tickmarkr 1.38.0 → 1.41.0

package/README.md

@@ -6,12 +6,16 @@
 
 tickmarkr is a spec-driven orchestration harness for AI coding agent CLIs. You write a spec with
 acceptance criteria; the engine routes tasks to the best installed agent CLI (claude-code, codex,
-cursor-agent, opencode, grok, pi) by cost and capability, dispatches work in isolated git worktrees
-— as interactive TUIs when running under [herdr](https://herdr.dev), headless subprocesses otherwise
-— and independently verifies every result before merge. Green tasks consolidate onto a
+cursor-agent, opencode, grok, pi) by cost and capability, dispatches work in git worktrees for
+change isolation — as interactive TUIs when running under [herdr](https://herdr.dev), headless
+subprocesses otherwise — and independently verifies each committed result by checking for no new
+baseline failures per task, then strictly verifying the integration tip. Green tasks consolidate onto a
 `tickmarkr/<runId>` branch; merging to your mainline is always your call, never automated. Engage
 with full visibility into routing decisions, worker progress, and gate verdicts — or run headless
-and review the audit trail afterward.
+and review the local execution log afterward.
+
+Here, **isolated git worktrees** means change isolation: each task gets its own worktree and branch
+so its diff is separated from sibling tasks. It is not a process sandbox or host-containment boundary.
 
 ## Invariants
 
@@ -19,7 +23,8 @@ These are law; the codebase fails closed around them:
 
 - `acceptance[]` required on every task; compile fails without it
 - new engagements consolidate to a `tickmarkr/<runId>` branch — never main
-- gates never trust worker claims; tickmarkr verifies everything itself
+- gates never trust worker claims; each task is checked for no new baseline failures and the merged
+  integration tip is strictly re-verified
 - state is files + git only; no DB, no services
 - worker/judge/review/consult prompts end with machine-parseable trailers
   (structured JSON verdicts); parse defensively, fail closed
@@ -68,7 +73,8 @@ tickmarkr report <runId> --md  # engagement record in Markdown
 
 That's the flow: `init` scaffolds config, you write tasks with `acceptance[]` criteria, `compile`
 validates and builds the graph, `plan` shows routing decisions and cost, `run` dispatches work to
-installed CLIs and independently verifies every result, and `report` documents the outcome. All
+installed CLIs and checks each task for no new baseline failures before strictly verifying the
+integration tip, and `report` documents the outcome. All
 green tasks land on `tickmarkr/<runId>` — merge to your mainline is your decision.
 
 ## Agent-ready repos: `tickmarkr init --agent`
@@ -98,7 +104,7 @@ Consent rules — every write is additive, never destructive:
 
 ```bash
 tickmarkr status               # engagement state (--watch to follow live)
-tickmarkr resume <runId>       # continue an engagement from the audit trail
+tickmarkr resume <runId>       # continue an engagement from the local execution log
 tickmarkr approve <runId> <taskId>   # approve a parked task (--reason to document)
 tickmarkr report <runId>       # cost/quality report
 tickmarkr profile              # show the learned routing profile
@@ -160,11 +166,11 @@ routing:
 ```
 `tickmarkr plan` lints denied models identically to unauthed ones. Re-enable by deleting one line.
 
-## Run output and audit trail
+## Run output and local execution log
 
-When you execute `tickmarkr run`, the daemon records every event in an append-only ledger (the audit trail):
+When you execute `tickmarkr run`, the daemon records every event in an append-only local journal:
 task dispatch, gate verdicts, worker status, and merges. Narration streams to stdout; you can also
-`--watch` or tail the ledger directly. If interrupted, `tickmarkr resume <runId>` replays the ledger
+`--watch` or tail the journal directly. If interrupted, `tickmarkr resume <runId>` replays the journal
 and continues from the last stable state — deterministic, not ephemeral.
 
 ## Usage and cost
@@ -193,7 +199,7 @@ and first-attempt success rate. Cost reporting follows strict honesty rules and
 - **Basis always shown**: every cost figure prints the token count, rate used, and date so estimates can be audited
 - **No network calls**: pricing config is operator-maintained locally, seeded with dated
   comments and LiteLLM's JSON file named as the copy-from source; tickmarkr never calls home to fetch rates
-- **Attribution from journal**: token counts come from tickmarkr's own telemetry spans in the audit trail, never from provider invoices or dashboards
+- **Attribution from journal**: token counts come from tickmarkr's own telemetry spans in the local journal, never from provider invoices or dashboards
 
 ## Visibility: optional supervised workspace
 
@@ -248,7 +254,7 @@ Every pane and tab tickmarkr creates receives a **parseable ownership name** enc
 
 tickmarkr creates all owned panes only within the run's workspace; any tickmarkr-owned panes discovered outside the run's workspace (from prior runs or placement bugs) are reconciled and closed. Any pane not matching the ownership contract is **foreign** — created by you or another tool — and is never closed automatically.
 
-**Desired-state reconciliation**: A pure function computes the exact set of panes that should exist from the audit trail at any moment:
+**Desired-state reconciliation**: A pure function computes the exact set of panes that should exist from the local journal at any moment:
 - Worker panes for all in-flight task attempts
 - Gate panes for unread judge/review/consult verdicts
 - The watch pane (if running)
@@ -264,11 +270,11 @@ Reconciliation failures (herdr unavailable, a pane vanished mid-sweep) never fai
 
 ### Workspace trust
 
-tickmarkr runs work in fresh git worktrees cloned from your repo. Before dispatch, workers check
-whether the repo is trusted by their CLI:
+tickmarkr creates fresh git worktrees for change isolation. That is separate from each CLI's own
+workspace-trust behavior:
 
-- `tickmarkr doctor` probes each CLI's trust status and auto-seeds trust where possible
-- Some CLIs show a "Workspace Trust" dialog; tickmarkr detects and auto-answers it once per task
+- `tickmarkr doctor` invokes each installed adapter's trust hook where supported and seeds trust where possible
+- Some CLIs show a "Workspace Trust" dialog; tickmarkr auto-answers only a recognized fingerprint once per slot
 - Other blocked dialogs page you for manual approval
 
 ## Spec formats
@@ -293,8 +299,9 @@ Every task requires explicit `acceptance[]` criteria; compile fails without them
 - **`test <name>`** — run a named test from your suite (must exist)
 - **`judge <rubric>`** — LLM verdict against your rubric; fail-closed, never overrides failed command/test
 
-At runtime, the **scope gate** verifies that workers only touched files declared in the spec. If a
-worker must change out-of-scope paths, the task pauses as a human gate — your approval is required.
+At runtime, the **scope gate** derives `git diff --name-only` from the task base and compares it with
+the spec-declared files. Out-of-scope edits fail unless the operator config explicitly allowlists
+them; worker-declared deviations are recorded as notes, not authority.
 
 ## Claude Code integration
 

package/dist/adapters/fake.js

@@ -14,7 +14,13 @@ export class FakeAdapter {
         this.script = JSON.parse(readFileSync(scriptPath, "utf8"));
     }
     async probe() {
-        return { installed: true, authed: true, version: "fake", models: ["fake-1", "fake-2"] };
+        return {
+            installed: true, authed: true, version: "fake", models: ["fake-1", "fake-2"],
+            modelAuth: {
+                "fake-1": { authed: true, probedAt: "1970-01-01T00:00:00.000Z" },
+                "fake-2": { authed: true, probedAt: "1970-01-01T00:00:00.000Z" },
+            },
+        };
     }
     channels(_cfg) {
         return [
@@ -27,9 +33,11 @@ export class FakeAdapter {
         // Phase 47 (GATE-09): detect role at COMMAND-BUILD time. runHeadless/runViaDriver write the prompt
         // file BEFORE calling headlessCommand, so it exists here. The counter advances ONLY when the prompt
         // contains TICKMARKR-JUDGE — a review/consult prompt never touches it (research Pitfall 3).
+        let prompt = "";
         let isJudge = false;
         try {
-            isJudge = /TICKMARKR-JUDGE/.test(readFileSync(promptFile, "utf8"));
+            prompt = readFileSync(promptFile, "utf8");
+            isJudge = /TICKMARKR-JUDGE/.test(prompt);
         }
         catch {
             // unreadable promptFile: can't detect role; serve static values (legacy headless-call behavior)
@@ -41,6 +49,14 @@ export class FakeAdapter {
                 val = val[Math.min(this.judgeIdx, val.length - 1)];
                 this.judgeIdx++;
             }
+            if (key === "judge" && isJudge && val && typeof val === "object" && !Array.isArray(val)) {
+                const verdict = val;
+                if (verdict.pass === true && Array.isArray(verdict.criteria) && verdict.criteria.length === 0) {
+                    const items = prompt.match(/## Acceptance criteria \(judge\)\n([\s\S]*?)\n\n## Diff/)?.[1]
+                        .split("\n").filter((line) => line.startsWith("- ")).map((line) => line.slice(2)) ?? [];
+                    val = { ...verdict, criteria: items.map((criterion) => ({ criterion, met: true, reason: "scripted fake pass" })) };
+                }
+            }
             const p = join(dirname(this.scriptPath), `${key}.json`);
             writeFileSync(p, JSON.stringify(val ?? {}, null, 1));
             return p;
@@ -59,14 +75,16 @@ export class FakeAdapter {
         // SPEND-01: synthetic usage as a TIMESTAMPED disk record the fake's own reader picks up post-hoc —
         // never a trailer, never pane text. node stamps a real ms-precision ISO time (bash 3.2 on darwin has
         // no ms clock) so the record lands at/after this attempt's dispatch and clears the sinceMs cursor.
-        // Written AFTER the step's `git add`/commit ⇒ stays untracked ⇒ invisible to the scope/evidence gates.
+        // Written BEFORE the trailer echo (same order real CLIs use: session-store rows land during work,
+        // completion marker last) so an interactive harvest on the trailer never races the usage writer.
+        // Still after the step's `git add`/commit ⇒ stays untracked ⇒ invisible to scope/evidence gates.
         const usageWrite = step.usage
             ? `; node -e ${shq(`require("fs").writeFileSync(".tickmarkr-usage.json", JSON.stringify({timestamp:new Date().toISOString(), usage:${JSON.stringify(step.usage)}}))`)}`
             : "";
         const base = !step.result
             ? `bash -c ${shq(step.shell)}` // no trailer: scripted stall/quota
-            : `bash -c ${shq(step.shell)}; echo ${shq(`TICKMARKR_RESULT_${nonce} ` + JSON.stringify({ deviations: [], ...step.result }))}`;
-        return base + usageWrite;
+            : `bash -c ${shq(step.shell)}${usageWrite}; echo ${shq(`TICKMARKR_RESULT_${nonce} ` + JSON.stringify({ deviations: [], ...step.result }))}`;
+        return base;
     }
     // SPEND-01: read the cwd-keyed usage record from DISK (never a pane), honoring the attempt cursor.
     // A record stamped before sinceMs, an unparseable stamp, or a bad usage shape all fail OPEN to

package/dist/adapters/registry.js

@@ -202,10 +202,10 @@ export function discoverChannels(cfg, adapters, health) {
         .flatMap((a) => {
         const h = health[a.id];
         const s = h?.servable;
-        // T2 (2026-07-13): a model doctor marked unauthed (modelAuth[model].authed===false) advertises NO
-        // channel — routing a 403 into dispatch was the v1.10 regression. modelAuthed is true when no verdict
-        // is recorded (absent modelAuth ⇒ unknown ⇒ routable), so an all-authed/pre-v1.5 fleet is byte-identical.
-        return a.channels(cfg).filter((c) => modelAuthed(h, c.model) && (!s || s.includes(c.model)));
+        // T2 (2026-07-13): only a model doctor marked authed (modelAuth[model].authed===true) advertises a
+        // channel — routing an unknown or 403 into dispatch is fail-closed. Operators with pre-v1.21 doctor.json
+        // can opt into the prior unknown-is-routable behavior with routing.allowUnverifiedModels.
+        return a.channels(cfg).filter((c) => modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)));
     });
     if (!cfg.routing.allow && !cfg.routing.deny)
         return base;
@@ -233,23 +233,23 @@ export function servabilityLine(excluded) {
     const parts = excluded.map(({ key, adapter }) => `${key} (not in ${adapter}'s served model list)`);
     return `servability: ${excluded.length} channel(s) unservable — ${parts.join(", ")}`;
 }
-// T2 (2026-07-13): channels discoverChannels dropped because doctor marked their model unauthed
-// (modelAuth[model].authed===false). Computed from the SAME inputs as the drop (a.channels(cfg)) so
-// attribution can never drift from behavior. installed+authed mirrors the discoverChannels adapter gate;
-// a missing modelAuth record ⇒ unknown ⇒ NOT excluded (compat with pre-v1.5 doctor.json + probeAll fallback).
+// T2 (2026-07-13): channels discoverChannels dropped because doctor marked their model unauthed or left it
+// unverified. Computed from the SAME inputs as the drop (a.channels(cfg)) so attribution can never drift from
+// behavior. installed+authed mirrors the discoverChannels adapter gate.
 export function modelAuthExclusions(cfg, adapters, health) {
     const out = [];
     for (const a of adapters) {
         const h = health[a.id];
         if (!h?.installed || !h?.authed)
             continue;
-        const verdicts = h.modelAuth;
-        if (!verdicts)
-            continue;
         for (const c of a.channels(cfg)) {
-            const v = verdicts[c.model];
+            const v = h.modelAuth?.[c.model];
+            if (modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels))
+                continue;
             if (v?.authed === false)
                 out.push({ key: channelKey(c), adapter: a.id, reason: v.reason ?? "probe failed", probedAt: v.probedAt });
+            else
+                out.push({ key: channelKey(c), adapter: a.id, reason: "no model auth verdict — run tickmarkr doctor", probedAt: "not recorded" });
         }
     }
     return out;

package/dist/adapters/types.d.ts

@@ -38,7 +38,7 @@ export interface AuthHealth {
     servable?: string[];
     modelAuth?: Record<string, ModelAuth>;
 }
-export declare function modelAuthed(health: AuthHealth | undefined, model: string): boolean;
+export declare function modelAuthed(health: AuthHealth | undefined, model: string, allowUnverifiedModels?: boolean): boolean;
 export interface Invocation {
     command: string;
 }

package/dist/adapters/types.js

@@ -23,8 +23,9 @@ export function addUsage(a, b) {
         reasoning: add(a.reasoning, b.reasoning),
     };
 }
-export function modelAuthed(health, model) {
-    return health?.modelAuth?.[model]?.authed !== false;
+export function modelAuthed(health, model, allowUnverifiedModels = false) {
+    const authed = health?.modelAuth?.[model]?.authed;
+    return authed === true || (authed === undefined && allowUnverifiedModels);
 }
 export function matchesTrustDialog(paneText, dialog) {
     return paneText.includes(dialog.fingerprint);

package/dist/cli/commands/init.js

@@ -13,18 +13,51 @@ const DOCS_END = "<!-- tickmarkr:agent-docs end -->";
 const AGENT_DOCS = `${DOCS_BEGIN}
 ## tickmarkr
 
-tickmarkr turns repository specs into isolated, independently verified agent work. Use \`/tickmarkr-loop\` for one spec or \`/tickmarkr-auto\` for several.
+tickmarkr compiles repository specs into isolated, independently verified agent work.
 
-Loop: \`tickmarkr compile <spec>\` → \`tickmarkr plan\` → \`tickmarkr run\` → \`tickmarkr report <runId> --md\`.
+### Invariants
 
 - Never run two tickmarkr runs in the same repository concurrently.
-- Never merge tickmarkr work directly to main; new runs consolidate on \`tickmarkr/<runId>\`.
-- Fix source specs instead of editing generated graphs.
-- Never trust a worker's completion claim; gates independently verify the work.
-- Treat missing or unparseable results as failures.
+- Never let tickmarkr merge work to main; new runs consolidate on \`tickmarkr/<runId>\`.
+- Do not edit compiled graphs to force outcomes; fix source specs and recompile.
+- Gates verify commits, diffs, acceptance criteria, and reviews independently — never trust a worker's completion claim.
+- Treat missing or unparseable machine results and verdicts as failures.
+
+### Commands
+
+- \`tickmarkr compile <spec>\` — spec → RunGraph
+- \`tickmarkr plan\` — routing table and human gates
+- \`tickmarkr run\` — execute the graph
+- \`tickmarkr status <runId>\` — run progress
+- \`tickmarkr resume <runId>\` — continue a paused or failed run
+- \`tickmarkr approve <runId> <taskId>\` — release a human gate
+- \`tickmarkr report <runId> --md\` — execution record beside the spec
+
+Loop: compile → plan → run → report. Watch the journal for run-end rather than polling workers.
+
+### Role check (multi-agent environments)
+
+- **Orchestrator:** run the loop in your session; do not start a second run.
+- **Supervisor with a live orchestrator:** relay the mission via verified handoff (below), then supervise — do not duplicate the loop.
+- **Primary session without an orchestrator:** spawn one child orchestration session, give it the mission and these rules, then supervise.
+
+Outside multi-agent environments, run the loop directly.
+
+### Version preflight
+
+Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and if the binary is older on major.minor, stop and tell the operator to update. Never proceed on hope — stale binaries silently skip daemon gates.
+
+### Tip-verify-before-green
+
+A run is green only when the run-end event exists in the journal AND tip verify is not "failed". Never report green to the operator, tab titles, or records until both hold.
+
+### Verified handoffs
+
+When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the target pane afterward; never report "relayed" without read-back.
 ${DOCS_END}
 `;
-const skillPath = (cwd, skill) => join(cwd, ".claude", "skills", skill, "SKILL.md");
+const skillsRoot = (cwd) => existsSync(join(cwd, ".claude", "skills")) ? join(cwd, ".claude", "skills") : join(cwd, ".agents", "skills");
+const skillPath = (cwd, skill) => join(skillsRoot(cwd), skill, "SKILL.md");
 const skillsInstalled = (cwd) => AGENT_SKILLS.every((s) => existsSync(skillPath(cwd, s)));
 const wizardDriverDefault = () => process.env.HERDR_ENV === "1" ? "herdr" : "auto";
 async function installAgentFiles(cwd, force, docs, notes) {
@@ -44,7 +77,7 @@ async function installAgentFiles(cwd, force, docs, notes) {
                 notes.push(`skipped existing ${dest}; pass --force to overwrite it`);
                 continue;
             }
-            mkdirSync(join(cwd, ".claude", "skills", skill), { recursive: true });
+            mkdirSync(join(skillsRoot(cwd), skill), { recursive: true });
             writeFileSync(dest, readFileSync(new URL(`../../../skills/${skill}/SKILL.md`, import.meta.url)), exists ? undefined : { flag: "wx" });
             notes.push(`${exists ? "overwrote" : "wrote"} ${dest}`);
         }
@@ -95,8 +128,8 @@ async function runInitWizard(cwd) {
         const llm = llmRaw === "pane" || llmRaw === "headless" ? llmRaw : llmDef;
         let installSkills = false;
         if (!skillsInstalled(cwd)) {
-            const skillsDef = existsSync(join(cwd, ".claude")) && !skillsInstalled(cwd);
-            installSkills = await askYesNo(rl, "Install agent skills (tickmarkr-loop/tickmarkr-auto) into .claude/skills?", skillsDef);
+            const skillsDef = existsSync(join(cwd, ".claude", "skills")) && !skillsInstalled(cwd);
+            installSkills = await askYesNo(rl, "Install agent skills (tickmarkr-loop/tickmarkr-auto)?", skillsDef);
         }
         return { overlay: { driver, concurrency, visibility: { llm } }, installSkills };
     }

package/dist/cli/commands/plan.js

@@ -5,7 +5,15 @@ import { loadConfig } from "../../config/config.js";
 import { loadGraph } from "../../graph/graph.js";
 import { excludedChannels, exclusionLine } from "../../route/preference.js";
 import { route, RoutingError } from "../../route/router.js";
+import { modelId } from "../../gates/review.js";
 import { loadRoutingProfile } from "../../run/journal.js";
+const fleetCanCrossVendorReview = (channels) => {
+    for (let i = 0; i < channels.length; i++)
+        for (let j = 0; j < channels.length; j++)
+            if (i !== j && channels[i].vendor !== channels[j].vendor && modelId(channels[i].model) !== modelId(channels[j].model))
+                return true;
+    return false;
+};
 export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters()) {
     // ponytail: hardcoded 24h TTL — promote to config when an operator asks. mtime is the signal because
     // doctor.json has no probe timestamp and a schema field would break the existing-files compat invariant.
@@ -59,6 +67,9 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
             lints.push(`${role}: ${sel.adapter}:${sel.model} not installed — that gate/consult will fail closed`);
     }
     lints.push(...modelLints(cfg, health, adapters, { tty: ttyVisual() })); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
+    if (cfg.review.required && channels.length && !fleetCanCrossVendorReview(channels)) {
+        lints.push("review: no cross-vendor reviewer pair in fleet — set review.required: false to waive");
+    }
     let cost = 0;
     for (const t of g.tasks) {
         try {
@@ -69,7 +80,7 @@ export async function plan(_argv, cwd = process.cwd(), adapters = allAdapters())
             }
             const est = r.assignment.channel === "sub" ? 0 : cfg.pricing[r.assignment.tier];
             cost += est;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`);
             if (r.deviation) {
                 deviations++;
                 const d = r.deviation;

package/dist/cli/commands/resume.d.ts

@@ -1 +1,4 @@
-export declare function resume(argv: string[], cwd?: string): Promise<string>;
+export declare function resume(argv: string[], cwd?: string): Promise<{
+    out: string;
+    code: number;
+}>;

package/dist/cli/commands/resume.js

@@ -2,10 +2,13 @@ import { loadConfig } from "../../config/config.js";
 import { pickDriver } from "../../drivers/index.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { formatJournalNarration } from "../../run/journal.js";
+const summaryGreen = (s) => s.failed.length === 0 && s.human.length === 0 && s.blocked.length === 0 && s.pending.length === 0
+    && s.tipVerify !== "failed";
 export async function resume(argv, cwd = process.cwd()) {
     const runId = argv[0];
     if (!runId)
         throw new Error("usage: tickmarkr resume <run-id>");
     const s = await runDaemon(cwd, { runId, resume: true, driver: pickDriver(loadConfig(cwd)), narrate: (event) => console.log(formatJournalNarration(event)) });
-    return `resumed ${s.runId} — ${formatSummary(s)}`;
+    const out = `resumed ${s.runId} — ${formatSummary(s)}`;
+    return { out, code: summaryGreen(s) ? 0 : 2 };
 }

package/dist/cli/commands/run.d.ts

@@ -1 +1,4 @@
-export declare function run(argv: string[], cwd?: string): Promise<string>;
+export declare function run(argv: string[], cwd?: string): Promise<{
+    out: string;
+    code: number;
+}>;

package/dist/cli/commands/run.js

@@ -6,6 +6,8 @@ import { loadGraph } from "../../graph/graph.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { route } from "../../route/router.js";
 import { formatJournalNarration, loadRoutingProfile } from "../../run/journal.js";
+const summaryGreen = (s) => s.failed.length === 0 && s.human.length === 0 && s.blocked.length === 0 && s.pending.length === 0
+    && s.tipVerify !== "failed";
 export async function run(argv, cwd = process.cwd()) {
     const { values } = parseArgs({
         args: argv,
@@ -15,6 +17,11 @@ export async function run(argv, cwd = process.cwd()) {
             "route-strict": { type: "boolean" },
         },
     });
+    if (values.concurrency !== undefined) {
+        const n = Number(values.concurrency);
+        if (!Number.isInteger(n) || n <= 0)
+            throw new Error(`--concurrency must be a positive integer (got ${values.concurrency})`);
+    }
     const cfg = loadConfig(cwd);
     if (values["route-strict"]) {
         const adapters = allAdapters();
@@ -31,5 +38,6 @@ export async function run(argv, cwd = process.cwd()) {
         driver: pickDriver(cfg, values.driver),
         narrate: (event) => console.log(formatJournalNarration(event)),
     });
-    return `run ${s.runId} finished — ${formatSummary(s)} (merge to main is a human decision)`;
+    const out = `run ${s.runId} finished — ${formatSummary(s)} (merge to main is a human decision)`;
+    return { out, code: summaryGreen(s) ? 0 : 2 };
 }

package/dist/cli/commands/version.d.ts

@@ -0,0 +1 @@
+export declare function version(_argv?: string[]): Promise<string>;

package/dist/cli/commands/version.js

@@ -0,0 +1,8 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "../../../package.json");
+export async function version(_argv = []) {
+    const { version: v } = JSON.parse(readFileSync(pkgPath, "utf8"));
+    return v;
+}

package/dist/cli/index.d.ts

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
-export type CommandMap = Record<string, (argv: string[]) => Promise<string>>;
+export type CommandResult = string | {
+    out: string;
+    code: number;
+};
+export type CommandMap = Record<string, (argv: string[]) => Promise<CommandResult>>;
 export declare const COMMANDS: CommandMap;
 export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> draft a compiled native spec beside an answered intent (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  run           execute the graph (--concurrency N --driver herdr|subprocess --route-strict)\n  status        live run state\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md for committable execution record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  approve <id> <task>  approve a parked human gate (--by <name> --reason <text>); takes effect on resume";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{

package/dist/cli/index.js

@@ -13,9 +13,12 @@ import { run } from "./commands/run.js";
 import { scope } from "./commands/scope.js";
 import { status } from "./commands/status.js";
 import { unlock } from "./commands/unlock.js";
+import { version } from "./commands/version.js";
+const normalize = (r) => typeof r === "string" ? { out: r, code: 0 } : r;
 export const COMMANDS = {
-    init, doctor, compile, scope, plan, run, status, resume, report, profile, unlock, approve,
+    init, doctor, compile, scope, plan, run, status, resume, report, profile, unlock, approve, version,
 };
+const VERSION_FLAGS = new Set(["version", "--version", "-v"]);
 const HELP_CMDS = new Set(["help", "-h", "--help"]);
 import { BANNER } from "../brand.js";
 export const USAGE = `tickmarkr — spec-driven orchestration harness for AI coding agents
@@ -36,6 +39,8 @@ usage: tickmarkr <command>
 // unknown/missing cmd → USAGE (exit 1 if a cmd was typed, 0 for bare `tickmarkr`); a handler throw becomes
 // a one-line `tickmarkr <cmd>: <message>` (never a raw stack) at exit 1.
 export async function dispatch(cmd, argv, commands = COMMANDS) {
+    if (cmd && VERSION_FLAGS.has(cmd))
+        return { out: await version(argv), code: 0 };
     const usage = process.stdout.isTTY ? BANNER + USAGE : USAGE;
     if (!cmd || HELP_CMDS.has(cmd))
         return { out: usage, code: 0 };
@@ -43,7 +48,7 @@ export async function dispatch(cmd, argv, commands = COMMANDS) {
     if (!fn)
         return { out: usage, code: 1 };
     try {
-        return { out: await fn(argv), code: 0 };
+        return normalize(await fn(argv));
     }
     catch (err) {
         return { out: `tickmarkr ${cmd}: ${err.message}`, code: 1 };
@@ -62,7 +67,7 @@ if (argv1Real && import.meta.url === pathToFileURL(argv1Real).href) {
     const [cmd, ...argv] = process.argv.slice(2);
     dispatch(cmd, argv).then(({ out, code }) => {
         // byte-identical streams: usage + success → stdout; a handler throw → stderr (original behavior)
-        (out.endsWith(USAGE) || code === 0 ? console.log : console.error)(out);
+        (code === 1 && !out.endsWith(USAGE) ? console.error : console.log)(out);
         if (code !== 0)
             process.exit(code);
     });

package/dist/compile/native.js

@@ -10,7 +10,7 @@ const NESTED_RE = /^\s+- (.+)$/;
 // v1.19: a typed acceptance oracle line — "command: ...", "test: ...", or "judge: ...". Anything
 // without one of these prefixes is a plain-string judge criterion (compat path, emits a warning).
 const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*(.*)$`);
-const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance"]);
+const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout"]);
 function invalid(task, field, detail) {
     throw new CompileError(`Task ${task} field "${field}" ${detail}`);
 }
@@ -110,6 +110,10 @@ export function compileNative(file) {
         const badGate = draft.gates.find((gate) => !GATE_NAMES.includes(gate));
         if (badGate)
             invalid(draft.id, "gates", `contains invalid gate "${badGate}"`);
+        const timeoutMinutes = fields.timeout === undefined ? undefined : Number(fields.timeout);
+        if (fields.timeout !== undefined && (!Number.isFinite(timeoutMinutes) || timeoutMinutes <= 0)) {
+            invalid(draft.id, "timeout", "must be a positive number");
+        }
         const routingHints = pin || fields.floor ? {
             ...(pin ? { pin: { via: pin[0], model: pin[1] } } : {}),
             ...(fields.floor ? { floor: fields.floor } : {}),
@@ -125,6 +129,7 @@ export function compileNative(file) {
             context: csv(fields.context),
             acceptance: draft.acceptance,
             ...(fields.humangate === "true" ? { humanGate: true } : {}),
+            ...(timeoutMinutes !== undefined ? { timeoutMinutes } : {}),
             ...(routingHints ? { routingHints } : {}),
             ...(draft.hasGates ? { gates: draft.gates } : {}),
         };
@@ -166,7 +171,8 @@ acceptance is required on every task (a nested list of observable outcomes).
     humanGate:   true | false — pauses for a human review before merging this task
     pin:         "via model" — pin an exact channel, e.g. "claude-code opus"
     floor:       cheap | mid | frontier — minimum capability tier for routing
-    gates:       nested list, any of build | test | lint | evidence | scope | acceptance | review
+    gates:       nested list; build | test | lint | evidence | scope are mandatory;
+                 acceptance | review may be omitted
     acceptance:  nested list (REQUIRED, non-empty). Each item is either a typed oracle or plain text:
                  - command: <shell>   (oracle: command — exit code)
                  - test: <name>       (oracle: test — named test)

package/dist/config/config.d.ts

@@ -6,6 +6,7 @@ declare const TierEnum: z.ZodEnum<{
 }>;
 export type Tier = z.infer<typeof TierEnum>;
 export declare const TIER_RANK: Record<Tier, number>;
+export declare const DEFAULT_DIFF_CAP = 60000;
 export declare const MapEntrySchema: z.ZodObject<{
     pin: z.ZodOptional<z.ZodObject<{
         via: z.ZodString;
@@ -84,6 +85,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
             halfLifeRuns: z.ZodOptional<z.ZodNumber>;
             availWeight: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;
+        allowUnverifiedModels: z.ZodBoolean;
         allow: z.ZodOptional<z.ZodObject<{
             adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
             models: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -123,6 +125,7 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         build: z.ZodOptional<z.ZodString>;
         test: z.ZodOptional<z.ZodString>;
         lint: z.ZodOptional<z.ZodString>;
+        diffCap: z.ZodOptional<z.ZodNumber>;
         byShape: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             plan: "plan";
             spec: "spec";

package/dist/config/config.js

@@ -9,6 +9,7 @@ const TierEnum = z.enum(TIERS, {
     error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
 });
 export const TIER_RANK = { cheap: 0, mid: 1, frontier: 2 };
+export const DEFAULT_DIFF_CAP = 60_000;
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
     tier: TierEnum.optional(),
@@ -86,6 +87,8 @@ export const TickmarkrConfigSchema = z.object({
             halfLifeRuns: z.number().positive().optional(),
             availWeight: z.number().nonnegative().optional(),
         }).optional(),
+        // Pre-v1.21 doctor.json lacks per-model verdicts. Keep legacy unknown-is-routable behavior opt-in.
+        allowUnverifiedModels: z.boolean(),
         allow: PrefBlockSchema.optional(),
         deny: PrefBlockSchema.optional(),
     }),
@@ -105,6 +108,7 @@ export const TickmarkrConfigSchema = z.object({
         build: z.string(),
         test: z.string(),
         lint: z.string(),
+        diffCap: z.number().int().positive(),
         byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
     }).partial(),
     scope: z.object({
@@ -160,6 +164,7 @@ export const DEFAULT_CONFIG = {
         // a workspace that has accumulated ≥MIN_SAMPLES warm telemetry per cell. Preview any workspace's effect
         // first with `tickmarkr plan` / `tickmarkr report`; flip to "off" to pin exact static routing (the kill switch stands).
         learned: "on",
+        allowUnverifiedModels: false,
     },
     // Seed table (spec §13). New models = edit this (or your config.yaml), never code.
     tiers: {
@@ -230,7 +235,7 @@ export const DEFAULT_CONFIG = {
         },
     },
     pricing: { cheap: 0.1, mid: 0.5, frontier: 2.5 },
-    gates: {},
+    gates: { diffCap: DEFAULT_DIFF_CAP },
     judge: { adapter: "claude-code", model: "fable" },
     review: { complexityThreshold: 7, required: true },
     consult: { adapter: "claude-code", model: "fable", stallMinutes: 15 },
@@ -316,6 +321,7 @@ export function configTemplate(overlay) {
 # scope:
 #   allowDeviations: []    # globs an operator permits out-of-scope edits into, e.g. ["package-lock.json"]
 # gates:                  # override auto-detected commands; per-shape participation may only skip LLM gates
+#   diffCap: 60000         # fail closed before an LLM gate; split the task or raise this positive integer
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory

package/dist/drivers/subprocess.js

@@ -52,6 +52,7 @@ export class SubprocessDriver {
             cwd: slot.cwd,
             stdio: ["ignore", "pipe", "pipe"],
             env: sealHerdrEnv(process.env),
+            detached: true,
         });
         s.proc = p;
         p.stdout.on("data", (d) => (s.buf = (s.buf + d).slice(-MAX_BUF)));
@@ -96,8 +97,14 @@ export class SubprocessDriver {
     }
     async close(slot) {
         const s = this.slots.get(slot.id);
-        if (s?.proc && !s.exited)
-            s.proc.kill("SIGKILL");
+        if (s?.proc && !s.exited) {
+            try {
+                process.kill(-s.proc.pid, "SIGKILL");
+            }
+            catch {
+                s.proc.kill("SIGKILL");
+            }
+        }
         this.slots.delete(slot.id);
     }
     worktree(repo, branch, baseRef) {