@dzhechkov/harness-core 0.8.2 → 0.8.6

package/src/deadwood-allowlist.json

@@ -0,0 +1,80 @@
+{
+  "v": 1,
+  "entries": [
+    {
+      "surface": "sign",
+      "kind": "command",
+      "reason": "trust-root signing and verification run only on key or release events; rarity is the design"
+    },
+    {
+      "surface": "delivery-check",
+      "kind": "command",
+      "reason": "release gate invoked per delivery, not as part of ordinary daily command traffic"
+    },
+    {
+      "surface": "deadwood",
+      "kind": "command",
+      "reason": "the measurement command deliberately does not record itself, so its zero count is structural"
+    },
+    {
+      "surface": "no-secrets",
+      "kind": "rule",
+      "reason": "credential safety net whose zero-firing state is the healthy outcome"
+    },
+    {
+      "surface": "no-workspace-star",
+      "kind": "rule",
+      "reason": "publish safety net; zero firings means no broken workspace dependency would ship"
+    },
+    {
+      "surface": "no-skill-drift",
+      "kind": "rule",
+      "reason": "canonical-copy safety net; zero firings means projected skills stayed in sync"
+    },
+    {
+      "surface": "readme-consistency",
+      "kind": "rule",
+      "reason": "documentation drift safety net; zero firings means measured counts stayed aligned"
+    },
+    {
+      "surface": "skills-registrable",
+      "kind": "rule",
+      "reason": "package registration safety net; zero firings means shipped skill layouts stayed loadable"
+    },
+    {
+      "surface": "readme-first",
+      "kind": "rule",
+      "reason": "release documentation safety net; zero firings means behavior changes carried their README update"
+    },
+    {
+      "surface": "agents-md-policy-sync",
+      "kind": "rule",
+      "reason": "governance projection safety net; zero firings means policy copies stayed synchronized"
+    },
+    {
+      "surface": "lockfile-in-sync",
+      "kind": "rule",
+      "reason": "dependency release safety net; zero firings means package manifests and the lockfile agreed"
+    },
+    {
+      "surface": "store-bloat-cap",
+      "kind": "rule",
+      "reason": "learning-store capacity safety net; zero firings means the configured cap was respected"
+    },
+    {
+      "surface": "no-stubs",
+      "kind": "rule",
+      "reason": "incomplete-source safety net; zero firings means no unfinished implementation marker reached publish"
+    },
+    {
+      "surface": "review-round",
+      "kind": "rule",
+      "reason": "independent-review safety net evaluated only for publishable source changes"
+    },
+    {
+      "surface": "licence-hold",
+      "kind": "rule",
+      "reason": "release safety net that fires only while a package has an unresolved licence grant"
+    }
+  ]
+}

package/src/feature-adr-checkpoints.ts

@@ -26,7 +26,7 @@
 
 /** Blob version stamp read by scripts/gen-loop-blobs.mjs (feature loop-designer, ADR-004) — the
  * ONLY loop-designer change to this canonical file; bump when any blob-exported semantic changes. */
-export const BLOB_VERSION = '1.1.0';
+export const BLOB_VERSION = '1.2.0';
 
 /** Stages the workflow checkpoints, in pipeline order. Cheap side-channel agents (usage probes,
  * fa-record, auto-cost selects) are never checkpointed; the opt-in Delivery gate re-runs by design
@@ -421,7 +421,7 @@ export function captureFailureRecord(stage: unknown, mode: unknown, reason: unkn
 }
 
 /** Training-pair record format version. Bump on any field-shape change. */
-export const TRAINPAIR_SCHEMA_VERSION = 'fa-trainpair-2';
+export const TRAINPAIR_SCHEMA_VERSION = 'fa-trainpair-3';
 
 /** Oversize guard cap over input+output combined (same posture as
  * CHECKPOINT_MAX_RESULT_CHARS, sized for full stage prompts): an over-cap pair is
@@ -460,6 +460,14 @@ export interface TrainingPairProvenance {
   minutes: number | null;
 }
 
+/** Resolved routing axes captured with every pair for later Fable-vs-grade analysis. */
+export interface TrainingPairBudget {
+  primary: 'claude' | 'codex';
+  claude: 'normal' | 'eco';
+  codex: 'normal' | 'eco';
+  preset: 'normal' | 'eco' | 'hybrid' | 'custom' | 'unset';
+}
+
 export interface TrainingPairTruncation {
   /** Original (pre-truncation) char counts + full-text hashes — what was cut is NAMED. */
   inputChars: number;
@@ -479,6 +487,7 @@ export interface TrainingPair {
   output: string;
   evaluation: TrainingPairEvaluation;
   provenance: TrainingPairProvenance;
+  budgetMode: TrainingPairBudget | null;
   truncated: TrainingPairTruncation | null;
   captureMode: 'capture' | 'backfill';
   resumed: boolean;
@@ -615,6 +624,31 @@ function coerceText(v: unknown): string {
   }
 }
 
+/** Normalize routing metadata without ever blocking capture. Undefined means the operator supplied
+ * neither axis; malformed/throwing inputs are explicit null, never a fabricated nearest preset.
+ * An explicit `preset:'unset'` preserves primary while recording that no budget arg was supplied. */
+function normalizeTrainingPairBudget(raw: unknown): TrainingPairBudget | null {
+  try {
+    if (raw === undefined) return { primary: 'claude', claude: 'normal', codex: 'normal', preset: 'unset' };
+    if (raw === null || typeof raw !== 'object') return null;
+    const value = raw as Record<string, unknown>;
+    const primary = value.primary;
+    const claude = value.claude;
+    const codex = value.codex;
+    if (primary !== 'claude' && primary !== 'codex') return null;
+    if (claude !== 'normal' && claude !== 'eco') return null;
+    if (codex !== 'normal' && codex !== 'eco') return null;
+    if (value.preset === 'unset') return { primary, claude, codex, preset: 'unset' };
+    let preset: TrainingPairBudget['preset'] = 'custom';
+    if (claude === 'normal' && codex === 'normal') preset = 'normal';
+    else if (claude === 'eco' && codex === 'eco') preset = 'eco';
+    else if (claude === 'eco' && codex === 'normal') preset = 'hybrid';
+    return { primary, claude, codex, preset };
+  } catch {
+    return null;
+  }
+}
+
 /** Assemble one SFT-ready training pair. Deterministic (ts passed in). Applies the oversize
  * guard: when input+output exceed TRAINPAIR_MAX_IO_CHARS combined, each over-budget side is
  * truncated with a marker naming the cut char count + the fnv1a64 of its FULL text (the
@@ -630,6 +664,7 @@ export function buildTrainingPair(opts: {
   output: unknown;
   evaluation?: Partial<TrainingPairEvaluation> | null;
   provenance?: Partial<TrainingPairProvenance> | null;
+  budgetMode?: unknown;
   captureMode?: unknown;
   resumed?: unknown;
 }): TrainingPair {
@@ -670,6 +705,7 @@ export function buildTrainingPair(opts: {
       tokens: typeof pv.tokens === 'number' && Number.isFinite(pv.tokens) ? pv.tokens : null,
       minutes: typeof pv.minutes === 'number' && Number.isFinite(pv.minutes) ? pv.minutes : null,
     },
+    budgetMode: normalizeTrainingPairBudget(opts.budgetMode),
     truncated,
     captureMode: opts.captureMode === 'backfill' ? 'backfill' : 'capture',
     resumed: opts.resumed === true,

package/src/feature-adr-routing.ts

@@ -14,8 +14,8 @@
  *
  * The load-bearing property: a model that WRITES code must not also SELF-QE.
  * When `args.models.qe` is unset, the QE stage is auto-routed to the OTHER
- * family than the resolved coder (codex-coder → Claude `opus`; Claude-coder →
- * `codex:<top>:high`, or `opus` if codex is unavailable — never a block).
+ * family than the resolved coder (codex-coder → Claude `sonnet`; Claude-coder →
+ * the Codex-budget cell, or `opus` if codex is unavailable — never a block).
  *
  * DESIGN CONSTRAINT — the Workflow parser is STRICTER than `node --check`
  * (no nested template literals, no inline `cond ? agent() : null` in arrays).
@@ -74,11 +74,15 @@ export interface RoutingEnv {
    */
   readonly usageOverride?: boolean;
   /**
-   * Per-stage reasoning for the usage-override spec (merged OVER {@link OVERRIDE_REASONING}).
-   * `args.usageReasoning` — stage → `'high'|'xhigh'|…`; a single stage may be overridden without
+   * Per-stage reasoning for the usage-override spec (merged OVER {@link STAGE_EFFORT}).
+   * `args.usageReasoning` — stage → a supported reasoning level; a single stage may be overridden without
    * touching the others.
    */
   readonly usageReasoning?: Record<string, string>;
+  /** Raw `args.budget`: a named preset or a per-family object. */
+  readonly budget?: unknown;
+  /** The productive family for design + code; absent defaults to Claude. */
+  readonly primary?: 'claude' | 'codex';
 }
 
 // ── USAGE-ADAPTIVE ROUTING (pre-emptive codex switch at >= usageThreshold) ────
@@ -109,39 +113,33 @@ export interface UsageDecision {
 }
 
 /**
- * Per-stage reasoning applied under the usage override (LOCKED L-4, arch §4.1 verbatim):
- * design/code/plan stages ⇒ `xhigh`; router/qe/fleet ⇒ `high`. A pure DATA table (not control
- * flow); user-overridable via `env.usageReasoning`. An unknown stage falls back to `'high'`.
+ * GPT-5.6 reasoning ladder used by the routing tables. The model default is `medium`; `xhigh`
+ * and `max` stay valid explicit values but are absent from shipped defaults until evals justify them.
  */
-export const OVERRIDE_REASONING: Record<string, 'high' | 'xhigh'> = {
-  router: 'high',
-  requirements: 'xhigh',
-  research: 'xhigh',
-  adr: 'xhigh',
-  ideation: 'xhigh',
-  ddd: 'xhigh',
-  architecture: 'xhigh',
-  plan: 'xhigh',
-  code: 'xhigh',
+export type ReasoningLevel = 'none' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+export const STAGE_EFFORT: { override: Record<string, ReasoningLevel> } = { override: {
+  router: 'medium',
+  requirements: 'medium',
+  research: 'medium',
+  adr: 'high',
+  ideation: 'medium',
+  ddd: 'high',
+  architecture: 'high',
+  plan: 'high',
+  code: 'medium',
   qe: 'high',
-  fleet: 'high',
-};
+  fleet: 'medium',
+} };
 
-/**
- * The gpt-5.6-ready TOP codex-id pick — SHARED by the cross-model QE default and the usage
- * override so adding an id to {@link KNOWN_CODEX} (e.g. `gpt-5.7`) retargets BOTH with zero
- * control-flow diff (AC-3). Pinned `CODEX_MODEL` when ≠ `'auto'`; else the last non-`auto` key of
- * `KNOWN_CODEX`.
- */
+/** One-release compatibility alias for existing public imports. */
+// Frozen (QE round-1 F10): the alias exports the SAME object as the live effort table, so a
+// consumer mutating the compatibility alias would silently mutate shipped routing. Freezing keeps
+// the read-compatibility promise while making any such write throw loudly in strict mode.
+export const OVERRIDE_REASONING = Object.freeze(STAGE_EFFORT.override);
+
+/** The flagship Codex id, independent of the spellability allowlist's insertion order. */
 export function topCodexId(env: RoutingEnv): string {
-  let top = env.CODEX_MODEL;
-  if (top === 'auto') {
-    const ids = Object.keys(KNOWN_CODEX);
-    for (let i = 0; i < ids.length; i++) {
-      if (ids[i] !== 'auto') top = ids[i] || top;
-    }
-  }
-  return top;
+  return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS.flagship;
 }
 
 /**
@@ -190,11 +188,80 @@ export function decideUsageAction(
 /** Known codex ids. Adding a new id (e.g. `'gpt-5.7'`) is a DATA-ONLY change. */
 export const KNOWN_CODEX: Record<string, number> = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };
 
+export type CodexTier = 'flagship' | 'workhorse' | 'high-volume';
+
+/**
+ * Capability tiers are routing data, separate from {@link KNOWN_CODEX}'s spellability role.
+ * The allowlist is not an availability check — probe every id before every run
+ * (`codex exec -m <id> "Reply with exactly: OK"`); ids drift in both directions on a
+ * timescale of days (probed 2026-08-18: 3 ids HTTP 400; probed 2026-08-29: all 3 exit 0).
+ */
+export const CODEX_TIERS: Record<CodexTier, string> = {
+  flagship: 'gpt-5.6-sol',
+  workhorse: 'gpt-5.6-terra',
+  'high-volume': 'gpt-5.6-luna',
+};
+
+export function codexIdForTier(tier: CodexTier, env: RoutingEnv): string {
+  return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS[tier];
+}
+
+export type BudgetLevel = 'normal' | 'eco';
+export interface BudgetAxis {
+  readonly claude: BudgetLevel;
+  readonly codex: BudgetLevel;
+}
+
+export const BUDGET_PRESETS: Record<'normal' | 'eco' | 'hybrid', BudgetAxis> = {
+  normal: { claude: 'normal', codex: 'normal' },
+  eco: { claude: 'eco', codex: 'eco' },
+  hybrid: { claude: 'eco', codex: 'normal' },
+};
+
+export function resolveBudgetMode(raw: unknown): BudgetAxis {
+  if (raw === undefined) return BUDGET_PRESETS.normal;
+  if (typeof raw === 'string') {
+    const preset = BUDGET_PRESETS[raw as keyof typeof BUDGET_PRESETS];
+    if (!preset) throw new RangeError('budget: unknown preset "' + raw + '" — valid: normal|eco|hybrid');
+    return preset;
+  }
+  if (raw && typeof raw === 'object') {
+    const value = raw as Record<string, unknown>;
+    for (const key of Object.keys(value)) {
+      if (key !== 'claude' && key !== 'codex') {
+        throw new RangeError('budget: unknown family key "' + key + '" — valid: claude|codex');
+      }
+    }
+    for (const key of ['claude', 'codex'] as const) {
+      const level = value[key];
+      if (level !== undefined && level !== 'normal' && level !== 'eco') {
+        throw new RangeError('budget.' + key + ': unknown level "' + level + '" — valid: normal|eco');
+      }
+    }
+    return {
+      claude: (value.claude as BudgetLevel | undefined) || 'normal',
+      codex: (value.codex as BudgetLevel | undefined) || 'normal',
+    };
+  }
+  throw new RangeError('budget: expected a preset name or {claude,codex} object, got ' + typeof raw);
+}
+
+export function budgetPresetName(axis: BudgetAxis): 'normal' | 'eco' | 'hybrid' | null {
+  for (const name of ['normal', 'eco', 'hybrid'] as const) {
+    const preset = BUDGET_PRESETS[name];
+    if (preset.claude === axis.claude && preset.codex === axis.codex) return name;
+  }
+  return null;
+}
+
 /** The Claude model names the Workflow runtime accepts as `agent()` `model`. */
 export const CLAUDE_NAMES: Record<string, number> = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };
 
-/** The codex-companion `--effort` vocabulary; a spec's `<reasoning>` is clamped to this (unknown ⇒ 'high'). */
-export const VALID_REASONING: Record<string, number> = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1 };
+/**
+ * The codex-companion `--effort` vocabulary. `minimal` remains temporarily for compatibility
+ * until a live companion probe establishes whether it can be retired; `max` is part of GPT-5.6's ladder.
+ */
+export const VALID_REASONING: Record<string, number> = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1, max: 1 };
 
 /**
  * The proven DEFAULT TABLE, applied only when the user opts into routing.
@@ -215,6 +282,80 @@ export const DEFAULT_MODELS: Record<string, string | null> = {
   fleet: 'sonnet',
 };
 
+type FamilyRoutingTables = Record<'claude' | 'codex', Record<BudgetLevel, Partial<Record<string, string | null>>>>;
+
+/** Four family half-tables; presets compose the Claude and Codex halves independently. */
+export const ROUTING_TABLES: Record<'claude' | 'codex', FamilyRoutingTables> = {
+  claude: {
+    claude: {
+      normal: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'fable', ideation: 'sonnet', ddd: 'fable', architecture: 'fable', plan: 'opus', code: 'sonnet', fleet: 'sonnet' },
+      eco: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: 'sonnet', fleet: 'sonnet' },
+    },
+    codex: { normal: {}, eco: {} },
+  },
+  codex: {
+    claude: {
+      normal: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },
+      eco: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },
+    },
+    codex: { normal: {}, eco: {} },
+  },
+};
+
+function codexCell(tier: CodexTier, effort: ReasoningLevel, env: RoutingEnv): string {
+  return 'codex:' + codexIdForTier(tier, env) + ':' + effort;
+}
+
+export function budgetTable(
+  primary: 'claude' | 'codex',
+  mode: BudgetAxis,
+  env: RoutingEnv,
+): Partial<Record<string, string | null>> {
+  const claudeHalf = ROUTING_TABLES[primary].claude[mode.claude];
+  let codexHalf: Partial<Record<string, string | null>>;
+  if (primary === 'claude') {
+    const qeSpec = mode.codex === 'normal'
+      ? codexCell('flagship', 'high', env)
+      : codexCell('workhorse', 'medium', env);
+    codexHalf = { ...ROUTING_TABLES.claude.codex[mode.codex], qe: env.codexAvailable === false ? 'opus' : qeSpec };
+  } else {
+    const normal = mode.codex === 'normal';
+    const design = codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'medium', env);
+    codexHalf = {
+      requirements: design,
+      research: design,
+      adr: design,
+      ideation: design,
+      ddd: design,
+      architecture: design,
+      plan: codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'low', env),
+      code: codexCell(normal ? 'flagship' : 'workhorse', 'medium', env),
+    };
+  }
+  return { ...claudeHalf, ...codexHalf };
+}
+
+/** Optional Claude precision review after A-normal's recall-oriented Sonnet QE. */
+export function qePrecisionPassSpec(
+  primary: 'claude' | 'codex',
+  budget: BudgetAxis,
+  tier: 'S' | 'M' | 'L' | 'XL',
+  _env: RoutingEnv,
+): string | null {
+  if (primary !== 'codex') return null;
+  if (budget.claude !== 'normal') return null;
+  if (tier !== 'L' && tier !== 'XL') return null;
+  return 'opus';
+}
+
+/** Build/test-time guard for the matrix's load-bearing cross-family property. */
+export function assertCrossFamilyQe(codeSpec: string | null, qeSpec: string | null): void {
+  const fam = (s: string | null) => (s && String(s).split(':')[0] === 'codex') ? 'codex' : 'claude';
+  if (fam(codeSpec) === fam(qeSpec)) {
+    throw new Error('cross-family QE violated: code=' + codeSpec + ' qe=' + qeSpec);
+  }
+}
+
 // ── Pure resolvers (byte-equivalent to the workflow's inline block) ──────────
 
 /**
@@ -247,11 +388,8 @@ export function specToOpts(spec: string | null | undefined, env: RoutingEnv): St
       id = env.CODEX_MODEL;
     }
     let reasoning = parts[2] || 'high';
-    // Clamp to the codex-companion --effort vocabulary so a bad token (e.g. `codex:gpt-5.6:banana`)
-    // can't silently reach the runtime as `--effort banana` (QE LOW). Unknown ⇒ 'high'.
     if (!VALID_REASONING[reasoning]) {
-      log('models: unknown reasoning ' + reasoning + ' — using high');
-      reasoning = 'high';
+      throw new RangeError('models: invalid reasoning "' + reasoning + '" — valid: ' + Object.keys(VALID_REASONING).join('|'));
     }
     return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };
   }
@@ -278,33 +416,43 @@ export function resolveCoderSpec(env: RoutingEnv): string {
  * `MODELS.code='codex'` still routes QE to Claude (never codex-self-QE).
  */
 export function coderIsCodex(env: RoutingEnv): boolean {
-  if (env.CODER === 'codex' || env.CODER === 'codex-fallback') return true;
   const codeSpec = env.MODELS.code;
-  if (codeSpec && String(codeSpec).split(':')[0] === 'codex') return true;
-  return false;
+  if (codeSpec !== undefined && codeSpec !== null) return String(codeSpec).split(':')[0] === 'codex';
+  if (env.CODER === 'codex' || env.CODER === 'codex-fallback') return true;
+  return env.primary === 'codex';
 }
 
 /**
  * The CROSS-MODEL QE default (load-bearing). Called only when `MODELS.qe` is
  * unset. Resolves to the OTHER family than the coder:
- *   - coder is codex  → `'opus'`                       (Claude reviews codex's code)
- *   - coder is Claude → codex-available ? `'codex:<top>:high'` : `'opus'` (never block)
- * `<top>` = `CODEX_MODEL` when pinned (≠'auto'), else the top `KNOWN_CODEX` id.
+ *   - coder is codex  → `'sonnet'` (the recall-oriented Claude reviewer)
+ *   - coder is Claude → the Codex-budget cell (`sol:high` or `terra:medium`),
+ *     or `'opus'` when Codex is unavailable (never block)
+ * A pinned `CODEX_MODEL` still outranks the tier selected by the budget table.
  */
-export function resolveQeSpec(env: RoutingEnv): string {
-  if (coderIsCodex(env)) return 'opus';
+export function resolveQeSpecForCoder(coderCodex: boolean, env: RoutingEnv): string {
+  if (coderCodex) return 'sonnet';
   const CODEX_AVAILABLE = env.codexAvailable !== false;
   if (!CODEX_AVAILABLE) return 'opus';
-  return 'codex:' + topCodexId(env) + ':high';
+  const budget = resolveBudgetMode(env.budget);
+  return budget.codex === 'eco'
+    ? 'codex:' + codexIdForTier('workhorse', env) + ':medium'
+    : 'codex:' + codexIdForTier('flagship', env) + ':high';
+}
+
+export function resolveQeSpec(env: RoutingEnv): string {
+  return resolveQeSpecForCoder(coderIsCodex(env), env);
 }
 
 /**
- * Whether the caller opted into routing at all. When FALSE (no `args.models`,
- * no codex knobs), every Claude stage resolves to `{}` → byte-identical to today.
+ * Whether the caller opted into routing at all. When FALSE (no axes, `args.models`,
+ * or Codex knobs), every Claude stage resolves to `{}` → byte-identical to today.
  */
 export function routingRequested(env: RoutingEnv): boolean {
   return (
     Object.keys(env.MODELS).length > 0 ||
+    env.primary !== undefined ||
+    env.budget !== undefined ||
     env.PLANNER === 'codex' ||
     env.CODER === 'codex' ||
     env.CODER === 'codex-fallback' ||
@@ -338,12 +486,12 @@ export function qeShouldUseCodex(env: RoutingEnv): boolean {
  * Resolve a stage to its `agent()` opts fragment.
  *   1. explicit `MODELS[stage]` wins
  *   2. else if the user did NOT opt into routing → `{}` (byte-identical BC path)
- *   3. else the DEFAULT TABLE fills the gap
+ *   3. else the primary × per-family-budget table fills the gap
  *   4. `code`/`qe` `null` sentinels resolve via the coder / cross-model rules
  */
 export function resolveStageModel(stage: string, env: RoutingEnv): StageOpts {
   if (env.usageOverride) {
-    const r = (env.usageReasoning && env.usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high';
+    const r = (env.usageReasoning && env.usageReasoning[stage]) || STAGE_EFFORT.override[stage] || 'medium';
     const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);
     o._usageSwitched = true;
     return o;
@@ -351,7 +499,18 @@ export function resolveStageModel(stage: string, env: RoutingEnv): StageOpts {
   let spec = env.MODELS[stage];
   if (spec === undefined) {
     if (!routingRequested(env)) return {};
-    spec = DEFAULT_MODELS[stage];
+    if (stage === 'code' && (env.CODER === 'codex' || env.CODER === 'codex-fallback')) {
+      return specToOpts(resolveCoderSpec(env), env);
+    }
+    if (stage === 'plan' && env.PLANNER === 'codex') {
+      return specToOpts('codex:' + env.CODEX_MODEL + ':high', env);
+    }
+    if (stage === 'qe') {
+      return specToOpts(resolveQeSpec(env), env);
+    }
+    const resolvedPrimary = env.primary || 'claude';
+    const cell = budgetTable(resolvedPrimary, resolveBudgetMode(env.budget), env)[stage];
+    spec = cell !== undefined ? cell : DEFAULT_MODELS[stage];
   }
   if (stage === 'code' && (spec === null || spec === undefined)) return specToOpts(resolveCoderSpec(env), env);
   if (stage === 'qe' && (spec === null || spec === undefined)) return specToOpts(resolveQeSpec(env), env);
@@ -389,7 +548,16 @@ export function codexEffortHint(opts: StageOpts | null | undefined): string {
 
 // ── Step-7.5 CODE landed barrier (Codex out-of-band write flush) ────────────
 
-export const DEFAULT_CODE_LANDING_MAX_WAIT_MS = 120_000;
+// Widened 2026-08-28 (MEASURED, not a guess): the dz-deadwood coder job ran 46m11s end to end, and
+// the slop-lint coder was independently confirmed STILL RUNNING (codex-companion status "running",
+// pid alive, mid-TDD-cycle, actively applying file changes) at 16m38s elapsed — a full 8x past the
+// old 120s window. The old window declared "genuinely not landed" and fed Step-8 QE a false empty
+// tree, producing a grade-D report entirely about an absence that was never real. This does not fix
+// the underlying conflation of TIMEOUT with CONFIRMED-ABSENCE (filed as a backlog item — the barrier
+// still cannot see the codex-companion job's own liveness) — it only narrows how often the false
+// negative fires for a realistic M-tier build, at the cost of a longer worst-case wait when the
+// coder truly produced nothing.
+export const DEFAULT_CODE_LANDING_MAX_WAIT_MS = 1_020_000;
 
 export const DEFAULT_CODE_LANDING_BACKOFF_MS = [
   1_000,
@@ -403,6 +571,17 @@ export const DEFAULT_CODE_LANDING_BACKOFF_MS = [
   20_000,
   25_000,
   25_000,
+  30_000,
+  30_000,
+  60_000,
+  60_000,
+  60_000,
+  90_000,
+  90_000,
+  120_000,
+  120_000,
+  120_000,
+  120_000,
 ] as const;
 
 export const CODE_LANDED_BARRIER_SLEEPS_SECONDS = DEFAULT_CODE_LANDING_BACKOFF_MS.map((ms) => ms / 1000);
@@ -1525,6 +1704,7 @@ function codexCd(repo: string): string {
  */
 export function codexExecCommand(input: {
   readonly modelId?: string | null;
+  readonly reasoning?: string | null;
   readonly prompt?: string | null;
   readonly timeoutBin?: string | null;
   readonly timeoutSeconds?: number | null;
@@ -1533,12 +1713,15 @@ export function codexExecCommand(input: {
   const o = input || {};
   const modelId = String(o.modelId === undefined || o.modelId === null ? '' : o.modelId);
   if (!isSafeCodexId(modelId)) return null;
+  const reasoning = o.reasoning === undefined || o.reasoning === null || o.reasoning === '' ? 'high' : String(o.reasoning);
+  if (!VALID_REASONING[reasoning]) return null;
   const raw = Number(o.timeoutSeconds);
   const seconds = raw === raw && raw !== Infinity && raw > 0 ? Math.floor(raw) : CODEX_EXEC_TIMEOUT_SECONDS;
   const repo = String(o.repo === undefined || o.repo === null ? '' : o.repo);
   const cd = repo === '' ? '' : ' -C ' + codexSq(repo);
   return timeoutBinOrDefault(o.timeoutBin) + ' ' + seconds + ' codex exec' + cd
-    + ' -m ' + codexSq(modelId) + ' ' + codexSq(String(o.prompt === undefined || o.prompt === null ? '' : o.prompt)) + ' < /dev/null';
+    + ' -m ' + codexSq(modelId) + ' -c model_reasoning_effort=' + codexSq(reasoning)
+    + ' ' + codexSq(String(o.prompt === undefined || o.prompt === null ? '' : o.prompt)) + ' < /dev/null';
 }
 
 export function codexReviewCommand(input: CodexReviewCommandInput): CodexReviewCommandResult {