@lmctl-ai/lmctl 0.1.324 → 0.1.325

package/dist/cli/schema.sql

@@ -859,3 +859,18 @@ CREATE INDEX IF NOT EXISTS idx_invocation_state_target_status
   ON invocation_state(target_teamfile, target_alias, status, launch_source);
 CREATE INDEX IF NOT EXISTS idx_invocation_state_from_time
   ON invocation_state(from_identity, started_at DESC);
+
+-- v59: source-generation identity. A single-row, non-secret random id assigned
+-- ONCE at migration time. Every lmctl-issued reference (invocation/provider-
+-- session/mail ref) binds to it so a ref minted against one ledger can never
+-- silently resolve against an unrelated or recovered one. The singleton CHECK
+-- makes >1 row structurally impossible; the row itself is inserted by
+-- migrate()'s ensureLedgerIdentity (fresh create AND upgrade paths).
+-- DELIBERATELY EXCLUDED from the db-recovery salvage set (salvageEssentialConfig
+-- copies only root_team + lmctl_config): a salvage-into-fresh-db is a NEW ledger
+-- and must mint a NEW id; only a full-file backup restore retains this row.
+CREATE TABLE IF NOT EXISTS state_ledger_identity (
+  singleton   INTEGER PRIMARY KEY CHECK (singleton = 1),
+  instance_id TEXT NOT NULL,
+  created_at  TEXT NOT NULL
+);

package/durable-memory/model_selection.md

@@ -21,6 +21,17 @@ For `.lmctl` teamfile compatibility mode:
   user-defined, not a fixed vendor catalog, so a hardcoded list in this
   doc would be wrong for every user whose aliases differ. See the
   `## Kimi` section below.
+- `hermes` model ids are the ENCODED `<provider>:<model>` form Hermes's
+  ACP server advertises (`acp_adapter/model_catalog.py`). lmctl sends the
+  value through ACP `session/set_model` and does NOT maintain a Hermes
+  model list to validate against: Hermes resolves models at runtime from
+  its own provider config + auth, so any hardcoded list here would be
+  wrong for most users. Lint warns only when `model=` has no `provider:`
+  prefix. Hermes only treats a leading `<x>:` as a provider delimiter when
+  `x` is a known provider name (`hermes_cli/models.py:parse_model_input`);
+  a bare id stays the model name and Hermes then has to infer the provider
+  by detection, which fails for models it cannot place. See the `## Hermes`
+  section below.
 - `copilot` accepts `model=` syntactically, but model selection is not
   supported and lint warns that the value is ignored.
 - `lmctl seed <teamfile>` passes `model=` through to the provider seed
@@ -54,11 +65,24 @@ or retiring tested model ids.
 | `gpt-5.4` | Ported from lmctl0 tested-model catalog. |
 | `gpt-5.5` | Ported from lmctl0 tested-model catalog. |
 | `gpt-5.6-sol` | Operator-confirmed for Codex review team use on 2026-07-19. |
-| `gpt-5.4-mini` | Ported from lmctl0 tested-model catalog. |
 | `gpt-5.3-codex` | Ported from lmctl0 tested-model catalog. |
 | `gpt-5.3-codex-spark` | Ported from lmctl0 tested-model catalog. Banned as a build model by the operator (2026-09-06, plenty of regular-GPT quota headroom) -- `lmctl lint` now warns on explicit `model=gpt-5.3-codex-spark` for build work; kept in this tested list since it's still a real, valid model for genuinely non-build (classification-only) use. |
 | `gpt-6-astra` | Operator seeding for evaluation, 2026-09-06. |
 
+**Retired:** `gpt-5.4-mini` -- removed 2026-09-15 after a real fleet incident:
+the model was withdrawn from the OpenAI subscription while 194 codex members
+across ~90 teamfiles had no `model=` pinned and were falling through to it
+as the ambient default (unrelated to this catalog directly, but the SAME
+stale id was also still listed here as "tested", so `lmctl lint` would have
+passed the exact configuration that was failing in production). Unlike
+`claude-fable-5` above (suspended, may return, kept valid), this id was
+withdrawn outright and is not expected back -- do not re-add without fresh
+operator/production confirmation it works again. Codex has no live model
+catalog to check against (unlike `agy`/`opencode`, which query the
+installed provider CLI directly) -- see the code comment on
+`BUILTIN_TESTED_MODELS.codex` for why, and keep this table and that array
+synchronized by hand until/unless a live check becomes possible for codex.
+
 ## Gemini
 
 | Configured `model=` | Evidence |
@@ -198,3 +222,41 @@ _MEMBER_ alias=Reviewer provider=kimi model="kimi-code/k3" sessionid=<seeded-id>
 | `claude` | Claude Code has native `--effort`, but lmctl has not wired `_MEMBER_ effort=` to Claude yet. |
 | `codex` | Native effort surfaces exist; lmctl has not wired `_MEMBER_ effort=` to Codex yet. |
 | `agy` | No verified effort flag; only `--model` supported. |
+| `hermes` | Not supported. Hermes exposes reasoning effort through its own config (`--reasoning`) but not through its ACP surface, so lmctl ignores `effort=` for a Hermes member and warns. |
+
+## Hermes
+
+Hermes is driven over ACP (`hermes acp`), and its ACP model ids are the
+encoded `provider:model` strings it advertises in `session/new`
+(`acp_adapter/model_catalog.py`, `encode_model_choice`). lmctl applies
+`model=` with ACP `session/set_model` when it differs from the loaded model.
+
+```md
+_MEMBER_ alias=Reviewer provider=hermes model="deepseek:deepseek-v4.1-flash" sessionid=<uuid>
+```
+
+There is deliberately **no** tested-model table here. Hermes resolves its
+model inventory at runtime from the user's own provider configuration and
+credentials, so a list in this repository would be wrong for most users —
+the same reasoning as `kimi` and `opencode`. Lint checks the SHAPE only:
+the value should carry a `provider:` prefix, because without one Hermes
+has to infer the provider by model-name detection and fails for models it
+cannot place.
+
+V1 supports ACP seeding and structured chat/dispatch against one effective
+`HERMES_HOME`. Existing session IDs default to strict resume. Yolo mode enables
+both the shell approval bypass and the per-process ACP edit mode; plan mode is
+rejected. Native deletion, interactive resume, fork, and persistent daemon
+sessions are not supported by this integration. The reader is read-only and
+shows active transcript rows; token totals do not establish last-turn usage.
+
+Release prerequisites: Hermes must return JSON-RPC errors for missing load/resume
+IDs. Task 140 also uncovered an ACP compression-head restore defect: restart-safe
+resume after compression requires a separate Hermes fix before this provider lands.
+
+The source fixes are reviewed and committed locally in the Hermes checkout as
+`989fd87461e23493fe62250b1671f9fc368e9117`. This is not an upstream release or an
+installed-runtime update: the current GitHub identity has read-only access to
+NousResearch/hermes-agent, and validation used the fixed checkout explicitly.
+Provider publication remains gated on an approved, available patched Hermes
+runtime and final owner landing approval (task 141 notes 548-549).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lmctl-ai/lmctl",
-  "version": "0.1.324",
+  "version": "0.1.325",
   "description": "A provider-agnostic control plane for teams of AI coding agents — across providers, with independent review and durable memory.",
   "type": "module",
   "homepage": "https://lmctl.com",