brindle 0.2.0__tar.gz → 0.2.1__tar.gz

{brindle-0.2.0 → brindle-0.2.1}/.gitignore

@@ -9,3 +9,4 @@ graphify-out/
 # private, kept local for now
 docs/
 .brindle/config.local.json
+.brindle/bench.json

{brindle-0.2.0 → brindle-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.2.0
+Version: 0.2.1
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -89,7 +89,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.2.0`). A session started before an upgrade keeps
+session shows it too (`brindle 0.2.1`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -360,6 +360,7 @@ your own status line prints, so what you see doesn't change.
 | `brindle cost requests` | Enterprise: your approval requests and their status; checks pending ones with the server (the cull pass also does, every few minutes). With cost centers, spend events also carry the repo (`owner/name`) so the org can total spend per center |
 | `brindle cost estimate [--tasks N] [--weight W] [--profile P] [--reviewer R]` | what the current goal (or N tasks) is likely to cost, as a range from this repo's history (median to p80 of past worker and review runs), plus a cheaper alternative with a different reviewer; says "low confidence" when there's too little history. Also added to `set_goal` and `assign` replies (brindle Pro) |
 | `brindle learning` | whether brindle Pro's hosted learning is on for this repo, and if not, why (nothing is learned on your machine) |
+| `brindle learning seed` | Pro: sends this repo's finished routing history to the hosted learner once, so it starts with what this machine has seen. Only the usual coarse record fields leave (kind/size one-hots, counters, HMAC keys), never task text or paths. A second run sends nothing new; decisions already sent live are skipped |
 | `brindle account [login\|logout\|status\|upgrade\|portal\|org]` | paid features: bare `brindle account` shows what your plan has and how to get the rest (see "brindle Pro and Team" below) |
 | `brindle audit verify\|export\|pubkey\|ship\|prune` | the local tamper-evident audit log, and shipping it to your SIEM (brindle Enterprise; see "Audit log" below) |
 | `brindle watch [--all] [--once]` | the dashboard on its own (the same view as the sidebar): enter attaches, `p` peeks, `x` closes |

{brindle-0.2.0 → brindle-0.2.1}/README.md

@@ -59,7 +59,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.2.0`). A session started before an upgrade keeps
+session shows it too (`brindle 0.2.1`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -330,6 +330,7 @@ your own status line prints, so what you see doesn't change.
 | `brindle cost requests` | Enterprise: your approval requests and their status; checks pending ones with the server (the cull pass also does, every few minutes). With cost centers, spend events also carry the repo (`owner/name`) so the org can total spend per center |
 | `brindle cost estimate [--tasks N] [--weight W] [--profile P] [--reviewer R]` | what the current goal (or N tasks) is likely to cost, as a range from this repo's history (median to p80 of past worker and review runs), plus a cheaper alternative with a different reviewer; says "low confidence" when there's too little history. Also added to `set_goal` and `assign` replies (brindle Pro) |
 | `brindle learning` | whether brindle Pro's hosted learning is on for this repo, and if not, why (nothing is learned on your machine) |
+| `brindle learning seed` | Pro: sends this repo's finished routing history to the hosted learner once, so it starts with what this machine has seen. Only the usual coarse record fields leave (kind/size one-hots, counters, HMAC keys), never task text or paths. A second run sends nothing new; decisions already sent live are skipped |
 | `brindle account [login\|logout\|status\|upgrade\|portal\|org]` | paid features: bare `brindle account` shows what your plan has and how to get the rest (see "brindle Pro and Team" below) |
 | `brindle audit verify\|export\|pubkey\|ship\|prune` | the local tamper-evident audit log, and shipping it to your SIEM (brindle Enterprise; see "Audit log" below) |
 | `brindle watch [--all] [--once]` | the dashboard on its own (the same view as the sidebar): enter attaches, `p` peeks, `x` closes |

{brindle-0.2.0 → brindle-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.2.0"
+version = "0.2.1"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.2.0 → brindle-0.2.1}/src/brindle/agents.py

@@ -47,6 +47,12 @@ WORKER_FOOTER = """
 ---
 You are running as a brindle worker (agent id {agent_id}) on branch `{branch}`.
 {guidance}
+Before you finish, check your work against the task and its finish line, item
+by item: each behaviour it asks for needs a test that would fail without your
+change, and a requirement with no such test isn't done yet. If the task turns
+out too big for one branch, finish a coherent part and say exactly what's left
+(and how you'd split it) rather than leaving every part half done.
+
 When you have finished:
 1. Commit your work to this branch with a clear message (do not push or merge).
 2. Call the `report_result` tool from the `brindle` MCP server with a concise
@@ -72,6 +78,12 @@ Your shell may start in another directory, so begin every Bash command with
 `cd {path} && ` (or use `git -C {path}`), and give file tools absolute paths
 under that directory. Don't change files anywhere else, and don't switch branches.
 {guidance}
+Before you finish, check your work against the task and its finish line, item
+by item: each behaviour it asks for needs a test that would fail without your
+change, and a requirement with no such test isn't done yet. If the task turns
+out too big for one branch, finish a coherent part and say exactly what's left
+(and how you'd split it) rather than leaving every part half done.
+
 When you have finished:
 1. Commit your work there on `{branch}` with a clear message (do not push or merge).
 2. Don't call any brindle tools. End with a concise summary: what you changed,
@@ -1697,38 +1709,19 @@ def _local_reviewer_available() -> bool:
     return bool(ok) and "is available" in detail
 
 
-def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | None = None,
-                   focus: str | None = None, cfg: RepoConfig | None = None) -> Agent:
-    """Start a reviewer in a worker's workspace right away. Its verdict is
-    recorded for the merge gate and forwarded to ``caller`` as a message.
-    ``profile`` picks the reviewer profile; None uses
-    ``default_review_profile``.
-
-    Raises ``AgentError`` if the chosen profile (explicit or picked) doesn't
-    exist, or if it uses the codex provider but codex isn't on PATH -- rather
-    than spawning a reviewer doomed to fail in a dead pane.
-
-    ``cfg.checks`` are NOT run here (that would block the caller on the full
-    suite): the caller runs them in the background and delivers a pass/fail
-    summary to the reviewer as a message once they finish, via
-    ``deliver_check_summary``. If the workspace already has a review at an
-    earlier commit, the reviewer is pointed at just what changed since then,
-    when that's a plain diff (see ``is_linear_since``)."""
-    from brindle import gates
-    from brindle.config import load_repo_config
+def _review_kill_switch(ws: Workspace) -> None:
     from brindle.pro import rollout
 
     why_not = rollout.kill_switch_reason(ws.repo_root)   # Enterprise managed rollout
     if why_not:
         raise AgentError(f"No reviewer started: {why_not}")
-    cfg = cfg or load_repo_config(ws.repo_root)
-    sha = gates.head(ws)
-    for old in db.list_agents(ws.id):
-        if old.mode != "review" or old.result is not None or not is_alive(old):
-            continue
-        if old.review_sha == sha:
-            return old   # one reviewer per workspace and commit
-        close(db, old.id)   # a new commit replaces the reviewer of the old one
+
+
+def _review_profile(db: DB, ws: Workspace, profile: str | None, cfg: RepoConfig) -> str:
+    """The reviewer profile to use, checked to be one that can run: raises
+    ``AgentError`` if it (explicit or picked) doesn't exist, or uses the codex
+    provider but codex isn't on PATH -- rather than spawning a reviewer doomed
+    to fail in a dead pane."""
     worker = workspace_worker(db, ws)
     profile = profile or default_review_profile(cfg, worker, db, ws.repo_root,
                                                 worker.task if worker else None)
@@ -1743,6 +1736,125 @@ def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | N
             f"reviewer profile {profile!r} can't run: {why}. "
             "Fix that, or set review_profile (or pass profile) to a different reviewer"
         )
+    return profile
+
+
+def _live_reviewer(db: DB, ws: Workspace, sha: str, profile: str | None = None) -> Agent | None:
+    """The reviewer still at work on ``ws`` at ``sha``, if any. With
+    ``profile``, only one running that profile (a second review by another
+    profile is not a duplicate)."""
+    for a in db.list_agents(ws.id):
+        if a.mode == "review" and a.result is None and is_alive(a) and a.review_sha == sha \
+                and (profile is None or a.profile == profile):
+            return a
+    return None
+
+
+def start_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | None = None,
+                 focus: str | None = None, cfg: RepoConfig | None = None) -> Agent | None:
+    """Have ``ws`` reviewed. Without checks configured the reviewer starts
+    right away and is returned. With checks, nothing starts yet: a detached
+    ``_review-after-checks`` process runs them and starts the reviewer with
+    their results in its prompt (see ``review_after_checks``), so this returns
+    at once with None, however long the suite takes. Raises ``AgentError``
+    for a reviewer that couldn't start whatever the checks say (the kill
+    switch, an unusable profile); a failure after that reaches ``caller``
+    as a message."""
+    from brindle import gates
+    from brindle.config import load_repo_config
+    from brindle.providers import brindle_invocation
+
+    cfg = cfg or load_repo_config(ws.repo_root)
+    if not cfg.checks:
+        return request_review(db, caller, ws, profile, focus, cfg)
+    _review_kill_switch(ws)
+    _review_profile(db, ws, profile, cfg)
+    existing = _live_reviewer(db, ws, gates.head(ws), profile)
+    if existing:
+        return existing   # one reviewer per workspace and commit
+    argv = [*brindle_invocation(), "_review-after-checks", ws.id]
+    if caller:
+        argv += ["--caller", caller.id]
+    if profile:
+        argv += ["--profile", profile]
+    if focus:
+        argv += ["--focus", focus]
+    _detach(argv)
+    return None
+
+
+def expected_check_wait(db: DB, ws: Workspace, cfg: RepoConfig) -> float | None:
+    """Seconds the repo's checks usually take (the sum of each one's last
+    passing duration), or None when any of them has never passed."""
+    total = 0.0
+    for cmd in cfg.checks:
+        took = db.check_duration(ws.repo_root, cmd)
+        if took is None:
+            return None
+        total += took
+    return total if cfg.checks else None
+
+
+def review_after_checks(db: DB, caller_id: str | None, ws: Workspace, profile: str | None = None,
+                        focus: str | None = None, cfg: RepoConfig | None = None) -> Agent | None:
+    """Run ``cfg.checks`` for ``ws`` (through ``gates.check_summary``: its
+    lock and the by-sha cache, so a result a worker's report already warmed
+    is instant), then start the reviewer with the results in its prompt.
+    Meant to run from a detached process, which outlives the call that
+    started it. Gives up quietly when the branch moves on (the new commit
+    gets its own review), the workspace is gone, or a reviewer is already at
+    work on this commit. Raises ``AgentError`` when the reviewer can't
+    start."""
+    from brindle import gates
+    from brindle.config import load_repo_config
+
+    cfg = cfg or load_repo_config(ws.repo_root)
+    sha = gates.head(ws)
+    if _live_reviewer(db, ws, sha, profile):
+        return None
+    try:
+        summary = gates.check_summary(db, ws, cfg, cancel=lambda: gates.head(ws) != sha)
+    except gates.Abandoned:
+        return None
+    except Exception as e:  # noqa: BLE001 - the review goes ahead, saying so
+        summary = f"(running the checks crashed: {e})"
+    if db.get_workspace(ws.id) is None or gates.head(ws) != sha:
+        return None
+    caller = db.get_agent(caller_id) if caller_id else None
+    text = f"Checks for {ws.branch} at {sha[:8]}:\n\n{summary}" if summary else None
+    return request_review(db, caller, ws, profile, focus, cfg, check_summary=text)
+
+
+def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | None = None,
+                   focus: str | None = None, cfg: RepoConfig | None = None,
+                   check_summary: str | None = None) -> Agent:
+    """Start a reviewer in a worker's workspace right away. Its verdict is
+    recorded for the merge gate and forwarded to ``caller`` as a message.
+    ``profile`` picks the reviewer profile; None uses
+    ``default_review_profile`` (``AgentError`` if it can't run).
+
+    ``cfg.checks`` are NOT run here (that would block the caller on the full
+    suite): ``start_review`` runs them first, in the background, and passes
+    their results as ``check_summary`` for the reviewer's prompt. If the
+    workspace already has a review at an earlier commit, the reviewer is
+    pointed at just what changed since then, when that's a plain diff (see
+    ``is_linear_since``)."""
+    from brindle import gates
+    from brindle.config import load_repo_config
+
+    _review_kill_switch(ws)
+    cfg = cfg or load_repo_config(ws.repo_root)
+    sha = gates.head(ws)
+    for old in db.list_agents(ws.id):
+        if old.mode != "review" or old.result is not None or not is_alive(old):
+            continue
+        if old.review_sha == sha:
+            if profile and old.profile != profile:
+                continue   # another profile's review of this commit (a second review): keep both
+            return old   # one reviewer per workspace and commit
+        close(db, old.id)   # a new commit replaces the reviewer of the old one
+    worker = workspace_worker(db, ws)
+    profile = _review_profile(db, ws, profile, cfg)
 
     base = ws.base_branch or "the base branch"
     task = (f"Review the changes on branch `{ws.branch}` (workspace {ws.id}) against `{base}`: "
@@ -1755,16 +1867,9 @@ def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | N
     if worker and worker.done_when:
         task += f"\n\nIts finish line: {worker.done_when.strip()}"
 
-    if cfg and cfg.checks:
-        task += ("\n\nThe repo's checks are still running (or queued behind other branches' "
-                 "runs): you don't have their results yet. A pass/fail summary will arrive as a "
-                 "message. Review the diff meanwhile, and don't call submit_review until you've "
-                 "received it. If about 10 minutes pass after you've finished reviewing with no "
-                 "such message, submit anyway and say plainly in your summary that the checks "
-                 "were still running when you submitted, so your verdict rests on the diff "
-                 "alone: the merge gate runs them before anything merges, and a failure that "
-                 "arrives after your verdict goes to the supervisor. Don't run the whole suite "
-                 "yourself to compensate.")
+    if check_summary:
+        task += (f"\n\nThe repo's checks have already run on this commit:\n\n{check_summary}\n\n"
+                 "Take these results into account; don't run the whole suite yourself.")
 
     prev = db.last_review(ws.id)
     if prev and prev.sha != sha:
@@ -1784,87 +1889,6 @@ def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | N
                  mode="review", background_setup=True, review_sha=sha)
 
 
-def deliver_check_summary(db: DB, reviewer_id: str, ws: Workspace, cfg: RepoConfig) -> None:
-    """Run ``cfg.checks`` for ``ws`` and deliver a pass/fail summary to the
-    reviewer's inbox: delivered right away if it's idle, or handed over at its
-    next Stop, exactly like any other queued message (see ``send_message``).
-    Meant to run from a detached process started by request_review, so it
-    outlives the MCP server call that kicked it off. Always delivers
-    something, even if a check crashes, since the reviewer was told to wait
-    for this before approving. If the reviewer is no longer there to receive
-    it by the time the checks finish, a failing summary isn't dropped: see
-    ``_late_check_summary``."""
-    from brindle import gates
-
-    reviewer = db.get_agent(reviewer_id)
-    if reviewer is None:
-        return
-    supervisor_id = reviewer.parent_id
-    sha = gates.head(ws)  # label with the commit the checks ran on
-    try:
-        summary = gates.check_summary(db, ws, cfg)
-        failed = gates.summary_failed(summary)
-    except Exception as e:
-        summary, failed = f"(running the checks crashed: {e})", True
-
-    reviewer = db.get_agent(reviewer_id)
-    if reviewer is None or reviewer.result is not None or reviewer.status == "done":
-        # It submitted its review, was closed, or was removed while the checks ran.
-        if failed:
-            _late_check_summary(db, ws, sha, summary, reviewer_id, supervisor_id)
-        return
-
-    text = (f"Checks for {ws.branch} at {sha[:8]}:\n\n{summary}" if summary
-            else "No checks are configured for this repo.")
-    db.enqueue(reviewer_id, text, None)
-    flush(db, reviewer_id)
-
-
-def _late_check_summary(db: DB, ws: Workspace, sha: str, summary: str, reviewer_id: str,
-                        supervisor_id: str | None) -> None:
-    """The checks for ``ws`` at ``sha`` finished after its reviewer was done,
-    and failed (or crashed), so the verdict was given without them (a late
-    pass changes nothing). The failure must reach someone who can act on it:
-    the supervisor when the branch was approved (or has no verdict at this
-    commit), the worker when changes were requested anyway (the supervisor
-    if it's gone). Dropped
-    only when there's nothing left to act on: the workspace was removed, the
-    branch merged at this commit (its worktree may be going away under the
-    run), or the branch has new commits, which get their own run."""
-    from brindle import gates
-
-    try:
-        if db.get_workspace(ws.id) is None or db.merged_sha(ws.id) == sha or gates.head(ws) != sha:
-            return
-    except git.GitError:
-        return
-    worker = workspace_worker(db, ws)
-    supervisor_id = supervisor_id or (worker.parent_id if worker else None)
-    review = db.latest_review(ws.id, sha)
-    checks = f"Checks for {ws.branch} at {sha[:8]}:\n\n{summary}"
-    if review is not None and not review.approved and worker and is_alive(worker):
-        try:
-            send_message(db, worker.id,
-                         "The repo's checks finished after the review of your branch, and "
-                         f"failed. Fix this along with the review's findings.\n\n{checks}")
-            return
-        except (AgentError, tmux.TmuxError):
-            pass   # the supervisor hears instead
-    if supervisor_id is None or db.get_agent(supervisor_id) is None:
-        return
-    if review is not None and review.approved:
-        lead = (f"[brindle] The checks on `{ws.branch}` (workspace {ws.id}) FAILED, and the result "
-                f"arrived after reviewer {reviewer_id} had approved it: the approval rests on "
-                "the diff alone. The merge gate runs the checks again, so the branch won't "
-                "merge while they fail. Send this to the worker to fix, then have it reviewed "
-                "again.")
-    else:
-        lead = (f"[brindle] The checks on `{ws.branch}` (workspace {ws.id}) FAILED, and the result "
-                f"arrived after reviewer {reviewer_id} had finished, so the review didn't "
-                "take it into account. Send this to the worker to fix.")
-    gates.tell(db, supervisor_id, f"{lead}\n\n{checks}")
-
-
 # -- hook entry point --------------------------------------------------------
 
 

{brindle-0.2.0 → brindle-0.2.1}/src/brindle/autopilot.py

@@ -41,6 +41,7 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from brindle.config import CONFIG_DIR, WEIGHTS, RepoConfig, config_root, load_repo_config
+from brindle import escapes
 from brindle.db import DB, Agent, Autopilot, Milestone, Workspace
 from brindle.profiles import load_profile
 
@@ -67,7 +68,9 @@ to be asked each step.
 - The goal: if none is set yet, ask the user what we're building. Turn the
   answer into a goal with 2-6 milestones, each with a `check` command brindle can
   run from the root of this checkout that exits 0 only when that milestone is
-  done (e.g. `uv run pytest tests/test_settings.py -q`). Record it with
+  done (e.g. `uv run pytest tests/test_settings.py -q`). A check must test what
+  the milestone promises, not just that the suite passes: name the tests that
+  cover its acceptance criteria. Record it with
   `set_goal`, tell the user the plan in a few lines, then start. If
   `.brindle/goals.md` exists, brindle has already loaded it: call `get_progress`.
 - Work on the first unverified milestone. Split it into independent tasks and
@@ -90,7 +93,8 @@ to be asked each step.
 - After merging, call `check_milestone`. Only brindle's check marks a milestone
   done: never claim one is done yourself. When every milestone passes, brindle
   audits the work against the goal; the goal is reached only when that audit
-  approves. Treat any gaps it finds as unfinished work.
+  approves. Treat any gaps it finds as unfinished work, and tighten (with
+  `set_goal`) the check that let each gap through.
 - Keep going until every milestone passes. If you stop early, brindle will ask
   you to continue. Stop only when you are blocked on something only the user
   can decide: call `need_user` with the question, then ask it.
@@ -501,7 +505,8 @@ def _route_by_weight(db: DB, cfg: RepoConfig, repo_root: str, weight: str, task:
         decision["baseline"] = remaining[0]
     why = f"weight {weight} -> {name}"
     picked = f"learning picked it: {reason}" if reason else "learning picked it"
-    detail = [picked if pick else "", *skipped]
+    kept = learning.kept_note(cfg, repo_root)
+    detail = [picked if pick else (f"learning kept it: {kept}" if kept else ""), *skipped]
     detail = [d for d in detail if d]
     if detail:
         why += f" ({', '.join(detail)})"
@@ -601,18 +606,63 @@ def tail(text: str, lines: int = OUTPUT_TAIL_LINES) -> str:
     return "\n".join(out[-lines:])
 
 
-def run_check(cmd: str, cwd: str, env: dict[str, str], timeout: int) -> tuple[bool, str]:
-    """Run one check command. Returns (passed, the tail of its output)."""
-    try:
-        proc = subprocess.run(
-            cmd, shell=True, cwd=cwd, env={**os.environ, **env}, capture_output=True,
-            text=True, timeout=timeout, stdin=subprocess.DEVNULL,
+class CheckCancelled(Exception):
+    """``cancel()`` turned true while a check command was running."""
+
+
+KILL_WAIT = 5.0     # seconds to wait for a killed check's pipes to close
+CANCEL_POLL = 1.0  # seconds between looks at ``cancel`` while a check runs
+
+
+def run_check(cmd: str, cwd: str, env: dict[str, str], timeout: int,
+              cancel=None) -> tuple[bool, str]:
+    """Run one check command. Returns (passed, the tail of its output).
+    ``cancel``, if given, is polled while the command runs; when it turns
+    true the command is killed and ``CheckCancelled`` is raised."""
+    if cancel is None:
+        try:
+            proc = subprocess.run(
+                cmd, shell=True, cwd=cwd, env={**os.environ, **env}, capture_output=True,
+                text=True, timeout=timeout, stdin=subprocess.DEVNULL,
+            )
+        except subprocess.TimeoutExpired:
+            return False, f"$ {cmd}\n(timed out after {timeout}s)"
+        stdout, stderr, returncode = proc.stdout, proc.stderr, proc.returncode
+    else:
+        proc = subprocess.Popen(
+            cmd, shell=True, cwd=cwd, env={**os.environ, **env}, stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE, text=True, stdin=subprocess.DEVNULL, start_new_session=True,
         )
-    except subprocess.TimeoutExpired:
-        return False, f"$ {cmd}\n(timed out after {timeout}s)"
-    output = tail((proc.stdout or "") + (proc.stderr or ""))
-    status = "" if proc.returncode == 0 else f"(exit {proc.returncode})"
-    return proc.returncode == 0, "\n".join(p for p in (f"$ {cmd}", output, status) if p)
+        deadline = time.monotonic() + timeout
+        while True:
+            try:
+                stdout, stderr = proc.communicate(timeout=CANCEL_POLL)
+                break
+            except subprocess.TimeoutExpired:
+                pass
+            timed_out = time.monotonic() >= deadline
+            if timed_out or cancel():
+                _kill_group(proc)
+                try:
+                    proc.communicate(timeout=KILL_WAIT)
+                except subprocess.TimeoutExpired:
+                    pass   # a grandchild still holds the pipes; don't hang on it
+                if timed_out:
+                    return False, f"$ {cmd}\n(timed out after {timeout}s)"
+                raise CheckCancelled(cmd)
+        returncode = proc.returncode
+    output = tail((stdout or "") + (stderr or ""))
+    status = "" if returncode == 0 else f"(exit {returncode})"
+    return returncode == 0, "\n".join(p for p in (f"$ {cmd}", output, status) if p)
+
+
+def _kill_group(proc: subprocess.Popen) -> None:
+    import signal
+
+    try:
+        os.killpg(proc.pid, signal.SIGKILL)
+    except (ProcessLookupError, PermissionError):
+        proc.kill()
 
 
 def checking(ap: Autopilot, timeout: float = 900.0) -> bool:
@@ -709,6 +759,11 @@ def check_milestones(db: DB, root_id: str, ws: Workspace, position: int | None =
             # Not if it already passed at this very commit: a flaky check
             # flipping back isn't progress.
             newly_passed |= ok and m.status != "passed" and (sha is None or m.passed_sha != sha)
+            if not ok and m.status == "passed" and sha and m.checked_sha:
+                # Passed at the commit before, fails now: whatever merged in
+                # between got past its reviewer.
+                escapes.milestone_regressed(db, checkout.repo_root, checkout.path, m.title,
+                                            m.checked_sha, sha)
             db.record_check(m.id, ok, out, sha)
 
     run(chosen)
@@ -884,6 +939,9 @@ def record_audit(db: DB, root_id: str, approved: bool, summary: str) -> str:
                 f"\n\n{summary}")
     db.update_autopilot(root_id, state="running", note=summary.strip()[:4000], audit_ok=0,
                         auditor_id=None)
+    audit_ws = db.get_workspace(root.workspace_id) if root else None
+    if audit_ws is not None:
+        escapes.audit_gaps(db, audit_ws.repo_root, summary)
     return (f"[brindle] Completion audit of {sha}: GAPS FOUND. The goal isn't reached yet, even "
             "though every milestone's check passes. Close each gap below (and where a check let "
             "a gap through, tighten it with set_goal), then call check_milestone to re-audit."

{brindle-0.2.0 → brindle-0.2.1}/src/brindle/budget.py

@@ -25,7 +25,7 @@ from __future__ import annotations
 import logging
 import statistics
 import time
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 
 from brindle import pricing
 from brindle.db import DB
@@ -47,10 +47,34 @@ class Limits:
     stop: bool = False      # close a worker that reaches task_usd (default: only warn)
     seat_spent_usd: float | None = None   # this month's spend as the org counts it (org budgets)
     org: bool = False       # an org budget is part of these limits: it can't be skipped for want of a price
+    hide_dollars: bool = False   # the org hides this person's org spend and limits: words, not dollars
+
+    org_caps: dict = field(default_factory=dict)   # the org's own value per limit key, before a repo tightened it
 
     def any(self) -> bool:
         return any(getattr(self, k) is not None for k in KEYS)
 
+    def hides(self, key: str) -> bool:
+        """Whether ``key``'s dollars are the org's to hide. A stricter personal
+        (repo) limit is the person's own: it stays in dollars."""
+        if not self.hide_dollars:
+            return False
+        cap, mine = self.org_caps.get(key), getattr(self, key)
+        return cap is not None and (mine is None or mine >= cap)
+
+
+AT_LIMIT, CLOSE, WITHIN = "at limit", "getting close", "within limit"
+
+
+def status_word(spent: float, limit: float | None) -> str:
+    """"within limit", "getting close" (at ``WARN_AT`` of ``limit`` or more) or
+    "at limit" (what is shown instead of org dollars when the org hides them)."""
+    if limit is None:
+        return WITHIN
+    if limit <= 0 or spent >= limit:
+        return AT_LIMIT
+    return CLOSE if spent >= limit * WARN_AT else WITHIN
+
 
 def parse(raw: object) -> Limits:
     """``Limits`` from a config value; anything malformed or non-positive is ignored."""
@@ -102,7 +126,8 @@ def org_limits(repo_root: str | None) -> Limits | None:
     if spent is not None and p.spend_month != time.strftime("%Y-%m", time.gmtime()):
         spent = None                      # last month's number
     lim = Limits(task_usd=p.budget_task_usd, goal_usd=p.budget_goal_usd,
-                 month_usd=p.budget_seat_month_usd, seat_spent_usd=spent)
+                 month_usd=p.budget_seat_month_usd, seat_spent_usd=spent,
+                 hide_dollars=p.visibility.get("own_dollars") is False)
     return lim if lim.any() else None
 
 
@@ -130,8 +155,13 @@ def limits(cfg, repo_root: str | None = None) -> Limits | None:
         lim.goal_usd = _tighter(lim.goal_usd, org.goal_usd)
         lim.month_usd = _tighter(lim.month_usd, org.month_usd)
         lim.seat_spent_usd = org.seat_spent_usd
+        lim.hide_dollars = org.hide_dollars
+        lim.org_caps = {k: getattr(org, k) for k in KEYS}
     if lim.month_usd is not None:
-        lim.month_usd += _approved_month()      # an admin's cost-center approval (Enterprise)
+        approved = _approved_month()      # an admin's cost-center approval (Enterprise)
+        lim.month_usd += approved
+        if lim.org_caps.get("month_usd") is not None:
+            lim.org_caps["month_usd"] += approved
     return lim if lim.any() else None
 
 
@@ -266,18 +296,25 @@ class Gate:
                 return f"{profile} has no known price, so it can't be shown to fit the org's budget"
             return None
         m = pricing.money
+        # the org hides its dollars from this person: say it in words (a personal limit stays in dollars)
         if lim.task_usd is not None and est > lim.task_usd:
+            if lim.hides("task_usd"):
+                return f"a {profile} task would go over the task budget (at limit)"
             return f"a {profile} task costs about {m(est)}, over the {m(lim.task_usd)} task budget"
         if lim.goal_usd is not None:
             spent, cap = self.goal_spend(), self.goal_limit()
             if spent is None:
                 return f"the goal's spend can't be totalled, so {profile} can't be shown to fit its budget"
             if spent + est > cap:
+                if lim.hides("goal_usd"):
+                    return f"{profile} would take the goal over its budget (at limit)"
                 return (f"{profile} at about {m(est)} would take the goal to {m(spent + est)}, "
                         f"over its {m(cap)} budget")
         if lim.month_usd is not None:
             spent = self.month_spend()
             if spent + est > lim.month_usd:
+                if lim.hides("month_usd"):
+                    return f"{profile} would take this month over the budget (at limit)"
                 return (f"{profile} at about {m(est)} would take this month to {m(spent + est)}, "
                         f"over the {m(lim.month_usd)} budget")
         return None
@@ -326,7 +363,9 @@ def sweep(db: DB, now: float | None = None) -> list[str]:
         m = pricing.money
         try:
             if spent >= lim.task_usd:
-                note = (f"[brindle budget] worker {agent.id} has spent about {m(spent)}, "
+                note = (f"[brindle budget] worker {agent.id} is at limit on its task budget."
+                        if lim.hides("task_usd") else
+                        f"[brindle budget] worker {agent.id} has spent about {m(spent)}, "
                         f"its {m(lim.task_usd)} task budget.")
                 if lim.stop:
                     try:
@@ -344,7 +383,9 @@ def sweep(db: DB, now: float | None = None) -> list[str]:
                 done.append(note)
             elif spent >= lim.task_usd * WARN_AT and not r.budget_state:
                 db.set_budget_state(agent.id, "warned")
-                note = (f"[brindle budget] worker {agent.id} has spent about {m(spent)}, over "
+                note = (f"[brindle budget] worker {agent.id} is getting close to its task budget."
+                        if lim.hides("task_usd") else
+                        f"[brindle budget] worker {agent.id} has spent about {m(spent)}, over "
                         f"{round(WARN_AT * 100)}% of its {m(lim.task_usd)} task budget.")
                 _tell(db, agent, note)
                 done.append(note)

brindle-0.2.1/src/brindle/builtin_agents/developer-codex.md

@@ -0,0 +1,6 @@
+---
+name: developer-codex
+description: Implements a well-scoped coding task on its own branch, using Codex (the medium tier of weight routing)
+extends: developer
+provider: codex
+---

brindle-0.2.1/src/brindle/builtin_agents/developer-heavy.md

@@ -0,0 +1,7 @@
+---
+name: developer-heavy
+description: Implements a design-heavy or subtle task on its own branch, on Fable with high effort (the heavy tier of weight routing)
+extends: developer
+model: claude-fable-5-1
+effort: high
+---

brindle-0.2.1/src/brindle/builtin_agents/developer-light.md

@@ -0,0 +1,7 @@
+---
+name: developer-light
+description: Implements a small, well-specified task on its own branch, on Sonnet with low effort (the baseline of the light tier of weight routing)
+extends: developer
+model: sonnet
+effort: low
+---