tickmarkr 1.50.0 → 1.52.0

package/dist/compile/native.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { GATE_NAMES, ORACLES, SHAPES, TIERS, validateGraph } from "../graph/schema.js";
+import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, SHAPES, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
 export const TICKMARKR_NATIVE_MARKER = /^<!--\s*tickmarkr:spec(?:\s+v1)?\s*-->\s*$/m;
@@ -20,6 +20,7 @@ export function compileNative(file) {
     const content = readFileSync(file, "utf8");
     const drafts = [];
     let plainCount = 0; // v1.19: plain-string acceptance items compiled as judge oracles (compat) — warn once
+    let specMode;
     for (const line of content.split("\n")) {
         const heading = line.match(HEAD_RE);
         if (heading) {
@@ -27,8 +28,18 @@ export function compileNative(file) {
             continue;
         }
         const draft = drafts.at(-1);
-        if (!draft)
+        if (!draft) {
+            // v1.51 T2: spec front-matter — a top-level `mode: <name>` line before the first task heading
+            // declares the engagement's routing mode (loses only to an explicit run flag).
+            const fm = line.match(/^mode:\s*(\S+)\s*$/);
+            if (fm) {
+                if (!GRAPH_ROUTING_MODES.includes(fm[1])) {
+                    throw new CompileError(`spec front-matter mode must be one of ${GRAPH_ROUTING_MODES.join(", ")} (got ${JSON.stringify(fm[1])})`);
+                }
+                specMode = fm[1];
+            }
             continue;
+        }
         const field = line.match(FIELD_RE);
         if (field) {
             const name = field[1].toLowerCase();
@@ -151,6 +162,7 @@ export function compileNative(file) {
     });
     const result = validateGraph({
         version: 1,
+        ...(specMode ? { mode: specMode } : {}),
         spec: { source: "native", paths: [file], hash: sha256(content) },
         tasks,
     });
@@ -184,6 +196,10 @@ Each task is a "## Tn: Title" heading with "- field: value" bullets.
 acceptance is required on every task (a nested list of observable outcomes).
 
 <!--
+  Spec front-matter (top-level, before the first task heading):
+    mode: partner-led | risk-based | staff-led — this engagement's routing mode
+          (loses only to an explicit \`run --mode\` flag)
+
   Fields available per task:
     goal:        outcome the task must achieve (defaults to the title if omitted)
     shape:       plan | spec | implement | tests | docs | migration | ui | refactor | chore

package/dist/config/config.d.ts

@@ -7,16 +7,20 @@ declare const TierEnum: z.ZodEnum<{
 export type Tier = z.infer<typeof TierEnum>;
 export declare const TIER_RANK: Record<Tier, number>;
 export declare const DEFAULT_DIFF_CAP = 60000;
+export declare const ROUTING_MODES: readonly ["partner-led", "risk-based", "staff-led"];
+declare const ModeEnum: z.ZodEnum<{
+    "partner-led": "partner-led";
+    "risk-based": "risk-based";
+    "staff-led": "staff-led";
+}>;
+export type RoutingMode = z.infer<typeof ModeEnum>;
+export declare const INTEGRITY_FLOOR_SHAPES: readonly ["plan", "spec", "migration", "ui"];
 export declare const MapEntrySchema: z.ZodObject<{
     pin: z.ZodOptional<z.ZodObject<{
         via: z.ZodString;
         model: z.ZodString;
     }, z.core.$strip>>;
-    tier: z.ZodOptional<z.ZodEnum<{
-        cheap: "cheap";
-        mid: "mid";
-        frontier: "frontier";
-    }>>;
+    tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
     prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     escalate: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -60,16 +64,17 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
     contextWarnTokens: z.ZodNumber;
     setup: z.ZodOptional<z.ZodString>;
     routing: z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            "partner-led": "partner-led";
+            "risk-based": "risk-based";
+            "staff-led": "staff-led";
+        }>>;
         map: z.ZodRecord<z.ZodString, z.ZodObject<{
             pin: z.ZodOptional<z.ZodObject<{
                 via: z.ZodString;
                 model: z.ZodString;
             }, z.core.$strip>>;
-            tier: z.ZodOptional<z.ZodEnum<{
-                cheap: "cheap";
-                mid: "mid";
-                frontier: "frontier";
-            }>>;
+            tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
             prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
             escalate: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
@@ -195,9 +200,31 @@ export declare function globalConfigDir(): string;
 export declare function overlayPreferShapes(repoRoot: string, opts?: {
     globalDir?: string;
 }): ReadonlySet<string>;
+export type ModeResolution = {
+    mode: RoutingMode;
+    /** floor shape → "mode <name>" | "config floors" */
+    provenance: Record<string, string>;
+    /** plan lints: shadowed mode deltas + operator floors below the integrity minimum (standing) */
+    lints: string[];
+};
+/** loadConfig plus the mode-resolution record (floor provenance + plan lints). The resolved floors are
+ *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
+export declare function loadConfigWithMode(repoRoot: string, opts?: {
+    globalDir?: string;
+    repoOverlayText?: string;
+}): {
+    cfg: TickmarkrConfig;
+    mode: ModeResolution;
+};
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
+/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
+ *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
+ *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+export declare function overlayBytesLoadError(repoRoot: string, bytes: string, opts?: {
+    globalDir?: string;
+}): string | null;
 export type InitConfigOverlay = {
     concurrency?: number;
     driver?: TickmarkrConfig["driver"];

package/dist/config/config.js

@@ -10,9 +10,31 @@ const TierEnum = z.enum(TIERS, {
 });
 export const TIER_RANK = { cheap: 0, mid: 1, frontier: 2 };
 export const DEFAULT_DIFF_CAP = 60_000;
+// v1.51 T1: routing.mode — a preset COMPILED INTO FLOORS at config load. The router never sees the
+// mode; it receives resolved floors only (the structural defense against the quality-silently-loses
+// class — no fourth runtime authority, no new precedence key).
+export const ROUTING_MODES = ["partner-led", "risk-based", "staff-led"];
+const ModeEnum = z.enum(ROUTING_MODES, {
+    error: (iss) => `Invalid option: expected one of "partner-led"|"risk-based"|"staff-led" (got ${JSON.stringify(iss.input)})`,
+});
+// Integrity set (weak-oracle shapes, OBS-68..70 class): no mode may resolve these below frontier.
+// Only an explicit operator floor line can — and it draws a standing plan lint every load.
+export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
+// v1.52 T5: tier is no longer a map-entry band authority — routing.floors is the only tier
+// source left (v1.51 T3 deprecated this field with a promise to remove it here). Only the legacy
+// `tier: null` tombstone still parses (and normalizes to absent); any real value fails config
+// load fail-closed, naming routing.floors as the move target, so a band intent set here can never
+// silently vanish. The field stays in the schema/type as an always-undefined marker (not deleted
+// outright) so a map entry can never carry a real tier value again, structurally.
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
-    tier: TierEnum.optional(),
+    tier: z
+        .null({
+        error: (iss) => `routing.map entry tier ${JSON.stringify(iss.input)} is no longer a band authority — move this value to routing.floors.<shape> (only "tier: null" tombstones still parse)`,
+    })
+        .optional()
+        .transform(() => undefined)
+        .optional(),
     prefer: z.array(z.string()).optional(),
     escalate: z.boolean().optional(),
 });
@@ -80,6 +102,8 @@ export const TickmarkrConfigSchema = z.object({
     contextWarnTokens: z.number().int().positive(),
     setup: z.string().optional(),
     routing: z.object({
+        // v1.51 T1: preset expanded into floors by loadConfig — absent ⇒ risk-based ⇒ byte-identical routing.
+        mode: ModeEnum.optional(),
         map: z.record(z.string(), MapEntrySchema),
         floors: z.record(z.string(), TierEnum),
         learned: z.enum(["on", "off"]), // v1.6 ROUTE-09 kill switch; a typo (offf) fails loud via safeParse
@@ -155,12 +179,15 @@ export const DEFAULT_CONFIG = {
     taskTimeoutMinutes: 30,
     contextWarnTokens: 170_000, // v1.23 T2: overseer ctx-watch.sh proven threshold
     routing: {
+        // v1.51 T3 (round-2 consult) / v1.52 T5: map entries carry preferences/pins only — band
+        // policy lives in routing.floors, the single tier authority. A map entry can no longer carry
+        // a real tier value at all: MapEntrySchema fails config load fail-closed on one, naming
+        // routing.floors as the move target; only the legacy `tier: null` tombstone still parses.
         map: {
             plan: { pin: { via: "claude-code", model: "fable" } },
             spec: { pin: { via: "claude-code", model: "fable" } },
-            implement: { tier: "mid", prefer: ["cursor-agent", "codex"] },
-            tests: { tier: "cheap", prefer: ["opencode"] },
-            docs: { tier: "cheap" },
+            implement: { prefer: ["cursor-agent", "codex"] },
+            tests: { prefer: ["opencode"] },
         },
         floors: {
             plan: "frontier", spec: "frontier", migration: "frontier",
@@ -278,7 +305,9 @@ function deepMerge(base, over) {
             delete out[k]; // v1.1 tombstone: an explicit null in an overlay removes the key (e.g. stale tiers model ids)
             continue;
         }
-        out[k] = k in out ? deepMerge(out[k], v) : v;
+        // OBS-75 class: merge fresh-landing objects onto {} so nested tombstone nulls are pruned even when
+        // no lower layer set the key (a fleet-cleared deny writes {adapters: null} — the schema rejects raw null)
+        out[k] = k in out ? deepMerge(out[k], v) : deepMerge({}, v);
     }
     return out;
 }
@@ -304,14 +333,104 @@ export function overlayPreferShapes(repoRoot, opts = {}) {
     }
     return shapes;
 }
-export function loadConfig(repoRoot, opts = {}) {
+const lowerTier = (t) => (t === "frontier" ? "mid" : "cheap");
+const maxTier = (a, b) => (TIER_RANK[a] >= TIER_RANK[b] ? a : b);
+const integrityMin = (shape) => INTEGRITY_FLOOR_SHAPES.includes(shape) ? "frontier" : "cheap";
+// partner-led = frontier everywhere; staff-led = one band down, integrity-clamped (net effect on the
+// defaults: implement/refactor → cheap, ui → frontier); risk-based = identity, so an absent mode key
+// resolves byte-identically to pre-v1.51 routing.
+function presetFloor(mode, shape, dflt) {
+    if (mode === "partner-led")
+        return "frontier";
+    if (mode === "staff-led")
+        return maxTier(lowerTier(dflt), integrityMin(shape));
+    return dflt;
+}
+/** Which floor shapes the operator wrote in an overlay layer (explicit beats mode; null tombstones stay removed). */
+function overlayFloorEdits(layers) {
+    const explicit = new Set();
+    const tombstoned = new Set();
+    for (const layer of layers) {
+        const floors = layer?.routing?.floors;
+        if (!floors || typeof floors !== "object" || Array.isArray(floors))
+            continue;
+        for (const [shape, v] of Object.entries(floors)) {
+            if (v === null) {
+                explicit.delete(shape);
+                tombstoned.add(shape);
+            }
+            else {
+                tombstoned.delete(shape);
+                explicit.add(shape);
+            }
+        }
+    }
+    return { explicit, tombstoned };
+}
+// Mutates cfg.routing.floors (and explore under partner-led) to the mode-resolved values.
+function resolveRoutingMode(cfg, layers) {
+    const mode = cfg.routing.mode ?? "risk-based";
+    const { explicit, tombstoned } = overlayFloorEdits(layers);
+    const provenance = {};
+    const lints = [];
+    for (const shape of SHAPES) {
+        if (tombstoned.has(shape))
+            continue; // operator removed the floor — a mode never resurrects it
+        const dflt = DEFAULT_CONFIG.routing.floors[shape];
+        const moded = presetFloor(mode, shape, dflt);
+        if (explicit.has(shape)) {
+            const val = cfg.routing.floors[shape];
+            provenance[shape] = "config floors";
+            if (moded !== val && moded !== dflt) {
+                lints.push(`floors.${shape}: ${val} (config floors) overrides mode ${mode} — shadowed delta: ${shape} ${dflt}→${moded}`);
+            }
+            if (TIER_RANK[val] < TIER_RANK[integrityMin(shape)]) {
+                lints.push(`floors.${shape}: ${val} is below integrity minimum frontier — integrity class ${INTEGRITY_FLOOR_SHAPES.join("/")} holds regardless of mode`);
+            }
+            continue;
+        }
+        cfg.routing.floors[shape] = moded;
+        provenance[shape] = `mode ${mode}`;
+    }
+    for (const shape of Object.keys(cfg.routing.floors)) {
+        if (!(shape in provenance))
+            provenance[shape] = "config floors"; // overlay floors on non-shape keys
+    }
+    // partner-led resolves exploration off (probes are the wrong spend under a premium declaration);
+    // staff-led and risk-based leave explore untouched — the round-2 fence rides through as configured.
+    if (mode === "partner-led")
+        cfg.routing.explore = { ...cfg.routing.explore, mode: "off" };
+    return { mode, provenance, lints };
+}
+/** loadConfig plus the mode-resolution record (floor provenance + plan lints). The resolved floors are
+ *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
+export function loadConfigWithMode(repoRoot, opts = {}) {
     const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
-    const repoCfg = readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"));
+    // v1.52 T2: repoOverlayText substitutes candidate bytes for the on-disk repo layer — the fleet
+    // write guard validates EXACTLY what it is about to write through this one loader path.
+    const repoCfg = opts.repoOverlayText === undefined
+        ? readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"))
+        : parse(opts.repoOverlayText);
     const merged = deepMerge(deepMerge(structuredClone(DEFAULT_CONFIG), globalCfg), repoCfg);
     const r = TickmarkrConfigSchema.safeParse(merged);
     if (!r.success)
         throw new ConfigError(z.prettifyError(r.error));
-    return r.data;
+    return { cfg: r.data, mode: resolveRoutingMode(r.data, [globalCfg, repoCfg]) };
+}
+export function loadConfig(repoRoot, opts = {}) {
+    return loadConfigWithMode(repoRoot, opts).cfg;
+}
+/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
+ *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
+ *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
+    try {
+        loadConfigWithMode(repoRoot, { ...opts, repoOverlayText: bytes });
+        return null;
+    }
+    catch (e) {
+        return e.message;
+    }
 }
 export function configTemplate(overlay) {
     const base = `# tickmarkr config overlay — merges over built-in defaults (repo beats global beats defaults)
@@ -321,10 +440,15 @@ export function configTemplate(overlay) {
 # contextWarnTokens: 170000   # v1.23: journal+notify once per attempt when live worker context crosses this (status shows the sample)
 # setup: npm ci --prefer-offline   # run in each fresh task worktree before dispatch
 # routing:
-#   map:                  # per-shape routing; pin an exact CLI+model, or tier+prefer
-#     implement: { tier: mid, prefer: [cursor-agent, codex] }
+#   mode: risk-based      # v1.51: partner-led | risk-based | staff-led — a preset compiled into floors at
+#                         # load (partner-led: every shape frontier + explore off; staff-led: implement/refactor
+#                         # cheap; integrity set plan/spec/migration/ui never resolves below frontier under any
+#                         # mode). Absent = risk-based = byte-identical routing. Explicit floors below beat mode deltas (linted).
+#   map:                  # per-shape preferences/pins; band policy lives in routing.floors
+#     implement: { prefer: [cursor-agent, codex] }
 #     migration: { pin: { via: claude-code, model: fable } }
-#   floors:               # advisory minimum tiers; 'tickmarkr plan' lints violations
+#     tests: { tier: null }   # tombstone: null removes a legacy map tier (a real tier value now fails config load — move the band to routing.floors.tests)
+#   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
 #   learnedTuning: { halfLifeRuns: 5, availWeight: 0.05 }  # optional; defaults byte-identical
@@ -561,7 +685,9 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}) {
             }
         }
         if (Object.keys(modelDelta).length) {
-            tiersOut[adapter] = { models: { ...tiersOut[adapter]?.models, ...modelDelta } };
+            // spread the existing entry so vendor/channel/windows survive the rewrite — dropping them
+            // makes the overlay unloadable for any adapter without a default seed (reload-guard class)
+            tiersOut[adapter] = { ...tiersOut[adapter], models: { ...tiersOut[adapter]?.models, ...modelDelta } };
             tiersTouched = true;
         }
     }
@@ -587,47 +713,58 @@ export function serializeFleetOverlay(overlay, provenance = {}) {
         return "";
     const lines = [];
     const today = new Date().toISOString().slice(0, 10);
+    // OBS-75: never glue stringify() output onto a key line — wrap the key into the object and
+    // re-indent the whole emitted block, so sequences/nested maps nest correctly and null
+    // tombstones/empty collections survive the serialize→parse round-trip.
+    const block = (obj, pad) => stringify(obj).trimEnd().split("\n").map((l) => `${pad}${l}`);
     const routing = overlay.routing;
     if (routing) {
         lines.push("routing:");
         const deny = routing.deny;
-        if (deny) {
+        if (deny && (deny.adapters !== undefined || deny.models !== undefined)) {
             lines.push("  deny:");
-            if (deny.adapters)
-                lines.push(`    adapters: ${stringify(deny.adapters).trim()}`);
-            if (deny.models)
-                lines.push(`    models: ${stringify(deny.models).trim()}`);
-        }
-        if (routing.map) {
-            lines.push("  map:");
-            for (const [shape, entry] of Object.entries(routing.map)) {
-                lines.push(`    ${shape}:`);
-                const body = stringify(entry, { indent: 2 }).trim().split("\n");
-                lines.push(...body.map((l) => `      ${l}`));
-            }
+            if (deny.adapters !== undefined)
+                lines.push(...block({ adapters: deny.adapters }, "    "));
+            if (deny.models !== undefined)
+                lines.push(...block({ models: deny.models }, "    "));
         }
+        if (routing.map)
+            lines.push(...block({ map: routing.map }, "  "));
         if (routing.floors)
-            lines.push(`  floors: ${stringify(routing.floors).trim().replace(/^/gm, "  ")}`);
+            lines.push(...block({ floors: routing.floors }, "  "));
     }
     const tiers = overlay.tiers;
-    if (tiers) {
+    if (tiers && Object.keys(tiers).length) {
         lines.push("tiers:");
         for (const [adapter, entry] of Object.entries(tiers)) {
-            lines.push(`  ${adapter}:`);
+            const body = [];
             if (entry.vendor)
-                lines.push(`    vendor: ${entry.vendor}`);
+                body.push(`    vendor: ${entry.vendor}`);
             if (entry.channel)
-                lines.push(`    channel: ${entry.channel}`);
-            lines.push("    models:");
-            for (const [model, tier] of Object.entries(entry.models ?? {})) {
-                if (tier === null)
-                    lines.push(`      ${model}: null`);
-                else {
-                    const note = provenance[adapter]?.[model];
-                    const suffix = note ? `  # ${note} — fleet ${today}` : "";
-                    lines.push(`      ${model}: ${tier}${suffix}`);
+                body.push(`    channel: ${entry.channel}`);
+            if (entry.windows)
+                body.push(...block({ windows: entry.windows }, "    "));
+            const models = Object.entries(entry.models ?? {});
+            if (models.length) {
+                body.push("    models:");
+                for (const [model, tier] of models) {
+                    if (tier === null)
+                        body.push(`      ${model}: null`);
+                    else {
+                        const note = provenance[adapter]?.[model];
+                        const suffix = note ? `  # ${note} — fleet ${today}` : "";
+                        body.push(`      ${model}: ${tier}${suffix}`);
+                    }
                 }
             }
+            else if (entry.models) {
+                body.push("    models: {}"); // present-but-empty: explicit {} — a childless header parses as null and the loader rejects it
+            }
+            // a bare `adapter:` line parses as a null tombstone and would DELETE the adapter's default seeds on merge
+            if (body.length)
+                lines.push(`  ${adapter}:`, ...body);
+            else
+                lines.push(`  ${adapter}: {}`);
         }
     }
     return `${lines.join("\n")}\n`;

package/dist/graph/schema.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 export declare const SHAPES: readonly ["plan", "spec", "implement", "tests", "docs", "migration", "ui", "refactor", "chore"];
+export declare const GRAPH_ROUTING_MODES: readonly ["partner-led", "risk-based", "staff-led"];
 export declare const STATUSES: readonly ["pending", "running", "gated", "failed", "done", "human"];
 export declare const GATE_NAMES: readonly ["build", "test", "lint", "evidence", "scope", "acceptance", "review"];
 export declare const TIERS: readonly ["cheap", "mid", "frontier"];
@@ -94,6 +95,11 @@ export declare const TaskSchema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const RunGraphSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        "partner-led": "partner-led";
+        "risk-based": "risk-based";
+        "staff-led": "staff-led";
+    }>>;
     spec: z.ZodObject<{
         source: z.ZodEnum<{
             speckit: "speckit";

package/dist/graph/schema.js

@@ -1,5 +1,8 @@
 import { z } from "zod";
 export const SHAPES = ["plan", "spec", "implement", "tests", "docs", "migration", "ui", "refactor", "chore"];
+// v1.51 T2: spec-declared routing mode. Mirrors config ROUTING_MODES literally — config.ts imports this
+// module, so a runtime import back would be circular; parity is pinned by test (tests/cli/mode-sources).
+export const GRAPH_ROUTING_MODES = ["partner-led", "risk-based", "staff-led"];
 export const STATUSES = ["pending", "running", "gated", "failed", "done", "human"];
 export const GATE_NAMES = ["build", "test", "lint", "evidence", "scope", "acceptance", "review"];
 const MANDATORY_GATES = ["build", "test", "lint", "evidence", "scope"];
@@ -88,6 +91,9 @@ export const TaskSchema = z.object({
 export const RunGraphSchema = z
     .object({
     version: z.literal(1),
+    // v1.51 T2: spec front-matter mode — the spec author's routing-mode declaration. Source
+    // precedence: run flag > this > repo config > global config > default (risk-based).
+    mode: z.enum(GRAPH_ROUTING_MODES).optional(),
     spec: z.object({
         source: z.enum(["speckit", "gsd", "prd", "native", "taskmaster"]),
         paths: z.array(z.string()),

package/dist/route/profile.d.ts

@@ -83,6 +83,18 @@ export declare function learnedScoreTerms(profile: RoutingProfile | undefined, s
     availWeight?: number;
     slaMinutes?: number;
 }): LearnedScoreTerms;
+export declare const STAFF_LED_MARGIN = 0.1;
+export interface StaffLedEvidence {
+    cheapBest: number;
+    midBest: number;
+    n: number;
+}
+export declare function staffLedEvidence(profile: RoutingProfile | undefined, shape: string, channels: readonly {
+    adapter: string;
+    model: string;
+    channel: string;
+    tier: string;
+}[]): StaffLedEvidence | null;
 export declare function learnedScore(profile: RoutingProfile | undefined, shape: string, chKey: string, channel: string, opts?: {
     availWeight?: number;
     slaMinutes?: number;

package/dist/route/profile.js

@@ -217,6 +217,37 @@ export function learnedScoreTerms(profile, shape, chKey, channel, opts = {}) {
     const overrun = cell.dispatches < MIN_SAMPLES ? 0 : -OVERRUN_WEIGHT * ((cell.overruns ?? 0) / cell.dispatches); // ∈ [−OVERRUN_WEIGHT, 0]
     return { quality, perf, avail, overrun };
 }
+// v1.51 T5 staff-led economics guard (round-3 Fable §3.3): ONE comparison over existing warm cells,
+// consumed by plan as an ADVISORY lint only. Evidence display, never a floor input — no routing path
+// reads this (anticipatory raises are refused house law: bands move on declarations, structural
+// signals, or the failure ladder — never on the profile's prediction).
+export const STAFF_LED_MARGIN = 0.1; // "materially below" = two quality quanta (2 × the 0.05 term weights)
+// Best WARM learned score per band (cold cells — n < MIN_SAMPLES — are not evidence; the warm best is
+// the band's incumbent proxy). Null unless BOTH bands are warm AND the mid incumbent leads by at least
+// STAFF_LED_MARGIN: silence is the default, so a cold profile can never fire the lint.
+export function staffLedEvidence(profile, shape, channels) {
+    if (!profile)
+        return null;
+    const best = (tier) => {
+        let top = null;
+        for (const c of channels) {
+            if (c.tier !== tier)
+                continue;
+            const cell = cellOf(profile, shape, channelKey(c), c.channel);
+            if (!cell || cell.n < MIN_SAMPLES)
+                continue;
+            const score = learnedScore(profile, shape, channelKey(c), c.channel);
+            if (!top || score > top.score)
+                top = { score, nRaw: cell.nRaw ?? 0 };
+        }
+        return top;
+    };
+    const cheap = best("cheap");
+    const mid = best("mid");
+    if (!cheap || !mid || mid.score - cheap.score < STAFF_LED_MARGIN)
+        return null;
+    return { cheapBest: cheap.score, midBest: mid.score, n: cheap.nRaw + mid.nRaw };
+}
 // Total by construction: every miss returns the explicit NEUTRAL constant; every denominator is a
 // compile-time-positive constant sum; no Record indexing by row strings (the TIER_RANK[typo] scar).
 // Score 0 defers to the static sort keys, which already encode the benchmark-dated tier seeds — a

package/dist/route/router.d.ts

@@ -32,6 +32,7 @@ export interface ExploreContext {
 }
 export declare const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 export declare const QUALITY_ENV = "TICKMARKR_QUALITY";
+export declare const ROUTING_ENV_SEAMS: readonly ["TICKMARKR_QUALITY", "TICKMARKR_NO_EXPLORE"];
 export declare const raiseTier: (tier: Tier) => Tier;
 export declare class RoutingError extends Error {
     constructor(msg: string);

package/dist/route/router.js

@@ -4,6 +4,9 @@ import { disallowedBy } from "./preference.js";
 import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore, MIN_SAMPLES } from "./profile.js";
 export const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 export const QUALITY_ENV = "TICKMARKR_QUALITY";
+// OBS-74: every routing env seam, in one list — the spawn seam (src/run/git.ts) scrubs exactly
+// these from child env so gate/baseline/tip-verify children are hermetic by construction.
+export const ROUTING_ENV_SEAMS = [QUALITY_ENV, NO_EXPLORE_ENV];
 const exploreCap = (cfg) => cfg.routing.explore?.cap ?? EXPLORE_CAP;
 const qualityOn = (exploreCtx) => !!exploreCtx?.quality || process.env[QUALITY_ENV] === "1";
 export const raiseTier = (tier) => tier === "cheap" ? "mid" : tier === "mid" ? "frontier" : "frontier";
@@ -160,15 +163,13 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
-    const baseTier = entry?.tier ?? floor ?? "cheap";
+    const baseTier = floor ?? "cheap";
     let minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier; // task floor is a hard >= constraint in all paths (D-04)
     if (quality && advisoryFloor) {
         const raised = raiseTier(advisoryFloor);
         if (TIER_RANK[raised] > TIER_RANK[minTier])
             minTier = raised;
     }
-    if (entry?.tier)
-        lintFloor(entry.tier, "map tier");
     if (prefActive)
         for (const p of prefer ?? [])
             preflightPrefer(p);
@@ -253,9 +254,8 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     }
     const bound = qualityBound(quality, advisoryFloor, taskFloorRaw) ??
         (taskFloor && TIER_RANK[taskFloor] >= TIER_RANK[baseTier] ? `floor ${taskFloor} (task hint${src})` :
-            entry?.tier ? `tier ${entry.tier} (config routing.map)` :
-                floor ? `floor ${floor} (config floors)` :
-                    "tier cheap (default)");
+            floor ? `floor ${floor} (config floors)` :
+                "tier cheap (default)");
     // name the key that actually broke the tie: prefer outranks the marginal-cost/tier keys, so if the
     // winner matched a prefer entry, prefer decided it — not "cheapest sufficient tier" (ROUTE-03, WR-01)
     const preferVia = preferFromAuto(task.shape, preferCtx)

package/dist/run/daemon.d.ts

@@ -1,4 +1,5 @@
 import { type WorkerAdapter } from "../adapters/types.js";
+import { type ModeResolution, type RoutingMode, type TickmarkrConfig } from "../config/config.js";
 import { type ExecutorDriver } from "../drivers/types.js";
 import { type JournalEvent } from "./journal.js";
 export interface RunOptions {
@@ -9,8 +10,23 @@ export interface RunOptions {
     driver?: ExecutorDriver;
     adapters?: WorkerAdapter[];
     globalDir?: string;
+    mode?: RoutingMode;
     narrate?: (event: JournalEvent) => void;
 }
+export type ModeSource = "run flag" | "spec" | "repo config" | "global config" | "default";
+export interface ResolvedRunMode {
+    cfg: TickmarkrConfig;
+    /** effective mode + per-floor provenance + standing lints, from the ONE preset compiler in config.ts */
+    mode: ModeResolution;
+    source: ModeSource;
+    /** set when the run flag picked a mode below the spec-declared mode (loud warn; --route-strict refuses) */
+    conflict?: string;
+}
+export declare function resolveRunMode(repoRoot: string, opts?: {
+    flag?: RoutingMode;
+    spec?: RoutingMode;
+    globalDir?: string;
+}): ResolvedRunMode;
 export interface RunSummary {
     runId: string;
     branch: string;