@indigoai-us/hq-cli 5.345.105 → 5.345.107

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [5.345.107] — 2026-10-13
+- Company Outposts: `hq outposts provision --company <slug>`, `hq outposts status --company <slug>` and `hq outposts jobs register` are available (hq-cloud 6.18.66). Only company admins can run them, the price and paying company are shown before anything is created, and nothing is provisioned without `--yes`.
+- Agent processes on one box share one cached Cognito sign-in again instead of each signing in separately (hq-cloud 6.18.66 fix).
+- Add native `hq core hq-task` behind the `core-native-bucket-c` family gate, with its pinned shell rollback assets.
+
+- Remove the six bundled ontology shell fallbacks and pin their 189 shell cases as native differential fixtures.
+
+- On macOS, hq now reads your HQ sign-in from the macOS Keychain copy kept
+  by the desktop app, and uses whichever of the Keychain and
+  `~/.hq/cognito-tokens.json` is newer. The first time, hq says that macOS
+  will ask once for access; choose Always Allow. If you deny it, hq keeps
+  using the file and won't ask again; run `hq auth keychain --retry` to
+  allow it later. Other platforms still use the file only.
+- `hq lanes create --remote-control` now opens a Claude lane through Remote Control using account A for the remote session and a ready daemon pool from account B, C, or D for inference. Remote Control lanes disable `AskUserQuestion` and resume the same Claude session with `hq lanes resume`.
+## [5.345.106] — 2026-10-12
+- Add `hq core pipeline workers` as a native TypeScript worker-table command, with a bundled shell companion controlled by the `core-native-pipeline` flag.
+
+- On Windows, `hq core` converts Git Bash paths for commands that declare path operands. Direct calls use the same path rules as the former script wrappers.
+- `hq logout` now ends your session on the HQ server as well as on this
+  device, so a copied token file stops working. If the server can't be
+  reached, logout still signs you out locally and says the old session will
+  expire on its own.
+
 ## [5.345.105] — 2026-10-12
 - Session-start health no longer files leftover company journals that this
   repair pass did not refresh, including older hooks that only read

package/assets/scaffold/core/scripts/hq-task.mjs

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+// hq-task.mjs — the global task list on an HQ board.
+//
+// Tasks live in `tasks[]` on a board file, not inside a project. Most tasks
+// never belong to a project, and a `prd.json` is the wrong shape for one: it
+// carries branchName, e2eTests, files and dependsOn, none of which mean
+// anything for "renew the registration".
+//
+//   personal/board.json          the owner's own board (default)
+//   companies/<slug>/board.json  a company board (--company <slug>)
+//
+// See core/knowledge/public/hq-core/goals-and-tasks-board.md for the concept.
+//
+// Node rather than python3: HQ's script layer must run on Windows machines
+// where python3 is absent or is a Store-alias stub that fails every call
+// (core/scripts/tests/hooks-no-python.test.sh).
+
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const STATUSES = ["open", "blocked", "done"];
+
+const USAGE = `hq-task — the global task list on an HQ board
+
+Usage:
+  hq-task.sh list   [--company <slug>] [--all] [--goal <objective-id>]
+  hq-task.sh add    [--company <slug>] --title "<short title>"
+                    [--description "<context>"]
+                    [--criteria "<one done-criterion>"]...
+                    [--contact "Name <email>|role"]...
+                    [--goal <objective-id>] [--priority <1-3>]
+  hq-task.sh done   [--company <slug>] --id T-002
+  hq-task.sh block  [--company <slug>] --id T-002 --reason "<what is in the way>"
+  hq-task.sh reopen [--company <slug>] --id T-002
+  hq-task.sh goals  [--company <slug>]
+
+Default board: personal/board.json. With --company: companies/<slug>/board.json.`;
+
+function hqRoot() {
+  if (process.env.HQ_ROOT) return process.env.HQ_ROOT;
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+}
+
+function die(message) {
+  process.stderr.write(`${message}\n`);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  const repeatable = new Set(["criteria", "contact"]);
+  const bare = new Set(["all"]);
+  const flags = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith("--")) die(`Unexpected argument: ${token}\n\n${USAGE}`);
+    const key = token.slice(2);
+    if (bare.has(key)) {
+      flags[key] = true;
+      continue;
+    }
+    const value = argv[i + 1];
+    if (value === undefined || value.startsWith("--")) {
+      die(`Flag --${key} needs a value.\n\n${USAGE}`);
+    }
+    i += 1;
+    if (repeatable.has(key)) (flags[key] ||= []).push(value);
+    else flags[key] = value;
+  }
+  return flags;
+}
+
+// The owner's own scope is the `personal/` overlay at the HQ root, NOT
+// `companies/personal/`. The personal vault's allowlist syncs `personal/`
+// paths, so a board kept there is readable by an agent running under the
+// owner's identity; the reserved company scope is absent from that vault.
+function boardPath(flags) {
+  const root = hqRoot();
+  return flags.company
+    ? path.join(root, "companies", flags.company, "board.json")
+    : path.join(root, "personal", "board.json");
+}
+
+function load(flags) {
+  const file = boardPath(flags);
+  if (!fs.existsSync(file)) die(`No board at ${file}`);
+  const board = JSON.parse(fs.readFileSync(file, "utf8"));
+  board.tasks ||= [];
+  return { file, board };
+}
+
+function save(file, board) {
+  board.updated_at = new Date().toISOString().replace(/\.\d+Z$/, "Z");
+  fs.writeFileSync(file, `${JSON.stringify(board, null, 2)}\n`);
+}
+
+function nextId(tasks) {
+  let highest = 0;
+  for (const task of tasks) {
+    const match = /^T-(\d+)$/.exec(task.id || "");
+    if (match) highest = Math.max(highest, Number(match[1]));
+  }
+  return `T-${String(highest + 1).padStart(3, "0")}`;
+}
+
+// Accept "Name <email>|role" with the email and role both optional.
+function parseContact(raw) {
+  let rest = raw;
+  let role = null;
+  const bar = rest.indexOf("|");
+  if (bar !== -1) {
+    role = rest.slice(bar + 1).trim();
+    rest = rest.slice(0, bar).trim();
+  }
+  let email = null;
+  const angle = /<([^>]+)>/.exec(rest);
+  if (angle) {
+    email = angle[1].trim();
+    rest = rest.slice(0, angle.index).trim();
+  }
+  const contact = { name: rest };
+  if (email) contact.email = email;
+  if (role) contact.role = role;
+  return contact;
+}
+
+const today = () => new Date().toISOString().slice(0, 10);
+
+function findTask(board, id) {
+  const task = board.tasks.find((t) => t.id === id);
+  if (!task) die(`No task ${id} on that board.`);
+  return task;
+}
+
+function goalTitle(board, id) {
+  const objective = (board.objectives || []).find((o) => o.id === id);
+  return objective ? objective.title : null;
+}
+
+const MARK = { open: " ", blocked: "!", done: "x" };
+
+function cmdList(flags) {
+  const { board } = load(flags);
+  let tasks = board.tasks.filter((t) => flags.all || t.status !== "done");
+  if (flags.goal) tasks = tasks.filter((t) => t.objective_id === flags.goal);
+  if (tasks.length === 0) {
+    process.stdout.write("No open tasks.\n");
+    return;
+  }
+  process.stdout.write(
+    `${flags.company || "personal"} — ${flags.all ? "all tasks" : "open tasks"} (${tasks.length})\n\n`,
+  );
+  tasks.sort(
+    (a, b) =>
+      (a.priority ?? 99) - (b.priority ?? 99) ||
+      String(a.id).localeCompare(String(b.id)),
+  );
+  for (const task of tasks) {
+    process.stdout.write(
+      `  [${MARK[task.status] ?? " "}] ${task.id}  ${task.title || ""}\n`,
+    );
+    const goal = task.objective_id && goalTitle(board, task.objective_id);
+    if (goal) process.stdout.write(`         goal: ${goal}\n`);
+    if (task.status === "blocked" && task.blockedReason) {
+      process.stdout.write(`         blocked: ${task.blockedReason}\n`);
+    }
+    for (const contact of task.contacts || []) {
+      const trail = [contact.email, contact.phone].filter(Boolean).join(" · ");
+      process.stdout.write(
+        `         ${contact.name}${trail ? ` — ${trail}` : ""}\n`,
+      );
+    }
+  }
+}
+
+function cmdGoals(flags) {
+  const { board } = load(flags);
+  const objectives = board.objectives || [];
+  if (objectives.length === 0) {
+    process.stdout.write("No goals on that board.\n");
+    return;
+  }
+  for (const objective of objectives) {
+    const open = board.tasks.filter(
+      (t) => t.objective_id === objective.id && t.status !== "done",
+    ).length;
+    process.stdout.write(
+      `${objective.id}  ${objective.title}  (${open} open task${open === 1 ? "" : "s"})\n`,
+    );
+    for (const kr of objective.key_results || []) {
+      process.stdout.write(
+        `    ${kr.title} — ${kr.current ?? 0}/${kr.target} ${kr.unit || ""}\n`,
+      );
+    }
+  }
+}
+
+function cmdAdd(flags) {
+  if (!flags.title) die(`add needs --title.\n\n${USAGE}`);
+  const { file, board } = load(flags);
+  if (flags.goal && !goalTitle(board, flags.goal)) {
+    die(`No goal ${flags.goal} on that board. Run 'hq-task.sh goals' to list them.`);
+  }
+  const task = {
+    id: nextId(board.tasks),
+    title: flags.title,
+    description: flags.description || flags.title,
+    status: "open",
+    priority: flags.priority ? Number(flags.priority) : 2,
+    objective_id: flags.goal || null,
+    criteria: flags.criteria || [`${flags.title} — completed.`],
+    contacts: (flags.contact || []).map(parseContact),
+    createdAt: today(),
+  };
+  board.tasks.push(task);
+  save(file, board);
+  process.stdout.write(`Added ${task.id}: ${task.title}\n`);
+}
+
+function setStatus(flags, status, extra = {}) {
+  const { file, board } = load(flags);
+  if (!flags.id) die(`${status} needs --id.\n\n${USAGE}`);
+  const task = findTask(board, flags.id);
+  task.status = status;
+  if (status === "done") task.closedAt = today();
+  else delete task.closedAt;
+  if (status === "blocked") task.blockedReason = extra.reason || "";
+  else delete task.blockedReason;
+  save(file, board);
+  process.stdout.write(`${task.id} → ${status}: ${task.title}\n`);
+}
+
+const COMMANDS = {
+  list: cmdList,
+  goals: cmdGoals,
+  add: cmdAdd,
+  done: (f) => setStatus(f, "done"),
+  reopen: (f) => setStatus(f, "open"),
+  block: (f) => {
+    if (!f.reason) die(`block needs --reason.\n\n${USAGE}`);
+    setStatus(f, "blocked", { reason: f.reason });
+  },
+};
+
+function main() {
+  const [command, ...rest] = process.argv.slice(2);
+  if (!command || command === "--help" || command === "-h") {
+    process.stdout.write(`${USAGE}\n`);
+    process.exit(command ? 0 : 1);
+  }
+  const handler = COMMANDS[command];
+  if (!handler) die(`Unknown command: ${command}\n\n${USAGE}`);
+  handler(parseArgs(rest));
+}
+
+main();
+
+export { STATUSES };

package/assets/scaffold/core/scripts/hq-task.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# hq-task.sh — add, list, and close tasks on a standing task-bucket project.
+#
+# A task bucket is an ordinary HQ project whose prd.json carries
+# metadata.kind == "task_board". Its user stories are errands rather than
+# software features, so they carry no branch, repo path, or test harness.
+#
+# Usage:
+#   hq-task.sh list   [--company <slug>] [--project <name>] [--all]
+#   hq-task.sh add    [--company <slug>] [--project <name>] \
+#                     --title "<short title>" [--description "<context>"] \
+#                     [--criteria "<one done-criterion>"]... \
+#                     [--priority <n>] [--contact "Name <email>|role"]...
+#   hq-task.sh done   [--company <slug>] [--project <name>] --id US-002
+#   hq-task.sh reopen [--company <slug>] [--project <name>] --id US-002
+#
+# Defaults: --company personal --project life-admin.
+#
+# See core/knowledge/public/hq-core/goals-and-tasks-board.md for the concept.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+export HQ_ROOT
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "hq-task: node is required but was not found on PATH." >&2
+  exit 1
+fi
+
+exec node "$SCRIPT_DIR/hq-task.mjs" "$@"

package/assets/scaffold/core/scripts/pipeline-worker-table.sh

@@ -0,0 +1,285 @@
+#!/bin/sh
+# hq-core: public
+# pipeline-worker-table.sh — the per-worker engine/model table behind
+# /run-project --pipeline.
+#
+# Each worker lane runs on its own engine and model. This script proposes that
+# table from a prd.json and, once the owner has confirmed it, turns it into the
+# launcher exports each lane starts with. It never reads an engine or model
+# default from a settings file (orchestrator.yaml, settings.json, ...): the only
+# seed is each worker's own worker.yaml, and anything that cannot be read off
+# it is left empty and flagged for the owner to answer.
+#
+# Usage:
+#   pipeline-worker-table.sh [--workers-root <dir>]... [--overlay <file>] <prd.json>
+#   pipeline-worker-table.sh [--workers-root <dir>]... [--overlay <file>] --confirmed <table.tsv> <prd.json>
+#
+# PROPOSE MODE (no --confirmed) prints tab-separated lines:
+#
+#   row   <worker> <engine> <model> <effort> <status> <stories> <note>
+#   hint  <worker> <story>  <model>
+#   unclassified <story>
+#
+#   status is `ok` or `needs-answer`. The lane set is the union of every
+#   story's worker sequence: one `row` per distinct worker that appears in any
+#   sequence (architect and qa-tester included), in first-seen order. A `hint`
+#   line is a story's model_hint, shown for the owner; a confirmed table pin wins
+#   over it (see CONFIRMED MODE).
+#
+# WORKER SEQUENCE (story -> workers, the full phase sequence in order), first
+# match wins; pipeline-conductor.sh classify reads the same three sources:
+#   1. --overlay <file> (the run's <state>/overlay.json, or the preflight plan):
+#      {id: {"worker_sequence": [...]}}, {id: [...]}, or
+#      {"ordered_stories": [{"id": .., "worker_sequence": [...]}]}.
+#   2. worker_preference — a string or an array of worker ids, used as given.
+#   3. Fallback, only when both are empty: the keyword table from
+#      .claude/skills/execute-task/SKILL.md step 3, matched case-insensitively
+#      against title + description + labels:
+#        schema_change   (database|migration|schema|prisma|sql)   -> database-dev
+#        ui_component    (component|page|form|button|react|ui)    -> frontend-dev
+#        api_development (endpoint|api|rest|graphql|route|service) -> backend-dev
+#      giving architect, the matched implementers (backend-dev also for a
+#      schema change), then qa-tester.
+#      A story matching none is printed as `unclassified`; no worker is guessed.
+#
+# UNKNOWN WORKERS: a worker with no worker.yaml under the worker roots gets an
+# empty, needs-answer row noted "no worker.yaml", and a line on stderr naming
+# the id, the roots searched and every known id. pipeline-conductor.sh classify
+# refuses such a worker before launch.
+#
+# ENGINE SEED (from worker.yaml `execution:`):
+#   model only        -> engine claude, model = execution.model
+#   codex_model only  -> engine codex,  model = execution.codex_model,
+#                        effort = `--reasoning <x>` from execution.codex_flags
+#   both set          -> ambiguous: engine and model empty, needs-answer, the
+#                        candidates listed in the note column
+#   neither / no file -> engine and model empty, needs-answer
+#   worker.yaml has no grok field, so grok is never seeded; the owner chooses it
+#   in the confirmed table.
+#
+# CONFIRMED MODE: --confirmed <file> holds one lane per line,
+#   <worker> <engine> <model> <effort>   (tabs or spaces; # comments allowed;
+#   effort may be omitted). engine must be claude, codex, or grok and model must
+#   be non-empty, or the script exits 2. Output per lane, using the pins in
+#   core/scripts/workflow-runner.mjs, plus HQ_CONDUCT_ENGINE=<engine> for
+#   every lane (a loop lane runs pipeline phase envelopes on that engine):
+#     claude      -> HQ_WORKFLOW_CLAUDE_PLAN_MODEL, HQ_WORKFLOW_CLAUDE_EXEC_MODEL,
+#                    HQ_WORKFLOW_CLAUDE_EFFORT
+#     codex|grok  -> HQ_WORKFLOW_MODEL, HQ_WORKFLOW_EFFORT
+#   The effort export is omitted when effort is empty (runner default applies).
+#   A story's model_hint never overrides the lane: the lane's table pin wins.
+#   Each hinted story on a confirmed lane gets a `# lane <w> story <id>
+#   (model_hint)` block whose exports are commented out and that says "hint
+#   ignored, table pins <model>". A bare alias (opus, sonnet, haiku, fable) is
+#   never printed as a model.
+#
+# Worker roots: --workers-root (repeatable) or PIPELINE_WORKERS_ROOTS
+# (colon-separated). Default: <hq>/core/workers, <hq>/companies/*/workers,
+# <hq>/personal/workers. A worker is the directory named <id> holding worker.yaml.
+#
+# POSIX sh (dash-clean); JSON work is done by jq.
+
+set -eu
+
+HQ_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+NL='
+'
+TAB="$(printf '\t')"
+
+die() { echo "pipeline-worker-table: $1" >&2; exit "${2:-1}"; }
+
+ROOTS=""
+CONFIRMED=""
+OVERLAY=""
+PRD=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --workers-root) [ $# -ge 2 ] || die "--workers-root needs a dir"; ROOTS="${ROOTS:+$ROOTS$NL}$2"; shift 2 ;;
+    --confirmed) [ $# -ge 2 ] || die "--confirmed needs a file"; CONFIRMED="$2"; shift 2 ;;
+    --overlay) [ $# -ge 2 ] || die "--overlay needs a file"; OVERLAY="$2"; shift 2 ;;
+    -h|--help) sed -n '3,/^# POSIX sh/p' "$0"; exit 0 ;;
+    -*) die "unknown flag: $1" ;;
+    *) [ -z "$PRD" ] || die "only one prd.json"; PRD="$1"; shift ;;
+  esac
+done
+[ -n "$PRD" ] || die "usage: pipeline-worker-table.sh [--workers-root <dir>] [--overlay <file>] [--confirmed <file>] <prd.json>"
+[ -f "$PRD" ] || die "no such prd: $PRD"
+command -v jq >/dev/null 2>&1 || die "jq is required"
+jq -e '.userStories | type == "array"' "$PRD" >/dev/null 2>&1 || die "not a prd (no userStories array): $PRD"
+if [ -n "$OVERLAY" ]; then
+  [ -f "$OVERLAY" ] || die "no such overlay: $OVERLAY"
+  jq -e 'type == "object"' "$OVERLAY" >/dev/null 2>&1 || die "overlay is not a JSON object: $OVERLAY"
+fi
+
+if [ -z "$ROOTS" ]; then
+  if [ -n "${PIPELINE_WORKERS_ROOTS:-}" ]; then
+    ROOTS="$(printf '%s\n' "$PIPELINE_WORKERS_ROOTS" | tr ':' '\n')"
+  else
+    ROOTS="$HQ_ROOT/core/workers"
+    for d in "$HQ_ROOT"/companies/*/workers; do [ -d "$d" ] && ROOTS="$ROOTS$NL$d"; done
+    ROOTS="$ROOTS$NL$HQ_ROOT/personal/workers"
+  fi
+fi
+
+# SEQS: one line per story, "<id><TAB><w1> <w2> ..." (empty worker list when
+# unclassified), in prd order. The one place the sequence is derived.
+SEQS="$(jq -r --slurpfile ov "${OVERLAY:-/dev/null}" '
+  def seq: if type == "array" then [.[] | select(type == "string" and length > 0)]
+           elif type == "string" then [split(",")[] | gsub("^\\s+|\\s+$"; "") | select(length > 0)]
+           elif type == "object" then (.worker_sequence // [] | seq) else [] end;
+  ($ov[0] // {}) as $o
+  | (if ($o.ordered_stories | type) == "array"
+       then [$o.ordered_stories[] | select(type == "object" and (.id | type) == "string") | {key: .id, value: (.worker_sequence // [] | seq)}] | from_entries
+       else ($o | with_entries(.value |= seq)) end) as $m
+  | .userStories[]
+  | . as $s
+  | ([$s.title // "", $s.description // "", (($s.labels // []) | join(" "))] | join(" ") | ascii_downcase) as $t
+  | ($m[$s.id // ""] // []) as $ovs
+  | (($s.worker_preference // []) | seq) as $pref
+  | (if ($ovs | length) > 0 then $ovs
+     elif ($pref | length) > 0 then $pref
+     else
+       ($t | test("\\b(database|migration|schema|prisma|sql)\\b")) as $schema
+       | ($t | test("\\b(component|page|form|button|react|ui)\\b")) as $ui
+       | ($t | test("\\b(endpoint|api|rest|graphql|route|service)\\b")) as $api
+       | if ($schema or $ui or $api) | not then []
+         else ["architect"] + (if $schema then ["database-dev"] else [] end)
+              + (if ($api or $schema) then ["backend-dev"] else [] end)
+              + (if $ui then ["frontend-dev"] else [] end) + ["qa-tester"] end
+     end) as $w
+  | "\($s.id // "")\t\($w | join(" "))"' "$PRD")"
+
+# story_has <story id> <worker> -> 0 when the worker is in that story's sequence
+story_has() {
+  printf '%s\n' "$SEQS" | while IFS="$TAB" read -r sid ws; do
+    [ "$sid" = "$1" ] || continue
+    case " $ws " in *" $2 "*) echo yes ;; esac
+  done | grep -q yes
+}
+
+find_worker_yaml() {
+  printf '%s\n' "$ROOTS" | while IFS= read -r r; do
+    [ -n "$r" ] && [ -d "$r" ] || continue
+    hit="$(find "$r" -type f -name worker.yaml -path "*/$1/worker.yaml" 2>/dev/null | head -n 1)"
+    if [ -n "$hit" ]; then echo "$hit"; break; fi
+  done
+}
+
+known_workers() {
+  printf '%s\n' "$ROOTS" | while IFS= read -r r; do
+    [ -n "$r" ] && [ -d "$r" ] || continue
+    find "$r" -type f -name worker.yaml 2>/dev/null
+  done | while IFS= read -r y; do basename "$(dirname "$y")"; done | sort -u | tr '\n' ' ' | sed 's/ $//'
+}
+
+# exec_field <worker.yaml> <key> -> value of execution.<key>, quotes and
+# trailing comments stripped; empty when absent.
+exec_field() {
+  awk -v key="$2" '
+    /^[^[:space:]#]/ { inexec = ($0 ~ /^execution:[[:space:]]*$/); next }
+    inexec && $0 ~ "^[[:space:]]+" key ":" {
+      v = $0; sub("^[[:space:]]+" key ":[[:space:]]*", "", v)
+      sub(/[[:space:]]+#.*$/, "", v); sub(/[[:space:]]+$/, "", v)
+      gsub(/^["'\'']|["'\'']$/, "", v); print v; exit
+    }' "$1"
+}
+
+N="$(jq '.userStories | length' "$PRD")"
+
+# ---- confirmed mode -------------------------------------------------------
+# sq <value> -> value as one single-quoted shell word (embedded ' escaped), so
+# a hostile model/effort string in the table or prd cannot break out of the
+# export line when it is eval'd or sourced.
+sq() { printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"; }
+
+emit_exports() { # engine model effort [prefix]
+  printf '%sexport HQ_CONDUCT_ENGINE=%s\n' "${4:-}" "$(sq "$1")"
+  case "$1" in
+    claude)
+      printf '%sexport HQ_WORKFLOW_CLAUDE_PLAN_MODEL=%s\n' "${4:-}" "$(sq "$2")"
+      printf '%sexport HQ_WORKFLOW_CLAUDE_EXEC_MODEL=%s\n' "${4:-}" "$(sq "$2")"
+      [ -z "$3" ] || printf '%sexport HQ_WORKFLOW_CLAUDE_EFFORT=%s\n' "${4:-}" "$(sq "$3")" ;;
+    codex|grok)
+      printf '%sexport HQ_WORKFLOW_MODEL=%s\n' "${4:-}" "$(sq "$2")"
+      [ -z "$3" ] || printf '%sexport HQ_WORKFLOW_EFFORT=%s\n' "${4:-}" "$(sq "$3")" ;;
+  esac
+}
+
+is_bare_alias() { case "$1" in opus|sonnet|haiku|fable|Opus|Sonnet|Haiku|Fable) return 0 ;; esac; return 1; }
+
+if [ -n "$CONFIRMED" ]; then
+  [ -f "$CONFIRMED" ] || die "no such confirmed table: $CONFIRMED"
+  while read -r w engine model effort _rest || [ -n "${w:-}" ]; do
+    case "$w" in ''|'#'*|worker) continue ;; esac
+    case "${engine:-}" in claude|codex|grok) ;; *) die "lane $w: engine must be claude, codex, or grok (got '${engine:-}')" 2 ;; esac
+    [ -n "${model:-}" ] || die "lane $w: model is empty — answer it before launch" 2
+    echo "# lane $w ($engine)"
+    emit_exports "$engine" "$model" "${effort:-}"
+    i=0
+    while [ "$i" -lt "$N" ]; do
+      hint="$(jq -r --argjson i "$i" '.userStories[$i].model_hint // ""' "$PRD")"
+      sid="$(jq -r --argjson i "$i" '.userStories[$i].id' "$PRD")"
+      if [ -n "$hint" ] && story_has "$sid" "$w"; then
+        if is_bare_alias "$hint"; then
+          echo "# lane $w story $sid (model_hint) bare alias ignored, table pins $model"
+        else
+          echo "# lane $w story $sid (model_hint) hint ignored, table pins $model"
+          emit_exports "$engine" "$hint" "${effort:-}" "# "
+        fi
+      fi
+      i=$((i + 1))
+    done
+    w=""; engine=""; model=""; effort=""
+  done <"$CONFIRMED"
+  exit 0
+fi
+
+# ---- propose mode ---------------------------------------------------------
+# WORKERS: distinct workers, first-seen order, one per line.
+# STORIES_OF <worker>: the story ids whose sequence holds it, space-joined.
+WORKERS="$(printf '%s\n' "$SEQS" | while IFS="$TAB" read -r sid ws; do
+  for w in $ws; do echo "$w"; done
+done | awk '!seen[$0]++')"
+
+printf '%s\n' "$SEQS" | while IFS="$TAB" read -r sid ws; do
+  [ -n "$ws" ] || printf 'unclassified\t%s\n' "$sid"
+done
+
+stories_of() {
+  printf '%s\n' "$SEQS" | while IFS="$TAB" read -r sid ws; do
+    case " $ws " in *" $1 "*) printf '%s\n' "$sid" ;; esac
+  done | tr '\n' ' ' | sed 's/ $//'
+}
+
+KNOWN=""
+printf '%s\n' "$WORKERS" | while IFS= read -r w; do
+  [ -n "$w" ] || continue
+  engine=""; model=""; effort=""; status="needs-answer"; note=""
+  y="$(find_worker_yaml "$w")"
+  if [ -z "$y" ]; then
+    note="no worker.yaml"
+    [ -n "$KNOWN" ] || KNOWN="$(known_workers)"
+    echo "pipeline-worker-table: unknown worker $w: no worker.yaml under $(printf '%s\n' "$ROOTS" | tr '\n' ' ' | sed 's/ $//'); known: ${KNOWN:-none}" >&2
+  else
+    cm="$(exec_field "$y" model)"; xm="$(exec_field "$y" codex_model)"
+    if [ -n "$cm" ] && [ -n "$xm" ]; then
+      note="ambiguous: claude:$cm codex:$xm"
+    elif [ -n "$cm" ]; then
+      engine=claude; model="$cm"; status=ok
+    elif [ -n "$xm" ]; then
+      engine=codex; model="$xm"; status=ok
+      effort="$(exec_field "$y" codex_flags | sed -n 's/.*--reasoning[= ]\([A-Za-z]*\).*/\1/p')"
+    else
+      note="no execution.model or execution.codex_model"
+    fi
+  fi
+  printf 'row\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$w" "$engine" "$model" "$effort" "$status" "$(stories_of "$w")" "$note"
+done
+
+# hint lines: each hinted story in prd order, one per worker in its sequence
+jq -r '.userStories[] | select((.model_hint // "") != "") | "\(.id)\t\(.model_hint)"' "$PRD" |
+  while IFS="$TAB" read -r sid hint; do
+    ws="$(printf '%s\n' "$SEQS" | while IFS="$TAB" read -r s2 w2; do if [ "$s2" = "$sid" ]; then printf "%s\n" "$w2"; fi; done)"
+    for w in $ws; do printf 'hint\t%s\t%s\t%s\n' "$w" "$sid" "$hint"; done
+  done
+exit 0