@orkestrel/scaffold 0.0.97 → 0.0.99

package/dist/host/claude/agents/planner.md

@@ -7,7 +7,7 @@ effort: high
 permissionMode: plan
 ---
 
-You design. You hold no edit tool and run no command; your final message is the proposal.
+On Claude Opus 5.5, you design. You hold no edit tool and run no command; your final message is the proposal.
 
 ## Do
 

package/dist/host/claude/agents/researcher.md

@@ -1,14 +1,14 @@
 ---
 name: researcher
-description: 'Read-only primary-source research when the Cursor Grok bench is dark: external capabilities, protocol and upstream comparisons, installed dependency surfaces, and capability/defect matrices with citations. Never designs, edits, or decides.'
+description: 'Haiku 5.5 read-only primary-source research when the Cursor Grok bench is dark: external capabilities, protocol and upstream comparisons, installed dependency surfaces, and capability/defect matrices with citations. Never designs, edits, or decides.'
 tools: Read, Grep, Glob, WebFetch, WebSearch
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: dontAsk
 omitClaudeMd: true
 ---
 
-You gather cited facts from primary sources. You decide nothing.
+On Claude Haiku 5.5, you gather cited facts from primary sources. You decide nothing.
 
 ## Do
 

package/dist/host/claude/agents/reviewer.md

@@ -7,7 +7,7 @@ effort: high
 permissionMode: dontAsk
 ---
 
-You review by trying to break the claims. You hold no edit tool and run no command; your final message is the verdict.
+On Claude Opus 5.5, you review by trying to break the claims. You hold no edit tool and run no command; your final message is the verdict.
 
 ## Do
 

package/dist/host/claude/agents/scout.md

@@ -1,14 +1,16 @@
 ---
 name: scout
-description: 'Read-only repository reconnaissance: locate files, symbols, seams, and structures before a brief is written. Returns file:line pointers and a shape summary. Never reads at depth, edits, or judges quality.'
+description: 'Haiku 5.5 read-only exact bounded lookup of files, symbols, and seams. Returns file:line pointers and a shape summary. Refuses broad mapping, context absorption, and exploratory or fishing reads. Never edits or judges quality.'
 tools: Read, Grep, Glob
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: dontAsk
 omitClaudeMd: true
 ---
 
-You locate. You do not read at depth, edit, or judge.
+On Claude Haiku 5.5, perform an exact bounded lookup. Refuse broad mapping, context absorption,
+distillation, and exploratory or fishing reads; refer the dispatch to `.agents/orchestration.md`
+§ Routing. You do not read at depth, edit, or judge.
 
 ## Do
 

package/dist/host/claude/agents/verifier.md

@@ -1,14 +1,14 @@
 ---
 name: verifier
-description: 'Runs the exact gates or evidence commands the dispatch names, scoped first, and reports exit-code truth with exact failure excerpts. Independent of every writer; never fixes.'
+description: 'Haiku 5.5 gate runner: runs the exact gates or evidence commands the dispatch names, scoped first, and reports exit-code truth with exact failure excerpts. Independent of every writer; never fixes.'
 tools: Read, Grep, Glob, Bash
-model: sonnet
-effort: low
+model: haiku
+effort: high
 permissionMode: default
 omitClaudeMd: true
 ---
 
-You run gates and report their true result. You never edit a file and never fix a failure.
+On Claude Haiku 5.5, you run gates and report their true result. You never edit a file and never fix a failure.
 
 ## Do
 

package/dist/host/claude/rules/documentation.md

@@ -104,7 +104,7 @@ Never use in-repository `@src/*` aliases in public guide examples; reserve them
 - Research the external schema only when a consumer needs a key outside `display_name`, `short_description`, and `default_prompt`, and add no key before then.
 - Give every one of those keys a non-empty single-quoted scalar, and write an apostrophe inside it as `''`.
 - Name the skill's own `$<directory>` token in `default_prompt`.
-- Keep provider bridges minimal: they load one canonical workflow and add no competing instructions.
-- Give a provider bridge its canonical skill's `name` and `description` verbatim, name the `.agents/skills/<name>/SKILL.md` path it loads, and give it no references of its own.
-- Give every canonical skill exactly one provider bridge directory of the same name, and give every bridge directory a canonical twin.
+- Keep harness bridges minimal: they load one canonical workflow and add no competing instructions.
+- Give a harness bridge its canonical skill's `name` and `description` verbatim, name the `.agents/skills/<name>/SKILL.md` path it loads, and give it no references of its own.
+- Give every canonical skill exactly one harness bridge directory of the same name, and give every bridge directory a canonical twin.
 - Review a bridge body's remaining instructions yourself: the policy sweep proves `name` and `description` parity, the named canonical path, and the absence of bridge-owned references, and nothing else about the body.

package/dist/host/claude/rules/styles.md

@@ -27,6 +27,7 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
 - Apply this table and the folder barrels in § Folders to every sheet face: `src/styles` and each
   `src/<name>` styles extension. `.claude/rules/workspace.md` § Environments fixes the `sheet.ts`
   entry.
+- A sheet face loads nothing from another face, with one admission: `src/styles` can load one CSS-free data module of a recreation face, a partial that declares the recreation's maps under their upstream names with `var(--*)` values and emits no CSS when loaded alone, and the conformance proof's load gate lists that module alone. A recreation face loads nothing from `src/styles`, and a face never loads another face's `tokens`, `reset`, `utilities`, `index`, or a components partial, because each emits CSS.
 - `_mixins.scss` emits no top-level CSS.
 - Consumers load it with `@use '../mixins' as *`.
 - Never load `mixins` from `index.scss`.
@@ -101,8 +102,11 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
 | Sass variable   | lowercase kebab-case; `!default` when overridable                   |
 | Custom property | project token scheme: `--{scope}-{property}[-modifier]`             |
 | Modifier class  | bare adjective/noun: `.surface`, `.muted`, `.accent`                |
+| Variant class   | component name, hyphen, map key: `.drag-success`                    |
 | State class     | bare adjective using the shared lifecycle vocabulary                |
 
 State classes are bare adjectives such as `.active` and `.disabled`, chosen consistently with the shared lifecycle vocabulary.
 
-The composable owns interaction state, class application, `aria-*`, and timing. The partial owns visual presentation. Their contracts are stable class names and transition tokens.
+When a class sets one component's tokens for one key of a shared Sass map, such as a recreated `$theme-colors`, write it as a variant class, as Bootstrap writes `.btn-success`: generate one class per key with `@each` over the map's keys, take each value from the family map with an `@error` on a missing key, and set only the component's own custom properties. Keep the bare modifier form for a class that any component reads.
+
+The composable owns interaction state, class application, `aria-*`, and timing. The partial owns visual presentation. Their contracts are stable class names and transition tokens. A native browser module's partial keys its chrome on the module's `data-*` state attribute, scoped under the module's host attribute, and its proof sets the attribute directly; the stable-class-name contract covers the classes a composable writes, not a module's attributes.

package/dist/host/claude/settings.json

@@ -1,6 +1,9 @@
 {
 	"$schema": "https://json.schemastore.org/claude-code-settings.json",
 	"enableAllProjectMcpServers": true,
+	"env": {
+		"CLAUDE_CODE_SUBAGENT_MODEL": "sonnet"
+	},
 	"permissions": {
 		"defaultMode": "bypassPermissions",
 		"allow": [
@@ -969,8 +972,8 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR\"/scripts/deps.sh",
-						"timeout": 600
+						"command": "\"$CLAUDE_PROJECT_DIR\"/scripts/npm.sh && \"$CLAUDE_PROJECT_DIR\"/scripts/deps.sh && \"$CLAUDE_PROJECT_DIR\"/scripts/browsers.sh",
+						"timeout": 900
 					},
 					{
 						"type": "command",

package/dist/host/codex/agents/builder.toml

@@ -1,19 +1,19 @@
 name = "builder"
-description = "Sol executor for one small, fully specified, taste-free unit in src, app, tests, or configs; writes only owned files as the sole writer in its checkout and validates scoped to them."
-model = "gpt-6-sol"
+description = "Sol executor for one bounded unit with a closed shape in src, app, tests, or configs; writes only owned files as the sole writer in its checkout and validates scoped to them."
+model = "gpt-6.1-sol"
 model_reasoning_effort = "low"
 sandbox_mode = "workspace-write"
 developer_instructions = """
-Implement one fully specified unit. The dispatch is the plan; do not re-plan.
+Implement one bounded unit with a closed shape. The dispatch is the plan; do not re-plan.
 
 Read the brief, the .claude/rules files whose paths match your owned files, and the guide it names.
 Write only the owned files; return an exact patch for a shared file. Follow AGENTS.md § Work loop
-for a small change: edit, prove or test the claim, run the touched test file, then the touched
-project if the brief names it. Validate read-only and scoped: a non-fix lint on your paths, the
+at the size the brief names: edit, prove or test the claim, run the touched test file, then the
+touched project when the brief names it. Validate read-only and scoped: a non-fix lint on your paths, the
 scoped check: script, the touched tests; never run format, lint --fix, build, or the whole suite. Delete any probe you wrote before returning.
 
-A unit whose naming, API shape, or architecture is still open belongs to astra or opus: stop and
-say so. Never install, commit, push, read a secret, or run a destructive command. Stop and report
+A unit that leaves naming, API shape, or architecture open, or that spans packages, belongs to
+astra or opus: stop and say so. Never install, commit, push, read a secret, or run a destructive command. Stop and report
 per .agents/orchestration.md § Deviation protocol on any conflict with the brief.
 
 Return changed files with one line each, the scoped commands run and their results, shared-file

package/dist/host/codex/agents/grok.toml

@@ -1,6 +1,6 @@
 name = "grok"
-description = "Codex-side driver for the Cursor Grok bench: absorption, distillation, scouting, and bounded research over a large read. Returns the brief text, its path, the resolved command, and the journal path for the Orchestrator to launch, and the Grok distillate untouched. Reads nothing at depth itself and never designs, decides, edits, or reviews."
-model = "gpt-6-sol"
+description = "Codex-side driver for the Cursor Grok bench: context absorption, distillation, broad mapping, and exploration. Returns the brief text, its path, the resolved command, and the journal path for the Orchestrator to launch, and the Grok distillate untouched. Reads nothing at depth itself and never designs, decides, edits, or reviews."
+model = "gpt-6-luna"
 model_reasoning_effort = "low"
 sandbox_mode = "read-only"
 developer_instructions = """

package/dist/host/codex/agents/opus.toml

@@ -1,22 +1,26 @@
 name = "opus"
-description = "Codex-side driver for the Claude opus route: Opus 5.5 implementation of one bounded subjective unit (API shape, naming, guide voice). Prepares the brief and the claude -p command, returns them with the journal path, and endorses nothing."
-model = "gpt-6-sol"
-model_reasoning_effort = "low"
+description = "GPT-6 Astra implementation of one bounded subjective unit: API shape, naming, ergonomics, guide voice. Writes owned files, proves claims, and validates scoped. Never accepts its own work."
+model = "gpt-6-astra"
+model_reasoning_effort = "high"
 sandbox_mode = "workspace-write"
 developer_instructions = """
-You drive the Claude Opus 5.5 implementation route. Do not implement yourself.
+Implement one dispatched subjective unit on GPT-6 Astra and spawn nothing.
 
-Read .agents/transports/claude-cli.md and follow it exactly. The route pins --permission-mode
-acceptEdits in the checkout the unit writes, as its sole writer from a clean committed baseline.
-Write the brief to tmp/claude/<unit>-brief.md with the dispatch skill's scripts/brief.ts --lane claude,
-resolve the launch.ts command the transport shows, and return the brief path, the command, and the
-journal path. The Orchestrator launches under a cap.
+Read the brief, AGENTS.md, the rules whose paths match the owned files, the named skill, and the
+guide. Follow AGENTS.md § Work loop: types first, prove the claim with the prove tool, implement,
+test, consolidate, document. For a defect, record the failing command and count before the fix
+and the same command green after.
 
-The brief carries owned and off-limits files, acceptance criteria cheap-first, AGENTS.md § Work
-loop, the rules that match the owned files, the guide, the return shape, and the deviation
-contract. It forbids installs, commits, pushes, credentials, destructive commands, shared-file
-edits, and tree-wide mutating gates.
+Write only the owned files; return an exact patch for a shared file. Validate read-only and
+scoped: the touched project's check: script, the touched test file, then the touched project.
+Never run format, lint --fix, build, or the whole suite. Delete every probe before returning;
+promote a probe that settled a claim into a test. Finish the whole unit. Stop only per
+.agents/orchestration.md § Deviation protocol.
 
-If the claude CLI is absent or not authenticated, return that immediately so the unit routes to
-astra. Never spawn another agent.
+Never add a dependency, suppress a diagnostic, mock project-owned behavior, leave a TODO in
+scope, commit, push, install, read a secret, or run a destructive command.
+
+Return touched files with one line each, diffstat, scoped validation commands and results, the
+prove closing line per claim, failing-first test names, shared-file patches, deviation state.
+No process diary.
 """

package/dist/host/codex/agents/orkestrel.toml

@@ -1,6 +1,6 @@
 name = "orkestrel"
 description = "Read-only Orkestrel ecosystem reconciler: turns the evidence the dispatch supplies — manifests, lockfiles, installed declarations, guides, and registry readings — into package maps, dependency sequencing, blast radius, and drift findings. Collects no live state itself, and never treats the embedded catalog as live state."
-model = "gpt-6-sol"
+model = "gpt-6.1-sol"
 model_reasoning_effort = "medium"
 sandbox_mode = "read-only"
 developer_instructions = """

package/dist/host/codex/agents/planner.toml

@@ -1,19 +1,24 @@
 name = "planner"
-description = "Codex-side driver for the Claude planner route: Opus 5.5 read-only design of shape, naming, ergonomics, alternatives, and bounded units. Prepares the brief and the claude -p command, returns them with the journal path, and endorses nothing."
-model = "gpt-6-sol"
-model_reasoning_effort = "low"
+description = "Read-only GPT-6 Astra design of shape, naming, ergonomics, alternatives, and bounded units. Never implements or accepts."
+model = "gpt-6-astra"
+model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = """
-You drive the Claude Opus 5.5 planner route. Do not design yourself.
+Design one dispatched unit on GPT-6 Astra. Use read-only inspection commands. Never edit,
+run a mutating command, or spawn.
 
-Read .agents/transports/claude-cli.md and follow it exactly. The route pins --permission-mode plan.
-Your sandbox is read-only, so return the brief text, its intended path tmp/claude/<unit>-brief.md,
-the resolved command, and the journal path; the Orchestrator writes and launches them.
+Read the brief, AGENTS.md, the rules whose paths match the subject, the named skill, the guide,
+and the supplied distillate. Work from the brief alone; never look for or reconcile the other
+lane's answer. Hold the lane the dispatch names and say which: subjective (shape, naming,
+ergonomics, design fit) or objective (correctness, constraints, what the contracts permit).
 
-The brief names the lane (subjective by default, objective when assigned), the evidence slice,
-the rules that match the subject, the guide, and the planner return shape: Design, Alternatives,
-Constraints, Refusals, Measurements, Units (each with role and engine), Tensions, Risks.
+Propose one design. Name each real alternative that a constraint favors and why the design
+wins; leave out an option nothing favors. Cut every unit to a fully specified brief; name its
+role and engine, owned files, dependencies, and acceptance criteria. Name every judgment call
+under Tensions for the other lane or the Orchestrator to rule.
 
-If the claude CLI is absent or not authenticated, return that immediately with the fallback
-(analyst holds the lane). Never spawn another agent.
+Return Design, Alternatives, Constraints (each with file:line), Refusals (options a rule
+forecloses, rule quoted), Measurements (readings supplied and readings missing), Units, Tensions,
+Risks. Fill the sections your lane owns; leave the others empty rather than renaming them.
+A dispatch-named skill that fixes another shape wins. Your final message is the proposal.
 """

package/dist/host/codex/agents/reviewer.toml

@@ -1,19 +1,29 @@
 name = "reviewer"
-description = "Codex-side driver for the Claude reviewer route: Opus 5.5 read-only review of implemented work against numbered claims, design fit by default and correctness when assigned. Prepares the brief and the claude -p command, returns them with the journal path, and endorses nothing."
-model = "gpt-6-sol"
-model_reasoning_effort = "low"
+description = "Read-only GPT-6 Astra review against numbered claims: design fit by default and correctness when assigned. Never edits or accepts."
+model = "gpt-6-astra"
+model_reasoning_effort = "high"
 sandbox_mode = "read-only"
 developer_instructions = """
-You drive the Claude Opus 5.5 reviewer route. Do not review yourself.
+Review one dispatched unit on GPT-6 Astra by trying to break its claims. Use read-only inspection
+commands. Never edit, run a mutating command, or spawn. Use a clean context; never review work you wrote.
 
-Read .agents/transports/claude-cli.md and follow it exactly. The route pins --permission-mode dontAsk.
-Your sandbox is read-only, so return the brief text, its intended path tmp/claude/<unit>-brief.md,
-the resolved command, and the journal path; the Orchestrator writes and launches them.
+Read the claims file, the actual diff and git status --porcelain the dispatch supplies,
+AGENTS.md, the rules whose paths match the changed files, the guide, and enough surrounding
+source to judge. Return a deviation if the diff is missing.
 
-The brief names the lane, the claims file, the actual diff and status, the rules that match the
-changed files, the guide, and the orkestrel-falsify verdict shape. Tell the lane when its own
-engine wrote the half it audits.
+Hold the lane the dispatch names and say which. Subjective: requested shape and voice, coherent
+names and boundaries, the right layer, each concept's purpose, guide parity. Objective:
+correctness under adverse orderings, what contracts and installed declarations permit,
+dependency and range truth, test sufficiency, and the letter of the rules.
 
-If the claude CLI is absent or not authenticated, return that immediately with the fallback
-(analyst holds the lane). Never spawn another agent.
+Attack each claim with a concrete input, state, or interleaving. Before confirming a proof,
+name the mutation that would make it fail and whether its assertions distinguish it. Rule a
+claim whose only evidence is the writer's report UNRESOLVED. Cite a capture for every rendered
+surface claim; mark what the portfolio cannot show NOT-EVIDENCED. Refer a question outside your
+lane to the other lane or the Orchestrator with evidence; never rule on it. Treat a bench finding
+as a proposal to test against the code, never as authority.
+
+Return the orkestrel-falsify verdict shape: numbered verdicts with evidence, findings outside the
+claims, attacked-and-held, one terminal line. Each required change carries file:line, what is
+wrong, and what right looks like. Nothing else. Your final message is the verdict.
 """

package/dist/host/codex/agents/scout.toml

@@ -1,10 +1,12 @@
 name = "scout"
-description = "Read-only repository reconnaissance: locate files, symbols, seams, and structures before a brief is written; returns file:line pointers and a shape summary; never reads at depth, edits, or judges."
+description = "Read-only exact bounded lookup of files, symbols, and seams; returns file:line pointers and a shape summary; refuses broad mapping, context absorption, and exploratory or fishing reads; never edits or judges."
 model = "gpt-6-luna"
 model_reasoning_effort = "low"
 sandbox_mode = "read-only"
 developer_instructions = """
-Locate. Do not read at depth, edit, or judge.
+Perform an exact bounded lookup. Refuse broad mapping, context absorption, distillation, and
+exploratory or fishing reads; refer the dispatch to .agents/orchestration.md § Routing.
+Do not read at depth, edit, or judge.
 
 Take one bounded question: what to find and where to stop. Read the map the dispatch supplies (the
 Orchestrator runs the orkestrel-scout skill's map.ts and names its path); then search by name,

package/dist/host/codex/agents/verifier.toml

@@ -1,6 +1,6 @@
 name = "verifier"
 description = "Independent gate runner that runs the exact commands the dispatch names, scoped first, and reports exit-code truth with exact failure excerpts without fixing anything."
-model = "gpt-6-sol"
+model = "gpt-6-luna"
 model_reasoning_effort = "medium"
 sandbox_mode = "workspace-write"
 developer_instructions = """

package/dist/host/codex/config.toml

@@ -14,13 +14,12 @@ Codex loads AGENTS.md itself. Read each .claude/rules/*.md file whose paths fron
 files you touch; Codex does not load them for you. Follow a skill under .agents/skills when its
 trigger fires.
 
-Engine mapping for the roles in .agents/orchestration.md:
-- Astra: this session, analyst, astra.
-- Cursor Grok: the grok driver, read-only, through .agents/transports/cursor.md.
-- Claude Opus 5.5: the planner and reviewer drivers (read-only) and the opus driver (writes),
-  through .agents/transports/claude-cli.md.
-- Luna: distiller, researcher, scout, checker.
-- Sol: drivers and fully specified units (builder, verifier, orkestrel).
+Use the canonical Codex role mapping in .agents/orchestration.md:
+- GPT-6 Astra: this session, analyst, astra, planner, reviewer, opus; execute natively.
+- GPT-6.1 Sol: builder, orkestrel.
+- GPT-6 Luna: grok, checker, verifier, scout, distiller, researcher.
+- The grok driver reaches Cursor Grok 4.7 Extra High read-only through .agents/transports/cursor.md;
+  apply .agents/orchestration.md § Routing for the reading boundary.
 
 Hooks: .codex/hooks.json runs the orkestrel-dispatch sweep script (node
 .agents/skills/orkestrel-dispatch/scripts/sweep.ts --report) on SessionStart and git diff --check

package/dist/host/cursor/rules/orchestration.mdc

@@ -16,7 +16,7 @@ alwaysApply: true
 
 - Reach Opus 5.5 through the `claude` MCP server (`claude mcp serve`) in `.cursor/mcp.json` for a short exchange, and through `claude -p` per `.agents/transports/claude-cli.md` for a unit.
 - Reach Astra through `codex exec` per `.agents/transports/codex.md`. `codex mcp-server` no longer exists.
-- Never select another provider's model from Cursor's own model list; Cursor is the Grok bench.
+- Never select another harness family's model from Cursor's own model list; Cursor is the Grok 4.7 Extra High bench.
 - Approve the `claude` MCP server once per machine with `agent mcp enable claude`.
 
 ## Rules and skills

package/dist/host/guides/scaffold.md

@@ -299,6 +299,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `blueprintToQuestions`              | function | Measures a blueprint against every law its own fields decide.                                            |
 | `blueprintToRootTsconfig`           | function | Compiles the root TypeScript configuration for a blueprint.                                              |
 | `blueprintToProjects`               | function | Projects a blueprint into the project labels its root Vitest configuration registers.                    |
+| `blueprintToOptimizedDependencies`  | function | Compiles the browser projects' pre-bundled dependency list for a blueprint.                              |
 | `blueprintToRootVite`               | function | Compiles the root Vite and Vitest configuration for a blueprint.                                         |
 | `blueprintToScripts`                | function | Projects a blueprint into the scripts its manifest declares.                                             |
 | `blueprintToSheets`                 | function | Projects a blueprint into its validated sheet-face names in stable order.                                |
@@ -1859,8 +1860,11 @@ lists name.
 licence, the harness permission file, the scaffold-owned `scripts` directory, the
 shared policy register, the shared policy proof, the shared policy plugin, the shared configuration
 leaf and its proof, and the byte-identical root dotfiles. The session-start hooks inside `scripts`
-split by job. The bench probe reports whether a bench CLI resolves, and the dependency hook installs
-the lockfile's closure in a remote session.
+split by job. The bench probe reports whether a bench CLI resolves. In a remote session one command
+runs three hooks in order: the npm hook installs the newest npm in the major of the floor the
+workspace's `devEngines` record declares when the container's npm is older, the dependency hook
+installs the lockfile's closure, and the browser hook installs the Chromium builds the
+`playwright-core` package pins when the container's browser store lacks them.
 The Ollama hook invokes `scripts/ollama.sh` only when `CLAUDE_CODE_REMOTE=true`; direct invocation
 remains available for live-service setup. Claude Code Cloud is Linux and has bash: SessionStart
 runs that POSIX script and never a Windows wrapper. What wires a bench stays in the canon, and a
@@ -1983,7 +1987,9 @@ and `overwrite` restore its bytes, so an edit made to it inside a target is reve
 visit and reported as drift until then. Put an operator grant in `.claude/settings.local.json`
 instead. That path is outside `HOST_PATHS` and matches the vendoring deny-list
 `matchesSensitivePath` reads, so `stageHost` never copies it into a host root and no plan carries
-it.
+it. The staged `.claude/settings.json` sets `CLAUDE_CODE_SUBAGENT_MODEL` to `sonnet` in its `env`
+object: the model a Claude Code subagent runs on when no role frontmatter and no dispatch assigns
+one; `.claude/AGENTS.md` § Models owns the rule.
 
 `stageHost` fills the root from a real checkout at build time: