from child environments.
 
-Vendor version probes and the report worker retain `HOME`, `PATH`, stored vendor sign-ins, and unrelated authentication variables. Configure the selected lane's own sign-in in the systemd user's account, such as `hermes auth add <provider>` for Hermes. An API-only lane relying solely on one of the removed provider variables needs vendor-supported stored authentication before this scheduled job can run; gateway keys are not a substitute for that setup.
+The allowed runtime names are `HOME`, `PATH`, `USER`, `LOGNAME`, `SHELL`; `LANG`, `LANGUAGE`, `TZ`; `LC_ALL`, `LC_CTYPE`, `LC_COLLATE`, `LC_MESSAGES`, `LC_MONETARY`, `LC_NUMERIC`, `LC_TIME`, `LC_ADDRESS`, `LC_IDENTIFICATION`, `LC_MEASUREMENT`, `LC_NAME`, `LC_PAPER`, `LC_TELEPHONE`; `TMPDIR`, `TMP`, `TEMP`; `XDG_CONFIG_HOME`, `XDG_DATA_HOME`, `XDG_STATE_HOME`, `XDG_CACHE_HOME`, `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS`; and the Windows shell runtime names `SystemRoot`, `SYSTEMROOT`, `WINDIR`. User-service access and stored sign-ins use those same locations.
+
+Only the selected report worker additionally receives its location override: `CODEX_HOME` for `codex`, `HERMES_HOME` for `hermes`. These names are removed from collection/version probes. `agy`, `grok` and `qwen` use stored sign-ins in the common user/configuration locations, with no additional exported authentication name. Configure the selected vendor's sign-in in the systemd user's account, such as `hermes auth add <provider>` for Hermes. API-only setups that depend on exported provider keys need vendor-supported stored authentication before this job can run. Claude Code is not a cli-run worker in this catalog, so its session-token export is removed as well.
+
+`PROBE_SECS` and `RUNNER_SECS` remain shell-only deadline overrides. Set documented runtime and location overrides in the service's `Environment=` settings or audit-only environment file. The key and any selected worker settings stay out of command arguments and logs. There is no arbitrary variable pass-through option.
+
+When migrating, use `--update-docs` for unchanged managed documents, review preserved edited files, apply the new script and docs, update the copied service, then reload systemd. Reconfigure any sign-in that depended on an unrelated export and manually start the service. [The jobs README](jobs/README.md) owns the invocation chain, exact environment contract, migration and verification steps. The environment boundary preserves access to files under HOME/XDG; it does not isolate those files or undo Bash startup files. Real vendor sign-in and systemd behavior remain unverified until the manual run.
 
 ## Rules
 

package/templates/advanced/vm/jobs/README.md

@@ -21,9 +21,28 @@ systemctl --user list-timers        # it should be listed with a next-run time
 loginctl enable-linger "$USER"      # so user timers run without a login session
 ```
 
-The service reads only `GATEWAY_MASTER_KEY` from `~/.config/ai-orchestrator/weekly-audit.env`, outside this folder with mode 600. Provision that audit-only file from your secrets manager and point `EnvironmentFile=` at it before installing. Keep the gateway's provider-key environment separate. Existing installs must replace or edit their copied service, then run `systemctl --user daemon-reload`; updating the source template alone does not update the installed unit. The key must be a single token matching `^[A-Za-z0-9._-]+$`; any embedded or trailing newline is refused.
+The service reads `GATEWAY_MASTER_KEY` and optional documented runtime/location settings from `~/.config/ai-orchestrator/weekly-audit.env`, outside this folder with mode 600. Provision that audit-only file from your secrets manager and point `EnvironmentFile=` at it before installing. Keep the gateway's provider-key environment separate. Existing installs must replace or edit their copied service, then run `systemctl --user daemon-reload`; updating the source template alone does not update the installed unit. The key must be a single token matching `^[A-Za-z0-9._-]+$`; any embedded or trailing newline is refused.
 
-Sign the selected vendor CLI in under the same user before enabling the timer. The job preserves `HOME`, `PATH`, stored sign-in state and unrelated authentication variables, but removes `GATEWAY_MASTER_KEY`, `LITELLM_MASTER_KEY`, `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `XAI_API_KEY`, and `OPENROUTER_API_KEY` from all child environments. An API-only lane dependent on a removed variable needs vendor-supported stored authentication, such as `hermes auth add <provider>`, before scheduling it. Those provider keys belong in the gateway launch environment.
+Sign the selected vendor CLI in under the same user before enabling the timer. Before its first external command, the script uses shell builtins to remove every export except the runtime settings below. It also removes exported shell functions and disables inherited tracing and automatic export. Collection commands and version probes receive this same allowed environment.
+
+| Purpose | Allowed names |
+|---|---|
+| User and executable lookup | `HOME`, `PATH`, `USER`, `LOGNAME`, `SHELL` |
+| Locale and time | `LANG`, `LANGUAGE`, `TZ`, `LC_ALL`, `LC_CTYPE`, `LC_COLLATE`, `LC_MESSAGES`, `LC_MONETARY`, `LC_NUMERIC`, `LC_TIME`, `LC_ADDRESS`, `LC_IDENTIFICATION`, `LC_MEASUREMENT`, `LC_NAME`, `LC_PAPER`, `LC_TELEPHONE` |
+| Temporary directories | `TMPDIR`, `TMP`, `TEMP` |
+| Stored configuration and sign-ins | `XDG_CONFIG_HOME`, `XDG_DATA_HOME`, `XDG_STATE_HOME`, `XDG_CACHE_HOME` |
+| User service and keyring session | `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS` |
+| Windows shell runtime compatibility | `SystemRoot`, `SYSTEMROOT`, `WINDIR` |
+
+The report worker additionally receives `CODEX_HOME` when the selected worker is `codex`, or `HERMES_HOME` when it is `hermes`, if that name was set. These location overrides are absent from collection and version probes. The `agy`, `grok` and `qwen` workers use their stored sign-ins under the common user/configuration directories. No token or provider-key variable is allowed for any current worker; `CLAUDE_CODE_OAUTH_TOKEN` is also removed because Claude Code is not a supported cli-run worker in this catalog. Configure authentication with the selected vendor's sign-in flow, such as `codex login`, `grok login`, `hermes auth add <provider>`, `agy`, or Qwen's `/auth`.
+
+`GATEWAY_MASTER_KEY` stays in a private shell variable until the stdin probe finishes and is then removed. `PROBE_SECS` and `RUNNER_SECS` override the shell's deadlines without becoming child exports. Configure the allowed names and worker location overrides through the service's `Environment=` settings or its audit-only environment file. Keep that file limited to the gateway key and the documented runtime/location settings; keep provider credentials in the gateway launch environment. The script provides no arbitrary extra-variable override.
+
+### Migrate an existing job
+
+Preview your existing selection and paths with `--update-docs --dry-run`, then apply the update. Unchanged managed runtime files upgrade automatically; `--update-docs` refreshes unchanged documents. Review any edited files the installer preserves and merge the environment change into those copies, or use `--upgrade-runtime` when you intend to replace edited runtime files. Apply the new script and both environment documents to your installation, then replace or edit the copied service and run `systemctl --user daemon-reload`. Move sign-in setups that depend on other exported names to the vendor's stored sign-in flow under the service user. Reapply only the documented runtime/location overrides, confirm the selected CLI is on the service's explicit PATH, then perform the manual service check below. Changing `AUDIT_LANE` also requires matching that worker's runner configuration and flags.
+
+This boundary limits child environment inheritance. Files under `HOME` and XDG directories remain readable, including stored sign-ins, and Bash startup files run before the script can filter exports. Live vendor authentication must be verified in the service user's account.
 
 ## Invocation, dependencies, reads and writes
 
@@ -59,7 +78,7 @@ For a manual check, start `systemctl --user start weekly-audit.service`, then ru
 - **Previous report preserved:** output goes to a temp file and is renamed over `audit-<date>.md` only on a clean, non-empty run. A failed run leaves `failed-audit-<stamp>-rc<N>.md` beside it and the last good report untouched.
 - **Boundary:** the lane runs with the strongest restriction it offers ({{AUDIT_LANE_BOUNDARY_NOTE}}). The brief's denied-actions list is an instruction, not an enforcement, for lanes without a sandbox flag.
 - **Honest unknowns:** a probe that times out writes an `UNVERIFIED` line, which the brief tells the lane to treat as unknown, never clean.
-- **Credential separation:** the gateway bearer is never written to a temp file or passed on argv, and gateway/provider keys are absent from version probes and the report worker's environment. Stored vendor sign-ins remain available.
+- **Credential separation:** the gateway bearer is never written to a temp file or passed on argv. Only the named runtime environment reaches probes, and only the selected worker receives its documented location override. Stored vendor sign-ins remain available.
 
 A timer that has never been seen to fire is not known to work. Run `systemctl --user start weekly-audit.service` once by hand and read the journal before trusting the schedule.
 

package/templates/advanced/vm/jobs/weekly-audit.service

@@ -8,7 +8,8 @@ WorkingDirectory={{INSTALL_DIR_SYSTEMD}}
 # Add absolute Node and vendor CLI directories if they live outside these defaults.
 # systemd does not expand shell variables in Environment=.
 Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-# Audit-only file OUTSIDE this repo, mode 600: GATEWAY_MASTER_KEY only.
+# Audit-only file OUTSIDE this repo, mode 600: GATEWAY_MASTER_KEY and optional
+# runtime/location settings from jobs/README.md. Other exports are removed.
 # Provider credentials stay in the separate gateway/Compose environment.
 # Vendor CLIs use this user's stored sign-in state. Edit the path if needed.
 EnvironmentFile=%h/.config/ai-orchestrator/weekly-audit.env

package/templates/advanced/vm/jobs/weekly-audit.sh

@@ -8,18 +8,32 @@
 #     renamed into place only on a clean exit; failed output is kept beside it for diagnosis
 #   - the lane runs with the strongest boundary it offers ({{AUDIT_LANE_BOUNDARY_NOTE}})
 #   - any nonzero rc from cli-run (10 to 18) means no report was produced; the timer's journal shows it
+# Disable inherited tracing and automatic export before handling credentials.
+set +a +x +v
 set -uo pipefail
 INSTALL_DIR={{INSTALL_DIR_SH}}
 AUDIT_LANE="{{AUDIT_LANE}}"
 AUDIT_LANE_FLAGS="{{AUDIT_LANE_FLAGS}}"
 PROBE_SECS="${PROBE_SECS:-10}"      # per collection probe
 RUNNER_SECS="${RUNNER_SECS:-600}"   # the model call; TimeoutStartSec in the unit covers the whole job
-# Keep the probe credential in this shell only. Gateway provider keys belong to
-# Compose, not to collection tools or the scheduled vendor CLI. Stored vendor
-# sign-ins, HOME, PATH, and unrelated authentication variables remain available.
-KEY="${GATEWAY_MASTER_KEY:-}"
+# Builtins only until the exported environment is reduced to these named runtime
+# settings. De-exporting also handles shell-owned readonly variables. Keep home
+# overrides private until the selected worker runs; stored sign-ins stay on disk.
 export -n KEY
-unset GATEWAY_MASTER_KEY LITELLM_MASTER_KEY ANTHROPIC_API_KEY OPENAI_API_KEY GEMINI_API_KEY XAI_API_KEY OPENROUTER_API_KEY
+KEY="${GATEWAY_MASTER_KEY:-}"
+while IFS= read -r name; do
+  case "$name" in
+    HOME|PATH|USER|LOGNAME|SHELL|LANG|LANGUAGE|TZ|TMPDIR|TMP|TEMP|\
+    LC_ALL|LC_CTYPE|LC_COLLATE|LC_MESSAGES|LC_MONETARY|LC_NUMERIC|LC_TIME|\
+    LC_ADDRESS|LC_IDENTIFICATION|LC_MEASUREMENT|LC_NAME|LC_PAPER|LC_TELEPHONE|\
+    XDG_CONFIG_HOME|XDG_DATA_HOME|XDG_STATE_HOME|XDG_CACHE_HOME|\
+    XDG_RUNTIME_DIR|DBUS_SESSION_BUS_ADDRESS|SystemRoot|SYSTEMROOT|WINDIR) ;;
+    *) export -n "$name" ;;
+  esac
+done < <(compgen -e)
+# Exported shell functions are also outside the child environment contract.
+while IFS= read -r name; do export -nf "$name"; done < <(compgen -A function)
+unset name GATEWAY_MASTER_KEY LITELLM_MASTER_KEY ANTHROPIC_API_KEY OPENAI_API_KEY GEMINI_API_KEY XAI_API_KEY OPENROUTER_API_KEY
 
 # A shell pattern checks the whole value, including embedded/trailing newlines.
 # Line-oriented grep accepts a valid line even when another line is malformed.
@@ -118,8 +132,16 @@ BRIEF="reports/audit-brief-$STAMP.md"
 # Write to a temp file; the dated report is replaced only by a clean, non-empty run.
 FINAL="reports/audit-$DATE.md"
 TMP="$(mktemp "reports/.audit-$STAMP-XXXXXX")"
-# shellcheck disable=SC2086
-node bin/cli-run.mjs "$AUDIT_LANE" $AUDIT_LANE_FLAGS --brief "$BRIEF" --timeout "$RUNNER_SECS" --quiet < /dev/null > "$TMP"
+(
+  # These are configuration locations, not provider keys. All current scheduled
+  # lanes use stored sign-ins; no token variable is part of this contract.
+  case "$AUDIT_LANE" in
+    codex) if [ "${CODEX_HOME+x}" ]; then export CODEX_HOME; fi ;;
+    hermes) if [ "${HERMES_HOME+x}" ]; then export HERMES_HOME; fi ;;
+  esac
+  # shellcheck disable=SC2086
+  exec node bin/cli-run.mjs "$AUDIT_LANE" $AUDIT_LANE_FLAGS --brief "$BRIEF" --timeout "$RUNNER_SECS" --quiet
+) < /dev/null > "$TMP"
 rc=$?
 if [ "$rc" -eq 0 ] && [ -s "$TMP" ]; then
   mv -f "$TMP" "$FINAL"

package/templates/agents/snippets/route-metrics.mjs

@@ -342,6 +342,40 @@ function runSummary(args) {
   const starts = records.filter((r) => r.event === 'start').length;
   const noMatchingStart = Math.max(0, dispatches.length - starts);
 
+  // Reconciliation: does the marker's claim match what the session actually did?
+  // Both halves are already in this log -- the Stop marker says which lane the turn
+  // DECLARED, and the PreToolUse event says what was actually DISPATCHED -- and until
+  // now nothing compared them. A declared lane is a claim; a dispatch is the act.
+  // Grouped by session because a marker is written once per turn while a dispatch can
+  // land on any turn of the same session, so turn-level pairing would report drift
+  // that is only ordering.
+  // PRESENCE, not identity, and the name says so: this asks whether a session that
+  // NAMED a lane went on to dispatch at all, not whether it dispatched the lane it named. A
+  // session that named builder and dispatched reader matches here. Lane identity is
+  // not recoverable from this log, because the marker names a lane from the user's own
+  // ROUTING.md while a dispatch names a subagent_type, and the two vocabularies do not
+  // have to line up.
+  const sessions = new Map();
+  for (const r of records) {
+    if (!r.session_id) continue;
+    if (!sessions.has(r.session_id)) sessions.set(r.session_id, { declaredOff: false, dispatched: false, sawLane: false });
+    const acc = sessions.get(r.session_id);
+    if (r.event === 'dispatch') acc.dispatched = true;
+    if (r.event === 'route' && Array.isArray(r.lane)) {
+      // 'missing' is what the hook writes when a turn carried NO marker, so it is the
+      // absence of a claim, not a claim of inline. Counting it here would double-report
+      // the gap the coverage line above already reports.
+      const named = r.lane.filter((l) => l !== 'missing');
+      if (named.length > 0) acc.sawLane = true;
+      if (named.some((l) => !inlineNames.has(String(l).trim().toLowerCase()))) acc.declaredOff = true;
+    }
+  }
+  const reconcilable = [...sessions.values()].filter((a) => a.sawLane);
+  const claimedNotDone = reconcilable.filter((a) => a.declaredOff && !a.dispatched).length;
+  const doneNotClaimed = reconcilable.filter((a) => !a.declaredOff && a.dispatched).length;
+  const agreed = reconcilable.length - claimedNotDone - doneNotClaimed;
+  const agreedPct = reconcilable.length > 0 ? (agreed / reconcilable.length) * 100 : null;
+
   const ends = records.filter((r) => r.event === 'end' && r.agent_type && typeof r.duration_s === 'number');
   const durationsByType = new Map();
   for (const r of ends) {
@@ -366,6 +400,15 @@ function runSummary(args) {
   if (dispatchCounts.size === 0) lines.push('  (none)');
   for (const [type, count] of [...dispatchCounts.entries()].sort((a, b) => b[1] - a[1])) lines.push('  ' + type + ': ' + count);
   lines.push('dispatches with no matching start: ' + noMatchingStart + ' (a hook or guard blocked them before launch)');
+  lines.push(
+    'delegation claimed vs observed: ' +
+      (agreedPct === null ? 'no session named a lane yet' : formatNumber(agreedPct) + '% of sessions match') +
+      ' (' + agreed + '/' + reconcilable.length + ' sessions that named a lane)'
+  );
+  lines.push('  named a lane, no dispatch in this window: ' + claimedNotDone);
+  lines.push('  dispatched, but every named lane was inline: ' + doneNotClaimed);
+  lines.push('  presence only: a session that named one lane, then dispatched a different one, still counts as matching,');
+  lines.push('  and --since or a rotated log can split a session so one half lands in the counts above.');
   lines.push('duration by agent_type (mean / max, seconds):');
   if (durationsByType.size === 0) lines.push('  (none)');
   for (const [type, durs] of durationsByType) {