@event4u/agent-config 12.0.0 → 12.1.0

package/src/scripts/ai_council/clients.ts

@@ -115,7 +115,37 @@ export const DEFAULT_PERPLEXITY_MODEL = 'sonar-pro';
 // divergence is a one-line change, not a hunt through inline literals.
 // (`xai` / `perplexity` CLI reuse their API constants: their CLIs are
 // community wrappers around the same paid API, so the values do not diverge.)
-export const DEFAULT_OPENAI_CLI_MODEL = 'gpt-5';
+/**
+ * Sentinel: let the codex CLI pick its own model, by omitting `--model`.
+ *
+ * This is not a placeholder for a value nobody looked up. Measured
+ * 2026-08-15 against `codex exec --json` on a ChatGPT-account (subscription)
+ * transport, every explicitly named candidate was refused with
+ * `400 invalid_request_error: The '<model>' model is not supported when using
+ * Codex with a ChatGPT account.` — `gpt-4o`, `gpt-5` (this constant's previous
+ * value) and `gpt-5.1-codex` alike. Omitting the flag answered normally.
+ *
+ * So the only value known to work on this transport is "whatever the CLI
+ * chooses", and pinning ANY name here would re-break the seat the next time
+ * the vendor rotates its lineup. The label is carried into records as-is so a
+ * reader can see that no model was pinned, rather than a name being implied
+ * that nobody verified.
+ */
+export const OPENAI_CLI_VENDOR_DEFAULT = 'codex-default';
+
+/**
+ * Models MEASURED to be refused by the codex subscription transport, with the
+ * date they were measured. This is a deny-list on purpose: the CLI publishes
+ * no allow-list, so the honest claim is "these were rejected when we tried",
+ * never "only these are allowed".
+ */
+export const CODEX_MEASURED_UNSERVABLE: ReadonlyMap<string, string> = new Map([
+    ['gpt-4o', '2026-08-15'],
+    ['gpt-5', '2026-08-15'],
+    ['gpt-5.1-codex', '2026-08-15'],
+]);
+
+export const DEFAULT_OPENAI_CLI_MODEL = OPENAI_CLI_VENDOR_DEFAULT;
 export const DEFAULT_ANTHROPIC_CLI_MODEL = 'claude-sonnet-4-5';
 export const DEFAULT_GEMINI_CLI_MODEL = 'gemini-2.5-pro';
 
@@ -665,7 +695,18 @@ export class OpenAIClient extends ExternalAIClient {
 
     constructor(opts: ApiClientOptions = {}) {
         super();
-        this.model = opts.model ?? DEFAULT_OPENAI_MODEL;
+        // `codex-default` is the CLI transport's "let the host choose" sentinel,
+        // and ONE `model:` field in `.ai-council.yml` feeds both transports —
+        // which one a member resolves to is decided at run time, not in the
+        // config. The API has no such sentinel (there is no endpoint named
+        // `codex-default`), so it resolves to this client's own default instead
+        // of being sent verbatim and rejected. Without this, making the shipped
+        // template CLI-safe would break every api-transport user in the same
+        // commit.
+        this.model =
+            opts.model === undefined || opts.model === OPENAI_CLI_VENDOR_DEFAULT
+                ? DEFAULT_OPENAI_MODEL
+                : opts.model;
         if (opts.client !== undefined && opts.client !== null) {
             this._client = opts.client;
             return;
@@ -1252,6 +1293,20 @@ export abstract class CliClient extends ExternalAIClient {
         }
     }
 
+    /**
+     * Refuse a call this transport cannot serve, BEFORE spawning.
+     *
+     * `null` means "nothing known to be wrong" — deliberately not "verified
+     * servable". No vendor CLI here publishes the set of models its
+     * subscription tier accepts, so an allow-list would be invented and would
+     * reject valid pins the day the vendor adds one. What CAN be stated is the
+     * complement: models this estate has MEASURED being rejected. Subclasses
+     * override; the base transport knows of none.
+     */
+    protected _preflight_transport(): { code: string; detail: string } | null {
+        return null;
+    }
+
     /** Return text to send on stdin, or `null` to inherit caller's stdin. */
     protected _stdin_payload(system_prompt: string, user_prompt: string): string | null {
         void system_prompt;
@@ -1391,6 +1446,26 @@ export abstract class CliClient extends ExternalAIClient {
             }
         }
 
+        // 1b. transport pre-flight — refuse BEFORE spending.
+        //
+        // A subscription transport can be structurally unable to serve the
+        // configured model. Discovering that by spawning costs a call against
+        // the daily cap and returns an opaque `exit_1`, which reads as "the CLI
+        // is flaky" rather than "this pin can never work here". A refusal that
+        // names the model and the transport is the difference between a config
+        // bug someone fixes in a minute and a seat that quietly stays dead.
+        const preflight = this._preflight_transport();
+        if (preflight !== null) {
+            return new CouncilResponse({
+                provider: this.name,
+                model: this.model,
+                text: '',
+                latency_ms: _elapsedMs(t0),
+                error: preflight.code,
+                metadata: { cli: true, transport: this.transport, detail: preflight.detail },
+            });
+        }
+
         // 2. build command + spawn.
         const cmd = this._build_command(system_prompt, user_prompt, max_tokens);
         const stdinPayload = this._stdin_payload(system_prompt, user_prompt);
@@ -1726,9 +1801,46 @@ export class OpenAICliClient extends CliClient {
         void system_prompt;
         void user_prompt;
         void max_tokens;
+        // `--skip-git-repo-check` is not a convenience flag. Without it codex
+        // refuses any directory it does not consider trusted — captured
+        // `stderr_tail`: `Not inside a trusted directory and
+        // --skip-git-repo-check was not specified.` A worktree path is never
+        // trusted, which is the whole explanation for the standing observation
+        // that the openai seat dies in a worktree while working from the main
+        // checkout. The council reads a prompt and writes nothing through this
+        // process, so the trust gate protects nothing here that the council's
+        // own gates do not already cover.
+        //
         // `-` is codex's documented "read the prompt from stdin" positional;
         // the payload itself is assembled in `_stdin_payload`.
-        return [this.binary, 'exec', '--json', '--model', this.model, '-'];
+        const modelArgs =
+            this.model === OPENAI_CLI_VENDOR_DEFAULT ? [] : ['--model', this.model];
+        return [this.binary, 'exec', '--json', '--skip-git-repo-check', ...modelArgs, '-'];
+    }
+
+    /**
+     * Refuse a pin this estate has measured the transport rejecting.
+     *
+     * The remedy is named because it is not guessable: removing the `model:`
+     * line is the fix, and "remove a setting" is the last thing an operator
+     * tries when a member is silent.
+     */
+    protected override _preflight_transport(): { code: string; detail: string } | null {
+        const measuredOn = CODEX_MEASURED_UNSERVABLE.get(this.model);
+        if (measuredOn === undefined) return null;
+        return {
+            code: 'model_unsupported_on_transport',
+            detail:
+                `openai member pins model \`${this.model}\`, which the codex CLI ` +
+                `(subscription transport) refused when measured on ${measuredOn}: ` +
+                `"The '${this.model}' model is not supported when using Codex with a ` +
+                'ChatGPT account." The CLI publishes no list of models it DOES accept, ' +
+                'so there is no supported set to offer here — the one configuration ' +
+                'measured to work is no pin at all. Fix: remove the `model:` line from ' +
+                'the openai member (or set it to `codex-default`) to use the CLI\'s own ' +
+                'default. A pinned model is only reachable on the API transport ' +
+                '(`api_key_ref:` without `mode: cli`).',
+        };
     }
 
     /**
@@ -1752,6 +1864,7 @@ export class OpenAICliClient extends CliClient {
         let text = '';
         let input_tokens = 0;
         let output_tokens = 0;
+        let failure: string | null = null;
         const meta: Record<string, unknown> = {};
         for (let line of _splitlines(stdout)) {
             line = line.trim();
@@ -1794,6 +1907,31 @@ export class OpenAICliClient extends CliClient {
                             text = chunks.join('\n').trim();
                         }
                     }
+                    // The FLAT shape, and it is the one the CLI emits today:
+                    //   {"item":{"type":"agent_message","text":"OK"}}
+                    // The `content[]` branch above is the older nested form. Both
+                    // are read because this adapter has no way to pin a CLI
+                    // version, and reading only the nested one is why the seat
+                    // returned an empty string with NO error for every call —
+                    // measured 2026-08-15, and indistinguishable downstream from
+                    // a model that answered with nothing. Only an `agent_message`
+                    // is taken: an `error` item also carries `text`-adjacent
+                    // fields, and treating one as an answer would turn the
+                    // skills-budget warning into the member's response.
+                    //
+                    // LAST message wins, never the first. A codex turn emits
+                    // several `agent_message` items — a preamble ("I'll check X
+                    // first…") and then the answer — so keeping the first one
+                    // truncates the response to its throat-clearing. Measured
+                    // 2026-08-15 on a real council run: 1,479 output tokens
+                    // billed, 134 characters captured. A one-word probe cannot
+                    // catch this, which is why it survived the first fix.
+                    if (_dictGet(itemObj, 'type', undefined) === 'agent_message') {
+                        const flat = _pyStr(_dictGet(itemObj, 'text', '')).trim();
+                        if (flat) {
+                            text = flat;
+                        }
+                    }
                     if (_pyTruthy(_dictGet(itemObj, 'id', undefined))) {
                         meta['item_id'] = _pyStr(itemObj['id']);
                     }
@@ -1812,8 +1950,49 @@ export class OpenAICliClient extends CliClient {
                 if (_pyTruthy(_dictGet(ev, 'session_id', undefined))) {
                     meta['session_id'] = _pyStr(ev['session_id']);
                 }
+            } else if (event_type === 'turn.failed') {
+                // The turn's real cause lives ONLY here, and codex still exits
+                // 0. Without this branch the response is an empty text, which
+                // the caller reports as `no response` — indistinguishable from
+                // a model that answered with nothing. Measured 2026-08-15: a
+                // pinned `gpt-4o` produced exactly this shape, and the seat
+                // read as flaky for weeks instead of as misconfigured.
+                let err = _dictGet(ev, 'error', null);
+                if (!_pyTruthy(err)) err = {};
+                if (_isPlainObject(err)) {
+                    const raw = _pyStr(_dictGet(err as Record<string, unknown>, 'message', ''));
+                    if (raw) failure = raw;
+                }
             }
         }
+
+        if (failure !== null && !text) {
+            const unsupported = /not supported when using Codex/i.test(failure);
+            return new CouncilResponse({
+                provider: this.name,
+                model: this.model,
+                text: '',
+                input_tokens,
+                output_tokens,
+                error: unsupported ? 'model_unsupported_on_transport' : 'turn_failed',
+                metadata: {
+                    ...meta,
+                    // The vendor's own sentence, kept because it names the
+                    // model and the account type — the two facts an operator
+                    // needs and neither of which the error code carries.
+                    detail: failure.slice(0, 400),
+                    ...(unsupported
+                        ? {
+                              hint:
+                                  'the codex subscription transport serves no explicitly pinned ' +
+                                  'model measured so far — remove the `model:` line from the ' +
+                                  'openai member to use the CLI default',
+                          }
+                        : {}),
+                },
+            });
+        }
+
         return new CouncilResponse({
             provider: this.name,
             model: this.model,

package/src/scripts/ai_council/config.ts

@@ -81,6 +81,7 @@ import * as user_global_paths from '../_lib/user_global_paths.js';
 // `import type` and is erased at build, so there is no runtime cycle today.
 // Converting it to a value import — or adding any other runtime import from
 // quorum into config — creates a real ESM cycle in the loader's init path.
+import { OPENAI_CLI_VENDOR_DEFAULT } from './clients.js';
 import { SOLO_FLOOR_MIN_PRESENT } from './quorum.js';
 
 const _VALID_PROVIDERS: ReadonlySet<string> = new Set([
@@ -1843,7 +1844,21 @@ function _build_member(
             }
             entries.push(entry);
         }
-        if (member_enabled && model && !entries.includes(model)) {
+        // `codex-default` is a SENTINEL, not a model id — "let the transport
+        // choose". Requiring it to appear on a downgrade ladder of concrete ids
+        // is a category error, and it is the check that blocks the one config
+        // that actually works on a subscription account: the shipped template
+        // cannot pin an id (every id this package shipped is on
+        // `CODEX_MEASURED_UNSERVABLE`), and its ladder is an api-transport
+        // concern the CLI's own default cannot be ordered against. Exempting
+        // the sentinel is narrower than dropping the check — a real pin is
+        // still required to be on its own ladder.
+        if (
+            member_enabled &&
+            model &&
+            model !== OPENAI_CLI_VENDOR_DEFAULT &&
+            !entries.includes(model)
+        ) {
             throw new CouncilConfigError(
                 `members.${name}.model_ladder must include the active ` +
                     `\`model\` (${_pyReprStr(model)}); got ${_pyRepr(entries)}.`,

package/src/scripts/ai_council/low_impact.ts

@@ -35,6 +35,7 @@
 // - dict insertion order + `dict(sorted(...))` for the stats aggregation.
 
 import { pyRound } from '../_lib/value_ladder.js';
+import { OPENAI_CLI_VENDOR_DEFAULT } from './clients.js';
 import type { CouncilResponse, ExternalAIClient } from './clients.js';
 import type { LowImpactFastPathConfig, MemberConfig } from './config.js';
 import type { ImpactVerdict } from './necessity.js';
@@ -630,7 +631,19 @@ export function resolve_low_impact(
             const pinned = model_downgrade.model_tier_override?.[member.name];
             const cheapest = member.model_ladder.length > 0 ? member.model_ladder[0] : null;
             const target = pinned && pinned.length > 0 ? pinned : cheapest;
-            if (target && target !== client.model) {
+            // A member left on the vendor-default sentinel is NOT downgradable
+            // off the ladder. There is nothing to downgrade FROM — the
+            // transport picks the model — and writing a rung onto it re-creates
+            // the pinned-id shape the seat repair removed. Concretely: the
+            // shipped ladder's cheapest rung is `gpt-4o-mini` and its
+            // neighbours are `gpt-4o` / `gpt-4.1`, so this line could hand the
+            // codex transport an id `CODEX_MEASURED_UNSERVABLE` already records
+            // as refused — on a path whose `model_downgrade.enabled` defaults
+            // to true. An explicit per-run `model_tier_override` still wins,
+            // because that is a human naming a model for this run.
+            const unpinned = client.model === OPENAI_CLI_VENDOR_DEFAULT;
+            const overrideWins = pinned !== undefined && pinned.length > 0;
+            if (target && target !== client.model && (!unpinned || overrideWins)) {
                 client.model = target;
             }
         }

package/src/scripts/ai_council/orchestrator.ts

@@ -2029,7 +2029,20 @@ export function render(responses: CouncilResponse[], opts: RenderOptions = {}):
 function _render_quorum_line(q: QuorumResult): string {
     const verdict = q.status === 'concluded' ? 'concluded' : 'INCONCLUSIVE — release gate holds';
     const solo = isSoloConcluded(q) ? ' · **solo** — one voice concluded this pass' : '';
-    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${solo}`;
+    // The DEGRADED marker shipped on stdout (`council_cli.ts::_format_quorum_line`,
+    // round 7 § 5.3) and did NOT ship here, although this function is the one
+    // the mirror was copied FROM. The two then diverged in the worse direction:
+    // stdout scrolls away, this string is what gets committed as evidence and
+    // cited months later. `1/2 present, needed 1 — concluded` is literally true
+    // and reads as agreement; the solo marker alone covers only present === 1,
+    // so 2-of-4 rendered as plain "concluded" with nothing to stop a reader
+    // inferring convergence. Same sentence as stdout on purpose — one wording,
+    // so neither surface can drift into being the softer one again.
+    const degraded =
+        q.present < q.total
+            ? `  ⚠️  DEGRADED — ${String(q.total - q.present)} member(s) did not answer; this is not convergence.`
+            : '';
+    return `**Quorum:** ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${solo}${degraded}`;
 }
 
 /**

package/src/scripts/ai_council/transport_resolver.ts

@@ -356,6 +356,7 @@ export type CliFailureClass =
     | 'binary_missing'
     | 'auth_rejected'
     | 'cli_unsupported'
+    | 'model_unservable'
     | 'timeout'
     | 'server_error'
     | 'quota_exhausted'
@@ -376,6 +377,20 @@ const FALLBACK_ELIGIBLE: ReadonlySet<CliFailureClass> = new Set([
     'binary_missing',
     'auth_rejected',
     'cli_unsupported',
+    // `model_unservable` satisfies the same no-double-charge property in both
+    // of its shapes: the pre-spend gate refuses before any subprocess exists,
+    // and the call-time shape is a provider 400 — rejected at the request
+    // boundary, no generation performed.
+    //
+    // HONEST SCOPE: this set is not consumed by any shipped path today.
+    // `isFallbackEligible` and `MidFlightFallback` have zero call sites outside
+    // this module and its tests, so membership here is a stated property of the
+    // class, NOT a behaviour a caller performs. Said plainly because the
+    // opposite reading is the attractive one — the constraint really is the
+    // subscription transport's rather than the model's, so the api rung really
+    // would serve the same id, and it would be easy to write that as if it
+    // happened. It does not happen yet.
+    'model_unservable',
 ]);
 
 /** Normalise a raw client error / skip reason into a `CliFailureClass`. */
@@ -388,6 +403,15 @@ export function classifyCliFailure(raw: string): CliFailureClass {
     if (s === 'cli_unsupported' || s === 'unsupported' || s === 'parse_failed') {
         return 'cli_unsupported';
     }
+    // Prefix match, not equality: the detail carries the operator-facing reason
+    // after the code, and that sentence IS the value of this class — collapsing
+    // it back to a bare token would restore the opaque `exit_1` this replaced.
+    // Also matched on the provider's own wording, so a model refused at call
+    // time (one the deny-list has never seen) classifies the same as one the
+    // pre-spend gate caught.
+    if (s.startsWith('model_unservable') || s.includes('is not supported when using codex')) {
+        return 'model_unservable';
+    }
     if (s === 'timeout') return 'timeout';
     if (s === 'cli_quota_exhausted' || s === 'quota_exhausted') return 'quota_exhausted';
     if (/^exit_5\d\d$/.test(s) || s === 'server_error' || s === 'os') return 'server_error';
@@ -406,8 +430,14 @@ export function isFallbackEligible(failure: CliFailureClass): boolean {
  * can bucket every absent member — whether it never got a transport at all
  * or lost one partway through — under one vocabulary. Returns `null` for a
  * failure class outside the four-value enum (`cli_unsupported`,
- * `server_error`, `other`); a caller falls back to the raw failure detail
- * for those rather than mis-classifying them.
+ * `server_error`, `model_unservable`, `other`); a caller falls back to the raw
+ * failure detail for those rather than mis-classifying them.
+ *
+ * `model_unservable` is deliberately unmapped rather than folded into
+ * `no_auth`: the credential is fine, the model is not, and the `detail` string
+ * carries the specific reason. So the bucket a reader sees is still the generic
+ * `unavailable`, while the line beside it now names the cause — an incomplete
+ * improvement, stated as one.
  */
 export function absentReasonFromCliFailure(failure: CliFailureClass): AbsentReason | null {
     switch (failure) {