trantor 0.18.59 → 0.18.61

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.59",
+  "version": "0.18.61",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/README.md

@@ -200,6 +200,14 @@ project takes over with a full window (and a PreCompact hook does this automatic
    **best live model** for the work at spawn (capability × cost), enumerated from the provider
    itself — never a guessed endpoint. **Serialized and then verified on the bus** — the launcher
    ends with "crew verified" or names the no-shows loudly. The orchestrator never gets a green lie.
+   **Seats build in their own git worktrees** (`~/.agent-bus/worktrees/<project>/<seat>`), and a
+   fresh checkout lacks gitignored files and cannot resolve relative sibling packages. Declare what a
+   worktree needs in `.trantor/worktree.json`:
+   `{"link": ["../sibling-repo"], "provision": [{"path": "ios/Config.swift", "mode": "link|stub|operator"}], "preflight": "npm test --silent"}`.
+   `trantor up` links the siblings beside the worktree, links or stubs the declared files (a real
+   credential is never copied; `operator` entries are named for you), runs the preflight once in the
+   first fresh worktree (5-minute cap) and prints `preflight ok` or the last 20 lines — broadcast on
+   the bus too, so the orchestrator sees it before writing contracts. No declaration, no preflight.
 3. **Work flows over the bus.** Contracts arrive as messages; each agent owns its own files;
    coordination happens in <280-char messages you can read on the dashboard. Crew members
    live under a **runner**: the CLI works one turn and exits, the runner long-polls the bus

package/bin/advise.mjs

@@ -15,7 +15,9 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
-import { busDir, readConfig } from "../lib/project.mjs";
+import { busDir, readConfig, resolveProject } from "../lib/project.mjs";
+import { loadCatalog, lookup as catalogLookup, effortParams, UNCATALOGUED_STATUS } from "../lib/model-catalog.mjs";
+import { benchedAt, loadSeatRecord } from "../lib/seat-record.mjs";
 
 const H = homedir();
 const read = (p, fb) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return fb; } };
@@ -119,7 +121,7 @@ const FORECAST = { easy: 0.3e6, medium: 1.5e6, hard: 6e6 };  // tokens
 const CREW_PREF = { hard: ["codex", "glm", "kimi", "deepseek", "openrouter"], medium: ["kimi", "glm", "codex", "deepseek", "openrouter"], easy: ["deepseek", "kimi", "glm", "codex", "openrouter"] };
 
 export function advise(input, world = loadWorld()) {
-  const { profile, registry, caps, agents, scrooge, roster = BUILTIN_ROSTER } = world;
+  const { profile, registry, caps, agents, scrooge, roster = BUILTIN_ROSTER, record } = world;
   // brought (discovered) opencode providers extend the preference list — appended LAST in every
   // tier (unknown strength a priori, like openrouter), so they fill once the curated seats are
   // taken, and are the only option for a user who brought nothing but a custom provider.
@@ -148,17 +150,39 @@ export function advise(input, world = loadWorld()) {
 
   // ---- routing per package ----
   const used = {};
+  // #7762: seats benched by the record ride along so the recommendation says WHO was benched,
+  // at which difficulty, and what their producing nothing already cost (tokens the crew burned).
+  const seatFeedback = [];
   const routing = pkgs.map(p => {
     if ((mode === "hybrid" || mode === "scrooge") && p.difficulty === "easy" && scrooge) {
       const m = scroogeModelFor(registry, caps, p.kind, p.difficulty);
       const tok = FORECAST.easy;
       const cost = m ? +(tok * 0.6 * m.cost_in / 1e6 + tok * 0.4 * m.cost_out / 1e6).toFixed(3) : null;
-      return { ...p, executor: "scrooge", model: m?.model, pool: "api", est_cost_usd: cost,
+      // #7777: scores pick WHICH model; the catalog says HOW to call it — attach the per-difficulty
+      // request parameters so the executor does not have to look them up again.
+      const catEntry = catalogLookup(m?.model);
+      const catParams = catEntry.found ? effortParams(m.model, p.difficulty, "openai-chat") : null;
+      const effort = catEntry.found
+        ? { found: true, difficulty: p.difficulty, api: "openai-chat", params: catParams || {} }
+        : { found: false, difficulty: p.difficulty, params: null, status: UNCATALOGUED_STATUS };
+      return { ...p, executor: "scrooge", model: m?.model, pool: "api", est_cost_usd: cost, effort,
         reason: `easy + stateless → cheapest capable model (${m?.model}); not worth a crew seat` };
     }
     if (p.owner === "self") return { ...p, executor: "orchestrator", pool: tierOf(profile, "claude"), reason: "architect-owned (foundation/integration doctrine) — the orchestrator keeps the shared contract in its own hands" };
     if (mode === "solo") return { ...p, executor: "orchestrator", pool: tierOf(profile, "claude"), reason: "small enough to do inline" };
-    const pref = [...CREW_PREF[p.difficulty], ...broughtPref].filter(a => agents.includes(a));
+    const prefAll = [...CREW_PREF[p.difficulty], ...broughtPref].filter(a => agents.includes(a));
+    // #7762 feedback loop: a seat whose last 3 cards AT THIS DIFFICULTY in THIS project were
+    // empty/bounced is benched at that difficulty — the redone work counts against it, so it
+    // stops being "the cheap option". A bench never empties the pool (better a struck seat
+    // than no seat), and the record is per project — never global.
+    const struck = prefAll.map(a => [a, benchedAt(record, a, p.difficulty)]).filter(([, b]) => b);
+    const eligible = prefAll.filter(a => !benchedAt(record, a, p.difficulty));
+    const pref = eligible.length ? eligible : prefAll;
+    for (const [s, b] of struck) {
+      const wasted = b.wastedTokens ? ` ≈${(b.wastedTokens / 1e6).toFixed(1)}M tok burned` : "";
+      seatFeedback.push({ seat: s, difficulty: p.difficulty, streak: b.streak, cardIds: b.cardIds, wastedTokens: b.wastedTokens,
+        note: `${s} benched at ${p.difficulty}: last ${b.streak.length} cards ${b.streak.join("/")} (#${b.cardIds.join(" #")})${wasted}` });
+    }
     const agent = pref.sort((a, b) => (used[a] || 0) - (used[b] || 0))[0] || agents[0] || "deepseek";
     used[agent] = (used[agent] || 0) + 1;
     const pool = tierOf(profile, roster[agent]?.provider || agent);
@@ -176,6 +200,7 @@ export function advise(input, world = loadWorld()) {
     // has scored it (AA scores + price proxy + per-difficulty cost weighting → hard escalates to a
     // strong model, easy stays cheap). If it hasn't been run, routing falls back to cost-only.
     if (agent === "openrouter" && p.difficulty === "hard") why_r += ` — OpenRouter ranks capability×cost; run \`scrooge-capabilities\` to keep the catalog scored (or pin openrouter:openrouter/<vendor>/<model>)`;
+    if (struck.length && !struck.some(([s]) => s === agent)) why_r += ` — ${struck.map(([s]) => s).join("/")} benched at ${p.difficulty} here (last 3 cards empty/bounced; seat_feedback)`;
     return { ...p, executor: agent, pool, est_cost_usd: est, reason: why_r };
   });
   // crew-size rationale: seats are EMERGENT from the work, and we say so
@@ -188,11 +213,14 @@ export function advise(input, world = loadWorld()) {
 
   const apiCost = +(routing.reduce((s, r) => s + (r.est_cost_usd || 0), 0)).toFixed(2);
   const pools = [...new Set(routing.map(r => `${r.executor}:${r.pool}`))];
+  // One bench line per seat+difficulty, however many packages tripped it.
+  const feedback = [...new Map(seatFeedback.map(f => [`${f.seat}@${f.difficulty}`, f])).values()];
   const summary =
     `Recommendation: ${mode.toUpperCase()}. ${why.join("; ")}. ` +
     (mode === "crew" || mode === "hybrid"
       ? `Routing: ${routing.map(r => `${r.title}→${r.executor}${r.model ? `(${r.model})` : ""}`).join(", ")}. ` +
-        `Estimated real-money cost ≈ $${apiCost} (everything on a subscription pool is $0 marginal — quota pooling across ${pools.length} pools).`
+        `Estimated real-money cost ≈ $${apiCost} (everything on a subscription pool is $0 marginal — quota pooling across ${pools.length} pools).` +
+        (feedback.length ? ` Seat record (this project): ${feedback.map(f => f.note).join("; ")}.` : "")
       : "");
   const table = ["| package | diff | executor (model) | pool | est $ | reason |", "|---|---|---|---|---|---|",
     ...routing.map(r => `| ${r.title} | ${r.difficulty} | ${r.executor}${r.model ? ` (${r.model})` : ""} | ${r.pool} | ${r.est_cost_usd ?? "—"} | ${r.reason} |`)].join("\n");
@@ -221,7 +249,12 @@ export function advise(input, world = loadWorld()) {
       ? routing.map((x, j) => j + 1).filter(j => j !== i + 1)
       : (r.executor !== "orchestrator" ? foundationIdx.filter(f => f !== i + 1) : []) };
   });
-  return { mode, why, crew, routing, routing_table_md: table, card_args: cards, est_api_cost_usd: apiCost, quota_pools: pools, summary, orchestrator_tier: orchTier, agents_available: agents };
+  // #7777: crew-bound packages get their catalog effort attached at SPAWN, when the live model is
+  // known (bin/crew/models.mjs resolveSpec → CREW_EFFORT); the advisor only records that it is deferred.
+  const catalogMeta = (() => { const c = loadCatalog(); return { version: c.version, models: Object.keys(c.models).length, source: "configs/model-catalog.json" }; })();
+  const recommendation = { mode, why, crew, routing, routing_table_md: table, card_args: cards, est_api_cost_usd: apiCost, quota_pools: pools, summary, orchestrator_tier: orchTier, agents_available: agents, catalog: catalogMeta };
+  if (feedback.length) recommendation.seat_feedback = feedback;
+  return recommendation;
 }
 
 // ---- CLI ----
@@ -238,6 +271,10 @@ if (import.meta.url === pathToFileURL(process.argv[1]).href) {
     const stdin = readFileSync(0, "utf8").trim();
     input = stdin ? JSON.parse(stdin) : { packages: [] };
   }
-  const out = advise(input);
+  const world = loadWorld();
+  // #7762: fold this project's seat record into the routing (fail-open — no hub, no record,
+  // and the advice is exactly what it was before the feedback loop existed).
+  try { world.record = await loadSeatRecord({ project: resolveProject(process.cwd()) }); } catch {}
+  const out = advise(input, world);
   console.log(JSON.stringify(out, null, 2));
 }

package/bin/cli.mjs

@@ -99,6 +99,7 @@ switch (cmd) {
   case "state": run("bin/state.mjs"); break;
   case "seats": case "seat": run("bin/seats.mjs"); break;
   case "seat-why": case "why": run("bin/seat-why.mjs"); break;
+  case "seat-record": run("bin/seat-record.mjs"); break;
   case "orchestrate": run("bin/orchestrate.mjs"); break;
   case "app": run("bin/app.mjs"); break;
   case "patrol": run("bin/patrol.mjs"); break;
@@ -231,6 +232,7 @@ switch (cmd) {
                       seats: which project lives in which directory — seats · seats add · seats up · seats login install
   trantor state       a seat's working memory: show <seat> <card> [--json] · validate · reset --force · gc [--apply]
   trantor seat-why    WHY a seat is down (err file, logs, pids): seat-why <agent> [--json] — quota, auth, crash, or just no pane
+  trantor seat-record the per-project seat record the advisor benches from (✓/∅/↩ per difficulty) — [--project p] [--reset <seat>] [--json]
   trantor watch       live bus feed in the terminal
   trantor inbox       THIS session's unread bus messages, signed (works under enforce) — [--all] [--consume] [--json]
   trantor policy      the autonomy ladder: show | set <project> <1-4> | link <a> <b> --reason "<why>"

package/bin/connect.mjs

@@ -1,27 +1,25 @@
 #!/usr/bin/env node
-// trantor connect — wire every AI coding CLI on this machine to the bus, in one shot.
-//
-//   node bin/connect.mjs            # detect installed CLIs, patch each one's MCP config (idempotent)
-//   node bin/connect.mjs --dry-run  # show what would change, touch nothing
-//
-// Each CLI keeps its own MCP config file/format; this writes the one "relay" entry into each
-// (with a timestamped .bak backup the first time it changes a file). Claude Code is handled by
-// the plugin (claude plugin install trantor), so it's only verified here, not patched.
+// trantor connect — wire every AI coding CLI on this machine to the bus, in one shot (idempotent;
+// --dry-run touches nothing). Writes the one "relay" MCP entry into each CLI's own config format,
+// with a timestamped .bak backup on first change. Claude Code rides the plugin: verified, not patched.
 import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { resolveProject, resolveHubInfo } from "../lib/project.mjs";
 
 const DRY = process.argv.includes("--dry-run");
 const MCP = join(dirname(dirname(fileURLToPath(import.meta.url))), "mcp.mjs");
-const URL_ = process.env.RELAY_URL || "http://127.0.0.1:4477";
-// Graft (github.com/NanoNets/context-graph-engine): a local Tree-sitter dependency graph served
-// over MCP (graft_find_code / _find_all / _trace_calls / _file_api / _repo_map). Wired next to
-// `relay` so a seat can locate code with one call instead of grep+read-many — the graph refreshes
-// itself before each query (no freshness hook) and serves the nearest ancestor with a graft/ index,
-// so it keys off the seat's cwd project. A project with no graft/ index simply returns empty tools,
-// never an error. `graft build` (or `graft init`) seeds a project's index; graft/ is gitignored.
+// Connect-time truth stamped into every relay entry env (#7893): the project this checkout resolves
+// to and the hub THAT project resolves to. Some CLIs spawn MCP with a scrubbed env where even `git`
+// is missing, so the stamp is the belt; the worktree path rule in lib/project.mjs stays primary.
+// Env wins in resolveHubInfo, so these keys are REFRESHED on every connect run — re-run after a pin change.
+const PROJECT_AT_CONNECT = resolveProject(process.cwd());
+const URL_ = resolveHubInfo(PROJECT_AT_CONNECT).url;
+// Graft (github.com/NanoNets/context-graph-engine): local Tree-sitter dependency graph over MCP,
+// wired next to `relay` so a seat locates code in one call; the graph refreshes itself per query
+// and a project with no graft/ index simply returns empty tools. `graft build` seeds an index.
 const GRAFT = (() => { try { return execSync("command -v graft", { encoding: "utf8", shell: "/bin/sh" }).trim(); } catch { return "graft"; } })();
 const HAS_GRAFT = GRAFT !== "graft" || (() => { try { execSync("command -v graft", { stdio: "ignore", shell: "/bin/sh" }); return true; } catch { return false; } })();
 const has = (cmd) => { try { execSync(`command -v ${cmd}`, { stdio: "ignore", shell: "/bin/sh" }); return true; } catch { return false; } };
@@ -43,11 +41,11 @@ function patchJson(path, mutate) {
   return exists ? "wired" : "wired (new config)";
 }
 
-// NO RELAY_URL here. A hardcoded URL in a CLI's MCP config OVERRIDES the per-project hub pin
-// (env wins in resolveHub), which silently sent every crew seat's relay tools to the local hub
-// while its runner sat on the pinned one — the residual split-brain mechanism (2026-08-20).
-// mcp.mjs resolves the hub from the session's project pin; that resolution must stay in charge.
-const relayEnv = (agent) => ({ RELAY_AGENT: agent });
+// Two keys, refreshed by every connect run: agent identity and the hub. The PROJECT is never
+// stamped: these configs are global to the CLI, and a seat of that CLI in another project would
+// inherit the wrong board (RELAY_PROJECT outranks the worktree rule in resolveProject, #7893).
+// A user-added env key survives the refresh merge.
+const relayEnv = (agent) => ({ RELAY_AGENT: agent, RELAY_URL: URL_ });
 // OpenCode hosts several differently-named seats. Its global MCP environment must not stamp all
 // of them "opencode": ambient runner identity wins, while this fallback names a normal interactive
 // OpenCode session that has no RELAY_AGENT/RELAY_SESSION of its own.
@@ -63,15 +61,31 @@ if (has("claude")) {
   report("claude", st);
 }
 
-// ---- Codex (TOML append — no TOML lib needed) ----
+// ---- Codex (TOML — append a missing relay section, refresh its env when it exists) ----
+const tomlRelayEnv = `env = { RELAY_AGENT = "codex", RELAY_URL = "${URL_}" }`;
 if (has("codex")) {
   const p = join(homedir(), ".codex", "config.toml");
-  const cur = existsSync(p) ? readFileSync(p, "utf8") : "";
-  if (cur.includes("[mcp_servers.relay]")) report("codex", "already wired");
-  else {
-    const block = `\n# trantor — auto-registers each Codex session on the bus + adds relay_* tools\n# (no RELAY_URL on purpose: the per-project hub pin decides the hub)\n[mcp_servers.relay]\ncommand = "node"\nargs = ["${MCP}"]\nenv = { RELAY_AGENT = "codex" }\n`;
+  let cur = existsSync(p) ? readFileSync(p, "utf8") : "";
+  if (!cur.includes("[mcp_servers.relay]")) {
+    const block = `\n# trantor — auto-registers each Codex session on the bus + adds relay_* tools\n# (env is REFRESHED by every \`trantor connect\`: agent + connect-time hub + project)\n[mcp_servers.relay]\ncommand = "node"\nargs = ["${MCP}"]\n${tomlRelayEnv}\n`;
     if (!DRY) { if (existsSync(p)) backup(p); else mkdirSync(dirname(p), { recursive: true }); writeFileSync(p, cur + block); }
     report("codex", cur ? "wired" : "wired (new config)", p);
+  } else {
+    // Refresh the connect-written single-line `env = { ... }` inside the existing section; a
+    // hand-rolled multi-line env table is left untouched (user customization wins) and is named.
+    const start = cur.indexOf("[mcp_servers.relay]");
+    const next = cur.indexOf("\n[", start + 1);
+    const end = next === -1 ? cur.length : next + 1;
+    const section = cur.slice(start, end);
+    let refreshed = section, note = "already wired";
+    if (/^env\s*=\s*\{.*\}\s*$/m.test(section)) refreshed = section.replace(/^env\s*=.*$/m, tomlRelayEnv);
+    else if (!/^env\s*=/m.test(section)) refreshed = section.replace(/\n*$/, "\n") + tomlRelayEnv + "\n";
+    else note = "relay env kept (custom shape) — refresh it by hand";
+    if (refreshed !== section) {
+      if (!DRY) { backup(p); writeFileSync(p, cur.slice(0, start) + refreshed + cur.slice(end)); }
+      note = "relay env refreshed";
+    }
+    report("codex", note, p);
   }
   // graft alongside relay
   if (HAS_GRAFT) {
@@ -85,27 +99,45 @@ if (has("codex")) {
   }
 }
 
-// ---- Gemini CLI ----  (existing relay entries are never overwritten — user customization wins)
+// ---- Gemini CLI ----  (relay entry env is REFRESHED: ||= kept an older connect's stale env forever)
 if (has("gemini")) {
   const p = join(homedir(), ".gemini", "settings.json");
   report("gemini", patchJson(p, d => {
     d.mcpServers ||= {};
-    d.mcpServers.relay ||= { command: "node", args: [MCP], env: relayEnv("gemini") };
+    d.mcpServers.relay ||= { command: "node", args: [MCP], env: {} };
+    d.mcpServers.relay.env = { ...d.mcpServers.relay.env, ...relayEnv("gemini") };
     if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
   }), p);
 }
 
-// ---- Kimi CLI ----
-if (has("kimi")) {
-  const p = join(homedir(), ".kimi", "mcp.json");
-  report("kimi", patchJson(p, d => {
-    d.mcpServers ||= {};
-    d.mcpServers.relay ||= { command: "node", args: [MCP], env: relayEnv("kimi") };
-    if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
-  }), p);
+// ---- Kimi CLI + kimi-code ----  (same refresh: the stale entry that caused #7893 was {RELAY_AGENT: kimi} only)
+// kimi-code is a separate install reading ~/.kimi-code/mcp.json — wiring only the old file left the
+// running kimi seat on a hard-coded stale hub (#7938). Same shape and stamp; the dir is detected by
+// config.toml presence — existsSync only, the config itself is never read.
+const kimiRelay = (cli, p) => report(cli, patchJson(p, d => {
+  d.mcpServers ||= {};
+  d.mcpServers.relay ||= { command: "node", args: [MCP], env: {} };
+  d.mcpServers.relay.env = { ...d.mcpServers.relay.env, ...relayEnv("kimi") };
+  if (HAS_GRAFT) d.mcpServers.graft ||= { command: GRAFT, args: ["mcp"] };
+}), p);
+const kimiPaths = [join(homedir(), ".kimi", "mcp.json"), join(homedir(), ".kimi-code", "mcp.json")];
+const kimiWritten = new Set();
+if (has("kimi")) { kimiRelay("kimi", kimiPaths[0]); kimiWritten.add(kimiPaths[0]); }
+if (existsSync(join(homedir(), ".kimi-code", "config.toml"))) { kimiRelay("kimi-code", kimiPaths[1]); kimiWritten.add(kimiPaths[1]); }
+// A kimi-family config this run did NOT write still names a hub of its own; if it disagrees with
+// the pin, say so — one CLI of the pair would keep registering on a different bus (#7938).
+for (const p of kimiPaths) {
+  if (kimiWritten.has(p) || !existsSync(p)) continue;
+  try {
+    const u = JSON.parse(readFileSync(p, "utf8"))?.mcpServers?.relay?.env?.RELAY_URL;
+    if (u && u !== URL_) report("kimi", `WARN: ${p} still points at ${u} — re-run connect or refresh it by hand`);
+  } catch {}
 }
 
 // ---- OpenCode ----
+// Deliberately NOT stamped with RELAY_URL/RELAY_PROJECT: OpenCode hosts several differently-named
+// seats from one config, and a stamped project/hub would override every hosted seat's runner-provided
+// env (the overlay bug the deletes below fix). Ambient runner env + RELAY_AGENT_FALLBACK stay in charge.
 if (has("opencode")) {
   const p = join(homedir(), ".config", "opencode", "opencode.json");
   report("opencode", patchJson(p, d => {
@@ -122,16 +154,10 @@ if (has("opencode")) {
   }), p);
 }
 
-// ---- DeepSeek Harness (dsh) ----
-// dsh has no single MCP config file — composition is a PROFILE (~/.dsh/profiles/<name>): a package.json
-// naming the bundles it stacks and a cordis.patch.yml inserting plugin rows. We build a "trantor"
-// profile on the stock headless bundle and mount two rows:
-//   1. their Claude Code hooks bridge pointed at OUR hooks.json — presence, focus cards, heartbeats,
-//      file claims run inside dsh exactly as they do inside CC (verified live 2026-08-19);
-//   2. their MCP client spawning our relay server — relay_* tools with the seat identity forwarded
-//      from the ambient RELAY_* env (crew-runner sets those per seat).
-// The bridge's own protocol lib is declared as a dependency explicitly: the rc package forgets it
-// (ERR_MODULE_NOT_FOUND at boot without it — reported upstream).
+// ---- DeepSeek Harness (dsh): composes from PROFILES (~/.dsh/profiles/<name>), no single MCP config.
+// We build a "trantor" profile mounting their Claude Code hooks bridge at OUR hooks.json plus their
+// MCP client running our relay server with ambient RELAY_* identity; the bridge's protocol lib is
+// declared explicitly — the rc package forgets it (ERR_MODULE_NOT_FOUND at boot).
 if (has("dsh")) {
   const ROOT = dirname(MCP);
   const prof = join(homedir(), ".dsh", "profiles", "trantor");
@@ -183,12 +209,10 @@ ${HAS_GRAFT ? `    - id: trantor-graft
         command: ${GRAFT}
         args: ['mcp']
 ` : ""}`;
-  // "a profile exists" is not "a profile is current": connect grows rows over time (relay, then
-  // graft, then whatever comes next), and an existence check short-circuits on a profile written
-  // by an older connect forever — the seat silently never gets the new row. So the gate is
-  // CONTENT-based: every row id this connect would write must already be in the patch; a missing
-  // one regenerates the patch (backed up). Presence, not diff — user edits to rows that ARE there
-  // still win, the same rule as the gemini/kimi/opencode `||=` patches above.
+  // "a profile exists" is not "a profile is current": connect grows rows over time, and an existence
+  // check short-circuits on a profile written by an older connect forever. The gate is CONTENT-based:
+  // every row id this connect writes must already be in the patch, else regenerate (backed up).
+  // Presence, not diff — user edits to rows that ARE there still win, like the JSON patches above.
   const expectedIds = [...patch.matchAll(/- id: (\S+)/g)].map(m => m[1]);
   const cur = existsSync(patchPath) ? readFileSync(patchPath, "utf8") : "";
   const missing = expectedIds.filter(id => !cur.split("\n").some(l => l.trim() === `- id: ${id}`));
@@ -201,11 +225,9 @@ ${HAS_GRAFT ? `    - id: trantor-graft
     if (!DRY) {
       mkdirSync(prof, { recursive: true });
       // The seat runs the plugin's hooks MINUS SessionStart: the crew runner already owns
-      // registration/announcement, and per-turn roster/catchup injection is wasted spend in a
-      // fresh one-shot session (headless has no resume — every turn re-pays it). Note: an earlier
-      // version of this comment blamed a dsh teardown crash on SessionStart; that was FALSE — the
-      // crash was the duplicated-core install below, refuted by a clean-profile repro before we
-      // reported upstream (deepseek-harness discussions #3515/#3516).
+      // registration/announcement, and per-turn roster injection is wasted spend in a one-shot
+      // session. (A dsh teardown crash was once blamed on SessionStart — FALSE: it was the
+      // duplicated-core install below, refuted by clean-profile repro; deepseek-harness #3515/#3516.)
       try {
         const full = JSON.parse(readFileSync(join(ROOT, "hooks", "hooks.json"), "utf8"));
         const subset = Object.fromEntries(Object.entries(full.hooks || {}).filter(([k]) => k !== "SessionStart"));
@@ -222,10 +244,8 @@ ${HAS_GRAFT ? `    - id: trantor-graft
       const rootPath = join(prof, "cordis.yml");
       if (!existsSync(rootPath)) writeFileSync(rootPath, "# dsh profile root — an empty entry list; the tree is composed from bundles + cordis.patch.yml.\n[]\n");
       // pnpm settings mirroring dsh's own profile template. autoInstallPeers:false is LOAD-BEARING:
-      // an installer that pulls the bridge's peers drops a SECOND copy of dsh's core packages into
-      // the profile, the loader mounts services from both module instances, and the first tool call
-      // dies on ctx.tools[TOOL_RUNTIME_SCHEDULER] being undefined (observed: every turn that used
-      // any tool crashed "reading 'prepare'"; tool-free turns worked).
+      // an installer that pulls the bridge's peers drops a SECOND copy of dsh's core into the
+      // profile, both instances mount, and the first tool call dies on ctx.tools being undefined.
       writeFileSync(join(prof, "pnpm-workspace.yaml"), "packages:\n  - .\n\nnodeLinker: hoisted\nautoInstallPeers: false\n");
       // the two bridge packages must be importable from the profile's node_modules — via pnpm
       // (peers OFF, hoisted) like dsh's own template; npm needs --legacy-peer-deps for the same
@@ -240,7 +260,7 @@ ${HAS_GRAFT ? `    - id: trantor-graft
 }
 
 const found = out.length;
-console.log(`trantor connect${DRY ? " (dry run)" : ""} — hub: ${URL_}`);
+console.log(`trantor connect${DRY ? " (dry run)" : ""} — project: ${PROJECT_AT_CONNECT}, hub: ${URL_}`);
 for (const r of out) console.log(`  ${r.cli.padEnd(9)} ${r.status}${r.detail ? `  (${r.detail})` : ""}`);
 if (!found) console.log("  no supported CLIs found on PATH (claude, codex, gemini, kimi, opencode, dsh)");
 console.log(DRY ? "\nRun without --dry-run to apply." : "\nDone. New sessions of each CLI auto-join the bus.");

package/bin/crew/cmux.mjs

@@ -109,7 +109,7 @@ export function spawnCmux(ctx, specs, resolve, prune) {
   for (let index = 0; index < specs.length; index += 1) {
     const seat = resolve(specs[index]);
     if (!seat) continue;
-    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model));
+    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
     const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.agent === seat.agent).at(-1)?.handle || "" : "";
     let pane = "";
     if (reuse) {
@@ -149,7 +149,7 @@ function spawnAppleScript(ctx, specs, resolve) {
   for (let index = 0; index < specs.length; index += 1) {
     const seat = resolve(specs[index]);
     if (!seat) continue;
-    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model));
+    const launcher = seatLauncher(ctx, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
     const old = reuse ? readRows(ctx).filter(row => row.project === ctx.project && row.kind === "cmux" && row.agent === seat.agent).at(-1)?.handle || "" : "";
     let pane;
     if (!tab && index === 0) {

package/bin/crew/core.mjs

@@ -141,12 +141,15 @@ export function gridColumns(size) {
 // file that was never written and a runner still on the transcript path.
 const FORWARDED_ENV = ["TRANTOR_STATE", "TRANTOR_STATE_ASSEMBLE", "TRANTOR_STATE_HANDOFF", "TRANTOR_STATE_GATE"];
 
-export function runnerCommand(ctx, agent, model = "") {
+export function runnerCommand(ctx, agent, model = "", effort = null) {
   const forwarded = FORWARDED_ENV
     .filter((name) => process.env[name])
     .map((name) => `${name}=${shellQuote(process.env[name])} `)
     .join("");
-  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
+  // #7777: the launcher resolved the catalog's per-difficulty effort for this seat; the runner
+  // reads CREW_EFFORT, applies what the CLI accepts and logs the one-line summary.
+  const effortEnv = effort ? ` CREW_EFFORT=${shellQuote(JSON.stringify(effort))}` : "";
+  return `cd ${shellQuote(ctx.dir)} && ${forwarded}CREW_MODEL=${shellQuote(model)}${effortEnv} RELAY_PROJECT=${shellQuote(ctx.project)} RELAY_URL=${shellQuote(ctx.hub)} node ${shellQuote(join(ROOT, "bin/crew-runner.mjs"))} ${shellQuote(agent)} ${shellQuote(ctx.dir)}`;
 }
 
 export function listPids(pattern) {

package/bin/crew/herdr.mjs

@@ -165,7 +165,7 @@ function replacementPane(ctx, workspace, spec, hostPane, resolve) {
     pane = `%DRYT${spec.index}`;
   } else {
     pane = splitPane(ctx, hostPane, "right", ctx.dir);
-    runSeat(ctx, pane, seat.agent, runnerCommand(ctx, seat.agent, seat.model));
+    runSeat(ctx, pane, seat.agent, runnerCommand(ctx, seat.agent, seat.model, seat.effort));
   }
   if (old) {
     closePane(ctx, old);
@@ -202,7 +202,7 @@ export function spawnHerdr(ctx, specs, resolve, prune) {
 function freshPane(ctx, workspace, spec, panes, columns, resolve) {
   const seat = resolve(spec.value);
   if (!seat) return null;
-  const command = runnerCommand(ctx, seat.agent, seat.model);
+  const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort);
   let pane = "";
   if (spec.index === 0) {
     if (ctx.dry) {

package/bin/crew/models.mjs

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { call } from "./core.mjs";
 import { reapSeat } from "./state.mjs";
+import { resolveEffort } from "../../lib/model-catalog.mjs";
 
 function routeModel(ctx, provider, candidates, task, difficulty) {
   const bundled = join(ctx.root, "engine/bin/scrooge");
@@ -36,16 +37,22 @@ export function resolveSpec(ctx, spec, task, difficulty, skipped) {
     if (agent === "glm") field = "zai-coding-plan";
     else if (!["codex", "kimi", "claude", "gemini", "dsh", "opencode"].includes(agent)) field = agent;
   }
-  if (!field) return { agent, model: "" };
-  if (field.includes("/")) return { agent, model: field };
+  if (!field) {
+    // #7777: CLI-default seat (kimi/codex/claude/dsh) — the catalog finds the entry through the
+    // agent alias so the runner still gets a CREW_EFFORT record (or the uncatalogued line).
+    return { agent, model: "", effort: resolveEffort(agent, "", difficulty) };
+  }
+  if (field.includes("/")) return { agent, model: field, effort: resolveEffort(agent, field, difficulty) };
   if (["claude", "codex", "kimi", "gemini"].includes(agent)) {
     console.log(`  → ${agent}: model ${field} (native pin)`);
-    return { agent, model: field };
+    return { agent, model: field, effort: resolveEffort(agent, field, difficulty) };
   }
   try {
     const model = resolveModel(ctx, agent, field, task, difficulty);
+    // #7777: the live model is known — attach the catalog's per-difficulty effort parameters here
+    // so the runner applies them where the CLI accepts them (CREW_EFFORT, below).
     console.log(`  → ${agent}: live model ${model} (${field} · ${task}/${difficulty})`);
-    return { agent, model };
+    return { agent, model, effort: resolveEffort(agent, model, difficulty) };
   } catch (error) {
     console.error(error.message);
     console.error(`[crew] ✗ skipping seat '${agent}' — model resolution failed for ${field} (${task}/${difficulty}); remaining seats still launch`);

package/bin/crew/preflight.mjs

@@ -0,0 +1,70 @@
+// #7760: `trantor up` used to hand out worktrees that could not build — every seat discovered the
+// missing sibling package and the gitignored config at once. Up now provisions the first seat's
+// worktree from .trantor/worktree.json, runs the declared preflight there once, and broadcasts.
+import {
+  PREFLIGHT_CAP_MS, applyWorktreeDeclaration, ensureSeatWorktree, preflightLine, provisioningLines,
+  readWorktreeDeclaration, runPreflight,
+} from "../../lib/seat-worktree.mjs";
+import { gitRoot, hostId } from "../../lib/project.mjs";
+import { loadOrCreate } from "../../lib/identity.mjs";
+import { ensureEnrolled } from "../../lib/enroll.mjs";
+import { sfetchJson } from "../../lib/signed-fetch.mjs";
+
+const BROADCAST_MAX = 1500;
+
+export function broadcastText(agent, applied, result) {
+  const parts = [];
+  if (result) parts.push(result.ok ? `${preflightLine(result)} in the ${agent} worktree` : `preflight failed in the ${agent} worktree (${result.command}): ${result.tail.join(" | ")}`);
+  else parts.push(`worktree declaration applied for ${agent} (no preflight declared)`);
+  if (applied.operator.length) parts.push(`operator steps: ${applied.operator.join("; ")}`);
+  if (applied.problems.length) parts.push(`problems: ${applied.problems.join("; ")}`);
+  const text = parts.join(" — ");
+  return text.length > BROADCAST_MAX ? `${text.slice(0, BROADCAST_MAX - 1)}…` : text;
+}
+
+async function broadcast(ctx, text, log) {
+  const session = ctx.env.RELAY_SESSION || `${hostId()}:${ctx.project}`;
+  try {
+    const identity = loadOrCreate(session, "agent");
+    await ensureEnrolled(ctx.hub, identity, ctx.project);
+    const r = await sfetchJson(`${ctx.hub}/send`, {
+      identity, payload: { from: session, to: "all", project: ctx.project, kind: "status", text },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!r.ok) log(`— preflight result NOT recorded on the bus (${ctx.hub}/send answered ${r.status}) —`);
+    return r.ok;
+  } catch (e) {
+    log(`— preflight result NOT recorded on the bus (${String(e?.message || e).slice(0, 80)}) —`);
+    return false;
+  }
+}
+
+// Returns { skipped } when the project declares nothing (unchanged behaviour), else what was
+// applied, the preflight result, and whether the bus recorded it.
+export async function preflightFirstSeat(ctx, agent, { capMs = PREFLIGHT_CAP_MS, log = console.log } = {}) {
+  const decl = readWorktreeDeclaration(gitRoot(ctx.dir) || ctx.dir);
+  if (!decl) return { skipped: "no declaration" };
+  const wt = ensureSeatWorktree({ sourceDir: ctx.dir, project: ctx.project, agent, home: ctx.home, env: ctx.env, log });
+  if (!wt.root) {
+    log(`— preflight skipped: no seat worktree for ${agent} (running from ${wt.dir}) —`);
+    return { skipped: "no worktree" };
+  }
+  const applied = applyWorktreeDeclaration(decl, { root: wt.root, seatDir: wt.dir });
+  log(`— ${agent} worktree ${wt.created ? "created" : "reused"} at ${wt.dir}; .trantor/worktree.json applied —`);
+  for (const l of provisioningLines(applied, { prefix: "  " })) log(l);
+
+  let result = null;
+  if (!decl.preflight) log("— no preflight declared —");
+  else if (wt.dirty) log(`— preflight skipped: the ${agent} worktree has uncommitted work (commit or harvest it, then re-run up) —`);
+  else {
+    log(`— preflight in ${wt.dir}: ${decl.preflight} (cap ${Math.round(capMs / 60000)} min) —`);
+    result = runPreflight(decl.preflight, { seatDir: wt.dir, capMs, env: ctx.env });
+    log(result.ok ? `\x1b[32m${preflightLine(result)}\x1b[0m` : `\x1b[31m${preflightLine(result)}\x1b[0m`);
+    if (!result.ok) log("  ✗ fix the worktree need above (or the declaration) BEFORE writing contracts — the seats will hit the same wall.");
+  }
+
+  const worthPosting = result || applied.operator.length || applied.problems.length;
+  const text = worthPosting ? broadcastText(agent, applied, result) : "";
+  const posted = text ? await broadcast(ctx, text, log) : false;
+  return { applied, result, text, posted, seatDir: wt.dir, created: wt.created };
+}

package/bin/crew/tmux.mjs

@@ -7,7 +7,7 @@ export function spawnTmux(ctx, specs, resolve) {
   for (const spec of specs) {
     const seat = resolve(spec);
     if (!seat) continue;
-    const command = runnerCommand(ctx, seat.agent, seat.model);
+    const command = runnerCommand(ctx, seat.agent, seat.model, seat.effort);
     let pane = ctx.dry ? "%DRY" : "";
     if (first) {
       run(ctx, "tmux", ["new-session", "-d", "-s", session, "-n", "crew", "-x", "260", "-y", "60"], { rendered: `tmux new-session -d -s '${session}' -n crew -x 260 -y 60` });
@@ -52,7 +52,7 @@ export function spawnTerminal(ctx, specs, resolve) {
       recordState(ctx, ctx.project, "win", seat.agent, `%DRYWIN${index}`);
       continue;
     }
-    const command = `clear && ${runnerCommand(ctx, seat.agent, seat.model)}`;
+    const command = `clear && ${runnerCommand(ctx, seat.agent, seat.model, seat.effort)}`;
     const title = `${ctx.project} · ${seat.agent.toUpperCase()}`;
     const result = appleScript(`tell application "Terminal"\nset w to do script "${appleScriptString(command)}"\nset custom title of w to "${appleScriptString(title)}"\nset theWin to first window whose tabs contains w\nset bounds of theWin to {${x}, ${y}, ${x + width}, ${y + height}}\nreturn id of theWin\nend tell\n`);
     if (result.stdout) {