tickmarkr 1.84.0 → 1.86.0

package/dist/adapters/model-windows.js

@@ -0,0 +1,69 @@
+import { z } from "zod";
+const ModelWindowClaimSchema = z
+    .object({
+    modelId: z.string().min(1),
+    window: z.number().int().positive(),
+    source: z.string().url(),
+    readDate: z.iso.date(),
+})
+    .strict();
+/**
+ * Validate cited model-window claims before production code can consume them.
+ * These values are vendor-published claims, not measurements made by tickmarkr.
+ */
+export function loadModelWindowClaims(input) {
+    const claims = z.array(ModelWindowClaimSchema).parse(input);
+    const seen = new Set();
+    for (const claim of claims) {
+        if (seen.has(claim.modelId))
+            throw new Error(`duplicate model id ${claim.modelId}`);
+        seen.add(claim.modelId);
+    }
+    return Object.freeze(claims.map((claim) => Object.freeze(claim)));
+}
+const ANTHROPIC_SOURCE = "https://platform.claude.com/docs/en/about-claude/models/overview";
+const OPENAI_SOURCE = "https://developers.openai.com/api/docs/models";
+const OPENAI_GPT_55_SOURCE = "https://developers.openai.com/api/docs/models/gpt-5.5";
+const CURSOR_SOURCE = "https://cursor.com/help/ai-features/max-mode";
+const ZAI_SOURCE = "https://z.ai/blog/glm-5.2";
+const XAI_SOURCE = "https://docs.x.ai/developers/models/grok-4.5";
+const KIMI_SOURCE = "https://www.kimi.com/code/docs/en/kimi-code-cli/configuration/config-files.html";
+const READ_DATE = "2026-08-05";
+const VENDORED_MODEL_WINDOW_CLAIMS = [
+    { modelId: "fable", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
+    { modelId: "opus", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
+    { modelId: "sonnet", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
+    { modelId: "haiku", window: 200_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
+    { modelId: "gpt-5.6-sol", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
+    { modelId: "gpt-5.5", window: 1_050_000, source: OPENAI_GPT_55_SOURCE, readDate: READ_DATE },
+    { modelId: "gpt-5.6-terra", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
+    { modelId: "gpt-5.6-luna", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
+    { modelId: "composer-2.5", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
+    { modelId: "composer-2.5-fast", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
+    { modelId: "zai-coding-plan/glm-5.2", window: 1_000_000, source: ZAI_SOURCE, readDate: READ_DATE },
+    { modelId: "zai/glm-5.2", window: 1_000_000, source: ZAI_SOURCE, readDate: READ_DATE },
+    { modelId: "grok-4.5", window: 500_000, source: XAI_SOURCE, readDate: READ_DATE },
+    { modelId: "grok-composer-2.5-fast", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
+    { modelId: "kimi-code/k3", window: 1_048_576, source: KIMI_SOURCE, readDate: READ_DATE },
+    { modelId: "kimi-code/kimi-for-coding", window: 262_144, source: KIMI_SOURCE, readDate: READ_DATE },
+    { modelId: "kimi-code/kimi-for-coding-highspeed", window: 262_144, source: KIMI_SOURCE, readDate: READ_DATE },
+];
+/** The closed, production-readable catalog of cited context-window claims. */
+export const CITED_MODEL_WINDOWS = loadModelWindowClaims(VENDORED_MODEL_WINDOW_CLAIMS);
+export function resolveModelWindowClaim(modelId, input = CITED_MODEL_WINDOWS) {
+    const claim = loadModelWindowClaims(input).find((entry) => entry.modelId === modelId);
+    return claim === undefined ? { status: "unknown", modelId } : { status: "declared", claim };
+}
+/** Fail when either side contains a model id absent from the other side. */
+export function assertModelWindowClaimsMatchSeededModels(seededModelIds, input = CITED_MODEL_WINDOWS) {
+    const tableIds = new Set(loadModelWindowClaims(input).map((claim) => claim.modelId));
+    const seedIds = new Set(seededModelIds);
+    const tableOnly = [...tableIds].filter((id) => !seedIds.has(id)).sort();
+    const seedOnly = [...seedIds].filter((id) => !tableIds.has(id)).sort();
+    const differences = [
+        tableOnly.length ? `table-only model ids: ${tableOnly.join(", ")}` : "",
+        seedOnly.length ? `seed-only model ids: ${seedOnly.join(", ")}` : "",
+    ].filter(Boolean);
+    if (differences.length)
+        throw new Error(differences.join("; "));
+}

package/dist/adapters/prompt.d.ts

@@ -1,10 +1,14 @@
 import { type Task } from "../graph/schema.js";
+import { type VerdictUnparseableCause } from "../gates/verdict-cause.js";
 import type { WorkerResult } from "./types.js";
 export declare function buildTaskPrompt(task: Task, feedback?: string, nonce?: string): string;
 export declare function writePrompt(dir: string, task: Task, attempt: number, feedback?: string, nonce?: string): string;
 export declare function trailerPattern(nonce: string): string;
 export declare const NO_TRAILER_SUMMARY = "worker produced no TICKMARKR_RESULT trailer";
 export declare const UNPARSEABLE_TRAILER_SUMMARY = "unparseable TICKMARKR_RESULT trailer";
-export declare function parseWorkerResult(raw: string, nonce: string): WorkerResult;
+export type ClassifiedWorkerResult = WorkerResult & {
+    cause?: VerdictUnparseableCause;
+};
+export declare function parseWorkerResult(raw: string, nonce: string): ClassifiedWorkerResult;
 export type DeadChannelReason = "auth-required" | "setup-required" | "provider-outage" | "timeout";
 export declare function classifyDeadChannel(result: WorkerResult): DeadChannelReason | undefined;

package/dist/adapters/prompt.js

@@ -1,6 +1,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { renderAcceptanceItem } from "../graph/schema.js";
+import { classifyVerdictCause } from "../gates/verdict-cause.js";
 export function buildTaskPrompt(task, feedback = "", nonce = "") {
     const list = (xs) => xs.map((x) => `- ${x}`).join("\n");
     return `You are an autonomous coding worker dispatched by tickmarkr into an isolated git worktree.
@@ -41,15 +42,22 @@ function trailerTokenPositions(raw, nonce) {
         positions.push(i);
     return positions;
 }
+// The worker protocol binds participation in the nonce-bearing TICKMARKR_RESULT token outside its
+// JSON object, while judge/review/consult bind it inside the object. Parsing has already rejected every
+// candidate by the time this runs, so canonicalize that token with the `ok` key this boundary requests;
+// the shared classifier still owns the resulting cause and callers cannot infer one from token count.
+function workerVerdictWitness(raw, nonce, positions) {
+    if (positions.length === 0)
+        return raw;
+    return `{"nonce":${JSON.stringify(nonce)},"ok":false,`;
+}
 // v1.65 T1: the parse boundary's own no-trailer sentinel summaries. classifyDeadChannel keys on
 // these — a result carrying any other summary is a PARSED trailer, i.e. the worker speaking.
 export const NO_TRAILER_SUMMARY = "worker produced no TICKMARKR_RESULT trailer";
 export const UNPARSEABLE_TRAILER_SUMMARY = "unparseable TICKMARKR_RESULT trailer";
 export function parseWorkerResult(raw, nonce) {
-    const fail = (summary) => ({ ok: false, summary, deviations: [], raw });
+    const fail = (summary, cause) => ({ ok: false, summary, deviations: [], raw, cause });
     const positions = trailerTokenPositions(raw, nonce);
-    if (positions.length === 0)
-        return fail(NO_TRAILER_SUMMARY);
     // TUIs echo the prompt template, redraw lines, and HARD-wrap the JSON with per-line margins
     // (cursor does; recent-unwrapped can't rejoin hard newlines). Scan occurrences backward — last
     // parseable wins — joining wrapped lines, stripping margin/box chrome, and growing the candidate
@@ -79,7 +87,8 @@ export function parseWorkerResult(raw, nonce) {
             }
         }
     }
-    return fail(UNPARSEABLE_TRAILER_SUMMARY);
+    const cause = classifyVerdictCause(workerVerdictWitness(raw, nonce, positions), nonce, "ok");
+    return fail(cause === "malformed-verdict" ? UNPARSEABLE_TRAILER_SUMMARY : NO_TRAILER_SUMMARY, cause);
 }
 // Signatures anchor distinctive CLI-error phrasing — never bare fragments or bare status-code
 // numbers (the QUOTA_RE Pitfall-3 lesson): these run only over no-trailer output, but a stalled

package/dist/adapters/registry.d.ts

@@ -1,9 +1,9 @@
 import { type TickmarkrConfig } from "../config/config.js";
-import { type RoutingProfile } from "../route/profile.js";
+import { type CatalogEntriesOptions, type CliEntry } from "./catalog.js";
 import { type AuthHealth, type BillingChannel, type WorkerAdapter } from "./types.js";
-export declare const CANDIDATE_CLI_CATALOG: readonly ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
-export declare const REGISTERED_ADAPTER_BINARIES: readonly ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
-export declare function resolveShellBinary(bin: string, cwd?: string): {
+export declare const CANDIDATE_CLI_CATALOG: readonly string[];
+export declare function registeredAdapterBinaries(adapters?: WorkerAdapter[]): string[];
+export declare function resolveShellBinary(bin: string, cwd?: string, pathEnv?: string): {
     resolved?: string;
     all: string[];
 };
@@ -27,40 +27,39 @@ export declare function modelAliasLine(excluded: {
 }[]): string;
 export type CandidateCliDetection = {
     binary: string;
-    version: string | undefined;
+    path: string;
 };
-export declare function probeCandidateVersion(bin: string): string | undefined;
-export declare function detectCandidateClis(opts?: {
+export declare function parseHerdrCliNames(help: string): string[];
+export declare function herdrNominatedCliNames(cwd?: string, pathEnv?: string): string[];
+export interface DetectCandidateCliOptions extends CatalogEntriesOptions {
+    cwd?: string;
     pathEnv?: string;
-}): CandidateCliDetection[];
-export declare function formatCandidateCliRow({ binary, version }: CandidateCliDetection): string;
+    entries?: readonly CliEntry[];
+    adapters?: WorkerAdapter[];
+    resolveBinary?: (binary: string) => {
+        resolved?: string;
+        all: string[];
+    };
+}
+export declare function detectCandidateClis(opts?: DetectCandidateCliOptions): CandidateCliDetection[];
+export declare function formatCandidateCliRow({ binary, path }: CandidateCliDetection): string;
 export declare function probeHelpText(bin: string): string | undefined;
 export declare function missingDeclaredFlags(helpText: string, flags: string[]): string[];
 export declare function flagDriftWarnings(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, helpOf?: (bin: string) => string | undefined): string[];
-export declare function allAdapters(opts?: {
+export declare function adaptersFromCliEntries(entries: readonly CliEntry[]): WorkerAdapter[];
+export interface AllAdaptersOptions {
     fakeScriptPath?: string;
-}): WorkerAdapter[];
+    cliEntries?: readonly CliEntry[];
+    operatorYaml?: string | null;
+    operatorPath?: string | false;
+}
+export declare function allAdapters(opts?: AllAdaptersOptions): WorkerAdapter[];
 export declare function getAdapter(id: string, adapters: WorkerAdapter[]): WorkerAdapter;
 export declare function probeAll(adapters: WorkerAdapter[], opts?: {
     cwd?: string;
 }): Promise<Record<string, AuthHealth>>;
 export type ProbeModelStatus = "ok" | "timeout" | "failed";
 export type ProbeModelProgress = (adapter: string, model: string, status: ProbeModelStatus, durationMs: number) => void;
-export interface AutoPreferDoc {
-    derivedAt: string;
-    [shape: string]: string[] | string;
-}
-export declare const pendingAutoPreferKey: unique symbol;
-export declare const DOCTOR_ROUTING_STALE_MS: number;
-export declare function deriveAutoPrefer(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, profile?: RoutingProfile): AutoPreferDoc;
-export declare function readAutoPrefer(repoRoot: string): AutoPreferDoc | null;
-export declare function routingPreferContext(repoRoot: string, cfg: TickmarkrConfig, opts?: {
-    globalDir?: string;
-}): {
-    autoPrefer?: AutoPreferDoc;
-    doctorFresh: boolean;
-    overlayPreferShapes: ReadonlySet<string>;
-};
 export declare function probeModels(cfg: TickmarkrConfig, repoRoot: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, onProgress?: ProbeModelProgress): Promise<void>;
 export declare function writeDoctor(repoRoot: string, health: Record<string, AuthHealth>): void;
 export declare function readDoctor(repoRoot: string): Record<string, AuthHealth> | null;

package/dist/adapters/registry.js

@@ -1,29 +1,33 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { overlayPreferShapes, TIER_RANK } from "../config/config.js";
 import { modelLints, suggestOverlay } from "./model-lints.js";
 import { HerdrDriver } from "../drivers/herdr.js";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
 import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../route/preference.js";
-import { learnedScore } from "../route/profile.js";
-import { marginalCostRank } from "../route/router.js";
 import { sh } from "../run/git.js";
-import { claudeCode } from "./claude-code.js";
-import { codex } from "./codex.js";
-import { cursorAgent } from "./cursor-agent.js";
 import { FakeAdapter } from "./fake.js";
-import { grok } from "./grok.js";
-import { kimi } from "./kimi.js";
-import { opencode } from "./opencode.js";
-import { pi } from "./pi.js";
+import { parseWorkerResult } from "./prompt.js";
 import { sealHerdrEnv } from "../drivers/subprocess.js";
-import { channelKey, modelAuthed, QUOTA_RE, shq } from "./types.js";
-// Agent-CLI binary names with no tickmarkr adapter — doctor sweeps these advisory-only (v1.48 T1).
-export const CANDIDATE_CLI_CATALOG = ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
-// Binaries probed by registered adapters — kept beside the catalog so a test can forbid overlap.
-export const REGISTERED_ADAPTER_BINARIES = ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
+import { catalogEntries, isNativeCliDrive, projectCliEntries, SHIPPED_CLI_CATALOG, } from "./catalog.js";
+import { channelKey, channelsFromConfig, modelAuthed, MODEL_ID_RE, QUOTA_RE, shq, } from "./types.js";
+// Compatibility projection for callers/tests that only need shipped advisory names. The literal
+// list is gone: both advisory and routable catalog views derive from SHIPPED_CLI_CATALOG. Native
+// definitions (claudeCode, codex, cursorAgent, opencode, pi, grok, kimi) are owned by catalog.ts;
+// this registry consumes their drive contracts instead of restating their registration order.
+export const CANDIDATE_CLI_CATALOG = SHIPPED_CLI_CATALOG
+    .filter((entry) => entry.drive === undefined)
+    .map((entry) => entry.binary);
+const SHIPPED_NATIVE_ADAPTERS = new Set(SHIPPED_CLI_CATALOG.flatMap((entry) => isNativeCliDrive(entry.drive) ? [entry.drive.adapter] : []));
+const declarativeBinaries = new WeakMap();
+// OBS-304: this was a hand-maintained mirror of the registered binaries, and the guard test that
+// forbids catalog overlap checked against IT rather than against the adapters — so when kimi gained
+// an adapter and nobody updated the copy, the guard kept passing on a collision it existed to catch.
+// Derive it. A list that restates another list is the defect, not the entry that fell out of sync.
+export function registeredAdapterBinaries(adapters = allAdapters()) {
+    return adapters.map((a) => a.hardcodedFlags?.binary ?? declarativeBinaries.get(a)).filter((b) => !!b);
+}
 // OBS-117: worker panes run commands through `bash -lc` (SubprocessDriver + sh()), not bare spawnSync(bin).
 // Doctor must resolve adapter binaries the same way so a shadow install on PATH cannot disagree with dispatch.
 function shellSpawnSync(cmd, cwd, timeoutMs = 10000) {
@@ -36,9 +40,24 @@ function shellSpawnSync(cmd, cwd, timeoutMs = 10000) {
     });
     return { code: r.status ?? 1, stdout: (r.stdout || "").trim(), stderr: (r.stderr || "").trim() };
 }
-export function resolveShellBinary(bin, cwd = process.cwd()) {
-    const r = shellSpawnSync(`type -a ${shq(bin)} 2>/dev/null | sed -n 's/^.* is \\(.*\\)$/\\1/p'`, cwd);
-    const all = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+export function resolveShellBinary(bin, cwd = process.cwd(), pathEnv) {
+    // An explicit PATH is a deterministic fixture/operator boundary. The default remains the same
+    // login-shell environment used by dispatched workers (OBS-117).
+    const pathPrefix = pathEnv === undefined ? "" : `export PATH=${shq(pathEnv)}; `;
+    const r = shellSpawnSync(`${pathPrefix}type -a ${shq(bin)} 2>/dev/null | sed -n 's/^.* is \\(.*\\)$/\\1/p'`, cwd);
+    const hits = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    // OBS-304: a duplicated PATH entry makes `type -a` emit the SAME path twice, which doctor then
+    // reported as "2 installs on PATH — …/claude, …/claude". Count distinct real files, so the real
+    // shadows (codex: homebrew + nvm) stop being buried in noise. realpath resolves symlinked twins.
+    const seen = new Set();
+    const all = hits.filter((p) => {
+        let key = p;
+        try {
+            key = realpathSync(p);
+        }
+        catch { /* unreadable or dangling — fall back to the literal path */ }
+        return seen.has(key) ? false : (seen.add(key), true);
+    });
     return { resolved: all[0], all };
 }
 export function probeVersionShell(bin, cwd = process.cwd()) {
@@ -101,39 +120,47 @@ export function modelAliasLine(excluded) {
     const parts = excluded.map(({ key, adapter }) => `${key} (not in ${adapter}'s reported model list)`);
     return `model alias: ${excluded.length} channel(s) invalid — ${parts.join(", ")}`;
 }
-function candidateOnPath(bin, pathEnv) {
-    const r = spawnSync("which", [bin], { encoding: "utf8", env: { ...process.env, PATH: pathEnv } });
-    return r.status === 0 && r.stdout.trim().length > 0;
+// Herdr's supported-kind help is nomination data only. Parse the closed token list and discard
+// everything else before any name can reach a shell resolver.
+export function parseHerdrCliNames(help) {
+    const body = /\[possible values:\s*([^\]]+)\]/m.exec(help)?.[1] ?? "";
+    return [...new Set(body.split(",").map((name) => name.trim()).filter((name) => /^[a-z0-9-]+$/.test(name)))];
 }
-// Fail open: a broken candidate binary never throws and never fails doctor.
-export function probeCandidateVersion(bin) {
-    try {
-        const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000 });
-        if (r.error || r.status !== 0)
-            return undefined;
-        return (r.stdout || r.stderr).trim().split("\n")[0];
-    }
-    catch {
-        return undefined;
-    }
+export function herdrNominatedCliNames(cwd = process.cwd(), pathEnv) {
+    // This asks a known driver binary for static help. It is deliberately NOT gated on
+    // HerdrDriver.available(), which reports HERDR_ENV rather than binary presence.
+    const { resolved } = resolveShellBinary("herdr", cwd, pathEnv);
+    if (!resolved)
+        return [];
+    const r = shellSpawnSync(`${shq(resolved)} agent start --help`, cwd);
+    return r.code === 0 ? parseHerdrCliNames(`${r.stdout}\n${r.stderr}`) : [];
 }
 export function detectCandidateClis(opts = {}) {
-    const pathEnv = opts.pathEnv ?? process.env.PATH ?? "";
-    const out = [];
-    for (const bin of CANDIDATE_CLI_CATALOG) {
-        if (!candidateOnPath(bin, pathEnv))
-            continue;
-        out.push({ binary: bin, version: probeCandidateVersion(bin) });
+    const cwd = opts.cwd ?? process.cwd();
+    const entries = opts.entries ?? catalogEntries({
+        shipped: opts.shipped,
+        operatorYaml: opts.operatorYaml,
+        operatorPath: opts.operatorPath,
+        herdrNames: opts.herdrNames ?? herdrNominatedCliNames(cwd, opts.pathEnv),
+    });
+    const registered = new Set(registeredAdapterBinaries(opts.adapters ?? allAdapters({ cliEntries: entries })));
+    const advisory = projectCliEntries(entries).advisory.filter((entry) => !registered.has(entry.binary));
+    const resolveBinary = opts.resolveBinary
+        ?? ((binary) => resolveShellBinary(binary, cwd, opts.pathEnv));
+    const discovered = [];
+    for (const entry of advisory) {
+        const { resolved } = resolveBinary(entry.binary);
+        if (resolved)
+            discovered.push({ binary: entry.binary, path: resolved });
     }
-    return out;
+    return discovered;
 }
-export function formatCandidateCliRow({ binary, version }) {
-    const ver = version ?? "version unknown";
-    return `  ! ${binary.padEnd(14)} detected: ${ver} (no tickmarkr adapter — not routable)`;
+export function formatCandidateCliRow({ binary, path }) {
+    return `  ! ${binary.padEnd(14)} detected at ${path} (no drive contract — not routable)`;
 }
-// v1.65 T3: same guarded spawn pattern as probeCandidateVersion — bounded, error/status-checked,
-// fail-open. undefined = binary unavailable/broken ⇒ no drift verdict (the existing auth reporting
-// already names an uninstalled CLI; drift must never pile on).
+// v1.65 T3: bounded, error/status-checked and fail-open. Unlike candidate detection above, this
+// executes only registered adapter binaries with drive contracts. undefined = unavailable/broken,
+// so no drift verdict piles onto the existing auth report.
 export function probeHelpText(bin) {
     try {
         const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000 });
@@ -169,11 +196,103 @@ export function flagDriftWarnings(adapters, health, helpOf = probeHelpText) {
     }
     return out;
 }
+function renderDriveTemplate(template, promptFile, model) {
+    return template.replaceAll("{promptFile}", shq(promptFile)).replaceAll("{model}", shq(model));
+}
+function valueAtPath(value, path) {
+    if (!path)
+        return value;
+    return path.split(".").reduce((cursor, part) => {
+        if (!cursor || typeof cursor !== "object")
+            return undefined;
+        return cursor[part];
+    }, value);
+}
+function parseDeclaredModels(raw, parser, path) {
+    let values;
+    if (parser === "json") {
+        try {
+            const selected = valueAtPath(JSON.parse(raw), path);
+            values = Array.isArray(selected) ? selected : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    else if (parser === "pi-table") {
+        const lines = raw.trim().split("\n");
+        const header = lines.findIndex((line) => /^provider\s+model\b/i.test(line.trim()));
+        values = header === -1 ? [] : lines.slice(header + 1).map((line) => {
+            const [provider, model] = line.trim().split(/\s+/);
+            return provider && model ? `${provider}/${model}` : "";
+        });
+    }
+    else {
+        values = raw.split("\n").map((line) => line.trim());
+    }
+    return [...new Set(values.filter((value) => typeof value === "string" && MODEL_ID_RE.test(value)))];
+}
+function declarativeAdapter(entry) {
+    const drive = entry.drive;
+    const adapter = {
+        id: entry.id,
+        vendor: entry.vendor,
+        probe: async () => {
+            const health = probeVersionShell(entry.binary);
+            if (!health.installed)
+                return health;
+            const version = health.version ?? "";
+            if (!new RegExp(entry.identity).test(version)) {
+                return {
+                    installed: true,
+                    authed: false,
+                    version,
+                    models: [],
+                    note: `identity mismatch for ${entry.binary}`,
+                    binaryPaths: health.binaryPaths,
+                };
+            }
+            return health;
+        },
+        channels: (cfg) => channelsFromConfig(entry.id, cfg),
+        headlessCommand: (promptFile, model) => renderDriveTemplate(drive.headless, promptFile, model),
+        interactiveCommand: (promptFile, model) => drive.interactive === null
+            ? null
+            : renderDriveTemplate(drive.interactive, promptFile, model),
+        invoke(_task, _cwd, assignment, ctx) {
+            return { command: this.headlessCommand(ctx.promptFile, assignment.model) };
+        },
+        parse: parseWorkerResult,
+        ...(drive.listModels ? {
+            listModels: async () => {
+                const { resolved } = resolveShellBinary(entry.binary);
+                if (!resolved)
+                    return [];
+                const cmd = [shq(resolved), ...drive.listModels.argv.map(shq)].join(" ");
+                const result = shellSpawnSync(cmd, process.cwd(), 15000);
+                return result.code === 0
+                    ? parseDeclaredModels(result.stdout, drive.listModels.parser, drive.listModels.path)
+                    : [];
+            },
+        } : {}),
+    };
+    declarativeBinaries.set(adapter, entry.binary);
+    return adapter;
+}
+export function adaptersFromCliEntries(entries) {
+    return projectCliEntries(entries).routable.map((entry) => {
+        if (isNativeCliDrive(entry.drive))
+            return entry.drive.adapter;
+        return declarativeAdapter(entry);
+    });
+}
 export function allAdapters(opts = {}) {
-    // pi + grok + kimi appended LAST: same-tier ties resolve by discovery order (Phase 6 D2), so
-    // appending keeps the Phase 6 shape→channel matrix byte-identical; inserting anywhere else
-    // silently reassigns shapes on same-tier ties. kimi is appended AFTER grok for the same reason.
-    const real = [claudeCode, codex, cursorAgent, opencode, pi, grok, kimi];
+    const entries = opts.cliEntries ?? catalogEntries({
+        operatorYaml: opts.operatorYaml,
+        operatorPath: opts.operatorPath,
+        herdrNames: [],
+    });
+    const real = adaptersFromCliEntries(entries);
     const fakePath = opts.fakeScriptPath ?? process.env.TICKMARKR_FAKE_SCRIPT;
     return fakePath ? [new FakeAdapter(fakePath), ...real] : real;
 }
@@ -233,58 +352,6 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
         ? reasonTail(output) || `probe exited ${code}`
         : undefined;
 }
-export const pendingAutoPreferKey = Symbol.for("tickmarkr.pendingAutoPrefer");
-const median = (xs) => {
-    const s = [...xs].sort((a, b) => a - b);
-    const m = Math.floor(s.length / 2);
-    return s.length % 2 ? s[m] : (s[m - 1] + s[m]) / 2;
-};
-// ponytail: 24h TTL matches plan.ts staleness — promote to config when an operator asks.
-export const DOCTOR_ROUTING_STALE_MS = 24 * 60 * 60 * 1000;
-export function deriveAutoPrefer(cfg, adapters, health, profile) {
-    const derivedAt = new Date().toISOString();
-    const out = { derivedAt };
-    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
-    for (const shape of Object.keys(cfg.routing.map)) {
-        const minTier = cfg.routing.floors[shape] ?? "cheap";
-        const ranked = [];
-        for (const a of adapters) {
-            const h = health[a.id];
-            if (!h?.installed || !h?.authed || typeof a.channels !== "function")
-                continue;
-            const qualifying = a.channels(cfg).filter((c) => TIER_RANK[c.tier] >= TIER_RANK[minTier] && h.modelAuth?.[c.model]?.authed === true);
-            if (!qualifying.length)
-                continue;
-            const durations = qualifying
-                .map((c) => h.modelAuth?.[c.model]?.durationMs)
-                .filter((d) => typeof d === "number");
-            ranked.push({
-                adapter: a.id,
-                mc: Math.min(...qualifying.map(marginalCostRank)),
-                dur: durations.length ? median(durations) : Number.POSITIVE_INFINITY,
-                learned: profile ? Math.max(...qualifying.map((c) => learnedScore(profile, shape, channelKey(c), c.channel))) : 0,
-            });
-        }
-        ranked.sort((a, b) => a.mc - b.mc || a.dur - b.dur || b.learned - a.learned);
-        out[shape] = ranked.map((r) => r.adapter);
-    }
-    return out;
-}
-export function readAutoPrefer(repoRoot) {
-    const raw = readDoctorFile(repoRoot);
-    if (!raw || typeof raw.autoPrefer !== "object" || raw.autoPrefer === null)
-        return null;
-    return raw.autoPrefer;
-}
-export function routingPreferContext(repoRoot, cfg, opts = {}) {
-    const age = doctorAgeMs(repoRoot);
-    const doctorFresh = age !== null && age <= DOCTOR_ROUTING_STALE_MS;
-    return {
-        autoPrefer: doctorFresh ? readAutoPrefer(repoRoot) ?? undefined : undefined,
-        doctorFresh,
-        overlayPreferShapes: overlayPreferShapes(repoRoot, opts),
-    };
-}
 const probeModelStatus = (v) => v.authed ? "ok" : v.reason?.includes("timed out") ? "timeout" : "failed";
 // v1.21: one bounded, headless call per configured model; detected-but-unclassified models never enter this loop.
 export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
@@ -296,7 +363,7 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         if (!h?.installed)
             return;
         // Tests inject FakeAdapter; never let an incidental default adapter spend a real token in the suite.
-        if (process.env.VITEST && [claudeCode, codex, cursorAgent, opencode, pi, grok, kimi].includes(a))
+        if (process.env.VITEST && SHIPPED_NATIVE_ADAPTERS.has(a))
             return;
         const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
@@ -360,7 +427,6 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         }
         h.modelAuth = verdicts;
     }));
-    health[pendingAutoPreferKey] = deriveAutoPrefer(cfg, adapters, health);
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
 // repo made ALL 4 time out where sequential passed 2/4 (suspected CLI self-contention).
@@ -388,20 +454,17 @@ function readDoctorFile(repoRoot) {
 }
 export function writeDoctor(repoRoot, health) {
     tickmarkrDir(repoRoot);
-    const pending = health[pendingAutoPreferKey];
-    const payload = { ...health };
-    delete payload[pendingAutoPreferKey];
-    if (pending)
-        payload.autoPrefer = pending;
     const path = doctorPath(repoRoot);
     const tmp = `${path}.tmp`;
-    writeFileSync(tmp, JSON.stringify(payload, null, 2) + "\n");
+    writeFileSync(tmp, JSON.stringify(health, null, 2) + "\n");
     renameSync(tmp, path);
 }
 export function readDoctor(repoRoot) {
     const raw = readDoctorFile(repoRoot);
     if (!raw)
         return null;
+    // pre-v1.86 caches may still carry an `autoPrefer` key — strip it; the mechanism is deleted and
+    // the key is never read back into health.
     const { autoPrefer: _, ...health } = raw;
     return health;
 }

package/dist/adapters/types.d.ts

@@ -86,6 +86,7 @@ export interface InputBox {
     fingerprint: string;
     match?(paneText: string): boolean;
     emptyMatch?(paneText: string): boolean;
+    occupiedMatch?(paneText: string): boolean;
     launchCommand?(command: string): boolean;
     readinessTimeoutMs?: number;
 }
@@ -93,6 +94,8 @@ export declare function declareInputBox(adapterId: string, inputBox: InputBox):
 export declare function declaredInputBoxForWorkerName(workerName: string): InputBox | undefined;
 export declare function matchesInputBox(paneText: string, inputBox: InputBox): boolean;
 export declare function matchesEmptyInputBox(paneText: string, inputBox: InputBox): boolean;
+export declare function matchesOccupiedInputBox(paneText: string, inputBox: InputBox): boolean;
+export declare function missingInputStateDeclarations(inputBox: InputBox | undefined): string[];
 export interface WorkerAdapter {
     id: string;
     vendor: string;

package/dist/adapters/types.js

@@ -45,13 +45,46 @@ export function matchesInputBox(paneText, inputBox) {
 export function matchesEmptyInputBox(paneText, inputBox) {
     return inputBox.emptyMatch?.(paneText) === true;
 }
+// The OCCUPIED state: the adapter's own pin when it has one, else painted-and-not-empty, which two
+// adapter declarations decide between them. Either way the answer comes from the adapter, never from
+// where the prompt happens to sit in the transcript.
+export function matchesOccupiedInputBox(paneText, inputBox) {
+    if (inputBox.occupiedMatch)
+        return inputBox.occupiedMatch(paneText) === true;
+    return matchesInputBox(paneText, inputBox) && !matchesEmptyInputBox(paneText, inputBox);
+}
+// v1.85 T5: which input-state declarations a typed delivery needs and this adapter has not made.
+// Empty is always required (it is the only positive submission evidence); occupied needs either its
+// own matcher or the `match` that derives it. A non-empty result is a fail-closed refusal, named.
+export function missingInputStateDeclarations(inputBox) {
+    if (!inputBox)
+        return ["inputBox"];
+    const missing = [];
+    if (!inputBox.emptyMatch)
+        missing.push("emptyMatch");
+    if (!inputBox.occupiedMatch && !inputBox.match)
+        missing.push("occupiedMatch");
+    return missing;
+}
 export function channelsFromConfig(adapterId, cfg) {
     const e = cfg.tiers[adapterId];
     if (!e)
         return [];
-    return Object.entries(e.models).map(([model, tier]) => ({
-        adapter: adapterId, vendor: e.vendor, model, channel: e.channel, tier,
-    }));
+    return Object.entries(e.models).flatMap(([model, tier]) => {
+        const override = e.modelOverrides?.[model];
+        const vendor = override?.vendor ?? e.vendor;
+        // Parsed configs guarantee this only occurs for invalid data, but direct callers must fail closed
+        // too: an undeclared vendor is not review diversity and provider prefixes are never provenance.
+        if (!vendor?.trim())
+            return [];
+        return [{
+                adapter: adapterId,
+                vendor,
+                model,
+                channel: override?.channel ?? e.channel,
+                tier,
+            }];
+    });
 }
 export function channelKey(c) {
     return `${c.adapter}:${c.model}`;