@hegemonart/get-design-done 1.59.7 → 1.59.9

package/scripts/lib/session-runner/index.ts

@@ -122,6 +122,21 @@ const adaptiveModeLib = _nodeRequire(
   getMode: (opts?: { baseDir?: string; budgetPath?: string; quiet?: boolean }) => 'static' | 'hedge' | 'full';
 };
 
+// ── Phase 59-9 — model-id normalization + tiering (single source of truth) ───
+//
+// `scripts/lib/model-id.cjs` is the canonical id parser shared with the
+// budget-enforcer. We route BOTH tier-labeling (`tierFromModel`) and pricing
+// (`rateFor`) through it so a new model family is a DATA edit there / in the
+// price tables, never scattered substring logic here. `tierForModelId` returns
+// `null` for an unknown family — callers MUST treat that as "price
+// conservatively + loudly", never as a tier or as free.
+const modelId = _nodeRequire(
+  _resolve(_REPO_ROOT, 'scripts/lib/model-id.cjs'),
+) as {
+  normalizeModelId: (id: string | null | undefined) => { base: string; variant: string | null };
+  tierForModelId: (id: string | null | undefined) => 'opus' | 'sonnet' | 'haiku' | null;
+};
+
 /** Rate-guard provider key for the Anthropic Agent SDK. */
 const RATE_GUARD_PROVIDER = 'anthropic';
 
@@ -144,16 +159,24 @@ const SESSION_RUNNER_DEFAULT_BIN = 'medium';
  *
  * Used at the 4 terminal-emit sites where the final tier isn't already
  * carried on `opts` — we fall back to inspecting `usage.model` (folded
- * during the run loop from SDK chunks). Unknown / empty model names
- * default to 'sonnet' (matches the DEFAULT_MODEL_RATE choice and is
- * the safest middle tier for posterior arms).
+ * during the run loop from SDK chunks). Delegates to the shared
+ * `model-id.cjs` resolver (variant suffix like `[1m]` is stripped, known
+ * ids classified identically to before).
+ *
+ * The shared resolver returns `null` for an UNKNOWN family. For tier
+ * LABELING (telemetry / posterior arms) we map null → 'sonnet' as the
+ * safest middle tier so the bandit arms stay well-defined. This is a
+ * TELEMETRY default only — it does NOT influence PRICING. Pricing of an
+ * unknown family uses the conservative OPUS ceiling, resolved separately in
+ * `rateFor` (see DEFAULT_MODEL_RATE / tier fallback there). Keep the two
+ * concerns distinct: a wrong tier label mis-attributes a posterior arm; a
+ * wrong price under-bills a frontier model.
  */
 function tierFromModel(modelName: string | null | undefined): 'opus' | 'sonnet' | 'haiku' {
-  if (typeof modelName !== 'string' || modelName.length === 0) return 'sonnet';
-  const lower = modelName.toLowerCase();
-  if (lower.includes('opus')) return 'opus';
-  if (lower.includes('haiku')) return 'haiku';
-  return 'sonnet';
+  const tier = modelId.tierForModelId(modelName);
+  // null = unknown family → conservative TELEMETRY default (pricing handled
+  // separately + conservatively in rateFor).
+  return tier ?? 'sonnet';
 }
 
 /**
@@ -539,29 +562,72 @@ function _logPeerCallComplete(args: {
 const RETRY_BACKOFF = { baseMs: 1000, maxMs: 30_000 } as const;
 
 /**
- * Per-million-token USD rates. Unknown models default to the Sonnet
- * rate (safer overestimate — we'd rather cap early than under-bill).
+ * Per-million-token USD rates.
+ *
+ * Canonical price source is `reference/prices/claude.md`; this table mirrors
+ * it for the sync headless path — keep in lockstep.
+ *
+ * Unknown FAMILIES default to the OPUS ceiling (see DEFAULT_MODEL_RATE) — a
+ * conservative overestimate. We'd rather cap early than silently under-bill a
+ * frontier model. Known families fall back to their per-tier representative
+ * rate (PER_TIER_RATE) so a dated/variant sku still prices correctly.
  */
 const MODEL_RATES: Readonly<Record<string, { input: number; output: number }>> = Object.freeze({
+  'claude-opus-4-8': { input: 15, output: 75 },
   'claude-opus-4-7': { input: 15, output: 75 },
   'claude-sonnet-4-5': { input: 3, output: 15 },
   'claude-haiku-4-5': { input: 0.8, output: 4 },
 });
-const DEFAULT_MODEL_RATE = Object.freeze({ input: 3, output: 15 });
 
-/** Resolve a per-M-token rate for a model name, matching prefix when possible. */
+/** Per-tier representative rates (match reference/prices/claude.md). Used as
+ *  the fallback when an exact/prefix MODEL_RATES match is absent but the
+ *  family tier is known. */
+const PER_TIER_RATE: Readonly<Record<'opus' | 'sonnet' | 'haiku', { input: number; output: number }>> =
+  Object.freeze({
+    opus: { input: 15, output: 75 },
+    sonnet: { input: 3, output: 15 },
+    haiku: { input: 1, output: 5 },
+  });
+
+/**
+ * DEFAULT_MODEL_RATE — conservative ceiling for a GENUINELY UNKNOWN family
+ * (tier resolves to null). Set to the OPUS rate, matching this file's own
+ * "safer overestimate" intent. The previous sonnet default UNDER-billed any
+ * frontier model whose id we did not yet recognize.
+ */
+const DEFAULT_MODEL_RATE = Object.freeze({ input: 15, output: 75 });
+
+/**
+ * Resolve a per-M-token rate for a model name.
+ *
+ * Resolution order (conservative + robust):
+ *   1. normalize the id (strip `[1m]`/`[200k]` variant suffix) → work on base;
+ *   2. exact match in MODEL_RATES;
+ *   3. prefix match (e.g. "claude-opus-4-7-20250101" → "claude-opus-4-7");
+ *   4. per-tier fallback via `tierForModelId(base)` (opus/sonnet/haiku → that
+ *      tier's representative rate) — keeps dated/variant skus of a known
+ *      family priced correctly;
+ *   5. ONLY if the tier is null (genuinely unknown family) → DEFAULT_MODEL_RATE
+ *      (opus ceiling — price LOUDLY + CONSERVATIVELY, never $0 or sonnet).
+ */
 function rateFor(modelName: string | null): { input: number; output: number } {
   if (modelName === null || modelName === '') return DEFAULT_MODEL_RATE;
-  // Direct match first.
-  const direct = MODEL_RATES[modelName];
+  const { base } = modelId.normalizeModelId(modelName);
+  if (base === '') return DEFAULT_MODEL_RATE;
+  // (2) Direct match first.
+  const direct = MODEL_RATES[base];
   if (direct !== undefined) return direct;
-  // Prefix match (e.g. "claude-opus-4-7-20250101" → "claude-opus-4-7").
+  // (3) Prefix match.
   for (const key of Object.keys(MODEL_RATES)) {
-    if (modelName.startsWith(key)) {
+    if (base.startsWith(key)) {
       const hit = MODEL_RATES[key];
       if (hit !== undefined) return hit;
     }
   }
+  // (4) Per-tier fallback for a known family.
+  const tier = modelId.tierForModelId(base);
+  if (tier !== null) return PER_TIER_RATE[tier];
+  // (5) Unknown family → conservative opus ceiling.
   return DEFAULT_MODEL_RATE;
 }
 
@@ -1281,3 +1347,8 @@ function buildResult(args: BuildResultArgs): SessionResult {
 // invariant: session-runner consumers can rely on these constants being
 // stable across minor releases.
 export { MODEL_RATES, DEFAULT_MODEL_RATE, RATE_GUARD_PROVIDER };
+
+// Pricing internals exported for regression tests (Phase 59-9 model-cost-truth):
+// verify unknown families resolve to the conservative opus ceiling while known
+// families price correctly via the per-tier fallback.
+export { rateFor, usdCost, tierFromModel, PER_TIER_RATE };

package/scripts/skill-templates/bandit-reset/SKILL.md

@@ -31,6 +31,8 @@ No posterior file found at `.design/telemetry/posterior.json` — nothing to res
 The next bandit pull with `adaptive_mode: full` will bootstrap a fresh posterior from informed priors. See `reference/bandit-integration.md`.
 ```
 
+> Note: the posterior only learns (updates from outcomes) on the SDK / headless `session-runner` path. In interactive Claude Code with `adaptive_mode: full`, the bandit samples from the configured priors but does not currently update them in-session. A reset therefore re-bootstraps the priors the SDK path will subsequently learn from. See `reference/bandit-integration.md` ("Where adaptive routing actually learns").
+
 If present, count the arms (`arms.length`, treating a missing/non-array `arms` as `0`) so the confirmation and receipt can report what will be cleared. A corrupted/unparseable file is still resettable - report `arms: unknown (file unparseable)` and continue.
 
 ### 2. Require explicit confirmation

package/scripts/skill-templates/bandit-status/SKILL.md

@@ -33,10 +33,13 @@ Possible reasons:
 - `adaptive_mode` is `static` or `hedge` (bandit silent — see `.design/budget.json`).
 - No spawns have fired since Phase 27.5 wiring landed.
 - Posterior was cleared via `{{command_prefix}}bandit-reset`.
+- You are running in interactive Claude Code: the posterior is updated (learns) only on the SDK / headless `session-runner` path. In interactive `adaptive_mode: full` the bandit samples from configured priors but does not learn from in-session outcomes.
 
-See `reference/bandit-integration.md` for setup guidance.
+See `reference/bandit-integration.md` ("Where adaptive routing actually learns") for setup guidance.
 ```
 
+> Note: the posterior only moves (learns) on the SDK / headless `session-runner` path. In interactive Claude Code with `adaptive_mode: full`, the bandit samples from the configured priors but does not currently update them in-session. See `reference/bandit-integration.md`.
+
 Skip to Section 4 (Record). Parse failure (truncated/corrupted) → emit `Posterior file exists but is unparseable. Run {{command_prefix}}bandit-reset to start fresh, or restore from a backup.`
 
 ### 2. Parse the posterior

package/scripts/skill-templates/darkmode/SKILL.md

@@ -29,7 +29,7 @@ Output artifact prefix `DARKMODE-AUDIT` is distinct from the pipeline namespace
 
 ## Pre-Flight
 
-Confirm source root exists. Try in order: `src/` (preferred), `app/` (Next.js App Router), `lib/` (libraries), `pages/` (Next.js Pages Router). Set `SRC_ROOT` to the first that exists. If none exist, abort: `"No source directory detected. Run /get-design-done scan first."`
+Confirm source root exists. Try in order: `src/` (preferred), `app/` (Next.js App Router), `lib/` (libraries), `pages/` (Next.js Pages Router). Set `SRC_ROOT` to the first that exists. If none exist, abort: `"No source directory detected. Run /get-design-done explore first."`
 
 Confirm `.design/` exists (create if absent: `mkdir -p .design/`).
 

package/scripts/skill-templates/graphify/SKILL.md

@@ -5,7 +5,7 @@ description: "Manage the Graphify knowledge graph for the current project. Build
 
 # gdd-graphify
 
-Thin command wrapper around the GSD graphify tools integration.
+Thin command wrapper around the get-design-done (GDD) graphify tools integration.
 
 ## Usage
 
@@ -30,10 +30,10 @@ Thin command wrapper around the GSD graphify tools integration.
    ```
    STOP.
 4. Execute the requested subcommand via the native CLI:
-   - build:  `node bin/gdd-graph build`
-   - query:  `node bin/gdd-graph query "<term>" --budget 2000`
-   - status: `node bin/gdd-graph status`
-   - diff:   `node bin/gdd-graph diff`
+   - build:  `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" build`
+   - query:  `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" query "<term>" --budget 2000`
+   - status: `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" status`
+   - diff:   `node "${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph" diff`
 5. After `build` completes, update `.design/STATE.md` `<connections>`: `graphify: available`
 
 ## Required Reading
@@ -43,7 +43,7 @@ Thin command wrapper around the GSD graphify tools integration.
 
 ## Notes
 
-- Graphify is optional. The native CLI ships in this repo at `bin/gdd-graph` (no external install - Node only).
+- Graphify is optional. The native CLI ships with the plugin at `${CLAUDE_PLUGIN_ROOT}/bin/gdd-graph` (no external install - Node only).
 - Graph is stored at `.design/graph/graph.json` (Ajv-validated against `scripts/lib/graph/schema.json`).
 - Graph covers source code (`src/`, `components/`). It does NOT index `.design/` artifacts by default.
 - Use `query` with node IDs from the graph schema: `component:<name>`, `token:color/<name>`, `decision:D-<nn>`, etc.

package/scripts/skill-templates/quick/SKILL.md

@@ -26,10 +26,12 @@ Fast pipeline run. Skips optional-quality agents for speed while keeping the cor
    - Optional stage name (defaults to full pipeline from the current STATE.md position).
    - `--skip <agent-name>` (repeatable) adds to the skip list.
 2. Read `.design/STATE.md` to determine entry stage if none was passed.
-3. For each stage to execute, spawn the stage skill with a `quick_mode: true` flag and the effective skip list in the spawn context. Stage skills read this flag and route around the listed agents.
+3. For each stage to execute, invoke the stage skill but spawn it with the optional agents in the effective skip list **omitted from the spawn graph** - this skill is the orchestrator, so it simply does not call those agents (the stage skills do not read a `quick_mode` flag; the skipping happens here, by not spawning them). The kept agents run exactly as in the full pipeline.
 4. After each stage, print: "Stage <name> done. Skipped: <list>."
 5. Final summary prints which agents were skipped across the full run.
 
+Mechanism note: `{{command_prefix}}quick` is a lighter-touch *invocation* of the normal stages, not a special stage mode. It reduces ceremony by leaving the listed optional-quality agents out of the spawn graph it orchestrates. There is no flag the stage skills parse - if invoked directly (not via this skill) the stages run their full agent set.
+
 ## Use When
 
 - You trust the problem scope (no need for fresh research).

package/scripts/skill-templates/reflect/SKILL.md

@@ -37,7 +37,7 @@ Run `design-reflector` on demand against the current (or specified) cycle. Produ
    See @skills/reflect/procedures/capability-gap-scan.md for the full procedure.
    The `design-reflector` agent runs the scan automatically as part of its reflection pass; this step lets users dry-run it independently with:
    ```
-   node scripts/lib/reflector/capability-gap-scan.cjs --dry-run
+   node "${CLAUDE_PLUGIN_ROOT}/scripts/lib/reflector/capability-gap-scan.cjs" --dry-run
    ```
    The scan emits `capability_gap` events (`source: "reflector_pattern"`) for recurring patterns lacking a dedicated executable owner; Plan 29-03 aggregates these for `{{command_prefix}}apply-reflections`.
 

package/scripts/skill-templates/router/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gdd-router
-description: "Routes a /gdd command to fast|quick|full path + S|M|L|XL complexity_class and returns {path, complexity_class, model_tier_overrides, resolved_models, estimated_cost_usd, cache_hits}. Deterministic - no model call. Invoked once at command entry before any Agent spawn. Read by hooks/budget-enforcer.ts."
+description: "Routes a /gdd command to fast|quick|full path + S|M|L|XL complexity_class and returns {path, complexity_class, model_tier_overrides, resolved_models, estimated_cost_usd, cache_hits}. A SKILL.md prompt the model executes to emit a routing-decision JSON from rule tables (no separate agent spawn). Optional/advisory - invoked only by the skills that opt into routing; the budget-enforcer hook tolerates its absence. Read by hooks/budget-enforcer.ts."
 argument-hint: "<intent-string> [<target-artifacts-csv>]"
 tools: Read, Bash, Grep
 ---
@@ -69,7 +69,9 @@ Delegate to `skills/cache-manager/SKILL.md` (Plan 10.1-02). The router lists can
 
 ## Integration Point
 
-Every `{{command_prefix}}*` SKILL.md's first substantive step is: spawn the router via `Task` or inline invocation; receive the JSON blob; pass it to downstream agents as context so the budget-enforcer hook has the router decision available in tool_input metadata when the first Agent spawn fires.
+The router is **optional and advisory**, not a universal first step. Only the handful of skills that explicitly opt into routing reference it (today: the root pipeline `SKILL.md` / `{{command_prefix}}handoff`, and `{{command_prefix}}style` documents that it deliberately does *not* invoke the router because it is a leaf invocation). The pipeline stage skills (explore / plan / design / verify) do **not** spawn the router. When a skill does invoke it, the flow is: invoke the router via `Task` or inline invocation; receive the JSON blob; pass it to downstream agents as context so the budget-enforcer hook has the router decision available in tool_input metadata when the first Agent spawn fires.
+
+When no skill supplies a router decision, the budget-enforcer hook reads `tool_input.context.router_decision` as absent and falls back to its legacy back-compat path - the router's absence is tolerated by design, never an error.
 
 ## Failure Modes
 

package/sdk/cli/index.js

@@ -82,44 +82,69 @@ var init_emitter = __esm({
 
 // sdk/event-stream/writer.ts
 function _findRepoRoot() {
-  let dir = process.cwd();
-  for (let i = 0; i < 8; i++) {
+  return _walkToPackageJson(process.cwd());
+}
+function _walkToPackageJson(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < 12; i++) {
     if ((0, import_node_fs.existsSync)((0, import_node_path.join)(dir, "package.json"))) return dir;
     const parent = (0, import_node_path.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return process.cwd();
+  return startDir;
 }
-var import_node_fs, import_node_path, import_node_module, _redact, redact, DEFAULT_EVENTS_PATH, DEFAULT_MAX_LINE_BYTES, EventWriter;
+function _warnRedactUnavailable() {
+  if (_redactWarned) return;
+  _redactWarned = true;
+  try {
+    process.stderr.write(
+      "[event-stream] WARNING: scripts/lib/redact.cjs could not be loaded \u2014 failing CLOSED: event payloads are dropped (envelope-only) to avoid writing unscrubbed secrets. Run the event writer from inside the plugin tree or set the redact lib on PATH to restore full payloads.\n"
+    );
+  } catch {
+  }
+}
+function _loadRedact() {
+  const candidates = [];
+  const entry = process.argv[1];
+  if (typeof entry === "string" && entry.length > 0) {
+    const entryAbs = (0, import_node_path.isAbsolute)(entry) ? entry : (0, import_node_path.resolve)(entry);
+    const entryRoot = _walkToPackageJson((0, import_node_path.dirname)(entryAbs));
+    candidates.push((0, import_node_path.resolve)(entryRoot, "scripts/lib/redact.cjs"));
+  }
+  const repoRoot = _findRepoRoot();
+  candidates.push((0, import_node_path.resolve)(repoRoot, "scripts/lib/redact.cjs"));
+  candidates.push((0, import_node_path.resolve)(repoRoot, "..", "..", "scripts/lib/redact.cjs"));
+  for (const candidate of candidates) {
+    try {
+      if (!(0, import_node_fs.existsSync)(candidate)) continue;
+      const req = (0, import_node_module.createRequire)(candidate);
+      const mod = req(candidate);
+      if (mod && typeof mod.redact === "function") return mod.redact;
+    } catch {
+    }
+  }
+  return null;
+}
+var import_node_fs, import_node_path, import_node_module, _redactWarned, _realRedact, redact, DEFAULT_EVENTS_PATH, DEFAULT_MAX_LINE_BYTES, EventWriter;
 var init_writer = __esm({
   "sdk/event-stream/writer.ts"() {
     "use strict";
     import_node_fs = require("node:fs");
     import_node_path = require("node:path");
     import_node_module = require("node:module");
-    try {
-      const _root = _findRepoRoot();
-      const _candidate = (0, import_node_path.resolve)(_root, "scripts/lib/redact.cjs");
-      if ((0, import_node_fs.existsSync)(_candidate)) {
-        const _redactRequire = (0, import_node_module.createRequire)((0, import_node_path.join)(_root, "package.json"));
-        const _mod = _redactRequire(_candidate);
-        _redact = _mod.redact;
-      } else {
-        const _altRoot = (0, import_node_path.resolve)(_root, "..", "..");
-        const _altCandidate = (0, import_node_path.resolve)(_altRoot, "scripts/lib/redact.cjs");
-        if ((0, import_node_fs.existsSync)(_altCandidate)) {
-          const _altRequire = (0, import_node_module.createRequire)((0, import_node_path.join)(_altRoot, "package.json"));
-          const _altMod = _altRequire(_altCandidate);
-          _redact = _altMod.redact;
-        } else {
-          _redact = (v) => v;
-        }
+    _redactWarned = false;
+    _realRedact = _loadRedact();
+    redact = _realRedact !== null ? _realRedact : (v) => {
+      _warnRedactUnavailable();
+      if (v !== null && typeof v === "object") {
+        const ev = v;
+        const out = { ...ev };
+        out["payload"] = { _redaction_unavailable: true };
+        return out;
       }
-    } catch {
-      _redact = (v) => v;
-    }
-    redact = _redact;
+      return { _redaction_unavailable: true };
+    };
     DEFAULT_EVENTS_PATH = ".design/telemetry/events.jsonl";
     DEFAULT_MAX_LINE_BYTES = 64 * 1024;
     EventWriter = class {
@@ -2435,6 +2460,7 @@ function getLogger() {
 // sdk/state/index.ts
 var import_node_fs5 = require("node:fs");
 var import_node_path4 = require("node:path");
+var import_node_module2 = require("node:module");
 
 // sdk/state/lockfile.ts
 var import_node_fs4 = require("node:fs");
@@ -2501,6 +2527,14 @@ async function acquire(path, opts = {}) {
       }
       const parsed = parseLock(existing);
       if (parsed !== null && isStale(parsed, staleMs)) {
+        const confirm = readLockSafe(lockPath);
+        if (confirm === null) {
+          continue;
+        }
+        if (confirm !== existing) {
+          await sleep(pollMs);
+          continue;
+        }
         try {
           (0, import_node_fs4.unlinkSync)(lockPath);
         } catch (delErr) {
@@ -2559,10 +2593,14 @@ function parseLock(raw) {
   }
 }
 function isStale(payload, staleMs) {
-  if (!isPidAlive(payload.pid, payload.host)) return true;
-  const acquiredAt = Date.parse(payload.acquired_at);
-  if (!Number.isFinite(acquiredAt)) return true;
-  return Date.now() - acquiredAt > staleMs;
+  const pidRecorded = typeof payload.pid === "number" && Number.isInteger(payload.pid) && payload.pid > 0;
+  if (!pidRecorded) {
+    const acquiredAt = Date.parse(payload.acquired_at);
+    if (!Number.isFinite(acquiredAt)) return true;
+    return Date.now() - acquiredAt > staleMs;
+  }
+  if (isPidAlive(payload.pid, payload.host)) return false;
+  return true;
 }
 function isPidAlive(pid, host) {
   if (host !== (0, import_node_os2.hostname)()) {
@@ -3969,6 +4007,8 @@ function gateFor(from, to) {
 }
 
 // sdk/state/index.ts
+var _moduleDir = typeof __dirname !== "undefined" ? __dirname : (0, import_node_path4.dirname)(process.argv[1] || process.cwd());
+var _require = typeof require !== "undefined" ? require : (0, import_node_module2.createRequire)(process.argv[1] || process.cwd());
 function _findPackageRoot(startDir) {
   let dir = (0, import_node_path4.resolve)(startDir);
   let firstWithPkg = null;
@@ -3976,7 +4016,7 @@ function _findPackageRoot(startDir) {
     const pkgPath = (0, import_node_path4.join)(dir, "package.json");
     if ((0, import_node_fs5.existsSync)(pkgPath)) {
       try {
-        const pkg = require(pkgPath);
+        const pkg = _require(pkgPath);
         if (firstWithPkg === null) firstWithPkg = dir;
         if (pkg.name === "@hegemonart/get-design-done") return dir;
       } catch {
@@ -3993,7 +4033,7 @@ var _backendCache = null;
 function _loadBackend() {
   if (_backendCache !== null) return _backendCache === false ? null : _backendCache;
   try {
-    const pkgRoot = _findPackageRoot(__dirname);
+    const pkgRoot = _findPackageRoot(_moduleDir);
     if (pkgRoot === null) {
       _backendCache = false;
       return null;
@@ -4003,7 +4043,7 @@ function _loadBackend() {
       _backendCache = false;
       return null;
     }
-    _backendCache = require(backendPath);
+    _backendCache = _require(backendPath);
     return _backendCache;
   } catch {
     _backendCache = false;
@@ -4128,14 +4168,41 @@ async function transition(path, toStage) {
     throw new TransitionGateFailed(toStage, gateResult.blockers);
   }
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-  const nextState = await mutate(path, (s) => {
-    s.frontmatter.stage = toStage;
-    s.frontmatter.last_checkpoint = nowIso;
-    s.position.stage = toStage;
-    s.timestamps[`${toStage}_started_at`] = nowIso;
-    return s;
-  });
-  return { pass: true, blockers: gateResult.blockers, state: nextState };
+  let lockedFailure = null;
+  let lockedBlockers = gateResult.blockers;
+  try {
+    const nextState = await mutate(path, (s) => {
+      const fromNow = s.position.stage;
+      if (!isStage(fromNow)) {
+        lockedFailure = new TransitionGateFailed(toStage, [
+          `Invalid transition: from="${fromNow}" is not a recognized Stage (changed under lock)`
+        ]);
+        throw lockedFailure;
+      }
+      const gateNow = gateFor(fromNow, toStage);
+      if (gateNow === null) {
+        lockedFailure = new TransitionGateFailed(toStage, [
+          `Invalid transition: ${fromNow} \u2192 ${toStage} (changed under lock)`
+        ]);
+        throw lockedFailure;
+      }
+      const resultNow = gateNow(s);
+      if (!resultNow.pass) {
+        lockedFailure = new TransitionGateFailed(toStage, resultNow.blockers);
+        throw lockedFailure;
+      }
+      lockedBlockers = resultNow.blockers;
+      s.frontmatter.stage = toStage;
+      s.frontmatter.last_checkpoint = nowIso;
+      s.position.stage = toStage;
+      s.timestamps[`${toStage}_started_at`] = nowIso;
+      return s;
+    });
+    return { pass: true, blockers: lockedBlockers, state: nextState };
+  } catch (err) {
+    if (lockedFailure !== null && err === lockedFailure) throw lockedFailure;
+    throw err;
+  }
 }
 
 // scripts/lib/pipeline-runner/state-machine.ts
@@ -4982,7 +5049,7 @@ function collapseBlankLines(text) {
 }
 
 // scripts/lib/session-runner/errors.ts
-var import_node_module2 = require("node:module");
+var import_node_module3 = require("node:module");
 var import_node_fs8 = require("node:fs");
 var import_node_path7 = require("node:path");
 function findRepoRoot() {
@@ -4996,7 +5063,7 @@ function findRepoRoot() {
   return process.cwd();
 }
 var REPO_ROOT = findRepoRoot();
-var nodeRequire = (0, import_node_module2.createRequire)((0, import_node_path7.join)(REPO_ROOT, "package.json"));
+var nodeRequire = (0, import_node_module3.createRequire)((0, import_node_path7.join)(REPO_ROOT, "package.json"));
 var transportClassifier = nodeRequire(
   (0, import_node_path7.resolve)(REPO_ROOT, "sdk/primitives/error-classifier.cjs")
 );
@@ -5348,7 +5415,7 @@ var TranscriptWriter = class {
 };
 
 // scripts/lib/session-runner/index.ts
-var import_node_module3 = require("node:module");
+var import_node_module4 = require("node:module");
 var import_node_fs10 = require("node:fs");
 var import_node_path9 = require("node:path");
 function _findRepoRoot2() {
@@ -5362,7 +5429,7 @@ function _findRepoRoot2() {
   return process.cwd();
 }
 var _REPO_ROOT = _findRepoRoot2();
-var _nodeRequire = (0, import_node_module3.createRequire)((0, import_node_path9.join)(_REPO_ROOT, "package.json"));
+var _nodeRequire = (0, import_node_module4.createRequire)((0, import_node_path9.join)(_REPO_ROOT, "package.json"));
 var jitteredBackoff = _nodeRequire(
   (0, import_node_path9.resolve)(_REPO_ROOT, "sdk/primitives/jittered-backoff.cjs")
 );
@@ -5375,15 +5442,15 @@ var banditIntegration = _nodeRequire(
 var adaptiveModeLib = _nodeRequire(
   (0, import_node_path9.resolve)(_REPO_ROOT, "scripts/lib/adaptive-mode.cjs")
 );
+var modelId = _nodeRequire(
+  (0, import_node_path9.resolve)(_REPO_ROOT, "scripts/lib/model-id.cjs")
+);
 var RATE_GUARD_PROVIDER = "anthropic";
 var DEFAULT_MAX_RETRIES = 2;
 var SESSION_RUNNER_DEFAULT_BIN = "medium";
 function tierFromModel(modelName) {
-  if (typeof modelName !== "string" || modelName.length === 0) return "sonnet";
-  const lower = modelName.toLowerCase();
-  if (lower.includes("opus")) return "opus";
-  if (lower.includes("haiku")) return "haiku";
-  return "sonnet";
+  const tier = modelId.tierForModelId(modelName);
+  return tier ?? "sonnet";
 }
 function _recordBanditOutcome(input) {
   try {
@@ -5592,21 +5659,31 @@ function _logPeerCallComplete(args) {
 }
 var RETRY_BACKOFF = { baseMs: 1e3, maxMs: 3e4 };
 var MODEL_RATES = Object.freeze({
+  "claude-opus-4-8": { input: 15, output: 75 },
   "claude-opus-4-7": { input: 15, output: 75 },
   "claude-sonnet-4-5": { input: 3, output: 15 },
   "claude-haiku-4-5": { input: 0.8, output: 4 }
 });
-var DEFAULT_MODEL_RATE = Object.freeze({ input: 3, output: 15 });
+var PER_TIER_RATE = Object.freeze({
+  opus: { input: 15, output: 75 },
+  sonnet: { input: 3, output: 15 },
+  haiku: { input: 1, output: 5 }
+});
+var DEFAULT_MODEL_RATE = Object.freeze({ input: 15, output: 75 });
 function rateFor(modelName) {
   if (modelName === null || modelName === "") return DEFAULT_MODEL_RATE;
-  const direct = MODEL_RATES[modelName];
+  const { base } = modelId.normalizeModelId(modelName);
+  if (base === "") return DEFAULT_MODEL_RATE;
+  const direct = MODEL_RATES[base];
   if (direct !== void 0) return direct;
   for (const key of Object.keys(MODEL_RATES)) {
-    if (modelName.startsWith(key)) {
+    if (base.startsWith(key)) {
       const hit = MODEL_RATES[key];
       if (hit !== void 0) return hit;
     }
   }
+  const tier = modelId.tierForModelId(base);
+  if (tier !== null) return PER_TIER_RATE[tier];
   return DEFAULT_MODEL_RATE;
 }
 function usdCost(inputTokens, outputTokens, modelName) {
@@ -9731,7 +9808,7 @@ ${BUILD_USAGE}`);
 
 // sdk/cli/commands/dashboard.ts
 var import_node_child_process2 = require("node:child_process");
-var import_node_module4 = require("node:module");
+var import_node_module5 = require("node:module");
 var import_node_http = require("node:http");
 var import_node_fs23 = require("node:fs");
 var import_node_path22 = require("node:path");
@@ -9767,7 +9844,7 @@ function anchorDirs() {
   return out;
 }
 function climbToMarker(startDir) {
-  const req = (0, import_node_module4.createRequire)((0, import_node_path22.join)(startDir, "noop.js"));
+  const req = (0, import_node_module5.createRequire)((0, import_node_path22.join)(startDir, "noop.js"));
   let dir = startDir;
   let firstWithPkg = null;
   for (let i = 0; i < 12; i++) {
@@ -9803,7 +9880,7 @@ function findPackageRoot() {
 }
 function requireFromRoot(relPath) {
   const root = findPackageRoot();
-  const req = (0, import_node_module4.createRequire)((0, import_node_path22.join)(root, "noop.js"));
+  const req = (0, import_node_module5.createRequire)((0, import_node_path22.join)(root, "noop.js"));
   return req((0, import_node_path22.join)(root, relPath));
 }
 function resolveRoot(deps, flags) {