tickmarkr 2.6.0 → 2.6.1

package/dist/tui/cockpit/run-view.js

@@ -53,7 +53,7 @@ export function evidenceLookup(rows, page) {
     return lookup;
 }
 export const GATE_CELL_LETTERS = {
-    passed: "P", failed: "F", running: "R", "not-run": "-", disabled: "D", unknown: "?",
+    passed: "P", failed: "F", queued: "Q", running: "R", "not-run": "-", disabled: "D", unknown: "?",
 };
 /** The outcome selector's vocabulary — a classification of the row, never a word search. */
 export const OUTCOME_FILTERS = ["all", "infra failure", "work failure", "pass", "unknown"];
@@ -81,10 +81,8 @@ function outcomeLabel(outcome) {
         case "unavailable": return `unknown — ${outcome.reason}`;
     }
 }
-/**
- * The current attempt's seven cells in declaration order. `rows` supplies the later journal rows
- * that give a cell its inherited/satisfied label; only rows for this task after the evidence line count.
- */
+/** Current-attempt cells in declaration order; later task rows supply inherited/satisfied labels.
+ * Only rows after each cell's own evidence line count. */
 export function runGateCells(task, evidence, rows = []) {
     return GATE_NAMES.map((gate) => {
         const cell = task.gates[gate] ?? { state: "unknown" };
@@ -94,12 +92,15 @@ export function runGateCells(task, evidence, rows = []) {
         const labels = [];
         let outcome;
         if (data === undefined) {
-            labels.push(line === undefined ? { "not-run": "not run", disabled: "disabled by policy", running: "running", unknown: "unknown", passed: "passed", failed: "failed" }[cell.state] : `evidence #L${line} unavailable`);
+            labels.push(line === undefined ? { "not-run": "not run", disabled: "disabled by policy", queued: "queued", running: "running", unknown: "unknown", passed: "passed", failed: "failed" }[cell.state] : `evidence #L${line} unavailable`);
+        }
+        else if (cell.state === "queued") {
+            labels.push(`queued — ${row?.event?.event ?? "wait"}${typeof data.count === "number" ? ` (${data.count} suites)` : ""}`);
         }
         else if (data.disabled === true) {
             labels.push("disabled by policy");
         }
-        else if (row?.event?.event === "gate-start") {
+        else if (["gate-start", "gate-phase-start", "phase-start"].includes(row?.event?.event ?? "")) {
             labels.push("running");
         }
         else {
@@ -124,7 +125,7 @@ export function runGateCells(task, evidence, rows = []) {
             if (e.event === "task-approved" && e.data.release === "gate-satisfied" && e.data.gate === gate)
                 labels.push(`satisfied by approval #L${later.line}`);
         }
-        const verdict = typeof data?.details === "string" ? data.details.split("\n") : [];
+        const verdict = row?.event?.event === "gate-result" && typeof data?.details === "string" ? data.details.split("\n") : [];
         return { gate, state: cell.state, letter: GATE_CELL_LETTERS[cell.state], ...(line === undefined ? {} : { line }), ...(outcome ? { outcome } : {}), outcomeClass: outcomeClassOf(outcome, cell.state), labels, verdict };
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -140,11 +140,11 @@ through brief lineage. **An executor choice nobody made is still an executor cho
      with the task id and holding that task's worker plus its judge/review/consult panes (tickmarkr
      updates it). Never long context strings or ✓-chains.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Do not load the `herdr` skill and do not map a Herdr workspace. Work from the current Orca terminal context. Keep the overseer in the launching terminal, name it in the same act — `orca terminal rename --terminal "$ORCA_TERMINAL_HANDLE" --title "OVERSEER · <version>"` (tab title; see the seat-name law under Seat-spawn recipes) — and inspect terminals with `orca terminal list --json`. The daemon self-places the watch board as a horizontal split of the launching terminal (`ORCA_TERMINAL_HANDLE`).
-2. **Orchestrator**: Launch the orchestrator with your agent host.
-   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <m>` after the `--` if the operator has a policy). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify a model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
+2. **Orchestrator**: First consume a successful `tickmarkr fleet --pick consult` in the seat repository, per the Fleet selection contract below; then launch the returned adapter/model with your agent host.
+   - **On herdr (`HERDR_ENV=1`)**: Spawning on current herdr is two-step — the one-shot `agent start --cwd` form was removed in the herdr CLI redesign and now fails with `unknown option` (OBS-138): first create the pane with `herdr tab create --workspace <ws> --cwd <repo> --label "ORCH · <version>"` and parse `result.root_pane.pane_id` from its JSON, then start the agent in it. For Claude Code, use `herdr agent start orchestrator --kind claude --pane <root-pane-id> -- --permission-mode bypassPermissions` (append `--model <picked-model>` after the `--` from the Fleet receipt). For Codex, use `herdr agent start orchestrator --kind codex --pane <root-pane-id> -- --dangerously-bypass-approvals-and-sandbox` (add `--model <picked-model>` from the Fleet receipt). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions --settings '{"promptSuggestionEnabled":false}'`. **For a codex consultant, use `-a never --sandbox workspace-write` — NOT `--sandbox read-only`.** ⚠ **`--sandbox read-only` CONTRADICTS this skill's own completion protocol and will hang the seat.** Every seat you spawn is told to deliver an ARTIFACT ending in a terminal MARKER, because that is the only completion signal the artifact watcher can key on (`done` is turn end). A read-only sandbox cannot write that artifact, so codex blocks on `Would you like to make the following edits?` for its OWN report — and the report exists ONLY in the pending edit, so abandoning the prompt destroys the work rather than merely delaying it. Measured 2026-08-28: a consultant spawned `--sandbox read-only` finished a 14,604-byte verdict, sat blocked on the write, and the operator saw the prompt before the supervising tier did. `read-only` is correct ONLY for a seat that writes nothing at all — which, under the artifact+marker rule, is no seat this skill tells you to spawn. When the prompt does appear, answer **"Yes, and don't ask again for these files"** rather than plain yes: plain yes re-blocks on the next write of the same file. **That `--settings` pair is not cosmetic and it is not optional:** claude-code's AUTOSUGGEST renders context-plausible ghost text into an idle seat's prompt line that is BYTE-IDENTICAL to a typed draft in text-format reads (OBS-482), so a supervising tier cannot tell a seat's own unsent work from a rendering artifact without `agent read --format ansi`. Turning the suggester off at spawn removes the ambiguity at its source instead of paying for the discrimination at every read. Verified against the shipped binary: `claude --settings '{"promptSuggestionEnabled":false}' -p …` exits 0 with a real response, and the key appears in the binary's own settings schema. **For kimi, pass `-y`** (`herdr agent start <name> --kind kimi --pane <id> -- -y`) — the adapter already launches its own workers that way (`src/adapters/kimi.ts:204`), and a kimi seat spawned without it sits on an approval prompt having done nothing. **Herdr cannot see that state**: it reports a kimi pane as `agent_status: working` with `screen_detection_skipped: true` while the prompt is up, so the BLOCKED-STATE watcher below is blind on this vendor and the spawn flag is the ONLY control. Every vendor you spawn needs its auto-approve form named here; a vendor absent from this list is a seat that will hang.
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create` on a path worktree selector with a command:
      `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "<agent-cmd>" --json`
-     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --permission-mode bypassPermissions" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
+     For Claude Code: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "claude --model <picked-model> --permission-mode bypassPermissions --settings '{\"promptSuggestionEnabled\":false}'" --json`. For Codex: `orca terminal create --worktree path:<repo> --title "ORCH · <version>" --command "codex --model <picked-model> --dangerously-bypass-approvals-and-sandbox" --json`. Parse `result.terminal.handle` from the create receipt.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then announce the brief file:
@@ -202,9 +202,46 @@ Inventories retain the **full suite log**, not a tail or summary, and no one run
 
 ### Seat-spawn and Leg-2 recipes
 
+**Fleet selection contract (OBS-1165), on BOTH hosts:** Before every supervisor-opened seat,
+including every respawn, replacement, delegated spawn and Leg-2 dispatch, run the applicable
+`tickmarkr fleet --pick <role>` in that seat's repository. Never reuse a prior pick at respawn.
+The purpose-to-role mapping is explicit:
+
+| Seat purpose | Fleet role | Vendor exclusions |
+| --- | --- | --- |
+| orchestrator | consult | Any vendors excluded for this mission |
+| records | consult | Any vendors excluded for this mission |
+| author (including planner, executor and scout) | consult | Any vendors excluded for this mission |
+| consultant | consult | Any vendors excluded for this mission or consultation round |
+| lab-rater | consult | Any vendors excluded for this rating round |
+| independent reviewer (including checker and verifier) | review | Author vendor plus every vendor already used by independent reviewers in this round, and mission exclusions |
+
+For example, an independent reviewer runs
+`tickmarkr fleet --pick review --exclude-vendor <author-vendor> --exclude-vendor <prior-reviewer-vendor>`;
+omit the prior-reviewer argument only for the first reviewer. Repeat `--exclude-vendor <vendor>`
+for every applicable exclusion on either role. Track the author's actual vendor and each reviewer's
+returned vendor in the seat record; if the author vendor is unknown, stop before review selection.
+Unknown seat purposes require an explicit mapping decision; never silently map them to consult.
+
+Consume only exit status zero and one complete JSON identity with `role`, `adapter`, `model`, `vendor`
+and `channel`. Validate the role and exclusions against the request and record this receipt with the
+seat. A nonzero refusal (including missing `<role>.prefer`, exhausted eligible preferences, or stale
+probe data) stops the spawn: report the named reason, never invent a default, auto-write preferences,
+or fall back to a remembered model. `fleet --print` and a preference list are not a resolved pick.
+
+Build the launch command from the returned `adapter` and `model`, shell-quoting the model as one
+argument: `claude-code` maps to executable/kind `claude` with `--model <picked-model>`, `codex` to
+`codex --model <picked-model>`, `kimi` to `kimi --model <picked-model>`, and `grok` to
+`grok -m <picked-model>`. Select only the matching adapter recipe below; examples do not choose
+models. If the returned adapter has no documented visible TUI recipe and approval flags, stop and
+report that transport limitation rather than substitute another adapter. Preserve the existing
+visible-seat transport safeguards: named interactive TUI seats, host-specific create receipts,
+orchestrator tab isolation, role-specific sandbox/approval flags, Claude prompt suggestions disabled,
+Kimi `-y`, artifact plus terminal marker, and verified file-brief delivery. Fleet pick never starts a seat.
+
 - **On herdr (`HERDR_ENV=1`)**: Every mission to a Claude or Grok seat is delivered only with `herdr pane run <pane> "<message>"` and
   verified by reading the pane back; never use `agent prompt` for mission delivery. Launch a Grok seat with
-  `herdr agent start <seat> --kind grok --pane <pane> -- -m grok-4.6`.
+  `herdr agent start <seat> --kind grok --pane <pane> -- -m <picked-model>`.
 - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)**: Seats spawn with `orca terminal create --worktree path:<repo> --command "<cmd>" --json`.
   **`--worktree path:` resolves only an Orca-MANAGED worktree** (`orca worktree list`); on any other checkout —
   a `git worktree add` the overseer made for a spec branch, a throwaway clone — `terminal create` hangs and
@@ -790,14 +827,14 @@ they are left implicit:
    stall watcher to catch — silent-time equals lifetime. Standing operator rule since 2026-07-13:
    consults and one-off LLM calls run as the CLI's real interactive TUI in a visible named pane.
    Headless is for exit-code probes — a quota check that wants `rc`, never work anyone must watch.
-3. **Buy seat diversity from the live capability matrix, at every dispatch.** When one vendor's model
+3. **Buy seat diversity through Fleet, at every dispatch and respawn.** Resolve authors with `tickmarkr fleet --pick consult` and independent checkers/verifiers with `tickmarkr fleet --pick review --exclude-vendor <author-vendor>`, adding every applicable vendor exclusion under the Fleet selection contract. Consume the successful JSON adapter/model before using the visible-seat recipes; never select directly from doctor data. When one vendor's model
    quota collapses, the reflex is to collapse every seat onto the surviving model and hold the
    cross-vendor CLI back for a late probe — P97 ran planner, checker and verifier as one family that
    way, and three same-family passes confirmed one wrong anchored conclusion with the refuting fact in
    the room. `<state-dir>/doctor.json` already lists every installed+authed adapter and its models (nine
    were authed on 2026-08-17 while every seat ran claude). Priority when independence is scarce:
    **verifier > checker > planner > executors**.
-   - **On herdr (`HERDR_ENV=1`)** the independent seat goes cross-vendor with `herdr agent start … --kind codex`;
+   - **On herdr (`HERDR_ENV=1`)** the independent seat uses its Fleet-selected adapter kind and model with `herdr agent start … --kind <picked-kind> -- …`;
    - **On Orca (`TERM_PROGRAM=Orca` and non-empty `ORCA_TERMINAL_HANDLE`)** it uses the Orca terminal-create
    seat recipe. The choice is ruled at dispatch, never debated under time pressure.
    **A codex seat inside a git WORKTREE cannot commit and cannot write outside the worktree** (OBS-824, measured