tickmarkr 2.6.1 → 2.6.2

package/dist/cli/help.d.ts

@@ -163,6 +163,8 @@ export declare const COMMAND_HELP: {
         usage: string;
         description: string;
         options: {
+            "--park <line>@<ts>": string;
+            "--gate <gate>": string;
             "--files <glob,\u2026>": string;
             "--by <name>": string;
             "--reason <text>": string;

package/dist/cli/help.js

@@ -131,14 +131,21 @@ export const COMMAND_HELP = {
     approve: {
         usage: "approve <run-id> <task-id> [options]", description: "Append a validated park decision. A running owner may enact it; a closed run requires a separate resume. Decisions cannot be undone.",
         options: {
+            "--park <line>@<ts>": "Bind the decision to the park token status prints (a failed task's recheck binds its failure token); refused once a newer park opens.",
+            "--gate <gate>": "Bind a waive to the park's failed gate; refused when the park failed another gate.",
             "--files <glob,…>": "Extend files[] for a scope-request park with comma-separated repository-relative globs; required for scope approval.",
             "--by <name>": "Name the actor (default: current OS user).",
             "--reason <text>": "Record the decision reason.",
             "--waive": "Waive only the identified failed gate.",
             "--uphold": "Uphold a review failure and fund a fixed attempt.",
             "--recheck": "Request rechecking an infra or failed-gate park; satisfies no gate.",
-            "--review-rounds <N>": "Set a positive integer review-round ceiling with the decision.",
-        }, examples: ["approve run-example T1 --by operator --reason 'ready to proceed'", "approve run-example T1 --recheck --reason 'infra recovered'"],
+            "--review-rounds <N>": "Set a positive integer review-round ceiling that binds only this approval engagement; a later approval without --review-rounds restores the built-in default.",
+        }, examples: [
+            "approve run-example T1 --park 42@2026-09-26T08:00:00.000Z --by operator --reason 'ready to proceed'",
+            "approve run-example T1 --waive --park 42@2026-09-26T08:00:00.000Z --gate review",
+            "approve run-example T1 --recheck --park 42@2026-09-26T08:00:00.000Z --reason 'infra recovered'",
+            "approve run-example T3 --recheck --park 57@2026-09-26T08:05:00.000Z --reason 'failed task: re-gate its landed commits'",
+        ],
     },
     beat: {
         usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",

package/dist/config/config.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type Effort } from "../graph/schema.js";
 declare const TierEnum: z.ZodEnum<{
     cheap: "cheap";
     mid: "mid";
@@ -41,6 +42,7 @@ export declare const MapEntrySchema: z.ZodObject<{
     escalate: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type MapEntry = z.infer<typeof MapEntrySchema>;
+export declare const EFFORT_ADAPTERS: readonly ["claude-code", "codex"];
 export declare const TierEntrySchema: z.ZodObject<{
     vendor: z.ZodNullable<z.ZodString>;
     channel: z.ZodEnum<{
@@ -58,6 +60,11 @@ export declare const TierEntrySchema: z.ZodObject<{
             sub: "sub";
             api: "api";
         }>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
     }, z.core.$strip>>>;
     windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
 }, z.core.$strip>;
@@ -274,6 +281,11 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
                 sub: "sub";
                 api: "api";
             }>>;
+            effort: z.ZodOptional<z.ZodEnum<{
+                low: "low";
+                medium: "medium";
+                high: "high";
+            }>>;
         }, z.core.$strip>>>;
         windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     }, z.core.$strip>>;
@@ -383,6 +395,12 @@ export declare function loadConfigWithMode(repoRoot: string, opts?: {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
 };
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
+ *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+export declare function lowerLayerModelOverrides(opts?: {
+    globalDir?: string;
+}): Record<string, Record<string, Record<string, unknown>>>;
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
@@ -416,6 +434,8 @@ export type FleetEditable = Partial<Record<DenyScopeKey, string[]>> & {
     denyModels: string[];
     allowOut?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
+    /** OBS-1182: tiers.<adapter>.modelOverrides.<model>.effort — absent = CLI default; present only when one is set */
+    efforts?: Record<string, Record<string, Effort>>;
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;
 };

package/dist/config/config.js

@@ -2,11 +2,11 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
-import { Document, parse } from "yaml";
+import { Document, isScalar, parse } from "yaml";
 import { z } from "zod";
 import { CITED_MODEL_WINDOWS } from "../adapters/model-windows.js";
 import { stateDirName } from "../graph/graph.js";
-import { SHAPES, TIERS } from "../graph/schema.js";
+import { EFFORTS, SHAPES, TIERS } from "../graph/schema.js";
 const TierEnum = z.enum(TIERS, {
     error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
 });
@@ -51,21 +51,32 @@ export const MapEntrySchema = z.object({
     escalate: z.boolean().optional(),
 });
 const DeclaredVendorSchema = z.string().trim().min(1, "vendor must be nonempty");
-const ModelOverrideSchema = z
+// OBS-1182: effort is launch metadata only these CLIs accept (claude --effort, codex -c
+// model_reasoning_effort=). Every other adapter's override refuses the key outright, so config
+// load and the emitted JSON schema both reject an effort that could never be launched.
+export const EFFORT_ADAPTERS = ["claude-code", "codex"];
+const EffortEnum = z.enum(EFFORTS, {
+    error: (iss) => `Invalid effort: expected one of "low"|"medium"|"high" (got ${JSON.stringify(iss.input)})`,
+});
+const NoEffort = z.never({
+    error: () => `effort is launch metadata only ${EFFORT_ADAPTERS.join(" and ")} accept — this adapter's CLI takes no effort level`,
+});
+const modelOverrideSchema = (effort) => z
     .object({
     vendor: DeclaredVendorSchema.optional(),
     channel: z.enum(["sub", "api"]).optional(),
+    effort: effort.optional(),
 })
-    .refine((override) => override.vendor !== undefined || override.channel !== undefined, {
-    message: "a model override must declare vendor, channel, or both",
+    .refine((override) => override.vendor !== undefined || override.channel !== undefined || override.effort !== undefined, {
+    message: "a model override must declare vendor, channel, effort, or a combination",
 });
-export const TierEntrySchema = z.object({
+const tierEntrySchema = (effort) => z.object({
     vendor: DeclaredVendorSchema.nullable(),
     channel: z.enum(["sub", "api"]),
     models: z.record(z.string(), TierEnum),
     // T19: keep model values scalar for existing consumers. Optional sibling metadata resolves before
     // parent metadata in channelsFromConfig; neither provider prefixes nor adapter ids manufacture it.
-    modelOverrides: z.record(z.string(), ModelOverrideSchema).optional(),
+    modelOverrides: z.record(z.string(), modelOverrideSchema(effort)).optional(),
     // v1.47 T3: optional per-model context-window sizes (tokens). Absent block ⇒ no doctor column, no plan lint.
     windows: z.record(z.string(), z.number().int().positive()).optional(),
 }).superRefine((entry, ctx) => {
@@ -81,6 +92,13 @@ export const TierEntrySchema = z.object({
         });
     }
 });
+export const TierEntrySchema = tierEntrySchema(EffortEnum);
+// Per-adapter object + catchall rather than a record, so the emitted JSON schema carries the same
+// adapter restriction as the loader; typed as the record every consumer already reads.
+// ponytail: catchall parses the EFFORT_ADAPTERS keys first — the seed table already lists them first.
+const TiersSchema = z
+    .object(Object.fromEntries(EFFORT_ADAPTERS.map((id) => [id, TierEntrySchema.optional()])))
+    .catchall(tierEntrySchema(NoEffort));
 // v1.10 FLEET-06: optional routing.allow/deny fleet preference; absent blocks ⇒ byte-identical routing/discovery.
 // deny wins on conflict; presence of allow (even {} / empty arrays) activates allowlist (fail-closed).
 const PrefBlockSchema = z.object({
@@ -372,7 +390,7 @@ export const TickmarkrConfigSchema = z.object({
         allow: PrefBlockSchema.optional(),
         deny: DenyBlockSchema.optional(),
     }),
-    tiers: z.record(z.string(), TierEntrySchema),
+    tiers: TiersSchema,
     pricing: z.record(z.string(), z.number()),
     // v1.20 REC-02: optional detailed price table for cost estimation. Distinct from `pricing` above
     // (the coarse per-task tier estimate `tickmarkr plan` shows) — this one drives the usage/cost report.
@@ -798,6 +816,15 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
     assertSeededModelWindows();
     return { cfg: r.data, mode: resolveRoutingMode(r.data, [globalCfg, repoCfg]) };
 }
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
+ *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+export function lowerLayerModelOverrides(opts = {}) {
+    const isMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml")));
+    const tiers = isMap(merged) && isMap(merged.tiers) ? merged.tiers : {};
+    return Object.fromEntries(Object.entries(tiers).map(([adapter, entry]) => [adapter, Object.fromEntries(Object.entries(isMap(entry) && isMap(entry.modelOverrides) ? entry.modelOverrides : {}).filter(([, o]) => isMap(o)))]));
+}
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
@@ -959,10 +986,14 @@ export function universeCovers(universe, entry) {
 // Absent universe ⇒ deny arrays verbatim and no allowOut, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
+    const efforts = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
         tiers[adapter] = {};
         for (const [model, tier] of Object.entries(entry.models)) {
             tiers[adapter][model] = { tier };
+            const effort = entry.modelOverrides?.[model]?.effort;
+            if (effort)
+                (efforts[adapter] ??= {})[model] = effort;
         }
     }
     // every enumerated deny scope rides verbatim (sorted) under its own key
@@ -991,6 +1022,7 @@ export function fleetEditableFromConfig(cfg, universe) {
         ...denyLists,
         ...(allowOut !== undefined ? { allowOut } : {}),
         tiers,
+        ...(Object.keys(efforts).length ? { efforts } : {}),
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
     };
@@ -1037,6 +1069,13 @@ export function formatFleetPrint(repoRoot, opts = {}) {
     for (const [adapter, entry] of Object.entries(effective.tiers)) {
         for (const model of Object.keys(entry.models))
             annotate(["tiers", adapter, "models", model]);
+        // OBS-1182: the effort value prints in place; its note names the layer that set it and the edit
+        for (const [model, override] of Object.entries(entry.modelOverrides ?? {})) {
+            const path = ["tiers", adapter, "modelOverrides", model, "effort"];
+            const node = doc.getIn(path, true);
+            if (override.effort && isScalar(node))
+                node.comment = ` ${fleetKeyLayer(repoRoot, path.join("."), opts)} — fleet e edits`;
+        }
     }
     return String(doc);
 }

package/dist/config/fleet-overlay.d.ts

@@ -20,6 +20,7 @@ export type FleetOverlayWrite = {
         };
     };
     universe?: FleetUniverseRow[];
+    lowerOverrides?: Record<string, Record<string, Record<string, unknown>>>;
 };
 export type FleetFirstTouch = {
     vendor: string;

package/dist/config/fleet-overlay.js

@@ -360,6 +360,62 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 setScalarPreservingComment(doc, path, after.tier, unpackFleetProvenance(after.provenance).provenance);
         }
     }
+    // OBS-1182: effort lands in tiers.<adapter>.modelOverrides.<model>.effort — the scalar tier and
+    // every sibling override key (vendor, channel) keep their bytes.
+    const efforts = (e) => e.efforts ?? {};
+    for (const adapter of new Set([...Object.keys(efforts(initial)), ...Object.keys(efforts(edited))])) {
+        for (const model of new Set([...Object.keys(efforts(initial)[adapter] ?? {}), ...Object.keys(efforts(edited)[adapter] ?? {})])) {
+            const after = efforts(edited)[adapter]?.[model];
+            if (efforts(initial)[adapter]?.[model] === after)
+                continue;
+            const override = ["tiers", adapter, "modelOverrides", model];
+            if (after !== undefined) {
+                // Setting beneath a tombstone (the override, or modelOverrides above it) lifts it, and
+                // deepMerge would restore what it masked: re-mask each lower-layer key it covered — sibling
+                // models, then this override's vendor/channel (unknown lower ⇒ both, blind).
+                // ponytail: tiers.<adapter> itself tombstoned is unreachable here — its models, and so a tier, are masked too.
+                const tombstoned = (depth) => {
+                    const node = doc.getIn(override.slice(0, depth), true);
+                    return node !== undefined && !isMap(node);
+                };
+                const lowerModels = write.lowerOverrides?.[adapter] ?? {};
+                const remask = [];
+                if (tombstoned(3))
+                    for (const other of Object.keys(lowerModels))
+                        if (other !== model)
+                            remask.push([...override.slice(0, 3), other]);
+                if (tombstoned(3) || tombstoned(4)) {
+                    for (const key of write.lowerOverrides ? Object.keys(lowerModels[model] ?? {}) : ["vendor", "channel"]) {
+                        if (key !== "effort")
+                            remask.push([...override, key]);
+                    }
+                }
+                setScalarPreservingComment(doc, [...override, "effort"], after);
+                for (const path of remask)
+                    setScalarPreservingComment(doc, path, null);
+                continue;
+            }
+            // Clearing means no effort in the MERGED config: drop the repo key, then mask an effort the
+            // lower layers still declare (unknown lower ⇒ a repo that never held the key inherited it).
+            const held = doc.getIn([...override, "effort"]) !== undefined;
+            deleteAt(doc, [...override, "effort"]);
+            const lower = write.lowerOverrides?.[adapter]?.[model];
+            const maskEffort = write.lowerOverrides ? lower?.effort !== undefined : !held;
+            const repoNode = doc.getIn(override, true);
+            const { effort: _masked, ...rest } = { ...lower, ...(isMap(repoNode) ? repoNode.toJSON() : {}) };
+            if (Object.values(rest).some((v) => v !== null && v !== undefined)) {
+                if (maskEffort)
+                    setScalarPreservingComment(doc, [...override, "effort"], null);
+            }
+            else if (maskEffort || (isMap(repoNode) && repoNode.items.length > 0)) {
+                // Tombstone-only siblings must still suppress lower metadata when effort is cleared,
+                // even without inherited effort. Their merged {} would fail the nonempty refinement.
+                setScalarPreservingComment(doc, override, null);
+            }
+            for (const depth of [4, 3, 2, 1])
+                deleteEmptyMap(doc, override.slice(0, depth));
+        }
+    }
     if (write.mode !== undefined) {
         setScalarPreservingComment(doc, ["routing", "mode"], write.mode);
     }

package/dist/drivers/orca.d.ts

@@ -123,12 +123,13 @@ export declare function mapAgentState(term: Record<string, unknown>, tuiIdle: bo
  * A retired record is replaced by a new reservation (CAS on the tombstone bytes) only once its pane
  * is proven gone. Everything else — a reservation or claim with no bound pane, a failed cleanup, a
  * record another driver holds with a live observer — refuses and keeps the record exactly as it is.
+ * One reservation or claim is HELD rather than in flight: its placer is this process after an
+ * indeterminate split receipt (OBS-1172). It is reconciled again on every call, never split over.
  */
 /** `placer` is the pid of the narrator that wrote the reservation: a reserved or claimed record is a
  *  normal intermediate state while that pid lives (another driver awaiting listing or bind) and a
  *  crash to recover only once it is dead. */
 type BoardRecord = WatchBoardOwner & {
-    retired?: true;
     runtimeId?: string;
     placer?: number;
 };
@@ -198,6 +199,16 @@ export declare class OrcaDriver implements ExecutorDriver {
     /** Explicit runtime probe. Also T3's doctor probe. */
     probeRuntime(cwd?: string): Promise<string>;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    /**
+     * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
+     * resumed daemon can read the interrupted attempt's pane. Binding needs ownership evidence, never
+     * a title or handle alone: exactly one tab on the tracked worktree carries the FULL journaled owned
+     * title, it resolves to exactly one terminal, and that terminal's scrollback proves the exact task
+     * checkout `slot.cwd` (the frame only tickmarkr's own create command prints). Zero, ambiguous or
+     * foreign candidates leave the slot unbound: the throw is the caller's decline. The journaled
+     * nonce is then checked by the caller against the trailer this binding reads.
+     */
+    adopt(slot: Slot): Promise<Slot>;
     /** Where to invoke the CLI for this slot's calls (see OrcaSlotState.dir). */
     private cliCwd;
     private state;
@@ -290,6 +301,15 @@ export declare class OrcaDriver implements ExecutorDriver {
     sendKey(slot: Slot, key: string): Promise<void>;
     nudge(slot: Slot, message: string): Promise<boolean>;
     narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
+    /** OBS-1172: what an indeterminate split left behind, reconciled from the owner record and Orca's
+     *  terminal table — never from the receipt that did not arrive. The reservation's token reaches no
+     *  process but the split's own command, so a claim proves that split started a board; the owned
+     *  record (this driver, the watch title) is ours by that same token. The claimant must be live (pid
+     *  and arm presence), and it must name the terminal it runs in — a listed pane in the launching tab.
+     *  A claim that names none proves a board started, not WHICH pane hosts it: a sole neighbouring pane
+     *  (row titles are shell-controlled, never ownership keys) is not adopted, so the claim stays held.
+     *  No claim and no such pane: the split started nothing the table shows. Anything else is held. */
+    private settleIndeterminate;
     private boardPath;
     /** A recorded pane (a receipt's handle bound to the split envelope's runtime, never a guess) is
      *  gone when that runtime no longer lists it, or when a handle-bound close receipt names it.
@@ -303,6 +323,11 @@ export declare class OrcaDriver implements ExecutorDriver {
      *  handle-bound close (timeout keeps the tombstone and the pane); a dead one never acknowledges,
      *  so it is only asked. */
     private retireAndClose;
+    /** Stop a retired board's observer before its pane is closed. A live observer acknowledges on
+     *  injected time; a dead one never can, so it is only asked. OBS-1131: an acknowledgement timeout
+     *  is not proof of death — while the pid lives the owned pane stays protected — but a pid that died
+     *  during the wait is, and its pane is closed instead of leaked. */
+    private stopObserver;
     /** WB-1 seam: the daemon reports this board lost. "Lost" can be a stale beat or missing presence
      *  under a still-live owner pid, so it is not proof of a dead observer — retirement keeps close's
      *  acknowledgement discipline (Leg-2 T9 P1). */