@jmanuelcorral/openteam 0.18.0 → 0.19.0

package/dist/cli.js

@@ -47,6 +47,18 @@ import { z as z2 } from "zod";
 
 // src/orchestrator/roles.ts
 import { z } from "zod";
+
+// src/messages/routing.ts
+var routingMessages = {
+  conflictingLegacyModes: "router.localOnly and router.frontierOnly cannot both be true",
+  conflictingRouterModes: (executionMode, legacyMode) => `router.executionMode "${executionMode}" conflicts with legacy router mode "${legacyMode}"`,
+  agentModeBroadensGlobal: (agentMode, routerMode) => `agent execution mode "${agentMode}" cannot broaden global router execution mode "${routerMode}"`,
+  requiredLocalModeConflict: "requiresLocalRuntime=true conflicts with a non-local agent executionMode",
+  privacyModeDeprecated: 'privacyMode is deprecated and ignored; it no longer protects prompt content from frontier egress. Set router.executionMode to "local" to prohibit frontier routing.',
+  unknownCost: "unknown"
+};
+
+// src/orchestrator/roles.ts
 var modelSelectionSchema = z.object({
   providerID: z.string().min(1),
   modelID: z.string().min(1)
@@ -70,8 +82,19 @@ var AgentRoleProfileSchema = z.object({
   requiresLocalRuntime: z.boolean().optional(),
   localRuntimes: z.array(z.string().min(1)).optional(),
   localModels: z.record(z.string().min(1), z.string().min(1)).optional(),
-  localModelClass: z.enum(["thinking", "coder"]).optional()
-}).strict();
+  localModelClass: z.enum(["thinking", "coder"]).optional(),
+  executionMode: z.enum(["local", "frontier", "mixed"]).optional(),
+  model: z.union([modelSelectionSchema, z.literal("auto")]).optional(),
+  fallbacks: z.array(modelSelectionSchema).optional()
+}).strict().superRefine((profile, ctx) => {
+  if (profile.requiresLocalRuntime === true && profile.executionMode !== undefined && profile.executionMode !== "local") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["executionMode"],
+      message: routingMessages.requiredLocalModeConflict
+    });
+  }
+});
 var TEAM_ROLES = {
   architect: {
     roleID: "architect",
@@ -125,8 +148,7 @@ var TEAM_ROLES = {
     minCodeQualityTier: 1,
     needsToolCallingByDefault: false,
     preferredFrontierModels: [],
-    localFirst: true,
-    requiresLocalRuntime: true
+    localFirst: true
   },
   ralph: {
     roleID: "ralph",
@@ -136,8 +158,7 @@ var TEAM_ROLES = {
     minCodeQualityTier: 2,
     needsToolCallingByDefault: true,
     preferredFrontierModels: [],
-    localFirst: true,
-    requiresLocalRuntime: true
+    localFirst: true
   },
   guardian: {
     roleID: "guardian",
@@ -148,7 +169,6 @@ var TEAM_ROLES = {
     needsToolCallingByDefault: false,
     preferredFrontierModels: [],
     localFirst: true,
-    requiresLocalRuntime: true,
     localModelClass: "thinking"
   },
   tester: {
@@ -216,9 +236,112 @@ function synthesiseFallbackProfile(roleID) {
     localFirst: true
   };
 }
+function concreteFrontierPreferences(role) {
+  return role.preferredFrontierModels.filter((model) => model !== "auto");
+}
+function agentExecutionPolicyForRole(role) {
+  const policy = {};
+  if (role.executionMode !== undefined) {
+    policy.executionMode = role.executionMode;
+  } else if (role.requiresLocalRuntime === true) {
+    policy.executionMode = "local";
+  }
+  if (role.model !== undefined) {
+    policy.model = role.model;
+  }
+  if (role.fallbacks !== undefined) {
+    policy.fallbacks = [...role.fallbacks];
+  }
+  if (policy.model === undefined && policy.executionMode === undefined && policy.fallbacks === undefined) {
+    const preferences = concreteFrontierPreferences(role);
+    const primary = preferences[0];
+    if (primary === undefined) {
+      return;
+    }
+    policy.executionMode = "frontier";
+    policy.model = primary;
+    if (preferences.length > 1) {
+      policy.fallbacks = preferences.slice(1);
+    }
+  }
+  return policy;
+}
+
+// src/router/executionPolicy.ts
+class ExecutionPolicyError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ExecutionPolicyError";
+    this.code = code;
+  }
+}
+function legacyExecutionMode(localOnly, frontierOnly) {
+  if (localOnly === true) {
+    return "local";
+  }
+  if (frontierOnly === true) {
+    return "frontier";
+  }
+  return;
+}
+function resolveExecutionModeResult(input) {
+  if (input.legacyLocalOnly === true && input.legacyFrontierOnly === true) {
+    return {
+      ok: false,
+      error: new ExecutionPolicyError("legacy-modes-conflict", routingMessages.conflictingLegacyModes)
+    };
+  }
+  const legacyMode = legacyExecutionMode(input.legacyLocalOnly, input.legacyFrontierOnly);
+  if (input.routerMode !== undefined && legacyMode !== undefined && input.routerMode !== legacyMode) {
+    return {
+      ok: false,
+      error: new ExecutionPolicyError("router-mode-conflict", routingMessages.conflictingRouterModes(input.routerMode, legacyMode))
+    };
+  }
+  const routerMode = input.routerMode ?? legacyMode ?? "mixed";
+  if (input.agentMode !== undefined && routerMode !== "mixed" && input.agentMode !== routerMode) {
+    return {
+      ok: false,
+      error: new ExecutionPolicyError("agent-mode-broadens-global", routingMessages.agentModeBroadensGlobal(input.agentMode, routerMode))
+    };
+  }
+  return { ok: true, mode: input.agentMode ?? routerMode };
+}
+function resolveExecutionMode(input) {
+  const resolution = resolveExecutionModeResult(input);
+  if (!resolution.ok) {
+    throw resolution.error;
+  }
+  return resolution.mode;
+}
+function resolveAgentExecutionPolicyResult(routerMode, override) {
+  const executionModeResolution = resolveExecutionModeResult({
+    agentMode: override?.executionMode,
+    routerMode
+  });
+  if (!executionModeResolution.ok) {
+    return executionModeResolution;
+  }
+  const policy = {
+    executionMode: executionModeResolution.mode,
+    model: override?.model ?? "auto"
+  };
+  if (override?.fallbacks !== undefined) {
+    policy.fallbacks = [...override.fallbacks];
+  }
+  return { ok: true, policy };
+}
+function resolveAgentExecutionPolicy(routerMode, override) {
+  const resolution = resolveAgentExecutionPolicyResult(routerMode, override);
+  if (!resolution.ok) {
+    throw resolution.error;
+  }
+  return resolution.policy;
+}
 
 // src/config/migrations.ts
-var CURRENT_CONFIG_VERSION = 1;
+var CURRENT_CONFIG_VERSION = 2;
 
 class ConfigMigrationError extends Error {
   code;
@@ -230,22 +353,69 @@ class ConfigMigrationError extends Error {
     this.detail = detail;
   }
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function detectConfigDeprecations(raw) {
+  if (!isRecord(raw) || raw.privacyMode === undefined) {
+    return [];
+  }
+  return [
+    {
+      code: "privacy-mode-ignored",
+      path: "privacyMode",
+      message: routingMessages.privacyModeDeprecated
+    }
+  ];
+}
+function migrateRouter(raw, fromLegacyVersion) {
+  if (!isRecord(raw)) {
+    return raw;
+  }
+  const validExecutionMode = raw.executionMode === "local" || raw.executionMode === "frontier" || raw.executionMode === "mixed" ? raw.executionMode : undefined;
+  let executionMode;
+  try {
+    executionMode = resolveExecutionMode({
+      routerMode: validExecutionMode,
+      legacyLocalOnly: typeof raw.localOnly === "boolean" ? raw.localOnly : undefined,
+      legacyFrontierOnly: typeof raw.frontierOnly === "boolean" ? raw.frontierOnly : undefined
+    });
+  } catch (error) {
+    if (!(error instanceof ExecutionPolicyError)) {
+      throw error;
+    }
+    throw new ConfigMigrationError("conflicting-execution-mode", error.message);
+  }
+  const { localOnly: _localOnly, frontierOnly: _frontierOnly, ...router } = raw;
+  if (raw.executionMode !== undefined && validExecutionMode === undefined) {
+    return raw;
+  }
+  if (fromLegacyVersion || raw.localOnly !== undefined || raw.frontierOnly !== undefined) {
+    return { ...router, executionMode };
+  }
+  return raw;
+}
 function migrateConfig(raw) {
-  if (typeof raw !== "object" || raw === null) {
+  if (!isRecord(raw)) {
     return raw;
   }
-  const record = raw;
-  const version = record.configVersion;
-  if (version === undefined) {
-    return { ...record, configVersion: CURRENT_CONFIG_VERSION };
+  const version = raw.configVersion;
+  const sourceVersion = version ?? 1;
+  if (typeof sourceVersion !== "number" || !Number.isInteger(sourceVersion) || sourceVersion < 1) {
+    throw new ConfigMigrationError("unknown-version", String(sourceVersion));
   }
-  if (typeof version !== "number" || !Number.isInteger(version) || version < 1) {
-    throw new ConfigMigrationError("unknown-version", String(version));
+  if (sourceVersion > CURRENT_CONFIG_VERSION) {
+    throw new ConfigMigrationError("unsupported-version", String(sourceVersion));
   }
-  if (version > CURRENT_CONFIG_VERSION) {
-    throw new ConfigMigrationError("unsupported-version", String(version));
+  const migratedRouter = migrateRouter(raw.router, sourceVersion < 2);
+  if (sourceVersion === CURRENT_CONFIG_VERSION && migratedRouter === raw.router) {
+    return raw;
   }
-  return record;
+  return {
+    ...raw,
+    configVersion: CURRENT_CONFIG_VERSION,
+    ...migratedRouter === undefined ? {} : { router: migratedRouter }
+  };
 }
 
 // src/config/schema.ts
@@ -254,6 +424,7 @@ var ModelRefSchema = z2.object({
   modelID: z2.string().min(1)
 }).strict();
 var RouterModeSchema = z2.enum(["economy", "balanced", "quality"]);
+var ExecutionModeSchema = z2.enum(["local", "frontier", "mixed"]);
 var PrivacyModeSchema = z2.enum([
   "forceLocalOnSensitive",
   "consentBeforeFrontier",
@@ -332,7 +503,12 @@ var OrchestratorRolesSchema = z2.record(z2.string().min(1), z2.unknown()).defaul
       });
       continue;
     }
-    const parsed = AgentRoleProfileSchema.safeParse({ ...value, roleID });
+    const base = getRoleProfile(roleID) ?? synthesiseFallbackProfile(roleID);
+    const parsed = AgentRoleProfileSchema.safeParse({
+      ...base,
+      ...value,
+      roleID
+    });
     if (!parsed.success) {
       for (const issue of parsed.error.issues) {
         ctx.addIssue({
@@ -366,17 +542,47 @@ var OrchestratorRolesSchema = z2.record(z2.string().min(1), z2.unknown()).defaul
     if (parsed.data.localModelClass !== undefined) {
       profile.localModelClass = parsed.data.localModelClass;
     }
+    if (parsed.data.executionMode !== undefined) {
+      profile.executionMode = parsed.data.executionMode;
+    }
+    if (parsed.data.model !== undefined) {
+      profile.model = parsed.data.model;
+    }
+    if (parsed.data.fallbacks !== undefined) {
+      profile.fallbacks = parsed.data.fallbacks;
+    }
+    if (profile.requiresLocalRuntime === true && profile.executionMode === undefined) {
+      profile.executionMode = "local";
+    }
+    const concretePreferences = profile.preferredFrontierModels.filter((model) => model !== "auto");
+    if (profile.requiresLocalRuntime !== true && profile.executionMode === undefined && profile.model === undefined && concretePreferences.length > 0) {
+      const primary = concretePreferences[0];
+      if (primary !== undefined) {
+        profile.executionMode = "frontier";
+        profile.model = primary;
+        if (profile.fallbacks === undefined && concretePreferences.length > 1) {
+          profile.fallbacks = concretePreferences.slice(1);
+        }
+      }
+    }
     parsedRoles[roleID] = profile;
   }
   return parsedRoles;
 });
+var AgentExecutionPolicySchema = z2.object({
+  executionMode: ExecutionModeSchema.optional(),
+  model: z2.union([ModelRefSchema, z2.literal("auto")]).optional(),
+  fallbacks: z2.array(ModelRefSchema).optional()
+}).strict();
 var OrchestratorConfigSchema = z2.object({
   roles: OrchestratorRolesSchema,
-  maxRetries: z2.number().int().min(0).optional()
+  primary: AgentExecutionPolicySchema.optional(),
+  maxRetries: z2.number().int().min(0).optional(),
+  maxModelsPerNode: z2.number().int().positive().optional()
 }).strict();
 var defaultFrontierModel = {
-  providerID: "anthropic",
-  modelID: "claude-sonnet-4-5"
+  providerID: "google",
+  modelID: "gemini-3.5-flash"
 };
 var DEFAULT_LOCAL_MAX_CONCURRENCY = 4;
 var LocalRuntimeKindSchema = z2.enum([
@@ -469,26 +675,34 @@ var OpenTeamConfigObjectSchema = z2.object({
   }),
   router: z2.object({
     mode: RouterModeSchema.default("balanced"),
+    executionMode: ExecutionModeSchema.optional(),
     localDefault: ModelRefSchema.nullable().default(null),
     trivialPromptMaxChars: z2.number().int().positive().default(280),
     frontierPromptMinChars: z2.number().int().positive().default(2000),
-    frontierOnly: z2.boolean().default(false),
-    localOnly: z2.boolean().default(false)
+    frontierOnly: z2.boolean().optional(),
+    localOnly: z2.boolean().optional()
   }).strict().superRefine((router, ctx) => {
-    if (router.frontierOnly && router.localOnly) {
+    try {
+      resolveExecutionMode({
+        routerMode: router.executionMode,
+        legacyLocalOnly: router.localOnly,
+        legacyFrontierOnly: router.frontierOnly
+      });
+    } catch (error) {
+      if (!(error instanceof ExecutionPolicyError)) {
+        throw error;
+      }
       ctx.addIssue({
         code: "custom",
-        path: ["localOnly"],
-        message: "router.localOnly and router.frontierOnly cannot both be true"
+        path: error.code === "legacy-modes-conflict" ? ["localOnly"] : ["executionMode"],
+        message: error.message
       });
     }
   }).default({
     mode: "balanced",
     localDefault: null,
     trivialPromptMaxChars: 280,
-    frontierPromptMinChars: 2000,
-    frontierOnly: false,
-    localOnly: false
+    frontierPromptMinChars: 2000
   }),
   local: z2.object({
     runtimes: z2.array(LocalRuntimeSchema).default([]).superRefine((runtimes, ctx) => {
@@ -517,7 +731,7 @@ var OpenTeamConfigObjectSchema = z2.object({
     frontierTokensPerSession: z2.number().int().positive().optional(),
     hardStopOnBudgetExhaustion: z2.boolean().default(false)
   }).strict().default({ hardStopOnBudgetExhaustion: false }),
-  privacyMode: PrivacyModeSchema.default("forceLocalOnSensitive"),
+  privacyMode: PrivacyModeSchema.optional(),
   console: ConsoleConfigSchema,
   storage: StorageConfigSchema,
   memory: MemoryConfigSchema.optional(),
@@ -529,7 +743,48 @@ var OpenTeamConfigObjectSchema = z2.object({
     worktrees: { enabled: false }
   }),
   orchestrator: OrchestratorConfigSchema.optional()
-}).strict();
+}).strict().superRefine((config, ctx) => {
+  let routerMode;
+  try {
+    routerMode = resolveExecutionMode({
+      routerMode: config.router.executionMode,
+      legacyLocalOnly: config.router.localOnly,
+      legacyFrontierOnly: config.router.frontierOnly
+    });
+  } catch (error) {
+    if (!(error instanceof ExecutionPolicyError)) {
+      throw error;
+    }
+    return;
+  }
+  const policies = [
+    {
+      path: ["orchestrator", "primary"],
+      policy: config.orchestrator?.primary
+    },
+    ...Object.entries(config.orchestrator?.roles ?? {}).map(([roleID, role]) => ({
+      path: ["orchestrator", "roles", roleID],
+      policy: agentExecutionPolicyForRole(role)
+    }))
+  ];
+  for (const { path, policy } of policies) {
+    if (policy === undefined) {
+      continue;
+    }
+    try {
+      resolveAgentExecutionPolicy(routerMode, policy);
+    } catch (error) {
+      if (!(error instanceof ExecutionPolicyError)) {
+        throw error;
+      }
+      ctx.addIssue({
+        code: "custom",
+        path: [...path, "executionMode"],
+        message: error.message
+      });
+    }
+  }
+});
 var OpenTeamConfigSchema = OpenTeamConfigObjectSchema;
 function resolveMemorySemantic(config) {
   return config.memory?.semantic ?? MemorySemanticSchema.parse(undefined);
@@ -619,6 +874,7 @@ var DIAGNOSTIC_CODES = [
   "graph-gate-denied",
   "memory-extraction-warning",
   "memory-runtime-warning",
+  "node-budget-exhausted",
   "opencode-server-url",
   "opencode-version-read-failed",
   "privacy-inert",
@@ -641,12 +897,14 @@ function diagnosticDescription(code) {
       return "Semantic memory extraction reported a non-fatal local-runtime warning; no raw conversation content was recorded.";
     case "memory-runtime-warning":
       return "Semantic memory runtime setup reported a non-fatal warning; memory recall may be incomplete.";
+    case "node-budget-exhausted":
+      return "A graph node consumed its entire per-node pass budget without ever reporting a substantive done; the node's iteration stopped at the bound and the role produced no substantive report across its passes. Inspect the role's report artifact; the task likely needs a larger orchestrator.maxRetries or a clearer assignment.";
     case "opencode-server-url":
       return "openteam observed the opencode server URL during plugin initialization.";
     case "opencode-version-read-failed":
       return "openteam could not read the live opencode version; graph gates fail closed when this happens.";
     case "privacy-inert":
-      return "forceLocalOnSensitive is configured but no local runtime is configured, so the setting cannot keep sensitive prompts local.";
+      return routingMessages.privacyModeDeprecated;
     case "soak-evidence-rejected":
       return "Graph soak evidence contained rejected observation lines; cutover gate evidence may be incomplete.";
     case "telemetry-warning":
@@ -673,9 +931,9 @@ var RouteEventSchema = EventBaseSchema.extend({
   routeKind: z4.enum(["local", "frontier", "blocked"]),
   selected: ModelRefSchema,
   rationale: z4.string(),
-  estimatedCostUSD: z4.number().finite().min(0),
-  baselineCostUSD: z4.number().finite().min(0),
-  estimatedSavingsUSD: z4.number().finite(),
+  estimatedCostUSD: z4.number().finite().min(0).nullable(),
+  baselineCostUSD: z4.number().finite().min(0).nullable(),
+  estimatedSavingsUSD: z4.number().finite().nullable(),
   budgetAction: z4.string().min(1),
   tokensIn: z4.number().int().min(0).optional(),
   tokensOut: z4.number().int().min(0).optional(),
@@ -766,7 +1024,9 @@ var DiagnosticCodeSchema = z4.enum(DIAGNOSTIC_CODES);
 var DiagnosticEventSchema = EventBaseSchema.extend({
   type: z4.literal("diagnostic"),
   level: DiagnosticLevelSchema,
-  code: DiagnosticCodeSchema
+  code: DiagnosticCodeSchema,
+  roleID: z4.string().min(1).optional(),
+  passCount: z4.number().int().min(0).optional()
 });
 var OpenTeamEventSchema = z4.discriminatedUnion("type", [
   RouteEventSchema,
@@ -887,9 +1147,9 @@ var CostRecordSchema = z5.object({
   routeKind: z5.enum(["local", "frontier", "blocked"]),
   selected: ModelRefSchema,
   rationale: z5.string(),
-  estimatedCostUSD: z5.number().finite().min(0),
-  baselineCostUSD: z5.number().finite().min(0),
-  estimatedSavingsUSD: z5.number().finite(),
+  estimatedCostUSD: z5.number().finite().min(0).nullable(),
+  baselineCostUSD: z5.number().finite().min(0).nullable(),
+  estimatedSavingsUSD: z5.number().finite().nullable(),
   budgetAction: z5.string().min(1),
   tokensIn: z5.number().int().min(0).optional(),
   tokensOut: z5.number().int().min(0).optional()
@@ -1148,7 +1408,11 @@ var FAILURE_CAUSE_RULES = [
       "bad request",
       /(?<!\d)400(?!\d)/,
       "unprocessable",
-      "malformed"
+      "malformed",
+      "invalid model",
+      "unknown model",
+      "model not found",
+      "model does not exist"
     ],
     "prompt-validation"
   ],
@@ -1594,6 +1858,9 @@ function pushUnique(list, value) {
     list.push(value);
   }
 }
+function addEstimate(current, value) {
+  return current === null || value === null ? null : current + value;
+}
 function applyRoute(session, event) {
   session.routeCount += 1;
   if (event.routeKind === "local") {
@@ -1601,8 +1868,8 @@ function applyRoute(session, event) {
   } else if (event.routeKind === "frontier") {
     session.frontierCount += 1;
   }
-  session.estimatedCostUSD += event.estimatedCostUSD;
-  session.estimatedSavingsUSD += event.estimatedSavingsUSD;
+  session.estimatedCostUSD = addEstimate(session.estimatedCostUSD, event.estimatedCostUSD);
+  session.estimatedSavingsUSD = addEstimate(session.estimatedSavingsUSD, event.estimatedSavingsUSD);
   pushUnique(session.models, `${event.selected.providerID}/${event.selected.modelID}`);
   pushUnique(session.agents, event.agent);
 }
@@ -1668,8 +1935,8 @@ function accumulateTotals(totals, session) {
   totals.routeCount += session.routeCount;
   totals.localCount += session.localCount;
   totals.frontierCount += session.frontierCount;
-  totals.estimatedCostUSD += session.estimatedCostUSD;
-  totals.estimatedSavingsUSD += session.estimatedSavingsUSD;
+  totals.estimatedCostUSD = addEstimate(totals.estimatedCostUSD, session.estimatedCostUSD);
+  totals.estimatedSavingsUSD = addEstimate(totals.estimatedSavingsUSD, session.estimatedSavingsUSD);
   totals.realCostUSD += session.realCostUSD;
   totals.messageCount += session.messageCount;
   totals.tokensIn += session.tokensIn;
@@ -1972,6 +2239,7 @@ var KNOWN_CONFIG_KEYS_BY_PATH = new Map([
     "router",
     [
       "mode",
+      "executionMode",
       "localDefault",
       "trivialPromptMaxChars",
       "frontierPromptMinChars",
@@ -2058,7 +2326,9 @@ var KNOWN_CONFIG_KEYS_BY_PATH = new Map([
     ]
   ],
   ["graph.worktrees", ["enabled"]],
-  ["orchestrator", ["roles", "maxRetries"]]
+  ["orchestrator", ["roles", "primary", "maxRetries", "maxModelsPerNode"]],
+  ["orchestrator.primary", ["executionMode", "model", "fallbacks"]],
+  ["orchestrator.primary.fallbacks[]", MODEL_REF_KEYS]
 ]);
 function isUnrecognizedKeysIssue(issue) {
   return issue.code === "unrecognized_keys" && Array.isArray(issue.keys);
@@ -2164,6 +2434,211 @@ function formatConfigError(error) {
   });
 }
 
+// src/messages/executionSetup.ts
+var executionSetupMessages = {
+  setupIntro: "openteam setup — configure local, frontier, or mixed team execution",
+  runtimeQuestion: "Which local runtimes do you want to enable? (choose 'None' for frontier-only)",
+  runtimeNoneLabel: "None — use frontier models only",
+  runtimeNoneHint: "no local runtime (frontier execution)",
+  executionModeQuestion: "Team execution mode",
+  executionModeChoices: {
+    local: {
+      label: "local — every agent stays on configured local providers",
+      hint: "requires at least one enabled local runtime"
+    },
+    frontier: {
+      label: "frontier — every agent uses frontier providers",
+      hint: "does not require a local runtime"
+    },
+    mixed: {
+      label: "mixed — policies may select local or frontier models",
+      hint: "the global mode is an upper bound; per-agent policies may narrow it"
+    }
+  },
+  frontierOnlyNote: [
+    "No local runtime is enabled, so the team will use frontier providers.",
+    "The selected primary model is written consistently to opencode.json and",
+    ".opencode/agent/openteam.md."
+  ].join(`
+`),
+  frontierOnlyTitle: "Frontier execution",
+  localOnlyNote: (model) => [
+    "Every team agent is restricted to configured local providers.",
+    `The primary coordinator is pinned to ${model}.`,
+    "No frontier provider is required for execution while this mode is active."
+  ].join(`
+`),
+  localOnlyTitle: "Local execution",
+  localRequiredError: "local execution requires an enabled local runtime",
+  mixedPrimaryQuestion: "Primary coordinator model",
+  mixedPrimaryLocal: (model) => `Use local thinking model ${model}`,
+  mixedPrimaryFrontier: "Choose a frontier model",
+  frontierModelQuestion: "Frontier model (type to search; cheapest capable entries first)",
+  primaryPolicySummary: (params) => [
+    `Execution mode: ${params.executionMode}`,
+    `Primary model: ${params.primaryModel}`,
+    `Primary fallbacks: ${params.fallbacks}`,
+    "Worker model policy: auto within the global execution mode"
+  ],
+  noFallbacks: "none",
+  yoloQuestion: "Enable YOLO mode? (opencode auto-approves all permissions)",
+  configuredSummary: (params) => [
+    ...executionSetupMessages.primaryPolicySummary({
+      executionMode: params.executionMode,
+      primaryModel: params.primaryModel,
+      fallbacks: executionSetupMessages.noFallbacks
+    }),
+    `Frontier baseline: ${params.frontierBaseline}`,
+    `Local runtimes: ${params.localRuntimes}`,
+    `YOLO mode: ${params.yolo ? "enabled (auto-approves permissions)" : "disabled"}`,
+    "Web Console: launched separately with 'openteam console' (multi-session, loopback)",
+    `Wrote: ${params.opencodePath}, ${params.configPath}, ${params.agentPath}, ${params.agentDir}/*.md (${params.roleAgentCount} standard subagents), ${params.commandDir}/*.md (${params.commandCount} commands); ensured ${params.gitignorePath}`,
+    "",
+    "Next steps:",
+    params.executionMode === "local" ? "  1. No frontier authentication is required while local execution is active" : "  1. Authenticate the frontier provider: opencode auth login",
+    params.executionMode === "local" ? executionSetupMessages.localRuntimeNextStep : params.executionMode === "mixed" ? executionSetupMessages.mixedNextStep : executionSetupMessages.frontierNextStep,
+    "  3. Press Tab and pick the 'openteam' agent, or type / and pick an /openteam… command"
+  ],
+  configuredTitle: "openteam configured",
+  complete: (paths) => `openteam setup complete: ${paths}`,
+  error: (message) => `setup error: ${message}`,
+  localRuntimeNextStep: "  2. Make sure every configured local runtime is reachable",
+  frontierNextStep: "  2. Open opencode in this repo; openteam will use frontier models",
+  mixedNextStep: "  2. Make sure local runtimes are reachable; unavailable candidates can use configured fallbacks",
+  done: "Done. Open opencode and select the 'openteam' agent.",
+  rolePolicy: {
+    whyTitle: "Configure execution and model selection",
+    why: (count) => `${count} roster role(s) have no explicit execution/model override. Configure a compact policy now, or leave them on the built-in automatic policy.`,
+    modeQuestion: (roleID, agentName) => `Execution mode for "${roleID}" (${agentName})`,
+    modeInheritLabel: "Inherit the team execution mode",
+    modeLocalLabel: "Local only",
+    modeFrontierLabel: "Frontier only",
+    modelQuestion: (roleID) => `Model selection for "${roleID}"`,
+    modelAutoLabel: "Auto — choose the cheapest capable eligible model",
+    modelExactLabel: "Exact provider/model pin",
+    modelExactQuestion: (roleID) => `Exact model for "${roleID}" as provider/model`,
+    modelExactPlaceholder: "provider/model",
+    fallbacksQuestion: (roleID) => `Ordered fallbacks for "${roleID}" (comma-separated provider/model, blank for none)`,
+    fallbacksPlaceholder: "provider/model, provider/model",
+    configured: (roleIDs, path) => `  ✓ execution/model policy: ${roleIDs} → ${path}`,
+    invalidModelRef: (value) => `invalid model "${value}"; expected provider/model`
+  }
+};
+var executionPolicyMessages = {
+  doctorHelp: "  openteam doctor                   Diagnose runtimes, execution policies, and config",
+  agentsHelp: "  openteam agents                   List agents, model identity, and execution policy",
+  section: "Configured execution policies:",
+  globalMode: (mode) => `  execution mode: ${mode}`,
+  line: (policy) => `  ${policy.owner}: mode=${policy.executionMode ?? "inherit"} · model=${policy.model} · fallbacks=${policy.fallbacks.length > 0 ? policy.fallbacks.join(" → ") : "none"}`,
+  retryLimits: (maxRetries, maxModelsPerNode) => `  retry limits: ${maxRetries} retries per model · ${maxModelsPerNode} model(s) per node`,
+  inheritedDefaultUnset: "inherits the opencode.json default (not set); execution follows the configured team and agent policy",
+  inheritedDefault: (subscription) => `inherits default → ${subscription}; execution follows the configured team and agent policy`,
+  unprofiledRoleRouting: "      routing: no explicit override — the role inherits its built-in or fallback policy within the global execution-mode upper bound. Roster prose is not executable configuration.",
+  unprofiledRoleRemedy: "      remedy: run `openteam roles init`, or add executionMode, model, and ordered fallbacks under orchestrator.roles in .opencode/openteam.json.",
+  noLocalMixed: "  ⚠ No local runtime reachable: mixed execution currently has only frontier candidates.",
+  noLocalBlocked: "  ✗ No local runtime reachable: local execution is blocked until a configured runtime is available.",
+  primaryLocalMismatch: (name, providerID) => `    ✗ local execution is configured, but primary agent '${name}' points at provider '${providerID}', which opencode.json does not configure.`,
+  primaryLocalMismatchCause: "      cause: the primary agent artifact and opencode.json no longer agree on the selected provider/model identity.",
+  primaryLocalMismatchConsequence: "      consequence: opencode cannot start the coordinator, so it cannot read the roster or distribute work.",
+  primaryLocalMismatchRemedy: (sourceFile) => `      remedy: re-run \`openteam setup\` to regenerate ${sourceFile} and opencode.json from the same primary policy, then re-run \`openteam doctor\`.`
+};
+var executionPolicyEditorMessages = {
+  title: "Execution and model policy",
+  globalMode: "Global execution mode",
+  primaryModel: "Primary model",
+  primaryFallbacks: "Primary fallbacks",
+  retryLimits: "Retry limits",
+  automatic: "auto",
+  inherit: "inherit",
+  none: "none",
+  retryValue: (maxRetries, maxModelsPerNode) => `${maxRetries} retries per model; ${maxModelsPerNode} model(s) per node`
+};
+var localModeChangeMessages = {
+  localProviderInFrontierDomain: (path, domainPath, providerID, modelID) => `${path}: model "${providerID}/${modelID}" uses provider "${providerID}", which is configured for local dispatch and cannot be selected when ${domainPath} is "frontier". Update this policy or use \`openteam local on\`.`,
+  frontierProviderInLocalDomain: (path, domainPath, providerID, modelID) => `${path}: model "${providerID}/${modelID}" uses provider "${providerID}", which is not a configured local provider and cannot be selected when ${domainPath} is "local". Update this policy or use \`openteam local on\`.`
+};
+
+// src/config/executionPolicyDomains.ts
+function compareRoleIDs([left], [right]) {
+  return left === right ? 0 : left < right ? -1 : 1;
+}
+function policyModelReferences(policy, path) {
+  const references = [];
+  if (policy?.model !== undefined && policy.model !== "auto") {
+    references.push({ path: `${path}.model`, model: policy.model });
+  }
+  for (const [index, fallback] of (policy?.fallbacks ?? []).entries()) {
+    references.push({
+      path: `${path}.fallbacks.${index}`,
+      model: fallback
+    });
+  }
+  return references;
+}
+function configuredPolicies(config) {
+  const policies = [
+    {
+      path: "orchestrator.primary",
+      policy: config.orchestrator?.primary
+    }
+  ];
+  const roles = Object.entries(config.orchestrator?.roles ?? {}).sort(compareRoleIDs);
+  for (const [roleID, role] of roles) {
+    policies.push({
+      path: `orchestrator.roles.${roleID}`,
+      policy: agentExecutionPolicyForRole(role)
+    });
+  }
+  return policies;
+}
+function effectiveConfigModelDomainViolations(config) {
+  const routerMode = resolveExecutionMode({
+    routerMode: config.router.executionMode,
+    legacyLocalOnly: config.router.localOnly,
+    legacyFrontierOnly: config.router.frontierOnly
+  });
+  const localProviderIDs = new Set(config.local.runtimes.map((runtime) => runtime.defaultModel.providerID));
+  const violations = [];
+  for (const { path, policy } of configuredPolicies(config)) {
+    if (policy === undefined) {
+      continue;
+    }
+    const executionMode = resolveAgentExecutionPolicy(routerMode, policy).executionMode;
+    if (executionMode === "mixed") {
+      continue;
+    }
+    const domainPath = policy.executionMode === undefined ? "router.executionMode" : `${path}.executionMode`;
+    for (const reference of policyModelReferences(policy, path)) {
+      const isLocalProvider = localProviderIDs.has(reference.model.providerID);
+      if (executionMode === "local" && !isLocalProvider || executionMode === "frontier" && isLocalProvider) {
+        violations.push({
+          path: reference.path,
+          domainPath,
+          model: reference.model,
+          executionMode
+        });
+      }
+    }
+  }
+  return violations;
+}
+
+class EffectiveConfigModelDomainError extends Error {
+  violations;
+  constructor(violations) {
+    super(violations.map((violation) => violation.executionMode === "frontier" ? localModeChangeMessages.localProviderInFrontierDomain(violation.path, violation.domainPath, violation.model.providerID, violation.model.modelID) : localModeChangeMessages.frontierProviderInLocalDomain(violation.path, violation.domainPath, violation.model.providerID, violation.model.modelID)).join(`
+`));
+    this.name = "EffectiveConfigModelDomainError";
+    this.violations = [...violations];
+  }
+}
+function assertEffectiveConfigModelDomains(config) {
+  const violations = effectiveConfigModelDomainViolations(config);
+  if (violations.length > 0) {
+    throw new EffectiveConfigModelDomainError(violations);
+  }
+}
+
 // src/config/load.ts
 function loadOpenTeamConfig(raw) {
   return OpenTeamConfigSchema.parse(migrateConfig(raw ?? {}));
@@ -2184,9 +2659,76 @@ async function readOpenTeamConfigFile(path = ".opencode/openteam.json", storage
 // src/config/persist.ts
 var DEFAULT_CONFIG_PATH = ".opencode/openteam.json";
 var DEFAULT_LOCAL_OVERLAY_PATH = ".opencode/openteam-local/config.local.json";
+var ROLE_OVERRIDE_KEYS = [
+  "opencodeAgent",
+  "defaultTier",
+  "minReasoningTier",
+  "minCodeQualityTier",
+  "needsToolCallingByDefault",
+  "preferredFrontierModels",
+  "localFirst",
+  "requiresLocalRuntime",
+  "localRuntimes",
+  "localModels",
+  "localModelClass",
+  "executionMode",
+  "model",
+  "fallbacks"
+];
+function sameConfigValue(left, right) {
+  return left === right || JSON.stringify(left) === JSON.stringify(right);
+}
+function compactRoleOverride(roleID, role) {
+  const base = getRoleProfile(roleID) ?? synthesiseFallbackProfile(roleID);
+  const override = {};
+  for (const key of ROLE_OVERRIDE_KEYS) {
+    if (!sameConfigValue(role[key], base[key])) {
+      override[key] = role[key];
+    }
+  }
+  return override;
+}
+function compactRoles(roles) {
+  return Object.fromEntries(Object.entries(roles).sort(([left], [right]) => left.localeCompare(right)).map(([roleID, role]) => [roleID, compactRoleOverride(roleID, role)]));
+}
 function serializeOpenTeamConfig(config) {
   const validated = OpenTeamConfigSchema.parse(config);
-  return `${JSON.stringify(validated, null, 2)}
+  const {
+    privacyMode: _privacyMode,
+    router: validatedRouter,
+    ...withoutLegacyPrivacy
+  } = validated;
+  const {
+    localOnly: _localOnly,
+    frontierOnly: _frontierOnly,
+    mode,
+    trivialPromptMaxChars,
+    frontierPromptMinChars,
+    ...canonicalRouter
+  } = validatedRouter;
+  const executionMode = resolveExecutionMode({
+    routerMode: validatedRouter.executionMode,
+    legacyLocalOnly: validatedRouter.localOnly,
+    legacyFrontierOnly: validatedRouter.frontierOnly
+  });
+  const router = {
+    ...canonicalRouter,
+    ...mode === "balanced" ? {} : { mode },
+    ...trivialPromptMaxChars === 280 ? {} : { trivialPromptMaxChars },
+    ...frontierPromptMinChars === 2000 ? {} : { frontierPromptMinChars },
+    executionMode
+  };
+  const orchestrator = validated.orchestrator === undefined ? undefined : {
+    ...validated.orchestrator,
+    roles: compactRoles(validated.orchestrator.roles)
+  };
+  const canonical = {
+    ...withoutLegacyPrivacy,
+    configVersion: CURRENT_CONFIG_VERSION,
+    router,
+    ...orchestrator === undefined ? {} : { orchestrator }
+  };
+  return `${JSON.stringify(canonical, null, 2)}
 `;
 }
 async function writeOpenTeamConfigFile(config, path = DEFAULT_CONFIG_PATH, storage = createFsStorageProvider(process.cwd())) {
@@ -2323,6 +2865,7 @@ async function loadRuntimeOpenTeamConfig(storage, options, path = DEFAULT_CONFIG
   ].filter((entry) => entry !== undefined);
   const label = mergedSources.length === 0 ? "runtime config" : `runtime config merged from ${mergedSources.join(", ")}`;
   const config = validateConfigInput(label, mergedRaw);
+  const deprecations = detectConfigDeprecations(mergedRaw);
   const source = optionsFound ? "options" : fileFound ? "file" : "default";
   return {
     config,
@@ -2330,6 +2873,7 @@ async function loadRuntimeOpenTeamConfig(storage, options, path = DEFAULT_CONFIG
     fileFound,
     optionsFound,
     overlayFound,
+    deprecations,
     searchedPaths: overlayPath === null ? [path] : [path, overlayPath]
   };
 }
@@ -2449,6 +2993,10 @@ function scrubSecretStrings(value, secrets) {
   };
   return walk(value);
 }
+function withoutDeprecatedPrivacyMode(config) {
+  const { privacyMode: _privacyMode, ...next } = config;
+  return next;
+}
 var DEFAULT_CONFIG_AUDIT_PATH = ".opencode/openteam-local/config-audit.jsonl";
 function editableSurface() {
   return [
@@ -2486,7 +3034,7 @@ function createConfigEditor(ports) {
     editableSurface,
     async read() {
       const resolution = await loadRuntimeOpenTeamConfig(ports.storage, undefined, basePath, overlayPath);
-      const scrubbed = scrubSecretStrings(resolution.config, secretValues());
+      const scrubbed = withoutDeprecatedPrivacyMode(scrubSecretStrings(resolution.config, secretValues()));
       return {
         config: scrubbed,
         reload: {
@@ -2508,6 +3056,7 @@ function createConfigEditor(ports) {
       let submitted;
       try {
         submitted = OpenTeamConfigObjectSchema.parse(submittedRaw);
+        assertEffectiveConfigModelDomains(submitted);
       } catch (error) {
         return {
           status: 400,
@@ -2573,7 +3122,6 @@ var RESTART_REQUIRED_KEYS = [
   "baseline",
   "router",
   "local",
-  "privacyMode",
   "graph",
   "orchestrator",
   "memory",
@@ -2581,6 +3129,110 @@ var RESTART_REQUIRED_KEYS = [
   "console.port"
 ];
 
+// src/messages/commands.ts
+var clearCacheMessages = {
+  header: "openteam clear-cache — frozen plugin cache entries:",
+  columns: {
+    specDir: "spec dir",
+    pinned: "spec-pinned",
+    installed: "installed",
+    mtime: "mtime"
+  },
+  reparseSkipSuffix: "  [SKIP — reparse point]",
+  deletedLabel: "deleted.",
+  lockedLabel: (message) => `[LOCKED] ${message}`,
+  pathOutsideWarning: (specDir, absolutePath) => `  ⚠ ${specDir}: path outside cacheRoot (${absolutePath}), skipped.`,
+  processed: (count) => `${count} entry(ies) processed.`,
+  found: (count) => `${count} entry(ies) found. Use --delete to remove them.`
+};
+var baselineMessages = {
+  effectiveAuto: "cheapest-capable (auto)",
+  pinnedSuffix: (ref) => `${ref} (pinned)`,
+  summary: (params) => [
+    "openteam baseline:",
+    `  mode:      ${params.mode}`,
+    `  pinned:    ${params.pinned}`,
+    `  hardDefault: ${params.hardDefault}`,
+    `  effective: ${params.effective}`
+  ],
+  invalidModel: (input) => `Invalid model "${input}". Use the provider/model format, e.g. anthropic/claude-sonnet-4-5.`,
+  pinnedTo: (ref) => `Baseline pinned to ${ref} (pinned mode).`,
+  autoMode: "Baseline set to auto mode (cheapest-capable)."
+};
+var localMessages = {
+  help: {
+    status: "  openteam local status             Show the execution mode (local / frontier / mixed)",
+    off: "  openteam local off                Use frontier models only",
+    only: "  openteam local only               Use local models only",
+    on: "  openteam local on                 Enable mixed local/frontier execution"
+  },
+  noRuntimes: "none",
+  modeFrontier: "frontier",
+  modeLocal: "local",
+  modeMixed: "mixed",
+  summary: (params) => [
+    "openteam local:",
+    `  execution mode: ${params.mode}`,
+    `  local runtimes: ${params.runtimes}`
+  ],
+  frontierOnlyNoChange: "No change: execution mode is already frontier.",
+  frontierOnlyEnabled: "Frontier execution enabled.",
+  localOnlyNoRuntimes: "Cannot enable local execution: no enabled local runtime is configured. Run 'openteam setup' or enable a local runtime in .opencode/openteam.json first.",
+  localOnlyNoChange: "No change: execution mode is already local.",
+  localOnlyEnabled: "Local execution enabled.",
+  localFirstNoChange: "No change: execution mode is already mixed.",
+  localFirstReEnabled: "Mixed local/frontier execution enabled. Make sure each configured provider is reachable.",
+  unknownSubcommand: (subcommand, help) => `Unknown local subcommand: ${subcommand}
+
+${help}`
+};
+var yoloMessages = {
+  updated: (path, status, agentNote) => `${path} updated. ${status}${agentNote}
+Restart opencode (or reload) so agents pick up the new permissions.`
+};
+var frontierCatalogMessages = {
+  free: "free",
+  costPerMillion: (inputUSD, outputUSD) => `$${inputUSD}/$${outputUSD} per 1M`
+};
+var migrateMessages = {
+  header: "openteam migrate:",
+  nothingToMigrate: "  nothing to migrate — the P15b layout is already in place.",
+  counts: (params) => [
+    `  moved:     ${params.moved} file(s)`,
+    `  deduped:   ${params.deduped} file(s) (destination already identical)`,
+    `  conflicts: ${params.conflicts} file(s)`
+  ],
+  relocatedHeader: "  relocated:",
+  relocatedEntry: (from, to, deduped) => `    · ${from} → ${to}${deduped ? " (deduped)" : ""}`,
+  conflictsHeader: "  ⚠ left in place (destination exists with different content — no data lost):",
+  conflictEntry: (from, to) => `    · ${from} → ${to}`,
+  manualWorktreesHeader: "  ⚠ legacy git worktree(s) need a manual move (run `git worktree move`):",
+  manualWorktreeEntry: (label, from, to) => `    · ${label}: ${from} → ${to}`,
+  success: "  ✓ machine-local runtime output relocated under .opencode/openteam-local/."
+};
+var rolesInitMessages = {
+  help: "  openteam roles init               Compose per-role execution, model, and fallback policy",
+  header: "openteam roles init:",
+  title: "openteam roles init",
+  noRoster: (path) => `  ✗ no roster at ${path}.`,
+  noRosterRemedy: "    Cast the team first: run `openteam setup`, then ask the orchestrator to register the cast.",
+  unparseableRoster: (path, error) => `  ✗ ${path} is present but unparseable: ${error}`,
+  unparseableRosterRemedy: "    Run `openteam doctor` for the remedy, then re-run this command.",
+  allProfiled: (count) => `  ✓ ${count} roster role(s) checked; no unprofiled roles — every role resolves a routing profile.`,
+  skipLabel: "Skip for now",
+  skipHint: "leaves the role on its built-in or fallback policy; doctor keeps reporting the missing explicit override",
+  runtimeQuestion: (roleID) => `Preferred local runtime(s) for "${roleID}" (in failover order)`,
+  runtimeHint: "machine-local — written to the git-ignored overlay",
+  cancelled: (reason) => `  ✗ cancelled (${reason}); nothing was written.`,
+  invalidResult: (reason) => `  ✗ refusing to write: the resulting config is invalid — ${reason}`,
+  deprecation: (message) => `  ⚠ ${message}`,
+  nothingWritten: (skipped) => `  · skipped ${skipped}; nothing written.`,
+  nothingToWriteOutro: "Nothing to write.",
+  runtimeBinding: (path) => `  ✓ runtime binding: ${path} (git-ignored, machine-local)`,
+  skippedSummary: (roleIDs) => `  · skipped: ${roleIDs} — using built-in or fallback policy; re-run this command to add an explicit override.`,
+  outro: "Role policy updated."
+};
+
 // src/web/graphRoute.ts
 var GRAPH_DISABLED_REMEDIATION = 'Agent tree is off. In .opencode/openteam.json set graph.mode to a value other than "off" and console.graphView.enabled to true, then restart the console.';
 var GRAPH_DISABLED_ENVELOPE = {
@@ -2990,10 +3642,10 @@ function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function usd(value) {
-  return `$${value.toFixed(5)}`;
+  return value === null ? routingMessages.unknownCost : `$${value.toFixed(5)}`;
 }
 function pct(value) {
-  return `${value.toFixed(2)}%`;
+  return value === null ? routingMessages.unknownCost : `${value.toFixed(2)}%`;
 }
 function ms(value) {
   return value >= 1000 ? `${(value / 1000).toFixed(2)}s` : `${Math.round(value)}ms`;
@@ -3689,6 +4341,42 @@ var OVERLAY_PATH = ".opencode/openteam-local/config.local.json";
 function codeList(keys) {
   return keys.map((key) => `<code>${escapeHtml(key)}</code>`).join(", ");
 }
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function modelSelection(value) {
+  if (value === "auto" || value === undefined) {
+    return executionPolicyEditorMessages.automatic;
+  }
+  const selection = record(value);
+  return typeof selection.providerID === "string" && typeof selection.modelID === "string" ? `${selection.providerID}/${selection.modelID}` : executionPolicyEditorMessages.automatic;
+}
+function fallbackSelections(value) {
+  if (!Array.isArray(value) || value.length === 0) {
+    return executionPolicyEditorMessages.none;
+  }
+  return value.map(modelSelection).join(" → ");
+}
+function renderExecutionPolicyOverview(config) {
+  const root = record(config);
+  const router = record(root.router);
+  const orchestrator = record(root.orchestrator);
+  const primary = record(orchestrator.primary);
+  const mode = typeof router.executionMode === "string" ? router.executionMode : router.localOnly === true ? "local" : router.frontierOnly === true ? "frontier" : "mixed";
+  const maxRetries = typeof orchestrator.maxRetries === "number" ? orchestrator.maxRetries : 2;
+  const maxModelsPerNode = typeof orchestrator.maxModelsPerNode === "number" ? orchestrator.maxModelsPerNode : 2;
+  return [
+    '<div class="config-policy">',
+    `<h3>${escapeHtml(executionPolicyEditorMessages.title)}</h3>`,
+    '<dl class="config-policy-list">',
+    `<dt>${escapeHtml(executionPolicyEditorMessages.globalMode)}</dt><dd><code>${escapeHtml(mode)}</code></dd>`,
+    `<dt>${escapeHtml(executionPolicyEditorMessages.primaryModel)}</dt><dd><code>${escapeHtml(modelSelection(primary.model))}</code></dd>`,
+    `<dt>${escapeHtml(executionPolicyEditorMessages.primaryFallbacks)}</dt><dd><code>${escapeHtml(fallbackSelections(primary.fallbacks))}</code></dd>`,
+    `<dt>${escapeHtml(executionPolicyEditorMessages.retryLimits)}</dt><dd>${escapeHtml(executionPolicyEditorMessages.retryValue(maxRetries, maxModelsPerNode))}</dd>`,
+    "</dl>",
+    "</div>"
+  ].join("");
+}
 function renderConfigReloadTable(read) {
   const hot = read.reload.hotReloadable.length > 0 ? codeList(read.reload.hotReloadable) : '<span class="muted">none</span>';
   const restart = read.reload.restartRequired.length > 0 ? codeList(read.reload.restartRequired) : '<span class="muted">none</span>';
@@ -3708,6 +4396,7 @@ function renderConfigEditorForm(read) {
   const secretsNote = read.secrets.length > 0 ? `<p class="config-note config-secrets">Secrets are read from environment variables and are never shown or editable here: ${read.secrets.map((s) => `<code>${escapeHtml(s.key)}</code> (${s.set ? "set" : "not set"})`).join(", ")}.</p>` : "";
   return [
     '<form class="config-form" data-config-form>',
+    renderExecutionPolicyOverview(read.config),
     renderConfigReloadTable(read),
     overlayNote,
     secretsNote,
@@ -3906,6 +4595,9 @@ function emptyTierSummary() {
     hard: { count: 0, estimatedUSD: 0, savingsUSD: 0 }
   };
 }
+function addEstimate2(current, value) {
+  return current === null || value === null ? null : current + value;
+}
 function summarizeCostRecords(records) {
   const report = {
     count: 0,
@@ -3920,30 +4612,33 @@ function summarizeCostRecords(records) {
     tokensOut: 0,
     byTier: emptyTierSummary()
   };
-  for (const record of records) {
+  for (const record2 of records) {
     report.count += 1;
-    if (record.routeKind === "local") {
+    if (record2.routeKind === "local") {
       report.localCount += 1;
-    } else if (record.routeKind === "blocked") {
+    } else if (record2.routeKind === "blocked") {
       report.blockedCount += 1;
     } else {
       report.frontierCount += 1;
     }
-    report.totalEstimatedUSD += record.estimatedCostUSD;
-    report.totalBaselineUSD += record.baselineCostUSD;
-    report.totalSavingsUSD += record.estimatedSavingsUSD;
-    report.tokensIn += record.tokensIn ?? 0;
-    report.tokensOut += record.tokensOut ?? 0;
-    const tier = report.byTier[record.tier];
+    report.totalEstimatedUSD = addEstimate2(report.totalEstimatedUSD, record2.estimatedCostUSD);
+    report.totalBaselineUSD = addEstimate2(report.totalBaselineUSD, record2.baselineCostUSD);
+    report.totalSavingsUSD = addEstimate2(report.totalSavingsUSD, record2.estimatedSavingsUSD);
+    report.tokensIn += record2.tokensIn ?? 0;
+    report.tokensOut += record2.tokensOut ?? 0;
+    const tier = report.byTier[record2.tier];
     tier.count += 1;
-    tier.estimatedUSD += record.estimatedCostUSD;
-    tier.savingsUSD += record.estimatedSavingsUSD;
+    tier.estimatedUSD = addEstimate2(tier.estimatedUSD, record2.estimatedCostUSD);
+    tier.savingsUSD = addEstimate2(tier.savingsUSD, record2.estimatedSavingsUSD);
   }
-  report.savingsPct = report.totalBaselineUSD > 0 ? report.totalSavingsUSD / report.totalBaselineUSD * 100 : 0;
+  report.savingsPct = report.totalBaselineUSD === null || report.totalSavingsUSD === null ? null : report.totalBaselineUSD > 0 ? report.totalSavingsUSD / report.totalBaselineUSD * 100 : 0;
   return report;
 }
 function usd2(value) {
-  return `$${value.toFixed(5)}`;
+  return value === null ? routingMessages.unknownCost : `$${value.toFixed(5)}`;
+}
+function pct2(value) {
+  return value === null ? routingMessages.unknownCost : `${value.toFixed(2)}%`;
 }
 function renderReport(report) {
   if (report.count === 0) {
@@ -3954,7 +4649,7 @@ function renderReport(report) {
     `  decisions:    ${report.count} (local ${report.localCount} · frontier ${report.frontierCount} · blocked ${report.blockedCount})`,
     `  real cost:    ${usd2(report.totalEstimatedUSD)}`,
     `  baseline:     ${usd2(report.totalBaselineUSD)}`,
-    `  savings:      ${usd2(report.totalSavingsUSD)} (${report.savingsPct.toFixed(2)}%)`,
+    `  savings:      ${usd2(report.totalSavingsUSD)} (${pct2(report.savingsPct)})`,
     `  tokens:       in ${report.tokensIn} · out ${report.tokensOut}`,
     "  by tier:"
   ];
@@ -4039,16 +4734,16 @@ var DEFAULT_RECENT_ROUTES = 50;
 var DEFAULT_ACTIVITY_LIMIT = 100;
 var DEFAULT_DECISIONS_LIMIT = 100;
 var DEFAULT_MEETINGS_LIMIT = 50;
-function toRouteView(record) {
+function toRouteView(record2) {
   return {
-    ts: record.ts,
-    tier: record.tier,
-    routeKind: record.routeKind,
-    model: `${record.selected.providerID}/${record.selected.modelID}`,
-    promptHash: record.promptHash,
-    estimatedCostUSD: record.estimatedCostUSD,
-    estimatedSavingsUSD: record.estimatedSavingsUSD,
-    budgetAction: record.budgetAction
+    ts: record2.ts,
+    tier: record2.tier,
+    routeKind: record2.routeKind,
+    model: `${record2.selected.providerID}/${record2.selected.modelID}`,
+    promptHash: record2.promptHash,
+    estimatedCostUSD: record2.estimatedCostUSD,
+    estimatedSavingsUSD: record2.estimatedSavingsUSD,
+    budgetAction: record2.budgetAction
   };
 }
 function isRoute(event) {
@@ -4101,7 +4796,7 @@ function activityFeed(aggregate, limit) {
 function buildSessionTabs(aggregate, costRecords, nowMs, limits, options) {
   return aggregate.sessions.map((summary) => {
     const id = summary.sessionID;
-    const routes = costRecords.filter((record) => record.sessionID === id);
+    const routes = costRecords.filter((record2) => record2.sessionID === id);
     const decisions = aggregate.decisions.filter((decision) => decision.sessionID === id).slice(0, Math.max(0, limits.decisionsLimit));
     const meetings = aggregate.meetings.filter((meeting) => meeting.sessionID === id).slice(0, Math.max(0, limits.meetingsLimit));
     const activity = composeActivity(aggregate.activity.filter((view) => view.sessionID === id), aggregate.decisions.filter((decision) => decision.sessionID === id), aggregate.meetings.filter((meeting) => meeting.sessionID === id), limits.activityLimit);
@@ -4279,9 +4974,9 @@ async function handlePermission(request, response, sessionID, deps) {
     return;
   }
   const body = await readJsonBody2(request, 4096);
-  const record = typeof body === "object" && body !== null ? body : {};
-  const permissionID = record.permissionID;
-  const responseValue = record.response;
+  const record2 = typeof body === "object" && body !== null ? body : {};
+  const permissionID = record2.permissionID;
+  const responseValue = record2.response;
   if (typeof permissionID !== "string" || permissionID.length === 0 || responseValue !== "once" && responseValue !== "always" && responseValue !== "reject") {
     response.writeHead(400, JSON_HEADERS3).end(JSON.stringify({ error: "invalid permission" }));
     return;
@@ -4441,8 +5136,8 @@ async function handleWrite(request, response, op, deps) {
     return;
   }
   const body = await readJsonBody3(request, 8 * 1024 * 1024);
-  const record = typeof body === "object" && body !== null ? body : undefined;
-  const rawPath = record?.path;
+  const record2 = typeof body === "object" && body !== null ? body : undefined;
+  const rawPath = record2?.path;
   if (typeof rawPath !== "string") {
     sendJson(response, 400, { error: "invalid path" });
     return;
@@ -4462,7 +5157,7 @@ async function handleWrite(request, response, op, deps) {
     return;
   }
   if (op === "write" || op === "append") {
-    const content = record?.content;
+    const content = record2?.content;
     if (typeof content !== "string") {
       sendJson(response, 400, { error: "invalid content" });
       return;
@@ -4840,7 +5535,7 @@ function classifyAgent(info, context) {
       name: info.name,
       mode: info.mode,
       kind: "inherited",
-      subscription: "inherits the opencode.json default (not set) · openteam routes local-first per message"
+      subscription: executionPolicyMessages.inheritedDefaultUnset
     };
   }
   const { subscription } = subscriptionLabel(context.defaultModel, context.localProviders);
@@ -4849,7 +5544,7 @@ function classifyAgent(info, context) {
     mode: info.mode,
     kind: "inherited",
     model: context.defaultModel,
-    subscription: `inherits default → ${subscription} · openteam routes local-first per message`
+    subscription: executionPolicyMessages.inheritedDefault(subscription)
   };
 }
 function modeRank(mode) {
@@ -4870,6 +5565,51 @@ function classifyAgents(files, context) {
 function modelText(classification) {
   return classification.model === undefined ? "" : ` (${classification.model.providerID}/${classification.model.modelID})`;
 }
+function asRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+}
+function selectionText(value) {
+  if (value === "auto" || value === undefined) {
+    return "auto";
+  }
+  const ref = asRecord3(value);
+  return typeof ref?.providerID === "string" && typeof ref.modelID === "string" ? `${ref.providerID}/${ref.modelID}` : "auto";
+}
+function fallbackTexts(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.map(selectionText).filter((selection) => selection !== "auto");
+}
+function executionPolicySummaries(config) {
+  const root = config;
+  const router = asRecord3(root.router);
+  const orchestrator = asRecord3(root.orchestrator);
+  const primary = asRecord3(orchestrator?.primary);
+  const roles = asRecord3(orchestrator?.roles);
+  const globalMode = typeof router?.executionMode === "string" ? router.executionMode : router?.localOnly === true ? "local" : router?.frontierOnly === true ? "frontier" : "mixed";
+  const summaries = [
+    {
+      owner: "primary",
+      executionMode: typeof primary?.executionMode === "string" ? primary.executionMode : globalMode,
+      model: selectionText(primary?.model),
+      fallbacks: fallbackTexts(primary?.fallbacks)
+    }
+  ];
+  for (const [roleID, value] of Object.entries(roles ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
+    const policy = asRecord3(value);
+    if (policy === undefined) {
+      continue;
+    }
+    summaries.push({
+      owner: roleID,
+      ...typeof policy.executionMode === "string" ? { executionMode: policy.executionMode } : {},
+      model: selectionText(policy.model),
+      fallbacks: fallbackTexts(policy.fallbacks)
+    });
+  }
+  return summaries;
+}
 function renderAgentList(classifications, context) {
   const lines = ["openteam agents — LLM per agent:", ""];
   if (classifications.length === 0) {
@@ -4896,6 +5636,15 @@ function renderAgentList(classifications, context) {
     lines.push("opencode.json default: (not set)");
   }
   lines.push("Legend: ● primary · ○ subagent · local = no token cost · frontier = uses your subscription.");
+  if (context.executionPolicies !== undefined && context.executionPolicies.length > 0) {
+    lines.push("", executionPolicyMessages.section);
+    for (const policy of context.executionPolicies) {
+      lines.push(executionPolicyMessages.line(policy));
+    }
+    if (context.retryLimits !== undefined) {
+      lines.push(executionPolicyMessages.retryLimits(context.retryLimits.maxRetries, context.retryLimits.maxModelsPerNode));
+    }
+  }
   if (context.opencodeConfigError !== undefined) {
     lines.push("");
     lines.push(`⚠ opencode config parse error: ${context.opencodeConfigError}`);
@@ -4918,22 +5667,22 @@ var KNOWN_FRONTIER_PROVIDER_IDS = new Set([
   "openrouter"
 ]);
 var VIRTUAL_ROUTER_PROVIDER_ID = "openteam-router";
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseOpencodeProviders(opencodeConfig) {
   const result = new Map;
   const provider = opencodeConfig?.provider;
-  if (!isRecord(provider)) {
+  if (!isRecord2(provider)) {
     return result;
   }
   for (const [id, value] of Object.entries(provider)) {
-    if (!isRecord(value)) {
+    if (!isRecord2(value)) {
       result.set(id, {});
       continue;
     }
     const models = value.models;
-    result.set(id, isRecord(models) ? { models: new Set(Object.keys(models)) } : {});
+    result.set(id, isRecord2(models) ? { models: new Set(Object.keys(models)) } : {});
   }
   return result;
 }
@@ -5675,8 +6424,8 @@ function canonical(value) {
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
   }
-  const record = value;
-  const entries = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`);
+  const record2 = value;
+  const entries = Object.keys(record2).sort().map((key) => `${JSON.stringify(key)}:${canonical(record2[key])}`);
   return `{${entries.join(",")}}`;
 }
 function frameDigest(prev, event) {
@@ -5937,7 +6686,7 @@ function createFsGraphJournal(root) {
 
 // src/telemetry/graphProjection.ts
 function projectGraphEvent(event) {
-  const record = {
+  const record2 = {
     v: event.v,
     seq: event.seq,
     runID: event.runID,
@@ -5950,8 +6699,8 @@ function projectGraphEvent(event) {
     ..."specDigest" in event ? { specDigest: event.specDigest } : {},
     ..."artifact" in event ? { artifact: redactedRef(event.artifact) } : {}
   };
-  assertReferenceOnly(record);
-  return record;
+  assertReferenceOnly(record2);
+  return record2;
 }
 
 // src/telemetry/graphRuntimeHealth.ts
@@ -6042,18 +6791,18 @@ function indexTelemetry(telemetry) {
   const lastError = new Map;
   const lastFailure = new Map;
   const lastArtifact = new Map;
-  for (const record of telemetry) {
-    if (record.nodeID === undefined) {
+  for (const record2 of telemetry) {
+    if (record2.nodeID === undefined) {
       continue;
     }
-    if (record.type === "node.failed" && record.errorClass !== undefined) {
-      lastError.set(record.nodeID, record.errorClass);
+    if (record2.type === "node.failed" && record2.errorClass !== undefined) {
+      lastError.set(record2.nodeID, record2.errorClass);
     }
-    if (record.type === "node.failed" && record.failureClass !== undefined) {
-      lastFailure.set(record.nodeID, record.failureClass);
+    if (record2.type === "node.failed" && record2.failureClass !== undefined) {
+      lastFailure.set(record2.nodeID, record2.failureClass);
     }
-    if (record.type === "node.succeeded" && record.artifact !== undefined) {
-      lastArtifact.set(record.nodeID, record.artifact);
+    if (record2.type === "node.succeeded" && record2.artifact !== undefined) {
+      lastArtifact.set(record2.nodeID, record2.artifact);
     }
   }
   return { lastError, lastFailure, lastArtifact };
@@ -6244,8 +6993,8 @@ async function runConsoleServe(deps, options) {
     load: () => Promise.resolve(deps.loadConfig(deps.configPath)),
     configPath: deps.configPath
   });
-  const auditSink = async (record) => {
-    await deps.storage.append(DEFAULT_CONFIG_AUDIT_PATH, `${JSON.stringify(record)}
+  const auditSink = async (record2) => {
+    await deps.storage.append(DEFAULT_CONFIG_AUDIT_PATH, `${JSON.stringify(record2)}
 `);
   };
   const configEditor = createConfigEditor({
@@ -6338,11 +7087,6 @@ async function runConsoleServe(deps, options) {
 // src/cli/graphOperator.ts
 import { join as join8 } from "node:path";
 
-// src/graph/privacyPolicy.ts
-function frontierAllowed(privacyClass, mode) {
-  return !(privacyClass === "sensitive" && mode === "forceLocalOnSensitive");
-}
-
 // src/graph/langgraph/reducer.ts
 function reduceAdapterState(current, update) {
   const route = update.route !== undefined ? update.route : current.route;
@@ -6357,21 +7101,22 @@ function reduceAdapterState(current, update) {
 
 // src/graph/langgraph/adapter.ts
 var GRAPH_END = "__end__";
-function resolveNodeRoute(privacyClass, mode, preferred) {
-  return preferred === "frontier" && !frontierAllowed(privacyClass, mode) ? "local" : preferred;
+function resolveNodeRoute(preferredOrPrivacyClass, _legacyMode, legacyPreferred) {
+  return legacyPreferred ?? preferredOrPrivacyClass;
 }
 var routeNode = (state) => ({
-  route: resolveNodeRoute(state.input.privacyClass, state.input.mode, state.input.preferredRoute),
+  route: resolveNodeRoute(state.input.preferredRoute),
   visited: ["route"]
 });
 var dispatchNode = async (state, deps) => {
-  const route = state.route ?? resolveNodeRoute(state.input.privacyClass, state.input.mode, state.input.preferredRoute);
-  const receipt = await deps.executor.execute({
+  const route = state.route ?? resolveNodeRoute(state.input.preferredRoute);
+  const request = {
     nodeID: state.input.nodeID,
     route,
-    privacyClass: state.input.privacyClass,
-    mode: state.input.mode
-  });
+    ...state.input.privacyClass === undefined ? {} : { privacyClass: state.input.privacyClass },
+    ...state.input.mode === undefined ? {} : { mode: state.input.mode }
+  };
+  const receipt = await deps.executor.execute(request);
   return { receipt, visited: ["dispatch"] };
 };
 function buildAdapterDefinition() {
@@ -6436,7 +7181,7 @@ function selectCheckpointer(location) {
 function resolveGraphEngine(config) {
   return config.graph?.engine ?? "builtin";
 }
-function createLangGraphEffects(nodeExecutor) {
+function createLangGraphEffects(nodeExecutor, defaultRoute = "local") {
   const definition = buildAdapterDefinition();
   return {
     async execute(request) {
@@ -6445,11 +7190,9 @@ function createLangGraphEffects(nodeExecutor) {
       }
       const input = {
         nodeID: request.node.id,
-        privacyClass: "internal",
-        mode: "forceLocalOnSensitive",
-        preferredRoute: "local"
+        preferredRoute: request.routeKind ?? defaultRoute
       };
-      const resolvedRoute = resolveNodeRoute(input.privacyClass, input.mode, input.preferredRoute);
+      const resolvedRoute = resolveNodeRoute(input.preferredRoute);
       let state;
       try {
         state = await invokeStateGraph(definition, input, {
@@ -6642,8 +7385,8 @@ function createWorkspaceLease(root, registry = createRunRegistry(root)) {
     return text === undefined ? undefined : parse2(text);
   };
   const grant = async (runID, holder, token) => {
-    const record = { runID, holder, token, released: false };
-    writeDurable(leasePath(runID), JSON.stringify(record));
+    const record2 = { runID, holder, token, released: false };
+    writeDurable(leasePath(runID), JSON.stringify(record2));
     await registry.markActive(runID);
     return { runID, holder, token };
   };
@@ -7374,19 +8117,19 @@ function createWorktreeAdapter(config) {
     const base = `${canonicalizePath(worktreesDir)}/`;
     return canonicalizePath(worktreePath).startsWith(base);
   };
-  const toInfo = (record) => ({
-    runID: runIDFromPath(record.path),
-    path: record.path,
-    head: record.head,
-    detached: record.detached,
-    locked: record.locked
+  const toInfo = (record2) => ({
+    runID: runIDFromPath(record2.path),
+    path: record2.path,
+    head: record2.head,
+    detached: record2.detached,
+    locked: record2.locked
   });
   const list = async () => {
     const output = await runGit(["worktree", "list", "--porcelain"]);
     if (output.exitCode !== 0) {
       throw new WorktreeError("git-failed", `worktree list: ${output.stderr.trim() || output.exitCode}`);
     }
-    return parsePorcelain(output.stdout).filter((record) => isOurs(record.path)).map(toInfo);
+    return parsePorcelain(output.stdout).filter((record2) => isOurs(record2.path)).map(toInfo);
   };
   const findExisting = async (expected) => (await list()).find((info) => samePath(info.path, expected));
   const addWorktree = async (runID, expected) => runGit([
@@ -7926,7 +8669,7 @@ function buildOrchestratorAgent(model, options = {}) {
   ];
   const frontmatter = [
     "---",
-    'description: "openteam multi-agent orchestrator: on every request it checks whether a team exists; if not, it understands the tasks and creates the team of subagents on demand, plans dependencies, parallelizes independent work and keeps the todo list attributed to the owner of each task, with local-first routing."',
+    'description: "openteam multi-agent orchestrator: on every request it checks whether a team exists; if not, it understands the tasks and creates the team of subagents on demand, plans dependencies, parallelizes independent work and keeps the todo list attributed to the owner of each task, using the configured execution and model policies."',
     "mode: primary",
     `model: ${modelSpec}`,
     "temperature: 0.2",
@@ -8048,10 +8791,9 @@ function buildOrchestratorAgent(model, options = {}) {
     "     global one, so an `ask`/`deny` in the subagent reintroduces the",
     "     prompts. If YOLO is disabled, use minimal permissions (leave `bash`",
     "     in ask mode).",
-    "   - Leave `model` unset so it inherits the default and openteam routes it",
-    "     local-first, or pin a local model for mechanical/bulk roles. Reserve",
-    "     frontier only for architecture, security or ambiguous debugging:",
-    "     openteam already routes cheapest-capable automatically.",
+    "   - Leave `model` unset in the agent file. Configure its execution domain,",
+    "     exact model or `auto`, and ordered fallbacks under `orchestrator.roles`",
+    "     in `.opencode/openteam.json`; the runtime policy is authoritative.",
     "   - A focused, actionable role prompt.",
     "4. Register the cast with the `openteam-register-cast` tool and **hand out",
     "   the tasks** to the newly created team with the `task` tool.",
@@ -8065,22 +8807,20 @@ function buildOrchestratorAgent(model, options = {}) {
     "",
     "- **scribe** — the team's silent memory. Records decisions and",
     "  learnings in a shared log (`.opencode/openteam/decisions.md`) without",
-    "  executing code changes. **Local** model; read-only permissions plus",
-    "  editing of that log. **Parseable format** for the console: one decision",
+    "  executing code changes. Use read-only permissions plus editing of that",
+    "  log. **Parseable format** for the console: one decision",
     "  per line as a Markdown list item, already **redacted** (no prompts or",
-    "  sensitive data):",
+    "  credentials):",
     "  `- YYYY-MM-DD [agent] Short summary of the decision #tag1 #tag2`",
     "  The date, the `[agent]` and the `#tags` are optional; the summary is",
     "  required.",
     "- **ralph** — automation and triage. Monitors pending work",
     "  (issues/tasks), prioritizes it, coordinates execution by delegating to the",
     "  specialists and **escalates to the human** on blockers, risks or approvals.",
-    "- **guardian** — security and privacy. **Detects and masks sensitive",
-    "  data** (PII, secrets, API keys, tokens, credentials) before it",
-    "  leaves the repo or goes to frontier, and does security review. Runs",
-    "  **always locally** and respects `privacyMode`/`forceLocalOnSensitive`: never",
-    "  lets sensitive data through to frontier. Reviews the inputs and outputs of the",
-    "  other agents when they touch sensitive data.",
+    "- **guardian** — an assignable security reviewer. Use it when a task calls",
+    "  for threat analysis, exploitability checks or security-focused review.",
+    "  It is not an invisible pre-dispatch gate and does not inspect or rewrite",
+    "  every other agent's input automatically.",
     "",
     "## Work planning and parallelization",
     "",
@@ -8100,10 +8840,9 @@ function buildOrchestratorAgent(model, options = {}) {
     "4. **Do not parallelize work that collides** on the same files or",
     "   state: those are implicit dependencies; split it into separate waves to",
     "   avoid write conflicts.",
-    "5. Distribute by **capability**: mechanical/bulk roles on local, and reserve",
-    "   frontier for the hard parts; parallelism does not change openteam's routing.",
-    "6. The `guardian` is still the pre-frontier gate **even** in",
-    "   parallel: nothing sensitive leaves without passing through it, even with several waves.",
+    "5. Distribute by **capability** and let each configured execution/model",
+    "   policy select local, frontier or mixed candidates. Parallelism never",
+    "   broadens a role beyond its configured execution domain.",
     "",
     "Briefly explain your plan to the user (what runs in parallel and what in series, and",
     "why) before or while you launch the tasks.",
@@ -8197,8 +8936,8 @@ function buildOrchestratorAgent(model, options = {}) {
     "- Create subagents **exactly when the work calls for it**, never “just in case”.",
     `  Review \`.opencode/agent/\` and the \`${OPENTEAM_ROSTER_FILENAME}\`, and reuse the`,
     "  existing ones before creating a new one.",
-    "- Respect openteam's routing and privacy; the `guardian` is the last",
-    "  line before sending anything sensitive to frontier.",
+    "- Respect openteam's configured execution domains, exact pins and ordered",
+    "  fallback chains. Assign `guardian` explicitly when security review is needed.",
     "- Summarize for the user which universe you chose, which team you created and why.",
     "",
     "## Limits",
@@ -8267,8 +9006,8 @@ function buildOpenteamCommands() {
   return [
     file("openteam", buildOpenteamCommand()),
     file("openteam-baseline", buildBaselineCommand()),
-    file("openteam-doctor", renderCommand("openteam · diagnostics for local runtimes and configuration", fixedActionBody("doctor"))),
-    file("openteam-agents", renderCommand("openteam · list the agents and the LLM (local/frontier + subscription) for each one", fixedActionBody("agents"))),
+    file("openteam-doctor", renderCommand("openteam · diagnostics for runtimes, execution policies, and configuration", fixedActionBody("doctor"))),
+    file("openteam-agents", renderCommand("openteam · list agents, model identity, execution policy, and subscription classification", fixedActionBody("agents"))),
     file("openteam-console", renderCommand("openteam · status and URL of the multi-session web Console", [
       "> ℹ️ The Console interface may still evolve between releases.",
       "",
@@ -8485,7 +9224,7 @@ var CURATED_FRONTIER_PROFILES = [
 ];
 
 // src/capabilities/normalize.ts
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringValue(value) {
@@ -8506,7 +9245,7 @@ function boolValue(value) {
 }
 function nestedRecord(value, key) {
   const nested = value[key];
-  return isRecord2(nested) ? nested : undefined;
+  return isRecord3(nested) ? nested : undefined;
 }
 function nestedBoolean(value, firstKey, secondKey) {
   const nested = nestedRecord(value, firstKey);
@@ -8519,7 +9258,7 @@ function includesImage(value) {
   if (Array.isArray(value)) {
     return value.some(includesImage);
   }
-  if (isRecord2(value)) {
+  if (isRecord3(value)) {
     return Object.values(value).some(includesImage);
   }
   return false;
@@ -8538,7 +9277,7 @@ function tierFromModelName(modelID, reasoning) {
   if (typeof reasoning === "number") {
     return Math.max(0, Math.min(5, Math.trunc(reasoning)));
   }
-  if (reasoning === true || isRecord2(reasoning)) {
+  if (reasoning === true || isRecord3(reasoning)) {
     return normalized.includes("flash") || normalized.includes("mini") ? 3 : 4;
   }
   if (normalized.includes("opus") || normalized.includes("codex")) {
@@ -8568,31 +9307,44 @@ function codeTierFromModelName(modelID) {
 function availability(value) {
   return value === "degraded" || value === "unavailable" ? value : "available";
 }
+function modelAvailability(availabilityValue, status) {
+  if (availabilityValue === "degraded" || status === "deprecated") {
+    return "degraded";
+  }
+  return availability(availabilityValue);
+}
 function modelEntriesFromProvider(providerID, provider) {
   const models = provider.models;
   if (Array.isArray(models)) {
-    return models.filter(isRecord2).map((model) => ({
-      providerID,
+    return models.filter(isRecord3).map((model) => ({
+      providerID: stringValue(model.providerID) ?? providerID,
       modelID: stringValue(model.id) ?? stringValue(model.modelID) ?? "",
       value: model
     })).filter((entry) => entry.modelID.length > 0);
   }
-  if (isRecord2(models)) {
-    return Object.entries(models).filter(([, model]) => isRecord2(model)).map(([modelID, model]) => ({
-      providerID,
-      modelID,
-      value: model
-    }));
+  if (isRecord3(models)) {
+    return Object.entries(models).flatMap(([modelID, model]) => {
+      if (!isRecord3(model)) {
+        return [];
+      }
+      return [
+        {
+          providerID: stringValue(model.providerID) ?? providerID,
+          modelID: stringValue(model.id) ?? stringValue(model.modelID) ?? modelID,
+          value: model
+        }
+      ];
+    });
   }
   return [];
 }
 function catalogEntries(raw) {
-  if (!isRecord2(raw)) {
+  if (!isRecord3(raw)) {
     return [];
   }
-  const providers = isRecord2(raw.providers) ? raw.providers : raw;
+  const providers = isRecord3(raw.providers) ? raw.providers : raw;
   return Object.entries(providers).flatMap(([providerKey, provider]) => {
-    if (!isRecord2(provider)) {
+    if (!isRecord3(provider)) {
       return [];
     }
     const providerID = stringValue(provider.id) ?? stringValue(provider.providerID) ?? providerKey;
@@ -8601,6 +9353,9 @@ function catalogEntries(raw) {
 }
 function normalizeEntry(entry) {
   const limit = nestedRecord(entry.value, "limit");
+  const capabilities = nestedRecord(entry.value, "capabilities");
+  const capabilityName = stringValue(entry.value.name) ?? entry.modelID;
+  const inputCapabilities = capabilities === undefined ? undefined : nestedRecord(capabilities, "input");
   const contextWindow = numberValue(entry.value.contextWindow) ?? numberValue(entry.value.context_window) ?? (limit === undefined ? undefined : numberValue(limit.context));
   const maxOutputTokens = numberValue(entry.value.maxOutputTokens) ?? numberValue(entry.value.max_output_tokens) ?? (limit === undefined ? undefined : numberValue(limit.output));
   const costPer1M = costPair(entry.value);
@@ -8612,12 +9367,12 @@ function normalizeEntry(entry) {
     kind: "frontier",
     contextWindow,
     maxOutputTokens,
-    supportsToolCalling: boolValue(entry.value.tool_call) || boolValue(entry.value.toolCall) || nestedBoolean(entry.value, "features", "tool_call"),
-    supportsVision: boolValue(entry.value.vision) || includesImage(entry.value.modalities) || includesImage(entry.value.input_modalities),
-    reasoningTier: tierFromModelName(entry.modelID, entry.value.reasoning),
-    codeQualityTier: codeTierFromModelName(entry.modelID),
+    supportsToolCalling: boolValue(entry.value.tool_call) || boolValue(entry.value.toolCall) || boolValue(capabilities?.toolcall) || nestedBoolean(entry.value, "features", "tool_call"),
+    supportsVision: boolValue(entry.value.vision) || boolValue(inputCapabilities?.image) || includesImage(entry.value.modalities) || includesImage(entry.value.input_modalities),
+    reasoningTier: tierFromModelName(capabilityName, entry.value.reasoning ?? capabilities?.reasoning),
+    codeQualityTier: codeTierFromModelName(capabilityName),
     costPer1M,
-    availability: availability(entry.value.availability)
+    availability: modelAvailability(entry.value.availability, entry.value.status)
   };
   const parsed = ModelCapabilityProfileSchema.safeParse(profile);
   return parsed.success ? parsed.data : undefined;
@@ -9454,123 +10209,6 @@ function isGateApplicable(mode) {
   return mode === "active";
 }
 
-// src/messages/commands.ts
-var clearCacheMessages = {
-  header: "openteam clear-cache — frozen plugin cache entries:",
-  columns: {
-    specDir: "spec dir",
-    pinned: "spec-pinned",
-    installed: "installed",
-    mtime: "mtime"
-  },
-  reparseSkipSuffix: "  [SKIP — reparse point]",
-  deletedLabel: "deleted.",
-  lockedLabel: (message) => `[LOCKED] ${message}`,
-  pathOutsideWarning: (specDir, absolutePath) => `  ⚠ ${specDir}: path outside cacheRoot (${absolutePath}), skipped.`,
-  processed: (count) => `${count} entry(ies) processed.`,
-  found: (count) => `${count} entry(ies) found. Use --delete to remove them.`
-};
-var baselineMessages = {
-  effectiveAuto: "cheapest-capable (auto)",
-  pinnedSuffix: (ref) => `${ref} (pinned)`,
-  summary: (params) => [
-    "openteam baseline:",
-    `  mode:      ${params.mode}`,
-    `  pinned:    ${params.pinned}`,
-    `  hardDefault: ${params.hardDefault}`,
-    `  effective: ${params.effective}`
-  ],
-  invalidModel: (input) => `Invalid model "${input}". Use the provider/model format, e.g. anthropic/claude-sonnet-4-5.`,
-  pinnedTo: (ref) => `Baseline pinned to ${ref} (pinned mode).`,
-  autoMode: "Baseline set to auto mode (cheapest-capable)."
-};
-var localMessages = {
-  help: {
-    status: "  openteam local status             Show the routing mode (local-first / local-only / frontier-only)",
-    off: "  openteam local off                Use frontier models only (no local runtime)",
-    only: "  openteam local only               Use local models only (never frontier)",
-    on: "  openteam local on                 Re-enable local-first routing"
-  },
-  noRuntimes: "none",
-  modeFrontierOnly: "frontier-only (frontierOnly)",
-  modeLocalOnly: "local-only (localOnly)",
-  modeLocalFirst: "local-first",
-  summary: (params) => [
-    "openteam local:",
-    `  mode:        ${params.mode}`,
-    `  frontierOnly: ${params.frontierOnly}`,
-    `  localOnly:    ${params.localOnly}`,
-    `  privacy:     ${params.privacy}`,
-    `  runtimes:    ${params.runtimes}`
-  ],
-  frontierOnlyNoChange: "No change: already in frontier-only mode.",
-  privacyAdjustedNote: " Privacy adjusted to 'consentBeforeFrontier' (forceLocalOnSensitive requires a local runtime).",
-  frontierOnlyEnabled: "Frontier-only mode enabled (frontierOnly=true, localOnly=false).",
-  localOnlyNoRuntimes: "Cannot enable local-only mode: no enabled local runtime is configured. Run 'openteam setup' or enable a local runtime in .opencode/openteam.json first.",
-  localOnlyNoChange: "No change: already in local-only mode.",
-  localOnlyEnabled: "Local-only mode enabled (localOnly=true, frontierOnly=false).",
-  localFirstNoChange: "No change: local-first routing is already active.",
-  localFirstReEnabled: "Local-first routing re-enabled (frontierOnly=false, localOnly=false). Make sure a local runtime is reachable.",
-  unknownSubcommand: (subcommand, help) => `Unknown local subcommand: ${subcommand}
-
-${help}`
-};
-var frontierCatalogMessages = {
-  free: "free",
-  costPerMillion: (inputUSD, outputUSD) => `$${inputUSD}/$${outputUSD} per 1M`
-};
-var migrateMessages = {
-  header: "openteam migrate:",
-  nothingToMigrate: "  nothing to migrate — the P15b layout is already in place.",
-  counts: (params) => [
-    `  moved:     ${params.moved} file(s)`,
-    `  deduped:   ${params.deduped} file(s) (destination already identical)`,
-    `  conflicts: ${params.conflicts} file(s)`
-  ],
-  relocatedHeader: "  relocated:",
-  relocatedEntry: (from, to, deduped) => `    · ${from} → ${to}${deduped ? " (deduped)" : ""}`,
-  conflictsHeader: "  ⚠ left in place (destination exists with different content — no data lost):",
-  conflictEntry: (from, to) => `    · ${from} → ${to}`,
-  manualWorktreesHeader: "  ⚠ legacy git worktree(s) need a manual move (run `git worktree move`):",
-  manualWorktreeEntry: (label, from, to) => `    · ${label}: ${from} → ${to}`,
-  success: "  ✓ machine-local runtime output relocated under .opencode/openteam-local/."
-};
-var rolesInitMessages = {
-  header: "openteam roles init:",
-  title: "openteam roles init",
-  noRoster: (path) => `  ✗ no roster at ${path}.`,
-  noRosterRemedy: "    Cast the team first: run `openteam setup`, then ask the orchestrator to register the cast.",
-  unparseableRoster: (path, error) => `  ✗ ${path} is present but unparseable: ${error}`,
-  unparseableRosterRemedy: "    Run `openteam doctor` for the remedy, then re-run this command.",
-  allProfiled: (count) => `  ✓ ${count} roster role(s) checked; no unprofiled roles — every role resolves a routing profile.`,
-  whyTitle: "Why you are being asked",
-  why: (count) => [
-    `${count} roster role(s) resolve no routing profile.`,
-    "Until a profile exists they are frontier-eligible: their work can escalate",
-    "to a frontier model. A 'local only' note in the roster prose does not",
-    "prevent this — prose outside the JSON fence is never read."
-  ].join(`
-`),
-  policyQuestion: (roleID, agentName) => `Routing policy for "${roleID}" (${agentName})`,
-  localOnlyLabel: (roleID, agentName) => `Local only — ${roleID} (${agentName}) never leaves this machine`,
-  localOnlyHint: "sets requiresLocalRuntime; the role fails closed when no local runtime is reachable",
-  frontierOkLabel: "Local first, frontier allowed",
-  frontierOkHint: "records today's implicit behaviour: cheapest-capable frontier when the task warrants it",
-  skipLabel: "Skip for now",
-  skipHint: "leaves the role unprofiled, so it stays frontier-eligible and doctor keeps reporting it",
-  runtimeQuestion: (roleID) => `Preferred local runtime(s) for "${roleID}" (in failover order)`,
-  runtimeHint: "machine-local — written to the git-ignored overlay",
-  cancelled: (reason) => `  ✗ cancelled (${reason}); nothing was written.`,
-  invalidResult: (reason) => `  ✗ refusing to write: the resulting config is invalid — ${reason}`,
-  nothingWritten: (skipped) => `  · skipped ${skipped}; nothing written.`,
-  nothingToWriteOutro: "Nothing to write.",
-  pinnedLocal: (roleIDs, path) => `  ✓ pinned local-only: ${roleIDs} → ${path} (tracked, travels with the roster)`,
-  frontierAllowed: (roleIDs, path) => `  ✓ frontier allowed: ${roleIDs} → ${path} (model choice stays "auto": cheapest-capable per task)`,
-  runtimeBinding: (path) => `  ✓ runtime binding: ${path} (git-ignored, machine-local)`,
-  skippedSummary: (roleIDs) => `  · skipped: ${roleIDs} — still frontier-eligible; re-run this command to revisit.`,
-  outro: "Role policy updated."
-};
-
 // src/orchestrator/worktreeReconciler.ts
 function planOne(wt) {
   const base = { runID: wt.runID, path: wt.path };
@@ -10126,8 +10764,7 @@ function rosterHealthSection(audit, loadError, rosterRoleCount, rosterMissing) {
   if (unprofiled.length > 0) {
     const roleIDs = unprofiled.map((entry) => entry.roleID).join(", ");
     lines.push(`    · unprofiled roleID(s): ${roleIDs}`);
-    lines.push("      routing: no profile means frontier-eligible — work for these roles can escalate to a frontier model. A 'local only' note in the roster prose does NOT prevent this: prose outside the JSON fence is never read.");
-    lines.push('      remedy: run `openteam roles init` to compose a profile interactively, or add one by hand under orchestrator.roles in .opencode/openteam.json with "requiresLocalRuntime": true to pin the role local; for curated routing, change roleID to a TEAM_ROLES key instead.');
+    lines.push(executionPolicyMessages.unprofiledRoleRouting, executionPolicyMessages.unprofiledRoleRemedy);
   }
   return lines;
 }
@@ -10169,10 +10806,7 @@ function agentModelsSection(diagnostics, searchedPaths, localOnly) {
   }
   const localOnlyGap = localOnly ? diagnostics.find((d) => d.mode === "primary" && d.resolution?.status === "unresolvable" && d.resolution.reason === "provider-not-configured") : undefined;
   if (localOnlyGap?.model !== undefined) {
-    lines.push(`    ✗ local-only mode, but the primary agent '${localOnlyGap.name}' points at provider '${localOnlyGap.model.providerID}', which opencode.json does not configure.`);
-    lines.push("      cause: `openteam setup` recorded the frontier baseline placeholder as this agent's `model:`. That value is correctly inert as baseline.hardDefault while router.localOnly is true, but an agent's own `model:` is load-bearing, so opencode cannot resolve the coordinator against your local-only providers.");
-    lines.push("      consequence: opencode cannot start the openteam coordinator, so it reads no roster and splits no work — even though every subagent resolves on your local runtime.");
-    lines.push(`      remedy: re-run \`openteam setup\` and keep local-only mode to regenerate ${localOnlyGap.sourceFile} with your local thinking model, then re-run \`openteam doctor\`.`);
+    lines.push(executionPolicyMessages.primaryLocalMismatch(localOnlyGap.name, localOnlyGap.model.providerID), executionPolicyMessages.primaryLocalMismatchCause, executionPolicyMessages.primaryLocalMismatchConsequence, executionPolicyMessages.primaryLocalMismatchRemedy(localOnlyGap.sourceFile));
   }
   lines.push("    note: 'declared' = model set in .opencode/agent/<name>.md frontmatter; 'inherited' = opencode.json default.");
   lines.push("    note: static checks are offline and deterministic; live checks need a reachable local runtime and can be inconclusive.");
@@ -10181,10 +10815,16 @@ function agentModelsSection(diagnostics, searchedPaths, localOnly) {
 function renderDoctor(input) {
   const enabledRuntimes = input.config.local.runtimes.filter((r) => r.enabled);
   const reachable = input.snapshots.filter((s) => s.reachable).length;
+  const configRecord = input.config;
+  const routerRecord = typeof configRecord.router === "object" && configRecord.router !== null && !Array.isArray(configRecord.router) ? configRecord.router : {};
+  const executionMode = typeof routerRecord.executionMode === "string" ? routerRecord.executionMode : routerRecord.localOnly === true ? "local" : routerRecord.frontierOnly === true ? "frontier" : "mixed";
+  const orchestratorRecord = typeof configRecord.orchestrator === "object" && configRecord.orchestrator !== null && !Array.isArray(configRecord.orchestrator) ? configRecord.orchestrator : {};
+  const maxRetries = typeof orchestratorRecord.maxRetries === "number" ? orchestratorRecord.maxRetries : 2;
+  const maxModelsPerNode = typeof orchestratorRecord.maxModelsPerNode === "number" ? orchestratorRecord.maxModelsPerNode : 2;
   const lines = [
     "openteam doctor:",
     `  baseline:  ${input.config.baseline.mode}` + (input.config.baseline.mode === "pinned" && input.config.baseline.pinnedModel !== null ? ` (${input.config.baseline.pinnedModel.providerID}/${input.config.baseline.pinnedModel.modelID})` : ""),
-    `  privacy:   ${input.config.privacyMode}`,
+    executionPolicyMessages.globalMode(executionMode),
     `  local runtimes (${reachable}/${enabledRuntimes.length} reachable):`
   ];
   if (input.snapshots.length === 0) {
@@ -10212,6 +10852,11 @@ function renderDoctor(input) {
     lines.push(`  ⚠ ${snapshot.id} is reached over the network: its ${cap}-slot cap is enforced per openteam process, so`, "    two processes at once (an opencode session plus 'openteam console') can together exceed it.");
   }
   lines.push(`  telemetry: ${input.telemetryPath} — ${input.telemetryRecords} record(s)`);
+  lines.push(executionPolicyMessages.section);
+  for (const policy of executionPolicySummaries(input.config)) {
+    lines.push(executionPolicyMessages.line(policy));
+  }
+  lines.push(executionPolicyMessages.retryLimits(maxRetries, maxModelsPerNode));
   if (input.queueWait !== undefined) {
     lines.push(...queueWaitSection(input.queueWait));
   }
@@ -10239,8 +10884,10 @@ function renderDoctor(input) {
   lines.push("  console:");
   lines.push("    command:    openteam console");
   lines.push("    launches:   the multi-session web Console (status and URL)");
-  if (reachable === 0) {
-    lines.push("  ⚠ No local runtime reachable: all traffic will go to frontier.");
+  if (reachable === 0 && executionMode === "mixed") {
+    lines.push(executionPolicyMessages.noLocalMixed);
+  } else if (reachable === 0 && executionMode === "local") {
+    lines.push(executionPolicyMessages.noLocalBlocked);
   }
   if (input.graphHealth !== undefined) {
     const h = input.graphHealth;
@@ -10262,7 +10909,7 @@ function renderDoctor(input) {
     lines.push("    Run `openteam clear-cache --delete` to clean up.");
   }
   if (input.agentModels !== undefined) {
-    lines.push(...agentModelsSection(input.agentModels, input.opencodeConfigPaths ?? [], input.config.router.localOnly));
+    lines.push(...agentModelsSection(input.agentModels, input.opencodeConfigPaths ?? [], executionMode === "local"));
   }
   if (input.opencodeConfigError !== undefined) {
     lines.push(`  ⚠ opencode config parse error: ${input.opencodeConfigError}`);
@@ -10387,6 +11034,47 @@ function renderWorktreeReconciliation(report) {
 function hasEnabledLocalRuntime(config) {
   return config.local.runtimes.some((runtime) => runtime.enabled);
 }
+function executionMode(config) {
+  const router = config.router;
+  if (router.executionMode !== undefined) {
+    return router.executionMode;
+  }
+  if (router.localOnly === true) {
+    return "local";
+  }
+  if (router.frontierOnly === true) {
+    return "frontier";
+  }
+  return "mixed";
+}
+function withExecutionMode(config, mode) {
+  const {
+    privacyMode: _legacyPrivacyMode,
+    router: currentRouter,
+    ...configWithoutLegacyPrivacy
+  } = config;
+  const {
+    frontierOnly: _legacyFrontierOnly,
+    localOnly: _legacyLocalOnly,
+    ...currentRouterWithoutLegacyModes
+  } = currentRouter;
+  const candidate = {
+    ...configWithoutLegacyPrivacy,
+    router: {
+      ...currentRouterWithoutLegacyModes,
+      executionMode: mode
+    }
+  };
+  const parsed = OpenTeamConfigSchema.safeParse(candidate);
+  if (!parsed.success) {
+    throw new Error(formatConfigError(parsed.error));
+  }
+  assertEffectiveConfigModelDomains(parsed.data);
+  return parsed.data;
+}
+function requiresExecutionMigration(config) {
+  return config.router.localOnly !== undefined || config.router.frontierOnly !== undefined || config.privacyMode !== undefined;
+}
 function enabledRuntimesSummary(config) {
   const enabled = config.local.runtimes.filter((runtime) => runtime.enabled);
   if (enabled.length === 0) {
@@ -10399,59 +11087,44 @@ function enabledRuntimesSummary(config) {
   }).join(", ");
 }
 function showLocal(config) {
-  const mode = config.router.localOnly ? localMessages.modeLocalOnly : config.router.frontierOnly ? localMessages.modeFrontierOnly : localMessages.modeLocalFirst;
+  const mode = executionMode(config);
+  const modeLabel = mode === "local" ? localMessages.modeLocal : mode === "frontier" ? localMessages.modeFrontier : localMessages.modeMixed;
   const lines = localMessages.summary({
-    mode,
-    frontierOnly: config.router.frontierOnly,
-    localOnly: config.router.localOnly,
-    privacy: config.privacyMode,
+    mode: modeLabel,
     runtimes: enabledRuntimesSummary(config)
   });
   return { message: lines.join(`
 `) };
 }
 function setFrontierOnly(config) {
-  if (config.router.frontierOnly && !config.router.localOnly) {
+  if (executionMode(config) === "frontier" && !requiresExecutionMigration(config)) {
+    assertEffectiveConfigModelDomains(config);
     return { message: localMessages.frontierOnlyNoChange };
   }
-  const flipsPrivacy = config.privacyMode === "forceLocalOnSensitive";
-  const next = {
-    ...config,
-    router: { ...config.router, frontierOnly: true, localOnly: false },
-    privacyMode: flipsPrivacy ? "consentBeforeFrontier" : config.privacyMode
-  };
-  const privacyNote = flipsPrivacy ? localMessages.privacyAdjustedNote : "";
   return {
-    config: next,
-    message: `${localMessages.frontierOnlyEnabled}${privacyNote}`
+    config: withExecutionMode(config, "frontier"),
+    message: localMessages.frontierOnlyEnabled
   };
 }
 function setLocalOnly(config) {
   if (!hasEnabledLocalRuntime(config)) {
     return { message: localMessages.localOnlyNoRuntimes };
   }
-  if (config.router.localOnly && !config.router.frontierOnly) {
+  if (executionMode(config) === "local" && !requiresExecutionMigration(config)) {
+    assertEffectiveConfigModelDomains(config);
     return { message: localMessages.localOnlyNoChange };
   }
-  const next = {
-    ...config,
-    router: { ...config.router, frontierOnly: false, localOnly: true }
-  };
   return {
-    config: next,
+    config: withExecutionMode(config, "local"),
     message: localMessages.localOnlyEnabled
   };
 }
 function setLocalFirst(config) {
-  if (!config.router.frontierOnly && !config.router.localOnly) {
+  if (executionMode(config) === "mixed" && !requiresExecutionMigration(config)) {
     return { message: localMessages.localFirstNoChange };
   }
-  const next = {
-    ...config,
-    router: { ...config.router, frontierOnly: false, localOnly: false }
-  };
   return {
-    config: next,
+    config: withExecutionMode(config, "mixed"),
     message: localMessages.localFirstReEnabled
   };
 }
@@ -10552,7 +11225,7 @@ function stripJsoncComments(src) {
   }
   return out.join("");
 }
-function isRecord3(v) {
+function isRecord4(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var OPENCODE_CONFIG_CANDIDATES = [
@@ -10563,7 +11236,7 @@ function mergeOpencodeConfigs(base, override) {
   const result = { ...base };
   for (const [key, value] of Object.entries(override)) {
     const baseVal = result[key];
-    if (isRecord3(baseVal) && isRecord3(value)) {
+    if (isRecord4(baseVal) && isRecord4(value)) {
       result[key] = mergeOpencodeConfigs(baseVal, value);
     } else {
       result[key] = value;
@@ -10764,17 +11437,17 @@ var GENERATED_OPENTEAM_STATE_GROUPS = [
 var OPENCODE_DIR = ".opencode";
 var AGENT_DIR = `${OPENCODE_DIR}/agent`;
 var ROLE_AGENT_DESCRIPTIONS = {
-  architect: "openteam architect subagent: high-level design, cross-cutting refactors and hard technical decisions; escalates to a frontier model when the task warrants it.",
+  architect: "openteam architect subagent: high-level design, cross-cutting refactors and hard technical decisions.",
   integration: "openteam integration subagent: wires components together, owns end-to-end flows and cross-module glue.",
-  "local-runtime": "openteam local-runtime subagent: local model operation and runtime health; prefers local execution.",
+  "local-runtime": "openteam local-runtime subagent: local model operation, provider binding and runtime health.",
   "routing-cost": "openteam routing-cost subagent: cost-aware routing analysis and token/budget optimisation.",
-  scribe: "openteam scribe subagent: the team's silent memory. Records decisions and learnings in .opencode/openteam/decisions.md without changing code. Runs locally only. When a conversation yields durable, reusable knowledge — such as facts, entities, and the typed relations between them (e.g. a decision that affects a component) — also call the `openteam-memory` tool with those messages to record it in the team's semantic graph; it never stores the raw conversation, and a reply that memory is disabled or that nothing was recorded is expected, so do not retry.",
-  ralph: "openteam ralph subagent: automation and triage driver. Monitors pending work, prioritises it and coordinates execution, escalating blockers to the human. Runs locally only.",
-  guardian: "openteam guardian subagent: security and privacy gate. Detects and masks sensitive data before it leaves the repo or reaches a frontier model. Runs locally only.",
+  scribe: "openteam scribe subagent: the team's silent memory. Records decisions and learnings in .opencode/openteam/decisions.md without changing code. When a conversation yields durable, reusable knowledge — such as facts, entities, and the typed relations between them (e.g. a decision that affects a component) — also call the `openteam-memory` tool with those messages to record it in the team's semantic graph; it never stores the raw conversation, and a reply that memory is disabled or that nothing was recorded is expected, so do not retry.",
+  ralph: "openteam ralph subagent: automation and triage driver. Monitors pending work, prioritises it and coordinates execution, escalating blockers to the human.",
+  guardian: "openteam guardian subagent: an assignable security reviewer for threat analysis, exploitability checks and security-focused review.",
   tester: "openteam tester subagent: writes and runs tests, reproduces bugs and validates fixes.",
   reviewer: "openteam reviewer subagent: reviews diffs for correctness, security and quality."
 };
-function buildRoleAgent(agentName, description, localOnly) {
+function buildRoleAgent(agentName, description) {
   const frontmatter = [
     "---",
     `description: ${JSON.stringify(description)}`,
@@ -10788,7 +11461,7 @@ function buildRoleAgent(agentName, description, localOnly) {
     "",
     description,
     "",
-    localOnly ? "You run on a local runtime only; openteam refuses to dispatch you when no local runtime is reachable, so sensitive work never reaches a frontier model." : "openteam routes your model per request (local-first, cheapest-capable frontier only when the task warrants it); leave `model` unset to inherit that routing.",
+    "Your execution domain, selected model and ordered fallbacks come from the matching policy in `.opencode/openteam.json`; leave `model` unset here so the runtime policy remains authoritative.",
     "",
     "Stay focused on your role. Keep changes surgical and report what you did."
   ].join(`
@@ -10798,19 +11471,19 @@ function buildRoleAgent(agentName, description, localOnly) {
 ${body}
 `;
 }
-function buildRoleAgentFiles() {
-  const seen = new Map;
+function buildRoleAgentFiles(_config) {
+  const seen = new Set;
   for (const role of Object.values(TEAM_ROLES)) {
     const agentName = role.opencodeAgent;
     if (agentName === undefined || seen.has(agentName)) {
       continue;
     }
-    seen.set(agentName, role.requiresLocalRuntime === true);
+    seen.add(agentName);
   }
-  return [...seen.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([agentName, localOnly]) => ({
+  return [...seen].sort((a, b) => a.localeCompare(b)).map((agentName) => ({
     agentName,
     path: `${AGENT_DIR}/${agentName}.md`,
-    contents: buildRoleAgent(agentName, ROLE_AGENT_DESCRIPTIONS[agentName] ?? `openteam ${agentName} subagent.`, localOnly)
+    contents: buildRoleAgent(agentName, ROLE_AGENT_DESCRIPTIONS[agentName] ?? `openteam ${agentName} subagent.`)
   }));
 }
 function splitSetupPath(path2) {
@@ -10956,40 +11629,42 @@ function buildOpenTeamConfig(answers) {
     return runtime;
   });
   const primaryLocal = firstEnabled(answers.runtimes);
+  if (answers.executionMode === "local" && primaryLocal === undefined) {
+    throw new Error(executionSetupMessages.localRequiredError);
+  }
   const localDefault = primaryLocal !== undefined ? {
     providerID: choiceProviderID(primaryLocal),
     modelID: primaryLocal.defaultModelID
   } : null;
-  const localOnly = answers.localOnly === true && primaryLocal !== undefined;
-  return OpenTeamConfigSchema.parse({
+  const roles = Object.fromEntries(Object.keys(TEAM_ROLES).sort().map((roleID) => [roleID, { model: "auto" }]));
+  const config = OpenTeamConfigSchema.parse({
+    configVersion: 2,
     baseline: {
       mode: "auto",
       pinnedModel: null,
       hardDefault: answers.frontier
     },
     router: {
-      mode: answers.routerMode,
-      localDefault,
-      frontierOnly: primaryLocal === undefined,
-      localOnly
+      executionMode: answers.executionMode,
+      localDefault
     },
     local: { runtimes },
-    privacyMode: answers.privacyMode,
+    orchestrator: {
+      primary: {
+        model: answers.primaryModel,
+        fallbacks: []
+      },
+      roles,
+      maxRetries: 2,
+      maxModelsPerNode: 2
+    },
     graph: { mode: "active" }
   });
+  assertEffectiveConfigModelDomains(config);
+  return config;
 }
 function orchestratorAgentModel(answers) {
-  const primaryLocal = firstEnabled(answers.runtimes);
-  if (answers.localOnly === true && primaryLocal !== undefined) {
-    return {
-      providerID: choiceProviderID(primaryLocal),
-      modelID: primaryLocal.thinkingModelID ?? primaryLocal.defaultModelID
-    };
-  }
-  return {
-    providerID: answers.frontier.providerID,
-    modelID: answers.frontier.modelID
-  };
+  return { ...answers.primaryModel };
 }
 function buildOpencodeConfig(answers) {
   const provider = {};
@@ -11003,12 +11678,22 @@ function buildOpencodeConfig(answers) {
     if (baseURL === undefined) {
       continue;
     }
-    const modelIDs = choice.models.length > 0 ? choice.models : [choice.defaultModelID];
+    const providerID = choiceProviderID(choice);
+    const modelIDs = new Set(choice.models);
+    modelIDs.add(choice.defaultModelID);
+    if (choice.thinkingModelID !== undefined) {
+      modelIDs.add(choice.thinkingModelID);
+    }
+    if (choice.coderModelID !== undefined) {
+      modelIDs.add(choice.coderModelID);
+    }
+    if (answers.primaryModel.providerID === providerID) {
+      modelIDs.add(answers.primaryModel.modelID);
+    }
     const models = {};
     for (const modelID of modelIDs) {
       models[modelID] = { name: modelID };
     }
-    const providerID = choiceProviderID(choice);
     const owner = providerOwner.get(providerID);
     if (owner !== undefined) {
       if (owner.baseURL !== baseURL) {
@@ -11033,8 +11718,7 @@ function buildOpencodeConfig(answers) {
     providerOwner.set(providerID, { instanceId: choice.id, baseURL });
   }
   const primaryLocal = firstEnabled(answers.runtimes);
-  const localOnly = answers.localOnly === true && primaryLocal !== undefined;
-  const mainModel = localOnly && primaryLocal !== undefined ? `${choiceProviderID(primaryLocal)}/${primaryLocal.defaultModelID}` : `${answers.frontier.providerID}/${answers.frontier.modelID}`;
+  const mainModel = `${answers.primaryModel.providerID}/${answers.primaryModel.modelID}`;
   const config = {
     $schema: "https://opencode.ai/config.json",
     plugin: [OPENTEAM_PLUGIN_SPEC],
@@ -11114,7 +11798,7 @@ async function chooseFrontier(prompt, profiles) {
   const sorted = sortFrontierByCost(profiles);
   const first = sorted[0];
   const selected = await prompt.autocomplete({
-    message: "Baseline frontier model (type to search; cheapest first)",
+    message: executionSetupMessages.frontierModelQuestion,
     placeholder: "search by provider or model…",
     choices: [
       ...sorted.map((profile) => ({
@@ -11400,7 +12084,7 @@ async function resolveRuntimeInstances(deps, meta, info, usedIds) {
 async function runSetup(deps) {
   const { prompt } = deps;
   try {
-    prompt.intro("openteam setup — configure opencode with local-first routing");
+    prompt.intro(executionSetupMessages.setupIntro);
     const detected = await deps.detect();
     const detectedById = new Map(detected.map((item) => [item.id, item]));
     const runtimeChoices = KNOWN_RUNTIMES.map((meta) => {
@@ -11414,11 +12098,11 @@ async function runSetup(deps) {
     });
     runtimeChoices.push({
       value: RUNTIME_NONE,
-      label: "None — use frontier models only",
-      hint: "no local runtime (frontier-only)"
+      label: executionSetupMessages.runtimeNoneLabel,
+      hint: executionSetupMessages.runtimeNoneHint
     });
     const enabledIds = await prompt.multiselect({
-      message: "Which local runtimes do you want to enable? (choose 'None' for frontier-only)",
+      message: executionSetupMessages.runtimeQuestion,
       choices: runtimeChoices,
       required: true
     });
@@ -11445,10 +12129,27 @@ async function runSetup(deps) {
       runtimes.push(...await resolveRuntimeInstances(deps, meta, info, usedIds));
     }
     const hasLocalEnabled = enabled.size > 0;
-    const localOnly = hasLocalEnabled ? await prompt.confirm({
-      message: "Run without frontier models? (local runtimes only; openteam never escalates)",
-      initial: false
-    }) : false;
+    const executionMode2 = hasLocalEnabled ? await prompt.select({
+      message: executionSetupMessages.executionModeQuestion,
+      choices: [
+        {
+          value: "mixed",
+          label: executionSetupMessages.executionModeChoices.mixed.label,
+          hint: executionSetupMessages.executionModeChoices.mixed.hint
+        },
+        {
+          value: "local",
+          label: executionSetupMessages.executionModeChoices.local.label,
+          hint: executionSetupMessages.executionModeChoices.local.hint
+        },
+        {
+          value: "frontier",
+          label: executionSetupMessages.executionModeChoices.frontier.label,
+          hint: executionSetupMessages.executionModeChoices.frontier.hint
+        }
+      ],
+      initial: "mixed"
+    }) : "frontier";
     let frontierProfiles;
     try {
       const loaded = await deps.loadFrontierProfiles();
@@ -11456,68 +12157,55 @@ async function runSetup(deps) {
     } catch {
       frontierProfiles = [...CURATED_FRONTIER_PROFILES];
     }
-    const frontier = localOnly ? cheapestFrontier(frontierProfiles) : await chooseFrontier(prompt, frontierProfiles);
-    if (localOnly) {
-      prompt.note([
-        "openteam will never escalate to a frontier model.",
-        "opencode's main model is pointed at your local runtime too, so the",
-        "session itself does not reach a frontier provider either.",
-        "",
-        `A baseline is still recorded (${frontier.providerID}/${frontier.modelID})`,
-        "but stays unused. Set router.localOnly to false to re-enable it.",
-        "",
-        "Routing mode set to 'balanced' and privacy to 'forceLocalOnSensitive'",
-        "automatically — in local-only mode every task stays local regardless,",
-        "so these settings cannot change behaviour."
-      ].join(`
-`), "Local-only mode");
-    }
-    const routerMode = localOnly ? "balanced" : await prompt.select({
-      message: "Routing mode",
-      choices: [
-        { value: "balanced", label: "balanced (recommended)" },
-        { value: "economy", label: "economy (max savings, prefers local)" },
-        { value: "quality", label: "quality (prefers frontier)" }
-      ],
-      initial: "balanced"
-    });
+    const primaryLocal = firstEnabled(runtimes);
+    const localPrimary = primaryLocal === undefined ? undefined : {
+      providerID: choiceProviderID(primaryLocal),
+      modelID: primaryLocal.thinkingModelID ?? primaryLocal.defaultModelID
+    };
+    let frontier;
+    let primaryModel;
+    if (executionMode2 === "local") {
+      if (localPrimary === undefined) {
+        throw new Error(executionSetupMessages.localRequiredError);
+      }
+      frontier = cheapestFrontier(frontierProfiles);
+      primaryModel = localPrimary;
+      prompt.note(executionSetupMessages.localOnlyNote(`${primaryModel.providerID}/${primaryModel.modelID}`), executionSetupMessages.localOnlyTitle);
+    } else {
+      frontier = await chooseFrontier(prompt, frontierProfiles);
+      if (executionMode2 === "frontier" || localPrimary === undefined) {
+        primaryModel = frontier;
+      } else {
+        const primaryDomain = await prompt.select({
+          message: executionSetupMessages.mixedPrimaryQuestion,
+          choices: [
+            {
+              value: "local",
+              label: executionSetupMessages.mixedPrimaryLocal(`${localPrimary.providerID}/${localPrimary.modelID}`)
+            },
+            {
+              value: "frontier",
+              label: executionSetupMessages.mixedPrimaryFrontier
+            }
+          ],
+          initial: "frontier"
+        });
+        primaryModel = primaryDomain === "local" ? localPrimary : frontier;
+      }
+    }
     if (!hasLocalEnabled) {
-      prompt.note([
-        "You have not enabled any local runtime: openteam will run only with",
-        "frontier models (the configured cheapest-capable).",
-        "",
-        "For sensitive prompts, 'forceLocalOnSensitive' would have no local",
-        "target, so 'consentBeforeFrontier' is recommended."
-      ].join(`
-`), "Frontier-only mode");
-    }
-    const privacyMode = localOnly ? "forceLocalOnSensitive" : await prompt.select({
-      message: "Privacy for sensitive prompts",
-      choices: [
-        {
-          value: "forceLocalOnSensitive",
-          label: "forceLocalOnSensitive (never sends sensitive data to frontier)",
-          ...hasLocalEnabled ? {} : { hint: "requires an enabled local runtime" }
-        },
-        {
-          value: "consentBeforeFrontier",
-          label: "consentBeforeFrontier (asks for consent)"
-        },
-        { value: "off", label: "off (no protection)" }
-      ],
-      initial: hasLocalEnabled ? "forceLocalOnSensitive" : "consentBeforeFrontier"
-    });
+      prompt.note(executionSetupMessages.frontierOnlyNote, executionSetupMessages.frontierOnlyTitle);
+    }
     const yolo = await prompt.confirm({
-      message: "Enable YOLO mode? (opencode auto-approves all permissions; does not affect openteam privacy)",
+      message: executionSetupMessages.yoloQuestion,
       initial: false
     });
     const answers = {
       runtimes,
       frontier,
-      routerMode,
-      privacyMode,
-      yolo,
-      localOnly
+      executionMode: executionMode2,
+      primaryModel,
+      yolo
     };
     const openTeamConfig = buildOpenTeamConfig(answers);
     const opencodeConfig = buildOpencodeConfig(answers);
@@ -11527,7 +12215,7 @@ async function runSetup(deps) {
     const existingOpencodePath = await deps.resolveOpencodeWriteTarget(OPENCODE_CONFIG_CANDIDATES);
     const opencodePath = existingOpencodePath ?? OPENCODE_CONFIG_CANDIDATES[0];
     const agentPath = ORCHESTRATOR_AGENT_PATH;
-    const roleAgentFiles = buildRoleAgentFiles();
+    const roleAgentFiles = buildRoleAgentFiles(openTeamConfig);
     const opencodeGitignorePath = OPENCODE_GITIGNORE_PATH;
     const existingGitignore = await deps.fileExists(opencodeGitignorePath) ? await deps.readFile(opencodeGitignorePath) ?? "" : "";
     const opencodeGitignore = buildOpencodeGitignore(existingGitignore);
@@ -11584,27 +12272,30 @@ async function runSetup(deps) {
       const remote = runtime.baseURL !== undefined && !runtime.baseURL.includes("localhost") && !runtime.baseURL.includes("127.0.0.1") ? ` @ ${runtime.baseURL}` : "";
       return `${runtime.id} (${runtime.defaultModelID})${remote}`;
     }).join(", ");
-    prompt.note([
-      `Baseline frontier: ${localOnly ? `${frontier.providerID}/${frontier.modelID} (recorded but unused — local-only)` : `${frontier.providerID}/${frontier.modelID}`}`,
-      `Local runtimes: ${enabledSummary || "none (frontier-only)"}`,
-      `YOLO mode: ${yolo ? "enabled (auto-approves permissions)" : "disabled"}`,
-      "Web Console: launched separately from the CLI with 'openteam console' (multi-session, loopback)",
-      `Wrote: ${opencodePath}, ${DEFAULT_CONFIG_PATH}, ${ORCHESTRATOR_AGENT_PATH}, ${AGENT_DIR}/*.md (${roleAgentFiles.length} standard subagents), ${OPENTEAM_COMMAND_DIR}/*.md (${slashCommands.length} commands); ensured ${OPENCODE_GITIGNORE_PATH}`,
-      "",
-      "Next steps:",
-      localOnly ? "  1. No frontier auth needed; openteam runs entirely on your local runtimes" : `  1. Authenticate the frontier provider: opencode auth login`,
-      hasLocalEnabled ? "  2. Make sure your local runtime (local or on the network) is reachable; openteam routes local-first automatically" : "  2. Open opencode in this repo; openteam will use frontier models only",
-      "  3. Press Tab and pick the 'openteam' agent, or type / and pick an /openteam… command"
-    ].join(`
-`), "openteam configured");
-    prompt.outro("Done. Open opencode and select the 'openteam' agent.");
+    prompt.note(executionSetupMessages.configuredSummary({
+      executionMode: executionMode2,
+      primaryModel: `${primaryModel.providerID}/${primaryModel.modelID}`,
+      frontierBaseline: `${frontier.providerID}/${frontier.modelID}`,
+      localRuntimes: enabledSummary || executionSetupMessages.runtimeNoneHint,
+      yolo,
+      opencodePath,
+      configPath: DEFAULT_CONFIG_PATH,
+      agentPath: ORCHESTRATOR_AGENT_PATH,
+      agentDir: AGENT_DIR,
+      roleAgentCount: roleAgentFiles.length,
+      commandDir: OPENTEAM_COMMAND_DIR,
+      commandCount: slashCommands.length,
+      gitignorePath: OPENCODE_GITIGNORE_PATH
+    }).join(`
+`), executionSetupMessages.configuredTitle);
+    prompt.outro(executionSetupMessages.done);
     return {
       exitCode: 0,
-      stdout: `openteam setup complete: ${opencodePath}, ${DEFAULT_CONFIG_PATH}, ${ORCHESTRATOR_AGENT_PATH}, ${AGENT_DIR}/*.md (${roleAgentFiles.length} subagents), ${OPENTEAM_COMMAND_DIR}/*.md, ${OPENCODE_GITIGNORE_PATH}`
+      stdout: executionSetupMessages.complete(`${opencodePath}, ${DEFAULT_CONFIG_PATH}, ${ORCHESTRATOR_AGENT_PATH}, ${AGENT_DIR}/*.md (${roleAgentFiles.length} subagents), ${OPENTEAM_COMMAND_DIR}/*.md, ${OPENCODE_GITIGNORE_PATH}`)
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    return { exitCode: 1, stdout: `setup error: ${message}` };
+    return { exitCode: 1, stdout: executionSetupMessages.error(message) };
   }
 }
 
@@ -11874,8 +12565,8 @@ function stripOpenteamFromOpencodeConfig(raw) {
     }
     return { status: "not-present" };
   }
-  const record = parsed;
-  const plugins = record.plugin;
+  const record2 = parsed;
+  const plugins = record2.plugin;
   if (!Array.isArray(plugins)) {
     if (raw.includes(OPENTEAM_PLUGIN_SPEC)) {
       return {
@@ -12289,10 +12980,10 @@ var HELP = [
   localMessages.help.off,
   localMessages.help.only,
   localMessages.help.on,
-  "  openteam doctor                   Diagnose runtimes and config",
-  "  openteam roles init               Compose per-role routing policy for unprofiled roster roles",
+  executionPolicyMessages.doctorHelp,
+  rolesInitMessages.help,
   "  openteam migrate                  Relocate pre-P15b artifacts to their split homes (idempotent)",
-  "  openteam agents                   List agents and each one's LLM (local/frontier)",
+  executionPolicyMessages.agentsHelp,
   "  openteam console                  Launch the multi-session web Console (Ctrl+C to stop; --open opens the browser)",
   "  openteam console --status         Show the Console config without launching it",
   "  openteam graph status             Show the Graph journal and lease health",
@@ -12510,9 +13201,7 @@ ${HELP}`
   const agentNote = await regenerateOrchestratorAgent(deps, config, enable);
   return {
     exitCode: 0,
-    stdout: `${writePath} updated. ${renderYoloStatus(enable)}${agentNote}${enable ? `
-Note: YOLO does not disable openteam privacy; sensitive prompts still stay off frontier with forceLocalOnSensitive.` : ""}
-Restart opencode (or reload) so agents pick up the new permissions.`
+    stdout: yoloMessages.updated(writePath, renderYoloStatus(enable), agentNote)
   };
 }
 async function regenerateOrchestratorAgent(deps, config, enable) {
@@ -12572,6 +13261,11 @@ async function runAgents(deps, configPath, opencodeConfigPaths, configResolution
     exitCode: 0,
     stdout: renderAgentList(classifications, {
       ...context,
+      executionPolicies: executionPolicySummaries(config),
+      retryLimits: {
+        maxRetries: config.orchestrator?.maxRetries ?? 2,
+        maxModelsPerNode: config.orchestrator?.maxModelsPerNode ?? 2
+      },
       ...opencodeConfigError !== undefined ? { opencodeConfigError } : {}
     })
   };
@@ -13158,9 +13852,12 @@ function auditParsedRoster(roster, configuredRoles) {
 }
 
 // src/commands/rolesInit.ts
-var ROLES_INIT_LOCAL_ONLY = "local-only";
-var ROLES_INIT_FRONTIER_OK = "frontier-ok";
+var ROLES_INIT_AUTO = "auto";
+var ROLES_INIT_PIN = "pin";
 var ROLES_INIT_SKIP = "skip";
+var ROLES_INIT_INHERIT = "inherit";
+var ROLES_INIT_LOCAL_ONLY = "local";
+var ROLES_INIT_FRONTIER_ONLY = "frontier";
 function isJsonRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -13193,29 +13890,15 @@ function withRole(config, roleID, profile) {
     }
   };
 }
-function localOnlyProfile(roleID) {
-  const base = synthesiseFallbackProfile(roleID);
-  return {
-    ...base,
-    preferredFrontierModels: [],
-    localFirst: true,
-    requiresLocalRuntime: true
-  };
-}
-function frontierEligibleProfile(roleID) {
-  return { ...synthesiseFallbackProfile(roleID) };
-}
-function policyChoices(roleID, agentName) {
+function policyChoices() {
   return [
     {
-      value: ROLES_INIT_LOCAL_ONLY,
-      label: rolesInitMessages.localOnlyLabel(roleID, agentName),
-      hint: rolesInitMessages.localOnlyHint
+      value: ROLES_INIT_AUTO,
+      label: executionSetupMessages.rolePolicy.modelAutoLabel
     },
     {
-      value: ROLES_INIT_FRONTIER_OK,
-      label: rolesInitMessages.frontierOkLabel,
-      hint: rolesInitMessages.frontierOkHint
+      value: ROLES_INIT_PIN,
+      label: executionSetupMessages.rolePolicy.modelExactLabel
     },
     {
       value: ROLES_INIT_SKIP,
@@ -13224,6 +13907,56 @@ function policyChoices(roleID, agentName) {
     }
   ];
 }
+function executionModeChoices() {
+  return [
+    {
+      value: ROLES_INIT_INHERIT,
+      label: executionSetupMessages.rolePolicy.modeInheritLabel
+    },
+    {
+      value: ROLES_INIT_LOCAL_ONLY,
+      label: executionSetupMessages.rolePolicy.modeLocalLabel
+    },
+    {
+      value: ROLES_INIT_FRONTIER_ONLY,
+      label: executionSetupMessages.rolePolicy.modeFrontierLabel
+    }
+  ];
+}
+function rawExecutionMode(config) {
+  const router = isJsonRecord2(config.router) ? config.router : {};
+  if (router.executionMode === "local" || router.executionMode === "frontier" || router.executionMode === "mixed") {
+    return router.executionMode;
+  }
+  if (router.localOnly === true) {
+    return "local";
+  }
+  if (router.frontierOnly === true) {
+    return "frontier";
+  }
+  return "mixed";
+}
+function normalizePortableConfig(raw) {
+  const migrated = migrateConfig(raw);
+  const normalized = isJsonRecord2(migrated) ? { ...migrated } : {};
+  delete normalized.privacyMode;
+  return normalized;
+}
+function parseModelRef2(value) {
+  const trimmed = value.trim();
+  const slash = trimmed.indexOf("/");
+  if (slash <= 0 || slash === trimmed.length - 1) {
+    throw new Error(executionSetupMessages.rolePolicy.invalidModelRef(value));
+  }
+  return {
+    providerID: trimmed.slice(0, slash),
+    modelID: trimmed.slice(slash + 1)
+  };
+}
+function parseFallbacks(value) {
+  const trimmed = value.trim();
+  return trimmed.length === 0 ? [] : trimmed.split(",").map((entry) => parseModelRef2(entry));
+}
 async function runRolesInit(deps) {
   const lines = [rolesInitMessages.header];
   const rosterContent = await deps.readFile(OPENTEAM_ROSTER_PATH);
@@ -13238,8 +13971,18 @@ async function runRolesInit(deps) {
     return { stdout: lines.join(`
 `), exitCode: 1 };
   }
-  const baseConfig = await readJsonFile(deps, DEFAULT_CONFIG_PATH);
+  const rawBaseConfig = await readJsonFile(deps, DEFAULT_CONFIG_PATH);
+  lines.push(...detectConfigDeprecations(rawBaseConfig).map((deprecation) => rolesInitMessages.deprecation(deprecation.message)));
+  let baseConfig;
+  try {
+    baseConfig = normalizePortableConfig(rawBaseConfig);
+  } catch (error) {
+    lines.push(rolesInitMessages.invalidResult(error instanceof Error ? error.message : String(error)));
+    return { stdout: lines.join(`
+`), exitCode: 1 };
+  }
   const configuredRoles = existingRoles(baseConfig);
+  const globalExecutionMode = rawExecutionMode(baseConfig);
   const unprofiled = parsed.roster.entries.filter((entry) => getRoleProfile(entry.roleID, configuredRoles) === undefined && !isKnownNonWorkerRole(entry.roleID));
   if (unprofiled.length === 0) {
     lines.push(rolesInitMessages.allProfiled(parsed.roster.entries.length));
@@ -13247,32 +13990,44 @@ async function runRolesInit(deps) {
 `), exitCode: 0 };
   }
   deps.prompt.intro(rolesInitMessages.title);
-  deps.prompt.note(rolesInitMessages.why(unprofiled.length), rolesInitMessages.whyTitle);
+  deps.prompt.note(executionSetupMessages.rolePolicy.why(unprofiled.length), executionSetupMessages.rolePolicy.whyTitle);
   const runtimes = (await deps.detectRuntimes?.())?.filter((runtime) => runtime.available);
   let nextConfig = baseConfig;
   let nextOverlay;
-  const pinned = [];
-  const relaxed = [];
+  const configured = [];
   const skipped = [];
   try {
     for (const entry of unprofiled) {
       const choice = await deps.prompt.select({
-        message: rolesInitMessages.policyQuestion(entry.roleID, entry.agentName),
-        choices: policyChoices(entry.roleID, entry.agentName),
-        initial: ROLES_INIT_LOCAL_ONLY
+        message: executionSetupMessages.rolePolicy.modelQuestion(entry.roleID),
+        choices: policyChoices(),
+        initial: ROLES_INIT_AUTO
       });
       if (choice === ROLES_INIT_SKIP) {
         skipped.push(entry.roleID);
         continue;
       }
-      if (choice === ROLES_INIT_FRONTIER_OK) {
-        nextConfig = withRole(nextConfig, entry.roleID, frontierEligibleProfile(entry.roleID));
-        relaxed.push(entry.roleID);
-        continue;
-      }
-      nextConfig = withRole(nextConfig, entry.roleID, localOnlyProfile(entry.roleID));
-      pinned.push(entry.roleID);
-      if (runtimes !== undefined && runtimes.length > 0) {
+      const modeChoice = globalExecutionMode === "mixed" ? await deps.prompt.select({
+        message: executionSetupMessages.rolePolicy.modeQuestion(entry.roleID, entry.agentName),
+        choices: executionModeChoices(),
+        initial: ROLES_INIT_INHERIT
+      }) : ROLES_INIT_INHERIT;
+      const model = choice === ROLES_INIT_AUTO ? "auto" : parseModelRef2(await deps.prompt.text({
+        message: executionSetupMessages.rolePolicy.modelExactQuestion(entry.roleID),
+        placeholder: executionSetupMessages.rolePolicy.modelExactPlaceholder
+      }));
+      const fallbacks = parseFallbacks(await deps.prompt.text({
+        message: executionSetupMessages.rolePolicy.fallbacksQuestion(entry.roleID),
+        placeholder: executionSetupMessages.rolePolicy.fallbacksPlaceholder
+      }));
+      const policy = {
+        model,
+        fallbacks,
+        ...modeChoice === ROLES_INIT_INHERIT ? {} : { executionMode: modeChoice }
+      };
+      nextConfig = withRole(nextConfig, entry.roleID, policy);
+      configured.push(entry.roleID);
+      if (modeChoice === ROLES_INIT_LOCAL_ONLY && runtimes !== undefined && runtimes.length > 0) {
         const selected = await deps.prompt.multiselect({
           message: rolesInitMessages.runtimeQuestion(entry.roleID),
           choices: runtimes.map((runtime) => ({
@@ -13294,15 +14049,21 @@ async function runRolesInit(deps) {
     return { stdout: lines.join(`
 `), exitCode: 1 };
   }
-  if (pinned.length === 0 && relaxed.length === 0) {
+  if (configured.length === 0) {
     lines.push(rolesInitMessages.nothingWritten(skipped.join(", ")));
     deps.prompt.outro(rolesInitMessages.nothingToWriteOutro);
     return { stdout: lines.join(`
 `), exitCode: 0 };
   }
-  const merged = mergeConfigInputs(nextConfig, nextOverlay);
   try {
-    loadOpenTeamConfig(merged);
+    const existingOverlay = await readJsonFile(deps, DEFAULT_LOCAL_OVERLAY_PATH);
+    const effectiveOverlay = nextOverlay === undefined ? existingOverlay : mergeConfigInputs(existingOverlay, nextOverlay);
+    const merged = mergeConfigInputs(nextConfig, effectiveOverlay);
+    const effectiveConfig = loadOpenTeamConfig(merged);
+    assertEffectiveConfigModelDomains(effectiveConfig);
+    if (nextOverlay !== undefined) {
+      nextOverlay = effectiveOverlay;
+    }
   } catch (error) {
     lines.push(rolesInitMessages.invalidResult(error instanceof Error ? error.message : String(error)));
     return { stdout: lines.join(`
@@ -13312,12 +14073,7 @@ async function runRolesInit(deps) {
   if (nextOverlay !== undefined) {
     await deps.writeFile(DEFAULT_LOCAL_OVERLAY_PATH, serialize(nextOverlay));
   }
-  if (pinned.length > 0) {
-    lines.push(rolesInitMessages.pinnedLocal(pinned.join(", "), DEFAULT_CONFIG_PATH));
-  }
-  if (relaxed.length > 0) {
-    lines.push(rolesInitMessages.frontierAllowed(relaxed.join(", "), DEFAULT_CONFIG_PATH));
-  }
+  lines.push(executionSetupMessages.rolePolicy.configured(configured.join(", "), DEFAULT_CONFIG_PATH));
   if (nextOverlay !== undefined) {
     lines.push(rolesInitMessages.runtimeBinding(DEFAULT_LOCAL_OVERLAY_PATH));
   }
@@ -14280,21 +15036,21 @@ var DEFAULT_RANK_SIGNALS = {
   accessWeight: 0.1,
   recencyHalfLifeMs: 14 * DAY_MS
 };
-function recencyTimestamp(record) {
-  if (record.kind === "preference" && record.lastAccessedAt !== null) {
-    return record.lastAccessedAt;
+function recencyTimestamp(record2) {
+  if (record2.kind === "preference" && record2.lastAccessedAt !== null) {
+    return record2.lastAccessedAt;
   }
-  return record.createdAt;
+  return record2.createdAt;
 }
-function recencyScore(record, signals) {
-  const ageMs = Math.max(0, signals.now - recencyTimestamp(record));
+function recencyScore(record2, signals) {
+  const ageMs = Math.max(0, signals.now - recencyTimestamp(record2));
   return 0.5 ** (ageMs / signals.recencyHalfLifeMs);
 }
-function accessScore(record) {
-  if (record.kind !== "preference") {
+function accessScore(record2) {
+  if (record2.kind !== "preference") {
     return 0;
   }
-  return 1 - 1 / (1 + record.accessCount);
+  return 1 - 1 / (1 + record2.accessCount);
 }
 function scoreCandidate(candidate, signals) {
   return signals.similarityWeight * candidate.similarity + signals.recencyWeight * recencyScore(candidate.record, signals) + signals.accessWeight * accessScore(candidate.record);
@@ -14312,20 +15068,20 @@ function rankRecall(candidates, signals) {
 }
 
 // src/memory/temporal.ts
-function isTransactionActiveAt(record, asOf) {
-  return record.invalidatedAt === null || record.invalidatedAt > asOf;
+function isTransactionActiveAt(record2, asOf) {
+  return record2.invalidatedAt === null || record2.invalidatedAt > asOf;
 }
-function isValidAt(record, asOf) {
-  if (record.validFrom > asOf) {
+function isValidAt(record2, asOf) {
+  if (record2.validFrom > asOf) {
     return false;
   }
-  return record.validUntil === null || record.validUntil > asOf;
+  return record2.validUntil === null || record2.validUntil > asOf;
 }
-function isActiveAt(record, asOf) {
-  return isTransactionActiveAt(record, asOf) && isValidAt(record, asOf);
+function isActiveAt(record2, asOf) {
+  return isTransactionActiveAt(record2, asOf) && isValidAt(record2, asOf);
 }
 function filterActive(records, asOf) {
-  return records.filter((record) => isActiveAt(record, asOf));
+  return records.filter((record2) => isActiveAt(record2, asOf));
 }
 function coalesceWindow(a, b) {
   const validFrom = Math.min(a.validFrom, b.validFrom);
@@ -14361,21 +15117,21 @@ function cosineSimilarity(a, b) {
 }
 
 // src/memory/recall.ts
-function matchesScope(record, query) {
-  if (record.ownerKey === query.ownerKey) {
+function matchesScope(record2, query) {
+  if (record2.ownerKey === query.ownerKey) {
     return true;
   }
-  return query.includeShared && record.ownerKey === SHARED_OWNER_KEY;
+  return query.includeShared && record2.ownerKey === SHARED_OWNER_KEY;
 }
 function recall(records, queryEmbedding, query, deps) {
   const asOf = query.asOf ?? deps.now;
   const kinds = new Set(query.kinds);
   const candidates = [];
-  for (const record of filterActive(records, asOf)) {
-    if (!kinds.has(record.kind) || !matchesScope(record, query)) {
+  for (const record2 of filterActive(records, asOf)) {
+    if (!kinds.has(record2.kind) || !matchesScope(record2, query)) {
       continue;
     }
-    const embedding = deps.embeddings.get(record.id);
+    const embedding = deps.embeddings.get(record2.id);
     if (embedding === undefined) {
       continue;
     }
@@ -14383,7 +15139,7 @@ function recall(records, queryEmbedding, query, deps) {
     if (similarity < query.minSimilarity) {
       continue;
     }
-    candidates.push({ record, similarity });
+    candidates.push({ record: record2, similarity });
   }
   const signals = {
     now: deps.now,
@@ -14573,11 +15329,11 @@ function emptyState() {
   return { facts: [], preferences: [], entities: [], relations: [] };
 }
 function applyTombstone(state, tombstone) {
-  const mark = (records) => records.map((record) => record.id === tombstone.id ? {
-    ...record,
+  const mark = (records) => records.map((record2) => record2.id === tombstone.id ? {
+    ...record2,
     invalidatedAt: tombstone.invalidatedAt,
     supersededBy: tombstone.supersededBy
-  } : record);
+  } : record2);
   if (tombstone.kind === "fact") {
     state.facts = mark(state.facts);
   } else if (tombstone.kind === "preference") {
@@ -14617,8 +15373,8 @@ function allRecords(state) {
 }
 
 // src/memory/log.ts
-function serializeAssertion(record) {
-  return JSON.stringify(record);
+function serializeAssertion(record2) {
+  return JSON.stringify(record2);
 }
 function parseMemoryLog(text2) {
   const records = [];
@@ -14680,8 +15436,8 @@ function insertRecords(db, records) {
   const stmt = db.query(INSERT_SQL2);
   db.run("BEGIN");
   try {
-    for (const record of records) {
-      stmt.run(record.id, record.kind, record.ownerKey, record.createdAt, record.invalidatedAt, JSON.stringify(record));
+    for (const record2 of records) {
+      stmt.run(record2.id, record2.kind, record2.ownerKey, record2.createdAt, record2.invalidatedAt, JSON.stringify(record2));
     }
     db.run("COMMIT");
   } catch (error) {
@@ -14734,15 +15490,15 @@ function createMemoryIndex(db, warn) {
     const preferences = [];
     const entities = [];
     const relations = [];
-    for (const record of allRecordsWithWarning()) {
-      if (record.kind === "fact") {
-        facts.push(record);
-      } else if (record.kind === "preference") {
-        preferences.push(record);
-      } else if (record.kind === "entity") {
-        entities.push(record);
+    for (const record2 of allRecordsWithWarning()) {
+      if (record2.kind === "fact") {
+        facts.push(record2);
+      } else if (record2.kind === "preference") {
+        preferences.push(record2);
+      } else if (record2.kind === "entity") {
+        entities.push(record2);
       } else {
-        relations.push(record);
+        relations.push(record2);
       }
     }
     return { facts, preferences, entities, relations };
@@ -14881,31 +15637,31 @@ function createLocalEmbedder(request, deps) {
 function normalize(parts) {
   return parts.map((part) => part.trim()).filter((part) => part.length > 0).join(" ");
 }
-function recordEmbeddingText(record) {
-  if (record.kind === "fact") {
+function recordEmbeddingText(record2) {
+  if (record2.kind === "fact") {
     return normalize([
-      record.subject,
-      record.predicate,
-      record.object,
-      record.category ?? ""
+      record2.subject,
+      record2.predicate,
+      record2.object,
+      record2.category ?? ""
     ]);
   }
-  if (record.kind === "preference") {
+  if (record2.kind === "preference") {
     return normalize([
-      record.category,
-      record.preference,
-      record.context ?? ""
+      record2.category,
+      record2.preference,
+      record2.context ?? ""
     ]);
   }
-  if (record.kind === "relation") {
+  if (record2.kind === "relation") {
     return normalize([
-      record.from,
-      record.predicate,
-      record.to,
-      record.annotation ?? ""
+      record2.from,
+      record2.predicate,
+      record2.to,
+      record2.annotation ?? ""
     ]);
   }
-  return normalize([record.canonicalName, record.type, ...record.aliases]);
+  return normalize([record2.canonicalName, record2.type, ...record2.aliases]);
 }
 
 // src/storage/index/memoryEmbeddings.ts
@@ -14921,7 +15677,7 @@ async function ensureMemoryEmbeddings(deps) {
   const records = index.allRecords();
   index.pruneEmbeddings();
   const have = modelChanged ? new Set : new Set(index.embeddingMap().keys());
-  const todo = records.filter((record) => !have.has(record.id));
+  const todo = records.filter((record2) => !have.has(record2.id));
   if (todo.length === 0) {
     return { embedded: 0, failed: 0, modelChanged };
   }
@@ -14937,8 +15693,8 @@ async function ensureMemoryEmbeddings(deps) {
     warn(`[openteam] could not compute embeddings for ${todo.length} memory record(s): ` + `the embedder returned ${vectors.length} vector(s). Recall over them is unavailable.`);
     return { embedded: 0, failed: todo.length, modelChanged };
   }
-  const entries = todo.map((record, position) => ({
-    recordId: record.id,
+  const entries = todo.map((record2, position) => ({
+    recordId: record2.id,
     vector: vectors[position]
   }));
   index.putEmbeddings(entries);
@@ -14987,7 +15743,7 @@ async function buildMemoryRuntimeFromConfig(config, deps, options = {}) {
 // package.json
 var package_default = {
   name: "@jmanuelcorral/openteam",
-  version: "0.18.0",
+  version: "0.19.0",
   packageManager: "bun@1.3.14",
   description: "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   license: "MIT",
@@ -15178,30 +15934,30 @@ function isMissingFile(error) {
 }
 
 // src/memory/traverse.ts
-function inOwnerScope(record, ownerKey, includeShared) {
-  if (record.ownerKey === ownerKey) {
+function inOwnerScope(record2, ownerKey, includeShared) {
+  if (record2.ownerKey === ownerKey) {
     return true;
   }
-  return includeShared && record.ownerKey === SHARED_OWNER_KEY;
+  return includeShared && record2.ownerKey === SHARED_OWNER_KEY;
 }
 function traverseRelations(records, query) {
   const includeShared = query.includeShared ?? true;
   const adjacency = new Map;
-  for (const record of records) {
-    if (record.kind !== "relation") {
+  for (const record2 of records) {
+    if (record2.kind !== "relation") {
       continue;
     }
-    if (!isActiveAt(record, query.asOf)) {
+    if (!isActiveAt(record2, query.asOf)) {
       continue;
     }
-    if (!inOwnerScope(record, query.ownerKey, includeShared)) {
+    if (!inOwnerScope(record2, query.ownerKey, includeShared)) {
       continue;
     }
-    const list = adjacency.get(record.from);
+    const list = adjacency.get(record2.from);
     if (list === undefined) {
-      adjacency.set(record.from, [record]);
+      adjacency.set(record2.from, [record2]);
     } else {
-      list.push(record);
+      list.push(record2);
     }
   }
   const visited = new Set([query.seed]);
@@ -15232,8 +15988,8 @@ function traverseRelations(records, query) {
   }
   return { seed: query.seed, nodes, edges };
 }
-function seedNodeId(record) {
-  return record.kind === "entity" ? record.canonicalName : undefined;
+function seedNodeId(record2) {
+  return record2.kind === "entity" ? record2.canonicalName : undefined;
 }
 function recallGraph(records, queryEmbedding, query, options, deps) {
   const seeds = recall(records, queryEmbedding, query, deps);
@@ -15529,32 +16285,32 @@ function projectRelationGraph(graph) {
   };
 }
 function projectRecall(results) {
-  return results.map(({ record, similarity, score }) => {
+  return results.map(({ record: record2, similarity, score }) => {
     const base = {
-      id: record.id,
-      kind: record.kind,
-      ownerKey: record.ownerKey,
-      confidence: record.confidence,
+      id: record2.id,
+      kind: record2.kind,
+      ownerKey: record2.ownerKey,
+      confidence: record2.confidence,
       similarity,
       score
     };
-    if (record.kind === "fact") {
+    if (record2.kind === "fact") {
       return {
         ...base,
-        subject: record.subject,
-        predicate: record.predicate,
-        object: record.object,
-        category: record.category
+        subject: record2.subject,
+        predicate: record2.predicate,
+        object: record2.object,
+        category: record2.category
       };
     }
-    if (record.kind === "preference") {
+    if (record2.kind === "preference") {
       return {
         ...base,
-        category: record.category,
-        preference: record.preference
+        category: record2.category,
+        preference: record2.preference
       };
     }
-    const entity = record;
+    const entity = record2;
     return { ...base, canonicalName: entity.canonicalName, type: entity.type };
   });
 }
@@ -15729,24 +16485,24 @@ var DEFAULT_DECAY_PARAMS = {
   halfLifeMs: 90 * DAY_MS2,
   forgetThreshold: 0.05
 };
-function lastReinforcedAt(record) {
-  if (record.kind === "preference" && record.lastAccessedAt !== null) {
-    return record.lastAccessedAt;
+function lastReinforcedAt(record2) {
+  if (record2.kind === "preference" && record2.lastAccessedAt !== null) {
+    return record2.lastAccessedAt;
   }
-  return record.createdAt;
+  return record2.createdAt;
 }
-function decayedConfidence(record, now, params = DEFAULT_DECAY_PARAMS) {
-  const ageMs = Math.max(0, now - lastReinforcedAt(record));
-  return record.confidence * 0.5 ** (ageMs / params.halfLifeMs);
+function decayedConfidence(record2, now, params = DEFAULT_DECAY_PARAMS) {
+  const ageMs = Math.max(0, now - lastReinforcedAt(record2));
+  return record2.confidence * 0.5 ** (ageMs / params.halfLifeMs);
 }
 function consolidate(records, now, params = DEFAULT_DECAY_PARAMS) {
   const tombstones = [];
-  for (const record of records) {
-    if (!isTransactionActiveAt(record, now)) {
+  for (const record2 of records) {
+    if (!isTransactionActiveAt(record2, now)) {
       continue;
     }
-    if (decayedConfidence(record, now, params) < params.forgetThreshold) {
-      tombstones.push({ ...record, invalidatedAt: now, supersededBy: null });
+    if (decayedConfidence(record2, now, params) < params.forgetThreshold) {
+      tombstones.push({ ...record2, invalidatedAt: now, supersededBy: null });
     }
   }
   return tombstones;
@@ -15861,17 +16617,21 @@ async function loadConfig(path4, resolution = { explicit: false }) {
     read: (requestedPath) => requestedPath === path4 ? readConfigFile(path4, resolution) : storage.read(requestedPath)
   } : storage;
   const overlayPath = resolution.explicit ? null : DEFAULT_LOCAL_OVERLAY_PATH;
-  return (await loadRuntimeOpenTeamConfig(configStorage, undefined, path4, overlayPath)).config;
+  const loaded = await loadRuntimeOpenTeamConfig(configStorage, undefined, path4, overlayPath);
+  for (const deprecation of loaded.deprecations) {
+    console.warn(deprecation.message);
+  }
+  return loaded.config;
 }
 async function saveConfig(config, path4, resolution = { explicit: false }) {
   if (!resolution.explicit) {
     await writeOpenTeamConfigFile(config, path4, storage);
     return;
   }
+  const contents = serializeOpenTeamConfig(config);
   const diskPath = resolve6(path4);
   await mkdir2(dirname6(diskPath), { recursive: true });
-  await writeFile2(diskPath, `${JSON.stringify(config, null, 2)}
-`, "utf8");
+  await writeFile2(diskPath, contents, "utf8");
 }
 function parseConfigSelection(argv) {
   for (let i = 0;i < argv.length; i += 1) {