wotann 0.5.0 → 0.5.39

package/dist/core/runtime.js

@@ -12,6 +12,56 @@
  * - DoomLoop detector monitors for infinite loops
  * - Cost tracker records spend per query
  * - Session management tracks state
+ *
+ * ── Sibling-module ownership map ────────────────────────────────────
+ * The runtime is intentionally large; surface boundaries with the two
+ * extracted siblings keep the god-object honest:
+ *
+ *   src/core/runtime-tools.ts          (627 LOC)
+ *     Owns: `buildEffectiveTools()` — assembles the FULL runtime-tool
+ *     surface (computer_use [narrow], web_fetch, monitor, terminal_run,
+ *     image_read, tmux_pull, parallel_search, plan_*, find_symbol,
+ *     find_references, rename_symbol, 36 connector tools, 5 browser
+ *     tools). Also exports `RUNTIME_TOOL_NAMES`, `isRuntimeTool`,
+ *     `buildLspToolsForAgent` (Serena-parity LSP bundle), and the
+ *     connector/browser passthroughs.
+ *     NOT used by runtime.ts for inline registration — runtime.ts
+ *     registers a NARROWER set (`computer_use` [rich], `web_fetch`,
+ *     `plan_*`, aux-tools via dynamic import) because the wider surface
+ *     advertised by `buildEffectiveTools` would expose tools that have
+ *     no inline dispatch wiring here. Used directly by:
+ *       • `tests/unit/connector-tools.test.ts`
+ *       • `tests/tools/monitor.test.ts`
+ *       • runtime.ts (only `buildLspToolsForAgent` for the Serena
+ *         agent-tools bundle used by `lspAgentTools` dispatch path)
+ *
+ *   src/core/runtime-tool-dispatch.ts   (1102 LOC)
+ *     Owns: `dispatchRuntimeTool()` + per-tool handlers (web_fetch,
+ *     plan_create/list/advance, monitor, find_symbol, find_references,
+ *     rename_symbol, terminal_run, image_read, tmux_pull,
+ *     parallel_search) + connector dispatch adapter + ToolTimingTracker
+ *     + tool-result annotation. The unified `dispatchRuntimeTool`
+ *     dispatcher is wired into runtime.ts via
+ *     `dispatchAndSanitizeRuntimeTool()` for the byte-identical 7
+ *     tools (web_fetch / plan_* / find_symbol / find_references /
+ *     rename_symbol). The other tool dispatchers (monitor with
+ *     bespoke `[stdout]`/`[exit]` formatting, terminal_run / image_read
+ *     / tmux_pull / parallel_search which aren't yet registered, and
+ *     connector tools which need a registry handle) stay inline in the
+ *     runtime stream loop because their wiring differs (streaming
+ *     event format, sandbox gates, or `attemptContentParts` +
+ *     `streamCheckpointStore` accumulation).
+ *
+ * ── Why the dispatch IS partially extracted but registration ISN'T ──
+ * `runtime-tool-dispatch.ts` produces byte-identical output envelopes
+ * for the 7 tools we migrated (`web_fetch` / `plan_*` / `find_symbol` /
+ * `find_references` / `rename_symbol`), so substituting it preserves
+ * behavior down to the byte. `runtime-tools.ts` registers a strict
+ * superset of tools (and uses a narrower `computer_use` schema), so
+ * substituting it would change what the model is told it can call —
+ * that's behavior change. Until the inline dispatch path is broadened
+ * (or `buildEffectiveTools` gains opt-out flags for the extra surface),
+ * registration stays inline.
  */
 import { extractTrackedFilePath } from "./tool-path-extractor.js";
 import { applyBoundToolFilter } from "./runtime/bound-tool-filter.js";
@@ -33,6 +83,48 @@ function warmupProviderModels(providers) {
         fallback: auth.models,
     })));
 }
+export function selectVerifierJudgeAdapter(input) {
+    const requested = input.requestedProvider?.trim();
+    if (requested) {
+        const provider = requested;
+        const adapter = input.adapters.get(provider);
+        if (adapter) {
+            return {
+                provider,
+                adapter,
+                model: input.requestedModel ??
+                    (provider === input.responseProvider ? input.responseModel : undefined),
+                selfJudging: provider === input.responseProvider &&
+                    (input.requestedModel ?? input.responseModel) === input.responseModel,
+            };
+        }
+    }
+    for (const [provider, adapter] of input.adapters.entries()) {
+        if (provider !== input.responseProvider) {
+            return {
+                provider,
+                adapter,
+                ...(input.requestedModel ? { model: input.requestedModel } : {}),
+                selfJudging: false,
+                ...(requested
+                    ? { fallbackReason: `requested verifier provider unavailable: ${requested}` }
+                    : {}),
+            };
+        }
+    }
+    const responseAdapter = input.adapters.get(input.responseProvider);
+    if (!responseAdapter)
+        return null;
+    return {
+        provider: input.responseProvider,
+        adapter: responseAdapter,
+        model: input.requestedModel ?? input.responseModel,
+        selfJudging: (input.requestedModel ?? input.responseModel) === input.responseModel,
+        ...(requested
+            ? { fallbackReason: `requested verifier provider unavailable: ${requested}` }
+            : {}),
+    };
+}
 import { resolveDefaultProvider } from "./default-provider.js";
 import { createProviderInfrastructure, } from "../providers/registry.js";
 import { HookEngine } from "../hooks/engine.js";
@@ -48,10 +140,10 @@ import { buildStablePrefix } from "../memory/stable-prefix.js";
 // before production traffic. Gated on `RuntimeConfig.enablePromptCacheWarmup`
 // (default off) + `WOTANN_PROMPT_CACHE_WARMUP` env var.
 import { warmupCache, } from "../providers/prompt-cache-warmup.js";
-import { DoomLoopDetector } from "../hooks/doom-loop-detector.js";
 import { createDefaultPipeline } from "../middleware/pipeline.js";
 import { assembleSystemPromptParts, wrapPromptWithThinkInCode } from "../prompt/engine.js";
 import { stripIsoTimestampsFromPrompt } from "../prompt/system-prompt.js";
+import { parseCavemanLevel } from "../prompt/modules/caveman.js";
 import { canBypass, executeBypass } from "../utils/wasm-bypass.js";
 import { CostTracker, shouldZeroForSubscription } from "../telemetry/cost-tracker.js";
 import { ToolTimingLogger, ToolTimingBaseline } from "../tools/tool-timing.js";
@@ -110,6 +202,8 @@ import { AutonomousExecutor } from "../orchestration/autonomous.js";
 import { NotificationManager } from "../desktop/notification-manager.js";
 import { ContextSourceInspector } from "../context/inspector.js";
 import { PersonaManager } from "../identity/persona.js";
+import { ReasoningEngine } from "../identity/reasoning-engine.js";
+import { getActivePersonaName } from "../cli/commands/persona.js";
 import { SelfHealingPipeline } from "../orchestration/self-healing-pipeline.js";
 import { LSPManager, SymbolOperations } from "../lsp/symbol-operations.js";
 import { LanguageServerRegistry } from "../lsp/server-registry.js";
@@ -195,8 +289,9 @@ import { ReflectionBuffer } from "../learning/reflection-buffer.js";
 import { WebFetchTool } from "../tools/web-fetch.js";
 import { PlanStore } from "../orchestration/plan-store.js";
 import { spawnMonitor } from "../tools/monitor.js";
-import { MONITOR_MAX_DURATION_MS, MONITOR_MAX_EVENTS_PER_RESULT } from "./runtime-tool-dispatch.js";
+import { MONITOR_MAX_DURATION_MS, MONITOR_MAX_EVENTS_PER_RESULT, dispatchRuntimeTool, } from "./runtime-tool-dispatch.js";
 import { SteeringServer } from "./steering-server.js";
+import { executeDesktopAction } from "../computer-use/platform-bindings.js";
 // ── Wired orphan modules ────────────────────────────────────
 // Orchestration
 import { AutonomousContextManager } from "../orchestration/autonomous-context.js";
@@ -270,6 +365,141 @@ import { scheduleViaHook as scheduleSessionIngestion, } from "../memory/session-
 import { createOmegaLayers } from "../memory/omega-layers.js";
 import { detectSupersession, parseAssertionAsFact } from "../memory/knowledge-update-dynamics.js";
 import { ProgressiveContextLoader, } from "../memory/progressive-context-loader.js";
+function unquoteShellToken(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    const singleQuoted = trimmed.match(/^'([^']*)'$/);
+    if (singleQuoted)
+        return singleQuoted[1] ?? "";
+    const doubleQuoted = trimmed.match(/^"([^"]*)"$/);
+    if (doubleQuoted)
+        return doubleQuoted[1] ?? "";
+    if (/\s/.test(trimmed))
+        return null;
+    return trimmed;
+}
+function parseSafeOpenCommand(command) {
+    const trimmed = command.trim();
+    if (/[\r\n;]/.test(trimmed) ||
+        trimmed.includes("&&") ||
+        trimmed.includes("||") ||
+        trimmed.includes("`") ||
+        trimmed.includes("$(")) {
+        return null;
+    }
+    const match = trimmed.match(/^open\s+(.+)$/);
+    if (!match)
+        return null;
+    const target = unquoteShellToken(match[1] ?? "");
+    if (!target || target.startsWith("-"))
+        return null;
+    const action = /^https?:\/\//i.test(target) ? "open-url" : "open-path";
+    return { action, target };
+}
+function executeSafeBashDesktopCommand(command) {
+    const parsed = parseSafeOpenCommand(command);
+    if (!parsed) {
+        return {
+            success: false,
+            content: "\n[Bash] Error: remote Bash execution is limited to safe desktop open commands right now.\n",
+        };
+    }
+    const result = executeDesktopAction({
+        action: parsed.action,
+        params: parsed.action === "open-url" ? { url: parsed.target } : { path: parsed.target },
+    });
+    if (!result) {
+        return {
+            success: false,
+            content: `\n[Bash] Error: desktop route ${parsed.action} is not available.\n`,
+        };
+    }
+    return {
+        success: result.success,
+        content: `\n[Bash] ${result.output}\n`,
+    };
+}
+function scalarParam(value) {
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return undefined;
+}
+function executeComputerUseAction(input) {
+    const action = typeof input["action"] === "string" ? input["action"] : "";
+    const normalized = action.replace(/_/g, "-");
+    const params = {};
+    if (normalized === "click") {
+        const x = scalarParam(input["x"]);
+        const y = scalarParam(input["y"]);
+        if (x !== undefined)
+            params["x"] = x;
+        if (y !== undefined)
+            params["y"] = y;
+        const button = scalarParam(input["button"]);
+        const clicks = scalarParam(input["clicks"]);
+        if (button !== undefined)
+            params["button"] = button;
+        if (clicks !== undefined)
+            params["clicks"] = clicks;
+    }
+    else if (normalized === "type") {
+        const text = scalarParam(input["text"]);
+        const delay = scalarParam(input["delay"]);
+        if (text !== undefined)
+            params["text"] = text;
+        if (delay !== undefined)
+            params["delay"] = delay;
+    }
+    else if (normalized === "screenshot") {
+        const path = scalarParam(input["path"]);
+        if (path !== undefined)
+            params["path"] = path;
+    }
+    else if (normalized === "read-screen") {
+        const result = executeDesktopAction({ action: "get-active-window", params: {} });
+        return {
+            success: result?.success ?? false,
+            content: `\n[computer_use] Active window: ${result?.output ?? "Unavailable"}\n`,
+        };
+    }
+    else if (normalized === "open-path") {
+        const path = scalarParam(input["path"]);
+        if (path !== undefined)
+            params["path"] = path;
+    }
+    else if (normalized === "open-url") {
+        const url = scalarParam(input["url"]);
+        if (url !== undefined)
+            params["url"] = url;
+    }
+    else if (normalized === "open-app") {
+        const app = scalarParam(input["app"]);
+        if (app !== undefined)
+            params["app"] = app;
+    }
+    const route = normalized === "screenshot" ||
+        normalized === "click" ||
+        normalized === "type" ||
+        normalized === "open-path" ||
+        normalized === "open-url" ||
+        normalized === "open-app"
+        ? normalized
+        : "";
+    if (!route) {
+        return {
+            success: false,
+            content: `\n[computer_use] Error: unsupported action "${action || "unknown"}"\n`,
+        };
+    }
+    const result = executeDesktopAction({ action: route, params });
+    return {
+        success: result?.success ?? false,
+        content: `\n[computer_use] ${result?.output ?? `Route ${route} is not available`}\n`,
+    };
+}
 // ── Runtime ────────────────────────────────────────────────
 export class WotannRuntime {
     infra = null;
@@ -287,8 +517,13 @@ export class WotannRuntime {
      * `shouldZeroForSubscription(provider, this.providerBilling.get(provider))`.
      */
     providerBilling = new Map();
+    /**
+     * Runtime-local provider -> model catalogue captured from provider discovery.
+     * This keeps model routing grounded in what the daemon actually discovered
+     * instead of treating provider identifiers as model identifiers.
+     */
+    providerModelCatalog = new Map();
     hookEngine;
-    doomLoop;
     pipeline;
     costTracker;
     /**
@@ -319,11 +554,28 @@ export class WotannRuntime {
     editTracker;
     sessionAnalytics;
     skillRegistry;
+    /**
+     * Skill activation telemetry sink (per-runtime, not module-global —
+     * QB #7). Records every skill activation to a JSONL log so the
+     * description-optimizer can mine its corpus from real usage.
+     * Lazily constructed on first use to avoid a synchronous import in
+     * the hot path of WotannRuntime construction; opt-out via env var.
+     */
+    skillTelemetry = null;
     ttsrEngine;
     qmdContext;
     modelPerformanceStore;
     pluginPanels = [];
     memoryStore = null;
+    /**
+     * Per-session formal reasoning engine (deductive / inductive / abductive).
+     * Lazily instantiated when memoryStore is available so conclusions
+     * can be persisted to the SQLite layer="reasoning" table. On each
+     * user turn, query() feeds the user prompt through `extractPremises`
+     * — explicit "I prefer X" / "always Y" patterns build a per-session
+     * premise list the downstream prompt assembler can consult.
+     */
+    reasoningEngine = null;
     /**
      * Round 8: cross-surface prompt library. Lives in the same .wotann
      * state dir as memory.db so users can back up both with one tar.
@@ -341,6 +593,18 @@ export class WotannRuntime {
     messageIndex = new Map();
     config;
     systemPrompt = "";
+    /**
+     * Read accessor for the assembled session-level system prompt
+     * (basePrompt + bootstrap + local context + user model + cross-device
+     * + memory + adaptive section). Lets the TUI's `/sizes` command show
+     * users what's actually being sent so they can diagnose slow turns
+     * without instrumenting the adapter. Excludes per-turn additions
+     * (skill activation, memory activation, reasoning sandwich preamble)
+     * — those are layered on at query time.
+     */
+    getSystemPrompt() {
+        return this.systemPrompt;
+    }
     localContextPrompt = "";
     /**
      * P1-B1 per-session bootstrap cache. One instance per runtime; the
@@ -557,6 +821,9 @@ export class WotannRuntime {
     // post-response turn that has non-empty content). Null when verifier
     // is disabled OR when instantiation hasn't happened yet.
     verifierEngine = null;
+    // Mutable: setVerifierEnabled() toggles this at runtime so the user
+    // can flip the secondary judge on/off via /verifier without restarting
+    // WOTANN. Initial value comes from config.enableVerifier or env.
     verifierEnabled;
     // Ring buffer of recent verdicts so the daemon RPC surface
     // (verifier.history / verifier.lastVerdict) can answer "what did the
@@ -687,8 +954,6 @@ export class WotannRuntime {
         // silently returns false).
         this.shadowGit = new ShadowGit(config.workingDir);
         registerBuiltinHooks(this.hookEngine, this.shadowGit);
-        // Initialize doom loop detector
-        this.doomLoop = new DoomLoopDetector();
         // Initialize middleware pipeline
         this.pipeline = createDefaultPipeline();
         // Initialize cost tracker. Single authoritative source for cost AND
@@ -786,6 +1051,18 @@ export class WotannRuntime {
             }
             try {
                 this.memoryStore = new MemoryStore(dbPath);
+                // ReasoningEngine reads + writes the same SQLite store under
+                // layer="reasoning". Instantiate alongside MemoryStore so the
+                // per-turn extractPremises() call has a destination for any
+                // conclusions it derives. Best-effort — failure here does
+                // not break the runtime.
+                try {
+                    this.reasoningEngine = new ReasoningEngine(this.memoryStore);
+                }
+                catch (err) {
+                    console.warn(`[WOTANN] ReasoningEngine init failed (continuing without inference): ${err instanceof Error ? err.message : String(err)}`);
+                    this.reasoningEngine = null;
+                }
                 // V9 T1.3 — auto-attach sqlite-vec backend if the native
                 // extension is loadable. Returns false silently when the
                 // extension or required prebuilt is missing; TEMPR then
@@ -892,10 +1169,13 @@ export class WotannRuntime {
         // Notification manager: surface task-complete / error / budget-alert
         // / channel-message / companion-paired events to desktop + iOS.
         this.notificationManager = new NotificationManager();
-        // Context source inspector: shows exactly what's in the context window (Ctrl+I)
+        // Context source inspector: shows exactly what's in the context window (Ctrl+X)
         this.contextInspector = new ContextSourceInspector();
-        // Persona manager: 8-file bootstrap, dynamic persona stacking
-        this.personaManager = new PersonaManager(join(config.workingDir, ".wotann", "identity"));
+        // Persona manager: 8-file bootstrap, dynamic persona stacking.
+        // Path matches prompt/engine.ts loadPersona() so `wotann persona`
+        // CLI, runtime introspection, and the prompt assembler all read
+        // the same `.wotann/personas/` directory.
+        this.personaManager = new PersonaManager(join(config.workingDir, ".wotann"));
         // Self-healing pipeline singleton: assigned above (pre-AutonomousExecutor
         // construction) so the executor can share the instance. This anchor
         // comment preserves the prior "graduated error recovery" docs site.
@@ -1214,6 +1494,92 @@ export class WotannRuntime {
     getMcpTier() {
         return this.mcpTier;
     }
+    refreshProviderModelCatalog(providers) {
+        this.providerModelCatalog.clear();
+        for (const auth of providers) {
+            if (this.providerModelCatalog.has(auth.provider))
+                continue;
+            const models = [
+                ...new Set(auth.models.map((m) => m.trim()).filter((m) => this.isConcreteModelId(m))),
+            ];
+            this.providerModelCatalog.set(auth.provider, models);
+        }
+    }
+    async refreshProviderModelCatalogs() {
+        const adapters = this.infra?.adapters;
+        if (!adapters)
+            return {};
+        const refreshed = {};
+        await Promise.all([...adapters.entries()].map(async ([provider, adapter]) => {
+            try {
+                const models = await adapter.listModels();
+                const concrete = [
+                    ...new Set(models.map((m) => m.trim()).filter((m) => this.isConcreteModelId(m))),
+                ];
+                if (concrete.length > 0) {
+                    this.providerModelCatalog.set(provider, concrete);
+                    refreshed[provider] = concrete;
+                }
+            }
+            catch {
+                /* Keep the last known model list for this provider. */
+            }
+        }));
+        return refreshed;
+    }
+    isConcreteModelId(model) {
+        if (!model)
+            return false;
+        const trimmed = model.trim();
+        return trimmed.length > 0 && trimmed !== "auto" && trimmed !== "unknown";
+    }
+    isKnownProviderIdentifier(value) {
+        if (!value)
+            return false;
+        if (this.providerModelCatalog.has(value))
+            return true;
+        const available = this.infra?.bridge?.getAvailableProviders?.() ?? [];
+        return available.includes(value);
+    }
+    getDiscoveredModelIds() {
+        const seen = new Set();
+        for (const models of this.providerModelCatalog.values()) {
+            for (const model of models) {
+                if (!seen.has(model))
+                    seen.add(model);
+            }
+        }
+        return [...seen];
+    }
+    providerHasModel(provider, model) {
+        if (!provider || !this.isConcreteModelId(model))
+            return false;
+        const models = this.providerModelCatalog.get(provider);
+        return Boolean(models && models.includes(model));
+    }
+    firstDiscoveredModelForProvider(provider) {
+        if (!provider)
+            return null;
+        const models = this.providerModelCatalog.get(provider);
+        return models?.[0] ?? null;
+    }
+    isModelUsableForProvider(provider, model) {
+        if (!this.isConcreteModelId(model))
+            return false;
+        if (provider && this.providerModelCatalog.has(provider)) {
+            return this.providerHasModel(provider, model);
+        }
+        return !this.isKnownProviderIdentifier(model);
+    }
+    shouldApplyTaskRouterModel(model, provider) {
+        if (!this.isConcreteModelId(model))
+            return false;
+        if (this.isKnownProviderIdentifier(model))
+            return false;
+        if (!provider || provider === "auto")
+            return false;
+        return this.providerHasModel(provider, model);
+    }
     /**
      * Session-13: per-session Visual Diff Theater for hunk-level review.
      * Consumers (CLI `wotann review`, iOS diff viewer) read sessions,
@@ -1315,7 +1681,7 @@ export class WotannRuntime {
             // Re-scan the persona dir in case defaults landed after ctor.
             // The manager's public API is immutable — we rebuild a sibling
             // instance and swap in, preserving the ctor contract.
-            const refreshedPersonas = new PersonaManager(join(this.config.workingDir, ".wotann", "identity"));
+            const refreshedPersonas = new PersonaManager(join(this.config.workingDir, ".wotann"));
             if (refreshedPersonas.getCount() > this.personaManager.getCount()) {
                 this.personaManager = refreshedPersonas;
             }
@@ -1449,6 +1815,7 @@ export class WotannRuntime {
         }
         // Discover providers
         const providers = await discoverProviders();
+        this.refreshProviderModelCatalog(providers);
         // Background model-catalog warmup: discoverProviders() returns a
         // synchronous list with hardcoded fallbacks (or 5-min cached
         // results from prior runs). Kick off live `/v1/models` fetches in
@@ -1566,9 +1933,11 @@ export class WotannRuntime {
         // modules read runtime state (provider/model/cost/surfaces/channels)
         // and emit only the sections that apply — absent capabilities cost
         // zero tokens.
+        const activePersona = getActivePersonaName(join(this.config.workingDir, ".wotann"));
         const basePrompt = assembleSystemPromptParts({
             workspaceRoot: this.config.workingDir,
             mode: "careful",
+            ...(activePersona ? { persona: activePersona } : {}),
             moduleContext: {
                 isMinimal: false,
                 provider: this.session.provider ?? "unknown",
@@ -1582,6 +1951,9 @@ export class WotannRuntime {
                 sessionCost: 0,
                 budgetRemaining: 0,
                 activeChannels: [],
+                // Caveman output-compression — opt-in via WOTANN_CAVEMAN env
+                // (lite|full|ultra|off). Empty when unset → zero token cost.
+                cavemanLevel: parseCavemanLevel(process.env["WOTANN_CAVEMAN"]),
             },
         });
         const modeInstructions = this.modeCycler.getMergedInstructions();
@@ -1676,14 +2048,13 @@ export class WotannRuntime {
      * 2. WASM bypass check (skip LLM for deterministic operations)
      * 3. Hook engine: UserPromptSubmit
      * 4. Middleware pipeline: before (all 16 layers)
-     * 5. DoomLoop check
-     * 6. Intelligence amplification (planning, verification, tool correction)
-     * 7. Reasoning sandwich (asymmetric budget: HIGH plan → LOW exec → HIGH verify)
-     * 8. Provider query via AgentBridge (with fallback chain)
-     * 9. Trace recording
-     * 10. Post-query hooks + middleware
-     * 11. Memory capture (SQLite + semantic index)
-     * 12. Cost tracking + session update
+     * 5. Intelligence amplification (planning, verification, tool correction)
+     * 6. Reasoning sandwich (asymmetric budget: HIGH plan → LOW exec → HIGH verify)
+     * 7. Provider query via AgentBridge (with fallback chain)
+     * 8. Trace recording
+     * 9. Post-query hooks + middleware
+     * 10. Memory capture (SQLite + semantic index)
+     * 11. Cost tracking + session update
      */
     async *query(options) {
         // S1-16: attribute errors to the actual targeted provider, falling back
@@ -1719,6 +2090,26 @@ export class WotannRuntime {
         catch (err) {
             console.warn(`[WotannRuntime] checkDailyBudgetCap failed; allowing query: ${err.message}`);
         }
+        // ReasoningEngine — feed every user turn through extractPremises
+        // so the per-session premise pool grows as the user expresses
+        // preferences / decisions / constraints. Side-effect-only: the
+        // engine writes derived conclusions to memoryStore under
+        // layer="reasoning"; never throws into the caller. Wrapped in
+        // try/catch (QB #6) so a regex regression doesn't break the
+        // hot query path.
+        if (this.reasoningEngine && typeof options.prompt === "string" && options.prompt.length > 0) {
+            try {
+                const newPremises = this.reasoningEngine.extractPremises([options.prompt]);
+                if (newPremises.length > 0) {
+                    // Periodically promote premises to deductive conclusions.
+                    // Cheap — pure in-memory grouping + persistence.
+                    this.reasoningEngine.deductiveReason(newPremises);
+                }
+            }
+            catch (err) {
+                console.warn(`[WotannRuntime] ReasoningEngine premise extraction failed: ${err.message}`);
+            }
+        }
         const queryStart = Date.now();
         const sessionBeforeQuery = this.session;
         this.session = addMessage(this.session, {
@@ -1797,11 +2188,6 @@ export class WotannRuntime {
         catch {
             // Active memory preprocessing must never block the main query.
         }
-        // WallClockBudget: inject time pressure prompt when approaching budget limit
-        const timePressure = this.wallClockBudget.getSystemPromptOverride();
-        if (timePressure) {
-            options = { ...options, prompt: `${timePressure}\n\n${options.prompt}` };
-        }
         // UserModel: update profile from each interaction
         this.userModelManager.recordExpertise(modeDetection.detectedMode, "intermediate", options.prompt.slice(0, 100));
         // Cross-session learner: record this query action
@@ -1834,7 +2220,7 @@ export class WotannRuntime {
             if (!options.model || options.model === "auto") {
                 try {
                     const routing = this.classifyAndRoute(options.prompt);
-                    if (routing.recommendedModel && routing.recommendedModel !== "auto") {
+                    if (this.shouldApplyTaskRouterModel(routing.recommendedModel, options.provider)) {
                         options = { ...options, model: routing.recommendedModel };
                     }
                 }
@@ -1922,17 +2308,6 @@ export class WotannRuntime {
             }
             // Reset TTSR fire counts for new query
             this.ttsrEngine.reset();
-            // ── Step 4: DoomLoop check ──
-            const doomResult = this.doomLoop.record("query", { prompt: options.prompt });
-            if (doomResult.detected) {
-                streamInterruptedReason = `DoomLoop detected (${doomResult.type ?? "repeated"}): Try a different approach.`;
-                yield {
-                    type: "error",
-                    content: streamInterruptedReason,
-                    provider: attributedProvider,
-                };
-                return;
-            }
             // ── Step 4.5: Context pressure check + VirtualContext offload ──
             // Tiered warnings: 60% info, 80% warning + VirtualContext, 95% critical
             const contextBudget = this.contextIntelligence.getBudget();
@@ -2126,14 +2501,47 @@ export class WotannRuntime {
                 console.warn(`[WotannRuntime] message-queue drain failed; continuing without queued messages: ${err.message}`);
             }
             const skillActivation = buildSkillActivationPrompt(this.skillRegistry, options.prompt, this.config.workingDir);
+            // Skill-activation telemetry — closes the description-optimizer
+            // loop. Records the chosen skill (if any) plus all considered
+            // candidates so future descriptions can be tuned against real
+            // usage. Disk write is best-effort; failure never aborts the
+            // active query (QB #3 honest stub). Disable via WOTANN_SKILL_TELEMETRY_OFF=1.
+            if (process.env["WOTANN_SKILL_TELEMETRY_OFF"] !== "1") {
+                try {
+                    if (!this.skillTelemetry) {
+                        const { SkillActivationTelemetry } = await import("../skills/activation-telemetry.js");
+                        const { resolveWotannHomeSubdir } = await import("../utils/wotann-home.js");
+                        this.skillTelemetry = new SkillActivationTelemetry({
+                            path: resolveWotannHomeSubdir("skill-telemetry.jsonl"),
+                        });
+                    }
+                    const winningSkill = skillActivation.names[0] ?? null;
+                    await this.skillTelemetry.record({
+                        sessionId: this.session.id,
+                        prompt: options.prompt,
+                        triggered: winningSkill ? { skill: winningSkill, kind: "auto" } : null,
+                        candidates: skillActivation.candidates,
+                    });
+                }
+                catch (err) {
+                    // Telemetry MUST NOT crash the run.
+                    console.warn(`[runtime] skill-telemetry record failed: ${err.message}`);
+                }
+            }
             const currentFile = skillActivation.referencedPaths[0];
             const memoryActivation = buildMemoryActivationPrompt(this.memoryStore, this.session.id, options.prompt, currentFile);
-            // TODO(god-object-extraction): Replace this tool registration section with:
-            // const runtimeTools = buildEffectiveTools(options.tools ?? [], {
-            //   computerUseEnabled: true,
-            //   planStoreAvailable: !!this.planStore,
-            // });
-            // const effectiveTools: ToolDefinition[] = [...runtimeTools];
+            // ── Tool-registration extraction analysis ──────────────────
+            // The extracted `buildEffectiveTools()` in `runtime-tools.ts`
+            // assembles a DIFFERENT surface area from what is registered
+            // inline below — it adds `monitor`, `terminal_run`, `image_read`,
+            // `tmux_pull`, `parallel_search`, the LSP symbol tools, the 36
+            // connector tools, and 5 browser tools, AND it uses a narrower
+            // `computer_use` schema (no open_path/open_url/open_app/button/
+            // clicks). Several of those advertised tools have NO inline
+            // dispatch wiring here; advertising them would let the model
+            // emit calls that fall through silently. So registration stays
+            // inline and the dispatch-side consolidation handles the only
+            // genuine duplication (web_fetch / plan_* / Serena LSP tools).
             // ── Register computer_use tool in agent tool schema ──
             const computerUseTool = {
                 name: "computer_use",
@@ -2143,12 +2551,25 @@ export class WotannRuntime {
                     properties: {
                         action: {
                             type: "string",
-                            enum: ["screenshot", "click", "type", "read_screen"],
+                            enum: [
+                                "screenshot",
+                                "click",
+                                "type",
+                                "read_screen",
+                                "open_path",
+                                "open_url",
+                                "open_app",
+                            ],
                             description: "The action to perform",
                         },
                         x: { type: "number", description: "X coordinate for click" },
                         y: { type: "number", description: "Y coordinate for click" },
                         text: { type: "string", description: "Text to type" },
+                        path: { type: "string", description: "File or folder path to open" },
+                        url: { type: "string", description: "URL to open" },
+                        app: { type: "string", description: "Application name to activate" },
+                        button: { type: "string", description: "Mouse button for click" },
+                        clicks: { type: "number", description: "Number of click repetitions" },
                     },
                     required: ["action"],
                 },
@@ -2396,18 +2817,42 @@ export class WotannRuntime {
             const taskType = classifyTaskType(options.prompt);
             const minCapability = taskType === "code-generation" || taskType === "bug-fix" ? "high" : "medium";
             const arbitrageRoute = this.providerArbitrage.findCheapestRoute(options.prompt, minCapability);
-            // Use arbitrage recommendation if no explicit provider was specified
+            // Use arbitrage only when it can supply a provider/model pair that
+            // exists in the daemon's discovered catalogue. Setting a provider alone
+            // lets a model from another provider leak into the adapter call.
+            const arbitragePair = !options.provider && this.providerHasModel(arbitrageRoute.provider, arbitrageRoute.model)
+                ? arbitrageRoute
+                : null;
             const arbitrageProvider = options.provider
                 ? (providerForSecurityMode ?? options.provider)
-                : (providerForSecurityMode ?? arbitrageRoute.provider);
+                : (providerForSecurityMode ?? arbitragePair?.provider);
+            const arbitrageModel = !options.provider && (!options.model || options.model === "auto")
+                ? arbitragePair?.model
+                : undefined;
             // ── Step 7: Query with amplified prompt ──
+            // Reasoning-effort plumbing. Without this, every reasoning-tier
+            // adapter (codex/gpt-5.5, anthropic extended thinking, openai
+            // gpt-5/o-series) runs at the SERVER default — for codex/gpt-5.5
+            // that's `xhigh`, which makes "test, who are you?" take 75s.
+            // Forward the runtime's user-facing `/thinking` setting as the
+            // wire-level hint. A caller-supplied options.reasoningEffort
+            // wins (so `/thinking xhigh` overrides the runtime default).
+            const reasoningEffortHint = options.reasoningEffort ??
+                this.thinkingEffort;
             const queryOptions = {
                 ...options,
-                provider: arbitrageProvider,
+                ...(arbitrageModel ? { model: arbitrageModel } : {}),
+                ...(arbitrageProvider ? { provider: arbitrageProvider } : {}),
+                // The runtime materializes an auto-routed provider before
+                // calling AgentBridge. Preserve fallback for those auto-routed
+                // calls, but keep explicit user selections sticky unless the
+                // caller opted back in.
+                allowProviderFallback: options.allowProviderFallback ?? !options.provider,
                 context: conversationContext,
                 prompt: sanitizedPrompt,
                 systemPrompt: fullSystemPrompt,
                 tools: effectiveTools,
+                reasoningEffort: reasoningEffortHint,
                 ...(turboQuantOllamaParams ? { ollamaParams: turboQuantOllamaParams } : {}),
             };
             // ── Step 7.1: Response cache fast-path ──
@@ -2490,10 +2935,17 @@ export class WotannRuntime {
                         .join("\n\n"),
                 };
                 for await (const chunk of this.infra.bridge.query(attemptQueryOptions)) {
+                    const previousResponseProvider = responseProvider;
                     if (chunk.provider)
                         responseProvider = chunk.provider;
-                    if (chunk.model)
+                    if (chunk.model && this.isModelUsableForProvider(responseProvider, chunk.model)) {
                         responseModel = chunk.model;
+                    }
+                    else if (chunk.provider &&
+                        chunk.provider !== previousResponseProvider &&
+                        !this.isModelUsableForProvider(responseProvider, responseModel)) {
+                        responseModel = this.firstDiscoveredModelForProvider(responseProvider) ?? "auto";
+                    }
                     if (chunk.type === "tool_use") {
                         const toolName = chunk.toolName?.toLowerCase() ?? "";
                         // Wave 4G: count tool-use chunks for the structured turn event.
@@ -2715,107 +3167,80 @@ export class WotannRuntime {
                             });
                         };
                         // ── Tier 2B: Runtime-handled tool execution ──
-                        // TODO(god-object-extraction): Replace individual tool dispatch cases below with:
-                        // if (isRuntimeTool(toolName) && chunk.toolInput) {
-                        //   const dispatchResult = await dispatchRuntimeTool(toolName, chunk.toolInput as Record<string, unknown>, {
-                        //     webFetch: this.webFetchTool,
-                        //     planStore: this.planStore,
-                        //     timingLogger: this.toolTimingLogger,
-                        //     sessionId: this.session.id,
-                        //   }, {
-                        //     responseProvider: chunk.provider ?? responseProvider,
-                        //     responseModel: chunk.model ?? responseModel,
-                        //   });
-                        //   if (dispatchResult) { yield dispatchResult; continue; }
-                        // }
-                        if (toolName === "web_fetch" && chunk.toolInput) {
-                            const input = chunk.toolInput;
-                            const url = String(input["url"] ?? "");
-                            const maxLength = typeof input["maxLength"] === "number" ? input["maxLength"] : undefined;
-                            let resultContent;
-                            try {
-                                const result = await this.webFetchTool.fetch(url);
-                                const text = maxLength ? result.markdown.slice(0, maxLength) : result.markdown;
-                                resultContent = `\n[web_fetch] ${result.title ?? url} (${result.status}): ${text.slice(0, 200)}...\n`;
-                            }
-                            catch (err) {
-                                const msg = err instanceof Error ? err.message : String(err);
-                                resultContent = `\n[web_fetch] Error: ${msg}\n`;
-                            }
-                            // Session-5: fire ToolResultReceived so ResultInjectionScanner
-                            // sees the raw tool output before the model does. Blocked
-                            // results are replaced with a sanitised error notice.
-                            const sanitised = await this.fireToolResultReceivedHook("web_fetch", resultContent);
-                            yield {
-                                type: "text",
-                                content: sanitised.content,
-                                provider: chunk.provider ?? responseProvider,
-                                model: chunk.model ?? responseModel,
-                            };
-                        }
-                        if (toolName === "plan_create" && chunk.toolInput && this.planStore) {
+                        // The web_fetch / plan_* / find_symbol / find_references /
+                        // rename_symbol branches below delegate to
+                        // `dispatchAndSanitizeRuntimeTool()`, which calls the
+                        // extracted `dispatchRuntimeTool` in `runtime-tool-dispatch.ts`
+                        // and routes the result through `fireToolResultReceivedHook`.
+                        // bash / computer_use / monitor / lsp-agent-tools remain
+                        // inline because they need bespoke wiring
+                        // (`attemptContentParts` + `streamCheckpointStore`,
+                        // streaming event format, or features the extracted
+                        // dispatcher doesn't yet support).
+                        if (toolName === "bash" && chunk.toolInput) {
                             const input = chunk.toolInput;
-                            const title = String(input["title"] ?? "Untitled");
-                            const description = String(input["description"] ?? "");
-                            let resultContent;
-                            try {
-                                const plan = this.planStore.createPlan(title, description);
-                                resultContent = `\n[plan_create] Created plan "${plan.title}" (${plan.id})\n`;
-                            }
-                            catch (err) {
-                                const msg = err instanceof Error ? err.message : String(err);
-                                resultContent = `\n[plan_create] Error: ${msg}\n`;
-                            }
-                            const sanitised = await this.fireToolResultReceivedHook("plan_create", resultContent);
+                            const command = typeof input["command"] === "string" ? input["command"] : "";
+                            const result = executeSafeBashDesktopCommand(command);
+                            const sanitised = await this.fireToolResultReceivedHook("Bash", result.content);
                             yield {
                                 type: "text",
                                 content: sanitised.content,
                                 provider: chunk.provider ?? responseProvider,
                                 model: chunk.model ?? responseModel,
                             };
+                            attemptContentParts.push(sanitised.content);
+                            streamCheckpointStore.appendText(streamCheckpoint.id, sanitised.content, chunk.provider ?? responseProvider, chunk.model ?? responseModel);
+                            recordToolTiming(result.success, result.success ? undefined : sanitised.content);
+                            continue;
                         }
-                        if (toolName === "plan_list" && this.planStore) {
-                            let resultContent;
-                            try {
-                                const plans = this.planStore.listPlans();
-                                const summary = plans.length === 0
-                                    ? "No active plans."
-                                    : plans
-                                        .map((p) => `- ${p.title} (${p.planId}): ${p.completedTasks}/${p.taskCount} tasks`)
-                                        .join("\n");
-                                resultContent = `\n[plan_list]\n${summary}\n`;
-                            }
-                            catch (err) {
-                                const msg = err instanceof Error ? err.message : String(err);
-                                resultContent = `\n[plan_list] Error: ${msg}\n`;
-                            }
-                            const sanitised = await this.fireToolResultReceivedHook("plan_list", resultContent);
+                        if (toolName === "computer_use" && chunk.toolInput) {
+                            const result = executeComputerUseAction(chunk.toolInput);
+                            const sanitised = await this.fireToolResultReceivedHook("computer_use", result.content);
                             yield {
                                 type: "text",
                                 content: sanitised.content,
                                 provider: chunk.provider ?? responseProvider,
                                 model: chunk.model ?? responseModel,
                             };
+                            attemptContentParts.push(sanitised.content);
+                            streamCheckpointStore.appendText(streamCheckpoint.id, sanitised.content, chunk.provider ?? responseProvider, chunk.model ?? responseModel);
+                            recordToolTiming(result.success, result.success ? undefined : sanitised.content);
+                            continue;
                         }
-                        if (toolName === "plan_advance" && chunk.toolInput && this.planStore) {
-                            const input = chunk.toolInput;
-                            const planId = String(input["planId"] ?? "");
-                            let resultContent;
-                            try {
-                                const task = this.planStore.advanceTask(planId);
-                                resultContent = `\n[plan_advance] Task "${task.title}" → ${task.status}\n`;
-                            }
-                            catch (err) {
-                                const msg = err instanceof Error ? err.message : String(err);
-                                resultContent = `\n[plan_advance] Error: ${msg}\n`;
+                        // ── God-object extraction (web_fetch / plan_*) ──
+                        // The per-case dispatch for `web_fetch` and the three
+                        // `plan_*` tools now delegates to
+                        // `dispatchAndSanitizeRuntimeTool`, which calls the
+                        // extracted `dispatchRuntimeTool` in `runtime-tool-dispatch.ts`
+                        // and threads the result through `fireToolResultReceivedHook`
+                        // for virtual-path scrubbing + ResultInjectionScanner.
+                        // Output bytes are identical to the previous inline branches.
+                        //
+                        // Per-tool gating matches the legacy semantics:
+                        //  - `web_fetch` requires `chunk.toolInput`
+                        //  - `plan_create`/`plan_advance` require `chunk.toolInput && planStore`
+                        //  - `plan_list` requires `planStore` only (no toolInput needed)
+                        if (toolName === "web_fetch" ||
+                            toolName === "plan_create" ||
+                            toolName === "plan_list" ||
+                            toolName === "plan_advance") {
+                            const requiresInput = toolName !== "plan_list";
+                            const requiresPlanStore = toolName !== "web_fetch";
+                            const hasInput = chunk.toolInput !== undefined && chunk.toolInput !== null;
+                            if ((!requiresInput || hasInput) && (!requiresPlanStore || this.planStore !== null)) {
+                                const sanitised = await this.dispatchAndSanitizeRuntimeTool(toolName, (chunk.toolInput ?? {}), {
+                                    responseProvider: chunk.provider ?? responseProvider,
+                                    responseModel: chunk.model ?? responseModel,
+                                }, toolName);
+                                if (sanitised) {
+                                    yield {
+                                        type: "text",
+                                        content: sanitised.content,
+                                        provider: chunk.provider ?? responseProvider,
+                                        model: chunk.model ?? responseModel,
+                                    };
+                                }
                             }
-                            const sanitised = await this.fireToolResultReceivedHook("plan_advance", resultContent);
-                            yield {
-                                type: "text",
-                                content: sanitised.content,
-                                provider: chunk.provider ?? responseProvider,
-                                model: chunk.model ?? responseModel,
-                            };
                         }
                         // ── Session-6: Monitor tool (Claude Code v2.1.98 port) ──
                         // Wraps a long-running child process so stdout/stderr lines
@@ -2917,98 +3342,27 @@ export class WotannRuntime {
                         // Exposes workspace-wide symbol search / reference lookup /
                         // rename refactor as first-class agent tools backed by the
                         // TypeScript LanguageService via this.lspManager.
-                        if (toolName === "find_symbol" && chunk.toolInput) {
-                            const input = chunk.toolInput;
-                            const name = typeof input["name"] === "string" ? input["name"] : "";
-                            let resultContent;
-                            if (!name) {
-                                resultContent = `\n[find_symbol] Error: missing \`name\` argument\n`;
-                            }
-                            else {
-                                try {
-                                    const hits = await this.symbolOperations.findSymbol(name);
-                                    const summary = hits.length === 0
-                                        ? `No matches for "${name}"`
-                                        : hits
-                                            .slice(0, 20)
-                                            .map((h) => `  ${h.kind} ${h.name} — ${h.uri}`)
-                                            .join("\n");
-                                    resultContent = `\n[find_symbol] ${hits.length} match(es) for "${name}":\n${summary}\n`;
-                                }
-                                catch (err) {
-                                    const msg = err instanceof Error ? err.message : String(err);
-                                    resultContent = `\n[find_symbol] Error: ${msg}\n`;
-                                }
-                            }
-                            const sanitised = await this.fireToolResultReceivedHook("find_symbol", resultContent);
-                            yield {
-                                type: "text",
-                                content: sanitised.content,
-                                provider: chunk.provider ?? responseProvider,
-                                model: chunk.model ?? responseModel,
-                            };
-                        }
-                        if (toolName === "find_references" && chunk.toolInput) {
-                            const input = chunk.toolInput;
-                            const uri = typeof input["uri"] === "string" ? input["uri"] : "";
-                            const line = typeof input["line"] === "number" ? input["line"] : -1;
-                            const character = typeof input["character"] === "number" ? input["character"] : -1;
-                            let resultContent;
-                            if (!uri || line < 0 || character < 0) {
-                                resultContent = `\n[find_references] Error: requires uri + line + character\n`;
-                            }
-                            else {
-                                try {
-                                    const refs = await this.symbolOperations.findReferences(uri, {
-                                        line,
-                                        character,
-                                    });
-                                    const summary = refs
-                                        .slice(0, 20)
-                                        .map((r) => `  ${r.uri}`)
-                                        .join("\n");
-                                    resultContent = `\n[find_references] ${refs.length} reference(s):\n${summary}\n`;
-                                }
-                                catch (err) {
-                                    const msg = err instanceof Error ? err.message : String(err);
-                                    resultContent = `\n[find_references] Error: ${msg}\n`;
-                                }
-                            }
-                            const sanitised = await this.fireToolResultReceivedHook("find_references", resultContent);
-                            yield {
-                                type: "text",
-                                content: sanitised.content,
-                                provider: chunk.provider ?? responseProvider,
-                                model: chunk.model ?? responseModel,
-                            };
-                        }
-                        if (toolName === "rename_symbol" && chunk.toolInput) {
-                            const input = chunk.toolInput;
-                            const uri = typeof input["uri"] === "string" ? input["uri"] : "";
-                            const line = typeof input["line"] === "number" ? input["line"] : -1;
-                            const character = typeof input["character"] === "number" ? input["character"] : -1;
-                            const newName = typeof input["newName"] === "string" ? input["newName"] : "";
-                            let resultContent;
-                            if (!uri || line < 0 || character < 0 || !newName) {
-                                resultContent = `\n[rename_symbol] Error: requires uri + line + character + newName\n`;
-                            }
-                            else {
-                                try {
-                                    const result = await this.symbolOperations.rename(uri, { line, character }, newName);
-                                    resultContent = `\n[rename_symbol] Renamed: ${result.editsApplied} edit(s) across ${result.filesAffected} file(s)\n`;
-                                }
-                                catch (err) {
-                                    const msg = err instanceof Error ? err.message : String(err);
-                                    resultContent = `\n[rename_symbol] Error: ${msg}\n`;
-                                }
+                        // ── God-object extraction (Serena LSP tools) ──
+                        // find_symbol / find_references / rename_symbol delegate to
+                        // the extracted `dispatchRuntimeTool` (which calls the same
+                        // SymbolOperations methods with identical envelope text).
+                        // Output bytes are byte-identical to the legacy inline branches.
+                        if (chunk.toolInput &&
+                            (toolName === "find_symbol" ||
+                                toolName === "find_references" ||
+                                toolName === "rename_symbol")) {
+                            const sanitised = await this.dispatchAndSanitizeRuntimeTool(toolName, chunk.toolInput, {
+                                responseProvider: chunk.provider ?? responseProvider,
+                                responseModel: chunk.model ?? responseModel,
+                            }, toolName);
+                            if (sanitised) {
+                                yield {
+                                    type: "text",
+                                    content: sanitised.content,
+                                    provider: chunk.provider ?? responseProvider,
+                                    model: chunk.model ?? responseModel,
+                                };
                             }
-                            const sanitised = await this.fireToolResultReceivedHook("rename_symbol", resultContent);
-                            yield {
-                                type: "text",
-                                content: sanitised.content,
-                                provider: chunk.provider ?? responseProvider,
-                                model: chunk.model ?? responseModel,
-                            };
                         }
                         // Wave 4G: log tool-dispatch timing. `success` flag reflects
                         // whether the tool-result content starts with an error
@@ -3188,7 +3542,8 @@ export class WotannRuntime {
             // calls read that history, so we don't need to hold the return.
             const filesInContent = fullContent.match(/(?:src|lib|test)\/[\w\-./]+\.\w+/g) ?? [];
             this.trajectoryScorer.scoreTurn(fullContent.slice(0, 2000), options.prompt, filesInContent);
-            if (this.trajectoryScorer.shouldForceReplan()) {
+            const emitTrajectoryReplan = this.config.enableTrajectoryReplan ?? process.env["WOTANN_TRAJECTORY_REPLAN"] === "1";
+            if (emitTrajectoryReplan && this.trajectoryScorer.shouldForceReplan()) {
                 yield {
                     type: "text",
                     content: `\n[TrajectoryScorer] ${this.trajectoryScorer.analyze().recommendation}\n`,
@@ -3278,9 +3633,23 @@ export class WotannRuntime {
                         const { createVerifierEngine } = await import("../verification/verifier-engine.js");
                         const { createJudgeAdapter } = await import("../verification/judge-adapter.js");
                         const verifierMod = await import("../verification/index.js");
-                        const responseAdapter = this.infra.adapters.get(responseProvider);
-                        if (responseAdapter) {
-                            const judge = createJudgeAdapter(responseAdapter, { model: responseModel });
+                        const judgeSelection = selectVerifierJudgeAdapter({
+                            adapters: this.infra.adapters,
+                            responseProvider,
+                            responseModel,
+                            requestedProvider: this.config.verifierProvider ?? process.env["WOTANN_VERIFIER_PROVIDER"],
+                            requestedModel: this.config.verifierModel ?? process.env["WOTANN_VERIFIER_MODEL"],
+                        });
+                        if (judgeSelection) {
+                            if (judgeSelection.fallbackReason) {
+                                console.warn(`[WOTANN] verifier judge fallback: ${judgeSelection.fallbackReason}`);
+                            }
+                            if (judgeSelection.selfJudging) {
+                                console.warn("[WOTANN] verifier judge is using the response model because no distinct verifier provider/model is available");
+                            }
+                            const judge = createJudgeAdapter(judgeSelection.adapter, {
+                                ...(judgeSelection.model ? { model: judgeSelection.model } : {}),
+                            });
                             // Round 63 turn-10: respect WOTANN_VERIFIER_MODE env var
                             // (set by the CLI --verify flag) to pick the strategy
                             // preset. Falls through to BALANCED on unknown values.
@@ -3719,6 +4088,11 @@ export class WotannRuntime {
             });
             // ProviderArbitrage: record outcome for cost-per-quality tracking
             const querySuccess = truncationWarning === null && !fullContent.toLowerCase().startsWith("error");
+            if (querySuccess &&
+                responseProvider.length > 0 &&
+                (responseProvider !== this.session.provider || responseModel !== this.session.model)) {
+                this.setActiveProvider(responseProvider, responseModel || this.session.model || "auto");
+            }
             this.providerArbitrage.recordOutcome(responseProvider, responseModel, costEntry.cost, querySuccess ? 0.8 : 0.3);
             // Session-13: feed ProviderBrain so learning-based routing can
             // favour healthier providers on subsequent queries.
@@ -3871,6 +4245,47 @@ export class WotannRuntime {
         this.applySafetyOverrides();
         return this.modeCycler.getModeName();
     }
+    /**
+     * Atomically switch the active provider AND model for subsequent
+     * `query()` calls. Without this hook, the TUI's model picker would
+     * update React state but `this.session.provider` would still point at
+     * the original auth — so e.g. picking codex/gpt-5.5 routed the model
+     * through Anthropic and produced "unknown model" errors. Provider-
+     * agnostic by design: any provider in the registry is acceptable; we
+     * don't gate on a hardcoded list.
+     *
+     * Side effects: re-fits ContextIntelligence to the new provider's
+     * context window, resets the first-turn flag so the new system prompt
+     * gets resent, and emits a status update so observers (cost tracker,
+     * UI status bar) see the switch immediately.
+     */
+    setActiveProvider(provider, model) {
+        const resolvedModel = this.isModelUsableForProvider(provider, model)
+            ? model
+            : (this.firstDiscoveredModelForProvider(provider) ?? "auto");
+        const previousProvider = this.session.provider;
+        const previousModel = this.session.model;
+        if (previousProvider === provider && previousModel === resolvedModel)
+            return;
+        this.session = {
+            ...this.session,
+            provider,
+            model: resolvedModel,
+        };
+        // Refit context intelligence to the new provider's context window
+        // and tokenization heuristics. Without this, token-budget warnings
+        // and compaction triggers stay tuned to the old provider.
+        this.contextIntelligence.adaptToProvider(provider, resolvedModel);
+        // Reset first-turn so the system prompt gets resent. Some providers
+        // (codex via the Codex CLI bridge, claude via the Agent SDK bridge)
+        // use the system prompt to wire up their respective harnesses on
+        // every conversation start; failing to resend after a switch leaves
+        // the new bridge unconfigured.
+        this.isFirstTurn = true;
+        // Reasoning sandwich windowing depends on provider thinking-tier
+        // semantics — clear so the next turn is judged fresh.
+        this.reasoningSandwich.reset();
+    }
     /**
      * Get the current mode name.
      */
@@ -3878,9 +4293,11 @@ export class WotannRuntime {
         return this.modeCycler.getModeName();
     }
     updateSystemPromptForMode() {
+        const activePersona = getActivePersonaName(join(this.config.workingDir, ".wotann"));
         const basePrompt = assembleSystemPromptParts({
             workspaceRoot: this.config.workingDir,
             mode: "careful",
+            ...(activePersona ? { persona: activePersona } : {}),
         });
         const modeInstructions = this.modeCycler.getMergedInstructions();
         // Re-render stable prefix so mode changes still see the latest
@@ -4545,6 +4962,15 @@ export class WotannRuntime {
         return this.editTracker;
     }
     // ── Permission Mode Control ────────────────────────────────
+    //
+    // Four modes, ordered by user-interruption:
+    //   ask-always   → prompt for every tool call (max safety)
+    //   smart        → prompt for destructive ops only (default)
+    //   auto-approve → skip approval prompts, still escalate on errors
+    //   autonomous   → full agent autonomy. Skip every prompt, retry on
+    //                  recoverable errors, only break to the user on hard
+    //                  blocks (auth, missing files, network down). Pairs
+    //                  with a long-running task where the user is afk.
     permissionMode = "smart";
     getPermissionMode() {
         return this.permissionMode;
@@ -4552,6 +4978,26 @@ export class WotannRuntime {
     setPermissionMode(mode) {
         this.permissionMode = mode;
     }
+    // ── Verifier (Secondary AI Judge) ──────────────────────────
+    //
+    // The verifier is a separate model that audits the primary response
+    // before it lands in the user's chat (Round 63). When enabled, every
+    // streamed completion goes through `verifierEngine.judge(...)` which
+    // returns an AggregateVerdict; if the decision is "fail" or "needs
+    // revision", the runtime can re-prompt the primary or surface the
+    // verdict to the user. Opt-in to limit token cost — verifier doubles
+    // per-turn provider spend. (`isVerifierEnabled()` getter is declared
+    // farther down with the other "is*" status methods; this is the
+    // matching mutator.)
+    setVerifierEnabled(enabled) {
+        this.verifierEnabled = enabled;
+        if (!enabled) {
+            // Drop the lazy-instantiated engine on disable so a re-enable
+            // gets a fresh one tuned to the current provider/model. Cheap
+            // because the engine is just a config + judge callback.
+            this.verifierEngine = null;
+        }
+    }
     // ── Manual Compaction ─────────────────────────────────────
     manualCompact() {
         const compactionCheck = this.contextIntelligence.shouldCompact();
@@ -4572,7 +5018,14 @@ export class WotannRuntime {
         };
     }
     // ── Thinking Effort Control (like Cursor) ─────────────────
-    thinkingEffort = "medium";
+    // Default `low` for snappy interactive UX. Reasoning-tier models
+    // (codex/gpt-5.5, anthropic extended thinking, openai gpt-5/o-series)
+    // respond in <5s at low effort vs 60–90s at the server default
+    // (`xhigh` for codex). Users escalate via `/thinking medium` or
+    // `/thinking high` when a prompt actually warrants deep reasoning.
+    // Pre-2026-05-03 default was `medium`, which the user reported as
+    // making "test, who are you?" take 75s on codex/gpt-5.5.
+    thinkingEffort = "low";
     setThinkingEffort(effort) {
         this.thinkingEffort = effort;
         // Adjust reasoning sandwich multiplier based on effort
@@ -4767,6 +5220,35 @@ export class WotannRuntime {
         }
         return { content: contentForHooks, blocked: false };
     }
+    /**
+     * God-object extraction shim — delegate the per-tool dispatch for the
+     * runtime-handled tools (`web_fetch`, `plan_*`, `find_symbol`,
+     * `find_references`, `rename_symbol`) to the extracted
+     * `dispatchRuntimeTool` instead of repeating the per-case logic inline.
+     *
+     * Behavioral contract is preserved byte-for-byte:
+     *  - the input parsing, tool execution, and `[tool] ...` envelope are
+     *    identical to the previous inline branches (verified against
+     *    `runtime-tool-dispatch.ts` output formats); and
+     *  - the caller still fires `ToolResultReceived` via
+     *    `fireToolResultReceivedHook` so virtual-path scrubbing and the
+     *    result-injection scanner observe every tool envelope, exactly as
+     *    before. The hook label matches the legacy inline call sites.
+     *
+     * Returns `null` when the tool name isn't one this shim handles, so
+     * the caller can fall through to its remaining inline branches
+     * (bash / computer_use / monitor / LSP-agent-tools / etc.).
+     */
+    async dispatchAndSanitizeRuntimeTool(toolName, toolInput, ctx, hookLabel) {
+        const dispatchResult = await dispatchRuntimeTool(toolName, toolInput, {
+            webFetch: this.webFetchTool,
+            planStore: this.planStore,
+            lsp: this.symbolOperations,
+        }, ctx);
+        if (!dispatchResult)
+            return null;
+        return this.fireToolResultReceivedHook(hookLabel, dispatchResult.content);
+    }
     getCanvasEditor() {
         return this.canvasEditor;
     }
@@ -4788,6 +5270,14 @@ export class WotannRuntime {
     getContextInspector() {
         return this.contextInspector;
     }
+    /**
+     * Per-session ReasoningEngine instance. Null until MemoryStore is
+     * initialized. Used by RPC + tests to inspect the per-session
+     * premise pool and derived conclusions.
+     */
+    getReasoningEngine() {
+        return this.reasoningEngine;
+    }
     getPersonaManager() {
         return this.personaManager;
     }
@@ -5282,8 +5772,7 @@ export class WotannRuntime {
         // classifier treats empty as "don't filter; return the general-best
         // recommendation" rather than forcing any one model. Previously
         // hardcoded ["claude-sonnet-4-6"] which silently biased the router.
-        const status = this.infra ? this.getStatus() : null;
-        const available = status?.providers ? status.providers.map(String) : [];
+        const available = this.getDiscoveredModelIds();
         const classification = this.taskRouter.classify(prompt, available);
         return {
             taskType: classification.type,