tickmarkr 1.85.0 → 1.87.0

package/dist/adapters/prompt.js

@@ -1,6 +1,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { renderAcceptanceItem } from "../graph/schema.js";
+import { classifyVerdictCause } from "../gates/verdict-cause.js";
 export function buildTaskPrompt(task, feedback = "", nonce = "") {
     const list = (xs) => xs.map((x) => `- ${x}`).join("\n");
     return `You are an autonomous coding worker dispatched by tickmarkr into an isolated git worktree.
@@ -41,15 +42,22 @@ function trailerTokenPositions(raw, nonce) {
         positions.push(i);
     return positions;
 }
+// The worker protocol binds participation in the nonce-bearing TICKMARKR_RESULT token outside its
+// JSON object, while judge/review/consult bind it inside the object. Parsing has already rejected every
+// candidate by the time this runs, so canonicalize that token with the `ok` key this boundary requests;
+// the shared classifier still owns the resulting cause and callers cannot infer one from token count.
+function workerVerdictWitness(raw, nonce, positions) {
+    if (positions.length === 0)
+        return raw;
+    return `{"nonce":${JSON.stringify(nonce)},"ok":false,`;
+}
 // v1.65 T1: the parse boundary's own no-trailer sentinel summaries. classifyDeadChannel keys on
 // these — a result carrying any other summary is a PARSED trailer, i.e. the worker speaking.
 export const NO_TRAILER_SUMMARY = "worker produced no TICKMARKR_RESULT trailer";
 export const UNPARSEABLE_TRAILER_SUMMARY = "unparseable TICKMARKR_RESULT trailer";
 export function parseWorkerResult(raw, nonce) {
-    const fail = (summary) => ({ ok: false, summary, deviations: [], raw });
+    const fail = (summary, cause) => ({ ok: false, summary, deviations: [], raw, cause });
     const positions = trailerTokenPositions(raw, nonce);
-    if (positions.length === 0)
-        return fail(NO_TRAILER_SUMMARY);
     // TUIs echo the prompt template, redraw lines, and HARD-wrap the JSON with per-line margins
     // (cursor does; recent-unwrapped can't rejoin hard newlines). Scan occurrences backward — last
     // parseable wins — joining wrapped lines, stripping margin/box chrome, and growing the candidate
@@ -79,7 +87,8 @@ export function parseWorkerResult(raw, nonce) {
             }
         }
     }
-    return fail(UNPARSEABLE_TRAILER_SUMMARY);
+    const cause = classifyVerdictCause(workerVerdictWitness(raw, nonce, positions), nonce, "ok");
+    return fail(cause === "malformed-verdict" ? UNPARSEABLE_TRAILER_SUMMARY : NO_TRAILER_SUMMARY, cause);
 }
 // Signatures anchor distinctive CLI-error phrasing — never bare fragments or bare status-code
 // numbers (the QUOTA_RE Pitfall-3 lesson): these run only over no-trailer output, but a stalled

package/dist/adapters/registry.d.ts

@@ -1,9 +1,10 @@
 import { type TickmarkrConfig } from "../config/config.js";
-import { type RoutingProfile } from "../route/profile.js";
+import { type PreferenceRole } from "../route/preference.js";
+import { type CatalogEntriesOptions, type CliEntry, type ModelIdField } from "./catalog.js";
 import { type AuthHealth, type BillingChannel, type WorkerAdapter } from "./types.js";
-export declare const CANDIDATE_CLI_CATALOG: readonly ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
-export declare const REGISTERED_ADAPTER_BINARIES: readonly ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
-export declare function resolveShellBinary(bin: string, cwd?: string): {
+export declare const CANDIDATE_CLI_CATALOG: readonly string[];
+export declare function registeredAdapterBinaries(adapters?: WorkerAdapter[]): string[];
+export declare function resolveShellBinary(bin: string, cwd?: string, pathEnv?: string): {
     resolved?: string;
     all: string[];
 };
@@ -27,44 +28,50 @@ export declare function modelAliasLine(excluded: {
 }[]): string;
 export type CandidateCliDetection = {
     binary: string;
-    version: string | undefined;
+    path: string;
 };
-export declare function probeCandidateVersion(bin: string): string | undefined;
-export declare function detectCandidateClis(opts?: {
+export declare function parseHerdrCliNames(help: string): string[];
+export declare function herdrNominatedCliNames(cwd?: string, pathEnv?: string): string[];
+export interface DetectCandidateCliOptions extends CatalogEntriesOptions {
+    cwd?: string;
     pathEnv?: string;
-}): CandidateCliDetection[];
-export declare function formatCandidateCliRow({ binary, version }: CandidateCliDetection): string;
+    entries?: readonly CliEntry[];
+    adapters?: WorkerAdapter[];
+    resolveBinary?: (binary: string) => {
+        resolved?: string;
+        all: string[];
+    };
+}
+export declare function detectCandidateClis(opts?: DetectCandidateCliOptions): CandidateCliDetection[];
+export declare function formatCandidateCliRow({ binary, path }: CandidateCliDetection): string;
 export declare function probeHelpText(bin: string): string | undefined;
 export declare function missingDeclaredFlags(helpText: string, flags: string[]): string[];
 export declare function flagDriftWarnings(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, helpOf?: (bin: string) => string | undefined): string[];
-export declare function allAdapters(opts?: {
+export interface DeclaredModels {
+    models: string[];
+    reason?: string;
+}
+export declare function parseDeclaredModels(raw: string, parser: "lines" | "pi-table" | "json", path?: string, field?: ModelIdField): DeclaredModels;
+export declare function adaptersFromCliEntries(entries: readonly CliEntry[]): WorkerAdapter[];
+export interface AllAdaptersOptions {
     fakeScriptPath?: string;
-}): WorkerAdapter[];
+    cliEntries?: readonly CliEntry[];
+    operatorYaml?: string | null;
+    operatorPath?: string | false;
+}
+export declare function allAdapters(opts?: AllAdaptersOptions): WorkerAdapter[];
 export declare function getAdapter(id: string, adapters: WorkerAdapter[]): WorkerAdapter;
 export declare function probeAll(adapters: WorkerAdapter[], opts?: {
     cwd?: string;
 }): Promise<Record<string, AuthHealth>>;
 export type ProbeModelStatus = "ok" | "timeout" | "failed";
 export type ProbeModelProgress = (adapter: string, model: string, status: ProbeModelStatus, durationMs: number) => void;
-export interface AutoPreferDoc {
-    derivedAt: string;
-    [shape: string]: string[] | string;
-}
-export declare const pendingAutoPreferKey: unique symbol;
-export declare const DOCTOR_ROUTING_STALE_MS: number;
-export declare function deriveAutoPrefer(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, profile?: RoutingProfile): AutoPreferDoc;
-export declare function readAutoPrefer(repoRoot: string): AutoPreferDoc | null;
-export declare function routingPreferContext(repoRoot: string, cfg: TickmarkrConfig, opts?: {
-    globalDir?: string;
-}): {
-    autoPrefer?: AutoPreferDoc;
-    doctorFresh: boolean;
-    overlayPreferShapes: ReadonlySet<string>;
-};
 export declare function probeModels(cfg: TickmarkrConfig, repoRoot: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, onProgress?: ProbeModelProgress): Promise<void>;
 export declare function writeDoctor(repoRoot: string, health: Record<string, AuthHealth>): void;
 export declare function readDoctor(repoRoot: string): Record<string, AuthHealth> | null;
-export declare function discoverChannels(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): BillingChannel[];
+export declare function discoverChannels(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, role?: PreferenceRole): BillingChannel[];
+export declare const PREFERENCE_ROLES: readonly ["worker", "judge", "review", "consult"];
+export declare function rolePools(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): Record<PreferenceRole, BillingChannel[]>;
 export declare function servableExclusions(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): {
     key: string;
     adapter: string;

package/dist/adapters/registry.js

@@ -1,29 +1,33 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { overlayPreferShapes, TIER_RANK } from "../config/config.js";
 import { modelLints, suggestOverlay } from "./model-lints.js";
 import { HerdrDriver } from "../drivers/herdr.js";
 import { tickmarkrDir, stateDirName } from "../graph/graph.js";
 import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../route/preference.js";
-import { learnedScore } from "../route/profile.js";
-import { marginalCostRank } from "../route/router.js";
 import { sh } from "../run/git.js";
-import { claudeCode } from "./claude-code.js";
-import { codex } from "./codex.js";
-import { cursorAgent } from "./cursor-agent.js";
 import { FakeAdapter } from "./fake.js";
-import { grok } from "./grok.js";
-import { kimi } from "./kimi.js";
-import { opencode } from "./opencode.js";
-import { pi } from "./pi.js";
+import { parseWorkerResult } from "./prompt.js";
 import { sealHerdrEnv } from "../drivers/subprocess.js";
-import { channelKey, modelAuthed, QUOTA_RE, shq } from "./types.js";
-// Agent-CLI binary names with no tickmarkr adapter — doctor sweeps these advisory-only (v1.48 T1).
-export const CANDIDATE_CLI_CATALOG = ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
-// Binaries probed by registered adapters — kept beside the catalog so a test can forbid overlap.
-export const REGISTERED_ADAPTER_BINARIES = ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
+import { catalogEntries, isNativeCliDrive, projectCliEntries, SHIPPED_CLI_CATALOG, } from "./catalog.js";
+import { channelKey, channelsFromConfig, modelAuthed, MODEL_ID_RE, QUOTA_RE, shq, } from "./types.js";
+// Compatibility projection for callers/tests that only need shipped advisory names. The literal
+// list is gone: both advisory and routable catalog views derive from SHIPPED_CLI_CATALOG. Native
+// definitions (claudeCode, codex, cursorAgent, opencode, pi, grok, kimi) are owned by catalog.ts;
+// this registry consumes their drive contracts instead of restating their registration order.
+export const CANDIDATE_CLI_CATALOG = SHIPPED_CLI_CATALOG
+    .filter((entry) => entry.drive === undefined)
+    .map((entry) => entry.binary);
+const SHIPPED_NATIVE_ADAPTERS = new Set(SHIPPED_CLI_CATALOG.flatMap((entry) => isNativeCliDrive(entry.drive) ? [entry.drive.adapter] : []));
+const declarativeBinaries = new WeakMap();
+// OBS-304: this was a hand-maintained mirror of the registered binaries, and the guard test that
+// forbids catalog overlap checked against IT rather than against the adapters — so when kimi gained
+// an adapter and nobody updated the copy, the guard kept passing on a collision it existed to catch.
+// Derive it. A list that restates another list is the defect, not the entry that fell out of sync.
+export function registeredAdapterBinaries(adapters = allAdapters()) {
+    return adapters.map((a) => a.hardcodedFlags?.binary ?? declarativeBinaries.get(a)).filter((b) => !!b);
+}
 // OBS-117: worker panes run commands through `bash -lc` (SubprocessDriver + sh()), not bare spawnSync(bin).
 // Doctor must resolve adapter binaries the same way so a shadow install on PATH cannot disagree with dispatch.
 function shellSpawnSync(cmd, cwd, timeoutMs = 10000) {
@@ -36,9 +40,24 @@ function shellSpawnSync(cmd, cwd, timeoutMs = 10000) {
     });
     return { code: r.status ?? 1, stdout: (r.stdout || "").trim(), stderr: (r.stderr || "").trim() };
 }
-export function resolveShellBinary(bin, cwd = process.cwd()) {
-    const r = shellSpawnSync(`type -a ${shq(bin)} 2>/dev/null | sed -n 's/^.* is \\(.*\\)$/\\1/p'`, cwd);
-    const all = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+export function resolveShellBinary(bin, cwd = process.cwd(), pathEnv) {
+    // An explicit PATH is a deterministic fixture/operator boundary. The default remains the same
+    // login-shell environment used by dispatched workers (OBS-117).
+    const pathPrefix = pathEnv === undefined ? "" : `export PATH=${shq(pathEnv)}; `;
+    const r = shellSpawnSync(`${pathPrefix}type -a ${shq(bin)} 2>/dev/null | sed -n 's/^.* is \\(.*\\)$/\\1/p'`, cwd);
+    const hits = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    // OBS-304: a duplicated PATH entry makes `type -a` emit the SAME path twice, which doctor then
+    // reported as "2 installs on PATH — …/claude, …/claude". Count distinct real files, so the real
+    // shadows (codex: homebrew + nvm) stop being buried in noise. realpath resolves symlinked twins.
+    const seen = new Set();
+    const all = hits.filter((p) => {
+        let key = p;
+        try {
+            key = realpathSync(p);
+        }
+        catch { /* unreadable or dangling — fall back to the literal path */ }
+        return seen.has(key) ? false : (seen.add(key), true);
+    });
     return { resolved: all[0], all };
 }
 export function probeVersionShell(bin, cwd = process.cwd()) {
@@ -101,39 +120,47 @@ export function modelAliasLine(excluded) {
     const parts = excluded.map(({ key, adapter }) => `${key} (not in ${adapter}'s reported model list)`);
     return `model alias: ${excluded.length} channel(s) invalid — ${parts.join(", ")}`;
 }
-function candidateOnPath(bin, pathEnv) {
-    const r = spawnSync("which", [bin], { encoding: "utf8", env: { ...process.env, PATH: pathEnv } });
-    return r.status === 0 && r.stdout.trim().length > 0;
+// Herdr's supported-kind help is nomination data only. Parse the closed token list and discard
+// everything else before any name can reach a shell resolver.
+export function parseHerdrCliNames(help) {
+    const body = /\[possible values:\s*([^\]]+)\]/m.exec(help)?.[1] ?? "";
+    return [...new Set(body.split(",").map((name) => name.trim()).filter((name) => /^[a-z0-9-]+$/.test(name)))];
 }
-// Fail open: a broken candidate binary never throws and never fails doctor.
-export function probeCandidateVersion(bin) {
-    try {
-        const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000 });
-        if (r.error || r.status !== 0)
-            return undefined;
-        return (r.stdout || r.stderr).trim().split("\n")[0];
-    }
-    catch {
-        return undefined;
-    }
+export function herdrNominatedCliNames(cwd = process.cwd(), pathEnv) {
+    // This asks a known driver binary for static help. It is deliberately NOT gated on
+    // HerdrDriver.available(), which reports HERDR_ENV rather than binary presence.
+    const { resolved } = resolveShellBinary("herdr", cwd, pathEnv);
+    if (!resolved)
+        return [];
+    const r = shellSpawnSync(`${shq(resolved)} agent start --help`, cwd);
+    return r.code === 0 ? parseHerdrCliNames(`${r.stdout}\n${r.stderr}`) : [];
 }
 export function detectCandidateClis(opts = {}) {
-    const pathEnv = opts.pathEnv ?? process.env.PATH ?? "";
-    const out = [];
-    for (const bin of CANDIDATE_CLI_CATALOG) {
-        if (!candidateOnPath(bin, pathEnv))
-            continue;
-        out.push({ binary: bin, version: probeCandidateVersion(bin) });
+    const cwd = opts.cwd ?? process.cwd();
+    const entries = opts.entries ?? catalogEntries({
+        shipped: opts.shipped,
+        operatorYaml: opts.operatorYaml,
+        operatorPath: opts.operatorPath,
+        herdrNames: opts.herdrNames ?? herdrNominatedCliNames(cwd, opts.pathEnv),
+    });
+    const registered = new Set(registeredAdapterBinaries(opts.adapters ?? allAdapters({ cliEntries: entries })));
+    const advisory = projectCliEntries(entries).advisory.filter((entry) => !registered.has(entry.binary));
+    const resolveBinary = opts.resolveBinary
+        ?? ((binary) => resolveShellBinary(binary, cwd, opts.pathEnv));
+    const discovered = [];
+    for (const entry of advisory) {
+        const { resolved } = resolveBinary(entry.binary);
+        if (resolved)
+            discovered.push({ binary: entry.binary, path: resolved });
     }
-    return out;
+    return discovered;
 }
-export function formatCandidateCliRow({ binary, version }) {
-    const ver = version ?? "version unknown";
-    return `  ! ${binary.padEnd(14)} detected: ${ver} (no tickmarkr adapter — not routable)`;
+export function formatCandidateCliRow({ binary, path }) {
+    return `  ! ${binary.padEnd(14)} detected at ${path} (no drive contract — not routable)`;
 }
-// v1.65 T3: same guarded spawn pattern as probeCandidateVersion — bounded, error/status-checked,
-// fail-open. undefined = binary unavailable/broken ⇒ no drift verdict (the existing auth reporting
-// already names an uninstalled CLI; drift must never pile on).
+// v1.65 T3: bounded, error/status-checked and fail-open. Unlike candidate detection above, this
+// executes only registered adapter binaries with drive contracts. undefined = unavailable/broken,
+// so no drift verdict piles onto the existing auth report.
 export function probeHelpText(bin) {
     try {
         const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000 });
@@ -169,11 +196,133 @@ export function flagDriftWarnings(adapters, health, helpOf = probeHelpText) {
     }
     return out;
 }
+function renderDriveTemplate(template, promptFile, model) {
+    return template.replaceAll("{promptFile}", shq(promptFile)).replaceAll("{model}", shq(model));
+}
+function valueAtPath(value, path) {
+    if (!path)
+        return value;
+    return path.split(".").reduce((cursor, part) => {
+        if (!cursor || typeof cursor !== "object")
+            return undefined;
+        return cursor[part];
+    }, value);
+}
+export function parseDeclaredModels(raw, parser, path, field) {
+    let values;
+    if (parser === "json") {
+        let root;
+        try {
+            root = JSON.parse(raw);
+        }
+        catch {
+            return { models: [], reason: "malformed JSON: the output did not parse" };
+        }
+        const selected = valueAtPath(root, path);
+        if (!Array.isArray(selected)) {
+            return { models: [], reason: `no array at ${path ? `path "${path}"` : "the JSON root"}` };
+        }
+        // One key per entry, and only the configured one — and `ModelIdField` is an id-key allowlist, so
+        // `cost` and `provider` are not spellable here: no price, no vendor, no whole object.
+        values = field === undefined
+            ? selected
+            : selected.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry)
+                ? entry[field]
+                : undefined);
+        if (selected.length > 0 && !values.some((value) => typeof value === "string")) {
+            return {
+                models: [],
+                reason: field === undefined
+                    ? `${selected.length} entries are not id strings and no field is configured`
+                    : `no string field "${field}" on any of the ${selected.length} entries`,
+            };
+        }
+    }
+    else if (parser === "pi-table") {
+        const lines = raw.trim().split("\n");
+        const header = lines.findIndex((line) => /^provider\s+model\b/i.test(line.trim()));
+        values = header === -1 ? [] : lines.slice(header + 1).map((line) => {
+            const [provider, model] = line.trim().split(/\s+/);
+            return provider && model ? `${provider}/${model}` : "";
+        });
+    }
+    else {
+        values = raw.split("\n").map((line) => line.trim());
+    }
+    // Blanks are structural padding in every parser (trailing newline, headerless table row), never a
+    // rejected id — counting them would make "all values rejected" fire on a healthy list.
+    const candidates = values.filter((value) => typeof value === "string" && value.length > 0);
+    const models = [...new Set(candidates.filter((value) => MODEL_ID_RE.test(value)))];
+    if (models.length === 0 && candidates.length > 0) {
+        return { models, reason: `all ${candidates.length} listed values were rejected by the model-id format` };
+    }
+    return { models };
+}
+function declarativeAdapter(entry) {
+    const drive = entry.drive;
+    const adapter = {
+        id: entry.id,
+        vendor: entry.vendor,
+        probe: async () => {
+            const health = probeVersionShell(entry.binary);
+            if (!health.installed)
+                return health;
+            const version = health.version ?? "";
+            if (!new RegExp(entry.identity).test(version)) {
+                return {
+                    installed: true,
+                    authed: false,
+                    version,
+                    models: [],
+                    note: `identity mismatch for ${entry.binary}`,
+                    binaryPaths: health.binaryPaths,
+                };
+            }
+            return health;
+        },
+        channels: (cfg) => channelsFromConfig(entry.id, cfg),
+        headlessCommand: (promptFile, model) => renderDriveTemplate(drive.headless, promptFile, model),
+        interactiveCommand: (promptFile, model) => drive.interactive === null
+            ? null
+            : renderDriveTemplate(drive.interactive, promptFile, model),
+        invoke(_task, _cwd, assignment, ctx) {
+            return { command: this.headlessCommand(ctx.promptFile, assignment.model) };
+        },
+        parse: parseWorkerResult,
+        ...(drive.listModels ? {
+            listModels: async () => {
+                const { resolved } = resolveShellBinary(entry.binary);
+                if (!resolved)
+                    return [];
+                const cmd = [shq(resolved), ...drive.listModels.argv.map(shq)].join(" ");
+                const result = shellSpawnSync(cmd, process.cwd(), 15000);
+                if (result.code !== 0)
+                    return [];
+                const { models, reason } = parseDeclaredModels(result.stdout, drive.listModels.parser, drive.listModels.path, drive.listModels.field);
+                // Listing stays advisory (fail-open to []), but never silently: an empty projection names why.
+                if (models.length === 0 && reason)
+                    console.warn(`tickmarkr: ${entry.id} listed no models — ${reason}`);
+                return models;
+            },
+        } : {}),
+    };
+    declarativeBinaries.set(adapter, entry.binary);
+    return adapter;
+}
+export function adaptersFromCliEntries(entries) {
+    return projectCliEntries(entries).routable.map((entry) => {
+        if (isNativeCliDrive(entry.drive))
+            return entry.drive.adapter;
+        return declarativeAdapter(entry);
+    });
+}
 export function allAdapters(opts = {}) {
-    // pi + grok + kimi appended LAST: same-tier ties resolve by discovery order (Phase 6 D2), so
-    // appending keeps the Phase 6 shape→channel matrix byte-identical; inserting anywhere else
-    // silently reassigns shapes on same-tier ties. kimi is appended AFTER grok for the same reason.
-    const real = [claudeCode, codex, cursorAgent, opencode, pi, grok, kimi];
+    const entries = opts.cliEntries ?? catalogEntries({
+        operatorYaml: opts.operatorYaml,
+        operatorPath: opts.operatorPath,
+        herdrNames: [],
+    });
+    const real = adaptersFromCliEntries(entries);
     const fakePath = opts.fakeScriptPath ?? process.env.TICKMARKR_FAKE_SCRIPT;
     return fakePath ? [new FakeAdapter(fakePath), ...real] : real;
 }
@@ -233,58 +382,6 @@ function probeFailure(code, stdout, stderr, timedOut, timeoutMs = MODEL_PROBE_TI
         ? reasonTail(output) || `probe exited ${code}`
         : undefined;
 }
-export const pendingAutoPreferKey = Symbol.for("tickmarkr.pendingAutoPrefer");
-const median = (xs) => {
-    const s = [...xs].sort((a, b) => a - b);
-    const m = Math.floor(s.length / 2);
-    return s.length % 2 ? s[m] : (s[m - 1] + s[m]) / 2;
-};
-// ponytail: 24h TTL matches plan.ts staleness — promote to config when an operator asks.
-export const DOCTOR_ROUTING_STALE_MS = 24 * 60 * 60 * 1000;
-export function deriveAutoPrefer(cfg, adapters, health, profile) {
-    const derivedAt = new Date().toISOString();
-    const out = { derivedAt };
-    // v1.52 T5: routing.floors is the only band authority — a map entry can no longer carry a tier.
-    for (const shape of Object.keys(cfg.routing.map)) {
-        const minTier = cfg.routing.floors[shape] ?? "cheap";
-        const ranked = [];
-        for (const a of adapters) {
-            const h = health[a.id];
-            if (!h?.installed || !h?.authed || typeof a.channels !== "function")
-                continue;
-            const qualifying = a.channels(cfg).filter((c) => TIER_RANK[c.tier] >= TIER_RANK[minTier] && h.modelAuth?.[c.model]?.authed === true);
-            if (!qualifying.length)
-                continue;
-            const durations = qualifying
-                .map((c) => h.modelAuth?.[c.model]?.durationMs)
-                .filter((d) => typeof d === "number");
-            ranked.push({
-                adapter: a.id,
-                mc: Math.min(...qualifying.map(marginalCostRank)),
-                dur: durations.length ? median(durations) : Number.POSITIVE_INFINITY,
-                learned: profile ? Math.max(...qualifying.map((c) => learnedScore(profile, shape, channelKey(c), c.channel))) : 0,
-            });
-        }
-        ranked.sort((a, b) => a.mc - b.mc || a.dur - b.dur || b.learned - a.learned);
-        out[shape] = ranked.map((r) => r.adapter);
-    }
-    return out;
-}
-export function readAutoPrefer(repoRoot) {
-    const raw = readDoctorFile(repoRoot);
-    if (!raw || typeof raw.autoPrefer !== "object" || raw.autoPrefer === null)
-        return null;
-    return raw.autoPrefer;
-}
-export function routingPreferContext(repoRoot, cfg, opts = {}) {
-    const age = doctorAgeMs(repoRoot);
-    const doctorFresh = age !== null && age <= DOCTOR_ROUTING_STALE_MS;
-    return {
-        autoPrefer: doctorFresh ? readAutoPrefer(repoRoot) ?? undefined : undefined,
-        doctorFresh,
-        overlayPreferShapes: overlayPreferShapes(repoRoot, opts),
-    };
-}
 const probeModelStatus = (v) => v.authed ? "ok" : v.reason?.includes("timed out") ? "timeout" : "failed";
 // v1.21: one bounded, headless call per configured model; detected-but-unclassified models never enter this loop.
 export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
@@ -296,7 +393,7 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         if (!h?.installed)
             return;
         // Tests inject FakeAdapter; never let an incidental default adapter spend a real token in the suite.
-        if (process.env.VITEST && [claudeCode, codex, cursorAgent, opencode, pi, grok, kimi].includes(a))
+        if (process.env.VITEST && SHIPPED_NATIVE_ADAPTERS.has(a))
             return;
         const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
@@ -360,7 +457,6 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         }
         h.modelAuth = verdicts;
     }));
-    health[pendingAutoPreferKey] = deriveAutoPrefer(cfg, adapters, health);
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
 // repo made ALL 4 time out where sequential passed 2/4 (suspected CLI self-contention).
@@ -388,24 +484,25 @@ function readDoctorFile(repoRoot) {
 }
 export function writeDoctor(repoRoot, health) {
     tickmarkrDir(repoRoot);
-    const pending = health[pendingAutoPreferKey];
-    const payload = { ...health };
-    delete payload[pendingAutoPreferKey];
-    if (pending)
-        payload.autoPrefer = pending;
     const path = doctorPath(repoRoot);
     const tmp = `${path}.tmp`;
-    writeFileSync(tmp, JSON.stringify(payload, null, 2) + "\n");
+    writeFileSync(tmp, JSON.stringify(health, null, 2) + "\n");
     renameSync(tmp, path);
 }
 export function readDoctor(repoRoot) {
     const raw = readDoctorFile(repoRoot);
     if (!raw)
         return null;
+    // pre-v1.86 caches may still carry an `autoPrefer` key — strip it; the mechanism is deleted and
+    // the key is never read back into health.
     const { autoPrefer: _, ...health } = raw;
     return health;
 }
-export function discoverChannels(cfg, adapters, health) {
+// v1.87 T2: `role` is optional and defaults to "worker", so every pre-existing two/three-argument
+// call keeps its exact present behaviour — the worker pool. A non-worker role reads the SAME fleet
+// through its own deny scope: a worker-only deny (routing.deny.workers) benches a channel for
+// dispatch while leaving it eligible to judge, review or consult the work.
+export function discoverChannels(cfg, adapters, health, role = "worker") {
     const base = adapters
         .filter((a) => health[a.id]?.installed && health[a.id]?.authed)
         .flatMap((a) => {
@@ -420,7 +517,13 @@ export function discoverChannels(cfg, adapters, health) {
     });
     if (!cfg.routing.allow && !cfg.routing.deny)
         return base;
-    return base.filter((c) => disallowedBy(c, cfg.routing) === null);
+    return base.filter((c) => disallowedBy(c, cfg.routing, role) === null);
+}
+// v1.87 T2: the role-scoped pool builder. One doctor probe, one discovery pass per role — so the
+// daemon hands each seat the pool its own policy allows instead of handing everyone the worker list.
+export const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
+export function rolePools(cfg, adapters, health) {
+    return Object.fromEntries(PREFERENCE_ROLES.map((role) => [role, discoverChannels(cfg, adapters, health, role)]));
 }
 // HYG-07(a): the channels discoverChannels silently dropped because their model isn't in the adapter's
 // served list (the HYG-05 filter above). Computed from the SAME inputs as the drop (a.channels(cfg), not

package/dist/adapters/types.js

@@ -70,9 +70,21 @@ export function channelsFromConfig(adapterId, cfg) {
     const e = cfg.tiers[adapterId];
     if (!e)
         return [];
-    return Object.entries(e.models).map(([model, tier]) => ({
-        adapter: adapterId, vendor: e.vendor, model, channel: e.channel, tier,
-    }));
+    return Object.entries(e.models).flatMap(([model, tier]) => {
+        const override = e.modelOverrides?.[model];
+        const vendor = override?.vendor ?? e.vendor;
+        // Parsed configs guarantee this only occurs for invalid data, but direct callers must fail closed
+        // too: an undeclared vendor is not review diversity and provider prefixes are never provenance.
+        if (!vendor?.trim())
+            return [];
+        return [{
+                adapter: adapterId,
+                vendor,
+                model,
+                channel: override?.channel ?? e.channel,
+                tier,
+            }];
+    });
 }
 export function channelKey(c) {
     return `${c.adapter}:${c.model}`;

package/dist/brand.d.ts

@@ -16,7 +16,11 @@ export declare function bannerShell(): string;
 export declare const TICKMARKR_EXIT_TRAILER = "printf '\\nTICKMARKR_''EXIT:%s\\n' $?";
 /** OBS-50: visible-pane bootstrap script — banner + agent command + byte-identical exit trailer. */
 export declare function paneDispatchScript(body: string[]): string;
-/** OBS-50: one short herdr pane-run line; bootstrap lives in the script file beside the prompt. */
+/** Record that the command being passed directly to ExecutorDriver.run is a daemon-built launch. */
+export declare function paneLaunchCommand(command: string): string;
+/** Driver-side half of paneLaunchCommand's one-shot handoff. */
+export declare function consumePaneLaunchIntent(): boolean;
+/** OBS-50/342: one short, intent-bearing pane-run line; bootstrap lives beside the prompt. */
 export declare function paneDispatchCommand(scriptPath: string): string;
 /** The settled brand green ramp (256-color), bright → deep. */
 export declare const BRAND_RAMP: readonly [84, 78, 41, 35];

package/dist/brand.js

@@ -78,9 +78,25 @@ export const TICKMARKR_EXIT_TRAILER = `printf '\\nTICKMARKR_''EXIT:%s\\n' $?`;
 export function paneDispatchScript(body) {
     return ["export BASH_SILENCE_DEPRECATION_WARNING=1", ...body, TICKMARKR_EXIT_TRAILER].join("\n");
 }
-/** OBS-50: one short herdr pane-run line; bootstrap lives in the script file beside the prompt. */
+const pendingPaneLaunchIntents = [];
+/** Record that the command being passed directly to ExecutorDriver.run is a daemon-built launch. */
+export function paneLaunchCommand(command) {
+    const intent = { kind: "launch" };
+    pendingPaneLaunchIntents.push(intent);
+    queueMicrotask(() => {
+        const index = pendingPaneLaunchIntents.indexOf(intent);
+        if (index >= 0)
+            pendingPaneLaunchIntents.splice(index, 1);
+    });
+    return command;
+}
+/** Driver-side half of paneLaunchCommand's one-shot handoff. */
+export function consumePaneLaunchIntent() {
+    return pendingPaneLaunchIntents.shift()?.kind === "launch";
+}
+/** OBS-50/342: one short, intent-bearing pane-run line; bootstrap lives beside the prompt. */
 export function paneDispatchCommand(scriptPath) {
-    return `bash ${shq(scriptPath)}`;
+    return paneLaunchCommand(`bash ${shq(scriptPath)}`);
 }
 // ── design system (v1.50) ── contract: docs/codebase/CLI-DESIGN.md ──────────
 // Every cockpit surface styles through these tokens/glyphs/helpers. Styled only

package/dist/cli/commands/doctor.d.ts

@@ -1,9 +1,12 @@
 import { type ClaudeAlias } from "../../adapters/claude-code.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import { type KimiDoctorTurnResult } from "../../adapters/kimi.js";
+import { type CatalogReadResult } from "../../adapters/catalog-remote.js";
 export type DoctorOpts = {
     banner?: boolean;
     kimiTurnProbe?: (cwd: string) => Promise<KimiDoctorTurnResult>;
     resolveClaudeAliasIdentity?: (cwd: string, alias: ClaudeAlias) => string | undefined;
+    catalog?: CatalogReadResult;
+    catalogNow?: () => Date;
 };
 export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[], opts?: DoctorOpts): Promise<string>;