Per-target author overrides and endpoint URL files - #441

Today the author backend and model are fleet-wide (OUTERLOOP_AUTHOR_BACKEND / _MODEL / _ENDPOINT), so a deployment cannot trial a different author, such as a self-hosted model, on one target beside its usual authors. And a self-hosted server whose address changes on each restart cannot be used, because endpoint profiles take a fixed URL.

What changes

• OUTERLOOP_AUTHOR_OVERRIDES (optional deployment setting): JSON mapping a target to an author override, optionally narrowed to agent slots. Parsed and validated once at startup; a mistake is one clear error naming the setting.

  OUTERLOOP_AUTHOR_OVERRIDES='{"owner/repo":{"backend":"claude","model":"served-model[endpoint=onprem]","slots":["agent-05"]}}'
  

• The override binds to a run when it is claimed (direct climbs: at startup) and holds across wakes and resumes, even if the setting changes.
• Judges do not follow it. Panels and reviewers resolve against the fleet author exactly as without an override, so credit stays independent of the trialled model. Author/judge key separation uses the override's effective credential.
• OUTERLOOP_ENDPOINT_<NAME>_URL_FILE (alternative to _URL): a file holding a bare URL or JSON with a url key, read at each session start and wake. Before a session on such an endpoint, one bounded health request (the key in a header) checks the server answers. A missing file or a dead address defers the run: fresh runs park instead of aborting, and wakes refund the retry.
• init provisions every backend the fleet author and any override select before validating them.
• Run status and the board show each run's author backend and model, and whether it is overridden.
• claude, codex and hermes authors are peers here.

Compatibility (RELEASING.md)

Run records add optional author_overridden (default false); backend, model, endpoint selector and credential path reuse existing fields. Status JSON adds author backend/model and override information. All records previously accepted by load_record, including records without author fields and ended records, remain readable without migration (legacy fixture exercised on first read, repeated save/read and interrupted-write retry). On the first tick, existing runs and PRs keep their established author routes and resume/panel behaviour.

Fresh endpoint deferrals reuse author-sleep capacity parks without a session id; deferred wakes keep their state and refund the current delivery's retry. Rollback stays readable but loses fleet-only panel inheritance for overridden runs, and older kernels cannot resume fresh endpoint capacity parks: finish overridden runs and let endpoint parks resume before rolling back. Upgrading: line in CHANGELOG.

Tests

Parsing valid and invalid; slot matching; override at start, resume and wake; binding survives a setting change; an overridden run's panel equals a non-overridden run's; key separation with the override's credential; URL_FILE bare and JSON, re-read on wake; missing file and dead address defer without consuming a retry (fresh run and wake); fresh init with codex and hermes overrides; unchanged behaviour with no setting. Mutation-checked: panel independence and binding. Gate: 2495 passed, 2 skipped; ruff, format, mypy clean.

Built by codex from my brief; codex self-review (2 findings) plus my cross-review (2 findings), all fixed before this PR.

🤖 Generated with Claude Code