release: v0.1.0-rc15

.cursorindexingignore

@@ -0,0 +1 @@
+*

.github/workflows/refresh-seed.yml

@@ -0,0 +1,56 @@
+name: Refresh pricing seed
+
+# Keep the offline pricing floor (assets/pricing/models-dev-seed.json) current
+# without hand-editing it (ADR-0034 A3, issue #290). The generator refreshes the
+# seed from live models.dev out-of-band — never build.rs — and this job opens a
+# diffable PR only when the numbers actually change. Cadence is decoupled from
+# the release cycle. HITL: the resulting PR is reviewed as data before it merges.
+
+on:
+  schedule:
+    # Weekly, Mondays 06:00 UTC.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+permissions:
+  contents: write # push the refresh branch
+  pull-requests: write # open the review PR
+
+jobs:
+  refresh:
+    name: regenerate seed · open PR on change
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry and target
+        uses: Swatinem/rust-cache@v2
+
+      - name: Regenerate seed from live models.dev
+        run: cargo run -p xtask -- refresh-seed
+
+      - name: Open a diffable PR when the seed changed
+        # No-op safe: with no diff the action creates/updates no PR.
+        uses: peter-evans/create-pull-request@v6
+        with:
+          add-paths: assets/pricing/models-dev-seed.json
+          branch: chore/refresh-pricing-seed
+          delete-branch: true
+          commit-message: "chore(pricing): refresh models.dev seed floor"
+          title: "chore(pricing): refresh models.dev seed floor"
+          body: |
+            Automated refresh of the offline pricing seed
+            (`assets/pricing/models-dev-seed.json`) from live models.dev,
+            narrowed to the driven providers (anthropic, openai, google,
+            moonshotai). Review the price deltas as data before merging — a
+            deliberate floor above upstream (e.g. `claude-opus-4-8`, ADR-0008 D8)
+            should be restored here rather than let the refresh regress it, and
+            the `floor.rs` golden values move with any accepted change.
+
+            Generated by `cargo run -p xtask -- refresh-seed` (issue #290).

CLAUDE.md

@@ -9,9 +9,33 @@ them here.
   is defined there. Use these words; don't invent synonyms.
 - **[docs/adr/](./docs/adr/)** — architecture decisions. Check for a relevant
   ADR before changing a seam; the boundary you're about to cross was probably
-  decided on purpose (e.g. ADR-0004 core/adapter boundary).
+  decided on purpose (e.g. ADR-0002 core/adapter boundary).
 - **[docs/BUILDING.md](./docs/BUILDING.md)** — build, CI, crate layout.
 
+## Architecture — ports & adapters, ubiquitous-language-first
+
+Ralphy is **hexagonal (ports & adapters)** at the crate seam, with DDD in its
+**tactical** sense only: the [CONTEXT.md](./CONTEXT.md) glossary *is* the
+ubiquitous language and each crate is roughly one bounded context. There is no
+strategic-DDD ceremony here — no aggregates, repositories, or domain-event
+buses. Don't add them.
+
+- **`ralphy-core` is the center and depends on no vendor.** It defines the agent
+  contract (the *port*) and owns queue lifecycle, git/forge, run reporting. It
+  must never gain a dependency on a `ralphy-agent-*` crate or on
+  `ralphy-adapter-support`; the dependency arrow points *inward*, toward core
+  ([ADR-0002](./docs/adr/0002-core-agnostic-adapter-boundary.md) protects this
+  seam). If core seems to need something vendor-specific, the design is wrong —
+  lift it behind the contract, don't leak it in.
+- **Each `ralphy-agent-*` is an adapter** implementing that port: one crate per
+  vendor, holding all that is vendor-specific (execution mode, completion
+  protocol). **`ralphy-adapter-support`** is the vendor-*neutral* plumbing the
+  adapters share — it produces no `Outcome` (CONTEXT.md → *Adapter support*).
+- **`ralphy-cli` is the composition root** — the one place that names every
+  vendor and wires them together. Vendor enumeration lives *there and only
+  there* (plus the [ADR-0040](./docs/adr/0040-agent-adapter-onboarding-contract.md)
+  inventory), never scattered across the tree.
+
 ## Hard rules (an agent will get these wrong without being told)
 
 - **The green gate is CI's gate.** Before considering a change done:
@@ -28,17 +52,84 @@ them here.
   [ADR-0022](./docs/adr/0022-file-split-conventions.md): `foo.rs` + `foo/`
   layout (never `mod.rs`), tests migrate with the code, split by existing
   responsibility only.
+- **Tests live next to what they test — separated by `#[cfg(test)]`, not by a
+  parallel source tree.** That is this repo's convention *and* idiomatic Rust,
+  and `#[cfg(test)]` compiles the code out of release builds, so nothing
+  test-only ever ships — that gate is the "don't mix production and tests"
+  guarantee, not a separate root. Placement:
+  *unit tests* stay in the same crate as the code, either an inline
+  `#[cfg(test)] mod tests` or — once a file splits (ADR-0022) — a sibling
+  `#[cfg(test)]` submodule file (`foo/tests.rs`, or a named one like
+  `runstate/roundtrip.rs`); *integration tests* (black-box, public API only) go
+  in the crate's `tests/`, with data under `tests/fixtures/`; a **test helper
+  child binary** goes in `src/bin/<name>_test_child.rs`, because its
+  `CARGO_BIN_EXE_*` is visible only to integration tests (CONTEXT.md →
+  *Testing conventions*).
+- **Smallest change that fits the existing seam.** A new trait, generic, crate,
+  or layer of indirection needs a real second caller or a deciding ADR — never
+  "for flexibility" (`anti-over-abstraction`). Cross a seam only where an ADR
+  says to; if no ADR covers the boundary you're about to add, the change is
+  probably in the wrong place, or the seam is a design decision that wants an
+  ADR first.
+- **English is the canonical written language.** ADRs, docs, GitHub issues and
+  PRs, commit messages and code comments are written in English, whatever
+  language the request arrived in. A conversation with a maintainer may be in
+  any language; the artifact is English. Issues in particular are work orders an
+  agent consumes, and they quote English ADRs, identifiers and paths — prose in
+  a second language makes one document speak two per sentence.
 - **Contributing to this repo:** commit on a branch; a human reviews and merges.
   Do not push or open a PR unless explicitly asked. (This mirrors Ralphy's own
   product ethos — it never pushes and never opens PRs.)
 
+## Rust baseline (the always-on floor)
+
+The full `/rust-skills` (179 rules) is a surgical tool — invoke it to review
+non-trivial code or a specific concern. These few are the minimum that hold
+without invoking anything; they apply to every change. Each names the underlying
+rule so `/rust-skills <name>` gives you the bad/good example on demand.
+
+- **Errors — this codebase is a subprocess driver, so errors are the hot path.**
+  No `.unwrap()`/`.expect()` on anything recoverable (spawn, I/O, git, network,
+  parse); `expect()` is allowed *only* for a violated invariant that is a bug,
+  and its message states why the invariant holds (`anti-unwrap-abuse`,
+  `anti-panic-expected`, `err-expect-bugs-only`). Never swallow an error — no
+  `let _ = result`, no bare `.ok()`, no empty `if let Err(_)`: handle or
+  propagate (`anti-empty-catch`). Propagate with `?` and add
+  `.context()`/`.with_context()` at each boundary so the chain reads
+  "what failed: why" (`err-context-chain`). Error messages start lowercase with
+  no trailing punctuation — they get chained (`err-lowercase-msg`). `anyhow` at
+  the app/composition boundary; a `thiserror` domain type at a seam callers must
+  match on (`err-anyhow-app`, `err-custom-type`).
+- **Signatures — free flexibility clippy would flag anyway.** Take `&str` not
+  `&String`, `&[T]` not `&Vec<T>` (`anti-string-for-str`, `anti-vec-for-slice`).
+  A fixed set of values or a semantic identity is an `enum`/newtype, not a
+  `String` — this is the CONTEXT.md ubiquitous language expressed in the type
+  system (`anti-stringly-typed`).
+- **Idiom & restraint.** Iterators over manual `for i in 0..len` indexing; don't
+  `.collect()` mid-chain (`anti-index-over-iter`, `anti-collect-intermediate`).
+  `impl Trait` over `Box<dyn Trait>` when the type is concrete; start concrete
+  and generalize on a real second use, not "for flexibility" (`anti-type-erasure`,
+  `anti-over-abstraction`). No optimization without a profile
+  (`anti-premature-optimize`).
+- **Async (daemon only).** Never hold a lock guard across an `.await`; use
+  `tokio::sync` primitives and drop the guard first (`anti-lock-across-await`).
+
 ## Where things live
 
 `crates/ralphy-cli` (the `ralphy` binary + composition root) ·
 `crates/ralphy-core` (queue lifecycle, git/GitHub, run reporting) ·
-`crates/ralphy-agent-{claude,codex,opencode}` (the vendor adapters) ·
+`crates/ralphy-agent-*` (**the vendor adapters — one crate per vendor**;
+`claude`, `codex`, `kimi`, `opencode` today, more arriving) ·
 `crates/ralphy-adapter-support` (vendor-neutral child-driving plumbing) ·
-`crates/ralphy-pty` · `assets/prompts` (plan/execute charters) ·
+`crates/ralphy-daemon` (the supervised launcher + workbench) ·
+`crates/ralphy-usage-scan` (stateless reads of the vendors' session stores) ·
+`crates/ralphy-pty` · `crates/ralphy-proc-util` ·
+`assets/prompts` (plan/execute charters) ·
 `assets/plugin` (bundled skills, embedded into the binary).
 
-#teste 1
+Adding a vendor is not just a new crate: follow
+[ADR-0040](./docs/adr/0040-agent-adapter-onboarding-contract.md), whose wiring
+inventory lists every edit site across five tiers. **Do not enumerate the vendor
+crates anywhere a list can go stale** — that list has already drifted once
+(Kimi was missing from this section and is still missing from the daemon's
+agent enum).

CONTEXT.md

@@ -125,14 +125,16 @@ _Avoid_: model selection (reserved for Claude complexity routing).
 The shared machinery every **adapter** leans on but that is specific to *no*
 vendor — the headless child-driving loop (spawn, drain stdout/stderr, poll to
 completion-or-timeout, kill on deadline), the `RALPHY_DONE_EXIT` /
-`RALPHY_BLOCKED_EXIT` sentinel parser, and skill/plugin materialization. It is
+`RALPHY_BLOCKED_EXIT` sentinel parser, and skill/plugin materialization —
+including the `.agents/skills` exposure dance (link-or-copy, symlink-safe
+removal, merged per-entry `.gitignore`) that Codex and Copilot both drive. It is
 the deliberate counterpart of **Adapter**: where an adapter holds what is
 vendor-specific, adapter support holds what is common. It owns **no** completion
 protocol and produces **no** `Outcome` — it hands back raw captured output and
-each adapter still classifies it (the seam ADR-0004 protects). Lives in
+each adapter still classifies it (the seam ADR-0002 protects). Lives in
 `ralphy-adapter-support`; depended on by the vendor adapter crates, never by the
 core.
-_Avoid_: shared runner, headless runner (ADR-0004 forbids a shared *Outcome*
+_Avoid_: shared runner, headless runner (ADR-0002 forbids a shared *Outcome*
 runner — this is only the plumbing), utils, helpers.
 
 **Run deadline / per-issue budget / idle watchdog**:
@@ -164,7 +166,7 @@ beats closing a throttled session) and a `timeout`; a `done` needs only
 protocol-completion and flake-repair hand-backs legitimately finish with no commit
 (the plan lives in gitignored `.ralphy/plan.md`). `committed` is a *progress* signal
 feeding the Claude headless no-commit **streak**, not a gate on **green**. This
-*narrows* — does not reopen — ADR-0004: raw→signal extraction (including limit
+*narrows* — does not reopen — ADR-0002: raw→signal extraction (including limit
 trustworthiness and exit normalization) stays per-adapter; only the signal→`Outcome`
 ordering is shared (ADR-0023). Claude is the reference implementation; the behavior
 change lands on the Codex and OpenCode adapters.
@@ -187,6 +189,20 @@ An **optional adapter capability**, not a core guarantee — a deterministic ada
 which is a deterministic knob the operator sets, not an auto-judged choice.
 _Avoid_: model selection (too broad), auto-model.
 
+**Effort**:
+The deterministic reasoning-depth knob the operator sets per phase
+(`--plan-effort`/`--exec-effort`), on the fixed five-rung ladder
+`low | medium | high | xhigh | max` (ADR-0044) — the cross-vendor intersection of
+the CLIs that expose one. `low`/`medium`/`high` are the guaranteed-universal core;
+`xhigh`/`max` are accepted but clamp down on a model that cannot honour them, so
+asking for more never silently delivers less. One word, translated to each
+vendor's dialect **inside** the adapter (clamp where the vendor degrades silently,
+passthrough where it errors loudly, a documented no-op where there is no effort
+axis) — never a raw passthrough. Distinct from **complexity routing** (auto-judged
+model choice) and from model selection: effort is *how hard*, not *which model*.
+_Avoid_: reasoning level (vendor-specific), variant (that is OpenCode's dialect,
+not the Ralphy word).
+
 **Supervised session**:
 Live human oversight of a *running* agent session — following it and intervening
 mid-flight, via Remote Control (mobile) or an on-screen terminal (local/Tauri).
@@ -406,7 +422,7 @@ An issue's `## Blocked by` section names other issues (`#N`) it depends on. The
 runner gates on it: if any named blocker is still **open**, the blocked issue is
 *skipped* this run (not closed, not a stop) and picked up by a later run once the
 blocker clears. A blocker counts as satisfied when simply **closed** — safe only
-because every issue in a run shares one branch (see ADR-0002).
+because every issue in a run shares one branch (see ADR-0045).
 _Avoid_: depends-on, prerequisite, stop-before (that's flow control, not a dependency).
 
 **stop-before**: