feat: timeout salvage, quick tier sizing, observability denominators (0.0.42)

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
     "email": "hi@okis.dev"
   },
   "description": "Multi-model orchestration marketplace for Claude Code.",
-  "version": "0.0.41",
+  "version": "0.0.42",
   "plugins": [
     {
       "name": "grok",
       "source": "./plugins/grok",
       "displayName": "Grok Companion",
       "description": "Local Grok CLI delegation: task, review, resumable history, best-of-n tournaments, background jobs, stats, and setup health checks.",
-      "version": "0.0.41",
+      "version": "0.0.42",
       "author": {
         "name": "Harry Yep"
       },
@@ -34,7 +34,7 @@
       "source": "./plugins/codex",
       "displayName": "Codex Companion",
       "description": "First party local Codex CLI delegation for tasks, reviews, resumable threads, and durable background jobs.",
-      "version": "0.0.41",
+      "version": "0.0.42",
       "author": {
         "name": "Harry Yep"
       },
@@ -55,7 +55,7 @@
       "source": "./plugins/fusion",
       "displayName": "Fusion Orchestrator",
       "description": "Multi-model orchestration: tier agents, routing rules, blind panel, ultra fleet, model config, and drift doctor.",
-      "version": "0.0.41",
+      "version": "0.0.42",
       "author": {
         "name": "Harry Yep"
       },

CHANGELOG.md

@@ -1,5 +1,15 @@
 # changelog
 
+## 0.0.42
+
+- the codex rescue wrapper salvages foreground timeouts itself: a companion result ending `state: error` with `failure: timeout` and a `Resume Codex job` line authorizes exactly one scripted resume carrying a fixed wind down prompt, run as one additional foreground Bash call and relayed verbatim in place of the first output, never chained; the exception lands consistently in the rescue agent contract, the result handling, cli runtime, rescue, and task skills, the codex contract doc, the orchestration rules, and troubleshooting (15 of 20 recorded timeout deaths had ended salvage accepted only after a manual resume round; the wrapper now spends that round itself)
+- quick tier briefs get a time budget: the quick scoped routing row sizes a brief to one 570 second foreground flight, with the narrow suites for the touched files in the verification command and the complete list reserved for the orchestrator's collection rerun, an oversized package consolidates or splits before dispatch, and a timeout that survives the single scripted resume is a sizing error, not a redispatch candidate; the trivial row names the light middle band (explicit recipe single subsystem fixes, doc sweeps, mechanical test updates) as gpt-5.6-luna work, reserving terra for quick packages whose edits span files or need judgment inside the recipe
+- job records carry their runtime provenance: codex records persist `timeoutMs` and `companionVersion`, grok records and fusion worker ledger records gain `companionVersion`, each plugin reading its own manifest through a cached `CLAUDE_PLUGIN_ROOT` aware helper; persisting `timeoutMs` makes the 0.0.41 near cap counter count near cap finishes for real (it had been reading a field no writer ever set), and the version stamps make release watch mining sliceable by plugin version instead of timestamp inference
+- fusion stats reads real engine acceptance: `semanticAcceptance` prefers `semanticStatus`, the key engine records actually write, over the worker ledger's `acceptance` key, so byAcceptance, lane signal drift, and the accepted with error transport anomaly stop being blind to engine records; the per SKU trend adds a `salvaged` column counting timeout deaths later accepted, and the anomaly excludes designed timeout salvage while still flagging every other failure kind
+- the breaker advisory carries proportion: `latestBreakerFailure` also returns the failing kind's count and the engine's terminal job count inside the lookback window, and the advisory renders `(<n> <kind> across <m> terminal jobs, <h>h window)` so a singleton failure reads as a singleton instead of a lane wide alarm
+- stop gate demand and satisfaction share predicates, round two of the 0.0.39 class: `runtimeTaskMissing` and `needsCancellation` are extracted as exported predicates evaluated by both the demand filters and the reverify pass, reaped settlement funnels through one `settleReapedIfActive` shape from both the stop partition and the no task found consumption site, and the duplicate `unverifiedCollectedWorkers` folds into `settleOnlyRecords`
+- `/fusion:smoke` runs a post update live smoke wave before real work rides a refreshed install: version parity between installed caches and the marketplace manifest, one tiny probe per dispatch lane, and settlement recorded through `/fusion:stats` as one of the tested gates; the readme commands table and layout bullet list it, and the contributing release checklist runs it after every cache refresh
+
 ## 0.0.41
 
 - the worker token budget stops eating deliverables: a one shot wind down lands at 85 percent of the output token budget telling the worker to stop calling tools and write the deliverable, and after the limit trips exactly one final `Write` is still permitted (`terminalWriteGraceUsedAt`) while every other tool stays denied with the deny reason naming the grace; the subagent start announcement and all three worker prompts state both (observed live: three of four mining workers lost their final report write to the old hard deny)

CONTRIBUTING.md

@@ -18,6 +18,7 @@ Any change to `plugins/fusion/rules/orchestration.md` or `plugins/fusion/rules/t
    - A Codex package that cannot fit the foreground cap is split or routed elsewhere. Complexity and duration never silently detach it.
    - Independent packages fan out in a single message rather than being queued one at a time. Dependence is never removed by switching engines.
    - Agent scheduling, companion delivery, and CLI process supervision remain distinct. A manual receipt created by Fusion orchestration gets one same turn bounded collection attempt; a managed Grok detachment stays inside its owning Agent until terminal and marks collection. The monitor suppresses collected jobs but emits a delayed fallback after the grace period when a terminal managed job remains uncollected, as a best effort owner loss fallback. Direct Codex or Grok slash commands with explicit `--background` return manual receipts for status and result collection.
+   - After refreshing installed plugin caches, run `/fusion:smoke` before real delegated work.
    - `fusion:deep-reasoner` is read only advice, never an implementation retry. `fusion:fast-worker` owns resolved Claude tool or privacy packages, and `fusion:trivial-worker` is an exact tiny fallback when no eligible peer lane fits.
    - The question policy whitelist still routes questions and problem descriptions to read only main loop work and requested changes into implementation posture.
    - The session execution posture protocol (coordinate, implement, triage) still persists per goal and still forces implement before product edits once accumulation triggers fire.

README.md

@@ -56,6 +56,7 @@ Then, in a new session, run `/fusion:setup` once per machine (it writes the rout
 | `/fusion:panel <question>` | Blind multi-model panel with attributed adjudication, for decisions where a wrong answer is expensive. Also fires from plain language ("help me decide", "compare these") |
 | `/fusion:ultra <task>` | Fans a large task out as a fleet while preserving lane ownership: Codex keeps the primary deep implementation seat and Grok supplies protected burst, research, large context, and independent breadth. It synthesizes and verifies the combined result, fires from "go deep", "audit everything", or "be exhaustive", and returns small tasks to ordinary routing. |
 | `/fusion:setup` | Install or update the routing rules into `~/.claude/rules/`; offers the optional permission allow |
+| `/fusion:smoke` | Run the post-update live smoke wave across version parity and the three dispatch lanes before real delegated work |
 | `/fusion:config` | Read the local model configuration across engines, enumerate available models, and change defaults interactively |
 | `/fusion:doctor` | Audit model pins, environment overrides, peer model defaults (Grok and Codex config keys), rules drift, and stale agent copies |
 
@@ -110,7 +111,7 @@ CI also runs `node bench/manifest.mjs --check`; contributors should run it after
 - `.claude-plugin/marketplace.json`: the marketplace manifest; installs as marketplace `claude-code-fusion`.
 - `plugins/codex/`: the Codex integration (companion runtime, `codex-rescue` agent, `/codex:*` commands).
 - `plugins/grok/`: the Grok integration (companion runtime, `grok-rescue` agent, `/grok:*` commands).
-- `plugins/fusion/`: the orchestration layer: tier agents (`agents/`), the routing policy payload (`rules/`), and the `/fusion:panel`, `/fusion:setup`, `/fusion:doctor`, `/fusion:stats`, `/fusion:ultra`, and `/fusion:config` commands.
+- `plugins/fusion/`: the orchestration layer: tier agents (`agents/`), the routing policy payload (`rules/`), and the `/fusion:panel`, `/fusion:setup`, `/fusion:smoke`, `/fusion:doctor`, `/fusion:stats`, `/fusion:ultra`, and `/fusion:config` commands.
 - `bench/`: the benchmark methodology, harness, and task suite; no published results yet, see the publication gate in [bench/METHODOLOGY.md](bench/METHODOLOGY.md).
 - `tests/`: the fake Codex, Grok, and Claude driven test suite.
 

docs/codex-contract.md

@@ -61,7 +61,7 @@ The companion does not add a shell command allow list and does not rewrite the u
 
 Model and reasoning effort remain unset unless explicitly requested. The Codex configuration remains authoritative for defaults. The companion explicitly sets web search to disabled and workspace-write network access to false by default. `--web` opts a read-only or write task into live Codex web search. `--network` requires `--write` and opts the workspace-write sandbox into network access. Task mode `--output-schema <path>` validates a regular JSON Schema file up to 256 KiB and parses the final agent message once, while the Codex CLI `review` subcommand accepts but silently ignores `--output-schema`, unchanged from 0.144.6 through the live-verified 0.145.0.
 
-The companion writes the final prompt to Codex stdin. Prompts are never interpolated into a shell command. Programmatic callers use `--request-stdin` and pipe the complete raw companion request through stdin, leaving fixed argv free of request bytes. Claude Code's Bash tool does not expose stdin, so slash commands and wrapper Agents retain a private token-named staging compatibility path: the command model writes the raw request through its Write tool before invoking a fixed companion command containing only that token. Once the staging write has landed, the parser preserves positional whitespace, newlines, quotes, and backslashes byte for byte while removing recognized adapter options. The staged compatibility path is not an end-to-end byte-exact transport because a model performs the Write step. SessionEnd removes verified staging files owned by that Claude session, and later transport creation prunes other verified staging files after one hour. Final response text comes from the bounded JSONL stream, so Codex never receives an unbounded fallback output path. Prompts, individual JSONL events, final responses, raw event ledgers, logs, and rendered diagnostics have explicit byte limits. An oversized single JSONL event is skipped with a diagnostic and the run continues; the run fails as `resource` when the protocol cannot complete after a skip, and oversized prompts or final responses still fail as `resource` before they can inflate durable state. Resume accepts only a persisted Codex thread ID or a companion-selected terminal task record. `--resume-last` is restricted to the current Claude session when its id is available and otherwise selects the newest eligible workspace task. Active jobs are never resume candidates. `--fresh` rejects combination with either resume form and forces a new thread.
+The companion writes the final prompt to Codex stdin. Prompts are never interpolated into a shell command. Programmatic callers use `--request-stdin` and pipe the complete raw companion request through stdin, leaving fixed argv free of request bytes. Claude Code's Bash tool does not expose stdin, so slash commands and wrapper Agents retain a private token-named staging compatibility path: the command model writes the raw request through its Write tool before invoking a fixed companion command containing only that token. Once the staging write has landed, the parser preserves positional whitespace, newlines, quotes, and backslashes byte for byte while removing recognized adapter options. The staged compatibility path is not an end-to-end byte-exact transport because a model performs the Write step. SessionEnd removes verified staging files owned by that Claude session, and later transport creation prunes other verified staging files after one hour. Final response text comes from the bounded JSONL stream, so Codex never receives an unbounded fallback output path. Prompts, individual JSONL events, final responses, raw event ledgers, logs, and rendered diagnostics have explicit byte limits. An oversized single JSONL event is skipped with a diagnostic and the run continues; the run fails as `resource` when the protocol cannot complete after a skip, and oversized prompts or final responses still fail as `resource` before they can inflate durable state. Resume accepts only a persisted Codex thread ID or a companion-selected terminal task record. `--resume-last` is restricted to the current Claude session when its id is available and otherwise selects the newest eligible workspace task. Active jobs are never resume candidates. `--fresh` rejects combination with either resume form and forces a new thread. A foreground timeout with a resumable thread is salvaged by the wrapper's single scripted wind down resume; the resumed job links through `request.resumeThreadId`, and a second timeout terminalizes the package.
 
 ## Review execution
 

plugins/codex/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "codex",
   "displayName": "Codex Companion",
-  "version": "0.0.41",
+  "version": "0.0.42",
   "description": "First party local Codex CLI delegation for tasks, reviews, resumable threads, and durable background jobs.",
   "author": {
     "name": "Harry Yep"

plugins/codex/agents/codex-rescue.md

@@ -24,6 +24,7 @@ Forwarding rules:
 - If the Read call fails, the file is not empty, or the Write call fails, use a foreground Bash call to run `node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" transport-discard --raw-args-token TOKEN` with the validated token before returning the failure. Do not expose the token or transport file to the user.
 - Do not use Read for any path except the newly allocated empty transport file, and do not read it after writing. Do not search, run Git, execute tests, inspect job state, or perform any check, collection, cancellation, or companion operation beyond the fixed task operation.
 - When an explicit background request returns a receipt, return it unchanged. A direct slash command user inspects progress through status and collects the deliverable through result; when Fusion is installed, its monitor can notify them of completion. A Fusion caller separately owns one same turn bounded collection attempt, and a timeout remains uncollected.
+- When a task operation's companion output ends with `state: error` and `failure: timeout` and its body contains a line beginning `Resume Codex job`, run the command printed on that line exactly once, unchanged except for appending a space, `--`, a space, and this double quoted wind down prompt: "Wind down: do not start new work. Finish the smallest coherent deliverable from the work already completed and report the files changed and the verification output." Run it as one additional foreground Bash call and relay the second companion output verbatim in place of the first. This is the single authorized exception to the one operation rule: exactly one resume per task operation, never chained; any second timeout, any other failure, or any output without that line is relayed as received.
 - Return the companion stdout exactly as received. Do not summarize, paraphrase, prefix, suffix, or continue the work.
 - Relay the companion's stdout verbatim inside a fenced block. Never retype, summarize, or re-spell any part of it, including footers. Put commentary outside the fence.
 - If the companion invocation fails, return the failure exactly as Bash reports it. Do not generate a substitute answer.