coding-os 0.3.7__tar.gz → 0.3.9__tar.gz

{coding_os-0.3.7 → coding_os-0.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.7
+Version: 0.3.9
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0
@@ -474,6 +474,31 @@ Deep dive: [docs/engineering/graph_os-queries.md](./docs/engineering/graph_os-qu
 Parity matrix + reasoning: [docs/engineering/adapter-parity.md](./docs/engineering/adapter-parity.md)
 (the 2026-04-25 workflow audit is a historical snapshot predating Codex parity).
 
+## Agent supervision — pick the model per role (opt-in)
+
+Off by default. Turn it on and each of the 11 semantic roles can run on its own
+adapter, model, and reasoning effort — a cheap model reviewing, an expensive one
+architecting. It works with a **single** adapter too: routing across Claude's own
+model tiers is the common case, not a fallback.
+
+```bash
+cos supervision enable
+cos supervision set --orchestrator-model claude-sonnet-5     # project default
+cos supervision set --role reviewer  --role-model claude-haiku-4-5 --role-effort low
+cos supervision set --role architect --role-model claude-opus-4-8  --role-effort xhigh
+cos supervision show
+```
+
+Adapters and their model catalogs are discovered from `adapter.yaml`, so a new
+runtime is configurable the day it is installed. When a provider reports a rate
+or capacity limit, that adapter is put on a persistent cooldown with a single
+half-open recovery probe instead of retry-storming a limit that cannot succeed.
+Same policy from the Hub (**Config → Settings**), the CLI, or MCP — no Hub
+required. Disabled means disabled: no probe, no state write, no tokens.
+
+Full contract: [docs/engineering/agent-supervision.md](./docs/engineering/agent-supervision.md)
+· operator guide: [docs/playbooks/agent-supervision-setup.md](./docs/playbooks/agent-supervision-setup.md)
+
 ## Configuration
 
 `.coding-os.yaml` at every project root:
@@ -526,6 +551,7 @@ CI runs the matrix on every PR. See `.github/workflows/ci.yml`.
 | [docs/governance/agent-workflow.md](./docs/governance/agent-workflow.md)            | Domain routing, task protocol, memory contract              |
 | [docs/engineering/graph_os-queries.md](./docs/engineering/graph_os-queries.md)      | When to query the graph vs grep                             |
 | [docs/engineering/hub-architecture.md](./docs/engineering/hub-architecture.md)      | Hub: FastAPI ↔ React SPA contract                           |
+| [docs/engineering/agent-supervision.md](./docs/engineering/agent-supervision.md)    | Per-role adapter/model routing, capacity breaker, trigger modes |
 | [docs/playbooks/](./docs/playbooks/)                                                | Hook authoring · adapter authoring · template authoring · MCP tool authoring |
 | [docs/adapters/](./docs/adapters/)                                                  | Claude SDK · Codex CLI integration                          |
 | [CONTRIBUTING.md](./CONTRIBUTING.md)                                                | Setup, contribution loop, PR checklist                      |

{coding_os-0.3.7 → coding_os-0.3.9}/README.md

@@ -408,6 +408,31 @@ Deep dive: [docs/engineering/graph_os-queries.md](./docs/engineering/graph_os-qu
 Parity matrix + reasoning: [docs/engineering/adapter-parity.md](./docs/engineering/adapter-parity.md)
 (the 2026-04-25 workflow audit is a historical snapshot predating Codex parity).
 
+## Agent supervision — pick the model per role (opt-in)
+
+Off by default. Turn it on and each of the 11 semantic roles can run on its own
+adapter, model, and reasoning effort — a cheap model reviewing, an expensive one
+architecting. It works with a **single** adapter too: routing across Claude's own
+model tiers is the common case, not a fallback.
+
+```bash
+cos supervision enable
+cos supervision set --orchestrator-model claude-sonnet-5     # project default
+cos supervision set --role reviewer  --role-model claude-haiku-4-5 --role-effort low
+cos supervision set --role architect --role-model claude-opus-4-8  --role-effort xhigh
+cos supervision show
+```
+
+Adapters and their model catalogs are discovered from `adapter.yaml`, so a new
+runtime is configurable the day it is installed. When a provider reports a rate
+or capacity limit, that adapter is put on a persistent cooldown with a single
+half-open recovery probe instead of retry-storming a limit that cannot succeed.
+Same policy from the Hub (**Config → Settings**), the CLI, or MCP — no Hub
+required. Disabled means disabled: no probe, no state write, no tokens.
+
+Full contract: [docs/engineering/agent-supervision.md](./docs/engineering/agent-supervision.md)
+· operator guide: [docs/playbooks/agent-supervision-setup.md](./docs/playbooks/agent-supervision-setup.md)
+
 ## Configuration
 
 `.coding-os.yaml` at every project root:
@@ -460,6 +485,7 @@ CI runs the matrix on every PR. See `.github/workflows/ci.yml`.
 | [docs/governance/agent-workflow.md](./docs/governance/agent-workflow.md)            | Domain routing, task protocol, memory contract              |
 | [docs/engineering/graph_os-queries.md](./docs/engineering/graph_os-queries.md)      | When to query the graph vs grep                             |
 | [docs/engineering/hub-architecture.md](./docs/engineering/hub-architecture.md)      | Hub: FastAPI ↔ React SPA contract                           |
+| [docs/engineering/agent-supervision.md](./docs/engineering/agent-supervision.md)    | Per-role adapter/model routing, capacity breaker, trigger modes |
 | [docs/playbooks/](./docs/playbooks/)                                                | Hook authoring · adapter authoring · template authoring · MCP tool authoring |
 | [docs/adapters/](./docs/adapters/)                                                  | Claude SDK · Codex CLI integration                          |
 | [CONTRIBUTING.md](./CONTRIBUTING.md)                                                | Setup, contribution loop, PR checklist                      |

{coding_os-0.3.7 → coding_os-0.3.9}/coding_os.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-os
-Version: 0.3.7
+Version: 0.3.9
 Summary: The cognitive operating system that gives AI agents memory, structure, and discipline
 Author-email: Kourosh Ebrahimzadeh <info@coding-os.dev>
 License-Expression: Apache-2.0
@@ -474,6 +474,31 @@ Deep dive: [docs/engineering/graph_os-queries.md](./docs/engineering/graph_os-qu
 Parity matrix + reasoning: [docs/engineering/adapter-parity.md](./docs/engineering/adapter-parity.md)
 (the 2026-04-25 workflow audit is a historical snapshot predating Codex parity).
 
+## Agent supervision — pick the model per role (opt-in)
+
+Off by default. Turn it on and each of the 11 semantic roles can run on its own
+adapter, model, and reasoning effort — a cheap model reviewing, an expensive one
+architecting. It works with a **single** adapter too: routing across Claude's own
+model tiers is the common case, not a fallback.
+
+```bash
+cos supervision enable
+cos supervision set --orchestrator-model claude-sonnet-5     # project default
+cos supervision set --role reviewer  --role-model claude-haiku-4-5 --role-effort low
+cos supervision set --role architect --role-model claude-opus-4-8  --role-effort xhigh
+cos supervision show
+```
+
+Adapters and their model catalogs are discovered from `adapter.yaml`, so a new
+runtime is configurable the day it is installed. When a provider reports a rate
+or capacity limit, that adapter is put on a persistent cooldown with a single
+half-open recovery probe instead of retry-storming a limit that cannot succeed.
+Same policy from the Hub (**Config → Settings**), the CLI, or MCP — no Hub
+required. Disabled means disabled: no probe, no state write, no tokens.
+
+Full contract: [docs/engineering/agent-supervision.md](./docs/engineering/agent-supervision.md)
+· operator guide: [docs/playbooks/agent-supervision-setup.md](./docs/playbooks/agent-supervision-setup.md)
+
 ## Configuration
 
 `.coding-os.yaml` at every project root:
@@ -526,6 +551,7 @@ CI runs the matrix on every PR. See `.github/workflows/ci.yml`.
 | [docs/governance/agent-workflow.md](./docs/governance/agent-workflow.md)            | Domain routing, task protocol, memory contract              |
 | [docs/engineering/graph_os-queries.md](./docs/engineering/graph_os-queries.md)      | When to query the graph vs grep                             |
 | [docs/engineering/hub-architecture.md](./docs/engineering/hub-architecture.md)      | Hub: FastAPI ↔ React SPA contract                           |
+| [docs/engineering/agent-supervision.md](./docs/engineering/agent-supervision.md)    | Per-role adapter/model routing, capacity breaker, trigger modes |
 | [docs/playbooks/](./docs/playbooks/)                                                | Hook authoring · adapter authoring · template authoring · MCP tool authoring |
 | [docs/adapters/](./docs/adapters/)                                                  | Claude SDK · Codex CLI integration                          |
 | [CONTRIBUTING.md](./CONTRIBUTING.md)                                                | Setup, contribution loop, PR checklist                      |

{coding_os-0.3.7 → coding_os-0.3.9}/coding_os.egg-info/SOURCES.txt

@@ -92,6 +92,7 @@ src/cli/skills_list.py
 src/cli/stack_lint.py
 src/cli/stack_registry.py
 src/cli/subsystems.py
+src/cli/supervision_commands.py
 src/cli/sync_all.py
 src/cli/tail_command.py
 src/cli/update.py
@@ -553,6 +554,7 @@ src/core/thinking_os/impact.py
 src/core/thinking_os/memory_gc.py
 src/core/thinking_os/migrator_embeddings.py
 src/core/thinking_os/precision.py
+src/core/thinking_os/project_settings.py
 src/core/thinking_os/record_outcome.py
 src/core/thinking_os/repair.py
 src/core/thinking_os/retrieval_quality.py

{coding_os-0.3.7 → coding_os-0.3.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "coding-os"
-version = "0.3.7"
+version = "0.3.9"
 description = "The cognitive operating system that gives AI agents memory, structure, and discipline"
 readme = "README.md"
 requires-python = ">=3.10"

{coding_os-0.3.7 → coding_os-0.3.9}/src/adapters/claude/adapter.yaml

@@ -8,16 +8,24 @@ runtime: in_process
 runtime_entrypoints:
   dispatch: sdk_dispatcher.py
   capabilities: [dispatch, model_selection, effort_selection, structured_output]
+# `bucket` names the provider's rate-limit pool. Anthropic applies limits
+# separately per model, and Opus 4.x share one pool while Opus 5 has its own
+# (docs.claude.com/en/api/rate-limits) — so a limit on one bucket must not
+# take the others out of service.
 models:
   - id: claude-fable-5
     label: "Fable 5"
+    bucket: fable-5
   - id: claude-opus-4-8
     label: "Opus 4.8"
     default: true
+    bucket: opus-4x
   - id: claude-sonnet-5
     label: "Sonnet 5"
+    bucket: sonnet-5
   - id: claude-haiku-4-5
     label: "Haiku 4.5"
+    bucket: haiku-4-5
 # Reasoning-effort levels the Claude Agent SDK accepts (EffortLevel) — shown in
 # the Hub chat composer so a turn can be weighted per adapter.
 efforts: [low, medium, high, xhigh, max]

{coding_os-0.3.7 → coding_os-0.3.9}/src/adapters/claude/sdk_dispatcher.py

@@ -95,6 +95,11 @@ def _failure_fields(status: str, error: str | None) -> dict[str, Any]:
         for token in ("unauthorized", "authentication", "not logged in", "401", "403")
     ):
         return {"error_category": "auth", "outcome": "known_failed"}
+    # Provider-side overload (529) and internal errors (5xx) are NOT your quota,
+    # so they must not open the capacity breaker — but they are the most
+    # retryable class there is, and reporting them non-retryable is wrong.
+    if any(token in message for token in ("overloaded", "529", "api_error", "500", "502", "503")):
+        return {"error_category": "provider", "retryable": True, "outcome": "unknown"}
     if any(token in message for token in ("not importable", "not found")):
         return {"error_category": "unavailable", "outcome": "known_failed"}
     if any(token in message for token in ("must be absolute", "max_budget_usd", "max_turns")):

{coding_os-0.3.7 → coding_os-0.3.9}/src/adapters/codex/adapter.yaml

@@ -9,7 +9,7 @@ runtime: roadmap
 runtime_entrypoints:
   dispatch: sdk_dispatcher.py
   transcript: chat_provider.py
-  capabilities: [dispatch, model_selection, structured_output]
+  capabilities: [dispatch, transcript, model_selection, structured_output]
 models: []
 
 presence:

{coding_os-0.3.7 → coding_os-0.3.9}/src/adapters/codex/sdk_dispatcher.py

@@ -50,6 +50,11 @@ def _failure_fields(status: str, error: str | None) -> dict[str, Any]:
         for token in ("unauthorized", "authentication", "not logged in", "401", "403")
     ):
         return {"error_category": "auth", "outcome": "known_failed"}
+    # Provider-side overload (529) and internal errors (5xx) are NOT your quota,
+    # so they must not open the capacity breaker — but they are the most
+    # retryable class there is, and reporting them non-retryable is wrong.
+    if any(token in message for token in ("overloaded", "529", "api_error", "500", "502", "503")):
+        return {"error_category": "provider", "retryable": True, "outcome": "unknown"}
     if any(token in message for token in ("not in path", "not importable", "unsupported")):
         return {"error_category": "unavailable", "outcome": "known_failed"}
     if any(token in message for token in ("must be absolute", "cannot enforce", "invalid")):

{coding_os-0.3.7 → coding_os-0.3.9}/src/cli/main.py

@@ -1297,11 +1297,13 @@ from cli.module_commands import module_group as module_group_cmd  # noqa: E402
 from cli.preset_commands import preset_group as preset_group_cmd  # noqa: E402
 from cli.skill_commands import skill_group as skill_group_cmd  # noqa: E402
 from cli.stack_lint import stack_lint as stack_lint_cmd  # noqa: E402
+from cli.supervision_commands import supervision_group as supervision_group_cmd  # noqa: E402
 
 cli.add_command(module_group_cmd)
 cli.add_command(preset_group_cmd)
 cli.add_command(skill_group_cmd)
 cli.add_command(stack_lint_cmd)
+cli.add_command(supervision_group_cmd)
 
 # Durable error/log query CLI (cos errors / cos logs).
 try:

coding_os-0.3.9/src/cli/supervision_commands.py

@@ -0,0 +1,197 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import click
+
+from thinking_os.supervision import policy_snapshot, update_policy
+
+
+def _project_root(raw: str) -> Path:
+    root = Path(raw).resolve()
+    if not (root / ".coding-os").is_dir():
+        raise click.ClickException(
+            f"{root} is not a coding-os project (.coding-os/ missing) — run from the project root."
+        )
+    return root
+
+
+def _emit_snapshot(root: Path, output_format: str) -> None:
+    snapshot = policy_snapshot(root)
+    if output_format == "json":
+        click.echo(json.dumps(snapshot, indent=2))
+        return
+    policy = snapshot["policy"]
+    click.echo(f"Supervision: {'enabled' if policy['enabled'] else 'disabled'}")
+    click.echo(
+        f"Mode: {policy['mode']} · threshold: {policy['complexity_threshold']} · "
+        f"fallback: {policy['fallback_policy']} · parallel: {policy['max_parallel']}"
+    )
+    cooldown = policy["cooldown"]
+    click.echo(
+        f"Cooldown: {cooldown['default_seconds']}s default · {cooldown['maximum_seconds']}s maximum"
+    )
+    orchestrator = policy["orchestrator"]
+    click.echo(
+        "Orchestrator: "
+        + "/".join(
+            (
+                orchestrator["adapter"] or "current-adapter",
+                orchestrator["model"] or "default-model",
+                orchestrator["effort"] or "default-effort",
+            )
+        )
+    )
+    roles = policy["roles"]
+    click.echo("Roles: " + (", ".join(sorted(roles)) if roles else "none"))
+    adapters = snapshot["adapters"]
+    click.echo("Eligible adapters: " + (", ".join(row["id"] for row in adapters) or "none"))
+    click.echo(f"Settings: {snapshot['settings_path']}")
+
+
+def _update(root: Path, patch: dict, **kwargs) -> None:
+    try:
+        update_policy(root, patch, **kwargs)
+    except ValueError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+
+@click.group("supervision")
+def supervision_group() -> None:
+    """Inspect and configure agent supervision without Hub."""
+
+
+@supervision_group.command("show")
+@click.option("-d", "--project-dir", default=".", show_default=True, type=click.Path())
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text")
+def supervision_show(project_dir: str, output_format: str) -> None:
+    """Show the normalized project policy and eligible adapters."""
+    _emit_snapshot(_project_root(project_dir), output_format)
+
+
+def _toggle(project_dir: str, enabled: bool, output_format: str) -> None:
+    root = _project_root(project_dir)
+    _update(root, {"enabled": enabled})
+    _emit_snapshot(root, output_format)
+
+
+@supervision_group.command("enable")
+@click.option("-d", "--project-dir", default=".", show_default=True, type=click.Path())
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text")
+def supervision_enable(project_dir: str, output_format: str) -> None:
+    """Enable supervision for this project."""
+    _toggle(project_dir, True, output_format)
+
+
+@supervision_group.command("disable")
+@click.option("-d", "--project-dir", default=".", show_default=True, type=click.Path())
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text")
+def supervision_disable(project_dir: str, output_format: str) -> None:
+    """Disable supervision while preserving its policy."""
+    _toggle(project_dir, False, output_format)
+
+
+@supervision_group.command("set")
+@click.option("-d", "--project-dir", default=".", show_default=True, type=click.Path())
+@click.option("--mode", type=click.Choice(["explicit", "suggest", "adaptive"]))
+@click.option(
+    "--complexity-threshold",
+    type=click.Choice(["CLEAR", "COMPLICATED", "COMPLEX", "CHAOTIC"]),
+)
+@click.option(
+    "--fallback-policy",
+    type=click.Choice(["fail_closed", "same_adapter_default", "next_eligible"]),
+)
+@click.option("--max-parallel", type=click.IntRange(1, 16))
+@click.option("--cooldown-default-seconds", type=click.IntRange(1, 86400))
+@click.option("--cooldown-maximum-seconds", type=click.IntRange(1, 604800))
+@click.option("--orchestrator-adapter")
+@click.option("--orchestrator-model")
+@click.option("--orchestrator-effort")
+@click.option("--clear-orchestrator", is_flag=True)
+@click.option("--role")
+@click.option("--role-adapter")
+@click.option("--role-model")
+@click.option("--role-effort")
+@click.option("--clear-role", is_flag=True)
+@click.option("--format", "output_format", type=click.Choice(["text", "json"]), default="text")
+def supervision_set(
+    project_dir: str,
+    mode: str | None,
+    complexity_threshold: str | None,
+    fallback_policy: str | None,
+    max_parallel: int | None,
+    cooldown_default_seconds: int | None,
+    cooldown_maximum_seconds: int | None,
+    orchestrator_adapter: str | None,
+    orchestrator_model: str | None,
+    orchestrator_effort: str | None,
+    clear_orchestrator: bool,
+    role: str | None,
+    role_adapter: str | None,
+    role_model: str | None,
+    role_effort: str | None,
+    clear_role: bool,
+    output_format: str,
+) -> None:
+    """Partially update routing, cooldown, orchestrator, or one role policy."""
+    root = _project_root(project_dir)
+    patch: dict = {}
+    for key, value in (
+        ("mode", mode),
+        ("complexity_threshold", complexity_threshold),
+        ("fallback_policy", fallback_policy),
+        ("max_parallel", max_parallel),
+    ):
+        if value is not None:
+            patch[key] = value
+    cooldown = {
+        key: value
+        for key, value in (
+            ("default_seconds", cooldown_default_seconds),
+            ("maximum_seconds", cooldown_maximum_seconds),
+        )
+        if value is not None
+    }
+    if cooldown:
+        patch["cooldown"] = cooldown
+    orchestrator = {
+        key: value
+        for key, value in (
+            ("adapter", orchestrator_adapter),
+            ("model", orchestrator_model),
+            ("effort", orchestrator_effort),
+        )
+        if value is not None
+    }
+    if orchestrator:
+        patch["orchestrator"] = orchestrator
+    role_values = {
+        key: value
+        for key, value in (
+            ("adapter", role_adapter),
+            ("model", role_model),
+            ("effort", role_effort),
+        )
+        if value is not None
+    }
+    if (role_values or clear_role) and not role:
+        raise click.UsageError("--role is required with role options or --clear-role")
+    if clear_role and role_values:
+        raise click.UsageError("--clear-role cannot be combined with --role-adapter/model/effort")
+    if orchestrator and clear_orchestrator:
+        raise click.UsageError(
+            "--clear-orchestrator cannot be combined with --orchestrator-adapter/model/effort"
+        )
+    if role_values and role:
+        patch["roles"] = {role: role_values}
+    if not patch and not clear_role and not clear_orchestrator:
+        raise click.UsageError("provide at least one setting to update")
+    _update(
+        root,
+        patch,
+        clear_role=(role or "") if clear_role else "",
+        clear_orchestrator=clear_orchestrator,
+    )
+    _emit_snapshot(root, output_format)

{coding_os-0.3.7 → coding_os-0.3.9}/src/cli/update.py

@@ -161,10 +161,21 @@ def _build_target_assets(agent: str, templates: list[str]) -> dict[str, list[Ass
         "commands": [],
     }
 
-    # Hooks — always use src/core/hooks/ regardless of agent (path may differ).
+    # Hooks — the agent-agnostic core set, PLUS the adapter's own hooks. Omitting
+    # the adapter-owned ones made them look unknown to the diff, so `cos update`
+    # deleted them: for Codex that is every dispatcher, i.e. its whole hook
+    # parity mechanism. Helper .py files sit beside the .sh and link the same way.
     hooks_dir_rel = adapter.hooks_dir
     if hooks_dir_rel:
-        for hook in sorted((CORE_DIR / "hooks").glob("*.sh")):
+        sources = [*sorted((CORE_DIR / "hooks").glob("*.sh"))]
+        adapter_hooks = ADAPTERS_DIR / agent / "hooks"
+        if adapter_hooks.is_dir():
+            sources += sorted(
+                path
+                for path in adapter_hooks.iterdir()
+                if path.is_file() and path.suffix in (".sh", ".py")
+            )
+        for hook in sources:
             result["hooks"].append(
                 AssetRef(
                     name=hook.name,

{coding_os-0.3.7 → coding_os-0.3.9}/src/core/board_os/transition_gates_cli.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import logging
 import os
 import sqlite3
 import sys
@@ -18,6 +19,8 @@ from board_os.transition_gates_validator import (
     validate_transition,
 )
 
+logger = logging.getLogger("coding_os.board_os.gates")
+
 
 def _read_stdin_payload() -> dict:
     """Read the hook payload from stdin (≤2 s timeout matches our hooks)."""
@@ -73,6 +76,19 @@ def _load_body_for_task(task_id: str, file_path: Path | None) -> tuple[str, str]
     return "", str(row[1] or "feature")
 
 
+def _verify_ledger_path() -> Path | None:
+    state_dir = Path(os.environ.get("COS_STATE_DIR", ".coding-os"))
+    if state_dir.is_absolute():
+        return state_dir / ".last-verify.json"
+    try:
+        from thinking_os.database import project_root  # type: ignore
+
+        return project_root() / state_dir / ".last-verify.json"
+    except Exception as exc:
+        logger.debug("project-root ledger resolution unavailable: %s", exc)
+        return state_dir / ".last-verify.json"
+
+
 def _verify_state() -> tuple[bool, int | None]:
     """Most-recent PASS in .last-verify.json (freshness gate, not a forge wall).
 
@@ -84,9 +100,12 @@ def _verify_state() -> tuple[bool, int | None]:
     it catches the FORGOTTEN run, not a deliberate forge. The real wall is the
     server-side required CI check in pr-mode, not this local marker. (TASK-620)
     """
-    state_dir = os.environ.get("COS_STATE_DIR", ".coding-os")
-    path = Path(state_dir) / ".last-verify.json"
-    if not path.exists():
+    # COS_STATE_DIR is routinely a RELATIVE path, so resolving it against the
+    # gate process's cwd read a different file than the verify runners wrote —
+    # the MCP/board process does not share the agent's working directory. Anchor
+    # it to the project root, the same way every other kernel path is resolved.
+    path = _verify_ledger_path()
+    if path is None or not path.exists():
         return False, None
     try:
         data = json.loads(path.read_text(encoding="utf-8"))

{coding_os-0.3.7 → coding_os-0.3.9}/src/core/rules/model-routing.md

@@ -7,10 +7,10 @@ CLI and desktop sessions receive the same project policy through the once-per-se
 ## The contract
 
 1. **Toggle off (default)** — nothing fires; dispatch behaviour is unchanged.
-2. **Explicit** — dispatch only when the operator or active procedure requests a child run.
-3. **Suggest** — propose the adapter/model/role route and wait for operator approval.
-4. **Adaptive** — after classification, supervise work at or above the configured complexity threshold.
-5. **Dispatch** — explicit request fields override per-role policy, then preset and role defaults. Every parallel role resolves its own adapter.
+2. **Explicit** (default mode) — the configured policy always applies; what is configured is what runs.
+3. **Suggest** — resolve the route and return `status="skipped"` with `proposed_route`, executing nothing. A dry run, not an approval prompt.
+4. **Adaptive** — apply the policy only at or above the configured complexity threshold; pass the gate level to the run tools, or the request stays unclassified and below every gate.
+5. **Dispatch** — explicit request fields override per-role policy, which overrides the project orchestrator default, then preset and role defaults. Every parallel role resolves its own adapter. The capacity breaker is never gated by trigger mode.
 6. **Capacity** — a normalized usage-limit failure pauses only that adapter. The dispatcher uses an eligible fallback only when the failed run is known not to have started; timeout or unknown outcomes are never replayed.
 7. **Recovery** — after cooldown, one half-open probe is allowed. Success restores normal routing; another capacity failure extends cooldown.
 

{coding_os-0.3.7 → coding_os-0.3.9}/src/core/schemas/adapter.schema.json

@@ -251,7 +251,7 @@
     },
     "models": {
       "type": "array",
-      "description": "Chat models this adapter offers, grouped under the adapter in the Hub chat model picker. Empty for roadmap adapters (no fabricated IDs — P7).",
+      "description": "Model catalog this adapter offers — drives the Hub pickers and supervision write-time validation. Empty means either a roadmap adapter or a runtime that forwards any model string; core never fabricates IDs (P7), so an empty catalog accepts any non-empty string and the Hub renders a free-text field.",
       "items": {
         "type": "object",
         "required": ["id"],
@@ -259,7 +259,8 @@
         "properties": {
           "id": {"type": "string", "minLength": 1, "description": "Model identifier passed to the agent runtime."},
           "label": {"type": "string", "description": "Human-facing model name shown in the picker."},
-          "default": {"type": "boolean", "description": "Whether this is the adapter's default model. At most one per adapter."}
+          "default": {"type": "boolean", "description": "Whether this is the adapter's default model. At most one per adapter."},
+          "bucket": {"type": "string", "minLength": 1, "description": "Provider rate-limit pool this model draws from. Models sharing a pool share one capacity cooldown; models in different pools stay independent when one is limited. Absent = the adapter is treated as a single pool."}
         }
       }
     },

{coding_os-0.3.7 → coding_os-0.3.9}/src/core/subsystems.yaml

@@ -152,7 +152,7 @@ modules:
     # The reasoning-assist tool surface: role composition, formula dispatch,
     # supervision, model/skill routing, situation detect. cos_classify_prompt
     # (Record Gate, core loop) + cos_health (diagnostic) stay KERNEL by design.
-    tools: ["cos_dispatch_*", "cos_route_*", cos_compose_chain, cos_supervise, cos_supervise_record_output, cos_role_info, cos_situation_detect, cos_takeover, cos_analyze_task, cos_ambiguity_check, cos_backtrack_log, cos_discovery]
+    tools: ["cos_dispatch_*", "cos_route_*", cos_compose_chain, cos_supervise, cos_supervise_record_output, cos_supervision_config, cos_role_info, cos_situation_detect, cos_takeover, cos_analyze_task, cos_ambiguity_check, cos_backtrack_log, cos_discovery]
     # /compose is the role-chain composition surface; /role-* commands map from
     # thinking_os/agents/ (a separate source) and stay always-on (Rule 22 — not
     # worth the agents/ source-mapping to gate a low-frequency advanced surface).

{coding_os-0.3.7 → coding_os-0.3.9}/src/core/thinking_os/adapter_registry.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import importlib.util
 import logging
+import os
 from dataclasses import dataclass
 from pathlib import Path
 from types import ModuleType
@@ -13,14 +14,16 @@ logger = logging.getLogger("coding_os.adapter_registry")
 
 
 def _resolve_adapters_dir(module_path: Path) -> Path:
+    # COS_CODING_OS_ROOT wins: a consumer project points at the coding-os
+    # checkout that owns src/adapters, which is not a parent of this module.
+    configured = os.environ.get("COS_CODING_OS_ROOT", "").strip()
+    default = module_path.resolve().parents[2] / "adapters"
     candidates = (
-        module_path.resolve().parents[2] / "adapters",
+        *((Path(configured).resolve() / "src" / "adapters",) if configured else ()),
+        default,
         module_path.resolve().parents[1] / "adapters",
     )
-    return next((candidate for candidate in candidates if candidate.is_dir()), candidates[0])
-
-
-ADAPTERS_DIR = _resolve_adapters_dir(Path(__file__))
+    return next((candidate for candidate in candidates if candidate.is_dir()), default)
 
 
 @dataclass(frozen=True)
@@ -51,7 +54,7 @@ class AdapterRecord:
 
 
 def load_adapter_records(adapters_dir: Path | None = None) -> dict[str, AdapterRecord]:
-    root = adapters_dir or ADAPTERS_DIR
+    root = adapters_dir or _resolve_adapters_dir(Path(__file__))
     records: dict[str, AdapterRecord] = {}
     if not root.is_dir():
         return records
@@ -94,10 +97,24 @@ def entrypoint_path(record: AdapterRecord, capability: str) -> Path | None:
     return path if path.is_file() else None
 
 
+_MODULE_CACHE: dict[tuple[str, str], tuple[float, ModuleType]] = {}
+
+
 def load_entrypoint_module(record: AdapterRecord, capability: str) -> ModuleType | None:
     path = entrypoint_path(record, capability)
     if path is None:
         return None
+    # Executing an adapter entrypoint re-imports its provider SDK, which is far
+    # too expensive for a polled Hub route. Keyed on mtime so an edited adapter
+    # still reloads rather than serving a stale module.
+    key = (record.id, capability)
+    try:
+        stamp = path.stat().st_mtime
+    except OSError:
+        stamp = 0.0
+    cached = _MODULE_CACHE.get(key)
+    if cached is not None and cached[0] == stamp:
+        return cached[1]
     module_name = f"coding_os_adapter_{record.id}_{capability}"
     spec = importlib.util.spec_from_file_location(module_name, path)
     if spec is None or spec.loader is None:
@@ -108,4 +125,5 @@ def load_entrypoint_module(record: AdapterRecord, capability: str) -> ModuleType
     except Exception as exc:
         logger.warning("%s %s entrypoint load failed: %s", record.id, capability, exc)
         return None
+    _MODULE_CACHE[key] = (stamp, module)
     return module