phase-loop-runtime 0.7.24__tar.gz → 0.7.25__tar.gz

{phase_loop_runtime-0.7.24/src/phase_loop_runtime.egg-info → phase_loop_runtime-0.7.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.24
+Version: 0.7.25
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -50,7 +50,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.24      # …or pin an exact version
+pip install phase-loop-runtime==0.7.25      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.24      # …or pin an exact version
+pip install phase-loop-runtime==0.7.25      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.24"
+version = "0.7.25"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.24"
+__version__ = "0.7.25"

phase_loop_runtime-0.7.25/src/phase_loop_runtime/_proc_cpu.py

@@ -0,0 +1,57 @@
+"""Linux CPU observations for a process group and its descendants.
+
+Owner wrappers can start a child in another session. Include that child tree
+when sampling the leg. Missing /proc data yields zero; CPU activity alone does
+not establish completion or grant heartbeat-only termination authority.
+"""
+from __future__ import annotations
+
+import os
+
+
+def _pgrp_and_ticks(pid: int) -> tuple[int, int]:
+    """Return ``(process_group_id, utime+stime)`` for ``pid`` from /proc/<pid>/stat.
+
+    The ``comm`` field (2nd) is wrapped in parens and may itself contain spaces or
+    parens, so parse the fixed fields AFTER the last ``)``: from there field 3
+    (state) is index 0, so pgrp (field 5) = index 2, utime (14) = index 11, and
+    stime (15) = index 12.
+    """
+    with open(f"/proc/{pid}/stat", encoding="ascii", errors="replace") as fh:
+        data = fh.read()
+    after = data[data.rfind(")") + 2 :].split()
+    pgrp = int(after[2])
+    return pgrp, int(after[11]) + int(after[12])
+
+
+def group_cpu_ticks(leader_pid: int) -> int:
+    """Sum observed ticks for the group and children, including new sessions."""
+    samples = {}
+    try:
+        entries = os.listdir("/proc")
+    except OSError:
+        return 0
+    for entry in entries:
+        if not entry.isdigit():
+            continue
+        try:
+            with open(f"/proc/{entry}/stat", encoding="ascii", errors="replace") as fh:
+                data = fh.read()
+            fields = data[data.rfind(")") + 2 :].split()
+            samples[int(entry)] = (int(fields[1]), int(fields[2]),
+                                   int(fields[11]) + int(fields[12]))
+        except (OSError, ValueError, IndexError):
+            continue  # process exited mid-scan, or an unreadable/odd stat line
+    members = {pid for pid, (_, group, _) in samples.items() if group == leader_pid}
+    if leader_pid in samples:
+        members.add(leader_pid)
+    children = {}
+    for pid, (parent, _, _) in samples.items():
+        children.setdefault(parent, []).append(pid)
+    pending = list(members)
+    while pending:
+        for child in children.get(pending.pop(), ()):
+            if child not in members:
+                members.add(child)
+                pending.append(child)
+    return sum(samples[pid][2] for pid in members)

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/CONTRACTS.md

@@ -28,8 +28,8 @@ equivalence is proven by a test (not asserted in prose).
   the **agy/gemini leg where effort is embedded in the model-name string**
   (`render_gemini_model`, panel_invoker.py:1016). Built-3 lanes are concrete;
   breadth lanes raise `EffortMappingError` until ABDREG/ABDHOME/ABDOMNI.
-  Round-trip (proven): claude→`--effort max`, codex→
-  `-c model_reasoning_effort=xhigh`, Gemini Flash→`gemini-3.8-flash-high`;
+  Default round-trip (proven): claude→`--effort high`, codex→
+  `-c model_reasoning_effort=high`, Gemini Flash→`gemini-3.8-flash-medium`;
   explicit legacy Pro display names remain compatible.
 - **Seat identity for result re-keying** — `Seat.seat_key` is a stable LABEL over
   every distinguishing field (lane, model, effort, lens), so lens-only-different
@@ -899,8 +899,10 @@ set `gemini_heartbeat.QUALIFIED_IMAGES`: 1.2.11 SHA256
 `ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`, 1.2.14 SHA256
 `0d0d3eba22daf29504dd290151c7ed9a4d33b0c6aa0acfc5da27bc3b01d2f029`, 1.2.15 SHA256
 `5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164`, 1.2.16 SHA256
-`a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86` or 1.2.17 SHA256
-`c54ef90651a8646ae67334d39212c81f5946feec373ad6aa335f9ef401662bc5`. Each member
+`a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86`, 1.2.17 SHA256
+`c54ef90651a8646ae67334d39212c81f5946feec373ad6aa335f9ef401662bc5`, 1.3.0 SHA256
+`19be6af38f7beeaa0db415df9297e314ab3d33fdd6f853434d49f88819bc68e4` or 1.3.1 SHA256
+`ce1bdaed3201bb84f35d69d2773caec4f18af52af00e8c25f6cace07e4359615`. Each member
 carries its measured help digest and has its own qualification record; the
 evidence catalog and the runtime set must name exactly the same members.
 The running Python/kernel must support sealed memfds, pidfds and pidfd signaling;
@@ -1213,7 +1215,8 @@ are recorded on agent-harness#1132.
   - **On a pass:** the seat stays jailed, and its mode reports `qualified_now`.
   - **On a failure, or a run that cannot happen (a cached failure included):** the seat is
     DEGRADED and NOT RUN with `seat_jail_qualification_failed` and a typed reason
-    (`prerequisite_missing`, `store_unsafe`, `falsifiers_failed`, `timeout` or `error`),
+    (`prerequisite_missing`, `store_unsafe`, `uid_switch_denied`, `falsifiers_failed`, `timeout` or
+    `error`),
     each with a literal fix (plan amendment A3b supersedes A2's sealed fallback).
   - **The failure cache:** failures are cached per host, digest and layout for
     `PHASE_LOOP_SEAT_JAIL_QUALIFY_RETRY_S` (default 3600 s). A lock timeout is not cached.
@@ -1328,6 +1331,36 @@ are recorded on agent-harness#1132.
   stage root, opened `O_NOFOLLOW|O_DIRECTORY` component by component, and owned by a
   subordinate uid.
 
+## SEATOWNER — The seat-launch owner (agent-harness#1222)
+
+Every review seat, the president and executor `review` start through one owner,
+`panel_invoker.launch_owned`. A jailed Claude seat (SEATJAIL) launches through its jail
+instead, and the jail is that launch's owner.
+
+- **Credentials, the narrowest each CLI runs with.** No seat receives a refresh token.
+  - **Claude:** the one SEATJAIL decision. That is the bound override, else the login's
+    access token. It is delivered through the drained pipe named by
+    `CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`.
+  - **Gemini and Grok:** an access-token-only copy.
+  - **Codex:** the auth file with its refresh token's value emptied. The key and the id
+    token stay, because the CLI sends no bearer without them (measured).
+  - **Every copy:** it sits in the seat's private home, and its secret values are
+    redacted from the seat's output.
+- **Refusals.** Each owner refusal is a closed detail code and a `seat_jail.NOTICES`
+  entry, with what happened, why and a fix line (`seat_owner_unavailable`,
+  `seat_filtered_egress_unavailable`, `seat_keyring_unavailable`, ...).
+- **The Claude journal.** The host collects the exact session journal through retained
+  handles, after the provider has been cleaned up, and validates it before any approval.
+  - **Refused on both routes:** a new user turn, a max-token continuation, an unmatched
+    `tool_use`, partial JSONL, or a missing final answer.
+  - **A completed tool cycle is accepted:** every `tool_use` has its `tool_result`.
+  - **A journaled `isApiErrorMessage` record** is never an answer or a continuation. The
+    answer parser (agent-harness#1194) decides the turn.
+  - **The route's own answer rule:**
+    - the president requires a terminal turn;
+    - on the review route, a completed answer outlives a later stray error.
+  - **A refusal or cancellation keeps no partial journal on the host.**
+
 ## ABDFALSIFY — Executable review findings (IF-0-EXECFIND-1)
 
 An optional `falsifier` attachment names one `FindingFalsifier` with

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/backing.py

@@ -483,12 +483,15 @@ class ParentUnixBroker:
         ):
             raise ValueError("broker canonical repository authority is not probeable")
         try:
-            listed = subprocess.check_output(
-                ["git", "-C", str(self.canonical_repo), "ls-files", "-z"],
+            from ..review_stage import host_git
+
+            listed = host_git(
+                self.canonical_repo, "ls-files", "-z", check=True,
                 text=True,
+                stdout=subprocess.PIPE,
                 stderr=subprocess.DEVNULL,
                 timeout=3,
-            ).split("\0")
+            ).stdout.split("\0")
             probe_file = next(
                 (
                     self.canonical_repo / relative
@@ -498,7 +501,7 @@ class ParentUnixBroker:
                 ),
                 None,
             )
-        except (OSError, subprocess.SubprocessError):
+        except (OSError, ValueError, subprocess.SubprocessError):
             probe_file = None
         if probe_file is None:
             raise ValueError("broker canonical repository authority is not probeable")
@@ -696,7 +699,7 @@ class ParentUnixBroker:
         runtime_binds: list[str] = ["--ro-bind", "/usr", "/usr"]
         for runtime in ("/lib", "/lib64"):
             if Path(runtime).exists(): runtime_binds.extend(("--ro-bind", runtime, runtime))
-        argv = [str(bwrap),"--unshare-all","--die-with-parent","--new-session","--clearenv",*runtime_binds,"--dir","/run","--ro-bind",str(self.root),"/run/phase-loop-broker","--ro-bind",str(self.staged_dir),"/run/phase-loop-review","--tmpfs","/tmp","--proc","/proc","--dev","/dev","--setenv","PATH","/usr/bin","--setenv","PYTHONNOUSERSITE","1","--setenv","PYTHONDONTWRITEBYTECODE","1",str(python),"-I","-S","-c",code]
+        argv = [str(bwrap),"--unshare-all","--die-with-parent","--new-session","--clearenv",*runtime_binds,"--dir","/run","--dir","/run/phase-loop-broker","--ro-bind",str(self.path),"/run/phase-loop-broker/intended-inference.sock","--ro-bind",str(self.staged_dir),"/run/phase-loop-review","--tmpfs","/tmp","--proc","/proc","--dev","/dev","--setenv","PATH","/usr/bin","--setenv","PYTHONNOUSERSITE","1","--setenv","PYTHONDONTWRITEBYTECODE","1",str(python),"-I","-S","-c",code]
         error: list[BaseException] = []
         child: list[tuple[subprocess.Popen[bytes], int]] = []
         def serve() -> None:
@@ -882,18 +885,18 @@ def _staged_tree_digest(canonical_repo_authority: Path | str | None) -> str | No
     authorization that permits NO staged tree rather than one asserting a digest
     it could not compute.
     """
-    from ..review_stage import review_tree_manifest_sha256
+    from ..review_stage import host_git, review_tree_manifest_sha256
 
     # Normalize to the SAME git toplevel `_canonical_review_repo_authority` resolves
     # at spawn. Digesting an unnormalized path would bind a different tree than the
     # one actually staged, and the mismatch would only surface as a refusal at launch.
     candidate = Path(canonical_repo_authority) if canonical_repo_authority is not None else Path.cwd()
     try:
-        root = subprocess.check_output(
-            ["git", "-C", str(candidate), "rev-parse", "--show-toplevel"],
-            text=True, stderr=subprocess.DEVNULL, timeout=3,
-        ).strip()
-    except (OSError, subprocess.SubprocessError):
+        root = host_git(
+            candidate, "rev-parse", "--show-toplevel", check=True,
+            text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=3,
+        ).stdout.strip()
+    except (OSError, ValueError, subprocess.SubprocessError):
         return None
     if not root:
         return None
@@ -912,16 +915,18 @@ def _staged_tree_digest(canonical_repo_authority: Path | str | None) -> str | No
 
 
 def _canonical_repo_digest(canonical_repo_authority: Path | str | None) -> str:
+    from ..review_stage import host_git
+
     candidate = Path(canonical_repo_authority) if canonical_repo_authority is not None else Path.cwd()
     try:
-        root = subprocess.check_output(
-            ["git", "-C", str(candidate), "rev-parse", "--show-toplevel"],
+        root = host_git(
+            candidate, "rev-parse", "--show-toplevel", check=True,
             text=True,
+            stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL,
             timeout=3,
-            env={key: value for key, value in os.environ.items() if not key.startswith("GIT_")},
-        ).strip()
-    except (OSError, subprocess.SubprocessError):
+        ).stdout.strip()
+    except (OSError, ValueError, subprocess.SubprocessError):
         raise ValueError("HARDEN review has no canonical repository authority") from None
     if not root:
         raise ValueError("HARDEN review has no canonical repository authority")

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/composition.py

@@ -88,13 +88,13 @@ def _uses_production_composition_probe(
     )
 
 # Ideal per-vendor seat, in deterministic composition order. Each vendor runs at
-# its MAX thinking (gemini's ceiling is ``high``) with a distinct primary lens.
+# the panel default effort with a distinct primary lens.
 _VENDOR_ORDER: tuple[str, ...] = ("grok", "claude", "codex", "gemini")
 _VENDOR_SEAT: dict[str, dict[str, str]] = {
-    "grok": {"model": "grok-4.7", "harness": "grok", "effort": "max", "lens": "adversarial"},
-    "claude": {"model": "claude-opus-5-5", "harness": "claude", "effort": "max", "lens": "correctness"},
-    "codex": {"model": "gpt-6-astra", "harness": "codex", "effort": "max", "lens": "red-team"},
-    "gemini": {"model": "gemini-3.8-flash", "harness": "gemini", "effort": "high", "lens": "alternative-approach"},
+    "grok": {"model": "grok-4.7", "harness": "grok", "effort": "high", "lens": "adversarial"},
+    "claude": {"model": "claude-opus-5-5", "harness": "claude", "effort": "high", "lens": "correctness"},
+    "codex": {"model": "gpt-6-astra", "harness": "codex", "effort": "high", "lens": "red-team"},
+    "gemini": {"model": "gemini-3.8-flash", "harness": "gemini", "effort": "medium", "lens": "alternative-approach"},
 }
 
 # Distinct lenses the backfill cycles through (each vendor's primary lens is drawn

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/config.py

@@ -31,6 +31,7 @@ from collections.abc import Mapping
 from dataclasses import dataclass
 from pathlib import Path
 import re
+import subprocess
 from typing import Any, Callable
 
 try:  # Python 3.11+
@@ -311,6 +312,7 @@ def load_president_ladder(
     *,
     env: Mapping[str, str] | None = None,
     path: Path | None = None,
+    review_base: bool = False,
 ) -> tuple[str, ...]:
     """The effective president fallback order, first rung first.
 
@@ -331,7 +333,22 @@ def load_president_ladder(
         ladder = _parse_president(user, str(user_path)) or ladder
     if repo_dir is not None:
         repo_path = repo_board_config_path(repo_dir)
-        repo = _load_toml(repo_path)
+        if review_base:
+            from ..review_stage import trusted_review_control
+
+            try:
+                content = trusted_review_control(Path(repo_dir), REPO_CONFIG_RELATIVE_PATH)
+                repo = tomllib.loads(content.decode("utf-8")) if content is not None else None
+            except ValueError as exc:
+                if str(exc) != "review_base_unavailable":
+                    raise BoardConfigError(f"{repo_path} has no readable base configuration") from exc
+                # No main commit to read it from: the candidate's own copy is never trusted,
+                # so the repository layer is not in force (the user and built-in ladders are).
+                repo = None
+            except (OSError, UnicodeError, subprocess.SubprocessError) as exc:
+                raise BoardConfigError(f"{repo_path} has no readable base configuration") from exc
+        else:
+            repo = _load_toml(repo_path)
         if repo is not None:
             _reject_unknown(repo.keys(), _KNOWN_REPO_TOP_KEYS, str(repo_path))
             ladder = _parse_president(repo, str(repo_path)) or ladder

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/fixtures/advisor-boards.example.toml

@@ -18,8 +18,8 @@ default_board = "default"
 # [agy]
 # self_qualification = false
 
-# The default board reproduces today's 3-leg panel (byte-for-byte back-compat).
-# Its three seats, in panel-leg order, render to today's exact CLI invocations:
+# This explicit example overrides the built-in default board, keeping higher effort.
+# Its three seats, in panel-leg order, render to these CLI invocations:
 #   codex  gpt-6-astra          effort=max  -> -c model_reasoning_effort=xhigh
 #   gemini "Gemini 3.1 Pro" effort=high -> model "Gemini 3.1 Pro (High)"
 #   claude claude-sonnet-5  effort=max  -> --effort max

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/fixtures.py

@@ -27,23 +27,23 @@ DEFAULT_BOARD_VENDOR_ORDER: tuple[str, ...] = ("codex", "gemini", "claude", "gro
 # The default board's four seats — model-first, effort split out of the model
 # name. These reconstruct ``DEFAULT_LEG_MODELS`` under
 # ``harness_mapping.render_seat_invocation``:
-#   codex  gpt-6-astra           + effort max  -> ``-c model_reasoning_effort=xhigh``
-#   gemini gemini-3.8-flash   + effort high -> model ``gemini-3.8-flash-high``
-#   claude claude-opus-5-5   + effort max  -> ``--effort max``
-#   grok   grok-4.7           + effort max  -> ``--reasoning-effort xhigh``
+#   codex  gpt-6-astra           + effort high  -> ``-c model_reasoning_effort=high``
+#   gemini gemini-3.8-flash   + effort medium -> model ``gemini-3.8-flash-medium``
+#   claude claude-opus-5-5   + effort high  -> ``--effort high``
+#   grok   grok-4.7           + effort high  -> ``--reasoning-effort high``
 #
 # The claude seat runs Opus 5.5 (``claude-opus-5-5``), the maintainer's review default
 # "for now" (2026-09-23; Fable ``claude-fable-5-1`` before that), not the implementer
 # model ``claude-sonnet-5``. It keeps the review-policy seat NAME ``fable``. This is
 # byte-pinned to ``panel_invoker.DEFAULT_LEG_MODELS["claude"]`` by the golden proof.
 DEFAULT_SEATS: tuple[Seat, ...] = (
-    Seat(model="gpt-6-astra", effort="max", harness="codex", lens="red-team",
+    Seat(model="gpt-6-astra", effort="high", harness="codex", lens="red-team",
          auth=AUTH_SUBSCRIPTION, backing=BACKING_HOMEBREW),
-    Seat(model="gemini-3.8-flash", effort="high", harness="gemini", lens="alternative-approach",
+    Seat(model="gemini-3.8-flash", effort="medium", harness="gemini", lens="alternative-approach",
          auth=AUTH_SUBSCRIPTION, backing=BACKING_HOMEBREW),
-    Seat(model="claude-opus-5-5", effort="max", harness="claude", lens="correctness",
+    Seat(model="claude-opus-5-5", effort="high", harness="claude", lens="correctness",
          auth=AUTH_SUBSCRIPTION, backing=BACKING_HOMEBREW),
-    Seat(model="grok-4.7", effort="max", harness="grok", lens="adversarial",
+    Seat(model="grok-4.7", effort="high", harness="grok", lens="adversarial",
          auth=AUTH_SUBSCRIPTION, backing=BACKING_HOMEBREW),
 )
 
@@ -58,15 +58,15 @@ DEFAULT_BOARD: Board = Board(
 # back-compat test against the live ``panel_invoker`` constants).
 DEFAULT_SEAT_RENDERED_MODEL: dict[str, str] = {
     "codex": "gpt-6-astra",
-    "gemini": "gemini-3.8-flash-high",
+    "gemini": "gemini-3.8-flash-medium",
     "claude": "claude-opus-5-5",
     "grok": "grok-4.7",
 }
 DEFAULT_SEAT_EFFORT_ARGS: dict[str, tuple[str, ...]] = {
-    "codex": ("-c", "model_reasoning_effort=xhigh"),
+    "codex": ("-c", "model_reasoning_effort=high"),
     "gemini": (),
-    "claude": ("--effort", "max"),
-    "grok": ("--reasoning-effort", "xhigh"),
+    "claude": ("--effort", "high"),
+    "grok": ("--reasoning-effort", "high"),
 }
 
 # Canonical (model x harness) pairs ABDREG's matrix + ABDRESOLVE's validation test

{phase_loop_runtime-0.7.24 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/presets.py

@@ -7,7 +7,7 @@ Nine built-in presets, each a named, purpose-tagged, open-ended seat list:
                     board defines the canonical four-vendor review seats (the claude seat
                     on Opus 5.5, ``claude-opus-5-5``).
 * ``code-review`` — the 4-vendor cross-vendor board (grok / claude / codex /
-                    gemini) at max thinking, distinct lenses, composed
+                    gemini) at default effort, distinct lenses, composed
                     availability-aware (``composition.compose_review_board``).
 * ``brainstorm``  — multi-vendor divergent thinking, lens-differentiated.
 * ``doc-edit``    — a lighter documentation-editing board.
@@ -39,8 +39,8 @@ from .composition import compose_review_board
 from .fixtures import DEFAULT_BOARD
 from .schema import Board, Seat
 
-# code-review: review-class = the 4-vendor cross-vendor board, each vendor at MAX
-# thinking with a DISTINCT lens (grok=adversarial, claude=correctness,
+# code-review: review-class = the 4-vendor cross-vendor board, each vendor at default
+# effort with a DISTINCT lens (grok=adversarial, claude=correctness,
 # codex=red-team, gemini=alternative-approach). This is the IDEAL (all-vendors-up)
 # shape; the live panel composes it AVAILABILITY-AWARE via
 # ``composition.compose_review_board`` — down vendors are backfilled with distinct
@@ -57,9 +57,9 @@ BRAINSTORM_BOARD: Board = Board(
     name="brainstorm",
     purpose="brainstorm",
     seats=(
-        Seat(model="claude-sonnet-5", effort="high", harness="claude", lens="adversarial"),
-        Seat(model="gpt-6-astra", effort="high", harness="codex", lens="supportive"),
-        Seat(model="gemini-3.8-flash", effort="high", harness="gemini", lens="lateral"),
+        Seat(model="claude-sonnet-5", effort="medium", harness="claude", lens="adversarial"),
+        Seat(model="gpt-6-astra", effort="medium", harness="codex", lens="supportive"),
+        Seat(model="gemini-3.8-flash", effort="medium", harness="gemini", lens="lateral"),
     ),
 )
 
@@ -68,8 +68,8 @@ DOC_EDIT_BOARD: Board = Board(
     name="doc-edit",
     purpose="doc-edit",
     seats=(
-        Seat(model="claude-sonnet-5", effort="medium", harness="claude", lens="copyedit"),
-        Seat(model="gpt-6-astra", effort="medium", harness="codex", lens="structure"),
+        Seat(model="claude-sonnet-5", effort="low", harness="claude", lens="copyedit"),
+        Seat(model="gpt-6-astra", effort="low", harness="codex", lens="structure"),
     ),
 )
 
@@ -87,9 +87,9 @@ LEGAL_REVIEW_BOARD: Board = Board(
     name="legal-review",
     purpose="legal-review",
     seats=(
-        Seat(model="gpt-6-astra", effort="max", harness="codex", lens="opposing-counsel"),
-        Seat(model="gemini-3.8-flash", effort="high", harness="gemini", lens="risk-liability"),
-        Seat(model="claude-opus-5-5", effort="max", harness="claude", lens="authority-verification"),
+        Seat(model="gpt-6-astra", effort="high", harness="codex", lens="opposing-counsel"),
+        Seat(model="gemini-3.8-flash", effort="medium", harness="gemini", lens="risk-liability"),
+        Seat(model="claude-opus-5-5", effort="high", harness="claude", lens="authority-verification"),
     ),
 )
 
@@ -99,9 +99,9 @@ LEGAL_STRATEGY_REVIEW_BOARD: Board = Board(
     name="legal-strategy-review",
     purpose="legal-strategy-review",
     seats=(
-        Seat(model="gpt-6-astra", effort="max", harness="codex", lens="red-team"),
-        Seat(model="gemini-3.8-flash", effort="high", harness="gemini", lens="alternatives"),
-        Seat(model="claude-opus-5-5", effort="max", harness="claude", lens="downside-ethics"),
+        Seat(model="gpt-6-astra", effort="high", harness="codex", lens="red-team"),
+        Seat(model="gemini-3.8-flash", effort="medium", harness="gemini", lens="alternatives"),
+        Seat(model="claude-opus-5-5", effort="high", harness="claude", lens="downside-ethics"),
     ),
 )
 
@@ -111,9 +111,9 @@ LEGAL_BRAINSTORM_BOARD: Board = Board(
     name="legal-brainstorm",
     purpose="legal-brainstorm",
     seats=(
-        Seat(model="claude-sonnet-5", effort="high", harness="claude", lens="aggressive"),
-        Seat(model="gpt-6-astra", effort="high", harness="codex", lens="conservative"),
-        Seat(model="gemini-3.8-flash", effort="high", harness="gemini", lens="creative"),
+        Seat(model="claude-sonnet-5", effort="medium", harness="claude", lens="aggressive"),
+        Seat(model="gpt-6-astra", effort="medium", harness="codex", lens="conservative"),
+        Seat(model="gemini-3.8-flash", effort="medium", harness="gemini", lens="creative"),
     ),
 )
 
@@ -131,9 +131,9 @@ GENERAL_BOARD: Board = Board(
     name="general",
     purpose="general",
     seats=(
-        Seat(model="gpt-6-astra", effort="max", harness="codex", lens="adversarial"),
-        Seat(model="gemini-3.8-flash", effort="high", harness="gemini", lens="alternative"),
-        Seat(model="claude-opus-5-5", effort="max", harness="claude", lens="completeness"),
+        Seat(model="gpt-6-astra", effort="high", harness="codex", lens="adversarial"),
+        Seat(model="gemini-3.8-flash", effort="medium", harness="gemini", lens="alternative"),
+        Seat(model="claude-opus-5-5", effort="high", harness="claude", lens="completeness"),
     ),
 )
 
@@ -143,7 +143,7 @@ SOLO_BOARD: Board = Board(
     name="solo",
     purpose="general",
     seats=(
-        Seat(model="claude-opus-5-5", effort="max", harness="claude", lens="completeness"),
+        Seat(model="claude-opus-5-5", effort="high", harness="claude", lens="completeness"),
     ),
 )
 

phase_loop_runtime-0.7.25/src/phase_loop_runtime/agent_view_cleanup.py

@@ -0,0 +1,97 @@
+"""Stop a finished Claude Agent View background session once its closeout is verified.
+
+A `claude --bg` session that reaches `done` is not stopped by Claude Code: its Remote Control
+(bridge) session stays open in the app until `claude stop <id>`, and only that clean shutdown
+archives it. The phase-loop launch route waits for `done` and reads the final message but never
+stopped the session, so every finished executor run stayed in the app's session panel until it
+was archived by hand. Measured on Ubuntu 26.04 (Claude Code 2.1.289): the session reached `done`
+with no archive; `claude stop <id>` logged `Archive ... status=200` and kept the conversation.
+
+The rule (maintainer, 2026-10-06): never archive before the harness has verified that the
+session produced its required output. The verifier is the closeout's schema verification with
+the required data: the BAML parse plus the `PhaseLoopCloseoutV1` validators, which the runner
+reports as a `native_closeout_payload` and nothing else produces. A session whose closeout is
+missing, malformed, or not evaluated (a BAML worker outage) is left running and visible so it can
+be inspected. `stop` keeps the conversation (`claude attach <id>` and `--resume` still work);
+`remove` is never used.
+
+Never raises: cleanup is a tidy-up and must not change a run's outcome.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+from pathlib import Path
+from typing import Any, Mapping
+
+from .claude_agent_view import ClaudeAgentViewAdapter
+
+#: Set to a true value to leave finished sessions running (for debugging a run in the app).
+KEEP_ENV = "PHASE_LOOP_KEEP_AGENT_VIEW_SESSIONS"
+_LOG = logging.getLogger(__name__)
+_SESSION_ID = re.compile(r"[0-9A-Za-z][0-9A-Za-z._-]{2,63}")
+_PLACEHOLDER_IDS = frozenset({"preflight", "unknown", "none"})
+_TRUE = frozenset({"1", "true", "yes", "on"})
+
+
+def verified_session_id(result: Any, child_automation: Mapping[str, Any] | None) -> tuple[str | None, str]:
+    """``(session_id, reason)``: the id to stop, or ``None`` and the reason it is not eligible.
+
+    Eligible only when the launch was an Agent View route that finished ``done`` AND the
+    closeout it produced passed schema verification with the required data."""
+    if getattr(result, "dry_run", False):
+        return None, "dry_run"
+    if getattr(result, "claude_route", None) != "claude_agent_view":
+        return None, "not_agent_view"
+    route = getattr(result, "claude_route_result", None)
+    if not isinstance(route, dict):
+        return None, "no_route_result"
+    if route.get("status") != "done":
+        return None, "route_not_done"
+    session_id = route.get("session_id")
+    if not isinstance(session_id, str) or session_id in _PLACEHOLDER_IDS or not _SESSION_ID.fullmatch(session_id):
+        return None, "no_session_id"
+    lifecycles = [a for a in route.get("artifacts") or ()
+                  if isinstance(a, dict) and a.get("kind") == "claude_agent_view_lifecycle"]
+    if not lifecycles or lifecycles[0].get("state") != "done" or lifecycles[0].get("session_id") != session_id:
+        return None, "lifecycle_not_done"
+    automation = child_automation or {}
+    if automation.get("baml_worker_outage"):
+        return None, "closeout_not_evaluated"
+    if automation.get("automation_parse_error") or automation.get("native_closeout_extraction_failure"):
+        return None, "closeout_not_verified"
+    payload = automation.get("native_closeout_payload")
+    if not isinstance(payload, dict) or not payload:
+        return None, "closeout_not_verified"
+    return session_id, "verified"
+
+
+def stop_verified_session(
+    result: Any,
+    child_automation: Mapping[str, Any] | None,
+    *,
+    cwd: str | Path | None = None,
+    adapter: ClaudeAgentViewAdapter | None = None,
+    environ: Mapping[str, str] | None = None,
+) -> dict[str, object]:
+    """Stop the launch's Agent View session if (and only if) its closeout was verified.
+
+    Returns ``{"session_id", "action", "reason"}``; ``action`` is ``stopped``, ``kept`` or
+    ``stop_failed``. Never raises."""
+    try:
+        session_id, reason = verified_session_id(result, child_automation)
+        if session_id is None:
+            return {"session_id": None, "action": "kept", "reason": reason}
+        env = os.environ if environ is None else environ
+        if str(env.get(KEEP_ENV, "")).strip().lower() in _TRUE:
+            return {"session_id": session_id, "action": "kept", "reason": "kept_by_environment"}
+        stopped = (adapter if adapter is not None else ClaudeAgentViewAdapter()).stop(session_id, cwd=cwd)
+        if getattr(stopped, "stop_result", None) != "stopped":
+            _LOG.warning("agent-view session %s verified but `claude stop` did not stop it", session_id)
+            return {"session_id": session_id, "action": "stop_failed", "reason": "stop_command_failed"}
+        return {"session_id": session_id, "action": "stopped", "reason": "verified"}
+    except Exception as exc:  # cleanup never changes a run's outcome
+        _LOG.warning("agent-view session cleanup failed (%s)", type(exc).__name__)
+        return {"session_id": None, "action": "stop_failed", "reason": type(exc).__name__}