@junghanacs/entwurf 0.30.0 → 0.31.0

package/scripts/pi-durable-contact-host.mjs

@@ -0,0 +1,105 @@
+// G-contact host half (#129 L-identity). Runs AS the durable host, under the pinned overlay
+// checkout's source resolver, and is spawned only by scripts/check-pi-durable-contact.ts:
+//
+//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//        scripts/pi-durable-contact-host.mjs <bridge entry> new|continue \
+//        [<sessions dir> <senders dir> <mailbox dir> <receivers dir>]
+//
+// The four optional directories are explicit garden roots handed to the contact, all or none;
+// without them the contact uses the shared roots its environment selects.
+//
+// With ENTWURF_PI_DURABLE_CONTACT_FAULT=malformed-report (set only by the gate's control) the report
+// line is deliberately not JSON.
+//
+// It opens the durable app through the production bootstrap composition (`openDurableCitizen`),
+// then executes the contact's registered tools DIRECTLY — adapter-direct, harness-bypassed: no
+// model turn and no ToolTask, so this proves the adapter's bridge contact, not the harness
+// selecting or validating the tool. The report carries the contact's own `receiver()` state, never
+// the path the attachment returned. It prints one JSON report line, holds the host and its
+// bridge child alive until the orchestrator writes `close` (so /proc can be read from outside),
+// closes, prints `{"closed":true}` and exits.
+//
+// The bridge's environment is observed at the SDK connector boundary only: the contact's existing
+// `connect` injection wraps the COMPILED production `connectStdioBridge`, records the spawn spec's
+// command/args/cwd, whether each of the four poisoned identity carrier NAMES is present, and the
+// four root carrier VALUES — nothing else of the env — and forwards the spec unchanged to that real
+// connector. It is the spec the adapter hands the SDK, not the kernel child environment; no
+// /proc/<pid>/environ is read anywhere.
+import { createInterface } from "node:readline";
+import { connectStdioBridge } from "../mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js";
+import { openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
+
+const IDENTITY_CARRIERS = ["PI_SESSION_ID", "PI_AGENT_ID", "ENTWURF_META_SENDER_MARKER", "ENTWURF_BRIDGE_NATIVE_HOST"];
+const ROOT_CARRIERS = [
+	"ENTWURF_META_SESSIONS_DIR",
+	"ENTWURF_META_SENDERS_DIR",
+	"ENTWURF_META_MAILBOX_DIR",
+	"ENTWURF_META_RECEIVERS_DIR",
+];
+const bridgeSpecs = [];
+const connect = async (spec) => {
+	bridgeSpecs.push({
+		command: spec.command,
+		args: [...spec.args],
+		cwd: spec.cwd,
+		identityCarrierPresent: Object.fromEntries(IDENTITY_CARRIERS.map((name) => [name, Object.hasOwn(spec.env, name)])),
+		rootCarriers: Object.fromEntries(ROOT_CARRIERS.map((name) => [name, spec.env[name] ?? null])),
+	});
+	return connectStdioBridge(spec);
+};
+
+const [bridgeEntry, mode, ...rootArgs] = process.argv.slice(2);
+if (bridgeEntry === undefined || (mode !== "new" && mode !== "continue") || ![0, 4].includes(rootArgs.length)) {
+	throw new Error(
+		"usage: pi-durable-contact-host.mjs <bridge entry> new|continue [<sessions dir> <senders dir> <mailbox dir> <receivers dir>]",
+	);
+}
+const [sessionsDir, sendersDir, mailboxDir, receiversDir] = rootArgs;
+
+const citizen = await openDurableCitizen({
+	bridgeEntry,
+	continueSession: mode === "continue",
+	cwd: process.cwd(),
+	contact: rootArgs.length === 0 ? { connect } : { sessionsDir, sendersDir, mailboxDir, receiversDir, connect },
+});
+let code = 0;
+try {
+	const run = async (name) => {
+		const tool = citizen.contact.extension.tools.find((t) => t.name === name);
+		if (tool === undefined) throw new Error(`the contact registers no ${name}`);
+		const result = await tool.execute({}, undefined, {});
+		return result.content.map((block) => block.text).join("\n");
+	};
+	const view = citizen.durable.view.current();
+	const report = {
+		hostPid: process.pid,
+		session: view.session,
+		attachment: citizen.attachment,
+		receiver: citizen.contact.receiver(),
+		toolNames: citizen.contact.extension.tools.map((t) => t.name),
+		bridgeSpecs,
+		self: await run("entwurf_self"),
+		peers: await run("entwurf_peers"),
+		notices: view.notices.map((n) => `${n.level}: ${n.message}`),
+	};
+	// The gate's malformed-report control: the report line is deliberately not JSON.
+	if (process.env.ENTWURF_PI_DURABLE_CONTACT_FAULT === "malformed-report") {
+		process.stdout.write(`{"malformed report line\n`);
+	} else {
+		process.stdout.write(`${JSON.stringify(report)}\n`);
+	}
+	const lines = createInterface({ input: process.stdin });
+	for await (const line of lines) if (line.trim() === "close") break;
+} catch (error) {
+	code = 1;
+	// The failure report keeps its cause first and carries, beside it, only the host pid and the same
+	// connector-boundary record the success report has — so the gate can judge the scrub/root QKs before
+	// it throws this error. It is never a success: no attachment, self, peers or session is reported.
+	process.stdout.write(
+		`${JSON.stringify({ error: error instanceof Error ? error.message : String(error), hostPid: process.pid, bridgeSpecs })}\n`,
+	);
+} finally {
+	await citizen.close();
+}
+process.stdout.write(`${JSON.stringify({ closed: true })}\n`);
+process.exit(code);

package/scripts/pi-durable-receive-host.mjs

@@ -0,0 +1,127 @@
+// G-receive host half (#129 L-receive). Runs AS the durable host, under the pinned overlay checkout's
+// source resolver, and is spawned only by scripts/check-pi-durable-receive.ts:
+//
+//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//        scripts/pi-durable-receive-host.mjs <bridge entry>
+//
+// It opens the durable app through the production bootstrap composition — which arms the contact's
+// doorbell on the root conversation — reports `born`, and then gives the app NO input: no controller
+// call, no tool call, no bridge call, no native state of its own. Whatever runs afterwards was
+// started by the doorbell's root admission. The driver only watches the native view and the
+// contact's own `receiver()` state (never the path the attachment returned, which a later retire
+// can make stale), and reports once:
+//
+//   - the receiver has made an admission, the view holds an assistant entry after the newest user
+//     entry that calls no tool, and the conversation is no longer busy; or
+//   - the receiver is no longer armed; or
+//   - the app raised an error notice.
+//
+// Then it holds the host alive until the gate writes `close`, closes, prints `{"closed":true}` and
+// exits.
+import { createInterface } from "node:readline";
+import { openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
+
+const USAGE = "usage: pi-durable-receive-host.mjs <bridge entry>";
+const [bridgeEntry, ...extra] = process.argv.slice(2);
+if (bridgeEntry === undefined || extra.length > 0) throw new Error(USAGE);
+
+const stdinLines = createInterface({ input: process.stdin })[Symbol.asyncIterator]();
+/** Wait for one exact line from the gate; the gate closing stdin first is a failure. */
+async function waitFor(word) {
+	for (;;) {
+		const next = await stdinLines.next();
+		if (next.done) throw new Error(`stdin closed before "${word}"`);
+		if (next.value.trim() === word) return;
+	}
+}
+
+/** One entry of the native view, reduced to what the gate compares (the send driver's reduction). */
+function summarize(entry) {
+	const message = entry.model?.[0];
+	const blocks = Array.isArray(message?.content) ? message.content : [];
+	const text = (typeof message?.content === "string" ? [message.content] : [])
+		.concat(blocks.flatMap((b) => (b.type === "text" ? [b.text] : [])))
+		.join("\n");
+	return {
+		id: entry.id,
+		kind: entry.kind,
+		role: message?.role,
+		toolCalls: blocks
+			.filter((b) => b.type === "toolCall")
+			.map((b) => ({ id: b.id, name: b.name, arguments: b.arguments })),
+		...(message?.role === "toolResult"
+			? {
+					toolCallId: message.toolCallId,
+					toolName: message.toolName,
+					isError: message.isError === true,
+					diagnostics: Array.isArray(entry.data?.diagnostics) ? entry.data.diagnostics : [],
+				}
+			: {}),
+		text,
+	};
+}
+
+const citizen = await openDurableCitizen({ bridgeEntry, cwd: process.cwd() });
+
+function reportOf(view, why) {
+	return {
+		settled: why,
+		hostPid: process.pid,
+		session: view.session,
+		conversationId: view.conversation.conversation.id,
+		receiver: citizen.contact.receiver(),
+		entries: view.conversation.entries.filter((e) => e.kind.startsWith("pi.")).map(summarize),
+		busy: view.conversation.docs["pi.live"]?.run !== undefined,
+		notices: view.notices.map((n) => `${n.level}: ${n.message}`),
+	};
+}
+
+let code = 0;
+try {
+	const { durable } = citizen;
+	const born = durable.view.current();
+	const noticesBefore = born.notices.length;
+	process.stdout.write(
+		`${JSON.stringify({
+			born: true,
+			hostPid: process.pid,
+			session: born.session,
+			conversationId: born.conversation.conversation.id,
+			attachment: citizen.attachment,
+			receiver: citizen.contact.receiver(),
+		})}\n`,
+	);
+	const why = await new Promise((resolve) => {
+		let done = false;
+		const check = () => {
+			if (done) return;
+			const view = durable.view.current();
+			const receiver = citizen.contact.receiver();
+			const entries = view.conversation.entries;
+			const lastUser = entries.findLastIndex((e) => e.kind === "pi.user");
+			const lastAnswer =
+				lastUser < 0 ? undefined : entries.slice(lastUser + 1).findLast((e) => e.kind === "pi.assistant");
+			const answered = lastAnswer !== undefined && summarize(lastAnswer).toolCalls.length === 0;
+			const busy = view.conversation.docs["pi.live"]?.run !== undefined;
+			let outcome;
+			if (receiver.status !== "armed") outcome = "receiver-not-armed";
+			else if (view.notices.slice(noticesBefore).some((n) => n.level === "error")) outcome = "error-notice";
+			else if (receiver.admissions.length > 0 && answered && !busy) outcome = "answered";
+			if (outcome === undefined) return;
+			done = true;
+			unsubscribe();
+			resolve(outcome);
+		};
+		const unsubscribe = durable.view.subscribe(check);
+		check();
+	});
+	process.stdout.write(`${JSON.stringify(reportOf(durable.view.current(), why))}\n`);
+	await waitFor("close");
+} catch (error) {
+	code = 1;
+	process.stdout.write(`${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+} finally {
+	await citizen.close();
+}
+process.stdout.write(`${JSON.stringify({ closed: true })}\n`);
+process.exit(code);

package/scripts/pi-durable-send-host.mjs

@@ -0,0 +1,213 @@
+// G-send host half (#129 L-send first cell). Runs AS the durable host, under the pinned overlay
+// checkout's source resolver, and is spawned only by scripts/check-pi-durable-send.ts:
+//
+//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//        scripts/pi-durable-send-host.mjs <bridge entry> <prompt>
+//
+// It opens the durable app through the production bootstrap composition, then gives the app ONE
+// user input through its native controller — the call its TUI makes when the operator presses
+// enter — and watches only the native view. Everything after that input is the app's own: the
+// model request, the GenerationTask, the ToolTask, the adapter's bridge call. This driver never
+// calls a tool or the bridge itself.
+//
+// `controller.submit` settling is NOT the turn completing: the controller queues the command and
+// turns its failures into notices (runtime.ts:229-252). The driver waits on the view instead —
+// the run document is present exactly while the conversation is busy — and reports what the view
+// holds. It prints one JSON report line, holds the host alive until the gate writes `close`,
+// closes, prints `{"closed":true}` and exits. With ENTWURF_PI_DURABLE_SEND_FAULT=malformed-report
+// (the gate's control) it gives the app no input and sends a non-JSON report line instead.
+import { createInterface } from "node:readline";
+import { openDurableCitizen } from "../plugins/pi-durable/bootstrap.mjs";
+
+const USAGE =
+	"usage: pi-durable-send-host.mjs <bridge entry> <prompt> [--await-go] [--report-intent <callId> | --recover <callId>]";
+const [bridgeEntry, prompt, ...flags] = process.argv.slice(2);
+if (bridgeEntry === undefined || prompt === undefined) throw new Error(USAGE);
+// --await-go: report `born` once the citizen exists, and give the app its one input only after the
+// gate writes `go` — test-driver sequencing so the gate can read the bridge's counters first. It is
+// not a second input and not another controller.
+// --report-intent <callId>: after the input, watch the native view and report ONCE the frame in
+// which the task graph shows a `pi.tool` node running in phase `execute` and the live slot with the
+// same taskId is that call, running. The phase is the task's committed checkpoint (task-graph.ts
+// 210-221), written in the same commit as the slot (tool.ts 84-90). Then do nothing: the gate kills
+// this process.
+// --recover <callId>: continue the newest session, give the app NO input, and report once the view
+// holds that call's settled result and the conversation is idle.
+let awaitGo = false;
+let reportIntent;
+let recoverCall;
+for (let i = 0; i < flags.length; i++) {
+	if (flags[i] === "--await-go") awaitGo = true;
+	else if (flags[i] === "--report-intent" && flags[i + 1] !== undefined) reportIntent = flags[++i];
+	else if (flags[i] === "--recover" && flags[i + 1] !== undefined) recoverCall = flags[++i];
+	else throw new Error(USAGE);
+}
+if (reportIntent !== undefined && recoverCall !== undefined) throw new Error(USAGE);
+
+const stdinLines = createInterface({ input: process.stdin })[Symbol.asyncIterator]();
+/** Wait for one exact line from the gate; the gate closing stdin first is a failure. */
+async function waitFor(word) {
+	for (;;) {
+		const next = await stdinLines.next();
+		if (next.done) throw new Error(`stdin closed before "${word}"`);
+		if (next.value.trim() === word) return;
+	}
+}
+
+/** One entry of the native view, reduced to what the gate compares. */
+function summarize(entry) {
+	const message = entry.model?.[0];
+	const blocks = Array.isArray(message?.content) ? message.content : [];
+	const text = (typeof message?.content === "string" ? [message.content] : [])
+		.concat(blocks.flatMap((b) => (b.type === "text" ? [b.text] : [])))
+		.join("\n");
+	return {
+		kind: entry.kind,
+		role: message?.role,
+		toolCalls: blocks
+			.filter((b) => b.type === "toolCall")
+			.map((b) => ({ id: b.id, name: b.name, arguments: b.arguments })),
+		...(message?.role === "toolResult"
+			? {
+					toolCallId: message.toolCallId,
+					toolName: message.toolName,
+					isError: message.isError === true,
+					// The entry's own diagnostics (`data.diagnostics`), copied as they are.
+					diagnostics: Array.isArray(entry.data?.diagnostics) ? entry.data.diagnostics : [],
+				}
+			: {}),
+		text,
+	};
+}
+
+const citizen = await openDurableCitizen({
+	bridgeEntry,
+	cwd: process.cwd(),
+	continueSession: recoverCall !== undefined,
+});
+
+/** The frame the gate needs: graph node + same-task live slot, as the native view holds them. */
+function intentFrame(view, callId) {
+	const nodes = Object.values(view.tasks?.tasks ?? {});
+	const slots = view.conversation.docs["pi.live"]?.tools ?? [];
+	for (const node of nodes) {
+		if (node.kind !== "pi.tool" || node.conversationId !== 1) continue;
+		if (node.state?.status !== "running" || node.state?.phase !== "execute") continue;
+		const slot = slots.find((s) => s.taskId === node.id);
+		if (slot && slot.name === "entwurf_v2" && slot.callId === callId && slot.status === "running") {
+			return { node, slot, nodes, slots };
+		}
+	}
+	return undefined;
+}
+
+function reportOf(view, before) {
+	return {
+		hostPid: process.pid,
+		session: view.session,
+		attachment: citizen.attachment,
+		conversationIdBefore: before.conversation.conversation.id,
+		conversationIdAfter: view.conversation.conversation.id,
+		entries: view.conversation.entries.filter((e) => e.kind.startsWith("pi.")).map(summarize),
+		busy: view.conversation.docs["pi.live"]?.run !== undefined,
+		notices: view.notices.map((n) => `${n.level}: ${n.message}`),
+	};
+}
+let code = 0;
+try {
+	if (process.env.ENTWURF_PI_DURABLE_SEND_FAULT === "malformed-report") {
+		// The gate's before-valid-report cleanup control: born, no input given to the app, a report
+		// line that is deliberately not JSON, then alive until told to close.
+		process.stdout.write(`{"malformed send report line\n`);
+		await waitFor("close");
+		throw new Error("malformed-report control closed");
+	}
+	const { durable } = citizen;
+	if (recoverCall !== undefined) {
+		// Recovery may already have run inside openDurable (resume precedes attach): check the current
+		// view as well as every later one, so a settled outcome is never missed.
+		const before = durable.view.current();
+		await new Promise((resolve) => {
+			let done = false;
+			const check = () => {
+				if (done) return;
+				const view = durable.view.current();
+				const entries = view.conversation.entries;
+				const resultAt = entries.findIndex(
+					(e) => e.kind === "pi.tool-result" && e.model?.[0]?.toolCallId === recoverCall,
+				);
+				const answeredAfter = resultAt >= 0 && entries.slice(resultAt + 1).some((e) => e.kind === "pi.assistant");
+				const busy = view.conversation.docs["pi.live"]?.run !== undefined;
+				const failed = view.notices.some((n) => n.level === "error");
+				if ((answeredAfter && !busy) || failed) {
+					done = true;
+					unsubscribe();
+					resolve();
+				}
+			};
+			const unsubscribe = durable.view.subscribe(check);
+			check();
+		});
+		process.stdout.write(`${JSON.stringify({ recovered: true, ...reportOf(durable.view.current(), before) })}\n`);
+		await waitFor("close");
+		throw new Error("__closed__");
+	}
+	if (awaitGo) {
+		process.stdout.write(
+			`${JSON.stringify({ born: true, hostPid: process.pid, attachment: citizen.attachment, session: durable.view.current().session })}\n`,
+		);
+		await waitFor("go");
+	}
+	if (reportIntent !== undefined) {
+		let reported = false;
+		const check = () => {
+			if (reported) return;
+			const view = durable.view.current();
+			const frame = intentFrame(view, reportIntent);
+			if (frame === undefined) return;
+			reported = true;
+			process.stdout.write(
+				`${JSON.stringify({ intent: true, hostPid: process.pid, session: view.session, frame, entries: view.conversation.entries.filter((e) => e.kind.startsWith("pi.")).map(summarize) })}\n`,
+			);
+		};
+		durable.view.subscribe(check);
+		durable.controller.submit(prompt, "followUp").then(check);
+		check();
+		// The gate kills this process after the frame; nothing else happens here.
+		await waitFor("close");
+		throw new Error("report-intent host was asked to close instead of being killed");
+	}
+	const before = durable.view.current();
+	const noticesBefore = before.notices.length;
+	let submitted = false;
+	const settled = new Promise((resolve) => {
+		const check = () => {
+			if (!submitted) return;
+			const view = durable.view.current();
+			const busy = view.conversation.docs["pi.live"]?.run !== undefined;
+			const answered = view.conversation.entries.some((e) => e.kind === "pi.assistant");
+			const failed = view.notices.slice(noticesBefore).some((n) => n.level === "error");
+			if ((!busy && answered) || failed) {
+				unsubscribe();
+				resolve();
+			}
+		};
+		const unsubscribe = durable.view.subscribe(check);
+		durable.controller.submit(prompt, "followUp").then(() => {
+			submitted = true;
+			check();
+		});
+	});
+	await settled;
+	process.stdout.write(`${JSON.stringify(reportOf(durable.view.current(), before))}\n`);
+	await waitFor("close");
+} catch (error) {
+	if (!(error instanceof Error && error.message === "__closed__")) {
+		code = 1;
+		process.stdout.write(`${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+	}
+} finally {
+	await citizen.close();
+}
+process.stdout.write(`${JSON.stringify({ closed: true })}\n`);
+process.exit(code);

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.79.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp, exact pin in package.json) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-herdr-fresh-call-live.ts

@@ -196,10 +196,9 @@ function transcriptRecords(file: string): string[] {
 }
 
 /**
- * The BARE verb names, as the two surfaces this smoke reads actually spell them — NOT the
- * model-facing dialect. `[측정 2026-09-20, this smoke's own red fixture]` the claude MCP activity
- * log carries `Calling MCP tool: entwurf_callback` / `Tool 'entwurf_callback' completed`, and pi
- * writes `"type":"toolCall","name":"entwurf_callback"`; neither records
+ * The verb names as the CLAUDE MCP activity log spells them — NOT the model-facing dialect.
+ * `[측정 2026-09-20, this smoke's own red fixture]` that log carries `Calling MCP tool:
+ * entwurf_callback` / `Tool 'entwurf_callback' completed`, never
  * `mcp__entwurf-bridge__entwurf_callback`. The per-host dialect is owned by
  * `FRESH_CALL_CALLBACK_TOOL` / `FRESH_CALL_DELIVERY_TOOL` in `fresh-call-composition.ts` and is
  * what the FRAMING says; these two are what an OBSERVER sees, and conflating them is what this
@@ -208,6 +207,17 @@ function transcriptRecords(file: string): string[] {
 const CALLBACK_VERB = "entwurf_callback";
 const DELIVERY_VERB = "entwurf_v2";
 
+/**
+ * The callback as a Pi 1.0 TRANSCRIPT spells it. Pi's built-in MCP is the tool ingress since
+ * 0.30.0, and Pi records the qualified name the model called. The bare `entwurf_callback` this
+ * smoke read on 2026-09-20 belonged to the retired native-tool registration; a pi→pi child that
+ * called back correctly would then never match, which is a red about the oracle, not the rail.
+ * Declared here as the OBSERVED literal, not imported from the compositor, so a change to the
+ * production framing cannot quietly move this expectation with it — the same rule as
+ * `PI_SOURCE_VERBS` in `lib/codex-fresh-source-receipts.ts`. No prefix strip, no legacy OR.
+ */
+const PI_CALLBACK_TOOL = "mcp__entwurf_bridge__entwurf_callback";
+
 /**
  * The id of the CALLBACK toolCall in this record, or null. Pi writes a call and its result as two
  * records; this is one half of the join that replaces a same-record read.
@@ -238,7 +248,9 @@ function entwurfCallIdFor(record: string, nonce: string, callerGid: string): str
 	if (!Array.isArray(content)) return null;
 	for (const part of content) {
 		const call = part as { type?: unknown; name?: unknown; id?: unknown; arguments?: unknown };
-		if (call.type !== "toolCall" || call.name !== CALLBACK_VERB) continue;
+		if (call.type !== "toolCall") continue;
+		if (call.name === CALLBACK_VERB) throw new Error(`${LABEL}: retired raw Pi tool name ${CALLBACK_VERB}`);
+		if (call.name !== PI_CALLBACK_TOOL) continue;
 		// Zero-argument verb: absent, null and `{}` are all the shape it is called with. A supplied
 		// target or message is a model naming an address the env already owns — not this act.
 		const args = call.arguments as { message?: unknown; target?: unknown } | undefined | null;
@@ -444,8 +456,10 @@ async function main(): Promise<void> {
 			childBackend: "pi",
 			callerKind: "pi",
 			childKind: "pi",
-			callerModel: "openai-codex/gpt-5.6-sol",
-			childModel: "openai-codex/gpt-5.6-sol",
+			// The approved roster's lighter Pi GPT tier (agent-config MODELS.md, 2026-09-30); gpt-5.6-sol
+			// is still in the catalog but no longer on the roster. A LIVE cost choice, not a product set.
+			callerModel: "openai-codex/gpt-6-luna",
+			childModel: "openai-codex/gpt-6-luna",
 		},
 		{
 			label: "claude→claude",