tickmarkr 2.6.3 → 2.6.5

package/dist/adapters/model-windows.js

@@ -9,7 +9,8 @@ const ModelWindowClaimSchema = z
     .strict();
 /**
  * Validate cited model-window claims before production code can consume them.
- * These values are vendor-published claims, not measurements made by tickmarkr.
+ * These values are vendor-published claims (a vendor page, or a vendor CLI's own model cache), not
+ * measurements made by tickmarkr.
  */
 export function loadModelWindowClaims(input) {
     const claims = z.array(ModelWindowClaimSchema).parse(input);
@@ -22,8 +23,15 @@ export function loadModelWindowClaims(input) {
     return Object.freeze(claims.map((claim) => Object.freeze(claim)));
 }
 const ANTHROPIC_SOURCE = "https://platform.claude.com/docs/en/about-claude/models/overview";
-const OPENAI_SOURCE = "https://developers.openai.com/api/docs/models";
-const OPENAI_GPT_55_SOURCE = "https://developers.openai.com/api/docs/models/gpt-5.5";
+// v2.6.4 T3 (D-717): the Codex rows cite the installed CLI's own models_cache.json snapshot, not the API
+// docs. That file has no public URL, so the source names it in its own scheme, snapshot instant included.
+// Every listed entry there carried context_window=272000 — the budget the codex CLI launches with. The
+// API docs' 1,050,000 (formerly cited here) describes the API surface; it is superseded for these CLI
+// seeds, not called false. These windows are the CLI's self-report, not a tickmarkr measurement. Only the
+// window comes from this snapshot: the codex tiers seeded beside it (config.ts) rest on the provider's
+// descriptions and the retained workhorse tier policy, not on any measured benchmark.
+const CODEX_CLI_CACHE_SOURCE = "codex-cli:models_cache.json#fetched_at=2026-09-29T16:09Z";
+const CODEX_CLI_CACHE_READ_DATE = "2026-09-29";
 const CURSOR_SOURCE = "https://cursor.com/help/ai-features/max-mode";
 const ZAI_SOURCE = "https://z.ai/blog/glm-5.2";
 const XAI_SOURCE = "https://docs.x.ai/developers/models/grok-4.5";
@@ -37,10 +45,13 @@ const VENDORED_MODEL_WINDOW_CLAIMS = [
     { modelId: "opus", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
     { modelId: "sonnet", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
     { modelId: "haiku", window: 200_000, source: ANTHROPIC_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.6-sol", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.5", window: 1_050_000, source: OPENAI_GPT_55_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.6-terra", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
-    { modelId: "gpt-5.6-luna", window: 1_050_000, source: OPENAI_SOURCE, readDate: READ_DATE },
+    { modelId: "gpt-6-astra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.6-sol", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.5", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.6-terra", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
+    { modelId: "gpt-5.6-luna", window: 272_000, source: CODEX_CLI_CACHE_SOURCE, readDate: CODEX_CLI_CACHE_READ_DATE },
     { modelId: "composer-2.5", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
     { modelId: "composer-2.5-fast", window: 200_000, source: CURSOR_SOURCE, readDate: READ_DATE },
     { modelId: "claude-fable-5-1", window: 1_000_000, source: ANTHROPIC_SOURCE, readDate: OBS_871_READ_DATE },

package/dist/adapters/prompt.js

@@ -130,8 +130,9 @@ export function parseWorkerResult(raw, nonce) {
 }
 // Signatures anchor distinctive CLI-error phrasing — never bare fragments or bare status-code
 // numbers (the QUOTA_RE Pitfall-3 lesson): these run only over no-trailer output, but a stalled
-// worker's harvested pane can still contain ordinary work text.
-const AUTH_RE = /not logged in|please (?:log ?in|sign in)|please run [^\n]{0,30}log ?in|authentication[ _](?:required|failed|error)|invalid (?:api key|credentials)|api key (?:is )?(?:not set|missing|invalid|required)|credentials? (?:have )?expired|401 unauthorized/i;
+// worker's harvested pane can still contain ordinary work text. E1: the recorded refresh failure
+// ("access token could not be refreshed") is auth-required — classified, never re-probed or relaunched.
+const AUTH_RE = /not logged in|please (?:log ?in|sign in)|please run [^\n]{0,30}log ?in|authentication[ _](?:required|failed|error)|invalid (?:api key|credentials)|api key (?:is )?(?:not set|missing|invalid|required)|credentials? (?:have )?expired|401 unauthorized|access token could not be refreshed/i;
 const SETUP_RE = /command not found|not recognized as an internal or external command|spawn \S+ ENOENT|missing required config|workspace trust (?:required|not granted)/i;
 const OUTAGE_RE = /unable to reach the model provider|cannot reach the model provider|model provider.{0,40}(?:unavailable|unreachable)|service (?:is )?temporarily unavailable|upstream connect error|overloaded_error/i;
 const TIMEOUT_RE = /\bETIMEDOUT\b|request timed out|connection timed out|deadline exceeded|timed out waiting for/i;

package/dist/adapters/types.d.ts

@@ -36,6 +36,10 @@ export interface ModelAuth {
     probedAt: string;
     identity?: string;
 }
+export interface ModelRetirement {
+    retiresAt: string;
+    successor?: string;
+}
 export interface AuthHealth {
     installed: boolean;
     authed: boolean;
@@ -46,6 +50,14 @@ export interface AuthHealth {
     servable?: string[];
     modelAuth?: Record<string, ModelAuth>;
     modelIdentities?: Record<string, string>;
+    modelRetirements?: Record<string, ModelRetirement | null>;
+    codexCommit?: "protected" | "allowed" | "unknown";
+    launchServices?: LaunchServicesRecord;
+}
+export interface LaunchServicesRecord {
+    pid: number;
+    start: string;
+    advisory?: string;
 }
 export declare function modelAuthed(health: AuthHealth | undefined, model: string, allowUnverifiedModels?: boolean): boolean;
 export interface Invocation {
@@ -190,6 +202,7 @@ export interface WorkerAdapter {
     parse(output: string, nonce: string): WorkerResult;
     listModels?(): Promise<string[]>;
     listModelsFetchedAt?(): string | undefined;
+    listModelsRetirements?(): Record<string, ModelRetirement | null> | undefined;
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     readSessionTranscript?(session: SessionRef): {

package/dist/cli/commands/approve.js

@@ -1,11 +1,13 @@
 import { graphDefinitionHash, loadGraph, saveGraph, taskDefinitionFingerprint } from "../../graph/graph.js";
 import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
+import { allAdapters } from "../../adapters/registry.js";
+import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { applyScopeAmendments, bindingToken, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+import { applyScopeAmendments, bindingToken, captureOwedCheck, engagementComparable, engagementReleased, failedGateBeforePark, parseBindingToken, physicalLine, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
 export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
 /**
  * What each disposition's release actually buys — the clause every operator-facing sentence about
@@ -208,11 +210,17 @@ export async function approve(argv, cwd = process.cwd()) {
         if (namedGate !== undefined && namedGate !== park?.failedGate) {
             throw new Error(`refusing mismatched gate for ${taskId}: --gate ${namedGate} but park ${bindingToken(parkBinding)} failed ${park?.failedGate ?? "no gate"} — nothing appended`);
         }
-        if ((park?.kind === "scope-request" && !decisions) || files !== undefined) {
+        // A scope-request park is released one of two ways: --files widens files[], or a nonempty --reason
+        // refuses the expansion and funds a plain worker within the current files[] — the reason rides into
+        // the next brief as a standing ruling (journaledFailureBrief). No reason, no release: the refusal is
+        // a ruling only when it says why. The cockpit menu still offers neither (it has no reason entry).
+        const scopeRefusal = park?.kind === "scope-request" && !decisions && files === undefined && Boolean(reason?.trim());
+        if ((park?.kind === "scope-request" && !decisions && !scopeRefusal) || files !== undefined) {
             if (park?.kind !== "scope-request")
                 throw new Error("--files requires a scope-request park");
-            if (!files?.length)
-                throw new Error(`scope-request for ${taskId} requires --files <glob,…>`);
+            if (!files?.length) {
+                throw new Error(`scope-request for ${taskId} requires --files <glob,…> to widen files[], or \`tickmarkr approve ${runId} ${taskId} --reason <text>\` to refuse the expansion and continue within the current files[]`);
+            }
             if (decisions)
                 throw new Error("--files cannot be combined with --waive, --uphold or --recheck");
             const graph = applyScopeAmendments(loadGraph(cwd), journal, false, engagementReleased(events));
@@ -296,6 +304,28 @@ export async function approve(argv, cwd = process.cwd()) {
             if (!gateFailPark || !failedGate) {
                 throw new Error(`--waive applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
+            // C1: the waiver's owed check rides the SAME row — one append, captured synchronously so a live
+            // daemon's boundary never observes the decision without its obligation (or a second write).
+            // The seats a review discharge may resolve to are this repository's declared channels, recorded on
+            // the row so every later fold reads the same table whatever process or checkout it runs in.
+            let integrationRef = "unknown";
+            let declared;
+            let owedTask;
+            try {
+                const cfg = loadConfig(cwd);
+                integrationRef = integrationBranch(cfg, runId);
+                declared = allAdapters().flatMap((a) => a.channels(cfg)).map((c) => ({ key: channelKey(c), vendor: c.vendor }));
+            }
+            catch { /* an unreadable config binds no range and declares no seat: unknown */ }
+            try {
+                owedTask = loadGraph(cwd).tasks.find((t) => t.id === taskId);
+            }
+            catch { /* recorded as unknown criteria and scope */ }
+            const obligation = captureOwedCheck({
+                cwd, runId, taskId, gate: failedGate, events, acceptance: owedTask?.acceptance, files: owedTask?.files, declared,
+                cause: reason ?? `operator waived failed ${failedGate} gate`, // the row's own park field binds the park
+                taskRef: `${integrationRef}--${taskId}`, integrationRef,
+            });
             journal.append("task-approved", taskId, {
                 by,
                 ...(reason ? { reason } : {}),
@@ -304,8 +334,9 @@ export async function approve(argv, cwd = process.cwd()) {
                 gate: failedGate,
                 park: parkBinding,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+                obligation,
             });
-            return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}`, serialization.contended);
+            return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}; owes ${failedGate} check ${obligation.id}${obligation.known ? "" : " (debt unknown)"}`, serialization.contended);
         }
         if (gateFailPark) {
             const choices = [`--waive (disposition waive-gate)`, `--recheck (disposition re-dispatch)`];
@@ -333,7 +364,7 @@ export async function approve(argv, cwd = process.cwd()) {
             park: parkBinding,
         });
         const token = capPark ? "fresh-budget" : "dispatch";
-        return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}`, serialization.contended);
+        return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}${scopeRefusal ? "; scope expansion refused, files[] unchanged" : ""}`, serialization.contended);
     }
     finally {
         serialization.release();

package/dist/cli/commands/doctor.d.ts

@@ -1,6 +1,7 @@
 import { type ClaudeAlias } from "../../adapters/claude-code.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
 import { type KimiDoctorTurnResult } from "../../adapters/kimi.js";
+import { type CodexSandbox } from "../../adapters/codex-commit-check.js";
 import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import { type ShResult } from "../../run/git.js";
 import { type VitestListResult } from "../../gates/acceptance.js";
@@ -17,6 +18,7 @@ export declare function recentReviewDemotions(cwd: string, lastRuns?: number): R
 export type DoctorOpts = {
     banner?: boolean;
     kimiTurnProbe?: (cwd: string) => Promise<KimiDoctorTurnResult>;
+    codexSandbox?: CodexSandbox;
     resolveClaudeAliasIdentity?: (cwd: string, alias: ClaudeAlias) => string | undefined;
     catalog?: CatalogReadResult;
     catalogNow?: () => Date;
@@ -34,6 +36,8 @@ export type DoctorOpts = {
     resolveOrcaBinary?: (cwd: string) => string | undefined;
     /** Test seam for the runner-owned JSON listing used by the acceptance-oracle report row. */
     listTests?: (cwd: string) => Promise<VitestListResult>;
+    /** Clock for model-knowledge lints (retirement notices, knowledge age); absent = the wall clock. */
+    now?: () => Date;
 };
 type OrcaCapability = {
     verdict: "pass" | "fail" | "warn";

package/dist/cli/commands/doctor.js

@@ -14,11 +14,14 @@ import { loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
 import { ORCA_FIXTURE_VERSION, parseEnvelope, resolveOrcaCliBinary } from "../../drivers/orca.js";
 import { kimi, probeKimiDoctorTurn } from "../../adapters/kimi.js";
+import { recordCodexCommit } from "../../adapters/codex-commit-check.js";
 import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, observedSeat, preferRanks } from "../../route/preference.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, LIVEBENCH_TABLE_DATE, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 import { readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
+import { checkModelDiscovery } from "../../adapters/model-discovery-check.js";
+import { recordLaunchServices } from "../../run/launchservices-check.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
@@ -578,6 +581,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             };
         }
     }
+    await recordCodexCommit(adapters, health, cwd, opts.codexSandbox);
     // MODEL-02: detect models where the adapter exposes a list surface, BEFORE writing doctor.json (write once, below).
     // Fail OPEN — the inverse of gates' fail-closed: detection is advisory, so a broken list surface NEVER fails doctor.
     for (const a of adapters) {
@@ -590,6 +594,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             // no fetch timestamp, so it still stamps now — its staleness lint is best-effort until it surfaces one.
             if (health[a.id].models.length)
                 health[a.id].modelsDetectedAt = a.listModelsFetchedAt?.() ?? new Date().toISOString();
+            // v2.6.4 T2 (B1a): the CLI's retirement notices ride into doctor.json beside the list they describe;
+            // an unreadable source leaves the field absent, which every reader treats as unknown.
+            const retirements = a.listModelsRetirements?.();
+            if (retirements)
+                health[a.id].modelRetirements = retirements;
         }
         catch { /* fail open: leave models as-is, doctor stays healthy */ }
     }
@@ -654,7 +663,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
             }
         }
     }
-    writeDoctor(cwd, health);
+    const discovery = await checkModelDiscovery({ cwd, cfg, adapters, health, catalog, resolved: resolvedIdentitySnapshot, mayRefresh: !opts.catalog && !catalogRefreshLine && catalogRefreshAllowed, fetcher: opts.catalogFetcher, now: opts.catalogNow });
+    catalog = discovery.catalog;
+    aliasDriftFindings.push(...discovery.findings);
+    const launchServices = await recordLaunchServices(readDoctor(cwd), health);
+    writeDoctor(cwd, launchServices.health);
     const rows = adapters.map((a) => {
         const h = health[a.id];
         // OBS-503: a crash-on-version verdict carries its reason in note — print it instead of the lie.
@@ -784,7 +797,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const liveBenchStale = liveBenchStalenessFinding(opts.catalogNow?.() ?? new Date());
     if (liveBenchStale)
         lintRows.push(attentionRow(liveBenchStale));
-    lintRows.push(...modelLints(cfg, health, adapters, { tty: ttyVisual(), stateDir: stateDirName(cwd), overlayPreferShapes: overlayPreferShapes(cwd) }).map(attentionRow));
+    lintRows.push(...modelLints(cfg, health, adapters, { tty: ttyVisual(), stateDir: stateDirName(cwd), overlayPreferShapes: overlayPreferShapes(cwd), now: opts.now?.() }).map(attentionRow));
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         lintRows.push(attentionRow(exclusionLine(excluded)));
@@ -802,6 +815,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     lintRows.push(...flagDriftWarnings(adapters, health).map(attentionRow));
     // OBS-145: resolved-identity drift is advisory display warning.
     lintRows.push(...aliasDriftFindings.map(attentionRow));
+    if (launchServices.line)
+        lintRows.push(attentionRow(launchServices.line));
     const resolvedCatalogModel = (adapter, model) => {
         if (adapter !== "claude-code" || !(model in CLAUDE_ALIAS_IDENTITY_STAMPS))
             return undefined;
@@ -890,9 +905,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
                 rows.push(`    ${dim(`catalog · ${advisory.display}`)}`);
             if (!listAllModels && bulk.length) {
                 const uncovered = bulk.filter((adv) => adv.coverage === "uncovered").length;
-                const evidenceOnly = bulk.length - uncovered;
+                const unknown = bulk.filter((adv) => adv.coverage === "unknown").length;
+                const evidenceOnly = bulk.length - uncovered - unknown;
                 const parts = [
                     ...(uncovered ? [`${uncovered} uncovered by ${catalog.source === "cache" ? "cached catalogs" : "vendored catalog"}`] : []),
+                    ...(unknown ? [`${unknown} coverage unknown after a failed refresh`] : []),
                     ...(evidenceOnly ? [`${evidenceOnly} covered without a tier suggestion`] : []),
                 ];
                 rows.push(`    ${dim(`catalog · ${parts.join(" · ")} — tickmarkr doctor --models lists each`)}`);

package/dist/cli/commands/fleet.d.ts

@@ -1,6 +1,7 @@
 import { type CatalogFetcher, type CatalogReadResult } from "../../adapters/catalog-remote.js";
 import type { WorkerAdapter } from "../../adapters/types.js";
-import type { FleetEditorResult } from "../../tui/ink/fleet-app.js";
+import { type MapEntry, type ModeResolution, type RoutingMode, type TickmarkrConfig } from "../../config/config.js";
+import type { FleetEditorResult, FleetStagedDeny, FleetStagedMetadata } from "../../tui/ink/fleet-app.js";
 type FleetEditorProps = Parameters<typeof import("../../tui/ink/fleet-app.js").runFleetInkEditor>[0];
 export type FleetInput = NodeJS.ReadableStream & {
     isTTY?: boolean;
@@ -44,6 +45,14 @@ export declare function assembleFleetEditor(cwd: string, adapters: WorkerAdapter
     props: FleetEditorProps;
     commit: (result: FleetEditorResult) => string;
     renderWhy: () => string;
+    previewConfig: (mode: RoutingMode, map: Record<string, MapEntry>, deny: FleetStagedDeny, stage?: FleetStagedMetadata) => {
+        ok: true;
+        cfg: TickmarkrConfig;
+        mode: ModeResolution;
+    } | {
+        ok: false;
+        error: string;
+    };
 } | {
     unavailable: string;
 }>;