feat(pool): deterministic weighted tier model pools

[yury-procoders]

Summary

• add per-stance, per-tier weighted backend pools with deterministic manifest-order assignment
• freeze concrete pool members and backend/model assignments into validated run state for dispatch and resume
• keep retry, circuit-breaker, fallback, status, and every backend-keyed consumer on concrete assignments
• add fail-closed manifest/config/state guards, including all-member never-Haiku checks and bounded ring expansion

Merge prerequisite

Do not merge this PR before #5. The code paths are fixture-testable independently, but the shipped Codex + z.ai pool policy depends on the z.ai backend. PR #5 is currently open and green; this PR does not claim it has merged.

Verification

• 35 Python script selftest suites checked, 0 failed
• targeted changed suites: config 38, resolver 105, pool state 60, manifest validator 133, failure policy 35, classifier 43
• 12 manifests checked, 0 failed
• 4 injected adversarial errors detected: huge weight, negative retry counters, fallback Haiku, invalid auth/top-up breaker clearance
• frontmatter, JSON, version lockstep, shellcheck, anti-ruflo, and git diff --check passed
• dead-link scan checked 200 Markdown files, 0 dead links
• final independent SPEC, QUALITY, and INTEGRATION reviews: APPROVED; all 12 acceptance criteria pass

Python 3.9 grammar parsing passed for changed scripts. A Python 3.9 runtime was not installed locally; GitHub CI is the authoritative Python 3.9 execution gate.

What this does not show

Weighted rotation distributes job counts, not tokens, credits, messages, wall-clock time, quota burn, savings, or provider capacity. No balance percentage or improvement metric is claimed.

[copeus]

Review: two independent passes, both blocking

Reviewed with the repo's own pr-review skill and, because this PR changes how a model is chosen, a second adversarial pass by an independent model family (Codex/gpt-5.6). They were run separately and agree on the headline. Every claim below was reproduced — nothing here is inferred from reading.

First, credit where it's due: the shape of the design is right. Manifest-order ordinals rather than dispatch order, freeze-once, never re-derive on resume, skip-without-resize so a shrinking pool can't shift earlier assignments — that's careful work, and the self-review shipped with the PR caught real defects on its own. The problems below are about where the safety lives, not about the ring algorithm.

The blocking issue: the policy chain is joined by prose

Every safety property — never-Haiku, no deep tier, no pooled reviewers — is enforced in the manifest validator. The state layer that actually picks the model re-implements none of them. The two are connected only by an agent reading markdown.

In a repo whose entire thesis is "prose enforcement fails, git-derived gates hold", that's the wrong trust boundary — and it leaks twice:

1. Haiku reaches dispatch and survives resume. _assignment_errors gates Haiku only inside assignment_source == "fallback". A normal "pool" assignment only has to match a non-empty frozen slot, and freeze_pool_members stores whatever resolve() returned. Reproduced independently by both passes:

• freeze wrote assigned_model: claude-haiku-*
• validate_state returned []
• resume_assignment handed it straight back

The selftest passes because it only exercises the fallback branch (fallback_haiku). Worth noting: the review docs shipped inside this PR already flagged this — "'no change in either direction' is not neutral — it makes the hole the default path for this feature". The gate that landed covers only the branch that was already safe.

2. Sonnet bypasses the junior-task carve-out (found by the second pass only). A pool member with an explicit model:

{"pools": {"balanced": {"standard": [{"backend": "claude", "model": "sonnet"}]}}}

passes validation — the member check only asserts non-empty and not-Haiku — and the resolver returns sonnet for a balanced/standard job that must be Opus. No junior-task justification anywhere.

3. A config TOCTOU makes the manifest-side check unenforceable anyway. Manifest validation can run with --config safe.json while dispatcher Step 0a reloads $REPO/.claude/compound-v.json. Anything validated is not necessarily what gets frozen.

Fix, in one line: the never-Haiku and tier/model policy must be applied inside freeze_pool_members, select_frozen_member and validate_state, for every slot and every assignment_source — ideally with a persisted config digest so freeze validates the exact snapshot it consumed.

Backward compatibility is reproducibly broken (AC-1)

The backend_max_parallel read is unconditional, so a pool-free legacy manifest now re-validates the whole config. Reproduced base-vs-head — each of these flips valid → invalid on a manifest that never used pools:

• {"models": "nope"}
• {"pre_eval": [1, 2]}
• {"backend_max_parallel": {"gemini": 2}}

Related: config warnings become blocking violations and aren't stance-scoped — a wieght typo under cost-aware invalidates a balanced manifest.

Two states freeze produces that validate rejects

Both make a run permanently unresumable:

• tier: Light passes the manifest gate, freezes as light, then validate_state throws. _normalized_backend is used four lines above for exactly this reason (339710d fixed the same class for backend); job.get("tier") is raw.
• pool_members == {} short-circuits freeze forever; every later select raises.

Merging without #5

Confirmed policy-only at the code level — zai is absent from resolve-model.py:BACKENDS and validate-manifest.py:VALID_BACKENDS, and no tracked manifest names it. The blockers are the /v:init seed (which writes zai members and hard-fails with unknown backend 'zai') and the zai snippets in execution-manifest.md / state-machine.md. Re-seeding to codex + claude validates clean.

One caveat: that re-seed inverts the PR's own §2 rationale (Claude shares quota with the operator's session; forced worktree makes it costlier), so the rationale needs rewriting too, and codex should carry the heavier weight.

One more, and it's the fabricated-evidence class

_earliest_reset_seconds computes "earliest reset across members" from reset_seconds / retry_after_seconds fields that freeze_pool_members never writes — it stores only backend, model, available. The selftest passes only because it hand-constructs frozen members containing fields the production path cannot emit. Either persist a per-backend reset instant on every exhaustion including reroutes, or drop the "earliest across members" claim.

Anti-ruflo re-check on the PR body

Verified and true: 35 selftest suites / 0 failed (re-run on real 3.9.6 — the "no 3.9 runtime locally" caveat was unnecessary, it is 3.9.6), 12 manifests / 0 failed, and both injected Blocking mutations reproduce non-vacuously. Only the assertion counts are stale-low (measured 41/111/64/142/40/43 vs 38/105/60/133/35/43).

On proportionality — worth a conversation before the fixes

Counted in this repo: 76 claude and 3 codex job entries across 11 tracked manifests. The one backend carrying ~96% of all work is the one this feature excludes from pools by default, on the stated grounds that pooling it competes with the operator's session. So the pooling lands on backends that have never run a job.

This PR's own build manifest used claude×3 + codex×3 and zero pool jobs — the feature wasn't dogfooded on itself.

That isn't an argument to close it. The underlying pain — hitting a provider ceiling and stopping — is real, and we independently diagnosed it as a top cause of our autonomy ceiling this week. But it suggests landing this off by default rather than seeded into /v:init, and proving it on the Claude↔Codex pair that actually carries the traffic before adding providers.

Summary

Must fix before merge: the two policy leaks + the TOCTOU; AC-1 backward compatibility; the two unresumable states; the /v:init seed; the docs that contradict the shipped artifacts.

Reviewer's call: the codex + claude re-seed rationale; the constant/vocabulary duplication (already drifted — zai missing from VALID_BACKENDS); 5 changed files sit in no job's write_allowed, which our own scope gate would have blocked.

Happy to re-review once the policy moves into the state layer — that's the change that turns this from prose-joined to enforced, and it's the one that matters.