@ai-dev-methodologies/rlp-desk 0.6.0 → 0.7.1

package/docs/superpowers/plans/2026-04-06-worker-verifier-prompt-restructure.md

@@ -0,0 +1,179 @@
+# Worker/Verifier Prompt Restructure Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Restructure Worker/Verifier prompt templates in init_ralph_desk.zsh to make TDD more prominent, reduce prompt size, and add debugging/anti-rationalization guidance.
+
+**Architecture:** Elevate TDD from procedural guidance to hard constraint box (same level as SCOPE LOCK). Compress Forbidden Shortcuts by removing items already enforced by Verifier. Add "When Stuck" debugging protocol and Verifier anti-rationalization patterns.
+
+**Tech Stack:** zsh heredoc templates in init_ralph_desk.zsh
+
+**Origin:** ralplan consensus (Architect APPROVE + Critic ACCEPT, 2026-04-06)
+
+---
+
+### Task 1: Insert TDD MANDATE and remove old Test-First Approach
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh:323-337`
+
+- [ ] **Step 1: Insert TDD MANDATE after file-reading section (L323), before SCOPE LOCK (L325)**
+
+In `src/scripts/init_ralph_desk.zsh`, find:
+```
+4. Latest Context: $DESK/context/$SLUG-latest.md → current state
+
+## SCOPE LOCK (hard constraint — violation causes verification failure)
+```
+
+Replace with:
+```
+4. Latest Context: $DESK/context/$SLUG-latest.md → current state
+
+## TDD MANDATE (hard constraint — violation = automatic FAIL)
+> Write failing tests FIRST → confirm RED (exit_code=1) → implement minimum code → confirm GREEN.
+> Every NEW AC requires: write_test → verify_red → implement → verify_green in execution_steps.
+> No exceptions. Verifier rejects missing RED evidence. For already-passing ACs, use verify_existing.
+
+## SCOPE LOCK (hard constraint — violation causes verification failure)
+```
+
+- [ ] **Step 2: Remove old Test-First Approach section (L333-337)**
+
+Find and delete these 6 lines (header + blank line + 4 items):
+```
+## Test-First Approach (read test-spec BEFORE coding)
+1. Read test-spec "Impacted Tests" — if TODO (first iteration), skip to step 2 and fill this section during your work. Otherwise, run these FIRST to confirm they pass before your changes.
+2. Read test-spec "Required New Tests" — write these. They SHOULD FAIL initially.
+3. Implement minimum code to make all tests pass.
+4. Run ALL tests (impacted + new) to confirm nothing is broken.
+```
+
+- [ ] **Step 3: Verify changes**
+
+Run: `grep -n "TDD MANDATE\|Test-First Approach\|SCOPE LOCK" src/scripts/init_ralph_desk.zsh`
+Expected: TDD MANDATE appears BEFORE SCOPE LOCK. "Test-First Approach" does NOT appear.
+
+---
+
+### Task 2: Compress Forbidden Shortcuts from 14 to 6 items
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh:339-353`
+
+- [ ] **Step 1: Replace Forbidden Shortcuts section**
+
+Find the entire `## Forbidden Shortcuts` section (14 items from L339-353) and replace with these 6 items:
+
+```
+## Forbidden Shortcuts (Verifier will check these)
+- Do not mock external services when L2 integration test is required by test-spec.
+- Do not delete or weaken existing assertions to make tests pass.
+- Do not skip boundary cases listed in the PRD.
+- Do not write code before tests — if you did, delete it and start with tests.
+- **NEVER modify rlp-desk infrastructure files** (~/.claude/ralph-desk/*, ~/.claude/commands/rlp-desk.md). If you discover a bug in rlp-desk itself, report it in done-claim.json with {"status": "blocked", "reason": "rlp-desk bug: <description>"} and signal blocked. Do NOT attempt to fix rlp-desk — it is the orchestration tool, not your project code.
+- **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
+```
+
+Removed items and their coverage:
+- L342 "test-specific logic" → Verifier step 10 (L474) checks this
+- L344 "code inspection" → Verifier step 10½ phrase scan (L484)
+- L345 "too simple to test" → Verifier step 10½ phrase scan (L484)
+- L346 "I'll test after" → will add to Verifier step 10½ in Task 4
+- L347 "already manually tested" → Verifier step 10½ phrase scan (L484)
+- L348 "partial check is enough" → Verifier step 10½ phrase scan (L484)
+- L349 "I'm confident" → Verifier step 10½ phrase scan (L484)
+- L350 "existing code has no tests" → TDD MANDATE covers ("no exceptions")
+
+- [ ] **Step 2: Verify line count**
+
+Run: `sed -n '/^## Forbidden Shortcuts/,/^## /p' src/scripts/init_ralph_desk.zsh | head -10`
+Expected: 7 lines (1 header + 6 items)
+
+---
+
+### Task 3: Add "When Stuck" debugging guide
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh` (after Forbidden Shortcuts, before Iteration rules)
+
+- [ ] **Step 1: Insert debugging guide**
+
+Find:
+```
+- **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
+
+## Iteration rules
+```
+
+Replace with:
+```
+- **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
+
+## When Stuck (do NOT guess-and-fix)
+> 1. STOP and READ the error. Trace the call stack. Identify the root cause before touching code.
+> 2. Write a minimal test that reproduces the failure, then fix the root cause only.
+> 3. If 3+ fixes fail on the same issue, signal "blocked" with your diagnosis.
+
+## Iteration rules
+```
+
+- [ ] **Step 2: Verify insertion**
+
+Run: `grep -n "When Stuck" src/scripts/init_ralph_desk.zsh`
+Expected: exactly 1 match, between Forbidden Shortcuts and Iteration rules
+
+---
+
+### Task 4: Extend Verifier Anti-Rationalization + gap-close step 10½
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh:480,484`
+
+- [ ] **Step 1: Add rationalization red flags to step 10¼**
+
+Find:
+```
+   - Never issue a silent PASS — every pass verdict must cite specific evidence for each AC checked
+10½. **Worker Process Audit**:
+```
+
+Replace with:
+```
+   - Never issue a silent PASS — every pass verdict must cite specific evidence for each AC checked
+   - Rationalization red flags: "tests pass so it works" (passing ≠ correct), "Worker is confident" (confidence ≠ evidence), "changes are minimal" (scope ≠ correctness)
+10½. **Worker Process Audit**:
+```
+
+- [ ] **Step 2: Gap-close — add "I'll test after" to step 10½ phrase scan**
+
+Find:
+```
+   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "already manually tested", "partial check")
+```
+
+Replace with:
+```
+   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "I'll test after", "already manually tested", "partial check")
+```
+
+- [ ] **Step 3: Verify both changes**
+
+Run: `grep -n "Rationalization red flags\|I'll test after" src/scripts/init_ralph_desk.zsh`
+Expected: 2 matches — one in step 10¼, one in step 10½
+
+---
+
+## Token Budget Verification
+
+After all 4 tasks, verify net token reduction:
+
+```bash
+# Before: count Worker prompt lines (approximate)
+# After: should be ~10 lines fewer
+wc -l src/scripts/init_ralph_desk.zsh
+# Compare with git: lines removed vs added
+git diff --stat src/scripts/init_ralph_desk.zsh
+```
+
+Expected: net negative line count (fewer lines = less context pressure on Worker).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-dev-methodologies/rlp-desk",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification",
   "scripts": {
     "postinstall": "node scripts/postinstall.js",

package/src/commands/rlp-desk.md

@@ -69,14 +69,14 @@ Ask about these items one by one (or in small groups):
 
    | Complexity | Worker | per-US Verifier | Final Verifier | Consensus |
    |------------|--------|-----------------|----------------|-----------|
-   | LOW | spark:high | sonnet | opus | final-only |
-   | MEDIUM | spark:high | opus | opus | final-only |
+   | LOW | gpt-5.4:medium | sonnet | opus | final-only |
+   | MEDIUM | gpt-5.4:medium | opus | opus | final-only |
    | HIGH | gpt-5.4:high | opus | opus | all |
    | CRITICAL | gpt-5.4:high | opus | opus + human | all |
 
    **Worker model selection** (cross-engine):
-   - **spark:high** — default recommendation (Pro token pool = cost savings). PRD AC count <= 15
-   - **gpt-5.4:high** — fallback when spark 100k output limit exceeded. PRD AC count > 15
+   - **gpt-5.4:medium** — default recommendation (full context window, progressive upgrade handles harder US)
+   - **spark:high** — only when US is small enough for spark's 100k context (single-file, AC count <= 4, simple logic). Do NOT use as primary recommendation — spark context window is too small for most tasks
 
    Present complexity score with evidence to the user, e.g.: "I rate this MEDIUM because: US count=4 (MEDIUM), file scope=2 (MEDIUM), logic=conditionals (MEDIUM), deps=none (LOW), impact=modify (MEDIUM). Highest=MEDIUM."
 
@@ -85,7 +85,7 @@ Ask about these items one by one (or in small groups):
    **If codex is NOT installed** — say: "Codex is not installed. Defaulting to claude-only Worker. Note: without a second engine, your Verifier shares the same perspective as the Worker — there is a risk of blind spots where both Worker and Verifier miss the same issue. To unlock cross-engine coverage: `npm install -g @openai/codex`"
 
 8. **Batch Capacity Check** — when verify-mode is batch and PRD is large:
-   - batch + spark + AC > 10 → warn "spark 100k output limit — consider wave split or switch to gpt-5.4"
+   - batch + spark + AC > 4 → warn "spark 100k context limit — switch to gpt-5.4 or split smaller"
    - batch + gpt-5.4 + AC > 15 → warn "too many ACs for single batch — consider wave split (3-4 US per wave)"
    - per-us → no warning (US-level processing, no limit concern)
 9. **Verify Mode** — per-us (default) or batch. Ask: "Verify after each user story (per-us, recommended) or only after all stories are done (batch)?" Default recommendation: per-us for 2+ stories.
@@ -144,11 +144,11 @@ Tell the user:
    ```
    Available run commands (copy the one you want):
 
-   # ★ Recommended: cross-engine + final-consensus (cost savings + blind-spot coverage):
-   /rlp-desk run <actual-slug> --mode tmux --worker-model spark:high --consensus final-only --debug
+   # ★ Recommended: cross-engine + final-consensus (full context + blind-spot coverage):
+   /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:medium --consensus final-only --debug
 
-   # Large PRD (AC > 15, exceeds spark 100k limit):
-   /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:high --consensus final-only --debug
+   # Small tasks only (single-file, AC <= 4, simple logic — spark 100k context limit):
+   /rlp-desk run <actual-slug> --mode tmux --worker-model spark:high --consensus final-only --debug
 
    # Critical (full consensus on every verify):
    /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:high --consensus all --debug
@@ -158,7 +158,7 @@ Tell the user:
 
    # Full options reference:
    #   --mode agent|tmux                      (default: agent)
-   #   --worker-model MODEL                   haiku|sonnet|opus or spark:high|gpt-5.4:high (default: haiku)
+   #   --worker-model MODEL                   haiku|sonnet|opus or gpt-5.4:high|spark:high (default: haiku)
    #   --lock-worker-model                    disable auto model upgrade
    #   --verifier-model MODEL                 per-US verifier (default: sonnet)
    #   --final-verifier-model MODEL           final ALL verifier (default: opus)
@@ -707,7 +707,7 @@ Example:
 
 Run options:
   --mode agent|tmux                    Execution mode (default: agent)
-  --worker-model MODEL                 Worker model: haiku|sonnet|opus or spark:high|gpt-5.4:high (default: haiku)
+  --worker-model MODEL                 Worker model: haiku|sonnet|opus or gpt-5.4:high|spark:high (default: haiku)
   --lock-worker-model                  Disable auto model upgrade on failure
   --verifier-model MODEL               per-US verifier (default: sonnet)
   --final-verifier-model MODEL         Final ALL verifier (default: opus)

package/src/scripts/init_ralph_desk.zsh

@@ -203,10 +203,10 @@ print_run_presets() {
   echo "Available run commands (copy the one you want):"
   echo ""
   if [[ $codex_available -eq 1 ]]; then
-    echo "# Recommended: cross-engine + final-consensus (cost savings + blind-spot coverage):"
-    echo "/rlp-desk run $slug --worker-model gpt-5.4:high --final-consensus --debug"
+    echo "# Recommended: cross-engine + final-consensus (full context + blind-spot coverage):"
+    echo "/rlp-desk run $slug --worker-model gpt-5.4:medium --final-consensus --debug"
     echo ""
-    echo "# Spark Pro preset (fast codex worker, lower cost):"
+    echo "# Small tasks only (single-file, AC <= 4, simple logic — spark 100k context limit):"
     echo "/rlp-desk run $slug --worker-model gpt-5.3-codex-spark:high --debug"
     echo ""
     echo "# Claude-only:"
@@ -322,6 +322,11 @@ Read these files in order:
 3. Test Spec: $DESK/plans/test-spec-$SLUG.md → verification methods
 4. Latest Context: $DESK/context/$SLUG-latest.md → current state
 
+## TDD MANDATE (hard constraint — violation = automatic FAIL)
+> Write failing tests FIRST → confirm RED (exit_code=1) → implement minimum code → confirm GREEN.
+> Every NEW AC requires: write_test → verify_red → implement → verify_green in execution_steps.
+> No exceptions. Verifier rejects missing RED evidence. For already-passing ACs, use verify_existing.
+
 ## SCOPE LOCK (hard constraint — violation causes verification failure)
 - You MUST only implement the work described in the "Next Iteration Contract" from campaign memory.
 - If the contract says "implement US-001 only", do ONLY that. Do NOT touch other stories.
@@ -330,28 +335,19 @@ Read these files in order:
 - No file creation or modification outside the project root.
 - Do not modify this prompt file or any PRD/test-spec files.
 
-## Test-First Approach (read test-spec BEFORE coding)
-1. Read test-spec "Impacted Tests" — if TODO (first iteration), skip to step 2 and fill this section during your work. Otherwise, run these FIRST to confirm they pass before your changes.
-2. Read test-spec "Required New Tests" — write these. They SHOULD FAIL initially.
-3. Implement minimum code to make all tests pass.
-4. Run ALL tests (impacted + new) to confirm nothing is broken.
-
 ## Forbidden Shortcuts (Verifier will check these)
 - Do not mock external services when L2 integration test is required by test-spec.
 - Do not delete or weaken existing assertions to make tests pass.
-- Do not add test-specific logic (code that detects it is running in a test).
 - Do not skip boundary cases listed in the PRD.
-- Do not claim "code inspection" as verification — run the actual command.
-- Do not say "too simple to test" — simple code breaks. Test takes 30 seconds.
-- Do not say "I'll test after" — tests passing immediately prove nothing.
-- Do not say "already manually tested" — ad-hoc is not systematic, no record.
-- Do not say "partial check is enough" — partial proves nothing about the whole.
-- Do not say "I'm confident" — confidence is not evidence.
-- Do not say "existing code has no tests" — you are improving it, add tests.
 - Do not write code before tests — if you did, delete it and start with tests.
 - **NEVER modify rlp-desk infrastructure files** (~/.claude/ralph-desk/*, ~/.claude/commands/rlp-desk.md). If you discover a bug in rlp-desk itself, report it in done-claim.json with {"status": "blocked", "reason": "rlp-desk bug: <description>"} and signal blocked. Do NOT attempt to fix rlp-desk — it is the orchestration tool, not your project code.
 - **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
 
+## When Stuck (do NOT guess-and-fix)
+> 1. STOP and READ the error. Trace the call stack. Identify the root cause before touching code.
+> 2. Write a minimal test that reproduces the failure, then fix the root cause only.
+> 3. If 3+ fixes fail on the same issue, signal "blocked" with your diagnosis.
+
 ## Iteration rules
 - Use fresh context only; do NOT depend on prior chat history.
 - Execute exactly the work specified in the Next Iteration Contract.
@@ -478,10 +474,11 @@ Check the iter-signal.json "us_id" field:
    - If your verdict history shows a 100% pass rate, re-examine your last verdict with increased scrutiny — a 100% pass rate is a red flag for insufficient rigor
    - When issuing PASS with explicit warning: note any concerning patterns (e.g., low test diversity, marginal coverage) even if technically passing
    - Never issue a silent PASS — every pass verdict must cite specific evidence for each AC checked
+   - Rationalization red flags: "tests pass so it works" (passing ≠ correct), "Worker is confident" (confidence ≠ evidence), "changes are minimal" (scope ≠ correctness)
 10½. **Worker Process Audit**:
    - Test-first compliance: done-claim execution_steps must show write_test step before implement step for each AC
    - RED phase evidence: at least one verify_red step with exit_code=1 per AC (proves tests were written before passing)
-   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "already manually tested", "partial check")
+   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "I'll test after", "already manually tested", "partial check")
    - Step completeness: each AC should have write_test → verify_red → implement → verify_green sequence in execution_steps
 11. **Reproducibility check**: verify lock file committed, clean install succeeds, security scan passes, env vars documented (per test-spec Reproducibility Gate). Skip if test-spec says "N/A."
 12. Write verdict JSON to: $DESK/memos/$SLUG-verify-verdict.json

package/src/scripts/lib_ralph_desk.zsh

@@ -29,6 +29,33 @@ log_error() {
   echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: $*" >&2
 }
 
+# build_claude_cmd() — centralized claude CLI command builder
+# Single source of truth for all claude invocation flags (--no-mcp, DISABLE_OMC, etc.)
+# Inspired by codex-plugin-cc companion pattern: CLI abstraction in one place.
+# Args: $1=mode (tui|print)  $2=model  $3=prompt_file (print mode only)  $4=output_log (print mode only)
+# Output: complete command string on stdout
+# Globals read: CLAUDE_BIN
+build_claude_cmd() {
+  local mode="$1"
+  local model="$2"
+  local prompt_file="${3:-}"
+  local output_log="${4:-}"
+
+  local base="DISABLE_OMC=1 $CLAUDE_BIN --model $model --no-mcp --dangerously-skip-permissions"
+  case "$mode" in
+    tui)
+      echo "$base"
+      ;;
+    print)
+      echo "$base -p \"\$(cat $prompt_file)\" --output-format text 2>&1 | tee $output_log"
+      ;;
+    *)
+      echo "ERROR: build_claude_cmd unknown mode '$mode'" >&2
+      return 1
+      ;;
+  esac
+}
+
 # parse_model_flag() — parse unified --worker-model / --verifier-model value
 # Colon format (model:reasoning) → codex engine; plain name → claude engine.
 # Spark alias: bare "spark" is expanded to full model ID "gpt-5.3-codex-spark".

package/src/scripts/run_ralph_desk.zsh

@@ -1022,7 +1022,7 @@ restart_worker() {
   if [[ "$WORKER_ENGINE" = "codex" ]]; then
     safe_send_keys "$pane_id" "${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
   else
-    safe_send_keys "$pane_id" "$CLAUDE_BIN --model $WORKER_MODEL --dangerously-skip-permissions"
+    safe_send_keys "$pane_id" "$(build_claude_cmd tui "$WORKER_MODEL")"
   fi
   WORKER_RESTARTS[$iter]=$((restart_count + 1))
   return 0
@@ -1164,12 +1164,9 @@ write_worker_trigger() {
   \"\$(cat $prompt_file)\""
     local engine_comment="# Run codex with fresh context (fallback trigger — TUI primary launch via launch_worker_codex)"
   else
-    local engine_cmd="$CLAUDE_BIN -p \"\$(cat $prompt_file)\" \\
-  --model $WORKER_MODEL \\
-  --dangerously-skip-permissions \\
-  --output-format text \\
-  2>&1 | tee $output_log"
-    local engine_comment="# Run claude with fresh context (governance.md s7 step 5)"
+    local engine_cmd
+    engine_cmd=$(build_claude_cmd print "$WORKER_MODEL" "$prompt_file" "$output_log")
+    local engine_comment="# Run claude with fresh context, no MCP/skills (governance.md s7 step 5)"
   fi
 
   {
@@ -1253,12 +1250,9 @@ write_verifier_trigger() {
   2>&1 | tee $output_log"
     local engine_comment="# Run codex with fresh context (governance.md s7 step 7)"
   else
-    local engine_cmd="$CLAUDE_BIN -p \"\$(cat $prompt_file)\" \\
-  --model $verifier_model \\
-  --dangerously-skip-permissions \\
-  --output-format text \\
-  2>&1 | tee $output_log"
-    local engine_comment="# Run claude with fresh context (governance.md s7 step 7)"
+    local engine_cmd
+    engine_cmd=$(build_claude_cmd print "$verifier_model" "$prompt_file" "$output_log")
+    local engine_comment="# Run claude with fresh context, no MCP/skills (governance.md s7 step 7)"
   fi
 
   {
@@ -1661,7 +1655,7 @@ run_single_verifier() {
     launch_verifier_codex "$VERIFIER_PANE" "$prompt_file" "$iter" "$verifier_launch"
     log_debug "Verifier$suffix codex TUI dispatched"
   else
-    verifier_launch="$CLAUDE_BIN --model $model --dangerously-skip-permissions"
+    verifier_launch="$(build_claude_cmd tui "$model")"
     if ! launch_verifier_claude "$VERIFIER_PANE" "$prompt_file" "$iter" "$verifier_launch"; then
       log_error "Verifier$suffix failed to start"
       return 1
@@ -1746,7 +1740,7 @@ run_sequential_final_verify() {
       verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
       launch_verifier_codex "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch"
     else
-      verifier_launch="$CLAUDE_BIN --model $VERIFIER_MODEL --dangerously-skip-permissions"
+      verifier_launch="$(build_claude_cmd tui "$VERIFIER_MODEL")"
       launch_verifier_claude "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch" || {
         log_error "Failed to launch verifier for $us"
         FAILED_US="$us"
@@ -2191,7 +2185,7 @@ main() {
         return 1
       fi
     else
-      worker_launch="$CLAUDE_BIN --model $WORKER_MODEL --dangerously-skip-permissions"
+      worker_launch="$(build_claude_cmd tui "$WORKER_MODEL")"
       if ! launch_worker_claude "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
         write_blocked_sentinel "Worker claude failed to start in pane"
         update_status "blocked" "worker_start_failed"
@@ -2368,7 +2362,7 @@ main() {
           if [[ "$VERIFIER_ENGINE" = "codex" ]]; then
             verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
           else
-            verifier_launch="$CLAUDE_BIN --model $VERIFIER_MODEL --dangerously-skip-permissions"
+            verifier_launch="$(build_claude_cmd tui "$VERIFIER_MODEL")"
           fi
           log_debug "[FLOW] iter=$ITERATION phase=verifier engine=$VERIFIER_ENGINE model=$VERIFIER_MODEL scope=${signal_us_id:-all} dispatched=true"