SynkraAI
diff --git a/‎.aiox-core/cli/commands/config/index.js‎
Lines changed: 1 addition & 1 deletion b/‎.aiox-core/cli/commands/config/index.js‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.aiox-core/cli/commands/sdc/index.js‎
Lines changed: 49 additions & 3 deletions b/‎.aiox-core/cli/commands/sdc/index.js‎
Lines changed: 49 additions & 3 deletions
diff --git a/‎.aiox-core/cli/commands/wave/index.js‎
Lines changed: 5 additions & 0 deletions b/‎.aiox-core/cli/commands/wave/index.js‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎.aiox-core/core/execution/parallel-executor.js‎
Lines changed: 6 additions & 3 deletions b/‎.aiox-core/core/execution/parallel-executor.js‎
Lines changed: 6 additions & 3 deletions
diff --git a/‎.aiox-core/core/execution/parallel-monitor.js‎
Lines changed: 4 additions & 2 deletions b/‎.aiox-core/core/execution/parallel-monitor.js‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎.aiox-core/core/execution/wave-executor.js‎
Lines changed: 5 additions & 2 deletions b/‎.aiox-core/core/execution/wave-executor.js‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎.aiox-core/core/orchestration/agent-invoker.js‎
Lines changed: 14 additions & 6 deletions b/‎.aiox-core/core/orchestration/agent-invoker.js‎
Lines changed: 14 additions & 6 deletions
diff --git a/‎.aiox-core/core/orchestration/terminal-spawner.js‎
Lines changed: 47 additions & 16 deletions b/‎.aiox-core/core/orchestration/terminal-spawner.js‎
Lines changed: 47 additions & 16 deletions
@@ -415,7 +415,7 @@ function splitL4(config) {
   // mcp_configuration (Section 5)
   if (config.mcp) l4.mcp = config.mcp;
 
-  // coderabbit secrets/machine (Section 9 - machine portion)
+  // coderabbit secret and machine config (Section 9 - machine portion)
   if (config.coderabbit_integration) {
     const cr = config.coderabbit_integration;
     const l4cr = {};
 
@@ -11,10 +11,17 @@
 
 'use strict';
 
+const fs = require('fs');
 const path = require('path');
 const { Command } = require('commander');
+const { assertDispatchGovernance } = require('../../../core/permissions');
 const sdc = require('../../../core/sdc');
 
+/**
+ * Build the `aiox sdc` Commander command tree.
+ *
+ * @returns {Command} Configured SDC command.
+ */
 function createSdcCommand() {
   const cmd = new Command('sdc');
   cmd.description('Lean Full SDC runtime (plan, verify, progress)');
@@ -26,6 +33,38 @@ function createSdcCommand() {
       console.log(sdc.PHASES.join('\n'));
     });
 
+  cmd
+    .command('preflight')
+    .description('Enforce model budget, story binding, and intent scan before dispatch')
+    .argument('<story-path>', 'Path to the story bound to the model call')
+    .requiredOption('--budget-usd <amount>', 'Positive model budget ceiling in USD')
+    .requiredOption('--intent-file <path>', 'File containing the exact child model intent')
+    .option('--context-file <path>', 'File containing the exact child context')
+    .option('--task <task>', 'Dispatch task name', 'develop')
+    .option('--json', 'JSON evidence output', false)
+    .action((storyPath, opts) => {
+      try {
+        const absoluteStoryPath = path.resolve(storyPath);
+        const intent = fs.readFileSync(path.resolve(opts.intentFile), 'utf8');
+        const context = opts.contextFile
+          ? fs.readFileSync(path.resolve(opts.contextFile), 'utf8')
+          : '';
+        const evidence = assertDispatchGovernance({
+          budgetCeilingUsd: opts.budgetUsd,
+          task: opts.task,
+          intent: `${intent}\n${context}`,
+          story: absoluteStoryPath,
+          projectRoot: path.dirname(absoluteStoryPath),
+          requiresStory: true,
+        });
+        if (opts.json) console.log(JSON.stringify(evidence, null, 2));
+        else console.log(`SDC dispatch preflight: PASS (${evidence.story.storyId})`);
+      } catch (error) {
+        console.error(`[${error.code || 'SDC_PREFLIGHT'}] ${error.message}`);
+        process.exitCode = 5;
+      }
+    });
+
   cmd
     .command('plan')
     .description('Initialize full-sdc run state for a story')
@@ -124,6 +163,7 @@ function createSdcCommand() {
       'passed | failed | skipped | halted'
     )
     .option('--notes <notes>', 'Optional notes')
+    .option('--outcome <outcome>', 'approved | changes_requested (review phase)')
     .option('--json', 'JSON output', false)
     .action((storyId, phase, opts) => {
       let state = sdc.loadSdcState(storyId);
@@ -132,10 +172,16 @@ function createSdcCommand() {
         process.exitCode = 1;
         return;
       }
-      if (phase === 'apply_qa_fixes' && opts.status === 'passed') {
-        state.qgIterations = (state.qgIterations || 0) + 1;
+      if (
+        phase === 'review' &&
+        opts.status === 'passed' &&
+        !['approved', 'changes_requested'].includes(opts.outcome)
+      ) {
+        console.error('Review passed requires --outcome approved|changes_requested');
+        process.exitCode = 1;
+        return;
       }
-      sdc.markPhase(state, phase, opts.status, opts.notes);
+      sdc.markPhase(state, phase, opts.status, opts.notes, { outcome: opts.outcome });
       sdc.saveSdcState(state);
       if (opts.json) {
         console.log(JSON.stringify(state, null, 2));
 
@@ -41,6 +41,11 @@ function resolveStoryPaths(inputs) {
   return [...new Set(out.map((p) => path.resolve(p)))];
 }
 
+/**
+ * Build the `aiox wave` Commander command tree.
+ *
+ * @returns {Command} Configured wave command.
+ */
 function createWaveCommand() {
   const cmd = new Command('wave');
   cmd.description('Lean wave-execute planner (DAG + file partition)');
 
@@ -217,16 +217,19 @@ class ParallelExecutor extends EventEmitter {
    * Wrap execution with timeout and error handling
    */
   async _wrapExecution(provider, executor) {
+    let timeoutId;
     try {
       const result = await Promise.race([
         executor(),
-        new Promise((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), this.timeout),
-        ),
+        new Promise((_, reject) => {
+          timeoutId = setTimeout(() => reject(new Error('Timeout')), this.timeout);
+        }),
       ]);
       return { ...result, provider };
     } catch (error) {
       return { success: false, error: error.message, provider };
+    } finally {
+      if (timeoutId) clearTimeout(timeoutId);
     }
   }
 
 
@@ -166,9 +166,10 @@ class ParallelMonitor extends EventEmitter {
       this.broadcast('task_completed', { taskId, task });
 
       // Remove from active after delay
-      setTimeout(() => {
+      const cleanupTimer = setTimeout(() => {
         this.activeTasks.delete(taskId);
       }, 10000);
+      cleanupTimer.unref?.();
     }
   }
 
@@ -193,9 +194,10 @@ class ParallelMonitor extends EventEmitter {
       this.broadcast('wave_completed', { waveId, wave });
 
       // Move to history after delay
-      setTimeout(() => {
+      const cleanupTimer = setTimeout(() => {
         this.activeWaves.delete(waveId);
       }, 30000);
+      cleanupTimer.unref?.();
     }
   }
 
 
@@ -206,6 +206,7 @@ class WaveExecutor extends EventEmitter {
    */
   async executeTaskWithTimeout(task, context) {
     const startTime = Date.now();
+    let timeoutId;
 
     // Track active execution
     this.activeExecutions.set(task.id, {
@@ -219,7 +220,7 @@ class WaveExecutor extends EventEmitter {
     try {
       // Create timeout promise
       const timeoutPromise = new Promise((_, reject) => {
-        setTimeout(() => {
+        timeoutId = setTimeout(() => {
           reject(new Error(`Task ${task.id} timed out after ${this.taskTimeout}ms`));
         }, this.taskTimeout);
       });
@@ -272,10 +273,12 @@ class WaveExecutor extends EventEmitter {
         duration: Date.now() - startTime,
       };
     } finally {
+      if (timeoutId) clearTimeout(timeoutId);
       // Remove from active after a delay (for monitoring)
-      setTimeout(() => {
+      const cleanupTimer = setTimeout(() => {
         this.activeExecutions.delete(task.id);
       }, 5000);
+      cleanupTimer.unref?.();
     }
   }
 
 
@@ -419,12 +419,20 @@ class AgentInvoker extends EventEmitter {
    * @private
    */
   async _executeWithTimeout(fn, timeout) {
-    return Promise.race([
-      fn(),
-      new Promise((_, reject) =>
-        setTimeout(() => reject(new Error('Task execution timed out')), timeout),
-      ),
-    ]);
+    let timeoutId;
+    try {
+      return await Promise.race([
+        fn(),
+        new Promise((_, reject) => {
+          timeoutId = setTimeout(
+            () => reject(new Error('Task execution timed out')),
+            timeout,
+          );
+        }),
+      ]);
+    } finally {
+      if (timeoutId) clearTimeout(timeoutId);
+    }
   }
 
   /**
 
@@ -12,7 +12,7 @@
 
 'use strict';
 
-const { spawn, execSync } = require('child_process');
+const { spawn, execFileSync } = require('child_process');
 const fs = require('fs').promises;
 const fsSync = require('fs');
 const path = require('path');
@@ -30,6 +30,8 @@ const RETRY_DELAY_MS = 1000;
  * @enum {string}
  */
 const ENVIRONMENT_TYPE = {
+  INLINE: 'INLINE',
+  TEST: 'TEST',
   NATIVE_TERMINAL: 'NATIVE_TERMINAL',
   VSCODE: 'VSCODE',
   SSH: 'SSH',
@@ -49,16 +51,29 @@ const ENVIRONMENT_TYPE = {
  * Detects the current execution environment (Story 12.10 - Task 1)
  *
  * Detection priority:
- * 1. CI/CD (GitHub Actions, GitLab CI, etc.)
- * 2. Docker container
- * 3. SSH session
- * 4. VS Code integrated terminal
- * 5. Native terminal (default)
+ * 1. Explicit inline/no-visual override
+ * 2. CI/CD (GitHub Actions, GitLab CI, etc.)
+ * 3. Docker container
+ * 4. SSH session
+ * 5. VS Code integrated terminal
+ * 6. Test runner
+ * 7. Native terminal (default)
  *
  * @returns {EnvironmentInfo} Environment detection result
  */
 function detectEnvironment() {
-  // 1. CI/CD detection (Task 1.5)
+  if (
+    process.env.AIOX_INLINE_MODE === 'true' ||
+    process.env.AIOX_NO_VISUAL_TERMINAL === 'true'
+  ) {
+    return {
+      type: ENVIRONMENT_TYPE.INLINE,
+      supportsVisualTerminal: false,
+      reason: 'Explicit inline/no-visual terminal mode',
+    };
+  }
+
+  // 2. CI/CD detection (Task 1.5)
   // Check common CI environment variables
   if (
     process.env.CI === 'true' ||
@@ -78,7 +93,7 @@ function detectEnvironment() {
     };
   }
 
-  // 2. Docker container detection (Task 1.4)
+  // 3. Docker container detection (Task 1.4)
   // Check for /.dockerenv file or cgroup indicators
   try {
     if (fsSync.existsSync('/.dockerenv')) {
@@ -104,7 +119,7 @@ function detectEnvironment() {
     // Ignore file read errors (e.g., on Windows)
   }
 
-  // 3. SSH session detection (Task 1.3)
+  // 4. SSH session detection (Task 1.3)
   if (process.env.SSH_CLIENT || process.env.SSH_TTY || process.env.SSH_CONNECTION) {
     return {
       type: ENVIRONMENT_TYPE.SSH,
@@ -113,7 +128,7 @@ function detectEnvironment() {
     };
   }
 
-  // 4. VS Code integrated terminal detection (Task 1.2)
+  // 5. VS Code integrated terminal detection (Task 1.2)
   if (
     process.env.TERM_PROGRAM === 'vscode' ||
     process.env.VSCODE_PID ||
@@ -127,7 +142,15 @@ function detectEnvironment() {
     };
   }
 
-  // 5. Native terminal (default) - supports visual spawn
+  if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID) {
+    return {
+      type: ENVIRONMENT_TYPE.TEST,
+      supportsVisualTerminal: false,
+      reason: 'Test runner detected (visual side effects disabled)',
+    };
+  }
+
+  // 7. Native terminal (default) - supports visual spawn
   return {
     type: ENVIRONMENT_TYPE.NATIVE_TERMINAL,
     supportsVisualTerminal: true,
@@ -146,6 +169,7 @@ const DEFAULT_OPTIONS = {
   outputDir: os.tmpdir(),
   retries: MAX_RETRIES,
   debug: false,
+  budgetCeilingUsd: process.env.AIOX_MODEL_BUDGET_CEILING_USD,
 };
 
 /**
@@ -176,10 +200,12 @@ function getScriptPath() {
 }
 
 /**
- * Validates spawn arguments
- * @param {string} agent - Agent ID
- * @param {string} task - Task to execute
- * @throws {Error} If arguments are invalid
+ * Validate the public agent and task identifiers before spawning a process.
+ *
+ * @param {string} agent - Agent ID beginning with a letter and containing only letters, digits, or hyphens.
+ * @param {string} task - Task ID beginning with a letter and containing only letters, digits, or hyphens.
+ * @returns {void}
+ * @throws {Error} When either identifier is missing, non-string, or has an invalid format.
  */
 function validateArgs(agent, task) {
   if (!agent || typeof agent !== 'string') {
@@ -308,6 +334,7 @@ function sleep(ms) {
  * @param {number} [options.timeout=300000] - Timeout in ms
  * @param {string} [options.outputDir] - Directory for output files
  * @param {boolean} [options.debug=false] - Enable debug logging
+ * @param {number|string} [options.budgetCeilingUsd] - Required automated model budget ceiling
  * @returns {Promise<SpawnResult>} Result with output and status
  */
 async function spawnInline(agent, task, options = {}) {
@@ -354,6 +381,7 @@ async function spawnInline(agent, task, options = {}) {
         AIOX_DEBUG: opts.debug ? 'true' : 'false',
         AIOX_OUTPUT_DIR: opts.outputDir,
         AIOX_INLINE_MODE: 'true', // Signal to pm.sh that we're running inline
+        AIOX_MODEL_BUDGET_CEILING_USD: String(opts.budgetCeilingUsd || ''),
       },
       stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -479,6 +507,7 @@ async function spawnInline(agent, task, options = {}) {
  * @param {string} [options.outputDir] - Directory for output files
  * @param {number} [options.retries=3] - Number of retry attempts
  * @param {boolean} [options.debug=false] - Enable debug logging
+ * @param {number|string} [options.budgetCeilingUsd] - Required automated model budget ceiling
  * @returns {Promise<SpawnResult>} Result with output and status
  *
  * @example
@@ -552,9 +581,10 @@ async function spawnAgent(agent, task, options = {}) {
         ...process.env,
         AIOX_DEBUG: opts.debug ? 'true' : 'false',
         AIOX_OUTPUT_DIR: opts.outputDir,
+        AIOX_MODEL_BUDGET_CEILING_USD: String(opts.budgetCeilingUsd || ''),
       };
 
-      const result = execSync(`bash "${scriptPath}" ${args.join(' ')}`, {
+      const result = execFileSync('bash', [scriptPath, ...args], {
         encoding: 'utf8',
         timeout: opts.timeout,
         env,
@@ -1026,6 +1056,7 @@ module.exports = {
   formatCompatibilityReport,
 
   // Utilities
+  validateArgs,
   isSpawnerAvailable,
   getPlatform,
   cleanupOldFiles,
Original file line number	Diff line number	Diff line change
`@@ -166,9 +166,10 @@ class ParallelMonitor extends EventEmitter {`
`166`	`166`	`this.broadcast('task_completed', { taskId, task });`
`167`	`167`
`168`	`168`	`// Remove from active after delay`
`169`		`- setTimeout(() => {`
	`169`	`+ const cleanupTimer = setTimeout(() => {`
`170`	`170`	`this.activeTasks.delete(taskId);`
`171`	`171`	`}, 10000);`
	`172`	`+ cleanupTimer.unref?.();`
`172`	`173`	`}`
`173`	`174`	`}`
`174`	`175`
`@@ -193,9 +194,10 @@ class ParallelMonitor extends EventEmitter {`
`193`	`194`	`this.broadcast('wave_completed', { waveId, wave });`
`194`	`195`
`195`	`196`	`// Move to history after delay`
`196`		`- setTimeout(() => {`
	`197`	`+ const cleanupTimer = setTimeout(() => {`
`197`	`198`	`this.activeWaves.delete(waveId);`
`198`	`199`	`}, 30000);`
	`200`	`+ cleanupTimer.unref?.();`
`199`	`201`	`}`
`200`	`202`	`}`
`201`	`203`