feat(runner): delegated repair client — the host agent repairs, no API key (#189)

[myselfsiddharth]

Closes #189.

Why

AnthropicRepairModelClient (#27) makes Paragent buy its own inference. That imposes a shape the thesis does not require: the pitch is giving an agent that already exists the ability to drive a browser without paying full reasoning cost every run — and such an agent already has model access. Requiring it to provision ANTHROPIC_API_KEY means paying twice for a credential it did not need. With npx paragent as the advertised Quick Start (#179), that is the difference between "works out of the box" and "works after you provision a key".

What

DelegatedRepairModelClient calls no model. propose() hands the caller the authorized repair request and takes back a proposal; the host does the reasoning on its own budget.

An injected async callback, per the issue's design question 1 — it is the primitive an MCP tool would wrap rather than replace, so no wire format is frozen here.

new DelegatedRepairModelClient({
  handler: async (request) => ({ corrected_action: await yourAgent.propose(request) }),
});

Decline (null), throw, timeout, and garbage all land on corrected_action: null → REPAIR_EXHAUSTED. Never a retry: a silent retry loop is a hidden cost and an unbounded one.

The part that actually needed deciding

Not the ergonomics — the accounting. The host pays and does not report usage back to a library, so a delegated repair records zero tokens. In a Cost that is arithmetically identical to the stub's zero, which is honest (no model ran) and means the opposite.

§9's kill line is mean(cost_repair) >= 70% * mean(cost_fresh). Fold unmeasured zeros in and the ratio moves down — the direction that reads as "repair is cheap, the thesis passed". A fabricated pass is worse than a fabricated fail, because nobody goes looking for the bug behind good news. The same zeros enter amortizedTokensOverN's numerator, where a sum understates every point after the first delegated run — #123's failure mode again.

ADR-0020 decides it:

• RepairProposal.cost_measured / RunMetric.repair_cost_measured mark a cost nobody observed. Absent means measured; the flag is only ever emitted false, and ReplayRunner makes it sticky for the run — one unmeasured proposal makes the whole run's cost_repair an undercount.
• repairCostVsFresh() computes over measured rows only. All rows excluded → no_data, never 0.
• amortizedTokensOverN() returns no_data if any run in the window is unmeasured. Window is ordered first, filtered second, so exclusion cannot slide a later run in.
• Outcome aggregates keep those rows. Self-heal rate and task success are unchanged — whether a repair worked is observed regardless of whose budget paid.
• buildGateReport publishes cost_provenance (runs_total / runs_cost_measured / runs_cost_unmeasured), so an honest exclusion doesn't look identical to a silent drop.

This does not unblock #39. A measured denominator needs a real usage block, which is exactly what a delegated client cannot produce. A gate measurement run still needs AnthropicRepairModelClient.

Egress

Unchanged. The handler receives serializeRepairContext()'s output and nothing else (ADR-0012) — no second serializer. tests/canary/repair-egress.test.ts (merge-blocking) now asserts it on the delegated path too: a host agent is a third party the same way an API is, and one a reader is likelier to think of as "inside".

Also

sanitizeProposedAction moved from repair-anthropic.ts to repair.ts so both clients share one frozen-assertion guard and the keyless client doesn't load the Anthropic SDK to get it. Same function, same behaviour; still exported from the package index.

Testing

npm run ci           # 571 unit + 36 integration, green
npm run test:canary  # 54, green — merge-blocking

No live model, no key, no spend — that is the point of the issue. 23 new unit tests (propose / decline / throw / timeout / late-rejection / assertion-mutation / payload), 7 aggregate tests including a guard-the-guard case proving the excluded rows would have moved the number, and 3 runner tests pinning the flag's trip from proposal to emitted row.

Known gaps (also in the ADR)

• No delegated repair has run against a real host agent — the callback is faked in tests. Whether a host given RepairEgressPayload proposes a useful action, not just a well-formed one, is unmeasured.
• The package declares bin and no main/exports, so library consumers deep-import. The README says so rather than showing an import that doesn't resolve. Adding a root export freezes a public API surface and is deliberately not decided here.
• The 120s default ceiling is a hang guard, not a tuned budget. No host has been observed.

🤖 Generated with Claude Code