tickmarkr 1.30.0

package/dist/adapters/registry.js

@@ -0,0 +1,165 @@
+import { existsSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { drovrDir, stateDirName } from "../graph/graph.js";
+import { disallowedBy } from "../route/preference.js";
+import { sh } from "../run/git.js";
+import { claudeCode } from "./claude-code.js";
+import { codex } from "./codex.js";
+import { cursorAgent } from "./cursor-agent.js";
+import { FakeAdapter } from "./fake.js";
+import { grok } from "./grok.js";
+import { opencode } from "./opencode.js";
+import { pi } from "./pi.js";
+import { channelKey, modelAuthed, QUOTA_RE } from "./types.js";
+export function allAdapters(opts = {}) {
+    // pi + grok appended LAST: same-tier ties resolve by discovery order (Phase 6 D2), so appending
+    // keeps the Phase 6 shape→channel matrix byte-identical; inserting anywhere else silently
+    // reassigns shapes on same-tier ties. grok is appended AFTER pi for the same reason.
+    const real = [claudeCode, codex, cursorAgent, opencode, pi, grok];
+    const fakePath = opts.fakeScriptPath ?? process.env.DROVR_FAKE_SCRIPT ?? process.env.DROVER_FAKE_SCRIPT;
+    return fakePath ? [new FakeAdapter(fakePath), ...real] : real;
+}
+export function getAdapter(id, adapters) {
+    const a = adapters.find((a) => a.id === id);
+    if (!a)
+        throw new Error(`unknown adapter ${id} (have: ${adapters.map((a) => a.id).join(", ")})`);
+    return a;
+}
+export async function probeAll(adapters) {
+    const out = {};
+    await Promise.all(adapters.map(async (a) => { out[a.id] = await a.probe(); }));
+    return out;
+}
+const MODEL_PROBE_PROMPT = "Reply with exactly OK and nothing else.";
+const MODEL_PROBE_TIMEOUT_MS = 30000;
+// Auth-words only match when tied to a failure word; bare "auth"/"OAuth"/"authored" never fail (v1.27 T2).
+const AUTH_FAILURE_RE = /\b4\d\d\b|\bauth(?:entication|orization)?\s+(?:error|failed|failure|denied)|unauthori[sz]ed|forbidden|access denied|credit(?:s)?\s+(?:exhausted|error|denied)/i;
+function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TIMEOUT_MS) {
+    // SIGKILL-timeout is not exit-1: report the budget, never the masked kill code (v1.27 T1).
+    if (timedOut)
+        return `probe timed out after ${timeoutMs}ms`;
+    const output = `${stderr}\n${stdout}`.trim().replace(/\s+/g, " ");
+    return code !== 0 || QUOTA_RE.test(output) || AUTH_FAILURE_RE.test(output)
+        ? output.slice(0, 240) || `probe exited ${code}`
+        : undefined;
+}
+// v1.21: one bounded, headless call per configured model; detected-but-unclassified models never enter this loop.
+export async function probeModels(cfg, repoRoot, adapters, health) {
+    await Promise.all(adapters.map(async (a) => {
+        const h = health[a.id];
+        if (!h?.installed)
+            return;
+        // Tests inject FakeAdapter; never let an incidental default adapter spend a real token in the suite.
+        if (process.env.VITEST && [claudeCode, codex, cursorAgent, opencode, pi, grok].includes(a))
+            return;
+        const verdicts = {};
+        for (const model of Object.keys(cfg.tiers[a.id]?.models ?? {})) {
+            const probedAt = new Date().toISOString();
+            try {
+                if (typeof a.headlessCommand !== "function") {
+                    verdicts[model] = { authed: false, reason: "headless probe unavailable", probedAt };
+                    continue;
+                }
+                const promptFile = join(mkdtempSync(join(tmpdir(), "drovr-auth-")), "probe.md");
+                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                let r = await sh(a.headlessCommand(promptFile, model), repoRoot, MODEL_PROBE_TIMEOUT_MS);
+                if (r.timedOut) {
+                    r = await sh(a.headlessCommand(promptFile, model), repoRoot, MODEL_PROBE_TIMEOUT_MS);
+                    if (r.timedOut) {
+                        verdicts[model] = { authed: false, reason: `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`, probedAt };
+                        continue;
+                    }
+                }
+                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                verdicts[model] = reason ? { authed: false, reason, probedAt } : { authed: true, probedAt };
+            }
+            catch (e) {
+                verdicts[model] = { authed: false, reason: String(e), probedAt };
+            }
+        }
+        h.modelAuth = verdicts;
+    }));
+}
+const doctorPath = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "doctor.json");
+export function writeDoctor(repoRoot, health) {
+    drovrDir(repoRoot);
+    writeFileSync(doctorPath(repoRoot), JSON.stringify(health, null, 2) + "\n");
+}
+export function readDoctor(repoRoot) {
+    return existsSync(doctorPath(repoRoot)) ? JSON.parse(readFileSync(doctorPath(repoRoot), "utf8")) : null;
+}
+export function discoverChannels(cfg, adapters, health) {
+    const base = adapters
+        .filter((a) => health[a.id]?.installed && health[a.id]?.authed)
+        .flatMap((a) => {
+        const h = health[a.id];
+        const s = h?.servable;
+        // T2 (2026-07-13): a model doctor marked unauthed (modelAuth[model].authed===false) advertises NO
+        // channel — routing a 403 into dispatch was the v1.10 regression. modelAuthed is true when no verdict
+        // is recorded (absent modelAuth ⇒ unknown ⇒ routable), so an all-authed/pre-v1.5 fleet is byte-identical.
+        return a.channels(cfg).filter((c) => modelAuthed(h, c.model) && (!s || s.includes(c.model)));
+    });
+    if (!cfg.routing.allow && !cfg.routing.deny)
+        return base;
+    return base.filter((c) => disallowedBy(c, cfg.routing) === null);
+}
+// HYG-07(a): the channels discoverChannels silently dropped because their model isn't in the adapter's
+// served list (the HYG-05 filter above). Computed from the SAME inputs as the drop (a.channels(cfg), not
+// channelsFromConfig — FakeAdapter overrides channels()), so attribution can never drift from behavior.
+// installed+authed+servable-defined mirrors the filter's three gates exactly.
+export function servableExclusions(cfg, adapters, health) {
+    const out = [];
+    for (const a of adapters) {
+        const h = health[a.id];
+        if (!h?.installed || !h?.authed || !h.servable)
+            continue;
+        for (const c of a.channels(cfg)) {
+            if (!h.servable.includes(c.model))
+                out.push({ key: channelKey(c), adapter: a.id });
+        }
+    }
+    return out;
+}
+// HYG-07(a): exclusionLine() voice — the operator already parses this vocabulary in plan+doctor.
+export function servabilityLine(excluded) {
+    const parts = excluded.map(({ key, adapter }) => `${key} (not in ${adapter}'s served model list)`);
+    return `servability: ${excluded.length} channel(s) unservable — ${parts.join(", ")}`;
+}
+// T2 (2026-07-13): channels discoverChannels dropped because doctor marked their model unauthed
+// (modelAuth[model].authed===false). Computed from the SAME inputs as the drop (a.channels(cfg)) so
+// attribution can never drift from behavior. installed+authed mirrors the discoverChannels adapter gate;
+// a missing modelAuth record ⇒ unknown ⇒ NOT excluded (compat with pre-v1.5 doctor.json + probeAll fallback).
+export function modelAuthExclusions(cfg, adapters, health) {
+    const out = [];
+    for (const a of adapters) {
+        const h = health[a.id];
+        if (!h?.installed || !h?.authed)
+            continue;
+        const verdicts = h.modelAuth;
+        if (!verdicts)
+            continue;
+        for (const c of a.channels(cfg)) {
+            const v = verdicts[c.model];
+            if (v?.authed === false)
+                out.push({ key: channelKey(c), adapter: a.id, reason: v.reason ?? "probe failed", probedAt: v.probedAt });
+        }
+    }
+    return out;
+}
+// T2: one lint per exclusion, naming the probe reason and date (acceptance criterion). Mirrors servabilityLine voice.
+export function modelAuthLine(excluded) {
+    const parts = excluded.map(({ key, reason, probedAt }) => `${key} (${reason} — probed ${probedAt.split("T")[0]})`);
+    return `model auth: ${excluded.length} channel(s) unauthed — ${parts.join(", ")}`;
+}
+// HYG-07(b): file mtime is the zero-schema-change staleness signal — doctor.json carries no probe timestamp,
+// so a schema field would break the existing-files compat invariant. null when the file is absent (probeAll
+// fallback path is fresh by construction). statSync is free vs the readDoctor that already happened.
+export function doctorAgeMs(repoRoot) {
+    const p = doctorPath(repoRoot);
+    if (!existsSync(p))
+        return null;
+    // Math.max: mtimeMs is sub-ms float, Date.now() is int ms — clamp so a clock-skew fraction never
+    // renders a nonsensical negative age ("doctor.json is -0h old").
+    return Math.max(0, Date.now() - statSync(p).mtimeMs);
+}

package/dist/adapters/types.d.ts

@@ -0,0 +1,98 @@
+import { z } from "zod";
+import type { DrovrConfig, Tier } from "../config/config.js";
+import type { Task } from "../graph/schema.js";
+export declare const TokenUsageSchema: z.ZodObject<{
+    input: z.ZodNumber;
+    output: z.ZodNumber;
+    cacheRead: z.ZodOptional<z.ZodNumber>;
+    cacheWrite: z.ZodOptional<z.ZodNumber>;
+    reasoning: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type TokenUsage = z.infer<typeof TokenUsageSchema>;
+export declare function addUsage(a: TokenUsage | undefined, b: TokenUsage): TokenUsage;
+export interface Assignment {
+    adapter: string;
+    model: string;
+    channel: "sub" | "api";
+    tier: Tier;
+}
+export interface BillingChannel {
+    adapter: string;
+    vendor: string;
+    model: string;
+    channel: "sub" | "api";
+    tier: Tier;
+}
+export interface ModelAuth {
+    authed: boolean;
+    reason?: string;
+    probedAt: string;
+}
+export interface AuthHealth {
+    installed: boolean;
+    authed: boolean;
+    version?: string;
+    models: string[];
+    note?: string;
+    modelsDetectedAt?: string;
+    servable?: string[];
+    modelAuth?: Record<string, ModelAuth>;
+}
+export declare function modelAuthed(health: AuthHealth | undefined, model: string): boolean;
+export interface Invocation {
+    command: string;
+}
+export interface WorkerResult {
+    ok: boolean;
+    summary: string;
+    deviations: string[];
+    raw: string;
+}
+export interface ContextUsage {
+    tokens: number;
+    limit?: number;
+}
+export interface SessionRef {
+    cwd: string;
+    id: string;
+}
+export type TrustVerdict = {
+    status: "trusted";
+} | {
+    status: "seeded";
+} | {
+    status: "action-required";
+    command: string;
+};
+export interface TrustDialog {
+    fingerprint: string;
+    key: string;
+}
+export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): boolean;
+export interface WorkerAdapter {
+    id: string;
+    vendor: string;
+    probe(): Promise<AuthHealth>;
+    channels(cfg: DrovrConfig): BillingChannel[];
+    headlessCommand(promptFile: string, model: string): string;
+    interactiveCommand(promptFile: string, model: string): string | null;
+    resumeCommand?(sessionId: string, promptFile: string, model: string): string;
+    invoke(task: Task, cwd: string, a: Assignment, ctx: {
+        promptFile: string;
+    }): Invocation;
+    parse(output: string, nonce: string): WorkerResult;
+    listModels?(): Promise<string[]>;
+    listModelsFetchedAt?(): string | undefined;
+    collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
+    contextUsage?(session: SessionRef): ContextUsage | null;
+    trust?(repoRoot: string): TrustVerdict;
+    trustDialog?: TrustDialog;
+}
+export declare function channelsFromConfig(adapterId: string, cfg: DrovrConfig): BillingChannel[];
+export declare function channelKey(c: {
+    adapter: string;
+    model: string;
+}): string;
+export declare function shq(s: string): string;
+export declare const QUOTA_RE: RegExp;
+export declare const MODEL_ID_RE: RegExp;

package/dist/adapters/types.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+// SPEND-01/06: normalized token counts — the measurable fact. NO cost field, ever: CLIs report
+// cost:0 on sub plans and notional list prices on others (LIVE-CHECK finding 3); money is Phase 18's
+// derivation (operator price × tokens), never a CLI claim (SPEND-06).
+export const TokenUsageSchema = z.object({
+    input: z.number().int().nonnegative(),
+    output: z.number().int().nonnegative(),
+    cacheRead: z.number().int().nonnegative().optional(),
+    cacheWrite: z.number().int().nonnegative().optional(),
+    reasoning: z.number().int().nonnegative().optional(),
+});
+// SPEND-02 accumulation across attempts. The inner ?? 0 is the ONE sanctioned coalesce for usage —
+// safe ONLY behind the both-undefined guard (mirrors classify()'s consults ?? 0 precedent): it can
+// merge two observed counts, it can never MATERIALIZE a count for an unobserved attempt. Absent+absent
+// stays absent; the top-level fold in daemon.ts only calls this when attemptUsage is real.
+export function addUsage(a, b) {
+    if (!a)
+        return b;
+    const add = (x, y) => (x === undefined && y === undefined ? undefined : (x ?? 0) + (y ?? 0));
+    return {
+        input: a.input + b.input, output: a.output + b.output,
+        cacheRead: add(a.cacheRead, b.cacheRead), cacheWrite: add(a.cacheWrite, b.cacheWrite),
+        reasoning: add(a.reasoning, b.reasoning),
+    };
+}
+export function modelAuthed(health, model) {
+    return health?.modelAuth?.[model]?.authed !== false;
+}
+export function matchesTrustDialog(paneText, dialog) {
+    return paneText.includes(dialog.fingerprint);
+}
+export function channelsFromConfig(adapterId, cfg) {
+    const e = cfg.tiers[adapterId];
+    if (!e)
+        return [];
+    return Object.entries(e.models).map(([model, tier]) => ({
+        adapter: adapterId, vendor: e.vendor, model, channel: e.channel, tier,
+    }));
+}
+export function channelKey(c) {
+    return `${c.adapter}:${c.model}`;
+}
+export function shq(s) {
+    return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+// Quota exhaustion is detected from CLI errors, never predicted (spec §4).
+// ZAI coding-plan exhaustion text: "Insufficient balance or no resource package. Please recharge."
+// Anchor the distinctive full phrase, not the two-word "insufficient balance" fragment — that fires
+// on ordinary billing/wallet task output the harness edits (research Pitfall 3, 2026-07-10).
+export const QUOTA_RE = /rate.?limit|quota|usage limit|out of credits|insufficient credit|insufficient balance or no resource|\b429\b/i;
+// v1.5 MODEL-01: charset gate for detected model ids (research Pitfall 4, verified 2026-07-10).
+// Ids come from CLI stdout / another program's JSON (models_cache.json) and are echoed into
+// operator-facing lint text and persisted to doctor.json — defense-in-depth for MODEL-05 (config
+// suggestions that could reach a shell). Covers observed ids incl. zai-coding-plan/glm-5.2,
+// gpt-5.6-sol, composer-2.5, gpt-5.3-codex; non-conforming (ANSI/control/shell-metachar) ids dropped.
+export const MODEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._/:\[\]=,-]*$/;

package/dist/cli/commands/approve.d.ts

@@ -0,0 +1 @@
+export declare function approve(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/approve.js

@@ -0,0 +1,72 @@
+import { userInfo } from "node:os";
+import { ATTEMPT_CAP_RELEASE, Journal } from "../../run/journal.js";
+// GATE-08 (v1.12): approve a parked human gate so the next `drovr resume <runId>` dispatches it.
+//
+// The approval is a JOURNAL EVENT (task-approved) carrying who and when — it touches ONLY the
+// append-only journal. Writing it into drovr's compiled graph artifact would be silently erased by
+// the next recompile (which re-emits humanGate:true from the plan frontmatter) — Phase 42 D-02.
+//
+// v1.24 OBS-18: when the park was attempt-cap (not a humanGate pre-dispatch park), the event also
+// carries `release: "attempt-cap"`. replayResumeState zeros the attempt budget on that marker so
+// resume dispatches instead of re-parking in the same tick; tried-list is preserved. humanGate
+// parks (attempts 0, reason starts with "humanGate:") stamp no release — byte-identical to GATE-08.
+//
+// Fail-closed (D-05): unknown runId, unknown taskId, a not-parked task, and a double-approve are all
+// LOUD refusals that name the reason and append NO event — never a silent no-op. A handler throw
+// becomes `drovr approve: <message>` at exit 1 (src/cli/index.ts dispatch).
+//
+// Who/when is truthful, not dressed-up auth (D-03): default actor os.userInfo().username; --by overrides
+// for delegated approval; optional --reason; the event's ts (stamped by Journal.append) is the when.
+export async function approve(argv, cwd = process.cwd()) {
+    const { runId, taskId, by, reason } = parseArgs(argv);
+    // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
+    const journal = Journal.open(cwd, runId);
+    const status = journal.replayStatuses().get(taskId);
+    if (status === undefined) {
+        throw new Error(`task ${taskId} has no events in run ${runId} — unknown task or never dispatched`);
+    }
+    if (status !== "human") {
+        // a silent no-op would be worse than a loud refusal — name the actual status (D-05)
+        throw new Error(`task ${taskId} is ${status}, not a parked human gate — refusing (a silent no-op would be worse)`);
+    }
+    // OBS-18: only the most recent task-human for this task decides whether this approval grants a
+    // fresh attempt budget. Match the daemon's park reason literally (`attempt cap (N) reached`).
+    const lastHuman = journal.read().filter((e) => e.event === "task-human" && e.taskId === taskId).at(-1);
+    const capPark = typeof lastHuman?.data.reason === "string"
+        && /attempt cap \(\d+\) reached/.test(lastHuman.data.reason);
+    journal.append("task-approved", taskId, {
+        by,
+        ...(reason ? { reason } : {}),
+        via: "cli",
+        ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
+    });
+    return `approved ${taskId} in ${runId} — by ${by}; run \`drovr resume ${runId}\` to dispatch it`;
+}
+// hand-parsed argv — no CLI framework (house style). Flags --by <name> and --reason <text>; positionals
+// are runId then taskId. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
+function parseArgs(argv) {
+    const positionals = [];
+    let by;
+    let reason;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--by") {
+            by = argv[++i];
+            if (!by)
+                throw new Error("usage: drovr approve <run-id> <task-id> [--by <name>] [--reason <text>]");
+        }
+        else if (a === "--reason") {
+            reason = argv[++i];
+            if (!reason)
+                throw new Error("usage: drovr approve <run-id> <task-id> [--by <name>] [--reason <text>]");
+        }
+        else {
+            positionals.push(a);
+        }
+    }
+    const [runId, taskId] = positionals;
+    if (!runId || !taskId) {
+        throw new Error("usage: drovr approve <run-id> <task-id> [--by <name>] [--reason <text>]");
+    }
+    return { runId, taskId, by: by ?? userInfo().username, reason };
+}

package/dist/cli/commands/compile.d.ts

@@ -0,0 +1 @@
+export declare function compile(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/compile.js

@@ -0,0 +1,23 @@
+import { isAbsolute, join } from "node:path";
+import { parseArgs } from "node:util";
+import { compileSource } from "../../compile/index.js";
+import { saveGraph } from "../../graph/graph.js";
+import { isRunLockLive } from "../../run/lock.js";
+export async function compile(argv, cwd = process.cwd()) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: { type: { type: "string" } },
+        allowPositionals: true,
+    });
+    const src = positionals[0];
+    if (!src)
+        throw new Error("usage: drovr compile <spec-dir-or-md> [--type speckit|prd|gsd|native]");
+    // resolve against the target repo, not the process cwd (the CLI test passes a tmp repo)
+    const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd);
+    // HARD-01: a compile clobbering a running daemon's graph.json is the same last-write-wins race
+    // as a second daemon. Read-only check — compile never acquires/holds (it's instantaneous).
+    if (isRunLockLive(cwd))
+        throw new Error(".drovr/graph.lock is held by another drovr run, or is a stale/garbage lock — refusing to overwrite graph.json. If no run is active, run `drovr unlock`.");
+    saveGraph(cwd, g);
+    return `compiled ${src} → .drovr/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
+}

package/dist/cli/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+import type { WorkerAdapter } from "../../adapters/types.js";
+export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[]): Promise<string>;

package/dist/cli/commands/doctor.js

@@ -0,0 +1,103 @@
+import { allAdapters, probeAll, probeModels, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { modelLints, suggestOverlay } from "../../adapters/model-lints.js";
+import { loadConfig } from "../../config/config.js";
+import { HerdrDriver } from "../../drivers/herdr.js";
+import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
+export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters()) {
+    const cfg = loadConfig(cwd);
+    const health = await probeAll(adapters);
+    // MODEL-02: detect models where the adapter exposes a list surface, BEFORE writing doctor.json (write once, below).
+    // Fail OPEN — the inverse of gates' fail-closed: detection is advisory, so a broken list surface NEVER fails doctor.
+    for (const a of adapters) {
+        if (!a.listModels || !health[a.id].installed)
+            continue;
+        try {
+            health[a.id].models = await a.listModels();
+            // MODEL-05: prefer the source's own fetch time (codex's cache fetched_at) so the staleness lint
+            // measures real knowledge age, not run time. opencode reads its own offline cache too but exposes
+            // no fetch timestamp, so it still stamps now — its staleness lint is best-effort until it surfaces one.
+            if (health[a.id].models.length)
+                health[a.id].modelsDetectedAt = a.listModelsFetchedAt?.() ?? new Date().toISOString();
+        }
+        catch { /* fail open: leave models as-is, doctor stays healthy */ }
+    }
+    await probeModels(cfg, cwd, adapters, health);
+    writeDoctor(cwd, health);
+    const rows = adapters.map((a) => {
+        const h = health[a.id];
+        const state = !h.installed ? "not installed" : `${h.version ?? "installed"}${h.note ? ` (${h.note})` : ""}`;
+        return `  ${h.installed ? "✓" : "✗"} ${a.id.padEnd(14)} ${state}`;
+    });
+    rows.push(`  ${HerdrDriver.available() ? "✓" : "✗"} herdr          ${HerdrDriver.available() ? "driver available (HERDR_ENV=1)" : "not detected — subprocess driver will be used"}`);
+    // v1.22 T5: workspace-trust pre-flight — per installed adapter: trusted | seeded | action-required | n/a.
+    // action-required names the exact one-time command (or dialog) the operator must run once.
+    rows.push("workspace trust:");
+    for (const a of adapters) {
+        if (!health[a.id]?.installed)
+            continue;
+        if (!a.trust) {
+            rows.push(`  = ${a.id.padEnd(14)} trust: n/a`);
+            continue;
+        }
+        try {
+            const v = a.trust(cwd);
+            if (v.status === "trusted")
+                rows.push(`  ✓ ${a.id.padEnd(14)} trust: trusted`);
+            else if (v.status === "seeded")
+                rows.push(`  ✓ ${a.id.padEnd(14)} trust: seeded`);
+            else
+                rows.push(`  ! ${a.id.padEnd(14)} trust: action-required — run ONCE: ${v.command}`);
+        }
+        catch (e) {
+            // fail closed on the trust line only — never abort the rest of doctor
+            rows.push(`  ! ${a.id.padEnd(14)} trust: action-required — run ONCE: (trust check failed: ${e instanceof Error ? e.message : String(e)})`);
+        }
+    }
+    for (const [role, sel] of [["judge", cfg.judge], ["consult", cfg.consult]]) {
+        if (!health[sel.adapter]?.installed) {
+            rows.push(`  ! ${role} runs on ${sel.adapter}:${sel.model} — NOT installed; that gate will fail closed until you install it or remap cfg.${role}`);
+        }
+    }
+    rows.push(...modelLints(cfg, health, adapters).map((l) => `  ! ${l}`));
+    const excluded = excludedChannels(cfg, adapters, health);
+    if (excluded.length)
+        rows.push(`  ! ${exclusionLine(excluded)}`);
+    // HYG-07(a): doctor just probed fresh (probeAll above), so servability attribution is current by construction.
+    const servable = servableExclusions(cfg, adapters, health);
+    if (servable.length)
+        rows.push(`  ! ${servabilityLine(servable)}`);
+    // MODEL-05/06: print-only drift fragment; advisory, whole-line-commented additions, drovr NEVER applies it.
+    const frag = suggestOverlay(cfg, health, adapters);
+    const drift = frag ? `\nmodel drift — paste-ready overlay (advisory; drovr never applies):\n${frag}` : "";
+    // T4: model-status table — one row per CLASSIFIED model (tiers config) with tier, auth verdict
+    // (reason + date when unauthed), operator-deny flag, and prefer rank across the routing map.
+    // Unclassified listed models (detected via listModels but never tiered) compress to one count line
+    // per adapter — they aren't routable, so they don't earn table rows.
+    const trunc = (s, n) => (s.length <= n ? s : `${s.slice(0, n - 1)}…`);
+    const dateOf = (iso) => iso.slice(0, 10);
+    const modelStatus = adapters.flatMap((a) => {
+        const h = health[a.id];
+        if (!h?.installed)
+            return [];
+        const classified = cfg.tiers[a.id]?.models ?? {};
+        const models = Object.keys(classified);
+        const unclassified = (h.models ?? []).filter((m) => !(m in classified));
+        if (!models.length && !unclassified.length)
+            return [];
+        const w = Math.max(8, ...models.map((m) => m.length));
+        const rows = [`  ${a.id}`];
+        for (const m of models) {
+            const v = h.modelAuth?.[m];
+            const auth = !v ? "unknown" : v.authed ? "authed" : `unauthed: ${trunc(v.reason ?? "probe failed", 40)} (${dateOf(v.probedAt)})`;
+            const d = disallowedBy({ adapter: a.id, model: m }, cfg.routing);
+            const denied = d?.by === "deny" ? d.entry : "—";
+            const pref = preferRanks({ adapter: a.id, model: m }, cfg).map((p) => `${p.shape}#${p.rank}`).join(",") || "—";
+            rows.push(`    ${m.padEnd(w)} ${classified[m].padEnd(8)} ${auth}  denied=${denied}  prefer=${pref}`);
+        }
+        if (unclassified.length)
+            rows.push(`    (${unclassified.length} more listed, unclassified)`);
+        return rows;
+    });
+    const modelSummary = modelStatus.length ? `\nmodel status:\n${modelStatus.join("\n")}` : "";
+    return `drovr doctor — capability matrix:\n${rows.join("\n")}${modelSummary}${drift}\nwrote .drovr/doctor.json`;
+}

package/dist/cli/commands/init.d.ts

@@ -0,0 +1 @@
+export declare function init(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/init.js

@@ -0,0 +1,32 @@
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { configTemplate, globalConfigDir } from "../../config/config.js";
+import { specTemplate } from "../../compile/native.js";
+import { drovrDir } from "../../graph/graph.js";
+import { doctor } from "./doctor.js";
+export async function init(argv, cwd = process.cwd()) {
+    const { values } = parseArgs({ args: argv, options: { "global-dir": { type: "string" } } });
+    const gdir = values["global-dir"] ?? globalConfigDir();
+    mkdirSync(gdir, { recursive: true });
+    const notes = [];
+    for (const p of [join(gdir, "config.yaml"), join(drovrDir(cwd), "config.yaml")]) {
+        if (!existsSync(p)) {
+            writeFileSync(p, configTemplate());
+            notes.push(`wrote ${p}`);
+        }
+        else {
+            notes.push(`kept existing ${p}`);
+        }
+    }
+    const specPath = join(cwd, "drovr.spec.md");
+    if (!existsSync(specPath)) {
+        writeFileSync(specPath, specTemplate());
+        notes.push(`wrote ${specPath}`);
+    }
+    else {
+        notes.push(`kept existing ${specPath}`);
+    }
+    const doc = await doctor([], cwd);
+    return `${notes.join("\n")}\n${doc}\nnext: edit drovr.spec.md, then drovr compile drovr.spec.md && drovr plan && drovr run`;
+}

package/dist/cli/commands/plan.d.ts

@@ -0,0 +1,2 @@
+import type { WorkerAdapter } from "../../adapters/types.js";
+export declare function plan(_argv: string[], cwd?: string, adapters?: WorkerAdapter[]): Promise<string>;