feat(routing): add provider cooldown failover and network recovery

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "superpowers-v",
       "description": "Compound V for Superpowers: triple parallel pre-flight (code archaeology + domain-expert + Context7 library validator), disjoint partitioning, manifest-driven multi-backend dispatch (Claude + Codex + Antigravity + Cursor), git-diff scope enforcement, crash-resumable runs, adaptive tier-based routing, epic mode, research-grounded brainstorming (gated pre-brainstorm recon + batched elicitation), V-memory local-first semantic+lexical recall over docs/superpowers (opt-in pure-python embeddings + a deterministic recall→action bridge), and batched parallel dispatch (Opus default, narrow Sonnet exception)",
-      "version": "2.17.0",
+      "version": "2.18.0",
       "source": "./",
       "author": {
         "name": "Oleg",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "superpowers-v",
   "description": "Compound V for Superpowers: triple parallel pre-flight (code archaeology + domain-expert advisor + library/doc validator via Context7), disjoint file partitioning, manifest-driven multi-backend dispatch (Claude + headless Codex + Antigravity + Cursor workers), git-diff scope enforcement, crash-resumable runs, adaptive tier-based routing, epic mode for multi-feature builds, V-memory local-first semantic+lexical recall over docs/superpowers (opt-in pure-python embeddings + a deterministic recall\u2192action bridge), and batched parallel dispatch (Opus default, Sonnet for narrow junior-task carve-out), plus /v:onboard — a project-onboarding command that builds a citation-verified knowledge base + AGENTS.md/CLAUDE.md bridge behind a human gate. Auto-intercepts four transitions: pre-brainstorm recon \u2192 brainstorming \u2192 writing-plans \u2192 execution.",
-  "version": "2.17.0",
+  "version": "2.18.0",
   "author": {
     "name": "Oleg",
     "email": "copeus@gmail.com"

.github/workflows/validate.yml

@@ -123,7 +123,13 @@ jobs:
           # The deterministic manifest validator is the partition gate. A missing
           # validator is a HARD failure (a rename must never silently drop the gate).
           test -f scripts/compound-v-validate-manifest.py || { echo "❌ scripts/compound-v-validate-manifest.py is missing — the partition gate would silently vanish"; exit 1; }
-          python3 scripts/compound-v-validate-manifest.py examples/manifest.example.yaml
+          # examples/compound-v.example.json seeds a pools.balanced.light entry
+          # (codex + cursor — neither needs a secret/env var to resolve) so
+          # task-3-docs's `backend: pool` job exercises the real pool
+          # validation path in CI, not only the script's own --selftest
+          # fixtures. Scoped to this one file via --config; every other
+          # tracked manifest below is validated with no config, unaffected.
+          python3 scripts/compound-v-validate-manifest.py --config examples/compound-v.example.json examples/manifest.example.yaml
           echo "✅ example manifest passes the invariant gate"
           # Also validate every tracked run-manifest — exercise the gate on real data,
           # not just one curated fixture.
@@ -193,10 +199,24 @@ jobs:
             echo "✅ $hook is executable"
           done
 
-      - name: Lint hook scripts with shellcheck
+      - name: Lint hook and worker scripts with shellcheck
         run: |
           sudo apt-get install -y shellcheck
           shellcheck hooks/*.sh
+          # scripts/*.sh was NEVER linted before v2.18 — the worker scripts and their test
+          # harnesses, the largest shell surface in the repo, had no static analysis at all.
+          shellcheck scripts/*.sh
+
+      - name: Run bash test suites
+        run: |
+          # No CI step ran any scripts/test-*.sh before v2.18: the selftest sweep below covers
+          # scripts/*.py only, so every bash-level proof in this repo was manual-only.
+          # Tests that need a CLI this runner does not have exit 0 with SKIP.
+          set -e
+          for t in scripts/test-*.sh; do
+            echo "--- $t"
+            bash "$t"
+          done
 
       # FINAL step — run the repo-wide dead-link scan only after every file exists,
       # so cross-refs to files authored by later batches resolve at integration time.

.gitignore

@@ -5,6 +5,13 @@ node_modules/
 .env.local
 docs/superpowers/_runs/
 
+# Python bytecode cache. Committed __pycache__/*.pyc (added incidentally by a CI commit)
+# spuriously BLOCKs any job whose acceptance runs a Python selftest: a fresh worktree's
+# tracked bytecode gets rewritten by the interpreter, and the scope gate treats those
+# rewrites as out-of-scope changes.
+__pycache__/
+*.pyc
+
 # Compound V orchestrator run artifacts.
 # Worktrees live under $TMPDIR/compound-v/<run-id>/<job-id> (outside the repo) by
 # design; these guards catch any that accidentally land in-tree, plus the codex

CHANGELOG.md

@@ -4,6 +4,82 @@ All notable changes to **superpowers-v (Compound V)** are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project uses semantic versioning.
 
+## [Unreleased]
+
+### Added — three-provider cooldown recovery
+
+Pool dispatch now persists backend cooldowns, exact-model exclusions, correlated no-response network
+pauses, leased recovery probes, and attempt-specific launch bindings across Codex, Claude, and z.ai.
+Provider waits above 60 seconds reroute or halt resumably; only the exact leased attempt's completed
+normalized success clears health state.
+
+Cooldowns are deliberately backend-wide because CLI output does not expose limiter identity. This
+may temporarily sideline a healthy model or credential, but prevents retry herds. It is not quota
+balancing: Compound V does not poll balances, infer percentages, or dynamically adjust pool weights.
+
+### Added — deterministic weighted tier model pools
+
+A manifest job may now route through `backend: pool` for `standard` or `light` work. Pools are configured per stance and tier, rotate by manifest-order job ordinal, support positive integer weights, and resolve every member through the existing tier model map. The eligible weighted ring and each concrete backend/model assignment are frozen into `state.json`, so dispatch timing, config edits, and `/v:resume` cannot silently move an in-flight job.
+
+Pool routing remains inside the existing safety boundary: pooled jobs require worktree isolation; reviewers, deep-tier work, sensitive surfaces, `xhigh`, explicit manifest models, and `advisor_backend: pool` are rejected. The dispatcher passes only the resolved concrete backend/model to adapters, failure classification, usage, memory, scorecards, and status. As refined by the cooldown recovery entry above, the first short throttle/overload preserves the assignment; subsequent or explicitly timed transient failures may cooldown and advance through the validated transition, while confirmed permanent exhaustion opens its circuit. Canonical health state and resume assignments are validated fail-closed.
+
+`claude` is not included in the shipped pool example because its usage limit is shared with the operator's interactive Claude/Claude Code session; adding it is an explicit opt-in. This change is merge-dependent on the z.ai backend in PR #5, but does not claim that PR is already merged.
+
+#### What this does not show
+
+Weighted rotation distributes **job counts**, not tokens, credits, messages, wall-clock time, quota burn, savings, or provider capacity. Those meters are heterogeneous and are not visible through Compound V's CLI-process transport; no balance percentage or improvement metric is produced. z.ai's credit multiplier also varies by time of day, so equal job counts can consume unequal credits even on the same provider.
+
+## [2.18.0] - 2026-08-01
+
+### Added — `zai`, a headless GLM worker backend (lower-trust, opt-in, WORKER-ONLY)
+
+A sixth dispatch backend, so codex, claude and z.ai can run jobs concurrently on separate
+quotas. It is a Bash-spawned `claude -p` process pointed at z.ai's Anthropic-compatible
+endpoint, in its own git worktree, under the process-group supervisor, with the dispatcher's
+provider credentials scrubbed by `env -i` and `HOME`/`CLAUDE_CONFIG_DIR` redirected to a
+scratch directory. z.ai ships no headless CLI of its own; Claude Code is a tier-1 officially
+supported tool for the GLM Coding Plan, so driving the genuine binary is the compliant path.
+
+Enforcement is unchanged — the existing git-derived scope gate. **There is no kernel
+write-confinement**: the worktree plus `git diff` detects an in-worktree scope leak but cannot
+prevent an out-of-worktree side effect, the same trust tier as antigravity and cursor. `zai`
+is worker-only: never a reviewer (rejected by the manifest validator) and never an arbiter
+seat (`model_family()` carries no `glm` needle, so a GLM ballot would bucket as `unknown`).
+
+- `scripts/compound-v-run-zai-worker.sh`, `skills/backend-launcher/adapter-zai.md`.
+- Tier map `deep`/`standard` → `glm-5.2`, `light` → `glm-5-turbo`. `light` is chosen on a
+  head-to-head measurement, not the multiplier table: turbo is 16% faster and glm-4.7 only 7%
+  cheaper in practice, because glm-4.7 emits ~60% more output.
+- `job_result.usage` carries **real** token counts from z.ai's own response (`measured: true`).
+  The CLI's `total_cost_usd` is never carried — it is computed from Anthropic's price table for
+  a model that never ran.
+- Failure classification uses z.ai's **published** 429 codes (`1113, 1302, 1305, 1308, 1310,
+  1311, 1316, 1317`). No `Retry-After` header exists, and enforcement throttling is
+  indistinguishable on the wire from ordinary rate limiting, so the retry ceiling stays low and
+  the breaker opens early.
+- Default `max_parallel` for zai is 4. Six concurrent jobs measured clean, but z.ai publishes
+  no concurrency limit and adjusts it by plan tier.
+
+### Fixed
+
+- **A z.ai quota wall no longer halts a run.** `FALLBACK` in `compound-v-failure-policy.py`
+  had no `zai` key; a missing key reads as `None`, which the policy turns into `halt`. (`devin`
+  and `opencode` are still absent from that table — pre-existing, untouched here.)
+- **`compound-v-usage-extract.py` now parses `--output-format json` as a JSON document.**
+  Line-wise parsing silently yielded nothing the moment the document was pretty-printed.
+
+### CI
+
+Two gates that did not exist are now enforced: `shellcheck` over `scripts/*.sh` (it covered
+only `hooks/*.sh`, leaving every worker script unlinted) and a step that runs the
+`scripts/test-*.sh` suites (nothing ran them; the sweep covered `scripts/*.py` only).
+
+A new `scripts/test-zai-wire-smoke.sh` runs the **real** `claude` binary against a local stub
+HTTP server — no network, no key, no quota — and asserts the tool set that actually reaches
+the wire. That check exists because argv assertions cannot catch this class of defect:
+`--allowedTools` decides which tools run unprompted, `--tools` decides which tools exist, and
+an earlier draft of this backend pinned only the former and shipped a worker with `Bash` it
+meant to withhold and no `Write` at all.
 ## [2.17.0] - 2026-07-26
 
 ### Added — Co-change advisory (ordered, git-derived) + failure-prioritized evidence packing