Pareto crewing: the crew picker, the Model Pool with its judge and relay, and the paper

.github/workflows/pool-mirror.yml

@@ -0,0 +1,95 @@
+name: Model Pool mirror
+
+# Mirrors the relay's signed index document onto the `model-pool` orphan data
+# branch, under pool/index.json and pool/index.json.sig, so it can be served
+# and linked from GitHub. The branch holds the signed document and its
+# signature, and nothing derived from them — no count, no leaderboard, no
+# extracted statistic.
+on:
+  schedule:
+    # Every six hours.
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: pool-mirror
+  cancel-in-progress: false
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      # Gets relay/verify.mjs, the only thing this workflow needs from the tree.
+      - uses: actions/checkout@v4
+
+      # -fsS: fail the job on any non-200, print an error on any other failure.
+      - name: Fetch the signed document and its signature
+        run: |
+          set -euo pipefail
+          curl -fsS -o index.json https://codeaf.agentfield.ai/pool/index.json
+          curl -fsS -o index.json.sig https://codeaf.agentfield.ai/pool/index.json.sig
+
+      # The value is the public key copied from relay/wrangler.toml, and it is a
+      # literal: no secret is needed to verify a signature. A bad signature or
+      # any non-2xx fetch fails the job before anything is published.
+      - name: Verify the signature
+        env:
+          POOL_PUBLIC_KEY: WOAo+g/oKxAV9vVqv2Q14w1TyyyiouwFO2fC0zgcps0=
+        run: node relay/verify.mjs index.json index.json.sig "$POOL_PUBLIC_KEY"
+
+      - name: Mirror onto the model-pool branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          mkdir -p mirror
+          cd mirror
+          git init -q
+          git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          # The data branch shares no history with the tree; adopt it when it
+          # exists and start an orphan when this is the first run.
+          if git fetch -q origin model-pool; then
+            git checkout -q -B model-pool FETCH_HEAD
+          else
+            git checkout -q --orphan model-pool
+          fi
+
+          mkdir -p pool
+          if [ ! -f pool/README.md ]; then
+            cat > pool/README.md <<'EOF'
+          # model-pool
+
+          This orphan branch holds the Model Pool's published index document and
+          its detached signature, and nothing derived from them.
+
+          - `pool/index.json` — the signed index document.
+          - `pool/index.json.sig` — the detached Ed25519 signature (standard
+            base64) over the exact bytes of `pool/index.json`.
+
+          Both files are copies of what the relay serves; there is no count, no
+          leaderboard and no extracted statistic here. Verify them with:
+
+          ```
+          node relay/verify.mjs pool/index.json pool/index.json.sig <public-key-base64>
+          ```
+          EOF
+          fi
+
+          cp ../index.json pool/index.json
+          cp ../index.json.sig pool/index.json.sig
+
+          git add -A
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "No change; nothing to publish."
+            exit 0
+          fi
+
+          version=$(node -e "process.stdout.write(String(JSON.parse(require('fs').readFileSync('../index.json', 'utf8')).version))")
+          git commit -q -m "pool: index version ${version}"
+          git push -q origin model-pool

README.md

@@ -195,6 +195,22 @@ request goes to the provider that has been fastest for that kind of call.
 Providers built in: OpenRouter, DeepSeek, GLM, Kimi, MiniMax, Qwen, Ollama and
 any OpenAI-compatible endpoint.
 
+## Model Pool
+
+The picker can choose models from what other installs have found. It is on by
+default: what an install sends is computed, text-free numbers about the models
+it ran (role, model, a number, which model judged, door, size bucket, day) under
+a per-install nonce, never code,
+prompts, paths or an identity, and `codeaf pool status` shows exactly what is
+waiting to go. Turn it off with `model_pool = off` on the settings sheet or
+`CODEAF_MODEL_POOL=off`; `read` uses the pool and sends nothing. The relay
+publishes a signed index the crew picker reads under `picked from = learn`. The index is mirrored on the `model-pool` branch at
+`pool/index.json`. The design is [Pareto Crewing](docs/design/model-pool/pareto-crewing.pdf);
+the relay's code is under `relay/`, with a [runbook](docs/design/model-pool/RUNBOOK.md)
+that includes running your own.
+
+[![pool updated](https://img.shields.io/github/last-commit/Agent-Field/CodeAF/model-pool?label=pool%20updated)](https://github.com/Agent-Field/CodeAF/tree/model-pool)
+
 ## Standing orders
 
 Rules, reminders and watches are one thing, and you set them up by saying them.

cmd/codeaf/chat.go

@@ -166,6 +166,15 @@ func buildBrain(w *chatWindow, session string, opts brainOptions) (*chatBrain, e
 		// then let the machine form print underneath, which said one fact twice.
 		return nil, err
 	}
+	// A tier row that says auto is answered from this catalog (config.AutoModels),
+	// so the word is wired BEFORE the seats handed in are applied — a door whose
+	// ladder answered the word before this line resolved it from nothing. The
+	// read is the same non-blocking one, never a fetch.
+	modelCatalog := catalog.LoadLazy(context.Background(), catalog.Options{
+		BaseURL: settings.BaseURL, APIKey: settings.APIKey, Dir: settings.ProfileDir,
+	})
+	config.AutoModels = modelCatalog.ModelsNow
+	wirePoolIndex(settings.ProfileDir)
 	if opts.seats != nil {
 		applySeats(&settings, *opts.seats)
 	} else {
@@ -180,9 +189,6 @@ func buildBrain(w *chatWindow, session string, opts brainOptions) (*chatBrain, e
 	// to a tool the user has not been able to reach yet — the surface has not
 	// been drawn. Asking it in front of the first frame buys nothing and can
 	// cost fifteen seconds of dead terminal.
-	modelCatalog := catalog.LoadLazy(context.Background(), catalog.Options{
-		BaseURL: settings.BaseURL, APIKey: settings.APIKey, Dir: settings.ProfileDir,
-	})
 	// Every client built below shapes its requests against these rows: which
 	// knobs a model accepts is the catalog's answer, not a guess.
 	settings.Models = modelCatalog
@@ -545,9 +551,14 @@ func buildBrain(w *chatWindow, session string, opts brainOptions) (*chatBrain, e
 			fanIn = store.DependencyFanIn{}
 		}
 		// Ordinary leaves retain the byte-identical headless envelope, raised by
-		// exactly what their own fan-in measures — see gatheringGrant. Reflexes use
-		// the deliberately tiny rung budget and a seconds-scale watchdog.
+		// exactly what their own fan-in measures — see gatheringGrant. A leaf
+		// re-dispatched after running out is granted more than the attempt that
+		// ran out, or it would buy the same truncated ending again — see
+		// regrantAfterRunningOut; the wall below follows the larger grant because
+		// it is arithmetic over the same number. Reflexes use the deliberately
+		// tiny rung budget and a seconds-scale watchdog.
 		turns, tokens := gatheringGrant(chatLeafTurns, chatLeafTokens, fanIn)
+		tokens = regrantAfterRunningOut(tokens, int(node.Attempt))
 		leafRoom := exec.SubharnessFor(subharness)
 		wallLeft := remainingWall(ctx)
 		deadline := leafRoom.DeadlineWithin(tokens, wallLeft)

cmd/codeaf/chatv3.go

@@ -897,6 +897,15 @@ func openV3Launch(proc *v3Process, opts v3Options) (*v3Launch, error) {
 		media = v3ImageGen(mediaSettings)
 	}
 
+	// The Model Pool's judge reads every landing through the engine's one hook.
+	// It is built here, where the seats above are wired, so the answer to
+	// "may this process read the pool at all" is one posture for the whole
+	// door: a mode that forbids reading builds no hook, and a nil hook is the
+	// engine's own nothing. The ask is built once and a client is made from it
+	// per call, each billed to the judge's own seat.
+	taskLanded := poolJudgeHook(settings, settings.ProfileDir, workspace,
+		config.AutoModels, poolJudgeAsk(settings, settings.ProfileDir), time.Now)
+
 	cfg := session.Config{
 		Workspace:      workspace,
 		Model:          chosen,
@@ -905,6 +914,7 @@ func openV3Launch(proc *v3Process, opts v3Options) (*v3Launch, error) {
 		Sources:        settings.Sources,
 		CompactEnabled: !opts.NoCompact,
 		SessionFile:    transcript,
+		TaskLanded:     taskLanded,
 		// The folder this conversation keeps everything in (Decision 26). It is
 		// the zero Place for a launch opened on a flat legacy transcript, which
 		// is what keeps that session deriving its sidecars the way it always did.

cmd/codeaf/chatv3_crew_test.go

@@ -122,7 +122,7 @@ func TestABrokenRowLeavesTheLastGoodCrewInPlace(t *testing.T) {
 		t.Fatal(err)
 	}
 	want, _ := config.CrewModels(config.CrewMax)
-	if model, _ := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation"); model != "moonshotai/kimi-k3" {
+	if model, _ := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation"); model != want[config.ModelTierMastermind] {
 		t.Fatalf("after the row parsed again the planner resolves to %q, want the max crew's %q",
 			model, want[config.ModelTierMastermind])
 	}

cmd/codeaf/chatv3_host.go

@@ -614,6 +614,12 @@ func hostOptions(fleet *engineFleet, welcome remote.Welcome, pick bool) (tui3.Op
 	}
 	discovery := catalog.Options{BaseURL: settings.BaseURL, APIKey: settings.APIKey, Dir: profileDir}
 	models := catalog.LoadLazy(context.Background(), discovery)
+	// A tier row that says auto is answered from this catalog (config.AutoModels):
+	// the same non-blocking read, never a fetch, and set once at start-up.
+	config.AutoModels = models.ModelsNow
+	// The pool's index is seated beside it, read once here and refreshed in the
+	// background, against the same profile the catalog was read from.
+	wirePoolIndex(profileDir)
 	// The refresh key in /model asks the same router THIS machine's list came
 	// from, and refills the same shelf — the list is this laptop's list of
 	// names on both doors (chatv3_modelshelf.go).

cmd/codeaf/chatv3_process.go

@@ -177,6 +177,10 @@ func openV3ProcessWith(door string, askKey bool) (*v3Process, error) {
 		BaseURL: settings.BaseURL, APIKey: settings.APIKey, Dir: settings.ProfileDir,
 	}
 	models := catalog.LoadLazy(context.Background(), discovery)
+	// A tier row that says auto is answered from this catalog (config.AutoModels):
+	// the same non-blocking read, never a fetch, and set once at start-up.
+	config.AutoModels = models.ModelsNow
+	wirePoolIndex(settings.ProfileDir)
 	shelf := newV3ModelShelf(models, discovery)
 	shelf.setSources(settings.Sources)
 	return &v3Process{

cmd/codeaf/context_budget_test.go

@@ -208,3 +208,60 @@ func TestAFoldsGrantIsSizedForThePassItActuallyMakes(t *testing.T) {
 		t.Fatalf("an unsized window granted %d tokens, want the process-wide %d", unknown, want)
 	}
 }
+
+// A RE-DISPATCH IS GRANTED MORE ROOM THAN THE ATTEMPT THAT RAN OUT, or the
+// identical budget buys the identical truncated ending. The runner's overrun
+// settle releases a leaf that ran out back to pending with its banked turns,
+// and while the grant was attempt-blind the next claim re-entered the same
+// brief under the same meter and stopped at the same place — one truncation,
+// paid for as many times as the round cap allowed.
+func TestARedispatchIsGrantedMoreRoomThanTheAttemptThatRanOut(t *testing.T) {
+	// Attempt zero keeps the grant byte for byte: a leaf on its first claim
+	// has run out of nothing yet.
+	if room := regrantAfterRunningOut(chatLeafTokens, 0); room != chatLeafTokens {
+		t.Fatalf("a first claim was granted %d tokens, want the flat %d it has always had",
+			room, chatLeafTokens)
+	}
+
+	// Half again per re-dispatch, compounding, and strictly more room each
+	// time — the growth is the whole point of sending a node round again.
+	previous := chatLeafTokens
+	for attempt := 1; attempt <= 3; attempt++ {
+		room := regrantAfterRunningOut(chatLeafTokens, attempt)
+		if room <= previous {
+			t.Fatalf("re-dispatch %d was granted %d tokens, no more than the %d before it",
+				attempt, room, previous)
+		}
+		previous = room
+	}
+	// The exact arithmetic, in the integers the grant is stated in: three
+	// halves, applied per attempt, never rounded up by a shortcut.
+	if got, want := regrantAfterRunningOut(chatLeafTokens, 2), chatLeafTokens*3/2*3/2; got != want {
+		t.Fatalf("attempt 2 was granted %d tokens, want the twice-grown %d", got, want)
+	}
+
+	// The ceiling holds at attempts no run can reach, and the ladder stops
+	// there rather than stepping over it.
+	for _, attempt := range []int{10, 100} {
+		if room := regrantAfterRunningOut(chatLeafTokens, attempt); room != overrunGrantCeiling {
+			t.Fatalf("attempt %d was granted %d tokens, want the ceiling %d",
+				attempt, room, overrunGrantCeiling)
+		}
+	}
+
+	// A leaf whose fan-in already measured more than the ceiling keeps every
+	// token it measured. The bound is on what the ladder adds, and a
+	// re-dispatch handed less room than its first attempt would be the
+	// identical-budget defect back by another door.
+	_, measured := gatheringGrant(chatLeafTurns, chatLeafTokens,
+		store.DependencyFanIn{Count: 8, Bytes: 8 << 20})
+	if measured <= overrunGrantCeiling {
+		t.Fatalf("the wide join measured %d tokens, too small to ask the question", measured)
+	}
+	for _, attempt := range []int{1, 3, 100} {
+		if room := regrantAfterRunningOut(measured, attempt); room != measured {
+			t.Fatalf("a join measured at %d tokens was re-dispatched at %d on attempt %d",
+				measured, room, attempt)
+		}
+	}
+}

cmd/codeaf/coredone_test.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/store"
+)
+
+// THE ENVELOPE SAYS WHEN THE REQUESTED WORK WAS FIRST FOUND DONE, in seconds
+// from the run's start, off the journal's own gate event — and leaves the key
+// out when no gate ever said so, because a fabricated instant is worse than an
+// absent one.
+func TestTheEnvelopeSaysWhenTheRequestedWorkWasDone(t *testing.T) {
+	graph, err := store.Open(filepath.Join(t.TempDir(), "coredone.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer graph.Close()
+
+	const gated, ungated = "session-gated", "session-ungated"
+	spliceForErrand(t, graph, gated, []store.NodeSpec{{ID: "task-1", Brief: "add the flag"}})
+	spliceForErrand(t, graph, ungated, []store.NodeSpec{{ID: "task-2", Brief: "add the other flag"}})
+	if err := graph.RecordDeliveryGate("task-1", store.DeliveryGate{Pass: true}); err != nil {
+		t.Fatal(err)
+	}
+	_, at, ok, err := graph.DeliveryGateAnchor("task-1")
+	if err != nil || !ok {
+		t.Fatalf("the passing gate has no anchor: ok=%t err=%v", ok, err)
+	}
+	started := at.Add(-7 * time.Second)
+
+	gatedOutcome := headlessOutcome{started: started}
+	priceErrand(graph, gated, 0, &gatedOutcome)
+	fields := envelopeFields(t, errandEnvelope(gatedOutcome))
+	got, present := fields["core_done_seconds"]
+	if !present {
+		t.Fatal("a gate found the work done and the envelope says nothing about when")
+	}
+	if seconds, ok := got.(float64); !ok || seconds < 6.9 || seconds > 7.1 {
+		t.Fatalf("core_done_seconds = %v, want about 7", got)
+	}
+
+	// And absent when no gate ever said the work was done.
+	ungatedOutcome := headlessOutcome{started: started}
+	priceErrand(graph, ungated, 0, &ungatedOutcome)
+	if _, present := envelopeFields(t, errandEnvelope(ungatedOutcome))["core_done_seconds"]; present {
+		t.Fatal("a run whose gate never found the work done reported when it was")
+	}
+}