feat(agents): harness-agnostic effort write path and spawn bridge

[wpfleger96]

Summary

Genericizes the agent effort write-side so Goose participates in the same canonical effort contract as buzz-agent. A spawn bridge translates the canonical key to whatever the target harness expects at launch time. Read/write/spawn paths all derive their vocabulary from runtime metadata rather than a hardcoded buzz-agent list.

What changed

Rust — config bridge + spawn path

• apply_spawn_effort_env in effort.rs: production command-boundary seam — writes baked env, runs the effort projection, strips per-runtime suppress set, and emits exactly one projected key.
• apply_effort_to_spawn_command in runtime.rs: thin wrapper returning a #[must_use] EffortApplied(()) token (private field — unforgeable outside the function). spawn_agent_child calls it as let effort = apply_effort_to_spawn_command(...) and passes effort to spawn_with_effort_proof. Deleting the call is a compile error: effort is undefined at the spawn_with_effort_proof site. Deleting apply_spawn_effort_env inside the wrapper turns the production-sequence tests RED.
• apply_record_field_updates in agent_models_update.rs: returns Result<RecordFieldsApplied, String> (#[must_use] token). update_managed_agent calls it as let applied = apply_record_field_updates(...)? then passes applied to stamp_record_updated_at. Deleting the call is a compile error: applied is undefined at the stamp_record_updated_at site.
• Unknown/custom-runtime passthrough: apply_effort_launch_to_command skips the suppress loop when preserve_passthrough && value.is_none(), preserving ambient ACP sentinels.
• EnvVarGuard: prior value stored as OsString (var_os) so non-Unicode values are restored exactly on Drop. A single PROCESS_ENV_MUTEX in managed_agents/mod.rs is shared by lock_path_mutex() and lock_env_mutex() — any two tests calling either helper are mutually exclusive with each other. Tests in other modules (app_state_tests, agent_config_tests, reader_tests) maintain their own independent locks and are not in this domain.
• Dead-code: strip_effort_keys_from_command marked #[cfg(test)]; import path in effort_cmd_tests.rs fixed.
• Windows CI fix: platform-gated variants for inherited-env tests.

TypeScript — renderer + model cleanup

• AgentConfigFields orphan-model cleanup effect: the isHarnessNativeEffort early-return was skipping the model clear on provider→Custom transitions. Refined to: return early only when model is already null; clear model once while preserving the harness-native effort key (Carl P2).
• Provider-empty convergence: when model is null and effort is native, the cleanup effect returns early (nothing to clear) — prevents spurious onConfigChange loop.
• EffortSelectField / humanizeEffortLabel: runtime-native option labels title-cased (off → Off) with raw canonical values preserved for round-trip fidelity.
• AgentConfigFields: drives effort renderer from selectedRuntime.effortCanonicalValues (harness-native path) or the model/provider catalog (buzz-agent/provider path), selected by isHarnessNativeEffort.

Docs

• desktop/src/features/agents/AGENTS.md item 14: updated from deleted persistAgentEffortLevel direct-write contract to the shipped Save-gated update_managed_agent.effortLevel path. Consistent with EffortPickerField's own doc comment.

Tests

• agent_models_update_tests.rs: seam tests via apply_record_field_updates — non-local rejects, local set/clear, ordering invariant, ACP-sentinel sweep. record_field_updates_persist_effort_to_disk (renamed from the prior false-claim name) drives load→apply→stamp→save→load via a mock AppHandle + tempdir, asserting effort_level persists to disk. Manual HOME/XDG restore replaced with RAII EnvVarGuard (panic-safe, OsString-exact).
• effort_cmd_tests.rs / effort_tests.rs: production-sequence seam tests via apply_effort_to_spawn_command. Spawns /usr/bin/env to verify child's real env. EnvVarGuard for panic-safe restore. Windows twin using cmd /c set.
• effortAutoClear.test.mjs: five mounted stateful journeys via AgentConfigFields with useCustomSelect=true. Covers: custom trigger shows "Off" at mount; provider-empty mount is a stable fixed point; provider→Custom switch converges; stale Anthropic model cleared on Custom switch with Goose effort preserved (Carl P2 regression); Settings-style Save/reread preserves effort.
• agentDefaultsEditor.test.mjs: two full Save/Next journey tests through the real production parent trees. Both start with GOOSE_THINKING_EFFORT: "low" and operate the real Popover-based effort control (click trigger → click "off" option) before Save/Next, asserting zero writes after selection. The set_global_agent_config stub captures the submitted payload; each test asserts raw GOOSE_THINKING_EFFORT: "off" in the captured config. The stub stores its canonical response from the actual payload; the fresh remount's get_global_agent_config returns that stored object (not a hand-written fixture), then asserts "Off" shown. The DefaultConfigStep test starts with isDirty: false — the real-control effort selection calls onConfigChange → updateDraft → isDirtyRef=true, making the commit() on Next load-bearing.

Mutation evidence

• Delete let effort = apply_effort_to_spawn_command(...) call from spawn_agent_child → compile error: error[E0425]: cannot find value effort`` at spawn_with_effort_proof site.
• Delete let applied = apply_record_field_updates(...)? from update_managed_agent → compile error: error[E0425]: cannot find value applied`` at stamp_record_updated_at site.
• Delete apply_spawn_effort_env from inside apply_effort_to_spawn_command wrapper → production_sequence_goose_inherited_collision_resolved_in_child RED.
• Revert isHarnessNativeEffort && guard in cleanup useEffect to bare if (isHarnessNativeEffort) return → stale model not cleared → Carl P2 regression test RED.
• Remove isHarnessNativeEffort || from the nothing-to-clear condition → provider-empty mount emits onConfigChange → loop test RED.
• Remove isHarnessNativeEffort branch in AgentConfigFields.tsx:634-636 → both agentDefaultsEditor.test.mjs mount assertions fail: trigger shows "Select" instead of initial effort label.
• Remove preserve_passthrough guard in apply_effort_launch_to_command → production_sequence_custom_inherited_acp_sentinel_survives RED.
• Drop GOOSE_THINKING_EFFORT from the set_global_agent_config stub payload → payload assertion in agentDefaultsEditor.test.mjs fails (undefined !== "off") → RED (verified).
• Remove the effort-select dirtying steps from the DefaultConfigStep test (so isDirty stays false) → commit() is a no-op → write-count assertion after Next fails (0 instead of 1) → RED.

[kalvinnchau]

[P2] Pin-to-inherit can retain stale effort when the current runtime has no effort key — desktop/src/features/agents/ui/AgentInstanceEditDialog.tsx:500

handleInheritHarnessChange decides whether to clear effort from the pre-toggle prospectiveRuntime. For an agent pinned to Claude (no thinkingEnvVar) whose linked persona uses Goose, selecting Inherit skips the clear. On the next render the prospective runtime becomes Goose, but the record's existing BUZZ_AGENT_THINKING_EFFORT remains; resolveInheritedRuntimeSubmission only excludes effort keys from the persona layer, so that record value is saved and the spawn bridge aliases it into Goose effort. This violates the stated pin↔inherit clear contract and can silently resurrect an effort value from an unrelated prior runtime. Resolve the runtime for nextInherit inside the handler (or clear whenever either the before or after runtime owns effort), and pin the Claude-pin → Goose-persona transition with an integration-level state/submit test.

[P2] Consumed legacy effort is also emitted as an advanced field — desktop/src-tauri/src/managed_agents/config_bridge/reader.rs:125

For a Goose record containing only a valid legacy BUZZ_AGENT_THINKING_EFFORT, build_thinking_field consumes it and exposes canonical thinking_effort, but normalized_env_keys contains only GOOSE_THINKING_EFFORT. The loop at line 140 therefore also emits the legacy key in surface.advanced. The config panel presents one persisted setting twice, with conflicting semantics, and an edit can appear to target a generic env var while the normalized field is already interpreting it. Invalid or unconsumed legacy values should remain advanced, so hide the legacy key only when record-tier alias resolution actually consumed it; add a surface test for valid-consumed versus invalid-visible legacy values.

Validation at exact PR tip 5882e4494656b0ce3deeffb2c1d1c1dea25e47f3:

• just desktop-test: 4,774 passed, 0 failed
• just desktop-tauri-test: passed (workspace; one pre-existing ignored native performance test)
• git diff --check a8e5c89e2..HEAD: clean

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

• [P2] Preserve custom-runtime effort env in the restart snapshot — desktop/src-tauri/src/managed_agents/spawn_snapshot.rs:181

  The launch projection deliberately uses an empty suppress set for an unknown/custom runtime so wrapper-specific variables such as GOOSE_THINKING_EFFORT remain ordinary pass-through env. SpawnConfigSnapshot::from_inputs, however, unconditionally removes every globally known effort key. For an unknown command, effective_effort only reads BUZZ_ACP_EFFORT_LEVEL, so an exact-case GOOSE_THINKING_EFFORT disappears from both snapshot.env and snapshot.effort_level even though the child receives it. Changing that variable therefore produces no restart diff and can leave a running custom-wrapper agent on the old effort despite auto-restart-on-config-change. Scope snapshot cleanup to the runtime projection: known runtimes can collapse their suppress set, while unknown runtimes must retain non-sentinel effort-looking keys as ordinary env. Please pin the custom-wrapper case with a snapshot regression test.

The authority, normalization, mutation, local/remote launch, and reader paths were otherwise coherent in the read-only diff review. Existing checks on this immutable head are green; PR code was not executed locally under the automation trust policy.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested at exact head 239cbdd30cefee7a3a28d02271fc21de5226967f.

P2 — Mixed-case ACP sentinel changes for a custom runtime still disappear from restart snapshots

The new custom-runtime snapshot scoping fixes non-sentinel keys such as GOOSE_THINKING_EFFORT, but it still loses a mixed-case ACP sentinel on Windows.

For an unknown/custom runtime, launch projection deliberately uses an empty suppression set (desktop/src-tauri/src/managed_agents/config_bridge/effort.rs:246-259), so a user-provided buzz_acp_effort_level=high survives into the child environment when no canonical column overwrites it. Windows treats that key as BUZZ_ACP_EFFORT_LEVEL. Snapshot extraction, however, reads the destination with an exact-case map lookup (desktop/src-tauri/src/managed_agents/spawn_snapshot.rs:153-157), yielding no effort_level, then removes every case variant of the sentinel (spawn_snapshot.rs:194-203; config_bridge/effort.rs:208-226). Changing that effective child input therefore changes neither snapshot field, so restart-required remains false and a running custom agent can keep stale effort.

Make unknown-runtime snapshot handling mirror actual projection semantics: either capture the sentinel case-insensitively before stripping it, or retain a pass-through sentinel when projection did not emit/consume it. Add mixed-case custom-runtime regressions with and without a canonical column. The new test at spawn_snapshot/tests_ext.rs:239-275 covers only exact-case GOOSE_THINKING_EFFORT, so it does not exercise this collision.

The prior non-sentinel custom-runtime blocker is otherwise closed. I reviewed immutable GitHub source and diffs only; no PR code was checked out or executed. Hosted checks were green at review time.

[wesbillman]

Carl, an automated reviewer, commenting via Wes's GitHub account.

The write/spawn projection is internally consistent, but the global/onboarding Goose Effort control still persists the legacy Buzz key that the new projection intentionally does not consume from the global tier.

• deriveAgentConfigFieldModel sets currentPersistence.key and its displayed value to BUZZ_AGENT_THINKING_EFFORT for every runtime with thinkingEnvVar, while only targetApplication uses runtime.thinkingEnvVar (desktop/src/features/agents/lib/agentConfigCore.ts:206-220). AgentConfigFields reads and writes through that persistence key (desktop/src/features/agents/ui/AgentConfigFields.tsx:244-257,638-640,876-885). Selecting Goose effort therefore saves the legacy key rather than GOOSE_THINKING_EFFORT.
• The launch authority accepts the legacy alias only at record/persona scope; its global tier reads the runtime-native key only (desktop/src-tauri/src/managed_agents/config_bridge/effort.rs:362-383). The UI consequently shows the global Goose setting as saved, but the next Goose spawn silently ignores it.

Please make the global/onboarding persistence contract match the launch projection, and add a regression covering global Goose selection through the persisted env to a projected GOOSE_THINKING_EFFORT descriptor.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head 7c0278288b24586d3e5a41857e8b7446c7770817 against base bd73490418266f267d9bb3bdf13e64582adc8e80. This is a bounded corrective review of the existing Save-gated, next-spawn native-effort contract, with local-only instance writes and deployment-owned remote configuration.

P2: Preserve model cleanup while preserving native effort

The new unconditional return at AgentConfigFields.tsx:480–496 stops the feedback loop but also skips clearing the previous provider's model.

Source-derived reproduction: in Defaults, select Goose with Anthropic and a model, then choose Custom provider… and enter a different provider ID. The actual Custom selection handler retains config.model; the new native-effort return prevents the one-time cleanup, and the custom input changes only provider. The previous provider-specific model survives into Save and is submitted with the new provider. During the blank Custom state, the model control even presents an empty/disabled value while validity still reads the retained model.

Smallest repair: return only when no eligible field needs clearing. Clear the model once, but preserve native effort; with a null model and native effort alone, emit nothing. Add a stateful-parent regression that invokes the real provider control, checks bounded config-change emissions, model === null, and preserved GOOSE_THINKING_EFFORT=off, then exercises Save/reread.

The current Custom-switch test replaces props directly, never setting userEditedProviderRef, and does not feed changes through React state. The separate Save test has a nonempty provider throughout. Neither establishes the claimed provider-to-Custom convergence proof.

P2: Remove or test-gate the obsolete production strip helper

After runtime moved to apply_spawn_effort_env, effort.rs:257–269 retains strip_effort_keys_from_command as non-test code, but its remaining callers are the old helper tests. The exact-head Desktop Core job fails deterministically in desktop-tauri-clippy:

error: function `strip_effort_keys_from_command` is never used
--> src/managed_agents/config_bridge/effort.rs:257:15
= note: `-D dead-code` implied by `-D warnings`
error: could not compile `buzz-desktop` (lib) due to 1 previous error

Remove the obsolete helper and migrate its assertions to the live boundary, or make it test-only if it still has a useful test role. Do not restore its unconditional production call: that would reintroduce the custom-wrapper environment loss.

Closed findings and validation limits

The prior render loop itself, inherited custom-wrapper environment loss, and Windows /usr/bin/env failure are addressed in source. The exact-head Windows Rust job is successful. The local set/clear/absent persistence seam and env-before-effort ordering remain intact; configured descriptor projection still feeds local launch, deployment, and restart snapshots.

All three independent review lanes returned and were integrated. Review used immutable source/diffs and hosted check metadata/logs only: no checkout, build, test, import, or execution of PR code. Desktop smoke shards 3/4 also report failures; their causes were not investigated or attributed here. Previously deferred live-ACP and baked-reader policies are not reopened. Exit criteria are the two repairs above with the real provider-transition regression and a passing Desktop Core gate.

[kalvinnchau]

🤖 Approved at 4caa6117322ac0f1caf20d7e8976a93b1cbf1bf1. No findings in the final delta. The parent journeys now bind real effort selection to zero pre-save writes, the exact Save/Next payload, and a fresh reread of the stored response; the mutex and agent guidance now state only what the implementation guarantees. Independent targeted run: 7/7 passed. Scores: minimalness 9/10, elegance 9/10, correctness 9/10. Residual risk: no installed-Goose end-to-end run at this head; real child-process environment coverage remains the terminal automated boundary.

addressed