kairos-chain 3.84.0 → 3.85.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ebfc6fe1ff6c901c620512c56c698f6dca7bd058143e611547864a0a5460e29
-  data.tar.gz: caa3229fcb55a9f057a88be84a7a7694e514aff6e9b31ec5a8796d5e1ca93138
+  metadata.gz: bb60c9f0163eaf405fdad217697364791fd3bc3d40fe15a77ef57458950c1163
+  data.tar.gz: f5e9dd8b9bfc9ccc36472ada9bdc0d0b00104ef06398c198c6d9963369f82d39
 SHA512:
-  metadata.gz: 91588bb7de5f9f211409c77e90ba688432415dae81a142341481201ea412d2769d597ed1d10382a726b7ef301fbfdda77439bfa7f27e870102a296f520957656
-  data.tar.gz: a7a9bd001776163b148e690508f6aa6f44639f01974f00da552f5264676f37f4a25a286c9acb6e502edd6c77f07f9c5de2afd963a6053a89a8d0999721bf55a4
+  metadata.gz: 28cb26af2e39d33a5f39e4157c5c2e74f7ff63af77384a73aadb6fe4c03e7c7a8e6c445f7deaff9fdc0b05daf47ad69fdb5a6dee3bdeecd6f40a64f146f7196d
+  data.tar.gz: ac81db0e9cb2ab019f2944113de79e7b4c19be5389dead92398f86dcc6b4a82f38491bfad13de2a98d68eefe0ee7ddf94d23289d131662fbff2c1ccfe6dab9cc

data/CHANGELOG.md

@@ -4,6 +4,83 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.85.0] - 2026-09-06
+
+### Changed — multi-LLM review: high effort by default, gpt-6-astra seats, gpt-5.5 retires
+
+Templates only: `multi_llm_review/config/multi_llm_review.yml`, L1
+`multi_llm_review_workflow` 3.12.0 → 3.13.0. No library code.
+
+**Effort.** Every seat that has an effort control now runs at `high`, at every
+complexity level, so `effort_map` is a constant rather than a function of complexity.
+Claude CLI takes `--effort high`, codex takes `-c model_reasoning_effort=high`, Cursor
+takes nothing — `cursor_adapter` builds no effort flag, so a value set for a cursor
+entry would be recorded and never sent. Both the roster defaults and `effort_map` are
+set, because `effort_map` overrides the roster per dispatch and an entry left at
+`medium` would be silently raised. `high` rather than `xhigh`/`max` because it is the
+ceiling the two providers share (Claude CLI accepts low/medium/high/xhigh/max, codex
+accepts minimal/low/medium/high), and a roster split across incomparable settings is
+worth less than a lower common one.
+
+This supersedes the 2026-04-29 default-effort policy. That policy rested on one
+low-vs-high measurement — 8.35 vs 8.16 — taken on the Opus 4.6 / 4.7 generation, on
+none of the models now in the roster. It was not re-measured, so the supersession is a
+judgement and a later measurement could reverse it. Cost is measured and rises:
+gpt-6-astra spent 8,274 tokens at high against 3,150 at its default on one identical
+one-line prompt.
+
+**Roster.** `codex_gpt6-astra` replaces `codex_gpt5.6-sol`, verified before the swap
+through the flags `codex_adapter` actually builds. `codex_gpt5.5` retires in the same
+edit and is not replaced: it had been commented out of the instance roster since
+2026-07-30 "for round R10 only" and never restored, so the calibrated
+cross-generation anchor role had already lapsed for five weeks. Codex now holds one
+slot and it is uncalibrated. Roster 5 → 4, so `convergence_rule` moves 3/5 → 3/4 and
+`convergence_rule_after_exclusion` 3/4 → 2/3, both on the same ceil(N × 0.6) basis and
+both reference figures rather than gates. Three calibration warnings are recorded in
+the L1: the 138-run seat profile is gpt-5.6-sol's and does not transfer; that corpus
+was gathered at medium effort; and it was gathered on a 5-seat roster.
+
+### Fixed — three documents called the APPROVE ratio the closing condition
+
+A round closes on the exhaustion of (a)+(b) findings, declared by the operator, with
+new (a)+(b) P0 = 0 as the machine-side signal. The tooling has said so since v0.7
+INV-R2 named the field `reference_verdict` and v0.10.1 renamed `convergence` to
+`vote_tally`. Three documents had not caught up, and they are the ones actually read.
+
+L1 `multi_llm_reviewer_evaluation` 1.5 → 1.6. § Convergence Rule (Updated) stated
+`3/4 APPROVE = proceed to next step` and `4/4 APPROVE = merge-ready` with no note that
+the ratio is a reference value — while L1 `multi_llm_review_workflow` names this very
+section as the normative detail it defers to. The document saying "the ratio is not
+the primary close" pointed at a document saying it was. The closing condition is now
+stated first, the one blocking rule (any (a)/(b) REJECT) is separated from the
+reference figures, and the two facts that make the ratio unusable as a criterion sit
+in the section: Codex went 24 of 24 reviews without APPROVE on one design loop, and
+both 2026-08 threads closed by (a)+(b) exhaustion without reaching their ratio.
+
+L1 `design_to_implementation_workflow` 1.1 → 1.2. `merge gate: 3/3 APPROVE =
+merge-ready` and `Merge criteria: 3/3 APPROVE with 0 FAIL` replaced by the closing
+condition; the anti-pattern list gains reading an APPROVE count as the closing
+condition, naming this document as having carried it. The reviewer lineup written here
+("3 reviewers: Opus 4.6 + Codex GPT-5.4 + Composer-2") is deleted rather than
+corrected — it had been wrong since 2026-04-19, and a roster copied into a second
+document goes stale silently.
+
+`agent` SkillSet: the bundle handed to reviewers opened "aggregate per the convergence
+rule below" followed by the bare ratio. The heading no longer calls it a convergence
+rule, a Closing condition section states what actually closes a round, and the ratio
+is labelled "Reference ratio (recorded, never sufficient on its own)".
+
+Surviving uses of "merge gate" name the stage and its reviewer lineup, not a ratio,
+and stay.
+
+**Not reviewed by multi-LLM review**, at the operator's explicit instruction — the
+change is a seat swap plus wording, and a round would have cost hours. Verification is
+this agent's own and is not an independent judgement: YAML load of both configs, the
+three CLI invocations run for real (gpt-6-astra and both Claude models answered at
+high, with the model echoed back), `ruby -c` on `agent_step.rb`, multi_llm_review 556
+runs / 1,809 assertions and agent 21 checks, all passing. No test asserts the reviewer
+prompt wording, so that one line is unguarded.
+
 ## [3.84.0] - 2026-09-03
 
 ### Fixed — agent: second field-defect bundle (D5-b, D6, exit-record housekeeping), real-process worker tests

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.84.0"
+  VERSION = "3.85.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/design_to_implementation_workflow/design_to_implementation_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: design_to_implementation_workflow
 description: "Full-lifecycle workflow for complex features: design review, self-review, implementation review, and final merge gate. Derived from Service Grant + Attestation Nudge experiments."
-version: "1.1"
+version: "1.2"
 tags:
   - workflow
   - implementation
@@ -31,7 +31,8 @@ different bugs.
 │  v0.2 ──→ Multi-LLM Review R2 ──→ Fix ──→ v0.3            │
 │            (fix correctness)                                │
 │                                                             │
-│  Convergence: 0 FAIL, 2/3+ APPROVE                         │
+│  Closes on: new (a)+(b) P0 = 0, operator declares freeze    │
+│  (APPROVE ratio is a reference figure, not the gate)        │
 ├─────────────────────────────────────────────────────────────┤
 │ IMPLEMENTATION PHASE                                        │
 │                                                             │
@@ -48,7 +49,7 @@ different bugs.
 │  (missing wiring, fail-open, integration gaps)              │
 │                                                             │
 │  Final Multi-LLM Review + Persona Assembly                  │
-│  (merge gate: 3/3 APPROVE = merge-ready)                   │
+│  (closes the same way; ratio stays a reference figure)      │
 └─────────────────────────────────────────────────────────────┘
 ```
 
@@ -76,8 +77,15 @@ different bugs.
 - Output: Complete design document with pseudocode
 
 #### Multi-LLM Review Rounds
-- **3 reviewers**: Claude Opus 4.6 + Codex GPT-5.4 + Composer-2
-- **Convergence criteria**: 0 FAIL, 2/3+ APPROVE
+- **Reviewers**: the roster in `multi_llm_review/config/multi_llm_review.yml`,
+  which is where the count and the models live. The "3 reviewers: Opus 4.6 +
+  Codex GPT-5.4 + Composer-2" written here until 2026-09-06 had been wrong since
+  2026-04-19 and is not restated, because a roster copied into a second document
+  goes stale silently
+- **Closing condition**: new (a)+(b) P0 = 0, carryover P0s counted separately
+  with a closure verdict on each, and the freeze declared by the operator. The
+  APPROVE ratio the tool reports is a recorded reference value — see L1
+  `multi_llm_review_workflow` § Convergence Rules
 - **Typical rounds**: 2-3 for Tier 3 complexity
 - **Convergence curve**:
   - R1: Structural gaps — "this is missing" (existence)
@@ -148,7 +156,11 @@ Claude Persona Assembly (4 personas):
 - Safety-critical components
 - NOT for intermediate rounds (diminishing returns)
 
-**Merge criteria**: 3/3 APPROVE with 0 FAIL. Codex APPROVE is the strongest signal (see `multi_llm_reviewer_evaluation`).
+**Merge criteria**: new (a)+(b) P0 = 0, with the freeze declared by the operator.
+A Codex APPROVE is the strongest *reference* signal (see
+`multi_llm_reviewer_evaluation`), and it is not a gate: Codex went 24 of 24
+reviews without reaching APPROVE on one design loop, so a merge waiting on it
+would never have merged.
 
 ## Effort Level Selection
 
@@ -192,6 +204,9 @@ Reviewer 側 (Opus 4.7) は effort-independent なので high が天井。xhigh/
 
 ## Convergence Data
 
+Observed outcomes of past loops, not criteria. The APPROVE counts below record
+what those particular rounds happened to reach; they are not what closed them.
+
 ### Service Grant (Tier 3, 2026-03-18)
 - Design: v1.0 → v1.4, 3 review rounds, 3 LLMs
 - Design review findings: R1: 8 P0/P1, R2: 2 FAIL + 28 CONCERN, R3: 0 FAIL
@@ -207,6 +222,10 @@ Reviewer 側 (Opus 4.7) は effort-independent なので high が天井。xhigh/
 
 ## Anti-Patterns
 
+- **Reading an APPROVE count as the closing condition.** It is a recorded
+  reference value; a round closes on new (a)+(b) P0 = 0 with the freeze declared
+  by the operator. This document itself carried the mistake until v1.2, in the
+  strongest available wording ("merge gate: 3/3 APPROVE = merge-ready")
 - Implementing Phase 2+ when Phase 1 prerequisites aren't met
 - Using agent team for implementation (context fragmentation)
 - Skipping self-review (misses cheap P0 fixes)

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.11.0"
+version: "3.13.0"
 tags:
   - workflow
   - review
@@ -90,6 +90,72 @@ Codex (c)-class value-divergent REJECTs as blocking, which causes review loops t
 fail to converge. The cross-reference exists in `related:` frontmatter; this step
 makes it an explicit pre-condition rather than an implicit hint.
 
+## Step 0.1 — Measured seat characteristics (corpus 2026-08-03 .. 2026-09-03)
+
+Qualitative per-model profiles stay in `multi_llm_reviewer_evaluation`. What
+follows is the counted complement: seat behaviour as it actually occurred, so
+seat selection is a lookup rather than a recollection. A **seat** is one
+reviewer slot in one run.
+
+Corpus: 138 completed runs in the local run store, 556 seat observations, 5286
+findings (P0 1473 / P1 560 / P2 2994 / P3 259). Run types: design 54,
+implementation 60, document 24. Extraction script `log/mlr_extract/extract.py`
+lives in the development repository and does not ship; re-run it to refresh
+these numbers.
+
+| Seat | Runs | APPROVE rate design / impl / doc | Median wall s | Median output chars | (c) share, labelled only |
+|---|---|---|---|---|---|
+| `claude_cli_opus4.6` | 134 | 64% (31/48) / 71% (27/38) / 86% (20/23) | 54 | 4,536 | 70% (19/27) |
+| `cursor_composer2.5` | 138 | 13% (7/51) / 48% (24/50) / 25% (6/24) | 133 | 3,795 | 100% (2/2) |
+| `codex_gpt5.6-sol` (retired 2026-09-05) | 138 | 1% (1/54) / 11% (7/60) / 4% (1/24) | 113 | 2,038 | 3% (5/140) |
+| `claude_team_opus-5` (persona) | 131 | 0% (0/51) / 12% (7/56) / 0% (0/22) | not measured per seat | 11,512 | 27% (374/1362) |
+
+The codex row is a profile of **gpt-5.6-sol**, which left the roster on
+2026-09-05 when gpt-6-astra replaced it. Nothing in that row transfers to the
+new occupant: the seat's identity here is the model, not the slot. Until a
+comparable corpus accumulates for `codex_gpt6-astra`, read the codex row as
+history and treat the new seat as uncalibrated. The same caution applies to
+every row from 2026-09-05 onward for a second reason — the corpus was gathered
+with reviewers at medium effort, and reviewers now run at high (see § Thinking
+Effort Configuration), so post-swap rounds are not directly comparable to it.
+
+Selection consequences, each tied to the number above it:
+
+- **A `codex` APPROVE carries the most information and an `opus4.6` APPROVE the
+  least.** Codex approves 1 design review in 54 and pairs that with the lowest
+  advisory rate in the corpus (5 of 140 labelled findings). Opus4.6 approves 20
+  document reviews in 23 while 19 of its 27 labelled findings are advisory. Seat
+  both, read them differently: the `3/4 APPROVE` threshold is met, in practice,
+  with opus4.6's vote already inside it, so the live question is whether two of
+  the remaining three agree. (That threshold is a reference figure, not a gate —
+  see § Convergence Rules.)
+- **Volume anti-correlates with signal.** The persona seat raises 3,249 of the
+  5,286 findings (61%) and 27% of its labelled ones are advisory. Seat personas
+  when breadth is wanted; do not seat them to obtain a verdict.
+- **Design draws roughly seven times the P0 of implementation** — median 14 P0
+  per design-medium run against 2 per implementation-high run. Budget rounds
+  accordingly; a design round returning two P0 is anomalous, not clean.
+- **Dropping a seat does not shorten the round.** Seats run concurrently, so
+  wall-clock is the slowest seat (median 179 s per run against 300–400 s summed
+  across seats). Removing the 54 s seat saves nothing.
+- **Loops do not converge on their own.** Of 29 artifacts reviewed more than
+  once, the last round was REVISE in 26 and APPROVE in 3; rounds per loop median
+  3, maximum 12. P0 counts are not monotone: `chain_history_erasure_fix` ran
+  25, 25, 21, 14, **38**, 29, 26, 13 across rounds 1–8, and
+  `ruby_association_grant_2026_application_ja` returned APPROVE at round 8 with
+  3 P0 and then 23 P0 at round 9. Treat a single APPROVE as an observation, not
+  as a close — § Convergence Rules already requires the operator's declaration.
+
+Two limits of this corpus, both open:
+
+- **Findings are not deduplicated across seats.** `cited_by` had exactly one
+  entry in 5,286 of 5,286 findings, so agreement between seats is not derivable
+  from the store, and the (c) shares above are per-seat rates rather than
+  contested classifications.
+- **(a)/(b)/(c) labels are present on 1,622 of 5,286 findings (31%)**, and
+  `cursor` labelled 2 of its 730. Classification is applied unevenly by the
+  seats, so the shares are computed over labelled findings only.
+
 ## Step 0.25 — Unknowns Pass (pre-draft, qualifying reviews only)
 
 > **Numbering vs timing**: Step 0 and Step 0.5 execute at review time,
@@ -399,12 +465,17 @@ they disagree, the config is right and this section is stale.
       which under the default "delegate" strategy is taken by your persona team
       rather than spawned — so when you are Opus 5, Opus 4.6 is the only Claude
       CLI subprocess
-- [ ] Codex models: gpt-5.6-sol AND gpt-5.5 (both, not either/or), each with -m
+- [ ] Codex model: gpt-6-astra, with -m. One codex slot since gpt-5.5 was
+      retired 2026-09-05 — do not add a second codex entry expecting the old
+      cross-generation pairing
 - [ ] Cursor model: composer-2.5, passed explicitly as --model composer-2.5
-- [ ] Total reviewer count: 5 (or 4 after orchestrator exclusion from subprocess)
+- [ ] Effort: high on every seat that has an effort control — `--effort high`
+      for Claude CLI, `-c model_reasoning_effort=high` for codex. Cursor has no
+      effort control and takes no flag
+- [ ] Total reviewer count: 4 (or 3 after orchestrator exclusion from subprocess)
 - [ ] Closing condition: new (a)+(b) P0 = 0, with carryover P0s counted
       separately and a closure verdict on each. The APPROVE ratio the tool
-      reports (3/5 full roster, 3/4 after exclusion) is a reference value,
+      reports (3/4 full roster, 2/3 after exclusion) is a reference value,
       not the condition — see § Convergence Rules
 ```
 
@@ -423,7 +494,7 @@ Path B refuses such a slot outright; on Path A nothing refuses it but you.
 |---------|-----------------|----------------|
 | Launch a reviewer without an explicit model flag | Always pass `--model` / `-m`. A slot with no flag takes the CLI's user-editable default | "The default is the one we want" — it was, until someone changed it outside this repo |
 | Exclude orchestrator model from Agent Team Personas | Agent Team uses orchestrator model — they provide persona diversity, not epistemic diversity | LLM misreads "do not assign yourself as a reviewer" as applying to Agent Team; it applies only to subprocess CLI |
-| Run only Codex GPT-5.6-sol, skip 5.5 | Run both — cross-generation entries catch different things (5.5 found §5 schema contradiction in Phase 2 Case A that no other reviewer caught) | Cost-saving heuristic; roster has both for a reason |
+| Run only Codex GPT-6-astra, skip 5.5 | Run both — cross-generation entries catch different things (5.5 found §5 schema contradiction in Phase 2 Case A that no other reviewer caught) | Cost-saving heuristic; roster has both for a reason |
 | Use a smaller/cheaper model as Agent Team substitute | Use the orchestrator's own model with different personas | Confusing "model diversity" with "persona diversity" — Agent Team is the latter |
 | Run 3 reviewers instead of the configured roster | Use the full roster from config | Ad-hoc "3 is enough" reasoning; the roster size is empirical |
 | Count a reply that carries only a verdict | Drop it from the denominator, and say why | A bare "APPROVE" looks like agreement and raises the bar for everyone else without contributing (see § Substance and the denominator) |
@@ -592,7 +663,7 @@ The rule applies **after** orchestrator classifies each finding as (a)/(b)/(c) p
 findings count toward the thresholds below; (c) findings are recorded as advisory
 and never block.
 
-- **3/5 APPROVE** full roster, or **3/4 APPROVE** after orchestrator exclusion ("exclude" strategy only — the default "delegate" strategy keeps 5 voters via collect) (no (a)/(b) REJECT) = proceed to next step
+- **3/4 APPROVE** full roster, or **2/3 APPROVE** after orchestrator exclusion ("exclude" strategy only — the default "delegate" strategy keeps 4 voters via collect) (no (a)/(b) REJECT) = proceed to next step
 - **Any (a) or (b) REJECT or FAIL** = revise and re-review
 - **(c)-only REJECT** = record as advisory, non-blocking
 - **Unanimous APPROVE** (no (a)/(b)) = highest confidence, proceed
@@ -643,7 +714,7 @@ For normative detail and the underlying classification, see
 | Agreement | Meaning | Action |
 |-----------|---------|--------|
 | **N/N** (unanimous) | Architectural-level gap | Must fix |
-| **Majority** (e.g. 3/5, 3/4) | Implementation-level issue | Should fix |
+| **Majority** (e.g. 3/4, 2/3) | Implementation-level issue | Should fix |
 | **1/N only** | Specialty-specific insight | Do NOT ignore — often the most novel finding |
 
 1/N findings are not "minority opinions to discard." They represent unique expertise.
@@ -743,7 +814,7 @@ outside this repository — see the incident recorded in § Pre-flight checklist
 
 | Tool | Command | Prompt Input | Output Collection | Model |
 |------|---------|-------------|-------------------|-------|
-| **Codex** | `codex exec -m <model>` | stdin pipe: `cat prompt.md \| codex exec -m <model> -` | `-o /path/output.md` | gpt-5.6-sol + gpt-5.5 (both roster entries, `-m` per entry) |
+| **Codex** | `codex exec -m <model> -c model_reasoning_effort=high` | stdin pipe: `cat prompt.md \| codex exec -m <model> -` | `-o /path/output.md` | gpt-6-astra — one slot since gpt-5.5 was retired 2026-09-05 |
 | **Cursor Agent** | `agent -p --model composer-2.5` | File reference (stdin NOT supported) | stdout redirect: `> output.md` | composer-2.5, passed explicitly — never relying on the CLI default |
 | **Claude Code** | Agent tool (internal) | Direct prompt string | Write to workspace file | Orchestrator model, or the declared `persona_model` when personas run elsewhere |
 | **Claude CLI (4.6)** | `claude -p --model claude-opus-4-6` | stdin pipe: `cat prompt.md \| claude -p --model claude-opus-4-6` | stdout redirect: `> output.md` | Opus 4.6 — the calibrated anchor, deliberately not a frontier model |
@@ -766,11 +837,27 @@ Based on cross-evaluation experiment (7 models × 4 tasks + Nomic, 518 CLI calls
 |------|-------|-------------|-----------|
 | **Primary (orchestrator)** | session default | (default) | Sufficient for integration, dialogue, judgment |
 | **Reviewer: Agent Team** | = orchestrator, or the declared `persona_model` | (default) | Personas inherit whichever model actually runs them |
-| **Reviewer: Claude CLI** | Opus 4.6, plus any frontier roster slot the orchestrator is not | (default; config `effort: medium`) | Evaluator quality is effort-independent (low≈high: 8.35 vs 8.16) — per 2026-04-29 policy reviewers stay at default |
+| **Reviewer: Claude CLI** | Opus 4.6, plus any frontier roster slot the orchestrator is not | `--effort high` (config `effort: high`) | Operator instruction 2026-09-05; supersedes the 2026-04-29 default-effort policy — see the note below the table |
 | **Coding sub-agent** | Opus 5 | `--effort xhigh` | Published starting point for coding/agentic work; not measured here (see note) |
 | **Design sub-agent** | Opus 5 | `--effort high` | Published starting point for intelligence-sensitive work; not measured here (see note) |
-| **Codex** | GPT-5.6-sol / GPT-5.5 | (no flag) | Fixed effort |
-| **Cursor Agent** | Composer-2.5 | (no flag) | Fixed effort |
+| **Codex** | GPT-6-astra / GPT-5.5 | `-c model_reasoning_effort=high` | Same operator instruction. The earlier "(no flag) / fixed effort" entry was wrong: codex_adapter has always emitted this flag when the roster set `effort` |
+| **Cursor Agent** | Composer-2.5 | (no flag) | Genuinely has no effort control — cursor_adapter builds no such flag, so an `effort:` key on a cursor roster entry is recorded and never sent |
+
+Effort policy (2026-09-05, operator instruction). Every reviewer that HAS an
+effort control runs at **high**, at every complexity level, and the `effort_map`
+in `config/multi_llm_review.yml` is a constant rather than a function of
+complexity. `high` is deliberate rather than maximal: it is the ceiling the two
+providers share (Claude CLI accepts low/medium/high/xhigh/max, codex accepts
+minimal/low/medium/high), so it is the highest setting at which the roster stays
+comparable across providers.
+
+This supersedes the 2026-04-29 policy that kept reviewers at each CLI's default.
+That policy rested on one measurement — low vs high scoring 8.35 vs 8.16 in
+cross-evaluation — taken on the Opus 4.6 / 4.7 generation, on none of the models
+in the current roster. It was not re-measured, so it is superseded by judgement,
+not by a counter-measurement, and a later measurement could reinstate it. The
+cost side is measured: on one identical one-line prompt, gpt-6-astra spent 8,274
+tokens at high against 3,150 at its default (2026-09-05).
 
 Note (2026-07-25): the effort experiment data is from the Opus 4.6/4.7
 generation. Opus 5 and Fable 5 effort sensitivity is not yet calibrated;
@@ -867,13 +954,13 @@ multi_llm_review(
 **Dispatcher behavior** (config: `exclude_orchestrator_model: true`, default `true`):
 - If `orchestrator_model` matches a roster entry's `model`, that entry is skipped.
 - `min_quorum` and `convergence_rule` apply to the remaining reviewers.
-- 5-reviewer roster → 4 reviewers; `convergence_rule_after_exclusion: "3/4 APPROVE"`
+- 4-reviewer roster → 3 reviewers; `convergence_rule_after_exclusion: "2/3 APPROVE"`
   (from config) replaces the full-roster rule. This reduced count applies to the
   "exclude" strategy only. The "subprocess" strategy keeps the full roster (the
   matching entry runs as a fresh CLI process instead of being skipped). Under the
   default "delegate" strategy, the matching entry is dropped at dispatch but
-  re-added at collect as the persona-team entry, so the voter count returns to 5
-  and the full-roster rule (3/5 APPROVE) applies.
+  re-added at collect as the persona-team entry, so the voter count returns to 4
+  and the full-roster rule (3/4 APPROVE) applies.
 - **At most one roster entry leaves for matching the caller.** This is only
   visible on a roster carrying three or more entries on the orchestrator's own
   model: the first is taken over by the persona team, the second leaves as the
@@ -1342,16 +1429,16 @@ Step 2: Detect environment, and check the roster against config
   - Read the roster from config/multi_llm_review.yml — do NOT read CLI defaults
     and treat them as the roster. Detection only tells you whether a default has
     drifted; the model each slot runs is named on the command line.
-  - Report: "Auto mode: Codex (gpt-5.6-sol, gpt-5.5), Cursor (composer-2.5),
+  - Report: "Auto mode: Codex (gpt-6-astra), Cursor (composer-2.5),
     Claude Team (orchestrator model), Claude CLI (opus-4.6)"
 
-Step 3: Execute the configured roster in parallel (currently 5 slots, one of
+Step 3: Execute the configured roster in parallel (currently 4 slots, one of
         which is your own persona team)
-  - Bash(background): cat prompt.md | codex exec -m gpt-5.5 -C workspace -o log/review_codex_gpt5.5.md -
-  - Bash(background): cat prompt.md | codex exec -m gpt-5.6-sol -C workspace -o log/review_codex_gpt5.6-sol.md -
+  - Bash(background): cat prompt.md | codex exec -m gpt-6-astra -c model_reasoning_effort=high -C workspace -o log/review_codex_gpt6-astra.md -
   - Bash(background): agent -p --trust --model composer-2.5 "Read prompt and review..." > log/review_cursor.md
+    (no effort flag — Cursor has no effort control)
   - Agent(background): Claude Team (orchestrator model, e.g. Opus 5) → write to log/review_claude_team_opus5.md
-  - Bash(background): cat prompt.md | claude -p --model claude-opus-4-6 > log/review_claude_opus4.6.md 2>log/review_claude_opus4.6.stderr.log
+  - Bash(background): cat prompt.md | claude -p --model claude-opus-4-6 --effort high > log/review_claude_opus4.6.md 2>log/review_claude_opus4.6.stderr.log
     (add a line per further Claude roster slot you are not; with the 2026-07-26
      roster an Opus 5 orchestrator has none, so opus-4.6 is the only one)
 
@@ -1391,7 +1478,7 @@ log/{artifact}_review{N}_consensus_{date}.md       # Consensus analysis
 ```
 
 LLM identifiers: `claude_cli_opus5`, `claude_cli_opus4.6`,
-`codex_gpt5.6-sol`, `codex_gpt5.5`, `cursor_composer2.5`, `cursor_gpt5.4`,
+`codex_gpt6-astra`, `cursor_composer2.5`, `cursor_gpt5.4`,
 `cursor_premium`. The delegated slot is reported as `claude_team_<model>`
 (e.g. `claude_team_claude-opus-5`), assembled at collect time — the roster's
 own labels stay CLI-neutral because either frontier entry can take either path.
@@ -1399,7 +1486,11 @@ own labels stay CLI-neutral because either frontier entry can take either path.
 `claude_cli_opus4.7`, `cursor_composer2`; retired 2026-07-23: `codex_gpt5.4`;
 retired 2026-07-25: `claude_cli_opus4.8`, `claude_team_fable5`;
 retired 2026-07-26: `claude_cli_fable5` — five consecutive non-substantive
-returns, 85-128 characters in 5-7 seconds, no findings and no verdict text)
+returns, 85-128 characters in 5-7 seconds, no findings and no verdict text;
+retired 2026-09-05: `codex_gpt5.6-sol`, replaced by `codex_gpt6-astra`, and
+`codex_gpt5.5`, not replaced. Runs recorded under a retired identifier keep it —
+the label names the model that answered, so renaming old records would attribute
+one model's findings to another)
 
 ## Internal Agent Team Review
 
@@ -1695,6 +1786,44 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   four rounds was the change's account of itself, not the rules it proposed.
   Records: L2 `handoff_mlr_l1_norms_revision_three_rounds_and_switch_to_implementation_20260821`
   and L2 `mlr_v3_11_0_applied_review_r1_and_subtractive_revision_20260822`
+- Effort raised to high, and gpt-6-astra replaces gpt-5.6-sol (v3.13.0,
+  2026-09-05, operator instruction). Two changes with one config edit. **Effort**:
+  every seat that has an effort control now runs at high at every complexity
+  level, so `effort_map` is a constant rather than a function of complexity —
+  Claude CLI gets `--effort high`, codex gets `-c model_reasoning_effort=high`,
+  Cursor gets nothing because cursor_adapter builds no effort flag and a value
+  set for it would be recorded and never sent. `high` rather than `xhigh`/`max`
+  because it is the ceiling the two providers share, and a roster split across
+  incomparable settings is worth less than a lower common one. This supersedes
+  the 2026-04-29 default-effort policy, which rested on a single low-vs-high
+  measurement (8.35 vs 8.16) taken on the Opus 4.6 / 4.7 generation — none of
+  the models now in the roster. No counter-measurement was taken, so the
+  supersession is a judgement and a later measurement could reverse it. Cost is
+  measured and rises: gpt-6-astra spent 8,274 tokens at high against 3,150 at
+  its default on one identical one-line prompt. **Roster**: `codex_gpt6-astra`
+  replaces `codex_gpt5.6-sol`, verified before the swap through the flags
+  codex_adapter actually builds. **gpt-5.5 retired in the same edit**, not
+  replaced: it had been the calibrated cross-generation anchor, but it had been
+  commented out of the instance roster since 2026-07-30 "for round R10 only" and
+  never restored, so the anchor role had already lapsed for five weeks and the
+  retirement only names the state. Codex therefore holds ONE slot, and it is
+  uncalibrated — there is no longer a calibrated codex seat to read a new one
+  against. Roster 5 → 4, so `convergence_rule` moves 3/5 → 3/4 and
+  `convergence_rule_after_exclusion` 3/4 → 2/3, both on the same ceil(N × 0.6)
+  basis. Three calibration warnings follow and none is optional: the 138-run
+  seat profile in § Reviewer selection is gpt-5.6-sol's and does not transfer to
+  the new occupant; the whole of that corpus was gathered at medium effort, so
+  rounds from 2026-09-05 onward are not directly comparable to any of it; and
+  the corpus was gathered on a 5-seat roster, so per-round finding counts shift
+  for a third, independent reason. Record (a)/(b)/(c) breakdowns per round in
+  `multi_llm_reviewer_evaluation` until a profile for the new seat accumulates.
+  Recorded because it was got wrong in the session that made the change: the
+  new ratio was first reported to the operator as "3 of 4 seats must APPROVE",
+  as though it were a gate. It is not. § Convergence Rules has said since v3.5
+  that the ratio is neither the only nor the primary close, `Consensus.compute`
+  returns it under the name `reference_verdict`, and both 2026-08 threads closed
+  by (a)+(b) exhaustion without ever reaching it. Every ratio in this document
+  is a reference figure.
 
 **Key insight**: Design reviews and implementation reviews find
 **categorically different bugs**. Both phases are necessary.

data/templates/knowledge/multi_llm_reviewer_evaluation/multi_llm_reviewer_evaluation.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_reviewer_evaluation
 description: "Multi-LLM reviewer performance evaluation — strengths, weaknesses, value-system biases, and recommended workflows. Based on 185+ reviews (Phase 1, 2026-02 to 03) + Phase 2 Case A 4-round Codex bias study (2026-05-04)."
-version: "1.5"
+version: "1.6"
 tags:
   - multi-llm
   - review
@@ -172,8 +172,9 @@ When a reviewer issues a P0, classify the *cause* — not just the severity:
 | (b) philosophy-aligned | Deviation from declared design principles (e.g., enumeration where invariant suffices). | **Blocking P0** |
 | (c) value-divergent | Reviewer's own style preference or generic best practice not entailed by project principles. | **Advisory only** (non-blocking) |
 
-When uncertain between (b) and (c), default to (c). Convergence rule applies to (a)+(b);
-(c) findings are recorded but do not block.
+When uncertain between (b) and (c), default to (c). Only (a)+(b) findings count toward
+closing a round; (c) findings are recorded but do not block. Closing is the exhaustion
+of (a)+(b), not an APPROVE count — see § Convergence Rule (Updated).
 
 **Codex ↔ classes**: Codex finds genuine (a) bugs (e.g., the §5 schema contradiction).
 Codex also produces many (c) findings driven by the 3 biases above. The skill of using
@@ -201,6 +202,9 @@ Final Review:    Codex APPROVE | Composer-2.5 APPROVE+ | Claude APPROVE+
 - Codex REJECT reasons are always **substantive** (not stylistic): storage model contradictions, missing call sites, fail-open security
 - When Codex finally APPROVEs, all prior FAIL/HIGH issues have been genuinely resolved
 - **Codex APPROVE = strongest merge-readiness signal** in the 3-LLM configuration
+  — as a *reference* signal. It is not a gate, and waiting for it is not a
+  closing procedure; see the caveat immediately below and § Convergence Rule
+  (Updated)
 
 > **Note**: The above convergence data is from the 3-reviewer configuration in
 > the Attestation Nudge session. With the 4-reviewer default (Opus 4.7 added
@@ -216,18 +220,41 @@ Final Review:    Codex APPROVE | Composer-2.5 APPROVE+ | Claude APPROVE+
 
 ### Convergence Rule (Updated)
 
-The convergence rule applies **after** orchestrator classifies findings as (a)/(b)/(c)
-per § Reviewer Value-System Divergence. A REJECT whose findings are entirely (c)
-value-divergent is recorded but treated as non-blocking; only (a)+(b) findings count
-toward the rule below.
-
-- 3/4 APPROVE (no (a)/(b) REJECT) = proceed to next step (4-reviewer default)
-- Any (a) or (b) REJECT or FAIL = revise and re-review
-- **4/4 APPROVE (including Codex) = highest confidence, merge-ready**
-- Legacy 3-reviewer mode: 2/3 APPROVE = proceed
+**The APPROVE ratio is not the convergence criterion.** A round closes on the
+exhaustion of (a)+(b) findings, declared by the operator. The machine-side signal
+is **new (a)+(b) P0 = 0**, counting carryover P0s separately; nothing in the
+multi_llm_review SkillSet computes it and no returned field carries it, so it is
+read off the findings. `Consensus.compute` returns the ratio under the name
+`reference_verdict` and the vote counts under `vote_tally` — both recorded
+observations, neither a conclusion.
+
+The evidence that the ratio cannot serve as the criterion is in this document:
+two Codex entries went 24 of 24 reviews without reaching APPROVE on one design
+loop, and both 2026-08 review threads closed by (a)+(b) exhaustion plus an
+operator freeze declaration without ever reaching their ratio. A threshold a seat
+is structurally unlikely to meet cannot be what closes a round.
+
+Everything below applies **after** the orchestrator classifies findings as
+(a)/(b)/(c) per § Reviewer Value-System Divergence. A REJECT whose findings are
+entirely (c) value-divergent is recorded but non-blocking; only (a)+(b) findings
+count.
+
+- Any (a) or (b) REJECT or FAIL = revise and re-review. **This one blocks.**
 - Codex-only REJECT with (a)/(b) findings + others APPROVE = likely real issue, investigate before overriding
 - Codex REJECT with only (c) findings = expected per Codex value-system divergence; non-blocking
 
+Reference figures, recorded and never sufficient on their own. Read what the
+approving replies actually said before counting them:
+
+- 3/4 APPROVE (no (a)/(b) REJECT) on the current 4-reviewer roster — the literal
+  ratio tracks the roster size and changed on 2026-09-05 when gpt-5.5 retired
+- 4/4 APPROVE (including Codex) = the strongest reference signal available, still
+  a reference
+- Legacy 3-reviewer mode: 2/3 APPROVE
+
+Normative statement and the carryover/new split: L1 `multi_llm_review_workflow`
+§ Convergence Rules. Aggregation rule: project CLAUDE.md.
+
 ### Bug Category Differentiation Across Rounds
 
 | Review Phase | Typical Bug Category | Example |
@@ -324,6 +351,26 @@ MECHANISM of a sound invariant is (c) -> §11 / implementation review." This con
 Codex APPROVE" (not always reachable) into "freeze when only (c)/mechanism findings remain,"
 which is decidable by the orchestrator and resistant to value-divergence stalling.
 
+## Changelog
+
+- **v1.6 (2026-09-06)**: § Convergence Rule (Updated) rewritten. It had stated
+  `3/4 APPROVE = proceed to next step` and `4/4 APPROVE = merge-ready` with no
+  note that the ratio is a reference value — while L1 `multi_llm_review_workflow`
+  § Convergence Rules names *this* section as the normative detail it defers to.
+  So the document that says "the ratio is not the primary close" pointed at a
+  document that said it was. Now: the closing condition (new (a)+(b) P0 = 0,
+  carryover counted separately, operator declares the freeze) is stated first and
+  the blocking rule — any (a)/(b) REJECT — is separated from the reference
+  figures. Two supporting facts moved into the section because they are the
+  reason the ratio cannot be the criterion: Codex went 24 of 24 reviews without
+  APPROVE on one design loop, and both 2026-08 threads closed by (a)+(b)
+  exhaustion without reaching their ratio. The "Codex APPROVE = strongest
+  merge-readiness signal" line keeps its wording and gains "as a reference
+  signal, not a gate". Prompted by the operator after this agent reported an
+  APPROVE ratio to them as a gate for the third time; the wrong belief was
+  traceable to the text here, not to the tooling, which had been correct since
+  v0.7 INV-R2 (`reference_verdict`) and v0.10.1 (`vote_tally`).
+
 ## Refinement Source
 
 Profiles in this knowledge are refined from accumulated L2 contexts named with prefix

data/templates/skillsets/agent/tools/agent_step.rb

@@ -2424,9 +2424,15 @@ module KairosMcp
                         "Reviewer roster hash: #{bundle['reviewer_roster_hash']}",
                         "Config hash: #{bundle['config_hash']}",
                         '',
-                        '## Run each reviewer independently and aggregate per the convergence rule below.',
+                        '## Run each reviewer independently, then aggregate.',
                         '',
-                        "Convergence rule: #{bundle['convergence_rule']}",
+                        '## Closing condition',
+                        'A round closes on new (a)+(b) P0 = 0, counting carryover P0s',
+                        'separately with a closure verdict on each, and the freeze is',
+                        'declared by the operator. Read it off the findings — no field',
+                        'in this bundle carries it.',
+                        '',
+                        "Reference ratio (recorded, never sufficient on its own): #{bundle['convergence_rule']}",
                         '',
                         '## Aggregation instructions',
                         bundle['aggregation_instructions'].to_s,

data/templates/skillsets/minimum_nomic/bin/run_gm.rb

@@ -48,6 +48,12 @@
 #   ruby bench/minimum_nomic/run_gm.rb --out /tmp/smoke --turns 2   # smoke
 #   ruby bench/minimum_nomic/check_gm.rb log/minimum_nomic_gm_20260810/g3 --falsify
 #
+# Seating a different model, or a different provider in turn control:
+#   --codex-model gpt-6-astra --codex-effort high      # B seat
+#   --gm-adapter codex --gm-model gpt-6-astra --gm-effort high
+# Both go into the lineup, so a game says which generation played without the
+# reader having to know when this file was edited.
+#
 # One directory per game, and a fresh one every time: the run refuses to start
 # when the target already holds records. The games themselves are never
 # committed — this file is tracked, the corpus under log/ is not.
@@ -120,10 +126,47 @@ LC = KairosMcp::SkillSets::LlmClient
 # Read from ARGV here rather than in the option parser at the foot of the file,
 # because PLAYER_SPECS is a constant that the prompts and the lineup are built
 # from and it has to exist before either.
+# Which model sits in the claude seat is also a run parameter, for the same
+# reason. The 61-game corpus of 2026-08 was produced by editing the constant
+# below in place, so "which generation played" is recoverable only from each
+# game's own lineup row and never from this file's history. --claude-model and
+# --claude-effort put that choice on the command line and therefore in the
+# lineup. Defaults are unchanged, so an unflagged run stays comparable.
+def arg_after(flag)
+  i = ARGV.index(flag)
+  i && ARGV[i + 1] && !ARGV[i + 1].start_with?('--') ? ARGV[i + 1] : nil
+end
+
+CLAUDE_SEAT_MODEL  = arg_after('--claude-model')  || 'claude-opus-5'
+CLAUDE_SEAT_EFFORT = arg_after('--claude-effort') || 'high'
+GM_MODEL           = arg_after('--gm-model')      || 'claude-opus-5'
+GM_EFFORT          = arg_after('--gm-effort')     || 'high'
+
+# The codex seat carries a model name for the same reason the claude seat does.
+# gpt-5.6-sol sat there through the whole 2026-08 corpus and was written into
+# the constant, so seating a later generation meant editing this file, and the
+# edit left no trace anywhere except in each game's own lineup row. The effort
+# default stays nil rather than becoming a level, because every stored game ran
+# this seat without one and a default would silently change what "unflagged"
+# means.
+CODEX_SEAT_MODEL   = arg_after('--codex-model')   || 'gpt-5.6-sol'
+CODEX_SEAT_EFFORT  = arg_after('--codex-effort')
+
+# The game master's ADAPTER, not only its model. Turn control ran on claude_code
+# in every stored game, so "can a different provider hold turn control" cannot
+# be asked by changing the model name alone: a codex model name handed to the
+# claude_code adapter reaches a CLI that cannot serve it, and the run then
+# measures the mismatch instead of the model. Moving both together is the only
+# form of the question that has an answer. The adapter is recorded in the
+# lineup beside the model, so a reader never has to infer it from the name.
+GM_ADAPTER         = arg_after('--gm-adapter')    || 'claude_code'
+
 SEAT_POOL = {
-  'cursor'      => { adapter: 'cursor',      model: 'composer-2.5',  effort: nil    },
-  'codex'       => { adapter: 'codex',       model: 'gpt-5.6-sol',   effort: nil    },
-  'claude_code' => { adapter: 'claude_code', model: 'claude-opus-5', effort: 'high' }
+  'cursor'      => { adapter: 'cursor',      model: 'composer-2.5',      effort: nil },
+  'codex'       => { adapter: 'codex',       model: CODEX_SEAT_MODEL,
+                     effort: CODEX_SEAT_EFFORT },
+  'claude_code' => { adapter: 'claude_code', model: CLAUDE_SEAT_MODEL,
+                     effort: CLAUDE_SEAT_EFFORT }
 }.freeze
 
 DEFAULT_SEAT_ORDER = %w[cursor codex claude_code].freeze
@@ -141,7 +184,17 @@ PLAYER_SPECS = SEAT_ORDER.each_with_index.map do |key, i|
   { id: %w[A B C].fetch(i) }.merge(SEAT_POOL.fetch(key))
 end.freeze
 
-GM_SPEC = { id: 'GM', adapter: 'claude_code', model: 'claude-opus-5', effort: 'high' }.freeze
+GM_SPEC = { id: 'GM', adapter: GM_ADAPTER, model: GM_MODEL, effort: GM_EFFORT }.freeze
+
+# Who can reach this run's own record, over every participant rather than over
+# the players alone. claude_code is the only contained adapter: it is chdired
+# to an empty directory with no tools, so the record is not under its cwd and
+# it has nothing to open it with. codex has a read-only sandbox rooted at the
+# project root and cursor has no sandbox flag at all, so either one can read
+# the record from any seat — the game master's included. Used by the lineup.
+ALL_PARTICIPANTS = (PLAYER_SPECS + [GM_SPEC]).freeze
+CONTAINED   = ALL_PARTICIPANTS.select { |s| s[:adapter] == 'claude_code' }.freeze
+UNCONTAINED = ALL_PARTICIPANTS.reject { |s| s[:adapter] == 'claude_code' }.freeze
 
 # The analyst roster equals the player roster (v0.8 §6), so self-analysis is
 # part of the output and is recorded as such.
@@ -420,13 +473,49 @@ class Run
   def call!
     load_initial_rules!
     write_lineup!
+    probe_identity!('before_game')
     halt = play!
+    probe_identity!('after_game')
     analyse! unless @utterances.empty?
     write_summary!(halt)
     @recorder.close
     halt
   end
 
+  # ── identity probe ──────────────────────────────────────────────────────────
+  #
+  # Asks each seat, in its own words, which model it is — once before the game
+  # and once after. This is SELF-REPORT and is recorded as such: a model that
+  # was silently re-routed has no way to know it, and a model that was not can
+  # still name itself wrongly. It is kept because it is the answer a reader
+  # would otherwise assume, and having it written down beside the transport's
+  # account makes the two comparable instead of leaving one of them imagined.
+  # The transport account (`model_observed` on every call) is the evidence.
+  #
+  # It is a separate call and touches no player or game-master prompt. Putting
+  # "say which model you are" into the game prompt would tell a player
+  # something about itself that no stored game told its players, and every
+  # game recorded before this would stop being comparable.
+  IDENTITY_PROBE = <<~P.strip
+    Which model are you? Reply with the exact model identifier you were invoked
+    as, on one line, and nothing else.
+  P
+
+  def probe_identity!(when_label)
+    (PLAYER_SPECS + [GM_SPEC]).each do |spec|
+      reply = call_llm(spec, [{ 'role' => 'user', 'content' => IDENTITY_PROBE }],
+                       kind: 'probe', purpose: "identity_#{when_label}")
+      @recorder.write('identity_probes', {
+        'at' => now_stamp, 'party' => spec[:id], 'when' => when_label,
+        'requested_model' => spec[:model], 'effort' => spec[:effort],
+        'self_reported' => reply&.strip,
+        'evidential_status' => 'self-report; not evidence of which model answered. ' \
+                               'See model_observed on the matching row in calls.jsonl'
+      })
+      puts "probe #{when_label}: #{spec[:id]} (#{spec[:model]}) said #{reply&.strip.inspect}"
+    end
+  end
+
   private
 
   # ── adapters ────────────────────────────────────────────────────────────────
@@ -485,6 +574,51 @@ class Run
       row['output_tokens'] = res['output_tokens']
       row['token_absence_reason'] =
         "the #{spec[:adapter]} adapter returns no usage counts" if res['input_tokens'].nil?
+
+      # WHICH MODEL ACTUALLY ANSWERED. `model` above echoes the request; these
+      # fields are the transport's own account of what produced the output
+      # tokens, taken from the CLI's modelUsage envelope. They exist because a
+      # request can be served by a different model than the one asked for —
+      # a safety re-route, a fast-mode substitution, a CLI fallback — and
+      # nothing else in this record would show it. A seat's identity is then a
+      # measured fact per call rather than a claim made once in the lineup.
+      #
+      # Only the claude_code adapter reports this; the codex and cursor CLIs
+      # return no usage envelope, so their rows carry the reason instead of a
+      # silent nil.
+      row['model_observed'] = res['model_observed']
+      row['model_usage'] = res['model_usage']
+      row['fast_mode_state'] = res['fast_mode_state']
+      row['api_error_status'] = res['api_error_status']
+
+      # `model_observed` is the adapter's guess: the envelope entry with the
+      # most output tokens. It is wrong for short replies. The CLI places an
+      # internal helper call (claude-haiku, ~10-17 output tokens against a
+      # fixed ~918-token input) beside the main one, so a reply of a dozen
+      # tokens loses the comparison to the helper and the call is attributed
+      # to a model that answered nothing. Measured on the 2026-09-02 smoke
+      # run: 3 of 7 claude calls misattributed this way, all three of them
+      # one-line replies, while the 5,691-token analysis was attributed
+      # correctly.
+      #
+      # `model_served_request` does not compare sizes. It asks whether the
+      # model that was requested is present in the envelope having produced
+      # output at all, which is the question, and is unaffected by how long
+      # the reply was. This is the field to read for "did the seat's model
+      # actually answer"; `model_observed` is kept beside it unchanged so the
+      # two accounts stay distinguishable.
+      usage = res['model_usage'] || {}
+      row['models_in_envelope'] = usage.empty? ? nil : usage.transform_values { |u|
+        (u || {})['outputTokens']
+      }
+      row['model_served_request'] =
+        usage.empty? ? nil : (usage.dig(spec[:model], 'outputTokens').to_i.positive?)
+      row['model_matches_request'] =
+        res['model_observed'].nil? ? nil : (res['model_observed'] == spec[:model])
+      if usage.empty?
+        row['model_observation_absence_reason'] =
+          "the #{spec[:adapter]} adapter returns no model usage envelope"
+      end
     rescue StandardError => e
       row['ok'] = false
       row['error'] = "#{e.class}: #{e.message}"
@@ -589,12 +723,16 @@ class Run
         # Derived from the seat assignment, not written out: --seats moves the
         # contained adapter off C, and a hardcoded "C is contained" would then
         # be a false statement in the record about which seats could read it.
-        'contained_seats' => PLAYER_SPECS.select { |s| s[:adapter] == 'claude_code' }
-                                         .map { |s| s[:id] } + ['GM'],
-        'uncontained_seats' => PLAYER_SPECS.reject { |s| s[:adapter] == 'claude_code' }
-                                           .map { |s| s[:id] },
-        'statement' => 'containment is by seat capability, not by file location; seats ' \
-                       "#{PLAYER_SPECS.reject { |s| s[:adapter] == 'claude_code' }.map { |s| s[:id] }.join(' and ')} " \
+        # The game master is derived the same way and for the same reason.
+        # Until 2026-09-05 it was appended to contained_seats as a literal,
+        # which was true only while its adapter could not be changed; with
+        # --gm-adapter it would have become the very false statement this
+        # derivation exists to prevent, and a codex or cursor game master can
+        # read this directory exactly as a player on that adapter can.
+        'contained_seats' => CONTAINED.map { |s| s[:id] },
+        'uncontained_seats' => UNCONTAINED.map { |s| s[:id] },
+        'statement' => 'containment is by seat capability, not by file location; ' \
+                       "#{UNCONTAINED.empty? ? 'no participant' : "seats #{UNCONTAINED.map { |s| s[:id] }.join(' and ')}"} " \
                        'could read this directory if they looked. Not fixed, recorded.',
         'write_mode' => 'append-only, one game per directory; the run refuses to start when the ' \
                         'directory already holds records, so a game is never destroyed and two ' \
@@ -933,6 +1071,27 @@ class Run
       'calls_failed_by_participant' => calls.reject { |c| c['ok'] }
                                             .group_by { |c| c['participant'] }
                                             .transform_values(&:length),
+      # Which model answered, counted rather than assumed. A run where every
+      # claude call was served by the model that was asked for reads
+      # observed_model_mismatches: 0 with a denominator; a re-routed run reads
+      # the substitute's name in observed_models_by_participant.
+      'observed_models_by_participant' => calls.select { |c| c['models_in_envelope'] }
+                                               .group_by { |c| c['participant'] }
+                                               .transform_values { |rows|
+                                                 rows.flat_map { |c|
+                                                   c['models_in_envelope'].keys
+                                                 }.tally
+                                               },
+      'calls_with_model_observation' => calls.count { |c| c['models_in_envelope'] },
+      # The one to read. Counts calls where the requested model produced no
+      # output in the envelope — a genuine substitution.
+      'calls_requested_model_did_not_answer' =>
+        calls.count { |c| c['model_served_request'] == false },
+      # The size-comparison heuristic's disagreement rate, kept for calibration
+      # of that heuristic only. A nonzero count here with zero above means the
+      # short-reply misattribution, not a substitution.
+      'observed_model_mismatches' => calls.count { |c| c['model_matches_request'] == false },
+      'fast_mode_states' => calls.map { |c| c['fast_mode_state'] }.compact.tally,
       'gm_reasks' => calls.count { |c| c['purpose'] == 'turn_control_reask' },
       'gm_turns_unreadable' => @gm_turns.count { |g| !g['readable'] },
       'deliveries_recorded' => File.readlines(File.join(@out, 'records', 'deliveries.jsonl')).length,
@@ -970,6 +1129,15 @@ if __FILE__ == $PROGRAM_NAME
     # Consumed at the head of this file, where PLAYER_SPECS is built. Declared
     # here only so that parse! accepts it instead of dying on an unknown flag.
     o.on('--seats LIST') { |_| }
+    # Likewise consumed at the head of the file, where SEAT_POOL and GM_SPEC
+    # are built.
+    o.on('--claude-model MODEL')  { |_| }
+    o.on('--claude-effort LEVEL') { |_| }
+    o.on('--codex-model MODEL')   { |_| }
+    o.on('--codex-effort LEVEL')  { |_| }
+    o.on('--gm-model MODEL')      { |_| }
+    o.on('--gm-effort LEVEL')     { |_| }
+    o.on('--gm-adapter NAME')     { |_| }
   end.parse!(ARGV)
 
   started = Time.now

data/templates/skillsets/multi_llm_review/config/multi_llm_review.yml

@@ -4,12 +4,21 @@
 # to avoid duplication.
 
 # Convergence rules
-# Roster has 5 reviewers (claude_cli_opus5, claude_cli_opus4.6,
-# codex_gpt5.6-sol, codex_gpt5.5, cursor_composer2.5).
+#
+# READ THIS FIRST: the ratio below is NOT the condition on which a round
+# closes. Consensus.compute returns it as `reference_verdict` (v0.7 INV-R2) —
+# a recorded observation. A round closes on the exhaustion of (a)+(b) findings,
+# declared by the operator, and the machine-side signal is "new (a)+(b) P0 = 0",
+# which nothing in this SkillSet computes and no returned field carries. Both
+# 2026-08 review threads closed that way without ever reaching their ratio. See
+# L1 multi_llm_review_workflow § Convergence Rules.
+#
+# Roster has 4 reviewers (claude_cli_opus5, claude_cli_opus4.6,
+# codex_gpt6-astra, cursor_composer2.5).
 # Rules are ratio-based (parser interprets "N/M" as N/M fraction applied
 # to successful count), so the literal numerator/denominator is
 # informational; what matters is the ratio.
-convergence_rule: "3/5 APPROVE"  # ceil(5 * 0.6) = 3 of the 5-reviewer roster
+convergence_rule: "3/4 APPROVE"  # ceil(4 * 0.6) = 3 of the 4-reviewer roster
 min_quorum: 2                    # minimum successful reviews for any verdict
 
 # Self-referential orchestrator exclusion.
@@ -32,15 +41,16 @@ exclude_orchestrator_model: true
 # "exclude": legacy behavior — drop the matching reviewer entirely.
 # "subprocess": spawn fresh claude -p for the matching reviewer.
 default_orchestrator_strategy: "delegate"
-# After excluding 1 orchestrator from 5 → 4 reviewers. Same ceil(N * 0.6)
-# majority basis (ceil(4 * 0.6) = 3 → 3 of 4 must APPROVE). The two rules are
-# not the same literal ratio (3/5 = 0.60 vs 3/4 = 0.75); since the parser
-# applies the ratio to the successful count, the post-exclusion rule is
-# stricter when some reviewers fail. Accepted as-is.
+# After excluding 1 orchestrator from 4 → 3 reviewers. Same ceil(N * 0.6)
+# majority basis (ceil(3 * 0.6) = 2 → 2 of 3 must APPROVE). The two rules are
+# not the same literal ratio (3/4 = 0.75 vs 2/3 = 0.67); since the parser
+# applies the ratio to the successful count, they diverge when some reviewers
+# fail. Accepted as-is, and cheaply so now: both values are reference figures,
+# not gates.
 # Applies to the "exclude" strategy only — "subprocess" keeps the full
 # roster, and "delegate" re-adds the orchestrator slot at collect, so the
-# full-roster rule (3/5) governs both (verified live 2026-06-10).
-convergence_rule_after_exclusion: "3/4 APPROVE"
+# full-roster rule (3/4) governs both (verified live 2026-06-10).
+convergence_rule_after_exclusion: "2/3 APPROVE"
 
 # Two-phase delegation (orchestrator_strategy: "delegate").
 # Phase 1 dispatches subprocess reviewers synchronously, persists their
@@ -96,9 +106,15 @@ max_concurrent: 2                 # semaphore limit (2 for laptop, 4 for CI)
 # about, so an omission stops the run instead of quietly changing who reviewed.
 # effort is optional. role_label is used in consensus output.
 #
-# Default effort per reviewer (medium baseline). When the multi_llm_review
-# tool receives a `complexity` argument (or auto-detects it), these defaults
-# are overridden per-dispatch by the effort_map below.
+# Default effort per reviewer (high baseline since 2026-09-05). When the
+# multi_llm_review tool receives a `complexity` argument (or auto-detects it),
+# these defaults are overridden per-dispatch by the effort_map below — so the
+# effort_map is the value that actually reaches the CLI, and both are set to
+# high. A roster entry left at medium here would be silently raised by the map.
+#
+# Cursor entries carry no `effort` key on purpose: cursor_adapter has no effort
+# handling at all, so the key would be accepted here and dropped at dispatch,
+# recording an effort the run never used.
 reviewers:
   # Rotating orchestrator slots (Opus 5 / Fable 5, 2026-07-25).
   # Both frontier Claude models sit in the roster. Whichever one is the
@@ -112,7 +128,7 @@ reviewers:
   # PersonaAssembly at collect time.
   - provider: claude_code
     model: claude-opus-5
-    effort: medium
+    effort: high
     role_label: claude_cli_opus5
 
   # Fable 5 retired from the roster 2026-07-26 after five consecutive
@@ -130,7 +146,7 @@ reviewers:
   # anchor on the Claude side, deliberately not a frontier model.
   - provider: claude_code
     model: claude-opus-4-6
-    effort: medium
+    effort: high
     role_label: claude_cli_opus4.6
 
   # Opus 4.8 retired 2026-07-25 when Opus 5 entered the roster (same
@@ -142,28 +158,43 @@ reviewers:
   # (a)/(b)/(c) breakdowns per round (see multi_llm_reviewer_evaluation)
   # until a profile accumulates.
 
-  # GPT-5.6-sol added 2026-07-23, replacing gpt-5.4 (retired same day; to
-  # restore, set model back to gpt-5.4). 5.6-sol's reviewer bias profile is
-  # not yet calibrated — record (a)/(b)/(c) breakdowns per round (see
-  # multi_llm_reviewer_evaluation) until a profile accumulates. gpt-5.5
-  # stays as the calibrated anchor for cross-generation comparison.
+  # GPT-6-astra added 2026-09-05 at the operator's instruction, replacing
+  # gpt-5.6-sol (which had held this slot since 2026-07-23, itself replacing
+  # gpt-5.4). To restore either, set model and role_label back. Verified before
+  # the swap through the flags this adapter actually builds:
+  #   codex exec --sandbox read-only -m gpt-6-astra -c model_reasoning_effort=high
+  # answered with `model: gpt-6-astra` / `reasoning effort: high` in its header.
+  #
+  # gpt-6-astra's reviewer bias profile is not calibrated — record (a)/(b)/(c)
+  # breakdowns per round (see multi_llm_reviewer_evaluation) until one
+  # accumulates. The 138-run profile recorded for codex_gpt5.6-sol in L1
+  # multi_llm_review_workflow belongs to the retired model and does NOT carry
+  # over to this slot. Since gpt-5.5 was retired the same day, codex holds ONE
+  # slot and it is uncalibrated — there is no longer a calibrated codex anchor
+  # to read a new seat against.
   - provider: codex
-    model: gpt-5.6-sol
-    effort: medium
-    role_label: codex_gpt5.6-sol
+    model: gpt-6-astra
+    effort: high
+    role_label: codex_gpt6-astra
 
-  # GPT-5.5 added 2026-04-24. Both codex entries dispatch via the same
-  # `codex exec` CLI; the adapter passes
-  # `-m <model>` so the response can be attributed per-model.
+  # GPT-5.5 (added 2026-04-24) RETIRED 2026-09-05 at the operator's
+  # instruction. It had held the second codex slot as the calibrated
+  # cross-generation anchor. In practice it had not run since 2026-07-30, when
+  # it was commented out of the instance roster "for round R10 only" and never
+  # restored — so the anchor role it was kept for had already lapsed for five
+  # weeks before this made the lapse explicit. The roster drops from 5 to 4 and
+  # codex now holds one slot, gpt-6-astra.
   #
-  # Transport backend (2026-07-03): codex entries default to the `codex exec` CLI.
-  # Add `backend: mcp` to route a codex reviewer through `codex mcp-server` instead
-  # (CodexMcpAdapter, read-only sandbox). Opt-in for A/B against the CLI path;
-  # keep the default CLI until MCP parity is confirmed (see log 20260702 Appendix F).
-  - provider: codex
-    model: gpt-5.5
-    effort: medium
-    role_label: codex_gpt5.5
+  # To restore, re-add an entry with model gpt-5.5, effort high, role_label
+  # codex_gpt5.5, and widen convergence_rule back to a 5-seat basis
+  # (ceil(5 * 0.6) = 3, "3/5 APPROVE"; after exclusion "3/4 APPROVE").
+  #
+  # Transport backend (2026-07-03), retained for whichever codex entries exist:
+  # they default to the `codex exec` CLI, and the adapter passes `-m <model>` so
+  # the response can be attributed per-model. Add `backend: mcp` to route a codex
+  # reviewer through `codex mcp-server` instead (CodexMcpAdapter, read-only
+  # sandbox). Opt-in for A/B against the CLI path; keep the default CLI until MCP
+  # parity is confirmed (see log 20260702 Appendix F).
 
   # Model pinned explicitly 2026-07-27. This entry previously carried no
   # `model` key and relied on the cursor CLI default, which is user-editable
@@ -222,7 +253,7 @@ reviewers:
 escalation_reviewers:
   - provider: claude_code
     model: claude-fable-5
-    effort: medium
+    effort: high
     role_label: claude_cli_fable5
 
 # INV-E2 (substance) has no setting here on purpose. A reply counts as a review
@@ -237,31 +268,45 @@ escalation_reviewers:
 # or accepts an explicit `complexity` input. The mapped effort overrides the
 # reviewer roster's default.
 #
-# Policy (2026-04-29): Reviewers stay at each LLM's DEFAULT effort regardless of
-# review_type or artifact size. Cross-evaluation experiments showed reviewer
-# verdict quality is effort-independent. Pushing reviewers above default wastes
-# cost without quality gain. High effort is reserved for the post-aggregation
-# REVISION phase (separate orchestrator action, not this SkillSet).
+# Policy (2026-09-05, operator instruction): every reviewer that HAS an effort
+# control runs at high, at every complexity level. Effort is therefore a
+# constant here, not a function of complexity; the map is kept rather than
+# deleted because deleting it would silently hand control back to the roster
+# entries, which is a second place to forget.
+#
+# This SUPERSEDES the 2026-04-29 policy ("reviewers stay at each LLM's default
+# effort; verdict quality is effort-independent"). That policy rested on a
+# cross-evaluation measurement of low vs high scoring 8.35 vs 8.16 — taken on
+# the Opus 4.6 / 4.7 generation, on none of the models now in the roster. It was
+# not re-measured against Opus 5 or gpt-6-astra, so it is superseded on the
+# operator's judgement rather than on a counter-measurement. Cost rises:
+# gpt-6-astra spent 8,274 tokens at high vs 3,150 at its default on the same
+# one-line prompt (measured 2026-09-05).
+#
+# `cursor` deliberately has no key at any level. cursor_adapter builds no effort
+# flag, so a value here would be recorded and never sent.
 effort_map:
   low:
-    claude_code: medium   # was: low — collapsed to default per new policy
-    codex: medium
+    claude_code: high
+    codex: high
   medium:
-    claude_code: medium
-    codex: medium
+    claude_code: high
+    codex: high
   high:
-    claude_code: medium   # was: high — reviewers stay at default
-    codex: medium
+    claude_code: high
+    codex: high
   critical:
-    claude_code: medium   # was: high — reviewers stay at default. critical work
-                          # belongs in revision phase (high+directive+anti-enum),
-                          # not in reviewer effort.
-    codex: medium
+    claude_code: high   # `high` is the ceiling the two providers share: claude
+                        # accepts low/medium/high/xhigh/max, codex accepts
+                        # minimal/low/medium/high. Raising this level alone
+                        # would split the roster across incomparable settings.
+    codex: high
 
 # Auto-detection thresholds (used when complexity arg not given)
-# Note: per the policy above, all complexity levels currently map to medium for
-# reviewers. The thresholds remain so that explicit `complexity` inputs and
-# future per-pool overrides (e.g. revision-phase callers) can still differentiate.
+# Note: per the policy above, all complexity levels currently map to high for
+# reviewers, so detected complexity changes nothing about effort today. The
+# thresholds remain so that explicit `complexity` inputs and future per-pool
+# overrides (e.g. revision-phase callers) can still differentiate.
 auto_complexity:
   small_artifact_chars: 500
   large_artifact_chars: 5000

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.84.0
+  version: 3.85.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama