pi-crew 0.10.1 → 0.10.3

package/CHANGELOG.md

@@ -2,6 +2,353 @@
 
 > **Note:** `atomic-write-v2.ts` / `AtomicWriter` mentioned in historical entries below was consolidated into `atomic-write.ts` as of v0.9.42. This changelog is preserved as historical record — the migration was completed (the v2 class was never adopted; v1 won on simplicity + symlink-safety + link+unlink atomicity). See `docs/migration/atomic-write-v2-migration.md` for the decision rationale.
 
+## [0.10.3] — MuxSurface: workers in real panes + per-team-run tabs (2026-09-01)
+
+128 commits since v0.10.2. The headline feature is **MuxSurface A1** (spec
+`docs/superpowers/specs/2026-08-26-mux-surface-design.md` v0.7.1, ADR
+`docs/decisions/2026-08-26-mux-surface-a1.md`): crew workers can now live in
+REAL multiplexer panes instead of headless stdio pipes.
+
+### MuxSurface A1 — pane-backed workers
+
+- **SurfaceProvider abstraction** (`src/runtime/surface/`) with twin backends:
+  tmux (libtmux-style CLI) and herdr (socket API, newline-JSON). Fail-closed
+  by design: every failure (no mux, forced-mode detect fail, depth, cap, role)
+  degrades to the headless path and the run still completes — pane engagement
+  is proven by events (`worker.surface_spawned`/`worker.surface_closed`),
+  never by the run's green status alone.
+- **Surface gating follows env + config, not run-mode**: `runtime.surface.mode`
+  (auto/tmux/herdr/off) + `runtime.surface.visibleAgents` opt-in (default
+  `[]` = nobody). Async runs engage panes exactly like sync runs — the detached
+  background runner forwards mux env (TMUX/HERDR_*) so `no-mux` detection sees
+  the host's multiplexer (fix `f0a41a16`, verified live: 3/3 workers in panes
+  on an async run, tab closed at run end).
+- **Per-team-run tabs (tab-layout, spec 2026-08-27)**: every TEAM RUN gets its
+  own tab/window (tmux `new-window -d` / herdr `tab.create`), max 8 worker
+  panes per tab before a new tab opens, alternating down/right splits, and the
+  tab closes ONLY when the run ends/cancels/is killed — workers finishing do
+  not close panes. Doctor closes orphan tabs by id + mux liveness.
+- **herdr pane-parent fix**: spawns target the caller's pane via
+  `HERDR_PANE_ID` (never the focused pane — `pane.current` without
+  `caller_pane_id` follows focus, verified live on herdr 0.8.2).
+- **Worker-side recorder + host tail**: surface workers write per-agent
+  `events.jsonl` (same shape as the host); the host tails it via
+  `EventLogTailSource` (incremental byte-offset reads, drain-before-close for
+  fast-closing panes, ENOENT backoff + log-once, and a steady-poll safety net
+  for FSEvents append coalescing on macOS).
+- **D5 full-loadout**: workers are FULL pi sessions by default — no
+  `--no-extensions`, no tool allowlists; restrictions are per-agent opt-in via
+  frontmatter. **D8 nesting**: every role gets the `delegate` tool
+  (`nesting.maxDepth: 4`, kill switch in user config only). **D9 `message`**
+  tool: non-blocking notify/DM/group via broker with anti-spoof `from`
+  override.
+- **ask gate flip**: `broker.waitMethodsEnabled` now defaults `true` — the
+  worker→parent blocking question path works out of the box (it had silently
+  slept behind the old default-off gate).
+- **Broker token revocation**: stale-token + secret-based checks; terminal
+  runs (completed/failed/cancelled) reject worker tokens by definition
+  (late-worker protection).
+
+### Verification for this release
+
+- E2E real-mux suites: tmux 4/4 + herdr 5/5 (spawn/self-close,
+  kill-pane→degrade→headless resume, doctor orphan cleanup, tab per-run,
+  closeTabById fallback).
+- Two full real-test batteries from live pi sessions
+  (`docs/real-test/reports/real-test-2026-08-30-post-tab-layout-live.md`,
+  `real-test-2026-08-31-post-fixes-live.md`): tab-layout verified with live
+  tmux polls (window per run, sequential worker panes, tab closed at run end),
+  async surface engagement verified post-fix, `set <array-key> []` config
+  round-trip fixed.
+- CI all-green on ubuntu + macOS + Windows (first time since 2026-08-24);
+  lint/format drift and 5 layers of hidden cross-OS test failures cleared.
+
+### Perf rounds also shipping in 0.10.3
+
+Retained verbatim below: round-3 retrieval single-pass, round-2 fsync cleanup
++ polling latency, and the 2026-08-24 performance-review fixes.
+
+### [0.10.3] perf: round 3 retrieval single-pass (retrieval 7.1s → 2.0s cold / 0.28s warm per task)
+
+Root cause (measured on real run `team_20260826002634`, 2026-08-26 real test):
+`runRetrievalCycle` spent up to ~7s CPU per task — 3 unconditional cycles (the
+0.7 convergence threshold is unreachable with path-only scoring, observed
+max 0.64), 55 keywords incl. filler over ~57k files, and a duplicate-
+accumulating evaluation list (same file up to 3× in the top-10).
+
+- Single discovery pass + dedupe by absolute path (`retrieval-orchestrator.ts`)
+- STOPWORDS expanded (filler verbs/pronouns out; path-meaningful words kept)
+- rg discovery cached per cwd, 60s TTL, cap 32 (fallback walk uncached)
+- b13 bench guards cold <2s / cache-hit <400ms on the repo itself
+
+| Metric (my_pi monorepo, full-length real-run goal) | Before (`745cf9f1`) | After | Delta |
+|---|---|---|---|
+| runRetrievalCycle cold | 7055 ms | 1980 ms | −72% |
+| warm, new keywords (discovery cache) | 3335 ms | 275 ms | −92% |
+| keywords from tokenize | 55 | 41 | −25% |
+| duplicate paths in top-10 | up to 3×¹ | 0 | — |
+
+¹ Observed ×3 on the original real-run workload; the identical-input baseline
+re-measure shows max 1 (score-tie ordering can keep cycle-2/3 duplicates out
+of the top slice — the cross-cycle accumulation mechanism itself is what T1
+removed). See the probe report footnote.
+
+Prompt-pipeline impact: the measured 6-8s/task gap (real test) had retrieval
+as its dominant component; post-fix retrieval is 2.0s cold / 0.28s warm —
+the non-retrieval remainder was not re-measured end-to-end yet (next real
+test will confirm).
+
+b13 (`bench/b13-retrieval-latency.bench.ts`) runs on the small pi-crew repo
+(cold 83 ms / cache-hit 8 ms) — it is a smoke guard, not the monorepo
+context above; a regression back to 3-cycle behavior stays under its budget
+at that scale. Full follow-up note: `docs/real-test/reports/perf-round3-probe.md`.
+Every number above was measured, not estimated.
+
+### [0.10.3] perf round 2 (2026-08-25): fsync cleanup + polling latency
+
+13 commits after the 2026-08-24 round (45 after `v0.10.2`) (27 files, +3,094/−105, excluding the plan doc and this changelog). Continuation of the 2026-08-24 performance review work, focused on durability escalations and polling latency. Implementation plan: `.superpowers/sdd/2026-08-25-perf-round2-fsync-and-polling/`. Validation evidence: task reports T1-T8 + `bench/b12-fsync-counts.bench.ts`.
+
+### What changed (by area)
+
+- **Pid files** — `withEventLogLockSync` writes lock pid files via `openSync(pidFile, "wx")` followed by plain write (0 fsyncs) instead of `atomicWriteFile` (2 fsyncs). The lock dir's `mkdir` is the mutex; pid files are mtime-stale-detected. Async `.alock` path unchanged.
+- **Buffered event batch flush** — `appendBatchForBufferedWrite` skips fsync for all-non-terminal batches (terminal batches still fsync). Non-terminal buffered work now pays 0 fsyncs per batch.
+- **Non-terminal tasks checkpoints** — opt-in best-effort fsync gate `PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC` (default `false`, beats config). When enabled, non-terminal `tasks.json` checkpoints are written with durability `"best-effort"` (0 fsyncs) while keeping the 50ms coalesced write grouping; terminal transitions and default-off path retain full durability. Reconstructible from the fsync'd event log.
+- **Mailbox delivery marks** — `appendMailboxMessage` (regular sync delivery) now defaults to best-effort durability (delivery.json is informational; next message overwrites). Terminal `acknowledgeMailboxMessage` and `appendMailboxMessageAsync` paths keep explicit full durability.
+- **Steering/ask polling** — event-driven adaptive cadence under live-session realtime: 50ms when realtime active (`hasLiveControlRealtimeListeners()`), 500ms when idle. Non-realtime workers stay at 500ms.
+- **Events cursor tail reads** — verified watermark cache with inode-stamped entries (replaces unsound order-assumption fast path from first attempt). Unchanged stamps read zero bytes; growth reads only the appended delta `[verifiedOffset, size)` — the 4MB wide parse now happens only on cold/shrink/violation. Cache invalidates on inode change (compaction/rotation/rewrite) and drops entries on sinceSeq=0/no-limit reads.
+- **Bench infra** — b5 (`deep-tracking`) repaired for deleted `observation-store` module; b11 (`dep-context-cache`) fixed NDJSON contract; new b12 (`b12.fsync-counts`) micro-bench spies `fs.fsyncSync` calls per operation.
+- **Coalesced drain** — `flushPendingAtomicWrites` groups parent-dir fsyncs across all files in the drain (one `fsyncSync` per distinct dir, best-effort on win32). 4 files in one dir: 5 fsyncs total (4 data + 1 dir) vs 8 pre-grouping (4 data + 4 dir).
+
+### Bench results (Linux x86_64, Node v22.23.1, `npm run bench`)
+
+b12 fsync counts per operation (deterministic across runs; "before" refers to pre-round2 baseline):
+
+| Operation | Before | After | Expectation |
+|---|---|---|---|
+| `appendEventSyncNonTerminal` | 2 | **0** | ≤1 (T1 pid write) |
+| `appendEventSyncTerminal` | 3 | **1** | ==1 (documented) |
+| `appendEventBufferedNonTerminalBatch8` | 1 | **0** | ==0 (T2 batch skip) |
+| `tasksCheckpointNonTerminalFlagOff` | 2 | **2** | ≥1 (full durability) |
+| `tasksCheckpointNonTerminalFlagOn` | 2 | **0** | ==0 (opt-in best-effort) |
+| `appendMailboxMessageDeliveryMark` | 2 | **0** | ==0 (T4 best-effort) |
+| `coalescedDrain4FilesOneDir` | 8 | **5** | ==5 (4 data + 1 dir, T8) |
+
+Coalesced drain A/B (4 files, one dir, heavily loaded machine — indicative): median 36.6 ms (post-T8) vs 55.6 ms (pre-T8) for 5 vs 8 fsyncs. Idle-machine measurement: −61% wall-clock (pre-implementation plan measurement: 59.4→22.9ms; task-8's loaded A/B was 36.6 vs 55.6ms). The deterministic contract is the fsync count.
+
+### Durability semantics
+
+**Full durability retained** for: terminal event writes, terminal task transitions, all `acknowledgeMailboxMessage` calls, all direct `atomicWrite`/`atomicWriteJson` calls, and the default (flag-off) non-terminal checkpoint path. Every persistent state transition that is *not* reconstructible from the event log remains fsync'd.
+
+**Best-effort (opt-in or informational-only)** for: pid files (lock dir is the mutex), non-terminal buffered event batches, non-terminal `tasks.json` checkpoints (when `PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC=1`), and `delivery.json` marks. These state components are reconstructible (pid files via mtime-stale detection; tasks.json from the fsync'd `events.jsonl`; delivery.json is informational and overwritten). A hard crash may lose the latest tail; recovery replays from the last fsync'd event.
+
+### Known residuals (discovered, documented, left for follow-up)
+
+- `flushOnePendingAtomicWrite`'s retry path is dead code (pre-existing; surfaced by T8): coalesced entries are deleted before the write attempt, so the catch block's `retryCount++` and `MAX_FLUSH_RETRIES` rethrow never execute. Fixing requires behavioral changes to failure semantics (separate task). *(→ resolved by the follow-up fixes below)*
+- Cursor cache ino-recycle coincidence: same-path in-place truncate+regrowth would pass the delta-branch check if the rewrite preserved the inode (no current writer does; same accepted-risk class as transcript-cache). Documented in `src/state/event-log/cursor.ts`.
+- Async mailbox twin (`appendMailboxMessageAsync`) retains full durability; T4 scoped to regular sync delivery only. *(→ resolved by the follow-up fixes below)*
+- Tasks-checkpoint `loadConfig()` reads the flag at every save (negligible via 2s TTL cache).
+
+### Follow-up fixes (branch `fix/round2-followups`, 2026-08-26)
+
+- **Dead retry path fixed** — `flushOnePendingAtomicWrite`'s catch now re-queues the entry (the live map entry if a newer write arrived mid-flush, else the captured one) with exponential backoff, so a failed flush retries instead of silently dropping the buffered write; the error still propagates at `MAX_FLUSH_RETRIES`. Regression suite `test/unit/state/atomic-write-coalesced-retry.test.ts` (openSync ENOSPC injection; the coalescer contract is no-throw while retries remain).
+- **Async mailbox twin aligned** — `appendMailboxMessageAsync` delivery marks drop to the best-effort default (mirror of the T4 sync-twin fix); third test in `mailbox-delivery-durability.test.ts` pins 0-fsync pure appends with init absorbed into the baseline.
+- **Test isolation fix (not a production bug)** — `manifest-cache-list-active.test.ts` leaked the real user root into exact-membership assertions (listActive scans every run root by design, RT-F3); the suite now snapshots env and points `PI_CREW_HOME` at an empty temp home, deleting the precedence-winning `PI_TEAMS_HOME`.
+
+### What did NOT improve
+
+- Broker fan-out and worktree git-spawn memoization: unchanged (already addressed in round 1).
+- Async mailbox path (`appendMailboxMessageAsync`): intentionally left at full durability (T4 scoped to sync delivery only). *(→ resolved by the follow-up fixes above)*
+- Tasks-checkpoint coalescing: already present; T3 only added durability control, the 50ms grouping predates this branch.
+
+### Verification
+
+| Check | Result |
+|---|---|
+| `npm run typecheck` | pass |
+| `npm run lint` | pass (2 warnings and 2 infos (all pre-existing)) |
+| `npm run test:unit` | 7153 pass / 0 fail / 3 skipped (7156 total) (includes new T1/T2/T3/T4/T5/T6/T8 test suites) |
+| `npm run bench` | legacy suite green; b5/b11 NDJSON contract repaired; b12 fsync-counts bench added (7 cases, all pass) |
+
+### [0.10.3] perf: fix 2026-08-24 performance review findings (state persistence syscall ceremony, UI sync I/O storms, mailbox/event-log hot paths, broker fan-out, worktree git-spawn memoization)
+
+28 commits after `v0.10.2` (53 files, +4,718/−433). Implements the plan at
+`docs/superpowers/plans/2026-08-24-perf-review-fixes.md`: all Critical (C1–C3) and
+High (H1–H6) findings from the 2026-08-24 performance review, plus the Medium sweep.
+Validation evidence: `.superpowers/sdd/2026-08-24-perf-review-fixes/task-27-report.md`.
+
+### What changed (by area)
+
+- **State persistence syscall ceremony** — `persistSingleTaskUpdate` does a scoped
+  flush + in-lock CAS baseline (only the file being read is drained, not the whole
+  process); atomic-write coalescer gains a dir-exists memo and lazy stringify;
+  `saveRunTasksCoalesced` keeps the manifest half of the run cache across coalesced
+  saves (only tasks stamps are zeroed); artifacts containment verdict memoized 10s
+  (positives only); event-log lock pid files written ceremony-free (no fsync'd
+  tmp+rename for pid files) and the redundant post-reserve monotonic seq persist is
+  skipped (R16-B1 advance-on-reserve untouched); pre-append stat hoisted and
+  reader-less sequenceCache upkeep dropped; lock acquire pre-check caches the
+  symlink verdict; mailbox reads go through a stat-gated parse cache.
+- **UI sync I/O storms** — widget refresh is coalesced on the `fs.watch` path
+  (scheduleRefresh, one async refresh per tick); transcripts render through a
+  tail-windowed wrap + incremental byte-offset reads (no full-file re-read per
+  frame); the dashboard resolves run snapshots once per frame; the widget cache is
+  truncate-once; `visibleWidth` gets a short-string cache; render-diff does a
+  single `diffWords` pass per changed line pair; `listLiveAgents` memoizes its sort
+  with a plain string compare; worker events channel tail is a 1-byte read;
+  config store path does a single `readCacheMtimes` pass.
+- **Broker fan-out / worktree / live-session** — `msg.send` fan-out is chunked
+  over concurrent recipients; sync git probes in the worktree path are memoized
+  (cleanLeader verdict, rev-parse) with throttled per-repo prune; live-session
+  sidechain/transcript writers are batched per 50ms window with bounded (512 KiB)
+  stdout capture and a gated control poll.
+
+### Bench results (Linux x86_64, Node v22.23.1, `npm run bench`)
+
+Pre-fix = same-machine capture 2026-08-24 before the branch; post = this branch.
+Fsync-dominated wall clocks drift ±10-25% day-to-day on this machine — a
+same-day control run on `main` (see report) shows the b4 drift below is
+environmental, not a regression. fsync intentionally remains in the durable path.
+
+| Metric | Pre-fix (2026-08-24) | Post-fix (branch) | Δ |
+|---|---|---|---|
+| `atomic-write-json` warm p50 | 13.01 ms | 13.21 ms | ~flat (fsync floor; control-on-main 13.09 ms) |
+| `b3.state-store-jsonl` n10 `atomicWriteMs` | 14.83 ms | 15.00 ms | ~flat; the "25% faster than same-day control (20.03 ms)" noted pre-merge was load drift — a post-merge interleaved A/B (main vs `519a5e4e`, same session) shows 16.6 vs 16.5 ms, no delta |
+| `b4.event-log` n100 sync append | 1409 ms (70.96/s) | 1518 ms (65.89/s) | environmental drift (control-on-main 1503 ms, 66.53/s) |
+| `b4.event-log` n100 async append | 156 ms (640.86/s) | 198 ms (506/s) | environmental drift (control-on-main 179 ms, 558.30/s); hoped-for async p50 drop did not materialize on wall clock |
+| `b4.event-log` n100 buffered append | — | 261-263 ms (380/s) | new visibility |
+| `snapshot-cache` cold / warm p50 | 1.12 / 1.13 ms | 0.79 / 0.79 ms | **−30%** |
+| `render-flush` p50 | 0.10 ms | 0.10 ms | flat (already sub-budget) |
+| `register-startup` import p50 | 1861.28 ms | 1739.55 ms | −6.5% (cold-cache import, high variance) |
+| `event-append` serial p50 | 15.52 ms | 14.61 ms | −6% |
+| `b2.broker-roundtrip` n1000 | — | 10,049 msgs/s | new visibility |
+| `b7.startup` bundle load (warm avg) | — | 419.89 ms | new visibility |
+
+The structural wins (syscall counts, stat storms, fan-out chunking, batched
+writers) are mostly invisible to these wall-clock benches by design — they remove
+kernel calls whose latency is dominated by the remaining fsync. See the task-27
+report for run-to-run variance data, the same-day main control runs behind the
+"environmental drift" rows, and the b5/b11 bench-infra notes.
+
+Post-merge interleaved A/B (2026-08-25, main vs `519a5e4e` in a worktree, same
+session, alternating runs — the CPU-bound paths the branch targeted, which the
+fsync-floor rows above cannot show):
+
+| Path | baseline | main | Δ |
+|---|---|---|---|
+| `readAllMailboxMessages` warm (160 msgs / 8 files) | 932-949 µs | 521-527 µs | **−44%** (stat-gated parse cache) |
+| `readAllMailboxMessages` churn (60-msg file rewritten per read) | 1903-1970 µs | 1057-1088 µs | **−45%** |
+| `b3` jsonl read n=100 | 1.32 ms | 0.23 ms | **−83%** (cache-keep + stamp reuse) |
+| `b3` jsonl write (n10/100/1000) | 0.11/0.17/0.83 ms | 0.09/0.15/0.77 ms | ~−10% (lazy stringify) |
+| manifest `list()` refresh after TTL (200 runs) | 61-64 µs | 45-66 µs | no measurable wall-time delta (win is syscall count, not latency) |
+
+### Verification
+
+| Check | Result |
+|---|---|
+| `npm run typecheck` | pass |
+| `npm run lint` | pass (2 branch-introduced import-sort errors fixed in `src/state/event-log/event-log.ts`, `src/runtime/live-session/live-session-runtime.ts`) |
+| `npm run test:unit` | 7115-7117 pass / 0-1 fail / 3 skipped — the 1 fail (run 1 of 2) is a pre-existing environmental flake (`session-summary-cov` vector #11 reads the real user-level `~/.pi/.../state/runs`; reproduced identically on `main`; run 2 fully green) |
+| `npm run test:integration` | 189 pass / 0 fail / 4 skipped (env-gated real-model + placeholders), 238.8 s |
+| `npm run bench` | legacy suite green; perf suite requires per-bench invocation until b11 emits NDJSON (pre-existing, see report) |
+
+## [0.10.2] — UI rewrite + adaptive default team (2026-08-24)
+
+40 commits after `v0.10.1` (≈3,500 LOC, 54 files). Headline: the UI surface
+goes from "two modal overlays + status widget" to a proper in-document
+panel — task list above the editor, dock at the very bottom, and an inline
+agent transcript that opens with `↓` from the empty prompt. The default
+team also moves from a fixed 4-step chain to a single adaptive `assess` →
+parallel-execute → verify DAG.
+
+### UI: task list above the editor (`src/ui/widget/task-list.ts`)
+
+- **Pi-tasks style plan rows** (commits `3d930579`, `7434afd7`, `f37619c0`,
+  `54e638ef`). One numbered row per task painted in plan order: `#1`, `#2`,
+  … — no more `01_explore` style technical ids leaking into the user view.
+  Completed rows dim and strike through; the running row carries a spinner
+  frame with elapsed time and live token counts; queued rows name the open
+  dependencies they wait on (`› blocked by #2`).
+- **Header is Claude-Code style**: `● 4 tasks (1 done, 1 in progress, 2 open)` —
+  plain counts, no agent/role identity (those belong to the dock).
+- **Role/agent/model visibility removed from the row** — they live in the dock
+  below the editor. The list above the editor is the *plan*, not a worker
+  report.
+- **10-row cap with `… and N more`** — unfinished work never falls out of the
+  cap; finished rows collapse behind the overflow marker.
+- **Templated titles / descriptions** (commit `f51f7095`) — the task packet
+  emits `title` + `description` fields, `{goal}` substitution lands in the
+  persisted task record (not the run goal), so the list reflects what was
+  actually scoped per phase.
+
+### UI: inline agent panel (`src/ui/inline-panel/`)
+
+A new module (1,761 LOC across 10 files) that replaces the modal-only agent
+surface with an in-document path. Design rationale: `docs/design/2026-08-20-inline-agent-panel.md`.
+Attribution: `NOTICE.md` §"Inline agent panel" — adapted from `pi-subtask`
+v0.7.4 (Victor Mustar, MIT); no code copied verbatim; steering rides
+pi-crew's existing `team steer` channel rather than pi-subtask's stdin pipe.
+
+- **`↓` from the empty prompt opens the dock** (commits `cfcad621`, `cf4895e8`,
+  `bff74c4f`). Static-icon flat rows, footer usage meter, `belowEditor`
+  placement. Enter on a row drops you into the worker's transcript.
+- **Worker view is an in-document pane, never a session switch** (commits
+  `11c6649a`, `21ff211d`, `87497bd5`, `de3d44a0`, `50f41f30`, `5526c279`,
+  `402bb2a5`, `3dd68cc8`, `2b3e899d`, `9ee89866`, `ec8efd0a`, `e1708b20`,
+  `27c5c402`, `56279b00`, `c16cb332`). A sequence of fixes that landed
+  together: a) the `/crew-view` dispatch was routed through pi's immediate
+  command path (not a custom overlay), b) the agent view is a *byte-copy*
+  of the worker's own session log via a derived sessions ROOT, c) live
+  refresh polls the worker transcript and re-renders, d) `Enter` always
+  opens a real Pi session (no broken overlay), e) the worker-143 kill on
+  switches is root-caused (stale `ctx` was being passed around) and the
+  `AbortError` post-exit crash is fixed (`9db66cda`).
+- **Dock survives until the run is done** (commit `67fa202a`) — rows no
+  longer disappear at "completed", the 3-row scroll window keeps the
+  in-progress task visible, and each row remembers its model.
+- **Full-screen overlay still works for end-of-run review** (commit `c16cb332`)
+  — transcripts are complete; `Escape` returns to the dock.
+
+### Workflow: default is now adaptive (BREAKING for templates)
+
+`workflows/default.workflow.md` was rewritten (commit `fff4b98d`) — old
+sequential `explore → plan → execute → verify` was too rigid for the
+common case of "small goal, fast turnaround". The new default is a
+single-`assess` adaptive plan:
+
+- Topology: `complex-dag` (was `sequential`).
+- Frontmatter: `adaptive: true`.
+- The `assess` step (planner role) inspects the repo and emits an
+  `ADAPTIVE_PLAN_JSON` block with the concrete phases + tasks. Independent
+  tasks go into the SAME phase so they run in parallel; the verifier still
+  closes the loop at the end of any implementation plan.
+- Hard cap: 12 tasks per phase. A simple goal may produce 1-2 phases with
+  1-2 tasks; broader goals fan out.
+- Workflow file is **runtime data** (no rebuild needed) — the change is live
+  the next time a worker loads it.
+- Migration: anyone pinning the old `explore/plan/execute/verify` chain
+  should switch to `workflow='plan-execute'` (still ships the fixed DAG).
+
+### Misc
+
+- **Model-routing transparency**: `console.warn` per-model passthrough
+  muted (`273c4f83`) + test pins the muted behaviour (`b019e645`).
+- **Biome 2.5.3 lint + format sync** (commit `69a0460e`, no logic changes).
+- 5 `docs/real-test/reports/real-test-2026-08-2{0..4}-*.md` reports landed
+  alongside the B5 real-test battery (the subagent-v2 release was
+  end-to-end verified before this UI batch).
+- Real-test re-run on the released bundle (`b0cf3a3a` onward): test:critical
+  102/102, typecheck clean, 9a 10/10, 9b 5/5, chain 306.8s observation;
+  opportunistic finding #5 (SPEC-EVIDENCE marker format mismatch `===` vs
+  `:`) filed separately.
+
+### See also
+- `NOTICE.md` §"Inline agent panel" — pi-subtask attribution.
+- `NOTICE.md` §"Source inspiration" — pi-tasks attribution for task list rendering.
+- `docs/design/2026-08-20-inline-agent-panel.md` — inline panel design rationale.
+- `workflows/default.workflow.md` — adaptive default workflow (runtime data).
+- `docs/real-test/reports/real-test-2026-08-11-full-battery.md` — full 9-tier
+  battery on the post-v0.10.1 HEAD (`54e638ef`).
+
 ## [0.10.1] — subagent v2: governed delegation, plan objects, spec system, transparency (2026-08-20)
 
 The full subagent-v2 effort (design `docs/design/subagent-v2-design.md`, plan

package/NOTICE.md

@@ -6,6 +6,7 @@
 
 - Primary design and Pi-extension implementation inspiration: `pi-subagents` by Nico Bailon, MIT license.
 - Team orchestration, state, and worktree contract inspiration: `oh-my-claudecode` by Yeachan Heo, MIT license.
+- Task-list-above-the-editor rendering (numbered plan rows, dependency hints, one-line-per-task) draws on `pi-tasks` (tintinweb, MIT) and Claude Code's plan header convention; no code copied — the pi-crew implementation lives in `src/ui/widget/task-list.ts` and is original work informed by those surfaces.
 - Conceptual inspiration only: `oh-my-openagent` / `oh-my-opencode`, SUL-1.0. No source code from this project should be copied into `pi-crew` unless explicitly reviewed for license compatibility and documented here.
 - Built-in skill topics are original pi-crew guidance informed by common agent-skill patterns in `Source/awesome-agent-skills`, `Source/oh-my-claudecode`, and related local references; no verbatim skill text was copied.
 
@@ -13,6 +14,26 @@
 
 When code is copied or substantially adapted from an MIT source, add the source path and license note here.
 
+### Inline agent panel (2026-08-20)
+
+The inline agent panel (`src/ui/inline-panel/`) adapts the display architecture
+of `pi-subtask` v0.7.4 by Victor Mustar (MIT,
+https://github.com/gary149/pi-subtask):
+
+- width-budgeted single-line agent rows (compact widget row style),
+- identity-tracked panel cursor (`panel-selection.ts` matches its
+  `panelSelId` state machine),
+- in-document `aboveEditor` transcript pane reusing pi's native transcript
+  components instead of a viewport overlay,
+- `CustomEditor` wrapper with `↓`/`↑`/`enter`/`x`/`escape` panel navigation
+  and the `@agent` editor-border label, and the
+  `!ctx.ui.getEditorComponent()` yield rule for editor ownership.
+
+No code was copied verbatim; the pi-crew implementation is a fresh port onto
+pi-crew's own widget/store/event architecture (steering rides pi-crew's
+existing `team steer` steering-file channel rather than pi-subtask's stdin
+pipe).
+
 Current scaffold status: no substantial source files have been copied verbatim; implementation is a fresh scaffold based on documented design lessons.
 
 ## crew-vibes font assets

package/README.md

@@ -53,7 +53,9 @@ repo: https://github.com/baphuongna/pi-crew
 - **Durable state** — manifest, tasks, events, artifacts all persisted to disk
 - **Async/background runs** — detached runs survive session switches with completion notifications
 - **Worktree isolation** — opt-in git worktrees per task for safe parallel edits
-- **Rich UI** — live widget, dashboard, progress tracking, model/token display
+- **Rich UI** — task list above the editor (pi-tasks style: numbered plan rows, dependency hints, `… and N more` overflow), dock at the very bottom (static icons, per-row model, footer usage), and an inline agent panel (open a worker's transcript with `↓` from the empty prompt — never a session switch). Live widget, dashboard, and progress tracking unchanged.
+- **Inline agent panel** (`src/ui/inline-panel/`) — status rows at the bottom, transcript in-document with pi's native components, `CustomEditor` overlay for steering (rides the existing `team steer` channel). Adapted from `pi-subtask` v0.7.4 (MIT) — attribution `NOTICE.md` §"Inline agent panel"; no code copied verbatim.
+- **Adaptive default team** (`workflows/default.workflow.md`) — the built-in default is now a single `assess` → adaptive-DAG step instead of a fixed `explore → plan → execute → verify` chain. The planner inspects the repo and emits a JSON plan; independent tasks run in parallel; the verifier closes the loop. Workflow files are runtime data — the change is live without a rebuild. Pin to `workflow='plan-execute'` if you need the old fixed DAG.
 - **Observability** — metrics registry, Prometheus/OTLP exporters, heartbeat watching, deadletter queue
 - **Resource management** — create/update/delete agents, teams, workflows with validation
 - **Import/export** — portable run bundles for sharing and archiving
@@ -212,7 +214,7 @@ When unsure which team/workflow fits:
 
 | Team | Workflow | Purpose |
 |------|----------|----------|
-| `default` | explore → plan → execute → verify | Balanced, general-purpose |
+| `default` | adaptive: planner derives concrete tasks from the goal, parallel phases, verify | Balanced, general-purpose |
 | `fast-fix` | explore → execute → verify | Quick bug fixes |
 | `implementation` | Adaptive planner decides fanout | Multi-file implementation |
 | `review` | explore → code-review → security-review → verify | Code review + security audit |
@@ -289,6 +291,46 @@ The advisory is **informational only** — there is no `force:true` flag needed
 
 ## Recent changes
 
+### v0.10.2: UI rewrite + adaptive default team (2026-08-24)
+
+40 commits after `v0.10.1` (≈3,500 LOC, 54 files). Headline: the UI surface
+goes from "two modal overlays + status widget" to a proper in-document
+panel — task list above the editor, dock at the very bottom, and an inline
+agent transcript that opens with `↓` from the empty prompt. The default
+team also moves from a fixed 4-step chain to a single adaptive `assess` →
+parallel-execute → verify DAG.
+
+- **Task list above the editor** — pi-tasks style numbered plan rows
+  (`#1`, `#2`, …) instead of `01_explore` ids; completed rows dim and
+  strike through; running row shows spinner + elapsed time + token
+  counts; queued rows name dependencies (`› blocked by #2`). Header
+  is Claude-Code style (`● 4 tasks (1 done, 1 in progress, 2 open)`).
+  Role/agent/model identity moved to the dock — the list is the *plan*,
+  not a worker report. 10-row cap with `… and N more` overflow.
+- **Inline agent panel** (`src/ui/inline-panel/`, ~1,761 LOC, 10 files) —
+  `↓` from the empty prompt opens the dock; Enter drops into the worker's
+  full transcript rendered in-document with pi's native components;
+  steering rides the existing `team steer` channel (no stdin pipe).
+  Worker view is a *byte-copy* of the worker's own session log, polled
+  for live refresh, and Enter on the dock row always opens a real Pi
+  session (the worker-143 kill on switches and the `AbortError`
+  post-exit crash are both fixed). Full-screen overlay preserved for
+  end-of-run review.
+- **Dock survives until the run is done** — rows no longer disappear at
+  "completed"; 3-row scroll window keeps the in-progress task visible;
+  per-row model display.
+- **Adaptive default team** (`workflows/default.workflow.md`, runtime
+  data — no rebuild needed) — old fixed `explore → plan → execute →
+  verify` replaced by a single `assess` step (planner role) that emits
+  an `ADAPTIVE_PLAN_JSON` block. Independent tasks go into the SAME
+  phase so they run in parallel; verifier still closes the loop.
+  **Pin to `workflow='plan-execute'` if you need the old fixed DAG.**
+- **Model-routing passthrough muted** + Biome 2.5.3 lint/format sync.
+- Real-test re-run on the released v0.10.1 bundle: test:critical 102/102,
+  typecheck clean, 9a 10/10, 9b 5/5, chain 306.8s observation.
+  See `CHANGELOG.md` §Unreleased for full notes and `NOTICE.md` for
+  pi-subtask / pi-tasks attributions.
+
 ### v0.9.65: team-tool schema empty-string guard + effectiveness empty-result guard (2026-08-10)
 
 - **`budgetTotal` empty-string unset marker accepted**: `budgetTotal` was the only numeric `TeamToolParams` field missing the `Literal("")` union branch its siblings had. Calling models that emit every schema key with defaults were rejected by pi-ai's pre-handler validation → `Validation failed for tool "team"` on every action. The `MISCONFIGURATION GUARD` (rejects 1-999) is preserved. Caught by the Tier 9 feature battery — Tiers 1-8 stayed green while the team tool was broken for emitting models.

package/agents/executor.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, grep, find, ls, bash, edit, write, scratchpad, ask
+tools: read, grep, find, ls, glob, bash, edit, write, scratchpad, ask, delegate
 ---
 
 You are an implementation specialist. Follow the provided plan, make targeted changes, keep edits minimal, and report changed files plus validation status. Do not broaden scope without explaining why.

package/agents/test-engineer.md

@@ -5,7 +5,7 @@ model: false
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
-tools: read, edit, write, bash, ls, scratchpad, ask
+tools: read, edit, write, bash, ls, glob, grep, find, scratchpad, ask, delegate
 ---
 
 You are a test engineer. Identify the right test level, add or adjust tests when asked, detect flaky assumptions, and report exact validation commands and results.