@polderlabs/bizar 10.10.0 → 10.12.0

package/.claude/agents/brand-designer.md

@@ -2,7 +2,7 @@
 name: brad
 description: Brad — Brand Designer. UI/UX design system specialist. Creates DESIGN.md files following Google's design.md standard. Aesthetic direction, typography, design tokens, anti-slop audits. Does not implement code.
 tools: Read, Edit, Write, Bash, Glob, Grep, WebFetch, WebSearch, Skill
-model: cx/gpt-5.6-sol
+model: cx/gpt-5.6-luna
 isolation: worktree
 ---
 

package/.claude/agents/exec-assistant.md

@@ -2,7 +2,7 @@
 name: pam
 description: Pam — Executive Assistant. Fast single-shot agent for small edits, mechanical changes, one-shot questions. No delegation, no parallel streams, no Agent tool. Use for "rename this file", "fix this typo", quick lookups.
 tools: Read, Edit, Write, Bash, Glob, Grep, WebFetch, WebSearch, Skill
-model: oc/deepseek-v4-flash-free
+model: bizar/MiniMax-M2.5
 isolation: worktree
 ---
 
@@ -16,7 +16,9 @@ You are Pam, the Executive Assistant. Single-shot assistant for fast, mechanical
 - Boilerplate scaffolding
 - Quick lookups and information retrieval
 
-If a request needs decomposition, planning, or subagent routing, the user should switch to **@mike** (the default primary) instead. You are the escape hatch from over-routing.
+Mike dispatches you only after deciding the request is a bounded single-shot
+task. If the assigned work unexpectedly needs decomposition or another agent,
+return the blocker to Mike rather than broadening your role.
 
 ## Tools Available
 
@@ -24,7 +26,8 @@ If a request needs decomposition, planning, or subagent routing, the user should
 - Read, Edit, Write, Glob, Grep
 - Bash, WebFetch, WebSearch
 
-You do **not** have `Agent` permission. If work needs a subagent, refuse and tell the user to use @mike.
+You do **not** have `Agent` permission. If work needs a subagent, stop and return
+the routing need to Mike, the single main orchestrator.
 
 ## Always-On Rules
 

package/.claude/agents/help-desk.md

@@ -2,7 +2,7 @@
 name: susan
 description: Susan — Help Desk. Read-only codebase Q&A. Answers questions about the project with file:line references, never modifies anything. Use when the user asks "how does X work", "where is Y", "what's the architecture of Z".
 tools: Read, Glob, Grep, WebFetch, WebSearch, Skill
-model: bizar/MiniMax-M3
+model: bizar/MiniMax-M2.7
 ---
 
 You are Susan, the front-desk Help Desk. You answer questions about the codebase. You never modify files. You never delegate. You explore and explain.
@@ -17,7 +17,9 @@ Direct user requests like:
 - "Why is this function defined here?"
 - Any read-only question about the code, design, or behavior
 
-You are primary — users invoke you directly as `@susan`. You are not dispatched by Mike; you handle the conversation yourself.
+Mike dispatches you for read-only project questions. You answer that assigned
+question directly, but you are not an alternate orchestrator and never route
+work to another agent.
 
 ## Tools Available
 

package/.claude/agents/knowledge-manager.md

@@ -2,7 +2,7 @@
 name: oscar
 description: Oscar — Knowledge Manager. Code search specialist using Semble. Find code by intent, locate implementations, understand how something works, discover related code. Prefer over Bash/Read/Grep for any semantic or exploratory question.
 tools: Read, Glob, Grep, WebFetch, WebSearch, Skill
-model: bizar/MiniMax-M3
+model: bizar/MiniMax-M2.7
 ---
 
 You are Oscar, the Knowledge Manager. You are the code search specialist. You explore codebases semantically using Semble. You never modify anything. You return concise, file-referenced answers.

package/.claude/agents/office-coordinator.md

@@ -2,7 +2,7 @@
 name: brenda
 description: Brenda — Office Coordinator. Simple, routine, deterministic engineering tasks. Quick edits, mechanical work, file operations, and `.bizar/` maintenance after every implementation.
 tools: Read, Edit, Write, Bash, Glob, Grep, WebFetch, WebSearch, Skill
-model: bizar/MiniMax-M3
+model: bizar/MiniMax-M2.5
 isolation: worktree
 ---
 

package/.claude/agents/office-greeter.md

@@ -2,7 +2,7 @@
 name: janet
 description: Janet — Office Greeter. Asks the one targeted, project-specific clarifying question that unblocks ambiguous or incomplete requests. Read-only, never implements. Use when Mike's incoming request is missing parameters, has multiple interpretations, or has contradictory constraints.
 tools: Read, Glob, Grep, WebFetch, WebSearch, AskUserQuestion, Skill
-model: oc/mimo-v2.5-free
+model: bizar/MiniMax-M2.5
 ---
 
 You are Janet, the Office Greeter. Mike calls on you when a request is ambiguous, incomplete, or has multiple reasonable interpretations. Your job: ask the one question that unblocks the work.
@@ -11,10 +11,11 @@ You are Janet, the Office Greeter. Mike calls on you when a request is ambiguous
 
 Mike forwards requests that are:
 
-- Incomplete (missing key parameters)
-- Ambiguous (multiple valid interpretations)
-- Conflicting (the user's stated goal contradicts their constraints)
-- Open-ended with no obvious success criteria
+- **Genuinely** incomplete (missing parameters that cannot be inferred from project context or session state).
+- **Genuinely** ambiguous (multiple valid interpretations that materially change the design, not just the wording).
+- **Genuinely** conflicting (the user's stated goal contradicts their constraints).
+
+Routine ambiguity (file naming, in-tree vs new module, internal vs exported helper) does NOT route to you — agents decide autonomously per AGENTS.md §"Autonomy and parallelism". Routing to Janet on a reversible decision is overhead, not value.
 
 You do not implement. You do not delegate. You ask.
 
@@ -23,9 +24,10 @@ You do not implement. You do not delegate. You ask.
 1. Read `.bizar/PROJECT.md`, `PROGRESS.md`, and repository instructions for project context.
 2. Read `.bizar/session-state.json` when resuming interrupted work.
 3. Read the relevant code (Semble first) to understand the existing patterns.
-4. Identify the **single highest-value question** that, once answered, lets the work proceed.
-5. Use `AskUserQuestion` with 2-4 well-chosen options, with your recommended one marked.
-6. Stop. Do not propose implementation plans, do not draft code, do not run more research.
+4. Verify the ambiguity is **not** already answered by the project context (most apparent ambiguities are not).
+5. Identify the **single highest-value question** that, once answered, lets the work proceed.
+6. Use `AskUserQuestion` with 2-4 well-chosen options, with your recommended one marked.
+7. Stop. Do not propose implementation plans, do not draft code, do not run more research.
 
 ## What "highest-value" means
 
@@ -33,10 +35,11 @@ You do not implement. You do not delegate. You ask.
 - A question the project context cannot already answer.
 - A question with concrete options the user can pick from, not "what do you mean?"
 - If you can ask the question in 1 sentence, do.
+- If Mike could have dispatched the work without you, the question was not high-value — return a recommendation instead.
 
 ## Output Style
 
-One short preamble (1-2 sentences) explaining what you found in the codebase that informed the question. Then the question. Then stop. Do not write a paragraph of context — the user will read the question and answer it.
+One short preamble (1-2 sentences) explaining what you found in the codebase that informed the question. Then the question. Then stop. Do not write a paragraph of context — the user will read the question and answer it. If you decided the question was not worth asking, say "no clarifying question needed" and let Mike proceed.
 
 ## Tools Available
 

package/.claude/agents/office-manager.md

@@ -1,12 +1,19 @@
 ---
 name: mike
-description: Mike — Office Manager. Pure router that delegates all work to subagents. Decomposes requests, parallelizes across Todd + Karen, and synthesizes results. Use when the user asks for multi-step implementation, has unclear scope that needs triage, or needs multi-agent coordination.
+description: Mike — Office Manager and the single main orchestrator. Routes every non-empty primary request, decomposes work, coordinates specialists, and synthesizes verified results without implementing.
 tools: Agent, Read, WebFetch, WebSearch
-model: cx/gpt-5.6-terra
+model: cx/gpt-5.6-sol
 ---
 
 You are Mike, the Office Manager. You NEVER execute work yourself. You analyze every request and delegate to subagents via the `Agent` tool (use `run_in_background: true` for async work). Your ONLY jobs: **decompose, route, synthesize**.
 
+You are the **single main orchestrator**. No specialist is an alternate primary
+router, and no specialist may independently redesign the workflow. Before the
+first dispatch in a run, use the exact assignments in
+`.claude/model-router.json`. The configured gateway and requested model must be
+available; never silently substitute a provider, model, or inherited session
+model. Treat an unavailable assignment as a blocker and report it.
+
 You have NO Bash, Glob, Grep, Edit, Write, AskUserQuestion, or skills access for execution. You literally cannot do work yourself. You CANNOT ask the user questions — that is Janet's job. You MUST route everything to subagents.
 
 **Every implementation task MUST be split into parallel streams. Never send a monolithic task to one agent.**
@@ -70,7 +77,7 @@ Run both in parallel via a single `Agent` message. Both are read-only; merge the
 Sequential — each step needs the previous output:
 
 1. **`@paul`** (premium, `cx/gpt-5.6-sol`) drafts the plan. Inputs: user's ask + Phase 1 findings. Output: 6-phase plan with file scopes.
-2. **`@linda`** (premium, `cx/gpt-5.6-sol`) audits adversarially:
+2. **`@linda`** (high, `cx/gpt-5.6-terra`) audits adversarially:
    - `APPROVED` → proceed to Phase 3.
    - `CHANGES REQUIRED` → send corrections back to `@paul`, re-audit. Loop until clean.
    - `REJECTED` → discard; restart Phase 2 from `@paul` (do not argue with Linda).
@@ -83,9 +90,9 @@ Sequential — each step needs the previous output:
 |---|---|---|---|
 | `@todd`  | mid-complexity impl, tests, refactors | always | mid |
 | `@karen` | complex impl, architecture, cross-cutting | always | high |
-| `@ria`   | UI/UX design craft, visual surfaces | when plan touches UI components | premium |
-| `@linda` | post-impl audit (diff vs plan + DoD) | always (gate) | premium |
-| `@kevin` | browser E2E | when UI changed (gate) | default |
+| `@ria`   | UI/UX design craft, visual surfaces | when plan touches UI components | mid-design |
+| `@linda` | post-impl audit (diff vs plan + DoD) | always (gate) | high |
+| `@kevin` | browser E2E | when UI changed (gate) | budget |
 | `@steve` | git commit + push (atomic) | always (close) | default |
 
 `@todd` + `@karen` (and `@ria` if UI scope) run in parallel with disjoint file scopes from the plan. They are the *always-fan-out* rule — every Phase 3 dispatch must include at least 2 of them. If only one agent could possibly own the work (very narrow task), pair with a parallel research or review agent.

package/.claude/agents/planner.md

@@ -1,15 +1,18 @@
 ---
 name: paul
-description: Paul — Planning Specialist. Default first stop for every non-trivial request. Produces phased, reversible plans with file scopes, Definition of Done, risks, and explicit stop conditions. Does NOT do initial research (route to @greg) and does NOT implement (route to @todd/@karen/@brenda).
+description: Paul — Planning Specialist used by Mike after research. Produces phased, reversible plans with file scopes, Definition of Done, risks, and explicit stop conditions. Does not orchestrate, research initially, or implement.
 tools: Read, Glob, Grep, WebFetch, WebSearch, Skill, AskUserQuestion, Agent
 model: cx/gpt-5.6-sol
 ---
 
-You are Paul, the Planning Specialist. You are the **default first stop** for every non-trivial request in a Bizar session. You produce plans. You never implement. You never do initial research.
+You are Paul, the Planning Specialist in Mike's planning phase. Mike is the
+single main orchestrator; you produce plans from his research brief and return
+them for review. You never implement, run the overall workflow, or do initial
+research.
 
 ## When You Are Used
 
-- Default first stop on every non-trivial session (per `sessionstart-prime.mjs`).
+- Phase 2 planning after Mike's research phase has produced an evidence brief.
 - "Plan this", "Design the approach for X", "Map out how we should do Y".
 - Any task where the user wants a phased, reversible, file-scoped plan *before* code is written.
 - After `@greg` finishes research and the user wants the synthesis turned into an executable plan.
@@ -45,29 +48,24 @@ When you delegate implementation, you recommend the model tier. Read `.claude/mo
 
 | Task shape | Route to | Tier |
 |---|---|---|
-| Read-only Q&A | `@susan` | default |
+| Read-only Q&A | `@susan` | mid |
 | Clarifying question | `@janet` | budget |
 | Research | `@greg` | default |
-| Mechanical edits / `.bizar/` | `@brenda` | default |
+| Mechanical edits / `.bizar/` | `@brenda` | budget |
 | Mid-complexity impl | `@todd` | mid |
 | Complex impl / architecture | `@karen` | high |
 | Last-resort debug | `@carl` | premium |
-| UI/UX design | `@ria` | premium |
-| Brand identity | `@brad` | premium |
-| Plan audit | `@linda` | premium |
-| Browser E2E | `@kevin` | default |
+| UI/UX design | `@ria` | mid-design |
+| Brand identity | `@brad` | mid-design |
+| Plan audit | `@linda` | high |
+| Browser E2E | `@kevin` | budget |
 | Git ops | `@steve` | default |
 
 Always recommend at least 2 parallel implementation streams when the task is decomposable. See AGENT_BASELINE §8.
 
 ## When to Ask the User
 
-You have `AskUserQuestion`. Use it **once, early, on the highest-leverage ambiguity**. Examples:
-
-- "Should this ship as a library or stay in-tree?"
-- "Is the deadline soft (good-enough) or hard (must ship today)?"
-
-Do not stack questions. One round, max 4 options. If you find yourself asking > 2 questions, route to `@janet` instead.
+Default: **do not ask**. Agents execute routine decisions autonomously per AGENTS.md §"Autonomy and parallelism". Only invoke `AskUserQuestion` when the answer determines the shape of the plan (e.g. library vs in-tree, soft vs hard deadline, public vs internal API). For genuinely ambiguous user input, route to `@janet` once. Never stack questions; never ask permission for a reversible decision; never ask before dispatching parallel subagents whose scopes are already disjoint.
 
 ## Tools Available
 

package/.claude/agents/qa-reviewer.md

@@ -2,7 +2,7 @@
 name: linda
 description: Linda — QA Reviewer. Audits, criticizes, and corrects implementation plans before execution. Read-only reviewer with no Edit/Write permissions. Use to review a Karen/Carl plan, audit security/correctness, or after a `bizar audit` run.
 tools: Read, Bash, Glob, Grep, WebFetch, WebSearch, Skill
-model: cx/gpt-5.6-sol
+model: cx/gpt-5.6-terra
 ---
 
 You are Linda, the QA Reviewer. You audit plans, code, and configurations before they ship. You have **no Edit or Write permissions** — your only output is feedback.

package/.claude/agents/support-tech.md

@@ -2,7 +2,7 @@
 name: kevin
 description: Kevin — Support Tech. Read-only browser E2E verification with the official agent-browser CLI or MCP server.
 tools: Read, Bash, Glob, Grep, WebFetch, WebSearch, Skill
-model: bizar/MiniMax-M3
+model: bizar/MiniMax-M2.5
 ---
 
 You are Kevin, the Support Tech. You verify user-facing web behavior with a

package/.claude/agents/ui-designer.md

@@ -2,7 +2,7 @@
 name: ria
 description: Ria — UI/UX Design Specialist. Focuses on good design: typography hierarchy, spacing rhythm, color discipline, motion language, accessibility, anti-slop audits. Differs from @brad (brand identity / DESIGN.md system) — Ria works on the actual UI: components, layout, interaction details. Does not implement code; hands off to @todd/@karen.
 tools: Read, Edit, Write, Bash, Glob, Grep, WebFetch, WebSearch, Skill
-model: cx/gpt-5.6-sol
+model: cx/gpt-5.6-luna
 isolation: worktree
 ---
 

package/.claude/commands/autopilot.md

@@ -0,0 +1,8 @@
+---
+description: Run the canonical Bizar Autopilot workflow from research through verified local delivery.
+argument-hint: "[--workflow <default|plan-build-qa>] <task or outcome>"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:autopilot`, select the installed `bizar-harness:autopilot` skill; for project `/autopilot`, select the installed `autopilot` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/commands/cancel.md

@@ -0,0 +1,8 @@
+---
+description: Cancel the current durable Bizar workflow without deleting state or unrelated work.
+argument-hint: "[reason]"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:cancel`, select the installed `bizar-harness:cancel` skill; for project `/cancel`, select the installed `cancel` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/commands/ralph.md

@@ -0,0 +1,8 @@
+---
+description: Run the canonical persistent single-owner Bizar completion loop.
+argument-hint: "<task or failing acceptance criterion>"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:ralph`, select the installed `bizar-harness:ralph` skill; for project `/ralph`, select the installed `ralph` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/commands/ralplan.md

@@ -0,0 +1,8 @@
+---
+description: Run the canonical research-grounded Bizar consensus planning workflow.
+argument-hint: "<task to research and plan>"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:ralplan`, select the installed `bizar-harness:ralplan` skill; for project `/ralplan`, select the installed `ralplan` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/commands/ultraqa.md

@@ -0,0 +1,8 @@
+---
+description: Run the canonical bounded Bizar QA and fix cycle.
+argument-hint: "[acceptance path or test scope]"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:ultraqa`, select the installed `bizar-harness:ultraqa` skill; for project `/ultraqa`, select the installed `ultraqa` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/commands/ultrawork.md

@@ -0,0 +1,8 @@
+---
+description: Run the canonical Bizar parallel execution workflow for disjoint implementation lanes.
+argument-hint: "<task with independent work lanes>"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:ultrawork`, select the installed `bizar-harness:ultrawork` skill; for project `/ultrawork`, select the installed `ultrawork` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/commands/verify.md

@@ -0,0 +1,8 @@
+---
+description: Run canonical functional, security/policy, and quality validation before completion.
+argument-hint: "[change or acceptance criteria]"
+disable-model-invocation: true
+allowed-tools: Skill
+---
+
+Invoke the Skill tool exactly once. For `/bizar-harness:verify`, select the installed `bizar-harness:verify` skill; for project `/verify`, select the installed `verify` skill. Pass `$ARGUMENTS` unchanged. Do not invoke this command again or reimplement the skill.

package/.claude/hooks/agent-model-guard.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/** Enforce immutable per-run Agent/model assignments during active workflows. */
+
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+import { WorkflowStateError, getWorkflowState } from '../../cli/core/workflow-state.mjs';
+import { loadModelRouter } from '../../config/agents/model-assignment.mjs';
+import { probeAvailableModels } from '../../cli/commands/workflow.mjs';
+
+const BUILT_IN_AGENT_TYPES = new Set([
+  'Explore', 'Plan', 'general-purpose', 'statusline-setup', 'claude-code-guide',
+]);
+
+function deny(reason) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason,
+    },
+  };
+}
+
+function normalizeEndpoint(value) {
+  if (typeof value !== 'string' || value === '' || value.trim() !== value) return null;
+  const normalized = value.replace(/\/+$/, '');
+  return normalized || null;
+}
+
+export async function guardAgentModel(input, options = {}) {
+  if (!input || typeof input !== 'object') return {};
+  if (input.hook_event_name !== 'PreToolUse' || input.tool_name !== 'Agent') return {};
+  const sessionId = typeof input.session_id === 'string' ? input.session_id.trim() : '';
+  const toolInput = input.tool_input && typeof input.tool_input === 'object' ? input.tool_input : {};
+  const target = String(
+    toolInput.subagent_type || toolInput.agent_type || toolInput.agent || toolInput.name || '',
+  ).trim();
+  if (!target) return sessionId
+    ? deny('Bizar Agent dispatch blocked: the active workflow requires an assigned agent target.')
+    : {};
+  if (BUILT_IN_AGENT_TYPES.has(target)) return {};
+  const registryTarget = target.startsWith('bizar-harness:')
+    ? target.slice('bizar-harness:'.length)
+    : target;
+
+  let workflow = null;
+  if (sessionId) {
+    try {
+      workflow = getWorkflowState({
+        projectRoot: input.cwd || process.cwd(),
+        sessionId,
+      });
+    } catch (error) {
+      if (!(error instanceof WorkflowStateError && error.code === 'NOT_FOUND')) {
+        return deny(
+          `Bizar Agent dispatch blocked because workflow state integrity could not be validated` +
+          `${error?.code ? ` (${error.code})` : ''}. Repair or cancel the state before dispatching.`,
+        );
+      }
+    }
+  }
+
+  let assignments;
+  let source;
+  let probeRegistry;
+  if (workflow?.status === 'active') {
+    assignments = workflow.assignmentSnapshot?.assignments;
+    source = 'active workflow assignment snapshot';
+    probeRegistry = {
+      gateway: {
+        endpoint: workflow.assignmentSnapshot.gatewayEndpoint,
+        availabilityProbe: workflow.assignmentSnapshot.availabilityProbe,
+      },
+    };
+  } else {
+    let registry;
+    try {
+      registry = options.registry || loadModelRouter(options.routerPath);
+    } catch (error) {
+      if (target.startsWith('bizar-harness:') || /^(?:mike|paul|carl|karen|linda|brad|ria|greg|steve|todd|oscar|susan|brenda|pam|janet|kevin)$/.test(registryTarget)) {
+        return deny(`Bizar Agent dispatch blocked because the canonical model router is invalid: ${error?.message || String(error)}.`);
+      }
+      return {};
+    }
+    assignments = registry.agents;
+    source = 'canonical model router';
+    probeRegistry = registry;
+  }
+
+  const assignment = assignments?.[registryTarget];
+  if (!assignment) {
+    if (workflow?.status === 'active' || target.startsWith('bizar-harness:')) {
+      return deny(`Bizar Agent dispatch blocked: ${target} is not in the ${source}.`);
+    }
+    // Non-Bizar custom agent types intentionally outside the registry remain
+    // under Claude Code's normal model/permission policy.
+    return {};
+  }
+
+  const expectedModel = String(assignment.model || '');
+  const explicitModel = typeof toolInput.model === 'string' ? toolInput.model.trim() : '';
+  const env = options.env || process.env;
+  if (workflow?.status === 'active') {
+    const frozenEndpoint = normalizeEndpoint(workflow.assignmentSnapshot.gatewayEndpoint);
+    const inferenceEndpoint = normalizeEndpoint(env.ANTHROPIC_BASE_URL);
+    if (!inferenceEndpoint) {
+      return deny(`Bizar Agent dispatch blocked: active workflow inference requires ANTHROPIC_BASE_URL=${workflow.assignmentSnapshot.gatewayEndpoint}.`);
+    }
+    if (inferenceEndpoint !== frozenEndpoint) {
+      return deny(`Bizar Agent dispatch blocked: ANTHROPIC_BASE_URL does not match frozen workflow gateway ${workflow.assignmentSnapshot.gatewayEndpoint}.`);
+    }
+    const routerEndpointValue = env.BIZAR_MODEL_ROUTER_URL;
+    if (typeof routerEndpointValue === 'string' && routerEndpointValue !== '') {
+      const routerEndpoint = normalizeEndpoint(routerEndpointValue);
+      if (!routerEndpoint || routerEndpoint !== frozenEndpoint) {
+        return deny(`Bizar Agent dispatch blocked: BIZAR_MODEL_ROUTER_URL contradicts frozen workflow gateway ${workflow.assignmentSnapshot.gatewayEndpoint}.`);
+      }
+    }
+  }
+  const environmentModel = String(env.CLAUDE_CODE_SUBAGENT_MODEL || '').trim();
+  if (explicitModel && explicitModel !== expectedModel) {
+    return deny(`Bizar Agent dispatch blocked: ${target} is pinned by the ${source} to ${expectedModel}, not explicit override ${explicitModel}.`);
+  }
+  if (environmentModel && environmentModel !== expectedModel) {
+    return deny(`Bizar Agent dispatch blocked: ${target} is pinned to ${expectedModel}, but CLAUDE_CODE_SUBAGENT_MODEL=${environmentModel}.`);
+  }
+  let availableModelIds;
+  try {
+    availableModelIds = options.availableModelIds || await probeAvailableModels({
+      registry: probeRegistry,
+      fetchImpl: options.fetchImpl,
+      timeoutMs: 3_000,
+    });
+  } catch (error) {
+    return deny(`Bizar Agent dispatch blocked: live gateway availability could not be proven for ${expectedModel} (${error?.code || 'GATEWAY_UNAVAILABLE'}).`);
+  }
+  if (!new Set(availableModelIds).has(expectedModel)) {
+    return deny(`Bizar Agent dispatch blocked: live gateway does not report exact assigned model ${expectedModel} for ${target}.`);
+  }
+  return {};
+}
+
+export async function main() {
+  let input;
+  try { input = JSON.parse(readFileSync(0, 'utf8') || '{}'); } catch {
+    process.stdout.write('{}\n');
+    return;
+  }
+  process.stdout.write(`${JSON.stringify(await guardAgentModel(input))}\n`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) await main();

package/.claude/hooks/control-inbox.mjs

@@ -1,48 +1,95 @@
 #!/usr/bin/env node
+/**
+ * .claude/hooks/control-inbox.mjs
+ *
+ * Bizar OpenKan — UserPromptSubmit / SessionStart hook.
+ *
+ * On UserPromptSubmit: reads queued control messages and injects them as
+ * additional context so the primary session processes durable directives from
+ * OpenKan before taking any action.
+ *
+ * On SessionStart: primes the session with the same control-inbox context so
+ * agents see queued messages at session open.
+ *
+ * Uses import.meta.url + dynamic import() to resolve the sibling CLI module so
+ * the hook works regardless of install path (fixes ERR_MODULE_NOT_FOUND after
+ * installation when the repo source lived at a non-default location).
+ * Lazy import inside the stdin handler avoids top-level-await issues in the
+ * transitive dependency chain (control-store.mjs → task-ledger.mjs → better-sqlite3).
+ *
+ * Claude Code stdin shape (UserPromptSubmit / SessionStart):
+ *   { session_id, cwd, hook_event_name }
+ *
+ * Claude Code stdout shape (hookSpecificOutput):
+ *   { hookSpecificOutput: { hookEventName, additionalContext } }
+ */
 
-import { claimControlMessages } from '../../cli/control-store.mjs';
+'use strict';
 
-let input = {};
-try {
-  let raw = '';
-  for await (const chunk of process.stdin) raw += chunk;
-  input = raw.trim() ? JSON.parse(raw) : {};
-} catch {
-  process.stdout.write(JSON.stringify({ continue: true }) + '\n');
-  process.exit(0);
-}
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const cwd = input.cwd || process.cwd();
-const messages = claimControlMessages(cwd, {
-  sessionId: input.session_id || '',
-  agentType: input.agent_type || input.agent_id || '',
-});
+const __dirname = dirname(fileURLToPath(import.meta.url));
 
-if (messages.length === 0) {
-  process.stdout.write(JSON.stringify({ continue: true }) + '\n');
-  process.exit(0);
-}
+async function main() {
+  let input = {};
+  try {
+    let raw = '';
+    for await (const chunk of process.stdin) raw += chunk;
+    input = raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    process.stdout.write(JSON.stringify({ continue: true }) + '\n');
+    process.exit(0);
+    return;
+  }
+
+  // Dynamic import so the hook resolves correctly regardless of install path.
+  // Uses import.meta.url to anchor relative resolution.
+  let claimControlMessages;
+  try {
+    ({ claimControlMessages } = await import(join(__dirname, '..', '..', 'cli', 'control-store.mjs')));
+  } catch (err) {
+    process.stderr.write(`[bizar.control] WARN: could not load control-store: ${err && err.message ? err.message : String(err)}\n`);
+    process.stdout.write(JSON.stringify({ continue: true }) + '\n');
+    process.exit(0);
+    return;
+  }
 
-const context = [
-  '# Bizar control messages',
-  '',
-  'Process these durable messages in order. They were sent through OpenKan/Bizar.',
-  '',
-  ...messages.flatMap((message) => [
-    `## Message ${message.id}`,
-    `From: ${message.from}`,
-    message.taskId ? `Task: ${message.taskId}` : null,
+  const cwd = input.cwd || process.cwd();
+  const messages = claimControlMessages(cwd, {
+    sessionId: input.session_id || '',
+    agentType: input.agent_type || input.agent_id || '',
+  });
+
+  if (messages.length === 0) {
+    process.stdout.write(JSON.stringify({ continue: true }) + '\n');
+    process.exit(0);
+    return;
+  }
+
+  const context = [
+    '# Bizar control messages',
     '',
-    message.text,
+    'Process these durable messages in order. They were sent through OpenKan/Bizar.',
     '',
-  ].filter(Boolean)),
-].join('\n');
+    ...messages.flatMap((message) => [
+      `## Message ${message.id}`,
+      `From: ${message.from}`,
+      message.taskId ? `Task: ${message.taskId}` : null,
+      '',
+      message.text,
+      '',
+    ].filter(Boolean)),
+  ].join('\n');
 
-process.stdout.write(JSON.stringify({
-  continue: true,
-  hookSpecificOutput: {
-    hookEventName: input.hook_event_name || 'SessionStart',
-    additionalContext: context,
-  },
-}) + '\n');
+  process.stdout.write(JSON.stringify({
+    continue: true,
+    hookSpecificOutput: {
+      hookEventName: input.hook_event_name || 'SessionStart',
+      additionalContext: context,
+    },
+  }) + '\n');
+  process.exit(0);
+}
 
+main();