santos/dev2 lands on dev: the worker harness as default, runs as work, skills from other harnesses, the chat as manager

[santoshkumarradha]

Brings santos/dev2 onto dev. dev is already merged in with a real merge commit, so this is a fast-forward: dev has nothing that dev2 lacks.

Status: ready for review. #1396 and the worker step-boundary fix are integrated. The current head 008363c98e6cff47cab919364d609d91a0037581 passed the light gate, touched-package tests, final required check, and CLA check on 2026-09-24.

What this brings

1. The worker harness, now the default. A task runs on a bash belt: one loop under both /task and codeaf do, with a checking seat for the belt check. CODEAF_TASK_BELT=node (or legacy, or off) is the way back to the older node belt. See #1109 waves 1, 2, 6 and 7, and #1335, #1340, #1355, #1207.

2. Runs as first-class work.

• A run's life is the conversation's.
• It works in its own copy, and the copy is written down so it can be found again.
• Dollar and time limits end it by one road, and the ending names the limit that caused it.
• A run's dollars reach the conversation's total.
• Work that nothing is driving reads as interrupted, not failed, and is kept, readable with the earlier runs. Nothing carries an interrupted run on today; a new task starts a run of its own.
• A stopped task reads stopped everywhere.

About 50 entries, from #1204 through #1305.

3. Skills from other tools. A skill shelf, use_skill, per-message automatic choice, a working /skill picker, and visible skill-use reporting. #1396 adds enabled Claude Code plugin skills, Codex bundled skills and linked skill folders. Skills work with memory on or off, and attachment/list operations cross the hosted session connection. The stable model catalog is bounded at 12 KiB of descriptions plus 2 KiB of names; keyword-based carry remains. #1409 adds OpenCode and Goose folders separately.

4. The chat as manager over the plan store. The chat role. The chat sees the plan when the person speaks, and notes are a channel into a running worker. See #1205, #1354, #1356 and #1357.

5. Task page, rail and step rows. The page and rail door. Step rows are cut from the commands as they ran, step numbers continue across a wake, and a call that did not run has no row. See #1231, #1257, #1260 and #1261.

6. Pickers. One fuzzy matcher for every picker, match highlighting, and the caret parks where you type (#1321).

7. Benchmarks and docs. The footprint benchmark and its method, resume cost (#1126, #1317), and ADHD-shaped answers (#1209).

8. Hardening.

• Heavy-suite locks as kernel file locks (scripts: hold the heavy-suite lock so it works across pid namespaces and dies with its holder #1264, scripts: the heavy-suite lock follows the suite, not the wrapper #1270, scripts: the heavy-suite lock is held beside the suite, not by what the suite leaves behind #1284, scripts: a heavy suite takes both locks so a stale tree can see it #1324).
• Goroutine ownership at close (session: join the usage writer at Close so no usage row is written after a process quits #1259, chatv3: stop and join the pool judge sweep at close, and inventory process goroutines with a class law #1267, catalog: the lazy warm is owned, cancelled and joined at close, so it cannot write under a later home #1274, chat: closing a process stops its place sweep before it can change a later home #1276).
• Unread and retired profile keys (config: report unread profile config keys once at load #1223, config: unread notice skips keys the product itself retired #1245).
• The CI gate on this branch (build: the pull-request gate runs on santos/dev2, the line the work lands on #1362).

Behaviour that changes on merge

• Tasks run on the bash belt by default. Before, CODEAF_TASK_BELT=bash opted in. Now node, legacy or off opts out.
• task.parallel = 0 means no limit on both doors.

Review

Every feature group above had a feature-level review against its change entry. The findings are being fixed in their own PRs into dev2, each with tests shown failing first and a full make check on the merged head.

Already in:

• run, session: a run's ending is written where the next request reads it #1411: run lifecycle (10 findings). A new request never adopts an earlier run, every ending is written on the root, the dollar limit ends peers, close lands nothing, steers on ended runs are refused, interrupted rows are honest.
• session, config: the chat manages a live run in the side list's words and through every door #1393: chat manager (9 findings). The digest leads with the live run in the rail's words, say and forward reach run rows, a key that is read is no longer reported unread, and Assisted-by follows /model.
• tui3, chat, pool: task-page keys, notes, tab mark and unowned warms #1395: task page keys, the tab mark, pool judge sweep claims, unowned catalog warms, manual gaps (12 findings).
• The dev merge: a parked parent could wake before its child's review check was seated. Fixed in internal/run, 100 stress runs green.

Also integrated:

• do, run, session: codeaf do edits in place, commits nothing, and stops at a price #1416: codeaf do keeps its work and spend contract, including project lockfiles.
• session, provider, suite-lock: the one machine is waited on, a pool is not one machine, and the dual lock is seen and taken back #1392: retry waits are applied and saturated, and single-machine behavior follows the actual route.
• attribution: always sign, and name only the bare model #1412: commit attribution is always on. The attribution.model row decides whether Assisted-by names the model on the conversation's own commits and on the older node belt's landings; a task landed on the worker harness, the default belt, carries the bare Assisted-by: CodeAF either way.
• Skills from Claude Code plugins and Codex, with memory off, chosen by what they are for #1396: skills discovery, memory-off operation and the real /skill attachment path.

Deferred skills decisions and limits

Per-scope skill enable/disable remains a product decision against automatic selection by meaning. #1409 remains separate. Claude Code's disable-model-invocation and user-invocable frontmatter are not yet honoured. Remote picker discovery still reads local disk, and task workers with memory off do not inherit the temporary shelf. These are not included as completed features in this PR.

Evidence

• The merge of dev into dev2 at 525b77fde: full make check EXIT 0, including the Windows cross-builds. Nothing is on the known-red list.
• tui3, chat, pool: task-page keys, notes, tab mark and unowned warms #1395 at 635c029c6, session, config: the chat manages a live run in the side list's words and through every door #1393 at 449e7921c, run, session: a run's ending is written where the next request reads it #1411 at 888911c05: full make check EXIT 0 each. CI green on each.

Latest verification (2026-09-24)

• Skills from Claude Code plugins and Codex, with memory off, chosen by what they are for #1396 merged into this branch at 6f1f39f5 after its successful PR gate, clean integration and independent review.

• 008363c9 fixes the original failing note-delivery test's cause: a worker could issue further actions while its asynchronous reader was still recording the preceding step. Task workers now wait for recording, limits and note delivery before another action; cancellation releases that wait.

• Full internal/run passed. Note cases passed 10 repetitions; note/cap cases passed 20 repetitions under the race detector; the stricter cap assertion passed 30 repetitions. Deterministic tests cover acknowledgement, cancellation and ordinary asynchronous events. A temporary slow-recorder experiment reproduced the old failure and passed five times with the fix; no artificial delay remains.

• Combined-tree focused run/session tests passed five repetitions, and make build passed. The published source tree matches the locally tested tree (5d7e675fc5a9c7898a8186762e2cc2238d67010c).

• The earlier session failure named in Skills from Claude Code plugins and Codex, with memory off, chosen by what they are for #1396 passed 20 repetitions; the full telemetry package passed.

• Local integration build, vet and manual checks passed. The local pr-ready run could not complete because the execution environment refuses a Unix socket in TestARecordingLaunchKeepsItsCallsInThisProcess. GitHub CI remains the final gate for the combined PR.

• Final GitHub gate: GREEN on 008363c9: light gate, touched packages and required check all succeeded. Run 36053569186. PR marked ready for review after confirming the tested head is still current.

Review fixes (2026-09-24)

Pushed to this branch after review, as fast-forwards only, with no force-push.

dev merged in:

• 99ec179ab: Ara's wave (chat: rename the Home scheduled heading to standing #1415, Fix home tab alignment across views #1424, Remove closed tasks from current Sessions results #1425, Message-box parity and visual design rules #1334, chat: select the next message project by clicking its Home name #1422, Restore double-space Home navigation and ask-here choices #1388, chat: one list of twenty-two tips, said two ways — home rotates, a conversation ranks #1389, Show Home conversations as working while their tasks run #1426).
• 538da010e: chat: know the OpenRouter balance, start a near-zero account on free models, keep the whole 402 sentence #1440, the OpenRouter balance.
• Follow-ups:
  • 7db417c37: pages and comments chat: one list of twenty-two tips, said two ways — home rotates, a conversation ranks #1389 left stale.
  • ee0abdf11: /skill typed on Home keeps its words, and commands.md lists it.
  • 19a5a77c5: a balance read still running when the window closes is stopped and waited for.

Four blockers fixed:

• 3cc26ea04: a skill or Claude Code settings file that is not an ordinary file (a pipe, a device, or a link to one) is absent. A committed SKILL.md -> /dev/tty no longer hangs the chat.
• 2d5cf1fb1: the default run road asks the machine (task.max_load, task.min_free_mb) before every worker it starts, and the rail says waiting · machine busy.
• 01acafb17: codeaf do keeps its run record in a private folder under the state root, never in the person's repository.
• ee5f424e5: a task that finishes on its capped step ends done and gets its review.
• With them: 503150586 (manual pins), 2aaf5919e (change entry), f5cf5c86f (a test reads its refusal through a wrapped path).

Owner rulings written into the manual (ab036aaca). No behaviour changed.

• A commit a task lands on the worker harness carries the bare Assisted-by: CodeAF. Only the older node belt's landing names the model.
• A /task started after the conversation's dollar limit is spent still gets one paid call before the limit ends it.
• Signing is on by default and has no off. A profile or shell that still turns the retired attribution row off is told so once, and only the model's name can be turned off.
• A message carrying a picture carries no skills, the attached ones included.

codeaf do on a busy machine (41a57e164). It used to wait in silence until --timeout. Now:

• The first held start prints waiting · machine busy · <the limit that held it> on stderr, once.
• The first start after the hold prints starting · the machine has room again.
• A timeout with nothing started still leaves 124 / stop: "deadline", and --json carries the held line in blocked_on.

Should-fixes filed as #1444–#1465. Also filed from this review: #1490 (read / read_document block on a pipe; pre-existing on dev), #1491 and #1492 (load-only test reds), and #1493 (a ruling on the Model Pool judge at low credit).

CI on 41a57e164: green. The light gate, touched packages (the whole dev2 delta) and check all passed on both the push run 36084156976 and the pull_request run 36084160527.

[santoshkumarradha]

@AbirAbbas thanks for the dev merge (99ec179ab). To keep this reviewable, this PR is now frozen:

• From here, santos/dev2 takes only fixes from your review of this PR, plus dev merges. No new features.
• It shows a conflict with dev again, because chat: know the OpenRouter balance, start a near-zero account on free models, keep the whole 402 sentence #1440 (the OpenRouter balance and free-models change) landed on dev after your merge. Are you merging it in, or should we? We'd do it as a plain merge commit: no rebase, no force-push.
• Follow-up work waits for this to land, then gets retargeted to dev as small PRs of its own:
  • One task page for every task: a run's task opens the real task room #1485 one task page (a run's task opens the real task room), currently a draft into santos/dev2. We won't merge it there.
  • Brain index: design, runs record their files, elsewhere keyed by repository, live runs seen #1443 (the brain index steps) is paused.

[AbirAbbas]

I updated the description. Two lines claimed more than the branch does:

• Model name in commits. It said the model name in commits could be switched on and off everywhere. A task landed on the worker harness (the default belt) always carries the bare Assisted-by: CodeAF.
• Interrupted runs. It said interrupted work "can be carried on". Nothing wires that today: an interrupted run is kept and readable, and a new task starts its own run.

I also added a Review fixes (2026-09-24) section listing what landed on santos/dev2 since review:

• the dev merges
• the four blocker fixes
• today's two commits:
  • ab036aaca writes the owner's four rulings into the manual
  • 41a57e164 makes codeaf do say waiting · machine busy on stderr when the machine holds it, and puts the reason in blocked_on on a timeout
• the issues filed: A note on an interrupted run promises a worker that no longer exists #1444–The task rail counts interrupted and stopped runs as done #1465, read and read_document block forever on a pipe, and read without end from a link to a device #1490–Question: should the Model Pool's judge go free, or be skipped, while the OpenRouter balance is low? #1493

CI is green on 41a57e164. The rest of Santosh's text is unchanged.

[santoshkumarradha]

@AbirAbbas this is ready for your review. dev is fully merged in (including #1440), there are no conflicts, and CI is green. GitHub is only waiting on your approval.

Next in line once this lands: #1485 (one task page). It's green on a full make check and CI, and gets retargeted to dev as its own small PR.

[AbirAbbas]

Verified end to end on 41a57e1: the four review blockers are fixed in the real binary on both launch roads, #1410's main flows, Ara's Home/tips/Sessions wave and #1440 all pass by hand, and the tagged TUI suite shows no subtest that passes on dev and fails here. CI green. Merging.