@gotcos/glasses-server 6.79.2 → 6.80.0

package/server/lib/model-router.ts

@@ -4,10 +4,12 @@ import { callCursorStreaming } from './cursor-bridge.js'
 import { callOllamaStreaming } from './ollama-bridge.js'
 import {
   getOrCreateSession,
+  getSessionBinding,
   getSessionModel,
   setSessionModel,
   type ModelPreference,
   type PromptReference,
+  type SessionModelBinding,
 } from './conversation.js'
 import {
   DEFAULT_MODEL,
@@ -15,7 +17,6 @@ import {
   isClaudeModel,
   isCursorModel,
   isOllamaModel,
-  normalizeModelPreference,
 } from '../../shared/model-preference.js'
 import {
   getCursorModelCatalog,
@@ -27,6 +28,14 @@ import {
   isOllamaProviderReady,
 } from './ollama-catalog.js'
 import type { ModelImageInput } from './model-image-input.js'
+import { parsePreference } from '../../shared/key-preference.js'
+import {
+  closedEnvDefaultModel,
+  keyProfileEngineRunner,
+  keyProfileUnavailableLine,
+  resolveKeyProfileTurn,
+  type KeyProfileTurnCallbacks,
+} from './key-profile-routing.js'
 
 // Bridges return as soon as their subprocess is spawned, while completion is
 // delivered later through callbacks. This keyed tail queue therefore releases
@@ -57,8 +66,8 @@ export async function acquireModelSessionRunLock(sessionId: string): Promise<()
 export async function callModelStreaming(
   query: string,
   sessionId: string | undefined,
-  callbacks: StreamCallbacks,
-  model?: ModelPreference,
+  callbacks: StreamCallbacks & KeyProfileTurnCallbacks,
+  model?: SessionModelBinding,
   images?: ModelImageInput[],
   reference?: PromptReference,
   globalMsgNum?: number,
@@ -71,12 +80,21 @@ export async function callModelStreaming(
     throw new Error('model-router: request aborted before the model run started.')
   }
 
+  // Key lanes K1 (plan 5.2): the request model is ACCEPTED here. parsePreference returns exactly
+  // normalizeModelPreference for every model slot; only a well formed `profile:<id>` is new.
+  const requested = parsePreference(model)
   const sessionModel = getSessionModel(sid)
+  // A session bound to a profile reads null from the closed getSessionModel. It is looked up
+  // only when nothing else names the model, so every 6.79.0 path stays exactly as it was.
+  const bound = requested ?? (sessionModel === null ? parsePreference(getSessionBinding(sid)) : undefined)
+  const profileId = bound?.kind === 'profile' ? bound.id : undefined
+  if (profileId !== undefined) return await runKeyProfileRoute(query, sid, callbacks, profileId, release, images, reference, globalMsgNum, options)
+
   // COS_G2_DEFAULT_MODEL is the documented default-model switch (CHANGELOG 6.1.0);
   // it must win over the hardcoded DEFAULT_MODEL on this primary query path, not
-  // just the OpenAI-compat surface.
-  const envDefault = normalizeModelPreference(process.env.COS_G2_DEFAULT_MODEL)
-  const resolvedModel = normalizeModelPreference(model) ?? sessionModel ?? envDefault ?? DEFAULT_MODEL
+  // just the OpenAI-compat surface. A profile id there is ignored (plan 5.2: closed).
+  const envDefault = closedEnvDefaultModel(process.env.COS_G2_DEFAULT_MODEL)
+  const resolvedModel = (requested?.kind === 'model' ? requested.value : undefined) ?? sessionModel ?? envDefault ?? DEFAULT_MODEL
 
   setSessionModel(sid, resolvedModel)
 
@@ -86,8 +104,9 @@ export async function callModelStreaming(
     terminal = true
     release()
   }
+  const { onKeyProfileTurn: _onKeyProfileTurn, ...streamCallbacks } = callbacks
   const lockedCallbacks: StreamCallbacks = {
-    ...callbacks,
+    ...streamCallbacks,
     onDone: async (fullText, completedModel, cliSessionId, metadata) => {
       try {
         return await callbacks.onDone(fullText, completedModel, cliSessionId, metadata)
@@ -142,3 +161,73 @@ export async function callModelStreaming(
     throw err
   }
 }
+
+/**
+ * Key lanes K1 (plan 5.2): a turn bound to `profile:<id>`. Refused with a lens line, never
+ * answered on the subscription, when lanes are off, the profile is unknown, disabled or keyless,
+ * no runner is registered for its engine, or it is a scheduled dispatch.
+ */
+async function runKeyProfileRoute(
+  query: string,
+  sid: string,
+  callbacks: StreamCallbacks & KeyProfileTurnCallbacks,
+  profileId: string,
+  release: () => void,
+  images?: ModelImageInput[],
+  reference?: PromptReference,
+  globalMsgNum?: number,
+  options?: CallOptions,
+): Promise<string> {
+  let terminal = false
+  const releaseTerminal = () => {
+    if (terminal) return
+    terminal = true
+    release()
+  }
+  const { onKeyProfileTurn, ...streamCallbacks } = callbacks
+  const lockedCallbacks: StreamCallbacks = {
+    ...streamCallbacks,
+    onDone: async (fullText, completedModel, cliSessionId, metadata) => {
+      try {
+        return await callbacks.onDone(fullText, completedModel, cliSessionId, metadata)
+      } finally {
+        releaseTerminal()
+      }
+    },
+    onError: async (error) => {
+      try {
+        await callbacks.onError(error)
+      } finally {
+        releaseTerminal()
+      }
+    },
+  }
+  try {
+    if (options?.dispatch) {
+      console.info(`[key-lanes] refused kind=dispatch profile=${profileId}`)
+      await lockedCallbacks.onError('dispatch_requires_claude')
+      return sid
+    }
+    const resolved = resolveKeyProfileTurn(profileId)
+    if (!resolved.ok) {
+      // QA G4: one line per refusal kind.
+      console.info(`[key-lanes] refused kind=${resolved.code} profile=${profileId}`)
+      await lockedCallbacks.onError(resolved.message)
+      return sid
+    }
+    const runner = keyProfileEngineRunner(resolved.turn.profile.engine)
+    if (!runner) {
+      console.info(`[key-lanes] refused kind=no_runner engine=${resolved.turn.profile.engine}`)
+      await lockedCallbacks.onError(keyProfileUnavailableLine(resolved.turn.profile.label))
+      return sid
+    }
+    // Persisted by syntax (conversation.ts) so the next turn of this session stays on the key,
+    // unless this is the one-turn plan-limit offer (QA U9): then the session keeps its model.
+    if (!options?.keyTurnOnly) setSessionModel(sid, resolved.turn.binding)
+    onKeyProfileTurn?.(resolved.turn)
+    return await runner(query, sid, lockedCallbacks, resolved.turn, images, reference, globalMsgNum, options)
+  } catch (err) {
+    releaseTerminal()
+    throw err
+  }
+}

package/server/lib/morning-brief-config.ts

@@ -19,6 +19,7 @@ import { chmodSync, mkdirSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { durableAtomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
 import { dataPath } from './data-dir.js'
+import { KEY_PROFILE_REJECT_CODE, KEY_PROFILE_SCHEDULED_REJECT, keyProfileRejectApplies } from './key-profile-rejects.js'
 import {
   normalizeEffortPreference,
   normalizeModelPreference,
@@ -410,6 +411,8 @@ export function applyMorningBriefPatch(current: MorningBriefConfig, raw: unknown
       delete next.model
     } else {
       const model = normalizeModelPreference(patch.model)
+      // Key lanes K1 (plan 5.2): Reject, and say why. A brief always runs on the subscription.
+      if (!model && keyProfileRejectApplies(patch.model)) throw new MorningBriefConfigError(KEY_PROFILE_REJECT_CODE, KEY_PROFILE_SCHEDULED_REJECT)
       if (!model) throw new MorningBriefConfigError('invalid_model', 'Unknown model preference.')
       next.model = model
     }

package/server/lib/native-head.ts

@@ -195,6 +195,8 @@ export interface NativeHeadDirs {
   claudeProjectsDir: string
   /** `<COS_AGENT_SESSIONS_HOME|~>/.codex/sessions` */
   codexSessionsDir: string
+  /** Key lanes (plan v4 8.2): each keyed profile home's `sessions`, searched after the server's. Absent with no profile home. */
+  codexProfileSessionsDirs?: string[]
   /** `<COS_AGENT_SESSIONS_HOME|~>/.cursor/projects` */
   cursorProjectsDir: string
 }
@@ -495,7 +497,16 @@ function claudeTranscriptPath(threadId: string, deps: NativeHeadDeps): string |
  * certified.
  */
 function codexRolloutPath(threadId: string, deps: NativeHeadDeps): string | null {
-  const root = deps.dirs.codexSessionsDir
+  const found = codexRolloutPathIn(deps.dirs.codexSessionsDir, threadId, deps)
+  if (found !== null || !deps.dirs.codexProfileSessionsDirs) return found
+  for (const root of deps.dirs.codexProfileSessionsDirs) {
+    const keyed = codexRolloutPathIn(root, threadId, deps)
+    if (keyed !== null) return keyed
+  }
+  return null
+}
+
+function codexRolloutPathIn(root: string, threadId: string, deps: NativeHeadDeps): string | null {
   if (!deps.dirExists(root)) return null
 
   let scanned = 0
@@ -626,6 +637,7 @@ export function realNativeHeadDirs(): NativeHeadDirs {
     claudeProjectsDir: roots.claudeProjects,
     codexSessionsDir: roots.codexSessions,
     cursorProjectsDir: roots.cursorProjects,
+    ...(roots.codexProfileSessions ? { codexProfileSessionsDirs: roots.codexProfileSessions } : {}),
   }
 }
 

package/server/lib/occupancy-probes.ts

@@ -63,6 +63,7 @@ import { activeSqliteReaderPids, cliChatLastWriteMs } from './cursor-session-mod
 // about which directory "empty" was observed in.
 export { claudeSessionsDir } from '../routes/claude-sessions.js'
 import { claudeSessionsDir } from '../routes/claude-sessions.js'
+import { profileCodexHomeSubdirs } from './codex-homes.js'
 
 /**
  * `<CODEX_HOME|~/.codex>/thread-writer-locks`.
@@ -78,10 +79,13 @@ export function codexLocksDir(): string {
 
 export function realOccupancyDirs(): OccupancyDirs {
   const home = process.env.COS_AGENT_SESSIONS_HOME?.trim() || homedir()
+  const profileLocks = profileCodexHomeSubdirs('thread-writer-locks')
   return {
     claudeSessionsDir: claudeSessionsDir(),
     codexLocksDir: codexLocksDir(),
     cursorChatsDir: join(home, '.cursor', 'chats'),
+    // Key lanes K1 (plan v4 8.2): absent with no keyed profile home, so the dirs are 963fe25's.
+    ...(profileLocks.length ? { codexProfileLocksDirs: profileLocks } : {}),
   }
 }
 

package/server/lib/ollama-run-ledger.ts

@@ -1,7 +1,9 @@
 import crypto from 'node:crypto'
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
-import { OLLAMA_MODEL, type OllamaModelPreference } from '../../shared/model-preference.js'
+import { OLLAMA_MODEL } from '../../shared/model-preference.js'
+import { dataPath } from './data-dir.js'
+import type { KeyLane } from './key-relay-contract.js'
 
 const DEFAULT_MAX_RUNS = 100
 const DEFAULT_TTL_MS = 7 * 24 * 60 * 60_000
@@ -10,6 +12,13 @@ const RUNNING_STALE_MS = 30 * 60_000
 
 export type OllamaRunStatus = 'running' | 'completed' | 'failed' | 'cancelled' | 'client_disconnected'
 
+/**
+ * One run, Ollama or (key lanes K1 P5, plan v4 9.1) direct. `model` was OllamaModelPreference; it
+ * is a string now so a direct run can carry its `profile:<id>` preference. Ollama rows still write
+ * exactly `model: 'ollama'` and never a `lane`, `profile` or `providerModel` key, in the 6.79.0
+ * key order (pinned byte for byte by ollama-run-ledger.test.ts). Direct rows live in their own
+ * file (`direct-runs.jsonl` under the data dir), so the Ollama ledger only ever holds Ollama runs.
+ */
 export interface OllamaRunRecord {
   runId: string
   turnId?: string
@@ -18,8 +27,15 @@ export interface OllamaRunRecord {
   status: OllamaRunStatus
   createdAt: string
   updatedAt: string
-  model: OllamaModelPreference
-  ollamaModel: string
+  model: string
+  /** Direct rows only. */
+  lane?: KeyLane
+  /** Direct rows only: the key profile id. */
+  profile?: string
+  /** Ollama rows: the pulled tag. Direct rows leave it out and use providerModel. */
+  ollamaModel?: string
+  /** Direct rows only: the provider model id or OpenRouter slug. */
+  providerModel?: string
   origin: string
   queryPreview?: string
   outputPreview?: string
@@ -42,6 +58,11 @@ export function getOllamaLedgerPath(): string {
   return resolve(process.env.COS_OLLAMA_RUN_LEDGER_FILE || resolve(import.meta.dirname, '..', 'data', 'ollama-runs.jsonl'))
 }
 
+/** Direct (Lane C1) runs. Written only by a keyed turn, so nothing is created while lanes are off. */
+export function getDirectRunLedgerPath(): string {
+  return resolve(process.env.COS_DIRECT_RUN_LEDGER_FILE || dataPath('direct-runs.jsonl'))
+}
+
 function getMaxRuns(): number {
   const raw = Number(process.env.COS_OLLAMA_RUN_LEDGER_MAX ?? DEFAULT_MAX_RUNS)
   return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : DEFAULT_MAX_RUNS
@@ -52,9 +73,8 @@ function getTtlMs(): number {
   return Number.isFinite(rawDays) && rawDays > 0 ? rawDays * 24 * 60 * 60_000 : DEFAULT_TTL_MS
 }
 
-function appendEvent(event: OllamaRunEvent): void {
+function appendEvent(event: OllamaRunEvent, path: string = getOllamaLedgerPath()): void {
   try {
-    const path = getOllamaLedgerPath()
     mkdirSync(dirname(path), { recursive: true })
     appendFileSync(path, JSON.stringify(event) + '\n')
   } catch (err) {
@@ -62,8 +82,7 @@ function appendEvent(event: OllamaRunEvent): void {
   }
 }
 
-function readEvents(): OllamaRunEvent[] {
-  const path = getOllamaLedgerPath()
+function readEvents(path: string = getOllamaLedgerPath()): OllamaRunEvent[] {
   if (!existsSync(path)) return []
   try {
     const events: OllamaRunEvent[] = []
@@ -129,23 +148,29 @@ export function startOllamaRun(input: {
   return run
 }
 
-export function finishOllamaRun(runId: string, input: {
+interface FinishRunInput {
   status: Exclude<OllamaRunStatus, 'running'>
   startedAtMs: number
   output?: string
   error?: string
-}): OllamaRunRecord | null {
+}
+
+function finishRun(path: string, classify: (message: string) => string, runId: string, input: FinishRunInput): void {
   const patch: Partial<OllamaRunRecord> = {
     status: input.status,
     durationMs: Math.max(0, Date.now() - input.startedAtMs),
   }
   if (input.output) patch.outputPreview = redactForOllamaLedger(input.output)
   if (input.error) {
-    patch.errorCode = classifyOllamaError(input.error)
+    patch.errorCode = classify(input.error)
     patch.errorPreview = redactForOllamaLedger(input.error)
   }
   const ts = new Date().toISOString()
-  appendEvent({ runId, ts, patch: { ...patch, updatedAt: ts } })
+  appendEvent({ runId, ts, patch: { ...patch, updatedAt: ts } }, path)
+}
+
+export function finishOllamaRun(runId: string, input: FinishRunInput): OllamaRunRecord | null {
+  finishRun(getOllamaLedgerPath(), classifyOllamaError, runId, input)
   return getOllamaRun(runId)
 }
 
@@ -154,10 +179,14 @@ export function getOllamaRun(runId: string): OllamaRunRecord | null {
 }
 
 export function listOllamaRuns(limit = 20, sessionId?: string): OllamaRunRecord[] {
+  return listRuns(getOllamaLedgerPath(), 'ollama.timeout', limit, sessionId)
+}
+
+function listRuns(path: string, staleCode: string, limit: number, sessionId?: string): OllamaRunRecord[] {
   const runs = new Map<string, OllamaRunRecord>()
   const order = new Map<string, number>()
   let eventIndex = 0
-  for (const event of readEvents()) {
+  for (const event of readEvents(path)) {
     eventIndex += 1
     const existing = runs.get(event.runId)
     const next = { ...(existing ?? {}), ...event.patch, runId: event.runId } as OllamaRunRecord
@@ -175,7 +204,7 @@ export function listOllamaRuns(limit = 20, sessionId?: string): OllamaRunRecord[
         return {
           ...run,
           status: 'client_disconnected' as const,
-          errorCode: run.errorCode ?? 'ollama.timeout',
+          errorCode: run.errorCode ?? staleCode,
         }
       }
       return run
@@ -183,3 +212,57 @@ export function listOllamaRuns(limit = 20, sessionId?: string): OllamaRunRecord[
     .sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt))
     .slice(0, limit)
 }
+
+// ── Direct runs (key lanes K1 P5, plan v4 9.1) ───────────────────────────────
+
+/** `direct.<failure>` for a key-lane failure kind, else the closest generic code. */
+export function classifyDirectError(message: string): string {
+  const m = /^direct-bridge: \[([a-z_]+)\]/.exec(message)
+  if (m) return `direct.${m[1]}`
+  const text = message.toLowerCase()
+  if (/tool round cap/.test(text)) return 'direct.tool_cap'
+  if (/tool aborted|tool call aborted/.test(text)) return 'direct.tool_abort'
+  if (/timeout|timed out|aborted/.test(text)) return 'direct.timeout'
+  return 'direct.error'
+}
+
+export function startDirectRun(input: {
+  turnId?: string
+  clientJobId?: string
+  cosSessionId: string
+  /** The COS preference the exchange is stamped with, `profile:<id>`. */
+  model: string
+  profile: string
+  providerModel: string
+  /** Endpoint origin only (scheme, host, port). Never a path, query or key. */
+  origin: string
+  query: string
+}): OllamaRunRecord {
+  const now = new Date().toISOString()
+  const run: OllamaRunRecord = {
+    runId: `direct-${crypto.randomUUID().slice(0, 8)}`,
+    turnId: input.turnId,
+    clientJobId: input.clientJobId,
+    cosSessionId: input.cosSessionId,
+    status: 'running',
+    createdAt: now,
+    updatedAt: now,
+    model: input.model,
+    lane: 'direct',
+    profile: input.profile,
+    providerModel: input.providerModel,
+    origin: input.origin,
+    queryPreview: redactForOllamaLedger(input.query),
+  }
+  appendEvent({ runId: run.runId, ts: now, patch: run }, getDirectRunLedgerPath())
+  return run
+}
+
+export function finishDirectRun(runId: string, input: FinishRunInput): OllamaRunRecord | null {
+  finishRun(getDirectRunLedgerPath(), classifyDirectError, runId, input)
+  return listDirectRuns(getMaxRuns()).find(run => run.runId === runId) ?? null
+}
+
+export function listDirectRuns(limit = 20, sessionId?: string): OllamaRunRecord[] {
+  return listRuns(getDirectRunLedgerPath(), 'direct.timeout', limit, sessionId)
+}

package/server/lib/prompt-edit.ts

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process'
+import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
 
 export const PROMPT_EDIT_DRAFT_MAX_CHARS = 24_000
 export const PROMPT_EDIT_INSTRUCTION_MAX_CHARS = 2_000
@@ -90,6 +91,7 @@ export function spawnClaudeText(prompt: string, opts: SpawnClaudeTextOptions = {
     const args = ['-p', '--model', model, '--effort', effort, '--output-format', 'text', '--no-session-persistence',
       '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}']
     if (opts.systemPrompt) args.push('--system-prompt', opts.systemPrompt)
+    args.push(...claudeKeySecretsGuardArgs())
 
     const proc = spawn('claude', args, {
       stdio: ['pipe', 'pipe', 'pipe'],

package/server/lib/query-job-coordinator.ts

@@ -31,6 +31,7 @@ import {
   type QueryJobSteerState,
   type QueryJobStoreHealth,
 } from './query-job-types.js'
+import type { QueryJobKeyAnswerFields } from './key-answer-fields.js'
 import { SteerPort, steerClock, steerCutoffMs, type PendingSteer, type QueryProvider } from './claude-steer.js'
 import type { MaintenanceWorkLease } from './maintenance-lifecycle.js'
 import { applyTrailToolMode, type JobTrailDraft } from './job-trail.js'
@@ -43,7 +44,7 @@ export interface QueryJobRunnerStart extends QueryJobProviderLinkage {
   sessionId?: string
 }
 
-export interface QueryJobRunnerCompletion extends QueryJobProviderLinkage {
+export interface QueryJobRunnerCompletion extends QueryJobProviderLinkage, QueryJobKeyAnswerFields {
   text: string
   attachments?: unknown
   outputImageStats?: QueryJobOutputImageStats

package/server/lib/query-job-runtime.ts

@@ -9,7 +9,7 @@ import { dataPath } from './data-dir.js'
 import { currentMessageEra, LEGACY_MESSAGE_ERA } from './message-era.js'
 import { durableQueryJobsEnabled, messagesSteerEnabled, messagesTrailEnabled } from './query-job-feature.js'
 import { claudeSupportsSteer } from './claude-cli-support.js'
-import { providerOfModel, resolveRunModel } from './claude-steer.js'
+import { steerProviderFor } from './claude-steer.js'
 import { QueryJobCoordinator, type QueryJobRunner } from './query-job-coordinator.js'
 import { QueryJobStore, createQueryJobJournalStorage } from './query-job-store.js'
 import {
@@ -17,7 +17,6 @@ import {
   isCursorModel,
   isOllamaModel,
   normalizeEffortPreference,
-  normalizeModelPreference,
   type CursorExecutionMode,
   type ModelPreference,
 } from '../../shared/model-preference.js'
@@ -26,10 +25,15 @@ import { attachmentHistoryPrefix, defaultAttachmentRequest } from '../../shared/
 import {
   findExchangesByJobIdentity,
   flushConversationToDisk,
+  getSessionBinding,
   getSessionModel,
   reconcileExchangeByJobIdentity,
   removeExchangesByJobIdentity,
+  type KeyProfileBinding,
+  type SessionModelBinding,
 } from './conversation.js'
+import { parsePreference, profilePreference } from '../../shared/key-preference.js'
+import { linkageProviderForEngine, profileSteerProvider, type KeyProfileTurn } from './key-profile-routing.js'
 import {
   isTerminalQueryJobStatus,
   type QueryJobProviderLinkage,
@@ -40,6 +44,7 @@ import { acquireMaintenanceWork } from './maintenance-lifecycle.js'
 import type { JobTrailDraft } from './job-trail.js'
 import { registerMessageReservationSource } from './message-reservations.js'
 import { bootResumeGate } from './boot-resume.js'
+import { keyAnswerCompletionFields, keyAnswerDoneFields } from './key-answer-fields.js'
 
 const TOOL_STATUS_MESSAGES: Record<string, string> = {
   WebSearch: 'Searching web...',
@@ -118,6 +123,38 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
   }
 }
 
+/**
+ * Plan 5.2 Accept by syntax for the terminal projection: a model slot exactly as
+ * normalizeModelPreference gives it, or `profile:<id>`. Same rule as conversation's
+ * normalizeSessionBinding, computed here so the projection needs nothing new from the store.
+ */
+function requestBinding(model: unknown): SessionModelBinding | undefined {
+  const parsed = parsePreference(model)
+  if (!parsed) return undefined
+  return parsed.kind === 'model' ? parsed.value : profilePreference(parsed.id) as KeyProfileBinding
+}
+
+/** Linkage provider for a keyed turn: the profile's engine. Direct (Lane C) carries none. */
+function keyProfileLinkageProvider(turn: KeyProfileTurn): { provider?: 'claude' | 'codex' } {
+  const provider = linkageProviderForEngine(turn.profile.engine)
+  return provider ? { provider } : {}
+}
+
+/**
+ * The steer gate's provider for a job (P6 owns this; P3 consumes it). With no profile anywhere
+ * this is exactly `providerOfModel(resolveRunModel(...))`, as in 6.78.0.
+ */
+export function steerProviderForJob(request: Pick<QueryJobRequest, 'model' | 'sessionId'>): ReturnType<typeof profileSteerProvider> {
+  const verdict = steerProviderFor(
+    request.model,
+    getSessionModel(request.sessionId),
+    process.env.COS_G2_DEFAULT_MODEL,
+    () => getSessionBinding(request.sessionId),
+  )
+  if (verdict.kind === 'profile_session') return profileSteerProvider(verdict.profileId)
+  return verdict.provider
+}
+
 function providerFor(model: ModelPreference): 'claude' | 'codex' | 'cursor' | 'ollama' {
   if (isOllamaModel(model)) return 'ollama'
   if (isCursorModel(model)) return 'cursor'
@@ -167,7 +204,7 @@ export async function projectPublicConversationTerminal(
     request.globalMsgNum,
     request.attachmentRefs,
     request.messageEra,
-    normalizeModelPreference(request.model),
+    requestBinding(request.model),
     request.origin,
   )
   reconcileExchangeByJobIdentity(
@@ -178,7 +215,7 @@ export async function projectPublicConversationTerminal(
     request.globalMsgNum,
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
     request.messageEra,
-    normalizeModelPreference(request.model),
+    requestBinding(request.model),
     request.origin,
   )
   flushConversationToDisk()
@@ -204,19 +241,29 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
     sessionId: request.sessionId,
   })
   const imageInputs = resolvedAttachments.inputs.length > 0 ? resolvedAttachments.inputs : undefined
-  const validModel = normalizeModelPreference(request.model)
+  // Key lanes K1 (plan 5.2): Accept. A `profile:<id>` goes to model-router, which runs it on the
+  // profile's engine or refuses it; the closed slot keeps every family guard below unchanged.
+  const requestedBinding = parsePreference(request.model)
+  const validModel = requestedBinding?.kind === 'model' ? requestedBinding.value : undefined
   const validEffort = normalizeEffortPreference(request.effort)
   let activeModel = validModel
+  // Set only by model-router's onKeyProfileTurn, so a subscription turn never sees it.
+  let keyTurn: KeyProfileTurn | undefined
+  const linkageFor = (model: ModelPreference) => keyTurn
+    ? { ...keyProfileLinkageProvider(keyTurn), resolvedModel: keyTurn.binding }
+    : { provider: providerFor(model), resolvedModel: model }
 
   await callModelStreaming(
     request.query,
     request.sessionId,
     {
+      ...(requestedBinding?.kind === 'model' ? {} : {
+        onKeyProfileTurn: (turn: KeyProfileTurn) => { keyTurn = turn },
+      }),
       onStart: async (model, sessionId, cliSessionId, metadata) => {
         activeModel = model
         const linkage = {
-          provider: providerFor(model),
-          resolvedModel: model,
+          ...linkageFor(model),
           cliSessionId,
           claudeRunId: metadata?.claudeRunId,
           codexRunId: metadata?.codexRunId,
@@ -232,7 +279,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           turnId,
           messageEra: request.messageEra,
           globalMsgNum: request.globalMsgNum,
-          model,
+          model: keyTurn ? keyTurn.binding : model,
           sessionId,
           cliSessionId,
           ...metadata,
@@ -241,7 +288,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       },
       onProviderProcess: metadata => callbacks.onProviderProcess({
         provider: metadata.provider,
-        ...(activeModel ? { resolvedModel: activeModel } : {}),
+        ...(keyTurn ? { resolvedModel: keyTurn.binding } : activeModel ? { resolvedModel: activeModel } : {}),
         ...(metadata.provider === 'claude'
           ? { claudeRunId: metadata.runId }
           : metadata.provider === 'cursor'
@@ -273,7 +320,8 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
         onTrail: (draft: JobTrailDraft) => callbacks.onTrail(draft),
       } : {}),
       onAnswerReady: text => callbacks.onAnswerReady(text, {
-        ...(activeModel ? { provider: providerFor(activeModel), resolvedModel: activeModel } : {}),
+        ...(keyTurn ? { ...keyProfileLinkageProvider(keyTurn), resolvedModel: keyTurn.binding }
+          : activeModel ? { provider: providerFor(activeModel), resolvedModel: activeModel } : {}),
       }),
       onDone: async (fullText, model, cliSessionId, metadata) => {
         const attachments = mergeMediaAttachmentRefs(
@@ -287,8 +335,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           ? acquireMaintenanceWork('query_attachment_write', { allowDuringDrain: true })
           : undefined
         const linkage = {
-          provider: providerFor(model),
-          resolvedModel: model,
+          ...linkageFor(model),
           cliSessionId,
           claudeRunId: metadata?.claudeRunId,
           codexRunId: metadata?.codexRunId,
@@ -304,6 +351,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             attachments,
             outputImageStats: metadata?.outputImageStats,
             ...linkage,
+            ...keyAnswerCompletionFields(metadata),
           })
           if (!terminalOwned) return
           if (resolvedAttachments.ids.length > 0) {
@@ -323,9 +371,10 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             globalMsgNum: request.globalMsgNum,
             text: fullText,
             sessionId: request.sessionId,
-            model,
+            model: keyTurn ? keyTurn.binding : model,
             cliSessionId,
             ...runMetadata,
+            ...keyAnswerDoneFields(runMetadata),
             ...(attachments.length > 0 ? { attachments } : {}),
             ...originStamp(request),
           } })
@@ -348,7 +397,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
         } })
       },
     },
-    validModel,
+    requestedBinding?.kind === 'profile' ? requestBinding(request.model) : validModel,
     imageInputs,
     request.reference,
     request.globalMsgNum,
@@ -371,6 +420,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       sessionLockHeld: true,
       ...(request.dispatch ? { dispatch: request.dispatch } : {}),
       ...(request.sessionName ? { sessionName: request.sessionName } : {}),
+      ...(request.keyTurnOnly ? { keyTurnOnly: true } : {}),
       // 6.78.0: only on a run the coordinator decided is steerable.
       ...(steer ? { steer } : {}),
     },
@@ -399,9 +449,11 @@ export const queryJobCoordinator = new QueryJobCoordinator(queryJobStore, runner
   bootResumeGate,
   // 6.78.0 Messages steer (COS_MESSAGES_STEER, default off). The provider is resolved as
   // model-router resolves it, so a run is steerable only when it will run on Claude.
+  // Key lanes K1 (plan 5.2): claude-steer stays closed and names a profile-bound job
+  // `profile_session`; the profile's engine then decides (only Lane B Claude steers).
   steer: {
     enabled: () => messagesSteerEnabled(),
-    provider: request => providerOfModel(resolveRunModel(request.model, getSessionModel(request.sessionId), process.env.COS_G2_DEFAULT_MODEL)),
+    provider: request => steerProviderForJob(request),
     cliSupported: () => claudeSupportsSteer(),
   },
 })