trantor 0.18.30 → 0.18.32

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.28",
+  "version": "0.18.32",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/cli.mjs

@@ -209,7 +209,7 @@ switch (cmd) {
   trantor gates       verification gates: "must verify before shipping" claims that survive handoffs — [--all] [--json]
   trantor backfill    card past GIT work onto the board (solo commits that were never carded) — [--since "14 days ago"] [--dry-run]
   trantor init-hooks  install a git post-commit hook so EVERY commit auto-cards on the board (reliable solo-work backstop) — [--uninstall]
-  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <path>] [--adopt] [--json] — makes the dir, git main, CLAUDE.md from the brief, hooks, hub brief + first card (never spawns a session)
+  trantor new         project genesis: new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — creates <parent>/<name>, git main, CLAUDE.md from the brief, hooks, hub brief + first card (never spawns a session)
   trantor balances    how much credit is left on each CONFIGURED provider (from your profile) — refill before you stall — [--json]
   trantor recost      recompute sub-agent notional cost from on-disk transcripts + reseed the board (repair after upgrade) — [--dry-run]
   trantor handoff     finish this session NOW: write a handoff, open a fresh session that takes over, and close this one (manual baton)

package/bin/crew-runner.mjs

@@ -19,6 +19,7 @@ import { ensureEnrolled } from "../lib/enroll.mjs";
 import { redactKeys } from "../lib/redact.mjs";
 import {
   AUTH_MARKER_RE, classifyFailure, looksLikeAuthDeath,
+  verdictFor,
   readPromptText, stripPromptEcho,
 } from "../lib/classify-failure.mjs";
 import { capWake, capBcast, pickLessons, composePrompt } from "./crew-payload.mjs";
@@ -381,13 +382,13 @@ async function reportFailure(exit, trigger, undelivered = 0) {
   const state = `${down ? "down" : "error"}:${reason}`;
   if (state !== announced) {
     announced = state;
-    await api("/send", { from: SESSION, to: "all", text, project: PROJ }).catch(() => {});
+    await api("/send", { from: SESSION, to: "all", text, project: PROJ, kind: "status" }).catch(() => {});
     // #5684: a broadcast does not wake anyone — the incident is the operator spotting dead seats
     // before the foreman did, twice in one morning. The same state-change event now goes DIRECT
     // to the project's orchestrator (direct = wake), gated identically so a standing outage says
     // it once. A seat that IS the orchestrator's own runner has nobody above it to wake.
     const orch = `${hostId()}:${PROJ}`;
-    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ }).catch(() => {});
+    if (orch !== SESSION) await api("/send", { from: SESSION, to: orch, text, project: PROJ, kind: "alert" }).catch(() => {});
   } else {
     log(`still ${state} (${consecFails} fails) — already announced, staying quiet`);
   }
@@ -433,7 +434,7 @@ async function notifyAssigners(pairs, text) {
     seen.add(f);
     // `re` threads this outcome to the exact contract it answers, so the sender's ledger closes the
     // right one instead of guessing from timing.
-    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ };
+    const payload = { from: SESSION, to: f, text: text.slice(0, 280), project: PROJ, kind: "receipt" };
     if (id) payload.re = id;
     await api("/send", payload).catch(() => {});
   }
@@ -446,7 +447,7 @@ async function reportHealthy() {
   // Recovery is a change too, so the next failure is news again.
   announced = "";
   await api("/register", { session: SESSION, project: PROJ, status: `active in ${PROJ}`, llm: AGENT, model: MODEL }).catch(() => {});
-  await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ }).catch(() => {});
+  await api("/send", { from: SESSION, to: "all", text: `✅ ${SESSION} recovered`, project: PROJ, kind: "status" }).catch(() => {});
   cmuxStatus("ok", "#14b8a6", "check"); herdrAgent("idle");
 }
 
@@ -461,6 +462,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   const pf = join(homedir(), ".agent-bus", `turn-${AGENT}-${PROJ}.txt`);
   appendFileSync(pf, "", { flag: "w" }); // truncate
   appendFileSync(pf, prompt);
+  // #5868: where HEAD stood when the turn began. A turn that moved it shipped real work, and an
+  // exit-0 turn with real output must never be re-labelled "auth" by the #5405 escalation — the
+  // qwen specimen committed aa3c340 while its captured stream still tripped the auth regex.
+  const headBefore = gitOut(["rev-parse", "HEAD"], TURN_DIR);
   let cmd = (isFirst || (cli.sid && !sid)) ? cli.first : cli.next;
   const mfrag = MODEL && cli.mflag ? `${cli.mflag}${MODEL}` : "";
   cmd = cmd.replaceAll("{M}", mfrag).replaceAll("{P}", pf).replaceAll("{SID}", sid);
@@ -543,10 +548,15 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
   // fail the turn. Telemetry keeps the REAL exit; the returned code is the effective one every
   // call site branches on (kickoff, pulse, deliverWake).
   let effExit = realExit;
-  if (realExit === 0 && looksLikeAuthDeath(ownOut)) {
+  let authHit = "";
+  // #5868: a NEW commit since turn start is real work, and an exit-0 turn with real output is
+  // never re-labelled auth — the qwen specimen exited 0 with a shipped commit (aa3c340) while a
+  // short capture of echoed contract text tripped the regex.
+  const newCommit = !!headBefore && gitOut(["rev-parse", "HEAD"], TURN_DIR) !== headBefore;
+  if (realExit === 0 && looksLikeAuthDeath(ownOut, newCommit)) {
     effExit = 1;
-    const hit = AUTH_MARKER_RE.exec(ownOut)[0];
-    log(`\x1b[31mexit 0 but the turn output IS an auth failure — treating as FAILED (auth, "${hit}")\x1b[0m`);
+    authHit = AUTH_MARKER_RE.exec(ownOut)[0];
+    log(`\x1b[31mexit 0 but the turn output IS an auth failure — treating as FAILED (auth, "${authHit}")\x1b[0m`);
   }
   // #5481: the Inception/Mercury trap — exit 0 with a NULL completion. ERRF is the TOTAL output
   // capture, not just stderr: every seat's stdout is tee'd into it (`| tee -a ERRF` for the
@@ -562,7 +572,10 @@ async function runTurn(prompt, isFirst, trigger = "kickoff") {
     lastEmptyOutput = true;
     log("\x1b[31mexit 0 but the turn produced NO output — treating as FAILED (empty-output)\x1b[0m");
   }
-  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput });
+  // #5868: the verdict rides the telemetry row so a classification survives the pane scrolling
+  // away — the same "classified X because Y" shape the runner logs, in the seat's jsonl forever.
+  const verdict = verdictFor(realExit, effExit, lastEmptyOutput, ownOut);
+  telemetry({ ts: Date.now(), agent: AGENT, project: PROJ, turn: TURN, trigger, model: MODEL || "cli-default", duration_ms: Date.now() - t0, exit: realExit, effExit, authFailed: effExit !== realExit, emptyOutput: lastEmptyOutput, verdict });
   log(`turn ended (exit ${realExit}${effExit !== realExit ? ` → effective ${effExit} (${lastEmptyOutput ? "empty-output" : "auth"})` : ""}, ${((Date.now() - t0) / 1000).toFixed(0)}s)`);
   if (realExit === 0 && effExit === 0) { cmuxStatus("idle", "#8a94a6", "robot"); herdrAgent("idle"); }   // finished this turn, waiting for the next
   // #5965 — TURN END. A clean exit means the seat is idle again; say so right away so the app stops
@@ -604,6 +617,57 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   return built.prompt;
 }
 
+const RECEIPT_MARKER = "✅ done on";
+const CARD_REF_RE = /#\d{1,7}(?!\d)/;
+
+// Runner-authored metadata is bus state, not work. Typed messages are authoritative; `re` and the
+// stable text marker keep a mixed-version crew safe while older runners are still on the bus.
+function isReceipt(message) {
+  const text = String(message?.text || "").trimStart();
+  return message?.kind === "receipt" || Number(message?.re) > 0 || text.startsWith(RECEIPT_MARKER);
+}
+
+function isStatusBroadcast(message) {
+  if (message?.to !== "all") return false;
+  if (message?.kind === "status") return true;
+  const text = String(message?.text || "").trim();
+  return /^[A-Za-z0-9_.-]+ reporting — ready for a contract\b/.test(text)
+    || /^[✅⚠️🛑]\s+\S+\s+(?:recovered|turn FAILED|DOWN)\b/.test(text);
+}
+
+function isContract(message) {
+  const text = String(message?.text || "");
+  return message?.kind === "contract" || /^\s*contract\s*:/i.test(text) || CARD_REF_RE.test(text);
+}
+
+function isRunnerSession(session) {
+  const suffix = `:${PROJ}`;
+  const name = String(session || "");
+  if (!name.endsWith(suffix)) return false;
+  const label = name.slice(0, -suffix.length);
+  // Crew labels are CLI/provider slugs. Host sessions keep their machine-style identity and remain
+  // valid direct assigners; runner-to-runner prose needs `contract:` or a card reference.
+  return /^[a-z0-9_.-]+$/.test(label) && !label.startsWith("hub:");
+}
+
+function shouldWake(message) {
+  if (isReceipt(message) || isStatusBroadcast(message)) return false;
+  if (message?.to === SESSION) {
+    if (message?.kind === "status") return false;
+    return !isRunnerSession(message?.from) || isContract(message);
+  }
+  return message?.to === "all"
+    && isContract(message)
+    && (message.text.includes(`@${AGENT}`) || message.text.toLowerCase().includes(`${AGENT}:`));
+}
+
+function askedExcerpt(message) {
+  let text = String(message?.text || "").replace(/\s+/g, " ").trim();
+  const nested = text.search(/\s+[·|]\s*asked\s*:/i);
+  if (nested >= 0) text = text.slice(0, nested).trim();
+  return text.slice(0, 120);
+}
+
 (async () => {
   await loadLessons();
   // start cursor at the CURRENT tip so we don't replay history
@@ -618,7 +682,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     const { loadOrCreate } = await import("../lib/identity.mjs");
     await sfetchJson(`${HUB}/send`, {
       identity: loadOrCreate(SESSION, "agent"),
-      payload: { from: SESSION, to: "all", project: PROJ, text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
+      payload: { from: SESSION, to: "all", project: PROJ, kind: "status", text: `${AGENT} reporting — ready for a contract${MODEL ? ` (${MODEL})` : ""}` },
       signal: AbortSignal.timeout(2500),
     });
   } catch {}
@@ -627,8 +691,8 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
   // broadcasts batched behind them. Restored from disk first: a runner that was killed mid-turn
   // (or a machine that rebooted) still owes those messages, and the hub will never send them again.
   const restored = loadPending();
-  let pendingWake = restored.wake;
-  let pendingBcast = restored.bcast;
+  let pendingWake = restored.wake.filter(shouldWake);
+  let pendingBcast = restored.bcast.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
   let retryAt = 0;            // 0 = deliver at the next opportunity
   let deliveryFails = 0;      // consecutive failed attempts at the SAME pending batch
   if (pendingWake.length) log(`\x1b[33m${pendingWake.length} message(s) survived from a previous run — redelivering\x1b[0m`);
@@ -675,6 +739,10 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // never wake on your own broadcasts: a claude seat's report contains "claude:" and matched the
     // @mention filter, buying one echo turn per report (seen live on the first pulsed orchestrator)
     msgs = msgs.filter(m => m.from !== SESSION);
+    // A receipt is the terminal state of a contract, never a new contract. Consume typed receipts,
+    // reply-linked outcomes, and the old stable marker before direct-address logic sees them. Status
+    // broadcasts are presence chatter and are dropped rather than saved as future prompt context.
+    msgs = msgs.filter(m => !isReceipt(m) && !isStatusBroadcast(m));
     // #5760 (the night of 08-31): the hub's hourly "same-project-sessions" FYI woke every seat
     // into a real CLI turn — three wedged for hours mid-chatter, one on the metered pool. That
     // kind is pure coordination CONTEXT ("no human needs to relay this" — and no turn needs to
@@ -682,8 +750,8 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // warnings still wake — those are actionable by the seat right now.
     const fyi = msgs.filter(m => m.from === "hub:duty" && String(m.text || "").startsWith("🤝 OVERSEER same-project-sessions"));
     const rest = msgs.filter(m => !fyi.includes(m));
-    const direct = rest.filter(m => m.to === SESSION);
-    const mentions = rest.filter(m => m.to === "all" && (m.text.includes(`@${AGENT}`) || m.text.toLowerCase().includes(`${AGENT}:`)));
+    const direct = rest.filter(m => m.to === SESSION && shouldWake(m));
+    const mentions = rest.filter(m => m.to === "all" && shouldWake(m));
     const bcast = [...rest.filter(m => m.to === "all" && !mentions.includes(m)), ...fyi];
     pendingBcast.push(...bcast);                      // wake-policy: plain broadcasts batch, they don't wake
     const wake = [...direct, ...mentions];
@@ -695,7 +763,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
       const dropped = pendingWake.splice(0, pendingWake.length - PENDING_MAX);
       log(`\x1b[31mundelivered queue overflowed — dropped ${dropped.length} oldest message(s)\x1b[0m`);
       await api("/send", { from: SESSION, to: "all", project: PROJ,
-        text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
+        kind: "status", text: `⚠️ ${SESSION} dropped ${dropped.length} undelivered message(s) — queue hit its ${PENDING_MAX} cap during a failure streak` }).catch(() => {});
     }
     savePending(pendingWake, pendingBcast);
     // Respect an active backoff: a new message during an outage joins the batch, it does not
@@ -728,7 +796,7 @@ function composedTurn({ base = "", wakeText = "", ctxText = "", againText = "",
     // Who is owed an answer, captured BEFORE the turn: pendingWake is cleared on success.
     const assigners = [];
     for (const m of wake) if (m.from && !assigners.some(a => a.from === m.from)) assigners.push({ from: m.from, id: m.id });
-    const asked = String(wake[0]?.text || "").replace(/\s+/g, " ").trim().slice(0, 90);
+    const asked = askedExcerpt(wake[0]);
     const tStart = Date.now();
     const prompt = composedTurn({
       wakeText, ctxText, againText,

package/bin/crew.sh

@@ -352,7 +352,7 @@ spawn_herdr() {   # $@ = specs
   local surfs=()
   [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     if [ -n "$REUSE_WS" ]; then
       # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
@@ -733,7 +733,8 @@ echo "[crew] hub for $PROJ: $HUB_URL (baked into every seat; CREW_HUB=<url> over
 SCROOGE="$BUS_DIR/engine/bin/scrooge"
 [ -f "$SCROOGE" ] || SCROOGE="$(command -v scrooge 2>/dev/null || echo scrooge)"
 
-# resolve_model <agent> <provider> <task> <diff> -> echoes a runner-ready model id, or empty (→ CLI default).
+# resolve_model <agent> <provider> <task> <diff> -> echoes a provider-qualified model id.
+# A provider seat must never fall through to opencode's unrelated global default.
 resolve_model() {
   local agent="$1" provider="$2" task="$3" diff="$4" cands="" out=""
   cands="$(opencode models "$provider" 2>/dev/null | tr '\n' ' ')"
@@ -742,16 +743,34 @@ resolve_model() {
   else
     out="$(python3 "$SCROOGE" route --provider "$provider" -t "$task" -d "$diff" --json 2>/dev/null)"
   fi
-  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — CLI default" >&2; return 0; }
-  printf '%s' "$out" | python3 -c 'import json,sys
+  if [ -n "$out" ]; then
+    out="$(printf '%s' "$out" | python3 -c 'import json,sys
 try: print(json.load(sys.stdin).get("qualified") or "")
-except Exception: pass' 2>/dev/null
+except Exception: pass' 2>/dev/null)"
+  fi
+  # The router can be absent (a fresh machine, a dry run, scrooge without its registry). That must
+  # never hand the seat to opencode's GLOBAL default (#6068, the DeepSeek bill) and must not drop
+  # the seat either (#6110): fall back INSIDE the provider — the head of its own catalog — and say so.
+  if [ -z "$out" ] && [ -n "$cands" ]; then
+    out="$provider/${cands%% *}"
+    echo "[crew] router unavailable for $agent:$provider — using the provider's own catalog head ($out)" >&2
+  fi
+  [ -n "$out" ] || { echo "[crew] live model selection failed for $agent:$provider — no router and no catalog; refusing opencode global default" >&2; return 1; }
+  [ "${out%%/*}" = "$provider" ] || {
+    echo "[crew] router selected $out outside $provider — refusing cross-provider fallback" >&2
+    return 1
+  }
+  printf '%s' "$out"
 }
 
 epoch_ms() { python3 -c 'import time;print(int(time.time()*1000))'; }
 
 # resolve_spec <spec> -> sets AGENT + MODEL globals (live-selects a provider-only spec).
-AGENT=""; MODEL=""
+# On failure, returns 1 (AGENT is still set; MODEL is empty) instead of exiting the whole script —
+# callers are responsible for skipping that one seat and continuing the batch. SKIPPED_SEATS
+# accumulates "agent: reason" entries across every spawn path so `up` can report + exit non-zero
+# at the end without killing seats that already launched earlier in the loop.
+AGENT=""; MODEL=""; SKIPPED_SEATS=()
 resolve_spec() {
   local SPEC="$1" FIELD
   AGENT="${SPEC%%:*}"; MODEL=""
@@ -760,16 +779,39 @@ resolve_spec() {
   # into the launcher string. AGENT is set above and DIR is fixed, so this is the earliest safe point.
   reap_seat
   FIELD=""; [ "$SPEC" != "$AGENT" ] && FIELD="${SPEC#*:}"
-  [ "$AGENT" = "openrouter" ] && [ -z "$FIELD" ] && FIELD="openrouter"
+  # Bare native seats use their own CLI defaults. Bare opencode-hosted seats MUST name their
+  # provider implicitly: glm is the one non-obvious alias; every discovered/BYOM seat's label is
+  # its provider id. Leaving FIELD empty is what handed qwen/glm to opencode's global DeepSeek.
+  if [ -z "$FIELD" ]; then
+    case "$AGENT" in
+      codex|kimi|claude|gemini|dsh|opencode) ;;
+      glm) FIELD="zai-coding-plan" ;;
+      *) FIELD="$AGENT" ;;
+    esac
+  fi
   if [ -n "$FIELD" ]; then
     case "$FIELD" in
       */*) MODEL="$FIELD" ;;
-      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")"
-           if [ -n "$MODEL" ]; then echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)"
-           else echo "  → $AGENT: '$FIELD' live selection unavailable — CLI default"; fi ;;
+      *)   MODEL="$(resolve_model "$AGENT" "$FIELD" "$TASK" "$DIFF")" || {
+             echo "[crew] ✗ skipping seat '$AGENT' — model resolution failed for $FIELD ($TASK/$DIFF); remaining seats still launch" >&2
+             SKIPPED_SEATS+=("$AGENT: model resolution failed for $FIELD ($TASK/$DIFF)")
+             return 1
+           }
+           echo "  → $AGENT: live model $MODEL ($FIELD · $TASK/$DIFF)" ;;
     esac
   fi
 }
+# report_skipped_seats: prints a summary of every seat resolve_spec skipped this run (if any) and
+# returns 1 so callers can propagate a non-zero exit — the whole point is that a batch with some
+# skips still launched the rest of the crew, so this is a REPORT, not an abort.
+report_skipped_seats() {
+  [ "${#SKIPPED_SEATS[@]}" -gt 0 ] || return 0
+  echo ""
+  echo "✗✗ ${#SKIPPED_SEATS[@]} seat(s) skipped (model resolution failed) — the rest of the crew still launched:"
+  local s
+  for s in "${SKIPPED_SEATS[@]}"; do echo "   - $s"; done
+  return 1
+}
 # Kill any runner ALREADY serving this exact agent+project before starting another.
 #
 # Without this, `trantor up <agent>` ADDS a runner instead of replacing one — and every duplicate
@@ -801,7 +843,7 @@ spawn_tmux() {   # $@ = specs
   # a pre-existing session for THIS project = the crew is already up; add missing seats as new panes.
   tmux has-session -t "$TMUX_SESS" 2>/dev/null && first=0
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     local pane=""
     if [ "$first" = "1" ]; then
@@ -852,7 +894,7 @@ spawn_grid() {   # $@ = specs
   local ROWS=$(( (N + COLS - 1) / COLS ))
   local CW=$(( GW / COLS )) CH=$(( GH / ROWS )) i=0 SPEC
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd; cmd="$(RUN_CMD)"
     local C=$(( i % COLS )) R=$(( i / COLS )) X1 Y1 WID=""
     X1=$(( GX + C * CW )); Y1=$(( GY + R * CH ))
@@ -937,7 +979,7 @@ spawn_cmux() {   # $@ = specs
   local surfs=()
   [ -n "$REUSE_WS" ] && wsid="$REUSE_WS"
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
     if [ -n "$REUSE_WS" ]; then
       # replace-in-place: split the fresh pane FIRST (targeting the agent's old pane when tracked),
@@ -1039,7 +1081,7 @@ OSA
   fi
   [ -n "$REUSE_TAB" ] && { tabid="$REUSE_TAB"; echo "  → reusing existing crew workspace for $PROJ ($tabid)"; }
   for SPEC in "$@"; do
-    resolve_spec "$SPEC"
+    resolve_spec "$SPEC" || continue
     local cmd launcher; cmd="$(RUN_CMD)"; launcher="$(_seat_launcher "$AGENT" "$cmd")"
     # In REUSE mode, replace-in-place: split off the agent's old terminal when tracked, close it after.
     local OLD_SURF=""
@@ -1160,7 +1202,11 @@ echo "— bringing up crew for $PROJ ($CREW_UI) —"
 SPAWN_EPOCH=$(epoch_ms)
 spawn_crew "$@"
 
-if [ "$DRY" = "1" ]; then echo "— dry run: no bus verify —"; exit 0; fi
+if [ "$DRY" = "1" ]; then
+  echo "— dry run: no bus verify —"
+  report_skipped_seats
+  exit $?
+fi
 echo "— verifying on the bus (the spawn is not the truth; the bus is) —"
 AGENTS_ONLY=$(for a in "$@"; do printf "%s " "${a%%:*}"; done)
 VER=$(node "$BUS_DIR/bin/crew-verify.mjs" "$PROJ" $AGENTS_ONLY --since "$SPAWN_EPOCH" --timeout 30)
@@ -1181,3 +1227,5 @@ if [ -n "${RETRY// }" ]; then
   fi
 fi
 echo "— crew verified on the bus. Send contracts with relay_send; runners keep agents alive for free. Teardown (this project only): trantor down —"
+report_skipped_seats
+exit $?

package/bin/new.mjs

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 // trantor new — project genesis, the CLI half (#5862). One command stands a project up:
 //
-//   trantor new <name> [--from <git-url>] [--brief <file>] [--dir <path>] [--adopt] [--json]
+//   trantor new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json]
 //
-// It makes the directory under the dev root (TRANTOR_DEV_ROOT or ~/development), starts git on
-// main (or clones --from, or adopts an existing folder with --adopt), seeds CLAUDE.md from the
+// It makes the project directory at <parent>/<name> — --dir names the PARENT, never the project
+// directory itself (default parent: TRANTOR_DEV_ROOT or ~/development). The name is always
+// appended under it, so `--dir P` with name N creates P/N. Starts git on main (or clones --from,
+// or adopts an existing folder with --adopt), seeds CLAUDE.md from the
 // brief (verbatim brief + the trantor conventions block), installs the same auto-card hook as
 // `trantor init-hooks`, posts the brief as the hub project brief (POST /project — the same call
 // relay_project_brief makes), and opens the first card "genesis: <name>" on the new board.
@@ -17,7 +19,8 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, append
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ensureEnrolled, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
+import { ensureEnrolled as enrollTofu, loadIdentity, signedPost } from "../hooks/lib/api.mjs";
+import { ensureEnrolled as enrollViaOwnerInvite } from "../lib/enroll.mjs";
 import { setAutonomy } from "../lib/autonomy.mjs";
 import { resolveHub, setProjectHub } from "../lib/project.mjs";
 
@@ -52,7 +55,7 @@ const flag = (n) => { const i = args.indexOf("--" + n); return i >= 0 ? args[i +
 const has = (n) => args.includes("--" + n);
 const json = has("json");
 const name = args.find(a => !a.startsWith("--"));
-if (!name) die("usage: trantor new <name> [--from <git-url>] [--brief <file>] [--dir <path>] [--adopt] [--json]");
+if (!name) die("usage: trantor new <name> [--from <git-url>] [--brief <file>] [--dir <parent>] [--adopt] [--json] — project lands at <parent>/<name>");
 if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) die(`invalid project name "${name}" — letters, digits, dot, dash, underscore`);
 const from = flag("from");
 const briefFile = flag("brief");
@@ -120,10 +123,18 @@ const identity = loadIdentity(session);
 let card = null;
 let hubError = null;
 try {
-  await ensureEnrolled(session, identity, name);
+  // The genesis identity is BRAND NEW — it cannot write to a project on an enforce hub until the
+  // hub knows it. TOFU /enroll only works on a local loopback hub; a remote enforce hub refuses it
+  // (403 "tofu enrollment refused") and the genesis silently records nothing (#6049). So enroll the
+  // way crew seats do: the operator's owner key mints a project-scoped write invite and the genesis
+  // identity spends it. Only when NO owner key is configured (a loopback hub with no owner identity)
+  // do we fall back to the plain TOFU enroll.
+  const viaOwner = await enrollViaOwnerInvite(hub, identity, name, { timeoutMs: 8000 });
+  if (!viaOwner.ok && viaOwner.reason === "no-owner-key") await enrollTofu(session, identity, name);
+  else if (!viaOwner.ok) console.error(`genesis: enrollment via owner invite failed: ${viaOwner.reason}`);
   const briefForHub = (brief || `Genesis of ${name} — created by trantor new.`).slice(0, 600);
   const r1 = await signedPost("/project", { project: name, brief: briefForHub, by: session }, { session, project: name, timeoutMs: 8000 });
-  if (!r1.ok) throw new Error(`hub ${r1.status} on /project`);
+  if (!r1.ok) throw new Error(`hub ${r1.status} on /project${r1.json?.error ? `: ${r1.json.error}` : ""}`);
   const r2 = await signedPost("/task", {
     project: name,
     title: `genesis: ${name}`,
@@ -131,7 +142,7 @@ try {
     by: session,
     note: "project genesis — created by trantor new",
   }, { session, project: name, timeoutMs: 8000 });
-  if (!r2.ok) throw new Error(`hub ${r2.status} on /task`);
+  if (!r2.ok) throw new Error(`hub ${r2.status} on /task${r2.json?.error ? `: ${r2.json.error}` : ""}`);
   card = r2.json?.task?.id ?? null;
 } catch (e) {
   hubError = e instanceof Error ? e.message : String(e);
@@ -139,8 +150,10 @@ try {
 }
 
 // ── report ──────────────────────────────────────────────────────────────────────────────────────
+// dir is the created project directory <parent>/<name>; parent is the --dir (or default) root the
+// name was appended under — the two together state the parent contract explicitly.
 if (json) {
-  console.log(JSON.stringify({ name, dir, branch, hub, card }));
+  console.log(JSON.stringify({ name, parent: devRoot, dir, branch, hub, card }));
 } else {
   console.log(`✓ ${dir} (${branch}${from ? ", cloned" : adopt ? ", adopted" : ""})`);
   console.log(`✓ CLAUDE.md seeded${brief ? " from the brief" : " (no brief — add the project's what/why/goal)"}`);

package/bin/patrol.mjs

@@ -43,6 +43,11 @@ function rowMatchesRunner(row, runner) {
   return !rp || rp === runnerProject(runner);
 }
 
+function seatProvider(agent) {
+  if (["codex", "kimi", "claude", "gemini", "dsh", "opencode"].includes(agent)) return null;
+  return agent === "glm" ? "zai-coding-plan" : agent;
+}
+
 function sortedProjects(projects) {
   return [...projects].sort((a, b) => displayProject(a).localeCompare(displayProject(b)));
 }
@@ -76,6 +81,7 @@ export function buildPatrolReport(rawInventory = {}, reaped = [], { bus = busDir
   const workspaceIds = new Set(workspaces.map(w => String(w?.id || "")).filter(Boolean));
   const orphans = [];
   const ambiguous = [];
+  const warnings = [];
 
   for (const runner of runners) {
     if (isBusInternalRunner(runner, bus)) continue;
@@ -85,6 +91,18 @@ export function buildPatrolReport(rawInventory = {}, reaped = [], { bus = busDir
     } else if (!rows.some(row => rowMatchesRunner(row, runner))) {
       orphans.push({ type: "live-runner-without-row", project: p, agent: runner.agent, pid: runner.pid, dir: runner.dir });
     }
+    const expectedProvider = seatProvider(String(runner?.agent || ""));
+    const actualProvider = String(runner?.model || "").split("/")[0];
+    if (expectedProvider && actualProvider && actualProvider !== expectedProvider) {
+      warnings.push({
+        type: "seat-model-provider-mismatch",
+        project: p,
+        agent: runner.agent,
+        model: runner.model,
+        expectedProvider,
+        pid: runner.pid,
+      });
+    }
   }
 
   for (const ws of workspaces) {
@@ -124,7 +142,7 @@ export function buildPatrolReport(rawInventory = {}, reaped = [], { bus = busDir
     };
   }
 
-  return { projects: out, orphans, ambiguous, reaped };
+  return { projects: out, orphans, ambiguous, warnings, reaped };
 }
 
 function oldEnough(path, now, maxAgeMs) {
@@ -196,6 +214,10 @@ export function formatHuman(report) {
   for (const item of report.orphans) lines.push(`  - ${item.type}: ${displayProject(item.project)} ${item.agent || item.title || item.handle || item.id || ""}`.trimEnd());
   lines.push(`ambiguous: ${report.ambiguous.length}`);
   for (const item of report.ambiguous) lines.push(`  - ${item.type}: ${item.agent || item.title || item.dir || item.id || ""}`.trimEnd());
+  lines.push(`warnings: ${report.warnings?.length || 0}`);
+  for (const item of report.warnings || []) {
+    lines.push(`  - ${item.type}: ${displayProject(item.project)} ${item.agent} runs ${item.model}; expected ${item.expectedProvider}/*`);
+  }
   lines.push(`reaped: ${report.reaped.length}`);
   for (const item of report.reaped) lines.push(`  - ${item.type}: ${item.path || item.output || ""}`.trimEnd());
   return `${lines.join("\n")}\n`;

package/hooks/lib/resources.mjs

@@ -22,6 +22,16 @@ const TIMEOUT = 2000;                                            // contract: ev
 
 const busDir = () => process.env.RELAY_DATA_DIR || join(homedir(), ".agent-bus");
 
+function opencodeDefaultModel() {
+  try {
+    const home = process.env.HOME || homedir();
+    const configDir = process.env.XDG_CONFIG_HOME || join(home, ".config");
+    const config = JSON.parse(readFileSync(join(configDir, "opencode", "opencode.json"), "utf8"));
+    const model = config?.model;
+    return /^[^\s/]+\/[^\s/]+$/.test(model) ? String(model) : "";
+  } catch { return ""; }
+}
+
 // Run a subprocess, return stdout; "" on ANY failure (missing binary, nonzero exit, timeout).
 function run(cmd, args, env = {}) {
   try {
@@ -75,7 +85,7 @@ function psTable() {
   return rows;
 }
 
-// Live crew-runner processes → [{pid,agent,dir}]. Runner argv (crew.sh RUN_CMD) is
+// Live crew-runner processes → [{pid,agent,dir,model}]. Runner argv (crew.sh RUN_CMD) is
 // `node …/crew-runner.mjs <agent> <dir>` — dir is the LAST argument, so the regex is anchored
 // on end-of-string. project=null → all runners; project given → only runners whose dir resolves
 // to that project. Resolution is the lib/project.mjs walk (git-root basename, else dir basename)
@@ -84,6 +94,7 @@ function psTable() {
 export function liveRunners(project = null) {
   try {
     const out = [];
+    const globalModel = opencodeDefaultModel();
     for (const { pid, cmd } of psTable()) {
       const m = cmd.match(/crew-runner\.mjs\s+(\S+)\s+(\S+)\s*$/);
       if (!m) continue;
@@ -92,7 +103,13 @@ export function liveRunners(project = null) {
         const name = basename(gitRoot(dir) || dir);
         if (name !== project) continue;
       }
-      out.push({ pid, agent, dir });
+      // CREW_MODEL is fixed for the runner lifetime. Read only that named environment field —
+      // never return the rest of `ps eww`, which can contain provider credentials.
+      const envLine = run("ps", ["eww", "-p", String(pid), "-o", "command="]);
+      const pinnedModel = (envLine.match(/(?:^|\s)CREW_MODEL=([^\s]*)/) || [])[1] || "";
+      const model = pinnedModel || globalModel;
+      const modelSource = pinnedModel ? "crew" : (globalModel ? "opencode-global" : "");
+      out.push({ pid, agent, dir, model, modelSource });
     }
     return out;
   } catch { return []; }

package/hub.mjs

@@ -2627,7 +2627,8 @@ const server = http.createServer(async (req, res) => {
       // is guesswork: a seat still working and a seat that died look identical from the sender's
       // side, which is how an orchestrator ends up waiting forever on a dead peer.
       const re = Number.isFinite(Number(b.re)) && Number(b.re) > 0 ? Number(b.re) : 0;
-      const msg = { id: ++state.seq, ts: now(), from: b.from || "anon", to: b.to || "all", text, project: String(b.project || fromProj || "").slice(0, 80), ...(re ? { re } : {}) };
+      const kind = String(b.kind || "").slice(0, 40);
+      const msg = { id: ++state.seq, ts: now(), from: b.from || "anon", to: b.to || "all", text, project: String(b.project || fromProj || "").slice(0, 80), ...(re ? { re } : {}), ...(kind ? { kind } : {}) };
       state.messages.push(msg); if (state.messages.length > 5000) state.messages.splice(0, 1000);
       dirty = true; pushToStreams(msg);               // <-- instant push to live watchers
       // Mirror onto the unified log. `refs` = the card ids this message cites (#3701), which is what

package/lib/classify-failure.mjs

@@ -8,10 +8,18 @@
 // matched AUTH_MARKER_RE's bare "forbidden", and the codex lesson "retries burn quota" matched
 // the exhausted rule. Three fixes, one per failure mode:
 //   · stripPromptEcho — a prompt line reappearing in the err stream is the CLI REPLAYING what it
-//     was told, not the CLI speaking; classification sees only the CLI's own output.
+//     was told, not the CLI speaking; classification sees only the CLI's own output. The exact-
+//     match version (9b28036) caught nothing in the wild: the qwen specimen (turn 9, 2026-09-02,
+//     card #5868) echoed its CONTRACT — the #6049 wake text is ABOUT a hub 401, dense with "401",
+//     "unknown identity", "credentials" — wrapped in CLI framing no prompt line equals verbatim.
+//     The strip now normalizes (ANSI off, whitespace collapsed) and drops a line that CONTAINS a
+//     prompt line or is a wrapped FRAGMENT of one, so replay is caught however the CLI frames it.
 //   · looksLikeAuthDeath — the #5405 exit-0 escalation fires only on a SHORT error-only output
 //     (the opencode "401 Unauthorized" specimen is a couple of lines); a long output is a real
-//     answer, and a warning inside it must not fail the turn.
+//     answer, and a warning inside it must not fail the turn. AND never when the turn produced
+//     REAL WORK (a new commit): the qwen specimen exited 0, committed aa3c340, and its captured
+//     stream still held under 400 bytes of contract echo carrying "401" — a short capture is not
+//     proof of a dead turn, but a shipped commit is proof of a live one.
 //   · classifyFailure — "exhausted" demands an explicit quota/rate-limit message; the broad bare
 //     words ("credit", "balance", bare "insufficient") labelled ordinary prose on a dead turn and
 //     sent the operator to wait out a window that did not exist.
@@ -19,25 +27,69 @@ import { readFileSync } from "node:fs";
 
 export const AUTH_MARKER_RE = /unauthor|401|403|forbidden|invalid[ _-]?api[ _-]?key|authentication? failed|token expired/i;
 
-/** Prompt lines (≥40 chars — a short line carries no signature) echoed back verbatim by the CLI
- *  are replay, not speech. Returns the err stream with those lines removed. */
+/** Prompt lines (≥40 chars — a short line carries no signature) echoed back by the CLI are
+ *  replay, not speech. Echoes are rarely byte-identical (CLI framing, terminal wrapping, ANSI
+ *  colors — the exact-match strip caught nothing in the qwen #6049 specimen), so both sides are
+ *  normalized (ANSI stripped, whitespace collapsed) and a long line is dropped when it CONTAINS
+ *  a prompt line, IS a fragment of one, or contains a ≥40-char RUN of one — terminal wrapping
+ *  breaks the line but preserves long runs inside each wrapped piece. */
+const ECHO_RUN = 40;
 export function stripPromptEcho(errText, promptText) {
   const text = String(errText || "");
   if (!promptText) return text;
-  const echo = new Set(String(promptText).split("\n").filter(l => l.length >= 40));
-  return text.split("\n").filter(l => !(l.length >= 40 && echo.has(l))).join("\n");
+  const norm = (l) => String(l).replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\s+/g, " ").trim();
+  const promptLines = String(promptText).split("\n").map(norm).filter(Boolean);
+  if (!promptLines.length) return text;
+  const prompts = promptLines.filter(l => l.length >= 40);
+  // Whole-prompt normalized text, for the short-line VERBATIM check below: a short line has no
+  // 40-char run to fuzzy-match against (that's the ECHO_RUN heuristic for long lines), but a short
+  // echoed wake fragment ("check the 401 on the hub") still reappears byte-for-byte (post-
+  // normalization) as a line or substring of the prompt — that's still replay, not the CLI's own
+  // voice, and must not survive to trip looksLikeAuthDeath on a healthy exit-0 turn (#6110).
+  const promptFull = promptLines.join(" ");
+  const hasRun = (p, n) => {
+    for (let i = 0; i + ECHO_RUN <= p.length; i++) if (n.includes(p.slice(i, i + ECHO_RUN))) return true;
+    return false;
+  };
+  return text.split("\n").filter(line => {
+    const n = norm(line);
+    if (!n) return true;
+    // Short lines: survive unless they are a multi-word fragment (has a space — excludes a bare
+    // token like "codex" or "4,387" that trivially co-occurs with unrelated prompt text) that
+    // appears verbatim in the prompt. A genuine short CLI error the prompt never mentioned, or a
+    // single echoed token, still passes through untouched; a full echoed phrase does not.
+    if (n.length < 40) return !(n.includes(" ") && promptFull.includes(n));
+    return !prompts.some(p => n.includes(p) || p.includes(n) || hasRun(p, n));
+  }).join("\n");
 }
 
 /** A real answer is long; an auth death is a couple of lines. The opencode specimen (#5405)
  *  printed its whole failure in under a hundred characters and produced nothing else. */
 export const OWN_OUTPUT_ANSWER_MIN = 400;
 
-/** The #5405 rule, refined by #5868: exit 0 + an auth-shaped marker means FAILED only when the
- *  CLI's own output is short enough to be JUST the error. */
-export function looksLikeAuthDeath(ownText) {
+/** The #5405 rule, refined twice by #5868: exit 0 + an auth-shaped marker means FAILED only when
+ *  the CLI's own output is short enough to be JUST the error — and NEVER when the turn did real
+ *  work (newCommit, checked by the runner via git): a shipped commit is a live turn, whatever the
+ *  captured stream happens to hold. */
+export function looksLikeAuthDeath(ownText, realWork = false) {
+  if (realWork) return false;
   return String(ownText || "").length < OWN_OUTPUT_ANSWER_MIN && AUTH_MARKER_RE.test(ownText);
 }
 
+/** The one-line verdict the seat's jsonl carries (#5868): why the runner judged the turn the way
+ *  it did, phrased exactly like the runner's own "classified X because Y" log — so a pane that
+ *  scrolls away loses nothing that the telemetry row needs to say. */
+export function verdictFor(realExit, effExit, emptyOutput, ownText) {
+  if (realExit === 0 && effExit === 0) return "classified success because exit 0 with CLI output";
+  if (realExit === 0 && effExit === 1) {
+    if (emptyOutput) return "classified empty-output because exit 0 with no output on either stream";
+    const m = AUTH_MARKER_RE.exec(String(ownText || ""));
+    return `classified auth because ${m ? m[0] : "auth marker"} in the CLI's own short output`;
+  }
+  const { reason, matched } = classifyFailure(realExit, String(ownText || ""), emptyOutput);
+  return `classified ${reason} because ${matched}`;
+}
+
 /** Classify one failed turn. Returns { reason, matched } — matched is the evidence excerpt the
  *  runner logs, so the next misclassification is diagnosable from the seat log alone. */
 export function classifyFailure(exit, errText, emptyOutput = false) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.30",
+  "version": "0.18.32",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"
@@ -11,7 +11,7 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
+    "test": "node bin/slop-gate.mjs --surface desktop/src && node test.mjs && node test-scenarios.mjs && node test-failure.mjs && node test-redelivery.mjs && node test-crew-completion.mjs && node test-contracts.mjs && node test-autonomy.mjs && node test-integrate.mjs && node test-handoff.mjs && node test-handoff-summarizer.mjs && node test-baton-turn-boundary.mjs && node test-agents.mjs && node test-update.mjs && node test-handoff-guard.mjs && node test-baton-latest.mjs && node test-balances.mjs && node test-usage-live.mjs && node test-subagent-cost.mjs && node test-inbox.mjs && node test-inflight.mjs && node test-notify.mjs && node test-focus.mjs && node test-cardlog.mjs && node test-checklist.mjs && node test-relay-note.mjs && node test-reaper.mjs && node test-events.mjs && node test-proposals.mjs && node test-scrub.mjs && node test-store-delta.mjs && node test-message-re.mjs && node test-claims.mjs && node test-adopt.mjs && node test-summarize.mjs && node test-identity-core.mjs && node test-identity.mjs && node test-identity-instances.mjs && node test-duty.mjs && node test-duty-dark.mjs && node test-duty-seat.mjs && node test-discovery.mjs && node test-doctor.mjs && node test-crew-env.mjs && node test-desktop-transport.mjs && node test-crew-worktree.mjs && node test-crew-redact.mjs && node test-crew-classify.mjs && bash test-crew-herdr.sh && npm --prefix desktop run test --silent && node test-splitbrain.mjs && node test-overseer.mjs && node test-overseer-lib.mjs && node test-overseer-warn.mjs && node test-provider-keys.mjs && node test-provider-cli.mjs && node test-crew-model-defaults.mjs && node test-inbox-delivery.mjs && node test-identity-drift.mjs && node test-inbox-staleness.mjs && node test-seats.mjs && node test-seat-identity.mjs && node test-hub-routing.mjs && node test-hook-routing.mjs && node test-relay-wait.mjs && node test-dsh-seat.mjs && node test-kimi-bridge.mjs && node test-kimi-events.mjs && python3 engine/test-routing.py && node test-new.mjs && node test-reconcile.mjs && node test-resources.mjs && node test-patrol.mjs && node test-bridge.mjs && bash test-crew.sh"
   },
   "description": "The hub-world for AI agent crews — orchestrate Claude Code, Codex, GLM, Kimi, DeepSeek & any OpenRouter model as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).",
   "files": [