feat(orchestration): assess secondary work readiness

CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+### Secondary Eligibility & Work Readiness — vNext.10.2 Phase 6
+
+- Added deterministic, versioned `WorkReadinessAssessment` and
+  `SecondaryEligibilityDecision` records for individual Objective WorkUnits,
+  covering knowledge, decision entropy, implementation specificity, trusted
+  verification, Phase 5 context quality, authority/contract risk, repository
+  mutation scope, and dependency readiness.
+- Added typed, explainable blocker precedence for `ELIGIBLE`,
+  `STRONG_REQUIRED`, `NEEDS_RESEARCH`, `NEEDS_AUTHORITY`, `NEEDS_CONTEXT`, and
+  `NOT_READY`, including research-resolved engineering work without allowing
+  recommendations to replace approved product authority.
+- Added stable input-bound assessment identity, durable Objective records,
+  aggregate readiness telemetry, inspect rendering, and a compatibility bridge
+  that leaves non-Objective task-level suitability behavior intact.
+- Integrated admission after Builder Packet compilation for explicitly selected
+  Secondary attempts. Parent Objective complexity is advisory, and default
+  builder routing, automatic fallback, repair, quota/economic policy, and model
+  selection remain unchanged.
+
 ### Builder Packet & Repository Code Retrieval — vNext.10.2 Phase 5
 
 - Added a deterministic `BuilderPacketCompiler` that turns an explicitly

contracts/orchestration-contract.json

@@ -127,6 +127,11 @@
     "SMALL",
     "UNKNOWN"
   ],
+  "decisionEntropies": [
+    "HIGH",
+    "LOW",
+    "MEDIUM"
+  ],
   "defectSources": [
     "CONFIGURATION",
     "CONTEXT_RETRIEVAL",
@@ -141,6 +146,12 @@
     "LOW",
     "MEDIUM"
   ],
+  "dependencyReadinessStates": [
+    "AMBIGUOUS",
+    "INCOMPLETE",
+    "READY",
+    "STALE"
+  ],
   "dogfoodRunStatuses": [
     "ABANDONED",
     "COMPLETED",
@@ -397,6 +408,11 @@
     "RUNTIME_FAILURE",
     "UNNECESSARY_CLARIFICATION"
   ],
+  "implementationSpecificities": [
+    "ABSTRACT",
+    "BOUNDED",
+    "CONCRETE"
+  ],
   "intentOutcomes": [
     "BLOCKED",
     "NEEDS_CLARIFICATION",
@@ -557,6 +573,7 @@
     "scheduling_decision_created",
     "secondary_builder_attempted",
     "secondary_candidate_succeeded",
+    "secondary_readiness_assessed",
     "self_heal_applied",
     "semantic_review_completed",
     "supervisor_attached",
@@ -608,6 +625,12 @@
     "WAITING_RESOURCE",
     "WAITING_RETRY"
   ],
+  "knowledgeStates": [
+    "EXTERNAL_UNKNOWN",
+    "KNOWN",
+    "RESOLVED_BY_RESEARCH",
+    "UNCERTAIN"
+  ],
   "laneDecisions": [
     "API",
     "DEFER",
@@ -909,6 +932,11 @@
     "PASS",
     "PASS_WITH_LIMITATIONS"
   ],
+  "repositoryMutationScopes": [
+    "BOUNDED",
+    "BROAD",
+    "UNKNOWN"
+  ],
   "repositorySizeClasses": [
     "LARGE",
     "MEDIUM",
@@ -1071,6 +1099,14 @@
     "TIMEOUT",
     "VERIFICATION_FAILURE"
   ],
+  "secondaryEligibilityStatuses": [
+    "ELIGIBLE",
+    "NEEDS_AUTHORITY",
+    "NEEDS_CONTEXT",
+    "NEEDS_RESEARCH",
+    "NOT_READY",
+    "STRONG_REQUIRED"
+  ],
   "stateInvariantIds": [
     "API_BUDGET_RECONCILES",
     "ATTEMPTS_REFERENCE_KNOWN_NODES",
@@ -1120,6 +1156,46 @@
     "DETERMINISTIC",
     "NONE"
   ],
+  "workReadinessContextStates": [
+    "AMBIGUOUS",
+    "INSUFFICIENT",
+    "SUFFICIENT"
+  ],
+  "workReadinessReasonCodes": [
+    "ABSTRACT_IMPLEMENTATION",
+    "APPROVED_AUTHORITY",
+    "AUTHORITY_UNRESOLVED",
+    "BOUNDED_TARGET",
+    "BROAD_MUTATION_SCOPE",
+    "CONCRETE_TARGET",
+    "CONTEXT_INSUFFICIENT",
+    "CONTEXT_SUFFICIENT",
+    "CONTRACT_MUTATION_REQUIRED",
+    "DEPENDENCIES_READY",
+    "DEPENDENCY_AMBIGUOUS",
+    "DEPENDENCY_NOT_READY",
+    "DEPENDENCY_STALE",
+    "HIGH_DECISION_ENTROPY",
+    "KNOWLEDGE_EXTERNAL_UNKNOWN",
+    "KNOWLEDGE_UNCERTAIN",
+    "KNOWN_IMPLEMENTATION_FACTS",
+    "LOW_DECISION_ENTROPY",
+    "MEDIUM_DECISION_ENTROPY",
+    "NO_TRUSTED_VERIFICATION",
+    "PARENT_COMPLEXITY_ADVISORY",
+    "REFERENCE_PATTERN_AVAILABLE",
+    "RESEARCH_RESOLVED",
+    "STRONG_VERIFICATION",
+    "TARGET_AMBIGUOUS",
+    "TEST_COVERAGE_AVAILABLE",
+    "UNKNOWN_MUTATION_SCOPE",
+    "WEAK_TRUSTED_VERIFICATION"
+  ],
+  "workReadinessVerificationStrengths": [
+    "NONE",
+    "STRONG",
+    "WEAK"
+  ],
   "workUnitKinds": [
     "build",
     "integration",

contracts/schema-versions.json

@@ -64,6 +64,7 @@
   "secondaryBuilderAttempt": "1.1.0",
   "secondaryBuilderPacket": "1.1.0",
   "secondaryBuilderResult": "1.1.0",
+  "secondaryEligibilityDecision": "1.0.0",
   "specIntakeApproval": "1.0.0",
   "specIntakeDelta": "1.0.0",
   "specIntakeGrounding": "1.0.0",
@@ -85,5 +86,7 @@
   "verificationPolicy": "1.0.0",
   "verificationReport": "1.0.0",
   "workGraph": "1.0.0",
+  "workReadinessAssessment": "1.0.0",
+  "workReadinessTelemetry": "1.0.0",
   "zeroTouchCertification": "1.0.0"
 }

docs/README.md

@@ -159,6 +159,9 @@ the intent in the evening, run one command, read the report in the morning.
 - [Builder Packet compilation](orchestration/builder-packet-compilation.md)
   — deterministic, fresh, bounded source/test/dependency retrieval for an
   explicitly selected Secondary Builder; context quality without routing.
+- [Secondary Work Readiness](orchestration/secondary-work-readiness.md)
+  — deterministic Phase 6 per-WorkUnit admission, blockers, freshness, and
+  telemetry without automatic routing.
 - [Context projection](orchestration/context-projection.md) — share truth,
   not context: what each isolated worker sees, hashed and staleness-checked.
 - [Sub-agent isolation](orchestration/subagent-isolation.md) — worker

docs/local-model.md

@@ -9,7 +9,11 @@ can also use this endpoint for bounded worktree edits. One managed server serves
 every logical role — roles are prompts, not processes.
 Its [Builder Packet compiler](orchestration/builder-packet-compilation.md)
 selects fresh source and tests first, so the direct model needs no repository
-tools for ordinary bounded implementation work.
+tools for ordinary bounded implementation work. Phase 6
+[Secondary Work Readiness](orchestration/secondary-work-readiness.md) then
+checks the individual WorkUnit's knowledge, entropy, specificity, trusted
+verification, context, authority, mutation scope, and dependencies. This is
+admission evidence only; it does not automatically route work to the model.
 
 The local model is a **worker**, never an authority: its answers are
 schema-validated structured proposals that deterministic policy accepts,

docs/orchestration/builder-packet-compilation.md

@@ -117,9 +117,10 @@ worktree.
 Missing explicit targets, unresolved verified dependencies, protected or
 unmaterializable target source, and equal plausible targets stop compilation.
 During inference the model may also return `NEEDS_MORE_CONTEXT` with bounded
-reasons and no edits. Both paths create no candidate. Phase 6 may use recorded
-quality facts for eligibility; Phase 7 may decide widening, repair, or
-fallback. Neither policy exists in Phase 5.
+reasons and no edits. Both paths create no candidate. Phase 6 consumes the
+recorded quality facts for
+[Secondary Work Readiness](secondary-work-readiness.md); Phase 7 may decide
+widening, repair, or fallback. Neither policy exists in Phase 5.
 
 Metrics record indexed files considered, ranked candidates, selected files
 and sections, source/test characters, reference/dependency counts, budget
@@ -144,5 +145,6 @@ the local server/model environment variables documented in
 are present.
 
 Builder Packet compilation does not decide which model should execute the
-task. Phase 6 eligibility, Phase 7 routing/repair/fallback, LLM Gateway,
-Vector RAG, and OpenMind are not implemented here.
+task. Phase 6 consumes its results as admission evidence; Phase 7
+routing/repair/fallback, LLM Gateway, Vector RAG, and OpenMind are not
+implemented here.

docs/orchestration/secondary-objective-builder.md

@@ -19,7 +19,10 @@ to the secondary backend. With no explicit `secondaryObjectiveBuilder`
 selection, BUILDER behavior remains the existing large-agent path. Automatic
 eligibility, routing, repair, and fallback belong to later phases. Phase 5
 adds deterministic [Builder Packet compilation](builder-packet-compilation.md)
-without changing this explicit-only selection rule.
+without changing this explicit-only selection rule. Phase 6 adds
+[Secondary Work Readiness](secondary-work-readiness.md): an explicitly selected
+attempt must be eligible before inference, but eligibility still does not
+select or automatically route a backend.
 
 ## Not an Agent Harness
 
@@ -114,7 +117,9 @@ verification failure, and an oversized context. A model may return the
 structured `NEEDS_MORE_CONTEXT` status; this records an insufficient attempt
 and creates no candidate.
 Phase 4 performs no secondary repair retry and no automatic large-model
-fallback.
+fallback. Phase 6 preserves that behavior: a readiness blocker is recorded
+with its own research, authority, context, dependency, or strong-reasoning
+meaning and is never converted into a silent fallback.
 
 ## Qualification
 

docs/orchestration/secondary-work-readiness.md

@@ -0,0 +1,135 @@
+# Secondary Work Readiness
+
+Phase 6 of vNext.10.2 adds deterministic admission policy for the Secondary
+Objective Builder. It answers whether one concrete Objective `WorkUnit` is a
+legitimate Secondary candidate. It does not select a model or change default
+routing.
+
+```text
+WorkUnit + approved ContextProjection
+         + Phase 5 Builder Packet quality
+         + trusted verification policy
+         + dependency and relevant ResearchRecord identity
+    ↓
+WorkReadinessAssessment
+    ↓ deterministic policy
+SecondaryEligibilityDecision
+```
+
+The unit, rather than its parent Objective, is the policy boundary. Parent
+Objective complexity is retained as advisory evidence only. A 17-file field
+propagation can be bounded, mechanical, and strongly verified, so it may be
+eligible. A three-line concurrency fix can leave several ordering and
+duplicate-delivery semantics open, so it requires strong reasoning. File and
+line counts are not proxies for intelligence difficulty.
+
+## Assessment dimensions
+
+`WorkReadinessAssessment` is a versioned derived execution record. It contains
+the following auditable categories:
+
+- `knowledgeState`: `KNOWN`, `RESOLVED_BY_RESEARCH`, `UNCERTAIN`, or
+  `EXTERNAL_UNKNOWN`. Only completed, conflict-free engineering, compatibility,
+  or domain facts can resolve a knowledge gap. A research recommendation does
+  not grant product authority.
+- `decisionEntropy`: `LOW`, `MEDIUM`, or `HIGH`. Explicit targets, established
+  patterns, precise behavior, and tests reduce the open implementation choices.
+  Design, architecture, concurrency, security, ambiguous ownership, and
+  unresolved semantic choices are high entropy. This is deterministic pattern
+  classification, not an LLM score.
+- `implementationSpecificity`: `ABSTRACT`, `BOUNDED`, or `CONCRETE`. Phase 5
+  target resolution and packet quality are the primary evidence; Phase 6 does
+  not perform another repository retrieval.
+- `verificationStrength`: `NONE`, `WEAK`, or `STRONG`. Only configured,
+  SpecBridge-controlled verification counts. Tests, schemas, exact fixtures,
+  and deterministic integration checks are strong; compile- or lint-only
+  verification is weak; model claims never count.
+- `contextState`: `SUFFICIENT`, `INSUFFICIENT`, or `AMBIGUOUS`, mapped from the
+  Phase 5 compilation outcome and quality facts. `INSUFFICIENT_CONTEXT` and
+  `AMBIGUOUS_TARGET` become context blockers, not intelligence blockers.
+- `authorityRisk` and `contractMutationRisk`: implementing approved truth is
+  allowed, but choosing product behavior or changing a compatibility/public
+  contract without approved authority is not.
+- `repositoryMutationScope`: `BOUNDED`, `BROAD`, or `UNKNOWN`. A known related
+  module can remain bounded across many files; an architecture-wide migration
+  or an unresolved impact surface cannot.
+- `dependencyState`: `READY`, `INCOMPLETE`, `STALE`, or `AMBIGUOUS`, using the
+  existing WorkGraph and verified dependency-candidate evidence.
+
+Phase 5 facts such as `explicitTargetResolved`, `targetAmbiguity`,
+`testsFound`, `referencePatternFound`, `dependencyContextComplete`,
+`verificationHintsAvailable`, and `contextSufficient` are consumed directly.
+
+## Decisions and precedence
+
+`SecondaryEligibilityDecision` has six outcomes:
+
+- `ELIGIBLE`: Secondary is a legitimate candidate; it is not a dispatch order.
+- `STRONG_REQUIRED`: the work is known and ready but needs stronger reasoning,
+  is abstract or broad, or lacks strong trusted verification.
+- `NEEDS_RESEARCH`: material external knowledge is unresolved.
+- `NEEDS_AUTHORITY`: an approved human/product or contract decision is missing.
+- `NEEDS_CONTEXT`: Phase 5 context is insufficient or ambiguous.
+- `NOT_READY`: dependency evidence is incomplete, stale, or ambiguous.
+
+Blockers use deterministic precedence:
+
+```text
+NEEDS_AUTHORITY
+  > NEEDS_RESEARCH
+  > NOT_READY
+  > NEEDS_CONTEXT
+  > STRONG_REQUIRED
+  > ELIGIBLE
+```
+
+Authority and contract risk, non-sufficient context, uncertain or external
+knowledge, high entropy, abstract specificity, no trusted verification,
+unknown mutation scope, and non-ready dependencies are hard non-eligibility
+gates. Medium-entropy work may be eligible when the remaining evidence is
+strong. Phase 6 deliberately treats weak verification conservatively as
+`STRONG_REQUIRED`; there is no weak-verification opt-in policy yet.
+
+Every decision carries typed reason codes and human-readable explanations.
+Examples include `AUTHORITY_UNRESOLVED`, `CONTRACT_MUTATION_REQUIRED`,
+`TARGET_AMBIGUOUS`, `KNOWLEDGE_EXTERNAL_UNKNOWN`,
+`HIGH_DECISION_ENTROPY`, `NO_TRUSTED_VERIFICATION`,
+`DEPENDENCY_NOT_READY`, `CONCRETE_TARGET`, `STRONG_VERIFICATION`,
+`REFERENCE_PATTERN_AVAILABLE`, and `RESEARCH_RESOLVED`. The inspect rendering
+shows categories and evidence references without exposing hidden reasoning.
+
+## Durability, freshness, and telemetry
+
+The Objective store writes one record per WorkUnit attempt beneath:
+
+```text
+.specbridge/jobs/<jobId>/objectives/<nodeId>/readiness/
+```
+
+The semantic identity binds the WorkUnit, Builder Packet and packet-quality
+facts, approved projection, relevant ResearchRecords, verification policy, and
+dependency evidence. Timestamps are excluded. Identical durable inputs reuse
+the assessment; a changed packet/source, contract projection, dependency,
+verification command, or relevant research record invalidates it.
+
+Aggregate telemetry records the assessment count and distributions for status,
+typed reasons, entropy, verification strength, and context state. These records
+support later eligibility and success-rate analysis but do not implement a
+numeric confidence score or learned routing.
+
+## Runtime and compatibility boundary
+
+For an explicitly selected Secondary path, packet compilation is followed by
+readiness assessment before inference. A non-eligible decision records evidence
+and stops that explicit attempt; it does not silently reroute or fall back.
+Ordinary Objective execution without an explicit Secondary selection remains
+on the existing builder path.
+
+The earlier task-level `LOCAL_SAFE` / `LOCAL_TRY` / `STRONG_REQUIRED`
+suitability policy remains in place for non-Objective scheduler flows. A small
+compatibility bridge can translate an Objective readiness record where needed,
+without reapplying parent-complexity vetoes.
+
+Phase 7 owns automatic routing, availability, quota/economic policy, repair,
+and fallback. Phase 8 cooldown continuation, LLM Gateway, remote-model
+registries, learned routing, and OpenMind are also outside Phase 6.

integrations/claude-code-plugin/specbridge/dist/checksums.json

@@ -7,12 +7,12 @@
       "bytes": 155994
     },
     "cli.cjs": {
-      "sha256": "8bc205156d51810ec082b0e9aa3be5d2f12c307706e680796ca4909360dee2e7",
-      "bytes": 5634305
+      "sha256": "a1df42b6e1b0bf453621c67ead827b85c198c67ecd4ffa6a79ba869a85b3059c",
+      "bytes": 5668507
     },
     "mcp-server.cjs": {
-      "sha256": "3854958225b757a1e0a2197471faf308fbf4a97ab58c51507114e7009748aea5",
-      "bytes": 3654373
+      "sha256": "5662f65d484174b74f1605a99872cafa0adfd8ff6320e848260011c80f3ef7cd",
+      "bytes": 3660029
     }
   }
 }