tickmarkr 2.3.0 → 2.4.1

package/dist/gates/review.js

@@ -8,6 +8,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
+import { modelProvider } from "../route/preference.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlmDetailed, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { captureDiffCapFor, measureArtifactDiff, reviewableLogicDiff, } from "./artifact-manifest.js";
@@ -165,24 +166,7 @@ export function diffCapParkReason(results) {
 export function modelId(model) {
     return model.slice(model.lastIndexOf("/") + 1);
 }
-/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
-export function modelProvider(model, fallback = "unknown") {
-    const id = model.toLowerCase();
-    const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
-    if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
-        return "openai";
-    if (prefix === "anthropic" || /^(?:claude|opus|sonnet|haiku|fable)(?:-|$)/.test(id))
-        return "anthropic";
-    if (prefix === "google" || /^gemini(?:-|$)/.test(id))
-        return "google";
-    if (prefix === "xai" || /^grok(?:-|$)/.test(id))
-        return "xai";
-    if (["zai", "zhipu", "zai-coding-plan"].includes(prefix) || /^glm(?:-|$)/.test(id))
-        return "zhipu";
-    if (["kimi-code", "moonshot"].includes(prefix) || /^kimi(?:-|$)/.test(id))
-        return "moonshot";
-    return fallback;
-}
+export { modelProvider };
 // v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
 // module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
 // every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
@@ -192,7 +176,9 @@ function reviewPreferIndex(c, prefer) {
 }
 export function pickReviewer(author, channels, exclude = [], // v1.1 failover: reviewer channels that already produced garbage for this task
 prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
-floor) {
+floor, // task-declared only; config floors govern workers and must not silently move review seats
+history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
+onSeat) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -200,18 +186,23 @@ floor) {
     const authorChannel = channels.find((c) => c.adapter === author.adapter && c.model === author.model);
     if (!authorChannel)
         return null;
-    // Failover also guards true provider; the initial pick keeps the established stamped-vendor contract.
     const authorProvider = modelProvider(author.model, authorChannel.vendor);
-    return (channels
+    const ranked = channels
         // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
-        // rule, never replacing it — a future edit can't silently drop either). The diversity filter runs
-        // BEFORE preference ranking: prefer sorts survivors only, so no entry can resurrect an excluded channel.
+        // rule, never replacing it — a future edit can't silently drop either). Failover additionally guards
+        // true provider identity; the initial pick keeps the established stamped-vendor contract. The diversity
+        // filter runs BEFORE preference ranking, so prefer cannot resurrect an excluded channel.
         .filter((c) => c.vendor !== authorChannel.vendor
         && (exclude.length === 0 || modelProvider(c.model, c.vendor) !== authorProvider)
         && modelId(c.model) !== modelId(author.model)
         && !exclude.includes(channelKey(c))
         && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
-        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
+        .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
+    const reviewer = [...ranked].sort((a, b) => history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
+        || ranked.indexOf(a) - ranked.indexOf(b))[0] ?? null;
+    if (reviewer)
+        onSeat?.(ranked.indexOf(reviewer) + 1);
+    return reviewer;
 }
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
@@ -229,7 +220,7 @@ ${files.map((path) => `- ${path}`).join("\n")}`;
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
-artifactDir) {
+artifactDir, reviewHistory) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
     // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
@@ -301,7 +292,8 @@ artifactDir) {
     // A reviewer floor is opt-in at the task. Applying cfg.routing.floors here would change the
     // historical seat for every task that never asked for review-tier coupling.
     const reviewerFloor = task.routingHints?.floor;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor);
+    let rotationSeat;
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
@@ -312,6 +304,8 @@ artifactDir) {
             ? { gate: "review", pass: false, details: `unreadable — ${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, unreadable: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
             : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
+    reviewHistory?.push(channelKey(reviewer));
+    const rotationMeta = rotationSeat === undefined ? {} : { rotationSeat };
     const measuredDiff = await fetchTaskDiff(worktree, baseRef, task.files);
     // Keep the reader payload identical to the text charged to the strict cap:
     // whole-file source deletions are represented by their citable operation fact.
@@ -362,9 +356,8 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
     // stdout that read as "unparseable" and escalated to re-implementation of green code
-    // (run-20260709-104447 P87-09). ponytail: literal 15min; make it cfg.review.timeoutMs if a
-    // second knob-turner appears.
-    900_000);
+    // (run-20260709-104447 P87-09). The configured ceiling defaults to that measured 15 minutes.
+    cfg.review.timeoutMs);
     const raw = llm.output;
     const provider = modelProvider(reviewer.model, reviewer.vendor);
     const v = extractVerdictJson(raw, nonce);
@@ -393,15 +386,17 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         return {
             gate: "review",
             pass: false,
-            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
+            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${cause === "timeout" ? `; killed at configured review timeout ${cfg.review.timeoutMs}ms` : ""}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
             meta: {
                 ...policyMeta,
+                ...rotationMeta,
                 reviewer: channelKey(reviewer),
                 vendor: reviewer.vendor,
                 provider,
                 unparseable: true,
                 cause,
                 ...(cause === "empty-output" ? { bytes } : {}),
+                ...(cause === "timeout" ? { timeoutMs: cfg.review.timeoutMs } : {}),
                 ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
             },
         };
@@ -414,6 +409,6 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         gate: "review",
         pass: decided.pass,
         details: appendAnchoredReview(prose, v),
-        meta: { ...policyMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider },
+        meta: { ...policyMeta, ...rotationMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider },
     };
 }

package/dist/gates/run-gates.d.ts

@@ -13,13 +13,15 @@ export declare function resetLoadProviderForTests(): void;
  * intervals and nothing between them, so the composite `test` gate (a selected screen, then other
  * gates, then the full suite) reports the two suites' cost rather than the span containing them —
  * and no consumer has to re-derive a duration by subtracting journal timestamps, which measures the
- * queue as well as the work. The load samples bracket the FIRST interval's start and the LAST
- * interval's end: start is what a scheduler would have decided on, end is the state it left behind.
+ * queue as well as the work. Load is sampled at each interval's endpoints and every second within it;
+ * start preserves the scheduling input while max and mean retain sustained interior saturation.
  */
 export interface GateTelemetry {
     durationMs: number;
     load1Start: number;
     load1End: number;
+    load1Max: number;
+    load1Mean: number;
 }
 export type GateEvent = {
     phase: "start";
@@ -51,6 +53,7 @@ export interface GateContext {
     cfg: TickmarkrConfig;
     via?: GateVia;
     excludeReviewers?: string[];
+    reviewHistory?: string[];
     artifactDir?: string;
     pipeline?: "v185" | "legacy";
     selectTests?: boolean;

package/dist/gates/run-gates.js

@@ -208,24 +208,42 @@ export async function runGates(task, ctx) {
     // executing is added HERE, at the call site that runs it, so a gate that runs twice (the test
     // gate's screen and its full suite) sums to its own cost and never to the span between them.
     const spans = new Map();
+    const loadSamples = new Map();
     // The test gate's two halves, kept apart as well as summed: `durationMs` alone cannot say whether
     // a slow round was a slow subset or a slow full suite, and the parked scheduler's threshold is
     // defined over the full-suite cost.
     let selectedDurationMs;
     let fullDurationMs;
-    const measure = async (gate, run) => {
+    const startMeasurement = () => {
         const at = Date.now();
-        const load1Start = loadProvider();
+        const samples = [loadProvider()];
+        const timer = setInterval(() => samples.push(loadProvider()), 1_000);
+        timer.unref();
+        return () => {
+            clearInterval(timer);
+            samples.push(loadProvider());
+            return { durationMs: Date.now() - at, samples };
+        };
+    };
+    const addMeasurement = (gate, measured) => {
+        const prior = spans.get(gate);
+        const samples = [...(loadSamples.get(gate) ?? []), ...measured.samples];
+        loadSamples.set(gate, samples);
+        spans.set(gate, {
+            durationMs: (prior?.durationMs ?? 0) + measured.durationMs,
+            load1Start: samples[0],
+            load1End: samples[samples.length - 1],
+            load1Max: Math.max(...samples),
+            load1Mean: samples.reduce((sum, value) => sum + value, 0) / samples.length,
+        });
+    };
+    const measure = async (gate, run) => {
+        const finish = startMeasurement();
         try {
             return await run();
         }
         finally {
-            const prior = spans.get(gate);
-            spans.set(gate, {
-                durationMs: (prior?.durationMs ?? 0) + (Date.now() - at),
-                load1Start: prior?.load1Start ?? load1Start,
-                load1End: loadProvider(),
-            });
+            addMeasurement(gate, finish());
         }
     };
     // The measurement is attached at the ONE seam every result leaves this function through, so a
@@ -347,12 +365,11 @@ export async function runGates(task, ctx) {
             // suppresses them anyway; split compareToBaseline only if a tool gate ever gets slow.
             // ponytail: legacy runs adjacent tools in ONE compareToBaseline call, so there is one interval
             // to measure and each of its gates carries it. Split it only if this branch ever stops batching.
-            const batchAt = Date.now();
-            const batchLoadStart = loadProvider();
+            const finish = startMeasurement();
             const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, [...gates]);
-            const batch = { durationMs: Date.now() - batchAt, load1Start: batchLoadStart, load1End: loadProvider() };
+            const batch = finish();
             for (const g of gates)
-                spans.set(g, batch);
+                addMeasurement(g, batch);
             // The same refusal AFTER the commands, because a green command can dirty the tree the check
             // above just proved clean. Batched, legacy cannot say WHICH command did it, so the refusal
             // lands on the last gate that had one — the round dies there either way. A red battery is
@@ -575,7 +592,7 @@ export async function runGates(task, ctx) {
             invocations.push(...captured.invocations);
             return captured.value;
         };
-        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir));
+        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir, ctx.reviewHistory));
         // OBS-193/574: an unparseable review verdict retries the REVIEW exactly once, preferring a
         // different adapter. Only a single-adapter eligible pool may fall back to another channel on the
         // flaked adapter. The flaked verdict never enters results; an exhausted pool preserves its cause.
@@ -598,7 +615,7 @@ export async function runGates(task, ctx) {
             const crossAdapter = pickReviewer(ctx.author, ctx.channels, [...priorExclusions, ...adapterExclusions], ctx.cfg.review.prefer ?? [], task.routingHints?.floor);
             const exclusion = crossAdapter ? "adapter" : "channel";
             const retryExclusions = [...priorExclusions, ...(crossAdapter ? adapterExclusions : [flaked])];
-            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, retryExclusions, ctx.artifactDir));
+            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, retryExclusions, ctx.artifactDir, ctx.reviewHistory));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
                 const route = exclusion === "adapter"
@@ -630,11 +647,11 @@ export async function runGates(task, ctx) {
     // The check runs BEFORE any gate, so on a clean tree it belongs to no gate: charging every round's
     // first gate for it would inflate the one measurement the parked recalibrations key on. It becomes
     // that gate's interval only on the path where it IS what the gate did — the refusal below.
-    const entryAt = Date.now();
-    const entryLoad = loadProvider();
+    const finishEntry = startMeasurement();
     const entryDirt = sequence.length ? await dirtyWorktree() : undefined;
+    const entryMeasurement = finishEntry();
     if (entryDirt) {
-        spans.set(sequence[0], { durationMs: Date.now() - entryAt, load1Start: entryLoad, load1End: loadProvider() });
+        addMeasurement(sequence[0], entryMeasurement);
         await emitStart(sequence[0]);
         await record(dirtyRefusal(sequence[0], entryDirt));
         return done();

package/dist/graph/graph.d.ts

@@ -1,6 +1,26 @@
 import { type RunGraph, type Task, type TaskStatus } from "./schema.js";
 export declare function stateDirName(_repoRoot: string): string;
 export declare function graphPath(repoRoot: string): string;
+export interface CompileRefusalRecord {
+    refusedAt: string;
+    source: string;
+    error: string;
+}
+export declare function compileRefusalPath(repoRoot: string): string;
+export declare function readCompileRefusal(repoRoot: string): CompileRefusalRecord | undefined;
+export declare function saveCompileRefusal(repoRoot: string, record: CompileRefusalRecord): void;
+export declare function clearCompileRefusal(repoRoot: string): void;
+export interface OnDiskSpecHash {
+    path: string;
+    hash: string;
+}
+/**
+ * Re-hash the exact single source file recorded by CLI compiles. Native and PRD record the source
+ * markdown; Spec Kit records its tasks.md. GSD combines several plan bodies and is deliberately not
+ * reconstructed here. A missing file is the one fail-open case: the refusal record is the fail-closed
+ * evidence for failed recompiles, while moved/deleted source files need not strand a compiled graph.
+ */
+export declare function onDiskSpecHash(_repoRoot: string, graph: RunGraph): OnDiskSpecHash | undefined;
 export declare function graphDefinitionHash(g: RunGraph): string;
 export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance">): string;
 export declare function tickmarkrDir(repoRoot: string): string;

package/dist/graph/graph.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { validateGraph } from "./schema.js";
 export function stateDirName(_repoRoot) {
     return ".tickmarkr";
@@ -8,6 +8,71 @@ export function stateDirName(_repoRoot) {
 export function graphPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "graph.json");
 }
+export function compileRefusalPath(repoRoot) {
+    return join(repoRoot, stateDirName(repoRoot), "compile-refusal.json");
+}
+export function readCompileRefusal(repoRoot) {
+    const path = compileRefusalPath(repoRoot);
+    if (!existsSync(path))
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`compile refusal record at ${path} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof value !== "object" || value === null
+        || typeof value.refusedAt !== "string"
+        || typeof value.source !== "string"
+        || typeof value.error !== "string") {
+        throw new Error(`compile refusal record at ${path} is malformed`);
+    }
+    return value;
+}
+export function saveCompileRefusal(repoRoot, record) {
+    tickmarkrDir(repoRoot);
+    const path = compileRefusalPath(repoRoot);
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(record, null, 2) + "\n");
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+export function clearCompileRefusal(repoRoot) {
+    rmSync(compileRefusalPath(repoRoot), { force: true });
+}
+/**
+ * Re-hash the exact single source file recorded by CLI compiles. Native and PRD record the source
+ * markdown; Spec Kit records its tasks.md. GSD combines several plan bodies and is deliberately not
+ * reconstructed here. A missing file is the one fail-open case: the refusal record is the fail-closed
+ * evidence for failed recompiles, while moved/deleted source files need not strand a compiled graph.
+ */
+export function onDiskSpecHash(_repoRoot, graph) {
+    if (graph.spec.source === "gsd")
+        return undefined;
+    if (graph.spec.paths.length !== 1)
+        return undefined;
+    const recorded = graph.spec.paths[0];
+    // CLI compilation records an absolute source. Relative paths belong to legacy/programmatic
+    // graphs whose resolution context is unknowable here, so preserve their prior fail-open behavior.
+    if (!isAbsolute(recorded))
+        return undefined;
+    const path = recorded;
+    try {
+        const content = readFileSync(path);
+        return { path, hash: createHash("sha256").update(content).digest("hex") };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`cannot verify compiled spec hash from ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 // T3 (Sol #2 / Fable F2): ONE canonical engagement identity over COMPILED TASK DEFINITIONS only.
 // status/evidence are runtime-mutated (the daemon flips status, accumulates evidence every attempt) so
 // they are excluded — the identity survives a status flip or evidence growth but changes the instant a

package/dist/route/preference.d.ts

@@ -5,6 +5,12 @@ export interface Disallowed {
     entry: string;
 }
 export type PreferenceRole = "worker" | "judge" | "review" | "consult";
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export declare function modelProvider(model: string, fallback?: string): string;
+export declare const routingModelProvider: typeof modelProvider;
+export declare const modelRouteIdentity: (model: string, fallback?: string) => string;
+export declare const channelRouteIdentity: (key: string, fallback?: string) => string;
+export declare function routingEntrySeatLines(cfg: TickmarkrConfig): string[];
 export declare function excludedChannels(cfg: TickmarkrConfig, adapters: {
     id: string;
 }[] | string[], health: Record<string, AuthHealth>): {

package/dist/route/preference.js

@@ -1,6 +1,46 @@
 import { channelKey, channelsFromConfig } from "../adapters/types.js";
 import { validateGraph } from "../graph/schema.js";
 import { route, RoutingError } from "./router.js";
+const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
+/** Provider identity comes from the served model, not a gateway adapter's stamped vendor. */
+export function modelProvider(model, fallback = "unknown") {
+    const id = model.toLowerCase();
+    const prefix = id.includes("/") ? id.slice(0, id.indexOf("/")) : "";
+    if (prefix === "openai" || prefix === "openai-codex" || /^(?:gpt|o\d)/.test(id))
+        return "openai";
+    if (prefix === "anthropic" || /^(?:claude|opus|sonnet|haiku|fable)(?:-|$)/.test(id))
+        return "anthropic";
+    if (prefix === "google" || /^gemini(?:-|$)/.test(id))
+        return "google";
+    if (prefix === "xai" || /^grok(?:-|$)/.test(id))
+        return "xai";
+    if (["zai", "zhipu", "zai-coding-plan"].includes(prefix) || /^glm(?:-|$)/.test(id))
+        return "zhipu";
+    if (["kimi-code", "moonshot"].includes(prefix) || /^kimi(?:-|$)/.test(id))
+        return "moonshot";
+    return fallback;
+}
+// Router naming remains explicit while sharing the review gate's exact function object.
+export const routingModelProvider = modelProvider;
+export const modelRouteIdentity = (model, fallback = "unknown") => `${routingModelProvider(model, fallback)}/${model.slice(model.lastIndexOf("/") + 1).toLowerCase()}`;
+export const channelRouteIdentity = (key, fallback = "unknown") => {
+    const i = key.indexOf(":");
+    return i < 0 ? key : modelRouteIdentity(key.slice(i + 1), fallback);
+};
+export function routingEntrySeatLines(cfg) {
+    const lines = [];
+    const add = (path, entries, roles) => {
+        for (const entry of entries ?? [])
+            lines.push(`${path} '${entry}' reaches seats: ${roles.join(", ")}`);
+    };
+    add("routing.allow.adapters", cfg.routing.allow?.adapters, PREFERENCE_ROLES);
+    add("routing.allow.models", cfg.routing.allow?.models, PREFERENCE_ROLES);
+    add("routing.deny.adapters", cfg.routing.deny?.adapters, PREFERENCE_ROLES);
+    add("routing.deny.models", cfg.routing.deny?.models, PREFERENCE_ROLES);
+    add("routing.deny.workers.adapters", cfg.routing.deny?.workers?.adapters, ["worker"]);
+    add("routing.deny.workers.models", cfg.routing.deny?.workers?.models, ["worker"]);
+    return lines;
+}
 const adapterIds = (adapters) => typeof adapters[0] === "string" ? adapters : adapters.map((a) => a.id);
 export function excludedChannels(cfg, adapters, health) {
     const { allow, deny } = cfg.routing;

package/dist/route/router.js

@@ -1,6 +1,6 @@
 import { channelKey, channelsFromConfig } from "../adapters/types.js";
 import { TIER_RANK } from "../config/config.js";
-import { disallowedBy } from "./preference.js";
+import { channelRouteIdentity, disallowedBy, modelRouteIdentity, routingModelProvider } from "./preference.js";
 import { cellOf, EXPLORE_CAP, explorationBonus, learnedScore, MIN_SAMPLES } from "./profile.js";
 export const NO_EXPLORE_ENV = "TICKMARKR_NO_EXPLORE";
 // OBS-89 (v1.60): the TICKMARKR_QUALITY variable is RETIRED — nothing in src reads it anymore and
@@ -337,7 +337,20 @@ export function nextChannel(current, task, cfg, channels, tried, profile, exclud
     // profile-dependent filter. NO exploration bonus here (route():110 has one; a probe on the
     // failure path would spend a real retry). Absent profile ⇒ every score is 0 ⇒ third key
     // all-ties ⇒ the stable sort preserves the exact v1.7 candidate ORDER.
-    const pool = channels.filter((c) => !tried.includes(channelKey(c)) && TIER_RANK[c.tier] >= TIER_RANK[current.tier]);
+    const triedKeys = new Set(tried);
+    const triedIdentities = new Set(tried.map((key) => {
+        const channel = channels.find((c) => channelKey(c) === key);
+        return channel ? modelRouteIdentity(channel.model, channel.vendor) : channelRouteIdentity(key);
+    }));
+    // excludeAdapter is expanded by the daemon into every channel key of the failed adapter. Once that
+    // complete set is present, the outage follows the current served provider across gateway aliases.
+    const currentAdapterExcluded = channels.some((c) => c.adapter === current.adapter)
+        && channels.filter((c) => c.adapter === current.adapter).every((c) => triedKeys.has(channelKey(c)));
+    const currentChannel = channels.find((c) => c.adapter === current.adapter && c.model === current.model);
+    const excludedProvider = currentAdapterExcluded ? routingModelProvider(current.model, currentChannel?.vendor) : undefined;
+    const pool = channels.filter((c) => !triedIdentities.has(modelRouteIdentity(c.model, c.vendor))
+        && (!excludedProvider || routingModelProvider(c.model, c.vendor) !== excludedProvider)
+        && TIER_RANK[c.tier] >= TIER_RANK[current.tier]);
     const scores = new Map(pool.map((c) => [channelKey(c), profile ? learnedScore(profile, task.shape, channelKey(c), c.channel, { availWeight: cfg.routing.learnedTuning?.availWeight }) : 0]));
     const scoreOf = (c) => scores.get(channelKey(c));
     const candidates = pool.sort((a, b) => TIER_RANK[a.tier] - TIER_RANK[b.tier] || marginalCostRank(a) - marginalCostRank(b) || scoreOf(b) - scoreOf(a));

package/dist/run/consult.d.ts

@@ -9,6 +9,7 @@ export interface ConsultVerdict {
     reason?: string;
     guidance?: string;
     excludeAdapter?: string;
+    excludeProvider?: string;
     adapter?: string;
     model?: string;
     vendor?: string;

package/dist/run/consult.js

@@ -4,7 +4,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { dewrapPaneVerdict, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { classifyVerdictCause } from "../gates/verdict-cause.js";
-import { disallowedBy } from "../route/preference.js";
+import { disallowedBy, routingModelProvider } from "../route/preference.js";
 import { sh } from "./git.js";
 import { redactSecrets } from "./redact.js";
 import { filterLlmTranscript } from "./stall.js";
@@ -59,6 +59,23 @@ export function augmentRetryBrief(feedback, opts) {
     return parts.join("\n\n");
 }
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
+function excludedProviderFromDossier(d, adapter) {
+    try {
+        const events = JSON.parse(d.journalTail);
+        const assignment = [...events].reverse().find((event) => event.event === "task-dispatch"
+            && event.taskId === d.taskId
+            && event.data?.assignment?.adapter === adapter
+            && typeof event.data.assignment.model === "string")?.data?.assignment;
+        if (typeof assignment?.model !== "string")
+            return undefined;
+        const provider = routingModelProvider(assignment.model);
+        return provider === "unknown" ? undefined : provider;
+    }
+    catch {
+        // Legacy/non-JSON dossier tails retain the adapter exclusion without inventing a provider.
+        return undefined;
+    }
+}
 export function parseConsultVerdict(out, nonce) {
     const v = extractVerdictJson(out, nonce);
     if (!v)
@@ -110,10 +127,10 @@ ${d.journalTail}
 Verdict meanings: retry = same assignment with your notes as feedback; reroute = different CLI/model;
 decompose = task too big, needs human re-planning; human = a person must look at this.
 
-On reroute only, optional excludeAdapter is an adapter id (e.g. "cursor-agent") that bans EVERY
-channel of that adapter for this task. Use it for environmental failures ("the CLI is blocked",
-trust dialog, broken install) — not when a single model produced bad code. Omit for model-level
-reroutes so other models of the same adapter remain eligible.
+On reroute only, optional excludeAdapter is the failed adapter id (e.g. "cursor-agent"). Tickmarkr
+resolves the adapter's current model to its provider and bans that provider for this task. Use it for
+environmental/provider failures ("the CLI is blocked", trust dialog, broken install) — not when a
+single model produced bad code. Omit for model-level reroutes so other models remain eligible.
 
 ${verdictNonceLine(nonce)}
 
@@ -230,8 +247,19 @@ opts = {}) {
     for (const [i, seat] of allowedSeats.entries()) {
         try {
             const parsed = await invokeSeat(seat.adapter, seat.model, i);
-            if (parsed.verdict)
-                return { ...parsed.verdict, ...seatIdentity(seat) };
+            if (parsed.verdict) {
+                const excludeProvider = parsed.verdict.excludeAdapter
+                    ? excludedProviderFromDossier(d, parsed.verdict.excludeAdapter)
+                    : undefined;
+                return {
+                    ...parsed.verdict,
+                    ...(excludeProvider ? {
+                        excludeProvider,
+                        notes: `${parsed.verdict.notes} — excluded provider ${excludeProvider}`,
+                    } : {}),
+                    ...seatIdentity(seat),
+                };
+            }
         }
         catch {
             // failed seat (unknown adapter, dead driver/pane, shell error) — fall to the next entry

package/dist/run/daemon.d.ts

@@ -68,6 +68,7 @@ export declare function formatSummary(s: RunSummary): string;
  *  run id (cli/commands/status.ts positionalRunId), so naming it here is what stops the board from
  *  following the newest journal in a repo that already carries a second, newer run — a board showing
  *  the wrong run is a recorded incident (skills/tickmarkr-overseer/SKILL.md). */
+export declare const daemonEntrypoint: string;
 export declare const watchCommand: (runId: string) => string;
 /**
  * R3 (OBS-186): a gate that DECLINED to run is not a gate that failed. The review gate's skip branch
@@ -103,6 +104,9 @@ export declare const gateSatisfied: (g: GateResult) => boolean;
  */
 export declare function decisiveReviewRounds(events: JournalEvent[]): JournalEvent[];
 export declare const SUITE_POLL_MS = 250;
+export declare const SUITE_WAIT_CEILING_MS = 600000;
+export declare const setSuiteWaitCeilingForTests: (ms: number) => void;
+export declare const resetSuiteWaitCeilingForTests: () => void;
 export declare const APPROVAL_POLL_MS = 250;
 export declare const EARLY_LAUNCH_LIVENESS_MS = 60000;
 /** Test seam — lowers the empty-pane liveness window without sleeping 60s per case. */
@@ -113,6 +117,11 @@ export declare const WORKER_NUDGE_MESSAGE = "tickmarkr liveness check: if the ta
 /** Test seam — shrink the nudge gate and grace without minute-long sleeps. */
 export declare function setNudgeTimingForTests(silentMs: number, graceMs: number): void;
 export declare function resetNudgeTimingForTests(): void;
+export declare const WORKER_STARTUP_WINDOW_MS = 60000;
+export declare const WORKER_STARTUP_WINDOW_BYTES: number;
+/** Test seam — exercises both sides of the startup boundary without a production-length fixture. */
+export declare function setWorkerStartupWindowMsForTests(ms: number): void;
+export declare function resetWorkerStartupWindowMsForTests(): void;
 /** Test seam — shrink the quota-banner silence gate without minute-long sleeps. */
 export declare function setQuotaBannerSilentMsForTests(ms: number): void;
 export declare function resetQuotaBannerSilentMsForTests(): void;