tickmarkr 1.86.0 → 1.89.0

package/dist/adapters/catalog.d.ts

@@ -1,9 +1,20 @@
 import { z } from "zod";
-import type { WorkerAdapter } from "./types.js";
+import { type WorkerAdapter } from "./types.js";
 export declare const CLI_NAME_RE: RegExp;
+export declare const MODEL_ID_FIELDS: readonly ["id", "selector", "model"];
+export type ModelIdField = (typeof MODEL_ID_FIELDS)[number];
+export declare const DRIVE_TRUST_DIALOG_MESSAGE = "drive contract must declare trustDialog \u2014 either the workspace-trust prompt this CLI renders, captured verbatim as {fingerprint, key}, or {kind: none, reason}";
 export declare const CliDriveSchema: z.ZodObject<{
     headless: z.ZodString;
     interactive: z.ZodNullable<z.ZodString>;
+    trustDialog: z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+        fingerprint: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"none">;
+        reason: z.ZodString;
+    }, z.core.$strict>]>;
     listModels: z.ZodOptional<z.ZodObject<{
         argv: z.ZodArray<z.ZodString>;
         parser: z.ZodEnum<{
@@ -12,6 +23,11 @@ export declare const CliDriveSchema: z.ZodObject<{
             json: "json";
         }>;
         path: z.ZodOptional<z.ZodString>;
+        field: z.ZodOptional<z.ZodEnum<{
+            id: "id";
+            model: "model";
+            selector: "selector";
+        }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 declare const CliEntryBaseSchema: z.ZodObject<{
@@ -28,6 +44,14 @@ export declare const CliEntrySchema: z.ZodObject<{
     drive: z.ZodOptional<z.ZodObject<{
         headless: z.ZodString;
         interactive: z.ZodNullable<z.ZodString>;
+        trustDialog: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+            fingerprint: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"none">;
+            reason: z.ZodString;
+        }, z.core.$strict>]>;
         listModels: z.ZodOptional<z.ZodObject<{
             argv: z.ZodArray<z.ZodString>;
             parser: z.ZodEnum<{
@@ -36,6 +60,11 @@ export declare const CliEntrySchema: z.ZodObject<{
                 json: "json";
             }>;
             path: z.ZodOptional<z.ZodString>;
+            field: z.ZodOptional<z.ZodEnum<{
+                id: "id";
+                model: "model";
+                selector: "selector";
+            }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/adapters/catalog.js

@@ -10,15 +10,39 @@ import { grok } from "./grok.js";
 import { kimi } from "./kimi.js";
 import { opencode } from "./opencode.js";
 import { pi } from "./pi.js";
+import { TRUST_DIALOG_VARIANTS, TrustDialogSchema } from "./types.js";
 export const CLI_NAME_RE = /^[a-z0-9-]+$/;
+// `field` names the ONE key projected out of an array of objects — a model id and nothing else.
+// `{"models":[{…}]}` is the normal shape of a modern CLI's --json output, and without a selector the
+// json parser only reads the rarer array-of-bare-strings. The allowlist is the rule, not a comment:
+// `cost` (prices have one authority, catalog-remote.ts) and `provider` (vendor landing is a separate
+// decision) are not id keys, so no config can name them and no parser call can be typed with them —
+// a schema that took any string would let either be harvested as a second source of truth.
+export const MODEL_ID_FIELDS = ["id", "selector", "model"];
 const ListModelsSchema = z.object({
     argv: z.array(z.string()).min(1),
     parser: z.enum(["lines", "pi-table", "json"]),
     path: z.string().min(1).optional(),
-}).strict();
+    field: z.enum(MODEL_ID_FIELDS).optional(),
+}).strict().superRefine((listModels, ctx) => {
+    // A selector the parser would silently ignore is the same silence this contract exists to end.
+    if (listModels.field !== undefined && listModels.parser !== "json") {
+        ctx.addIssue({ code: "custom", path: ["field"], message: "field is only read by the json parser" });
+    }
+});
+// v1.89 T1 / OBS-414: a drive contract declares its trust posture or it is not a drive contract.
+// `declarativeAdapter()` builds every catalog-driven CLI, so a contract without this field would
+// reintroduce the silent opt-out at the one construction site no adapter file covers. Absence gets
+// its own operator sentence; a malformed declaration keeps the union's own diagnosis.
+// Quote-free by construction: a zod issue reaches the operator as a JSON dump, where an embedded
+// double quote is escaped and no longer reads back as the sentence that was written.
+export const DRIVE_TRUST_DIALOG_MESSAGE = "drive contract must declare trustDialog — either the workspace-trust prompt this CLI renders, captured verbatim as {fingerprint, key}, or {kind: none, reason}";
 export const CliDriveSchema = z.object({
     headless: z.string().min(1),
     interactive: z.string().min(1).nullable(),
+    trustDialog: z.union(TRUST_DIALOG_VARIANTS, {
+        error: (issue) => (issue.input === undefined ? DRIVE_TRUST_DIALOG_MESSAGE : undefined),
+    }),
     listModels: ListModelsSchema.optional(),
 }).strict().superRefine((drive, ctx) => {
     for (const [field, template] of [["headless", drive.headless], ["interactive", drive.interactive]]) {
@@ -69,6 +93,14 @@ function validateCliEntry(entry) {
     if (drive.adapter.id !== base.id || drive.adapter.vendor !== base.vendor) {
         throw new Error(`native drive identity mismatch for ${base.id}`);
     }
+    // v1.89 T1 / OBS-414: native adapters carry their declaration in code, so the compiler enforces
+    // PRESENCE — it cannot enforce that the bytes are a real capture. The same schema the drive
+    // contract uses runs here, on the registry's own construction path, so a blank fingerprint or a
+    // prompt that is not a workspace-trust gate is unbuildable from either side of the catalog.
+    const trust = TrustDialogSchema.safeParse(drive.adapter.trustDialog);
+    if (!trust.success) {
+        throw new Error(`invalid trust declaration for ${base.id}: ${trust.error.issues.map((i) => i.message).join("; ")}`);
+    }
     return { ...base, drive };
 }
 // Package-owned, deterministic order. This is the sole shipped definition array: candidate-name
@@ -90,7 +122,31 @@ export const CLI_CATALOG = [
     native(pi, "pi"),
     native(grok, "grok"),
     native(kimi, "kimi"),
-    "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush", "omp",
+    "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush",
+    {
+        id: "omp",
+        binary: "omp",
+        // PROBE-omp-v189.md, re-recorded by hand 2026-08-07: `omp --version` → `omp/17.2.10`.
+        // A prefix match, so a patch bump does not re-open the identity gate.
+        identity: "^omp/",
+        // omp is a multi-provider gateway; a selected model carries its real vendor in its own prefix.
+        vendor: "mixed",
+        drive: {
+            // The same probe recorded -p as the fail-closed print mode (exit 1 on an unknown model).
+            // interactive deliberately omits it: `interactive` is nullable and `headless` is required, so
+            // the invisible configuration is the easier one to write — this one is written visible.
+            headless: "omp -p --model {model} @{promptFile}",
+            interactive: "omp --model {model} @{promptFile}",
+            trustDialog: {
+                kind: "none",
+                reason: "omp 17.2.10 showed no workspace-trust prompt during the recorded interactive probe (PROBE-omp-v189.md, 2026-08-07)",
+            },
+            // The recorded payload is an OBJECT keyed by models: 370 entries, selector prefixed 370/370
+            // and the neighbouring bare `id` prefixed 0/370. Projecting `id` would return 370 plausible
+            // ids that route to nothing, so the selector is the only id key this contract may name.
+            listModels: { argv: ["models", "ls", "--json"], parser: "json", path: "models", field: "selector" },
+        },
+    },
 ].flatMap((entry) => typeof entry === "string"
     ? [{ id: entry, binary: entry, identity: ".+", vendor: null }]
     : [entry]);

package/dist/adapters/fake.d.ts

@@ -1,6 +1,6 @@
 import type { TickmarkrConfig } from "../config/config.js";
 import type { Task } from "../graph/schema.js";
-import { type Assignment, type AuthHealth, type BillingChannel, type ContextUsage, type Invocation, type SessionRef, type TokenUsage, type WorkerAdapter, type WorkerResult } from "./types.js";
+import { type Assignment, type AuthHealth, type BillingChannel, type ContextUsage, type Invocation, type SessionRef, type TokenUsage, type TrustDialog, type WorkerAdapter, type WorkerResult } from "./types.js";
 export interface FakeScript {
     tasks: Record<string, Array<{
         shell: string;
@@ -25,6 +25,7 @@ export declare class FakeAdapter implements WorkerAdapter {
     private scriptPath;
     id: string;
     vendor: string;
+    trustDialog: TrustDialog;
     private script;
     private attempts;
     constructor(scriptPath: string);

package/dist/adapters/fake.js

@@ -7,6 +7,13 @@ export class FakeAdapter {
     scriptPath;
     id = "fake";
     vendor = "fake-a";
+    // v1.89 T1 / OBS-414: the scripted adapter runs `bash -c` — it has no TUI, so no prompt of any
+    // kind can render. Daemon tests that exercise the auto-answer seam assign a captured declaration
+    // to this field explicitly; that assignment is the falsifier for the claim made here.
+    trustDialog = {
+        kind: "none",
+        reason: "the zero-token scripted adapter dispatches a bash command and renders no TUI, so no trust prompt exists to capture",
+    };
     script;
     attempts = new Map();
     constructor(scriptPath) {

package/dist/adapters/grok.js

@@ -114,6 +114,17 @@ export const grok = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult, // prompt.ts — last-valid-trailer, hard-wrap tolerant. No grok fork.
+    // v1.89 T1 / OBS-414: no capture exists, so none is invented. grok 0.2.93 has never been observed
+    // rendering a workspace/folder-trust prompt: it loads the operator's global Claude-Code-compat
+    // config rather than keeping a per-directory trust store, and no grok dispatch in any recorded run
+    // has stalled before launch (OBS-414's own sweep lists grok's gap as MCP suppression, not trust).
+    // FALSIFIER, and it is cheap: dispatch grok into a never-seen worktree and read the pane. One
+    // capture of a trust prompt replaces this with {fingerprint, key} — the capture is the only
+    // admissible evidence, and a guess here would press a key on whatever it happened to match.
+    trustDialog: {
+        kind: "none",
+        reason: "grok 0.2.93 keeps no per-directory trust store and no recorded pane shows it rendering a workspace-trust prompt; falsified by one capture from a fresh worktree",
+    },
     // v1.5 MODEL-01: fail OPEN to [] (advisory detection, unlike gates). Parses the model LIST only —
     // the auth banner on line 1 is ignored BY CONSTRUCTION (parseGrokModels anchors on the header).
     // Advisory/doctor-only — never in the dispatch or auth path (types.ts:56-60).

package/dist/adapters/kimi.d.ts

@@ -1,5 +1,5 @@
 import type { ExecutorDriver, Slot } from "../drivers/types.js";
-import { type Assignment, type WorkerAdapter, type WorkerResult } from "./types.js";
+import { type Assignment, type TrustDialog, type WorkerAdapter, type WorkerResult } from "./types.js";
 export declare function kimiAuthed(credentialsText: string, nowMs: number): boolean;
 export declare function parseKimiModels(raw: string): string[];
 export declare function parseKimiResult(raw: string, nonce: string): WorkerResult;
@@ -32,6 +32,7 @@ export interface KimiInteractiveSeedResult {
     sessionId?: string;
 }
 export declare const KIMI_INPUT_BOX: import("./types.js").InputBox;
+export declare const KIMI_TRUST_DIALOG: TrustDialog;
 export declare function runKimiInteractiveSeed(opts: {
     driver: Pick<ExecutorDriver, "run" | "waitOutput" | "read">;
     slot: Slot;

package/dist/adapters/kimi.js

@@ -234,6 +234,34 @@ const KIMI_SEED = {
             : confirmation;
     },
 };
+// v1.89 T1 / OBS-414: the dialog that cost run …215 thirty minutes. Kimi records trust PER FOLDER
+// (~/.kimi-code/workspaces.json), and tickmarkr recreates a worktree on every attempt, so every kimi
+// dispatch after the first meets a brand-new path and a brand-new prompt. Neither `-y/--yolo` (tool
+// calls) nor `--auto` (agent questions) covers it: the gate is raised before the agent loop.
+//
+// VERBATIM CAPTURES, read off live panes — never composed (v1.79 law). Each is quoted from the
+// record that holds the FULLEST transcription of it, named here so a reviewer reads the same bytes:
+//   OBS-358, pane wW:p2TB, run-20260805-121252 (.overseer/REPAIR-v186/GATE-T28-1.md — five lines;
+//   .planning/OBSERVATIONS.md abridges the same capture to its first three):
+//     Trust this folder?
+//       /Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20260805-121252--T29
+//     ❯ Trust this folder     ← highlighted        ("← highlighted" is the observer's annotation)
+//         Enable project MCP servers. Remembered for this folder.
+//       Don't trust
+//   OBS-406, pane wW:p32A, run-20260806-121758-…214 T5:
+//     Kimi Code loads project-level MCP servers (.mcp.json, .kimi-code/mcp.json) only in trusted folders.
+//      ❯ Trust this folder      /      Don't trust
+//
+// The fingerprint carries the SELECTION CURSOR, and that is the load-bearing half: OBS-406's own
+// cursor-less watcher matched bare `Trust this folder` and produced 258 false wakes in 25 minutes —
+// every one of them a supervisor pane with the words on screen as prose. A live modal renders a
+// cursor glyph; prose never does. Enter accepts the highlighted "Trust this folder" option, and the
+// two captures above are the reason the cursor+label pair is the fingerprint rather than either
+// prompt's heading: the same gate ships two different headings.
+export const KIMI_TRUST_DIALOG = {
+    fingerprint: "❯ Trust this folder",
+    key: "Enter",
+};
 // v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
 export async function runKimiInteractiveSeed(opts) {
     const r = await runInteractiveSeed({ ...opts, adapter: kimi });
@@ -260,6 +288,14 @@ export const kimi = {
     // v1.65 T3: every flag the command builders below hardcode (-S is resumeCommand's) — verified in
     // `kimi --help` 2026-07-22.
     hardcodedFlags: { binary: "kimi", flags: ["-p", "--model", "--output-format", "-S"] },
+    // KNOWN GAP, stated rather than implied: this declaration is consumed by the daemon's trust loop,
+    // which is entered only AFTER runInteractiveSeed returns — and that seed waits for
+    // `readinessMatch` for the whole task timeout, which is exactly the window this prompt blocks in
+    // (run …215). So on a kimi startup pane the declaration is correct and still unreached: the seed
+    // reports `readiness pattern not seen` with zero keypresses. Answering it during the readiness
+    // wait is a change to src/run/interactive-seed.ts — WHEN and HOW OFTEN a declaration is answered
+    // is T19's half of this contract, and src/run may not appear in this task's diff.
+    trustDialog: KIMI_TRUST_DIALOG,
     // KIMI-02 headless. -p prompt mode + explicit model, NO permission flag: kimi 0.26.0 rejects
     // -p combined with -y/--auto at argument parse time ("Cannot combine --prompt with --yolo",
     // OBS-67 — doctor probes all failed on it), and prompt mode is already non-interactive with

package/dist/adapters/opencode.js

@@ -28,6 +28,23 @@ export const opencode = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult,
+    // v1.89 T1 / OBS-414: opencode 1.17.15 renders no workspace-trust gate, and the prompt it DOES
+    // render must never be declared here. A prior attempt at this contract pointed opencode's
+    // fingerprint at its tool-permission modal — captured verbatim as the three lines
+    //     Permission required
+    //     Allow once
+    //     enter confirm
+    // The daemon answers a match with Enter, which selects "Allow once" and silently approves the
+    // first arbitrary tool request in every slot: stall protection converted into auto-approval
+    // (.planning/RULING-v189-T1-reauthor.md:11). Tool approval and workspace trust are different
+    // gates, and no line of that capture — including the keybar hint that slipped past the first
+    // refusal list — can be declared now: the schema requires a fingerprint that names a trust gate.
+    // FALSIFIER: a captured opencode pane showing a folder/workspace-trust prompt — not a permission
+    // prompt — replaces this with {fingerprint, key}.
+    trustDialog: {
+        kind: "none",
+        reason: "opencode 1.17.15 renders no workspace-trust prompt; its only modal is the tool-permission prompt (Permission required / Allow once), a different gate that must never be auto-answered; falsified by a captured opencode pane showing a folder-trust prompt",
+    },
     // v1.5 MODEL-01: fail OPEN to [] (advisory detection, unlike gates). Plain `models` (NOT --refresh):
     // opencode reads its own cache offline; --refresh adds an avoidable network dependency (RESEARCH
     // anti-pattern). Live-verified 2026-07-10, opencode 1.17.15.

package/dist/adapters/pi.js

@@ -62,6 +62,17 @@ export const pi = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult,
+    // v1.89 T1 / OBS-414: pi HAS a per-directory trust prompt, and both command builders above already
+    // suppress it with --approve — a global option legal in both modes (pi --help 0.80.3), chosen for
+    // exactly this reason. Live-checked 2026-07-10 in a fresh worktree: no trust prompt reached the
+    // pane, so there is nothing captured, and a fingerprint here would be a guess about a dialog this
+    // adapter never lets render.
+    // FALSIFIER: drop --approve from interactiveCommand, dispatch into a fresh worktree, and capture
+    // the prompt that appears — then this becomes {fingerprint, key} rather than a suppression claim.
+    trustDialog: {
+        kind: "none",
+        reason: "pi 0.80.3's per-directory trust prompt is suppressed before it renders by --approve on both command builders (live-checked 2026-07-10, fresh worktree, no prompt); falsified by removing --approve and capturing the pane",
+    },
     // v1.5 MODEL-01: fail OPEN to [] (detection is advisory — unlike gates' fail-closed posture).
     // spawnSync mirrors probeVersion; 15s timeout. Live-verified 2026-07-10, pi 0.80.3.
     listModels: async () => {

package/dist/adapters/prompt.js

@@ -2,6 +2,13 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { classifyVerdictCause } from "../gates/verdict-cause.js";
+// v1.87 T5: the scope rule states only what the runtime enforces, and no more. What it enforces:
+// `scope.allowDeviations` comes from the operator's config, is snapshotted and frozen when a gate
+// round starts (run-gates.ts `allowDeviations`), and is never written back — so a worker has no
+// reach into it at all, and the round that judges its work judges against one fixed list. The
+// retired "unless the operator's config allowlists that path" advertised an exemption the worker
+// could neither invoke nor influence. Nothing here names a capability a worker can invoke mid-run,
+// and the allowlist stays exactly as immutable during a run as it was before this text changed.
 export function buildTaskPrompt(task, feedback = "", nonce = "") {
     const list = (xs) => xs.map((x) => `- ${x}`).join("\n");
     return `You are an autonomous coding worker dispatched by tickmarkr into an isolated git worktree.
@@ -15,7 +22,7 @@ ${task.files.length ? `\n## File scope — touch ONLY paths matching:\n${list(ta
 ## Rules
 - Work only inside the current directory (your isolated worktree). Never push. Never switch branches.
 - Make small atomic git commits as you go (git add + git commit, conventional messages).
-- Touch ONLY paths matching the file scope. Out-of-scope edits FAIL the scope gate unless the operator's config allowlists that path — declaring a deviation never passes the gate. If you cannot complete the task without an out-of-scope edit, stop and report ok:false explaining why in "summary". List any out-of-scope paths you did touch, each with a reason, in "deviations" (journaled for the operator's audit).
+- Touch ONLY paths matching the file scope. Out-of-scope edits FAIL the scope gate. The operator's allowlist is fixed when the run starts and nothing you do can change it while your work is judged; declaring a deviation never passes the gate either. If you cannot complete the task without an out-of-scope edit, stop and report ok:false explaining why in "summary". List any out-of-scope paths you did touch, each with a reason, in "deviations" (journaled for the operator's audit).
 - Do not ask questions; you are unattended. Make the smallest correct change.
 ${feedback ? `\n## Previous attempt failed gates — fix these specifically\n${feedback}\n` : ""}
 When finished, end your final message with exactly one line (no code fence):

package/dist/adapters/registry.d.ts

@@ -1,5 +1,6 @@
 import { type TickmarkrConfig } from "../config/config.js";
-import { type CatalogEntriesOptions, type CliEntry } from "./catalog.js";
+import { type PreferenceRole } from "../route/preference.js";
+import { type CatalogEntriesOptions, type CliEntry, type ModelIdField } from "./catalog.js";
 import { type AuthHealth, type BillingChannel, type WorkerAdapter } from "./types.js";
 export declare const CANDIDATE_CLI_CATALOG: readonly string[];
 export declare function registeredAdapterBinaries(adapters?: WorkerAdapter[]): string[];
@@ -46,6 +47,11 @@ export declare function formatCandidateCliRow({ binary, path }: CandidateCliDete
 export declare function probeHelpText(bin: string): string | undefined;
 export declare function missingDeclaredFlags(helpText: string, flags: string[]): string[];
 export declare function flagDriftWarnings(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, helpOf?: (bin: string) => string | undefined): string[];
+export interface DeclaredModels {
+    models: string[];
+    reason?: string;
+}
+export declare function parseDeclaredModels(raw: string, parser: "lines" | "pi-table" | "json", path?: string, field?: ModelIdField): DeclaredModels;
 export declare function adaptersFromCliEntries(entries: readonly CliEntry[]): WorkerAdapter[];
 export interface AllAdaptersOptions {
     fakeScriptPath?: string;
@@ -63,7 +69,9 @@ export type ProbeModelProgress = (adapter: string, model: string, status: ProbeM
 export declare function probeModels(cfg: TickmarkrConfig, repoRoot: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, onProgress?: ProbeModelProgress): Promise<void>;
 export declare function writeDoctor(repoRoot: string, health: Record<string, AuthHealth>): void;
 export declare function readDoctor(repoRoot: string): Record<string, AuthHealth> | null;
-export declare function discoverChannels(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): BillingChannel[];
+export declare function discoverChannels(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>, role?: PreferenceRole): BillingChannel[];
+export declare const PREFERENCE_ROLES: readonly ["worker", "judge", "review", "consult"];
+export declare function rolePools(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): Record<PreferenceRole, BillingChannel[]>;
 export declare function servableExclusions(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): {
     key: string;
     adapter: string;

package/dist/adapters/registry.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { modelLints, suggestOverlay } from "./model-lints.js";
@@ -208,15 +208,34 @@ function valueAtPath(value, path) {
         return cursor[part];
     }, value);
 }
-function parseDeclaredModels(raw, parser, path) {
+export function parseDeclaredModels(raw, parser, path, field) {
     let values;
     if (parser === "json") {
+        let root;
         try {
-            const selected = valueAtPath(JSON.parse(raw), path);
-            values = Array.isArray(selected) ? selected : [];
+            root = JSON.parse(raw);
         }
         catch {
-            return [];
+            return { models: [], reason: "malformed JSON: the output did not parse" };
+        }
+        const selected = valueAtPath(root, path);
+        if (!Array.isArray(selected)) {
+            return { models: [], reason: `no array at ${path ? `path "${path}"` : "the JSON root"}` };
+        }
+        // One key per entry, and only the configured one — and `ModelIdField` is an id-key allowlist, so
+        // `cost` and `provider` are not spellable here: no price, no vendor, no whole object.
+        values = field === undefined
+            ? selected
+            : selected.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry)
+                ? entry[field]
+                : undefined);
+        if (selected.length > 0 && !values.some((value) => typeof value === "string")) {
+            return {
+                models: [],
+                reason: field === undefined
+                    ? `${selected.length} entries are not id strings and no field is configured`
+                    : `no string field "${field}" on any of the ${selected.length} entries`,
+            };
         }
     }
     else if (parser === "pi-table") {
@@ -230,7 +249,14 @@ function parseDeclaredModels(raw, parser, path) {
     else {
         values = raw.split("\n").map((line) => line.trim());
     }
-    return [...new Set(values.filter((value) => typeof value === "string" && MODEL_ID_RE.test(value)))];
+    // Blanks are structural padding in every parser (trailing newline, headerless table row), never a
+    // rejected id — counting them would make "all values rejected" fire on a healthy list.
+    const candidates = values.filter((value) => typeof value === "string" && value.length > 0);
+    const models = [...new Set(candidates.filter((value) => MODEL_ID_RE.test(value)))];
+    if (models.length === 0 && candidates.length > 0) {
+        return { models, reason: `all ${candidates.length} listed values were rejected by the model-id format` };
+    }
+    return { models };
 }
 function declarativeAdapter(entry) {
     const drive = entry.drive;
@@ -255,6 +281,9 @@ function declarativeAdapter(entry) {
             return health;
         },
         channels: (cfg) => channelsFromConfig(entry.id, cfg),
+        // v1.89 T1 / OBS-414: straight from the validated drive contract — no default and no fallback,
+        // which is the only way this factory cannot reintroduce the optionality the type just removed.
+        trustDialog: drive.trustDialog,
         headlessCommand: (promptFile, model) => renderDriveTemplate(drive.headless, promptFile, model),
         interactiveCommand: (promptFile, model) => drive.interactive === null
             ? null
@@ -270,9 +299,13 @@ function declarativeAdapter(entry) {
                     return [];
                 const cmd = [shq(resolved), ...drive.listModels.argv.map(shq)].join(" ");
                 const result = shellSpawnSync(cmd, process.cwd(), 15000);
-                return result.code === 0
-                    ? parseDeclaredModels(result.stdout, drive.listModels.parser, drive.listModels.path)
-                    : [];
+                if (result.code !== 0)
+                    return [];
+                const { models, reason } = parseDeclaredModels(result.stdout, drive.listModels.parser, drive.listModels.path, drive.listModels.field);
+                // Listing stays advisory (fail-open to []), but never silently: an empty projection names why.
+                if (models.length === 0 && reason)
+                    console.warn(`tickmarkr: ${entry.id} listed no models — ${reason}`);
+                return models;
             },
         } : {}),
     };
@@ -365,67 +398,83 @@ export async function probeModels(cfg, repoRoot, adapters, health, onProgress) {
         // Tests inject FakeAdapter; never let an incidental default adapter spend a real token in the suite.
         if (process.env.VITEST && SHIPPED_NATIVE_ADAPTERS.has(a))
             return;
-        const verdicts = {};
         const priorModelAuth = priorHealth?.[a.id]?.modelAuth;
-        const probeRoot = a.probeCwd === "neutral" ? mkdtempSync(join(tmpdir(), "tickmarkr-probe-")) : repoRoot;
-        const store = (model, verdict) => {
-            verdicts[model] = verdict;
-            onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
-        };
-        // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
-        // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
-        // until re-probed alone); a retry attempt always returns a final verdict.
-        const attempt = async (model, retry) => {
-            const t0 = Date.now();
-            const probedAt = new Date().toISOString();
-            const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
-            try {
-                if (typeof a.headlessCommand !== "function")
-                    return { verdict: v(false, "headless probe unavailable"), timedOut: false };
-                const promptFile = join(mkdtempSync(join(tmpdir(), "tickmarkr-auth-")), "probe.md");
-                writeFileSync(promptFile, MODEL_PROBE_PROMPT);
-                const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
-                // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
-                // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
-                if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
-                    return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
+        const runProbes = async (probeRoot) => {
+            const verdicts = {};
+            const store = (model, verdict) => {
+                verdicts[model] = verdict;
+                onProgress?.(a.id, model, probeModelStatus(verdict), verdict.durationMs);
+            };
+            // One bounded probe call. verdict:null = a first-pass failure that earns the one serial retry
+            // (OBS-72: a failure inside the concurrent batch is indistinguishable from adapter self-contention
+            // until re-probed alone); a retry attempt always returns a final verdict.
+            const attempt = async (model, retry) => {
+                const t0 = Date.now();
+                const probedAt = new Date().toISOString();
+                const v = (authed, reason) => ({ authed, ...(reason !== undefined ? { reason } : {}), probedAt, durationMs: Date.now() - t0 });
+                try {
+                    if (typeof a.headlessCommand !== "function")
+                        return { verdict: v(false, "headless probe unavailable"), timedOut: false };
+                    const promptDir = mkdtempSync(join(tmpdir(), "tickmarkr-auth-"));
+                    try {
+                        const promptFile = join(promptDir, "probe.md");
+                        writeFileSync(promptFile, MODEL_PROBE_PROMPT);
+                        const r = await sh(a.headlessCommand(promptFile, model), probeRoot, MODEL_PROBE_TIMEOUT_MS);
+                        // T2 rule unchanged: a prior doctor.json timeout skips the retry — a persistently dead
+                        // model (e.g. opencode glm-5.2) costs one attempt instead of two every run.
+                        if (r.timedOut && !retry && priorModelAuth?.[model]?.reason?.includes("timed out") === true) {
+                            return { verdict: v(false, `probe timed out (repeat — retry skipped) (${MODEL_PROBE_TIMEOUT_MS}ms)`), timedOut: true };
+                        }
+                        const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
+                        if (!reason)
+                            return { verdict: v(true), timedOut: false };
+                        if (!retry)
+                            return { verdict: null, timedOut: r.timedOut === true };
+                        return {
+                            verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
+                            timedOut: r.timedOut === true,
+                        };
+                    }
+                    finally {
+                        rmSync(promptDir, { recursive: true, force: true });
+                    }
                 }
-                const reason = probeFailure(r.code, r.stdout, r.stderr, r.timedOut, MODEL_PROBE_TIMEOUT_MS);
-                if (!reason)
-                    return { verdict: v(true), timedOut: false };
-                if (!retry)
-                    return { verdict: null, timedOut: r.timedOut === true };
-                return {
-                    verdict: r.timedOut && retry.firstTimedOut ? v(false, `probe timed out twice (${MODEL_PROBE_TIMEOUT_MS}ms)`) : v(false, reason),
-                    timedOut: r.timedOut === true,
-                };
-            }
-            catch (e) {
-                return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
+                catch (e) {
+                    return { verdict: retry ? v(false, String(e)) : null, timedOut: false };
+                }
+            };
+            // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
+            // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
+            // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
+            // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
+            const retries = [];
+            await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
+                const first = await attempt(model);
+                if (first.verdict)
+                    store(model, first.verdict);
+                else
+                    retries.push({ model, firstTimedOut: first.timedOut });
+            });
+            // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
+            // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
+            // was contention; a second failure is the real verdict. Successful first-pass probes stored
+            // above and never wait; cost is one extra call per genuinely dead model only.
+            for (const { model, firstTimedOut } of retries) {
+                const second = await attempt(model, { firstTimedOut });
+                if (second.verdict)
+                    store(model, second.verdict);
             }
+            h.modelAuth = verdicts;
         };
-        // models probe concurrently too (v1.33.5) — sequential chains made init wall time Σ(models×60s)
-        // on the slowest adapter (measured 96s); each probe is one tiny prompt, safe to overlap.
-        // Capped at MODEL_PROBE_CONCURRENCY per adapter unless the adapter declares its own cap
-        // (codex: 1 — OBS-72, its concurrent probes self-contend in one repo).
-        const retries = [];
-        await mapLimit(Object.keys(cfg.tiers[a.id]?.models ?? {}), a.probeConcurrency ?? MODEL_PROBE_CONCURRENCY, async (model) => {
-            const first = await attempt(model);
-            if (first.verdict)
-                store(model, first.verdict);
-            else
-                retries.push({ model, firstTimedOut: first.timedOut });
-        });
-        // OBS-72: re-probe each first-pass failure once with ONE probe in flight, only after the
-        // concurrent batch drained — an in-slot retry still races its concurrency partner. Success here
-        // was contention; a second failure is the real verdict. Successful first-pass probes stored
-        // above and never wait; cost is one extra call per genuinely dead model only.
-        for (const { model, firstTimedOut } of retries) {
-            const second = await attempt(model, { firstTimedOut });
-            if (second.verdict)
-                store(model, second.verdict);
+        if (a.probeCwd !== "neutral")
+            return runProbes(repoRoot);
+        const probeRoot = mkdtempSync(join(tmpdir(), "tickmarkr-probe-"));
+        try {
+            await runProbes(probeRoot);
+        }
+        finally {
+            rmSync(probeRoot, { recursive: true, force: true });
         }
-        h.modelAuth = verdicts;
     }));
 }
 // T2: caps concurrent probes per adapter at 2 — v1.33.5 regression, 4 concurrent codex exec in one
@@ -468,7 +517,11 @@ export function readDoctor(repoRoot) {
     const { autoPrefer: _, ...health } = raw;
     return health;
 }
-export function discoverChannels(cfg, adapters, health) {
+// v1.87 T2: `role` is optional and defaults to "worker", so every pre-existing two/three-argument
+// call keeps its exact present behaviour — the worker pool. A non-worker role reads the SAME fleet
+// through its own deny scope: a worker-only deny (routing.deny.workers) benches a channel for
+// dispatch while leaving it eligible to judge, review or consult the work.
+export function discoverChannels(cfg, adapters, health, role = "worker") {
     const base = adapters
         .filter((a) => health[a.id]?.installed && health[a.id]?.authed)
         .flatMap((a) => {
@@ -483,7 +536,13 @@ export function discoverChannels(cfg, adapters, health) {
     });
     if (!cfg.routing.allow && !cfg.routing.deny)
         return base;
-    return base.filter((c) => disallowedBy(c, cfg.routing) === null);
+    return base.filter((c) => disallowedBy(c, cfg.routing, role) === null);
+}
+// v1.87 T2: the role-scoped pool builder. One doctor probe, one discovery pass per role — so the
+// daemon hands each seat the pool its own policy allows instead of handing everyone the worker list.
+export const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
+export function rolePools(cfg, adapters, health) {
+    return Object.fromEntries(PREFERENCE_ROLES.map((role) => [role, discoverChannels(cfg, adapters, health, role)]));
 }
 // HYG-07(a): the channels discoverChannels silently dropped because their model isn't in the adapter's
 // served list (the HYG-05 filter above). Computed from the SAME inputs as the drop (a.channels(cfg), not