@adhdev/daemon-core 0.9.82-rc.506 → 0.9.82-rc.508

package/dist/mesh/coordinator-prompt.d.ts

@@ -21,6 +21,7 @@
  * a static prompt, which is also fine.
  */
 import type { LocalMeshEntry, RepoMeshStatus } from '../repo-mesh-types.js';
+import type { MagiKindPanelMap } from '@adhdev/mesh-shared';
 /**
  * Cheap, locally-derived "what just happened" snapshot for the coordinator
  * prompt. Built at launch from the local ledger + work-queue stats — no remote
@@ -91,5 +92,25 @@ export interface CoordinatorPromptContext {
      * section.
      */
     operatingNotes?: CoordinatorOperatingNote[];
+    /**
+     * Machine-local MAGI kind-panel bindings (`~/.adhdev/meshes.json`
+     * `magiKindPanels`), read live at launch. Omitted / empty / all-empty →
+     * no "## Configured MAGI panels" section, so a mesh with no MAGI configured
+     * renders identically to before. Threaded in the same systematic way as the
+     * brain presets: read machine-local config at launch, render a pure section.
+     */
+    magiKindPanels?: MagiKindPanelMap;
 }
 export declare function buildCoordinatorSystemPrompt(ctx: CoordinatorPromptContext): string;
+/**
+ * Render the machine-local MAGI kind-panel bindings so the coordinator KNOWS
+ * which cross-verification panels (rca / design / claim_audit / freeform) are
+ * actually configured on this machine. Without this the coordinator only sees
+ * the `mesh_magi_*` tools in the static table and has no idea MAGI is set up.
+ *
+ * Pure — takes the panels map (read live at launch, mirroring how brain presets
+ * read getDifficultyBrains). Returns null (section OMITTED) when nothing usable
+ * is configured: undefined/null map, or every kind maps to an empty slot list.
+ * That keeps a MAGI-less mesh's prompt byte-identical to before.
+ */
+export declare function buildMagiKindPanelsSection(panels: MagiKindPanelMap | undefined | null): string | null;

package/dist/mesh/model-provider-compat.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Provider ↔ model compatibility guard for brain/slot-derived launch models.
+ *
+ * WHY THIS EXISTS: the difficulty→brain presets (and MAGI slots) carry
+ * provider-agnostic model strings like `opus`/`sonnet`/`haiku`, which are
+ * Anthropic (Claude) model names. When a task lands on a node whose provider is
+ * NOT Anthropic-backed — `codex-cli` (ChatGPT), `antigravity-cli`, `hermes-cli`
+ * — forwarding a `claude-*` model as the launch arg makes that provider convert
+ * it to e.g. `-c model='claude-...'`, and a ChatGPT-account codex then rejects
+ * the launch with a 400. The model string was never meant to be forced onto a
+ * provider that can't honor it (presets are "best-effort at launch").
+ *
+ * The invariant this enforces: **an Anthropic (`claude-*`) model is never passed
+ * as a launch argument to a non-Anthropic provider.** When a preset/slot model is
+ * incompatible with the resolved provider, drop the model (the provider then uses
+ * its own default) and keep only the provider-neutral axis (thinkingLevel).
+ *
+ * This is deliberately conservative: it only strips a model that is *known* to be
+ * Anthropic when the provider is *known* to be non-Anthropic. Unknown models and
+ * unknown providers pass through unchanged so a legitimately provider-specific
+ * model (e.g. an operator who configured `gpt-5-codex` on a codex slot) is not
+ * clobbered.
+ */
+/**
+ * True when `providerType` is an Anthropic-backed provider (Claude). Matching is
+ * case-insensitive and tolerant of surrounding whitespace. An empty/undefined
+ * provider is treated as non-Anthropic (unknown → don't assume Claude).
+ */
+export declare function isAnthropicProvider(providerType: string | undefined | null): boolean;
+/**
+ * True when `model` names an Anthropic (Claude) model — the provider-agnostic
+ * brain-preset aliases (`opus`/`sonnet`/`haiku`) or any explicit `claude-*` id.
+ * Case-insensitive. Non-Anthropic and unknown models return false so they pass
+ * the compatibility check unchanged.
+ */
+export declare function isAnthropicModel(model: string | undefined | null): boolean;
+/**
+ * Compatibility check for a brain/slot-derived launch model against the provider
+ * it would launch on. Returns false ONLY for the concrete failure mode we guard:
+ * an Anthropic model routed to a non-Anthropic provider. Everything else
+ * (no model, non-Anthropic model, Anthropic provider, unknown provider) is
+ * compatible so nothing legitimate is stripped.
+ */
+export declare function isModelCompatibleWithProvider(model: string | undefined | null, providerType: string | undefined | null): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.506",
+  "version": "0.9.82-rc.508",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.506",
-    "@adhdev/session-host-core": "0.9.82-rc.506",
+    "@adhdev/mesh-shared": "0.9.82-rc.508",
+    "@adhdev/session-host-core": "0.9.82-rc.508",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/commands/high-family/mesh-coordinator-launch.ts

@@ -138,6 +138,19 @@ export const meshCoordinatorLaunchHandlers: Record<string, HighFamilyHandler> =
                         } catch { return undefined; }
                     };
 
+                    // MAGI panels: load the machine-local kind-panel bindings so the
+                    // coordinator prompt auto-lists which cross-verification panels
+                    // (rca / design / claim_audit / freeform) are configured. Same
+                    // systematic pattern as the brain presets — read machine-local
+                    // config at launch. Best-effort: a read failure or empty map just
+                    // omits the "## Configured MAGI panels" section.
+                    const loadMagiKindPanelsBestEffort = async () => {
+                        try {
+                            const { listMagiKindPanels } = await import('../../config/mesh-config.js');
+                            return listMagiKindPanels();
+                        } catch { return undefined; }
+                    };
+
                     // Support inline mesh data from cloud (bypasses local meshes.json lookup)
                     let mesh: any;
                     if (args?.inlineMesh && typeof args.inlineMesh === 'object') {
@@ -264,7 +277,7 @@ export const meshCoordinatorLaunchHandlers: Record<string, HighFamilyHandler> =
                         // Build coordinator prompt first — fail closed on errors.
                         let cliCmdSystemPrompt = '';
                         try {
-                            cliCmdSystemPrompt = buildCoordinatorSystemPrompt({ mesh: effectiveMesh, coordinatorCliType: cliType, userInstruction: extraSystemPrompt || undefined, missionSection: buildMissionSectionBestEffort(mesh.id), recentActivity: await buildRecentActivityBestEffort(mesh.id), operatingNotes: await buildEffectiveOperatingNotes(mesh.id) });
+                            cliCmdSystemPrompt = buildCoordinatorSystemPrompt({ mesh: effectiveMesh, coordinatorCliType: cliType, userInstruction: extraSystemPrompt || undefined, missionSection: buildMissionSectionBestEffort(mesh.id), recentActivity: await buildRecentActivityBestEffort(mesh.id), operatingNotes: await buildEffectiveOperatingNotes(mesh.id), magiKindPanels: await loadMagiKindPanelsBestEffort() });
                         } catch (error: any) {
                             const message = error?.message || String(error);
                             LOG.error('MeshCoordinator', `Failed to build coordinator prompt: ${message}`);
@@ -484,7 +497,7 @@ export const meshCoordinatorLaunchHandlers: Record<string, HighFamilyHandler> =
                     // broken mesh state is visible instead of silently launching with weaker rules.
                     let systemPrompt = '';
                     try {
-                        systemPrompt = buildCoordinatorSystemPrompt({ mesh: effectiveMesh, coordinatorCliType: cliType, userInstruction: extraSystemPrompt || undefined, missionSection: buildMissionSectionBestEffort(mesh.id), recentActivity: await buildRecentActivityBestEffort(mesh.id), operatingNotes: await buildEffectiveOperatingNotes(mesh.id) });
+                        systemPrompt = buildCoordinatorSystemPrompt({ mesh: effectiveMesh, coordinatorCliType: cliType, userInstruction: extraSystemPrompt || undefined, missionSection: buildMissionSectionBestEffort(mesh.id), recentActivity: await buildRecentActivityBestEffort(mesh.id), operatingNotes: await buildEffectiveOperatingNotes(mesh.id), magiKindPanels: await loadMagiKindPanelsBestEffort() });
                     } catch (error: any) {
                         const message = error?.message || String(error);
                         LOG.error('MeshCoordinator', `Failed to build coordinator prompt: ${message}`);

package/src/mesh/coordinator-prompt.ts

@@ -34,6 +34,7 @@ import type {
 import { mergeAndNormalizePolicy } from '../repo-mesh-types.js';
 import { getDifficultyBrains } from '../config/mesh-config.js';
 import { MESH_TASK_DIFFICULTIES } from '@adhdev/mesh-shared';
+import type { MagiKindPanelMap, MagiSlot, MagiTaskKind } from '@adhdev/mesh-shared';
 
 /**
  * Cheap, locally-derived "what just happened" snapshot for the coordinator
@@ -109,6 +110,14 @@ export interface CoordinatorPromptContext {
      * section.
      */
     operatingNotes?: CoordinatorOperatingNote[];
+    /**
+     * Machine-local MAGI kind-panel bindings (`~/.adhdev/meshes.json`
+     * `magiKindPanels`), read live at launch. Omitted / empty / all-empty →
+     * no "## Configured MAGI panels" section, so a mesh with no MAGI configured
+     * renders identically to before. Threaded in the same systematic way as the
+     * brain presets: read machine-local config at launch, render a pure section.
+     */
+    magiKindPanels?: MagiKindPanelMap;
 }
 
 /**
@@ -284,6 +293,11 @@ Repository: \`${mesh.repoIdentity}\`${mesh.defaultBranch ? `\nDefault branch: \`
     // ── Brain presets (difficulty → model/thinking) ──
     sections.push(buildBrainPresetsSection());
 
+    // ── Configured MAGI panels (machine-local magiKindPanels) — only present
+    //     when at least one task_kind has a non-empty slot list. ──
+    const magiSection = buildMagiKindPanelsSection(ctx.magiKindPanels);
+    if (magiSection) sections.push(magiSection);
+
     // ── Tools ──
     sections.push(TOOLS_SECTION);
 
@@ -634,6 +648,58 @@ function buildBrainPresetsSection(): string {
     return lines.join('\n');
 }
 
+/**
+ * Render the machine-local MAGI kind-panel bindings so the coordinator KNOWS
+ * which cross-verification panels (rca / design / claim_audit / freeform) are
+ * actually configured on this machine. Without this the coordinator only sees
+ * the `mesh_magi_*` tools in the static table and has no idea MAGI is set up.
+ *
+ * Pure — takes the panels map (read live at launch, mirroring how brain presets
+ * read getDifficultyBrains). Returns null (section OMITTED) when nothing usable
+ * is configured: undefined/null map, or every kind maps to an empty slot list.
+ * That keeps a MAGI-less mesh's prompt byte-identical to before.
+ */
+export function buildMagiKindPanelsSection(panels: MagiKindPanelMap | undefined | null): string | null {
+    if (!panels) return null;
+    // Keep only kinds with a non-empty slot list; drop empty/undefined bindings.
+    const configured = (Object.entries(panels) as Array<[MagiTaskKind, MagiSlot[] | undefined]>)
+        .filter(([, slots]) => Array.isArray(slots) && slots.length > 0) as Array<[MagiTaskKind, MagiSlot[]]>;
+    if (configured.length === 0) return null;
+
+    const lines = [
+        '## Configured MAGI panels',
+        '',
+        'These machine-local MAGI kind-panels are configured on this mesh — read-only cross-verification quorums:',
+        '',
+    ];
+
+    for (const [kind, slots] of configured) {
+        const replicaCount = slots.reduce((sum, s) => sum + (s.n && s.n > 0 ? s.n : 1), 0);
+        const label = replicaCount === slots.length
+            ? `${slots.length} ${slots.length === 1 ? 'slot' : 'slots'}`
+            : `${replicaCount} replicas`;
+        const rendered = slots.map(renderMagiSlot).join(', ');
+        lines.push(`- **${kind}** (${label}): ${rendered}`);
+    }
+
+    lines.push('');
+    lines.push('Use these via `mesh_magi_review` (the `task_kind` is REQUIRED — it selects BOTH the output schema and the panel). The live authoritative slot list is `mesh_magi_kind_panel_list`. MAGI worker replicas are read-only and typically do NOT have mesh MCP tools exposed, so for live timing / tool-behavior claims you MUST gather the primary evidence yourself and use MAGI only for independent source-level corroboration.');
+
+    return lines.join('\n');
+}
+
+/** Render one MAGI slot as `provider[@nodeId][ (model, tags…, xN)]`. */
+function renderMagiSlot(slot: MagiSlot): string {
+    let s = slot.provider;
+    if (slot.nodeId) s += `@${slot.nodeId}`;
+    const extra: string[] = [];
+    if (slot.model) extra.push(`model: ${slot.model}`);
+    if (slot.capabilityTags && slot.capabilityTags.length) extra.push(`tags: ${slot.capabilityTags.join('+')}`);
+    if (slot.n && slot.n > 1) extra.push(`×${slot.n}`);
+    if (extra.length) s += ` (${extra.join(', ')})`;
+    return s;
+}
+
 function buildPolicySection(policy: RepoMeshPolicy): string {
     const rules: string[] = [];
     if (policy.requirePreTaskCheckpoint) rules.push('- Create a git checkpoint **before** starting each task');
@@ -738,7 +804,9 @@ Follow these recovery rules:
 1. **If "Retry recommended"**: Check \`mesh_view_queue\` first — the daemon may have auto-requeued. If not, re-launch the session on the same node (\`mesh_launch_session\`), then resend the original task (\`mesh_send_task\`). The system message includes the original task text.
 2. **If "Max retries exceeded"**: Do NOT retry on the same node. Either reassign the task to a different node, or inform the user that the task requires manual intervention.
 3. **If no recovery context**: The stop may be intentional (normal completion). Use \`mesh_read_chat\` once to verify, then move on.
-4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.`;
+4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.
+5. **Stuck-but-done vs actually-stuck**: If a delegated session appears stuck but has already produced a verified final summary or diff, stop polling noisy tool/terminal transcript bubbles. Verify with \`mesh_git_status\` or a checkpoint and proceed to landing.
+6. **Refinery falsely blocks a verified-clean branch — manual fast-forward convergence**: When \`mesh_refine_node\` falsely blocks a verified-clean branch (stale preflight, or the submodule-gitlink trivial-fast-forward misjudgment), bypass the refine tool and converge by strict fast-forward — (1) rebase the submodule commit onto the submodule \`origin/main\`, (2) push the submodule ff-only (verify \`git merge-base --is-ancestor\` first), (3) rebase the root branch and re-bump the submodule pointer so the root diff stays non-empty, (4) push the root ff-only. NEVER force-push or reset; abort and report on any non-fast-forward.`;
 
 const ONBOARDING_SECTION = `## Onboarding / Reinit
 
@@ -771,7 +839,7 @@ function buildRulesSection(coordinatorCliType?: string): string {
 
 - **Route, don't implement.** Delegate all code reading, analysis, and execution to node agents. Never read source files or run commands in the coordinator — keep context lean.
 - **Front-load task messages.** Include everything the agent needs (files, problem, expected fix) in \`mesh_enqueue_task\` / \`mesh_send_task\`. Append a structured result request at the end: ask the worker to conclude with a JSON block containing \`status\`, \`changedFiles\`, \`gitStatus\`, \`validationResults\`, \`errors\`, \`nextAction\`. The daemon parses this automatically; you can read it from \`mesh_task_history\`.
-- **Reuse idle sessions.** For follow-up, retry, commit/push, or cleanup on the same issue, send only the delta to the existing idle session. Start fresh only for independent work, provider mismatch, transcript contamination, or required worktree isolation.
+- **Reuse idle sessions.** For follow-up, retry, commit/push, or cleanup on the same issue, send only the delta to the existing idle session. Start a fresh session only when: (a) branch/worktree isolation is required, (b) the existing session had a dispatch failure or provider mismatch, (c) the transcript/runtime is contaminated or interrupted, or (d) the user explicitly asks for a different provider/session. Continuation of the same issue in an already-idle session is allowed and preferred — this rule blocks concurrent unrelated work interleaved into a live (still-generating) session, not sequential same-issue follow-ups.
 - **Worktree affinity.** A worktree is a durable per-branch workspace; keep all of a branch's code_change/fix/review work on its worktree node by targeting \`required_tags: ["worktree=<branch>"]\` or \`target_node_id\`. Get the id/branch from the \`mesh_clone_node\` result or a live \`mesh_status\` — the Configured Nodes snapshot won't list a worktree cloned after launch. Untargeted same-branch follow-ups drift to the base node. Only \`convergence\` (merge/push) runs on the base, never pinned to the worktree.
 - **Classify task difficulty to save tokens.** For each task you enqueue, judge its execution difficulty and pass \`difficulty\`: \`easy\` (extraction, renames, doc tweaks, trivial fixes), \`medium\` (ordinary feature/bugfix work), \`difficult\` (architecture, tricky debugging, multi-file refactors, subtle reasoning), or \`freeform\`. The mesh's per-difficulty brain preset then runs easy tasks on a cheaper model at low reasoning effort and hard tasks on a stronger model at high effort — real token savings on simple work. The current presets are shown in the "Brain presets" section below. You may still pass an explicit \`model\`/\`thinkingLevel\` to override the preset for one task.
 - **Retune node profiles when routing is a poor fit — but only with approval.** A node's capability slots (its provider/model/thinking + difficulty range + capability tags, seen via \`mesh_node_slots_list\`) are what task→node fitness routing matches against. If you notice a persistent mismatch — e.g. every \`difficult\` task lands on a node whose only slot is a cheap model, or a capability a node clearly has isn't declared — you MAY propose a slot change with \`mesh_node_slots_set\` (write=false). That returns current-vs-proposed; present that diff to the user with a one-line reason and apply (write=true) ONLY after they approve. It is a WHOLESALE replacement of the node's slots, so include the slots you want to keep. Never rewrite a node's profile silently or without a clear routing reason.
@@ -779,12 +847,15 @@ function buildRulesSection(coordinatorCliType?: string): string {
 - **Verify via git, not source.** Use \`mesh_git_status\` to confirm side effects. Treat agent summaries as self-reports, not verification.
 - **Limit parallelism.** Start with 1–2 tasks; scale only on success. Never duplicate a session because \`mesh_read_chat\` shows no final message while tool/terminal activity is ongoing. This caps *concurrent* load — it does not mean serialize independent work: when a new, independent request arrives and there is headroom under \`maxParallelTasks\`, dispatch it right away rather than waiting for an in-flight task or a user nudge (read-only diagnosis especially, since it has no merge cost).
 - **Check history first.** Call \`mesh_task_history\` at session start to avoid duplicate work and inform recovery. On failure, read task history before retrying.
+- **Don't reopen already-done work after a resume.** Before reopening a reported issue after context compaction or session resume, check current git state and recent session context. If another session has already completed the work, continue from the existing diff/commit instead of starting a duplicate investigation.
 - **Sequence shared-base-moving merges.** Parallel dispatch is encouraged, but merging one worktree can advance another in-flight worktree's base — especially a shared submodule pointer — turning a clean fast-forward into a diverged rebase (patch-equivalence correctly blocks this). Before merging an in-flight worktree while siblings are also in flight, land in an intentional order, re-clone long-running worktrees from the advanced base, or expect to manually rebase + ff-only the laggards; merging an independent fix mid-flight can strand siblings into a rebase.
 - **Converge branches.** After worktree tasks: refine/fast-forward, or classify as \`pushed_feature_branch_needs_merge\` / \`blocked_review\` / \`cleanup_candidate\` / \`not_mergeable\`. Clean up with \`mesh_remove_node\`.
 - **Refinery is config-driven.** \`mesh_refine_node\` must run validation from \`.adhdev/refine.{json,yaml,yml}\` or \`repo-mesh.refine.*\`. Heuristics are scaffolding only.
 - **Submodule reachability = publish-needed.** \`submodule_reachability_failed\` → classify as \`blocked_review\`, request user approval to push to submodule main, then rerun \`mesh_refine_node\`.
 - **Honor per-node instructions.** When a node carries a 📌 Node instruction in the nodes section, include the relevant parts of that instruction in the task message you send to that node. Don't paraphrase the instruction into your own words — quote it verbatim so the worker agent sees exactly what the user wrote.
 - **Mission status does not update itself.** When a mission's tasks are all done or the work is abandoned, explicitly call \`mesh_mission_upsert\` to set status \`completed\` or \`abandoned\`. Never leave a finished mission in \`active\`. All-cancelled tasks with no further work → \`abandoned\`.
+- **Don't spawn a nested coordinator for simple inspection.** Do not spawn a nested coordinator-like agent for simple inspection tasks. If delegation is required, use explicit provider selection and a fully self-contained, bounded task instruction.
+- **Keep internal traffic out of the transcript.** Internal tool calls, status events, control messages, and debug output must not appear as ordinary user-visible chat transcript content unless explicitly marked user-facing by the producing agent.
 - **Never fabricate tool results.** Always call the actual tool.
 - **Keep the user informed.** One or two sentences after each delegation round.${coordinatorNote}
 

package/src/mesh/mesh-queue-assignment.ts

@@ -23,6 +23,7 @@ import { queuePendingMeshCoordinatorEvent, retractPendingDispatchBlockedEvent }
 import { isWorktreeBootstrapStaleRunning, shouldDeferDispatchForBootstrap } from './worktree-bootstrap-config.js';
 import { isWithinCloneBootstrapGrace } from './mesh-clone-grace.js';
 import { beginTaskDispatchInFlight, endTaskDispatchInFlight } from './mesh-task-inflight.js';
+import { isModelCompatibleWithProvider } from './model-provider-compat.js';
 
 /**
  * CANON: the single canonical coordinator-daemon id this daemon stamps onto every
@@ -2056,9 +2057,27 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                 // Slot-derived model/thinking: an explicit task.model/thinkingLevel
                 // (resolved from the enqueue-time brain) still wins; the matched
                 // slot fills only what the task left blank (ORCHESTRATION_NODE_SLOTS.md).
-                const effectiveModel = (typeof task.model === 'string' && task.model.trim()) ? task.model.trim() : resolved.model;
+                const rawEffectiveModel = (typeof task.model === 'string' && task.model.trim()) ? task.model.trim() : resolved.model;
                 const effectiveThinkingLevel = (typeof task.thinkingLevel === 'string' && task.thinkingLevel.trim()) ? task.thinkingLevel.trim() : resolved.thinkingLevel;
 
+                // CODEX-400 GUARD: the difficulty→brain presets (and MAGI slots) carry
+                // provider-agnostic Anthropic model aliases (opus/sonnet/haiku). Now that
+                // resolved.providerType is definitively known, drop the model if it is a
+                // Claude model but the provider is NOT Anthropic-backed (codex-cli /
+                // antigravity-cli / hermes-cli): forwarding `claude-*` as an initialModel
+                // makes those providers convert it to `-c model='claude-...'`, and a
+                // ChatGPT-account codex then rejects the launch with a 400. Stripping it
+                // lets the provider fall back to its own default model; the provider-neutral
+                // thinkingLevel axis is preserved. This is the single authoritative point
+                // that enforces the invariant across every model source (preset, slot,
+                // explicit) because both remote and local launch consume effectiveModel below.
+                const effectiveModel = isModelCompatibleWithProvider(rawEffectiveModel, resolved.providerType)
+                    ? rawEffectiveModel
+                    : undefined;
+                if (rawEffectiveModel && effectiveModel === undefined) {
+                    LOG.info('MeshQueue', `CODEX-400 GUARD: dropped incompatible launch model '${rawEffectiveModel}' for non-Anthropic provider '${resolved.providerType}' on node ${nodeId} (task ${task.id}); provider will use its own default model`);
+                }
+
                 // Don't spawn a session for a (node, provider) already at its declared
                 // maxParallel cap — it would launch only to fail the claim. The claim
                 // transaction enforces the cap regardless; this just avoids a doomed launch.

package/src/mesh/model-provider-compat.ts

@@ -0,0 +1,73 @@
+/**
+ * Provider ↔ model compatibility guard for brain/slot-derived launch models.
+ *
+ * WHY THIS EXISTS: the difficulty→brain presets (and MAGI slots) carry
+ * provider-agnostic model strings like `opus`/`sonnet`/`haiku`, which are
+ * Anthropic (Claude) model names. When a task lands on a node whose provider is
+ * NOT Anthropic-backed — `codex-cli` (ChatGPT), `antigravity-cli`, `hermes-cli`
+ * — forwarding a `claude-*` model as the launch arg makes that provider convert
+ * it to e.g. `-c model='claude-...'`, and a ChatGPT-account codex then rejects
+ * the launch with a 400. The model string was never meant to be forced onto a
+ * provider that can't honor it (presets are "best-effort at launch").
+ *
+ * The invariant this enforces: **an Anthropic (`claude-*`) model is never passed
+ * as a launch argument to a non-Anthropic provider.** When a preset/slot model is
+ * incompatible with the resolved provider, drop the model (the provider then uses
+ * its own default) and keep only the provider-neutral axis (thinkingLevel).
+ *
+ * This is deliberately conservative: it only strips a model that is *known* to be
+ * Anthropic when the provider is *known* to be non-Anthropic. Unknown models and
+ * unknown providers pass through unchanged so a legitimately provider-specific
+ * model (e.g. an operator who configured `gpt-5-codex` on a codex slot) is not
+ * clobbered.
+ */
+
+/**
+ * Provider types that are Anthropic-backed (accept `claude-*` / opus/sonnet/haiku
+ * model names). Everything else is treated as non-Anthropic for the guard.
+ */
+const ANTHROPIC_PROVIDER_TYPES: ReadonlySet<string> = new Set([
+    'claude-cli',
+]);
+
+/**
+ * True when `providerType` is an Anthropic-backed provider (Claude). Matching is
+ * case-insensitive and tolerant of surrounding whitespace. An empty/undefined
+ * provider is treated as non-Anthropic (unknown → don't assume Claude).
+ */
+export function isAnthropicProvider(providerType: string | undefined | null): boolean {
+    const p = typeof providerType === 'string' ? providerType.trim().toLowerCase() : '';
+    return p.length > 0 && ANTHROPIC_PROVIDER_TYPES.has(p);
+}
+
+/**
+ * True when `model` names an Anthropic (Claude) model — the provider-agnostic
+ * brain-preset aliases (`opus`/`sonnet`/`haiku`) or any explicit `claude-*` id.
+ * Case-insensitive. Non-Anthropic and unknown models return false so they pass
+ * the compatibility check unchanged.
+ */
+export function isAnthropicModel(model: string | undefined | null): boolean {
+    const m = typeof model === 'string' ? model.trim().toLowerCase() : '';
+    if (!m) return false;
+    if (m.startsWith('claude') || m.startsWith('anthropic')) return true;
+    // Provider-agnostic brain-preset aliases (DEFAULT_DIFFICULTY_BRAINS) are Claude
+    // model families; a bare `opus`/`sonnet`/`haiku` (optionally with a suffix like
+    // `opus-4` or `sonnet-4-5`) means an Anthropic model.
+    return /^(opus|sonnet|haiku)(\b|[-_])/.test(m);
+}
+
+/**
+ * Compatibility check for a brain/slot-derived launch model against the provider
+ * it would launch on. Returns false ONLY for the concrete failure mode we guard:
+ * an Anthropic model routed to a non-Anthropic provider. Everything else
+ * (no model, non-Anthropic model, Anthropic provider, unknown provider) is
+ * compatible so nothing legitimate is stripped.
+ */
+export function isModelCompatibleWithProvider(
+    model: string | undefined | null,
+    providerType: string | undefined | null,
+): boolean {
+    if (!isAnthropicModel(model)) return true;      // non-Claude model → no constraint
+    if (isAnthropicProvider(providerType)) return true; // Claude model on Claude provider → fine
+    return false;                                    // Claude model on non-Claude provider → block
+}