@polderlabs/bizar 10.23.8 → 10.23.10

package/AGENTS.md

@@ -58,21 +58,18 @@ still deny prohibited actions and escalate externally visible or irreversible
 actions with `permissionDecision: "ask"`; that escalation list is the
 authoritative floor, not a starting point.
 
-Native dynamic workflows under `config/workflows/` and `~/.claude/workflows/`
-are the required dispatch mechanism for every primary request except an
-unmistakably tiny single-target copy/style/format edit with no behavior or test
-change. Mike may execute that narrow exception directly. All other work enters
-the matching research / implement / debug / review workflow and uses at least
-one explicitly modeled editing subagent with call-level worktree isolation.
-Do not add unnecessary phases or duplicate workers. For work that needs 3+
-long-lived workers with bounded cross-talk,
-Mike invokes a workflow that fans out as a native agent team; the team is
+Mike selects the coordination mode after bounded read-only orientation and one
+user clarification checkpoint: direct work only for an unmistakably tiny
+single-target copy/style/format edit; one isolated Agent for a clear bounded
+change; a native workflow for repeatable phased work; parallel Agents for
+disjoint scopes; and an Agent team for 3+ sustained roles that genuinely need
+cross-talk. Do not add unnecessary phases or duplicate workers. The team is
 host-side state under `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`, and per
-Anthropic's docs `team_name` is deprecated and ignored. When two or more
-subtasks have non-overlapping writable scopes and no data dependency, the
-orchestrator MUST dispatch them concurrently through `parallel([...])`, each
-with call-level `isolation: "worktree"`. Sequential dispatch is reserved for
-dependent phases and integration; never create artificial parallel work.
+Anthropic's docs `team_name` is deprecated and ignored. Every editing dispatch
+uses an explicit configured model and call-level `isolation: "worktree"`.
+When two or more subtasks have non-overlapping writable scopes and no data
+dependency, dispatch them concurrently; serialize only dependencies and
+integration.
 
 Agent roles are model-agnostic. Mike selects the cheapest sufficient enabled
 configured-tier model for each dispatch, with explicit user picks taking
@@ -136,11 +133,13 @@ The autonomy and approval policy above governs this execution model. The project
 Every non-empty primary request enters Bizar through `office-manager` (`@mike`).
 The installer sets Claude Code's global `agent` setting to Mike's frontmatter
 name (`mike`),
-and a session-scoped routing guard requires a successful native Workflow before
-substantive primary-session mutation. Read-only inspection remains available.
-Mike directly executes only the tiny edit exception above. Every other request
-must invoke a native Bizar workflow before mutation; the workflow dispatches
-worktree-isolated subagents while Mike owns integration and final verification.
+and the routing hook supplies the adaptive coordination policy. For non-tiny
+work, Mike first gathers only bounded read-only context, asks one concise
+clarification question that names the inferred outcome and proposed mode, then
+continues autonomously after the answer. A native workflow is one available
+mode, not a universal gate; Mike may select an isolated Agent, parallel Agents,
+or an Agent team when that better fits the work. Mike owns integration and
+final verification.
 A Bizar custom agent already executing its assigned role does not recursively
 dispatch itself.
 
@@ -152,8 +151,8 @@ relevant page. Guess-and-try integration work is prohibited. When official
 documentation is unavailable or ambiguous, inspect authoritative source code
 and report the evidence gap.
 
-For workflow-routed requests, `office-manager` uses only the phases that reduce
-a known risk; only the tiny edit exception skips this pipeline:
+For a workflow or team, `office-manager` uses only phases and members that
+reduce a known risk:
 
 1. Research: `greg` (`research-analyst.md`) plus an implementation-context specialist.
 2. Plan: `planner` drafts; `qa-reviewer` challenges assumptions and test shape.

package/cli/commands/models.mjs

@@ -716,9 +716,8 @@ export function classifyKind(modelId) {
 // in-code hardcoded list — adding or removing a blocked provider is a
 // single JSON edit.
 //
-// Dual-path read: the Bizar path (`~/.config/bizar/config/claude/model-router.json`)
-// WINS when both exist, including an explicit `[]` (operators may pin
-// "no providers disabled" without deleting the legacy mirror). Whitespace
+// Global-only read: the Bizar path (`~/.config/bizar/config/claude/model-router.json`)
+// is the sole operator policy source. Whitespace
 // trim + lowercase normalization happens at read time so operators may
 // write `"  Anthropic  "` in JSON and still match `anthropic/...` model
 // ids. The comparison itself is a case-sensitive prefix filter against
@@ -758,44 +757,28 @@ function extractDisabledProviders(router) {
 
 /**
  * Read the operator's `disabledProviders` list from the model-router
- * config. Dual-path: the Bizar path wins when present (even with an
- * explicit empty array); the legacy `~/.claude/model-router.json` mirror
- * is the fallback. Both paths are normalized (trim + lowercase) at read.
+ * config. The Bizar global path is the only source. It is normalized (trim +
+ * lowercase) at read.
  *
  * Pure function over the filesystem; returns an empty array when neither
- * file exists, when both files lack the key, or when both reads fail.
+ * file exists, lacks the key, or cannot be read.
  *
- * @param {{ routerPath?: string, legacyPath?: string }} [opts]
+ * @param {{ routerPath?: string }} [opts]
  *   - `routerPath` defaults to the Bizar home path
  *     (`~/.config/bizar/config/claude/model-router.json`).
- *   - `legacyPath` defaults to the Claude Code mirror
- *     (`~/.claude/model-router.json`).
  * @returns {string[]} normalized disabled-provider prefixes
  */
-export function readDisabledProviders({ routerPath, legacyPath } = {}) {
+export function readDisabledProviders({ routerPath } = {}) {
   const bizarPath = routerPath || resolveGlobalModelRouter();
-  const fallPath = legacyPath || join(resolveClaudeConfigDir(), 'model-router.json');
   if (existsSync(bizarPath)) {
     try {
       const parsed = JSON.parse(readFileSync(bizarPath, 'utf8'));
       const extracted = extractDisabledProviders(parsed);
-      // Bizar path exists — its `disabledProviders` is authoritative even
-      // when explicitly `[]` (operators may pin "no providers disabled"
-      // without deleting the legacy mirror). Missing key still falls back.
+      // An explicit empty list is a valid global opt-out policy.
       if (Array.isArray(parsed && typeof parsed === 'object' ? parsed.disabledProviders : undefined)) {
         return extracted;
       }
-    } catch {
-      // Corrupt Bizar file — fall through to the legacy mirror.
-    }
-  }
-  if (existsSync(fallPath)) {
-    try {
-      const parsed = JSON.parse(readFileSync(fallPath, 'utf8'));
-      return extractDisabledProviders(parsed);
-    } catch {
-      return [];
-    }
+    } catch { return []; }
   }
   return [];
 }

package/cli/commands/tier.mjs

@@ -5,7 +5,7 @@
  * `bizar tier` — automatic task-based model selection.
  *
  * Replays the same tier resolution the @mike orchestrator uses:
- *  1. Read the role default from ~/.claude/model-router.json.
+ *  1. Read the role default from the global Bizar model router.
  *  2. Adjust the tier from current task risk and complexity.
  *  3. Print ordered candidates; dispatch uses a candidate only when live
  *     discovery proves it, otherwise Agent omits model and inherits the session.

package/cli/commands/upgrade-defaults.mjs

@@ -42,13 +42,11 @@ const CLAUDE_DIR = resolveClaudeConfigDir();
 const SETTINGS_PATH = join(CLAUDE_DIR, 'settings.json');
 // 10.22.0 / Phase 4 spirit-of-constraint: the install model id comes
 // from the operator's `userSelected.models[0]`, not a hardcoded literal.
-// Dual-path read matches `cli/commands/models.mjs#readDisabledProviders`:
-// the Bizar path wins when present; the Claude Code mirror is fallback.
+// The Bizar global router is the sole model-policy source.
 const BIZAR_ROUTER_PATH = resolveGlobalModelRouter();
-const LEGACY_ROUTER_PATH = join(CLAUDE_DIR, 'model-router.json');
 
 function readConfiguredModels() {
-  for (const path of [BIZAR_ROUTER_PATH, LEGACY_ROUTER_PATH]) {
+  for (const path of [BIZAR_ROUTER_PATH]) {
     if (!existsSync(path)) continue;
     try {
       const parsed = JSON.parse(readFileSync(path, 'utf8'));
@@ -58,8 +56,7 @@ function readConfiguredModels() {
       if (list.length > 0) return list;
       const fallback = configuredFallbackModels(parsed);
       if (fallback.length > 0) return fallback;
-      // Bizar path exists with an explicit empty `userSelected.models` —
-      // honour that intent (do NOT fall through to the legacy mirror).
+      // An explicit empty selection is an intentional global policy.
       if (path === BIZAR_ROUTER_PATH && parsed && typeof parsed === 'object'
           && Array.isArray(parsed.userSelected?.models)) {
         return [];

package/cli/provision.mjs

@@ -31,7 +31,7 @@ import {
 import { homedir } from 'node:os';
 import { dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { resolveBizarHome } from './config-paths.mjs';
+import { resolveBizarHome, resolveGlobalModelRouter } from './config-paths.mjs';
 import {
   buildClaudeModelOverrides,
   configuredEnabledModels,
@@ -465,9 +465,20 @@ export async function syncAgentFiles({ dryRun = false, force = false } = {}) {
   return { ok: true, message: `${copied} agent(s) synced (${skipped} kept)${sharedCopied ? `, ${sharedCopied} _shared/*.md` : ''}${tail}`, copied, skipped, pruned };
 }
 
-// The dynamic model router lives at config/claude/model-router.json and is
-// copied to user-level `$CLAUDE_CONFIG_DIR/model-router.json` so Mike and the
-// SDK can select tiers without a repository cwd dependency.
+// The dynamic model router is operator-owned state. It is created only under
+// Bizar's global config root; a repository can never supply a runtime model.
+
+export const EMPTY_GLOBAL_MODEL_ROUTER = {
+  $schema: 'https://bizar.dev/schema/model-router.v3.json',
+  version: '13.0.0',
+  endpoint: null,
+  disabledProviders: ['anthropic'],
+  userSelected: { models: [], lastUpdated: null, source: 'default-empty', tierHints: {} },
+  gateway: { required: false, endpoint: null, availabilityProbe: '/models', discoveryTimeoutMs: 3000, unavailableBehavior: 'configured-tier-fallback' },
+  tiers: Object.fromEntries(['premium', 'high', 'mid-design', 'default', 'mid', 'budget'].map((name) => [name, { models: [] }])),
+  roleDefaults: { mike: 'premium', paul: 'premium', carl: 'premium', karen: 'high', linda: 'high', ria: 'mid-design', greg: 'default', steve: 'default', oscar: 'mid', todd: 'mid', susan: 'mid', pam: 'budget', brenda: 'budget', janet: 'budget', kevin: 'budget', brad: 'mid-design' },
+  policies: { mainOrchestrator: 'mike', selectionOwner: 'orchestrator', dispatchModelOverride: 'required-configured-candidate', unknownAgent: 'configured-tier-fallback', discoveryFailure: 'configured-tier-fallback', unavailableModel: 'configured-tier-fallback', silentProviderSubstitution: false, retryModelAliases: false, snapshotDecisions: true, maxDispatchModelAttempts: 1 },
+};
 
 export function isBizarManagedModelRouter(value) {
   return Boolean(
@@ -479,16 +490,14 @@ export function isBizarManagedModelRouter(value) {
 }
 
 export async function syncModelRouter({ dryRun = false, force = false } = {}) {
-  const src = join(REPO_ROOT, 'config', 'claude', 'model-router.json');
-  const dest = join(CLAUDE_DIR, 'model-router.json');
-  if (!existsSync(src)) return { ok: true, message: `no model-router at ${src}` };
-  if (existsSync(dest) && !force && !isBizarManagedModelRouter(readJsonSafe(dest, null))) {
-    return { ok: true, message: `${dest} is user-managed — pass --force to overwrite`, preserved: true };
+  const dest = resolveGlobalModelRouter();
+  if (existsSync(dest)) {
+    return { ok: true, message: `${dest} is operator-managed — preserved`, preserved: true };
   }
-  if (dryRun) return { ok: true, message: `[dry-run] would copy ${src} → ${dest}` };
-  ensureDir(CLAUDE_DIR);
-  copyFileSync(src, dest);
-  return { ok: true, message: `model-router.json → ${dest}`, path: dest };
+  if (dryRun) return { ok: true, message: `[dry-run] would create global model router at ${dest}` };
+  ensureDir(dirname(dest));
+  writeFileSync(dest, `${JSON.stringify(EMPTY_GLOBAL_MODEL_ROUTER, null, 2)}\n`);
+  return { ok: true, message: `global model-router.json → ${dest}`, path: dest };
 }
 
 export async function syncSkillFiles({ dryRun = false, force = false } = {}) {
@@ -949,16 +958,12 @@ export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
   // wins; otherwise the first enabled configured tier candidate is used.
   // This prevents Claude Code from falling through to an unconfigured
   // provider default when `userSelected.models` is intentionally empty.
-  // Dual-path read matches
-  // `cli/commands/models.mjs#readDisabledProviders` and
-  // `cli/commands/upgrade-defaults.mjs#readUserSelectedModels`.
-  const bizarRouterPath = process.env.BIZAR_MODEL_ROUTER_CONFIG?.trim()
-    || join(BIZAR_HOME(), 'config', 'claude', 'model-router.json');
-  const legacyRouterPath = join(CLAUDE_DIR, 'model-router.json');
+  // The Bizar global router is the sole source of model policy and picks.
+  const bizarRouterPath = resolveGlobalModelRouter();
   let installModel;
   let installContextTokens;
   let installModels = [];
-  for (const p of [bizarRouterPath, legacyRouterPath]) {
+  for (const p of [bizarRouterPath]) {
     if (!existsSync(p)) continue;
     const parsed = readJsonSafe(p, null);
     if (!parsed || typeof parsed !== 'object') continue;
@@ -966,8 +971,6 @@ export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
     installModels = configuredEnabledModels(parsed);
     installContextTokens = installModel ? configuredModelContextTokens(parsed, installModel) : undefined;
     if (installModel) break;
-    // The Bizar path is authoritative even when it has no enabled candidates.
-    if (p === bizarRouterPath) break;
   }
   if (installModel) {
     bizarSettings.model = installModel;
@@ -1177,16 +1180,16 @@ export async function runProvision(opts = {}) {
   await runStep('Installing git hooks', () => installGitHooks({ dryRun }));
   await runStep('Building SDK',       () => buildSdk({ dryRun }));
 
+  section('Ensuring global model-router.json');
+  const routerStep = await syncModelRouter({ dryRun, force });
+  if (routerStep.ok) logOk(routerStep.message); else logErr(routerStep.message);
+  stepResults.push({ label: 'model-router', ...routerStep });
+
   section('Writing settings.json');
   const settingsStep = writeClaudeSettings({ dryRun, force });
   if (settingsStep.ok) logOk(settingsStep.message); else logErr(settingsStep.message);
   stepResults.push({ label: 'settings.json', ...settingsStep });
 
-  section('Syncing model-router.json');
-  const routerStep = await syncModelRouter({ dryRun, force });
-  if (routerStep.ok) logOk(routerStep.message); else logErr(routerStep.message);
-  stepResults.push({ label: 'model-router', ...routerStep });
-
   section('MCP server (bizar)');
   const mcpStep = setupMcpServer({ dryRun });
   if (mcpStep.ok) logOk(mcpStep.message); else logWarn(mcpStep.message);
@@ -1221,7 +1224,7 @@ export async function runProvision(opts = {}) {
   // back to a clear hint to run `bizar models`.
   let premiumPick = null;
   try {
-    const routerPath = join(BIZAR_HOME(), 'config', 'claude', 'model-router.json');
+    const routerPath = resolveGlobalModelRouter();
     const router = JSON.parse(readFileSync(routerPath, 'utf8'));
     const picks = Array.isArray(router?.userSelected?.tierHints?.premium)
       ? router.userSelected.tierHints.premium.filter((id) => typeof id === 'string' && id)

package/config/agents/model-assignment.mjs

@@ -8,11 +8,12 @@
  */
 import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { resolveGlobalModelRouter } from '../../cli/config-paths.mjs';
 
-const ROOT = resolve(fileURLToPath(new URL('../..', import.meta.url)));
-export const DEFAULT_MODEL_ROUTER_PATH = resolve(ROOT, 'config', 'claude', 'model-router.json');
+/** Resolve the single operator-owned router at call time, never from a repo. */
+export function defaultModelRouterPath() {
+  return resolveGlobalModelRouter();
+}
 
 function fail(code, message) {
   const error = new Error(message);
@@ -39,9 +40,6 @@ function assertDynamicRegistry(registry) {
   if (!registry.tiers || typeof registry.tiers !== 'object' || Object.keys(registry.tiers).length === 0) {
     fail('MODEL_REGISTRY_INVALID', 'The model router must define at least one dynamic tier.');
   }
-  for (const [name, tier] of Object.entries(registry.tiers)) {
-    if (normalizeModelIds(tier?.models).length === 0) fail('MODEL_REGISTRY_INVALID', `Tier ${name} has no candidate models.`);
-  }
   const policies = registry.policies || {};
   if (policies.selectionOwner !== 'orchestrator') fail('MODEL_POLICY_INVALID', 'The orchestrator must own model selection.');
   if (!['configured-tier-fallback', 'inherit-session'].includes(policies.discoveryFailure)
@@ -54,7 +52,7 @@ function assertDynamicRegistry(registry) {
   return registry;
 }
 
-export function loadModelRouter(path = DEFAULT_MODEL_ROUTER_PATH) {
+export function loadModelRouter(path = defaultModelRouterPath()) {
   try {
     return assertDynamicRegistry(JSON.parse(readFileSync(path, 'utf8')));
   } catch (error) {
@@ -73,7 +71,16 @@ export function resolveDispatchModel({
   const definition = registry.tiers?.[chosenTier];
   if (!definition) fail('UNKNOWN_TIER', `Unknown model tier ${chosenTier}.`);
   const disabled = new Set(normalizeModelIds(registry.disabledProviders).map((prefix) => prefix.toLowerCase()));
-  const candidates = normalizeModelIds(definition.models)
+  const selected = normalizeModelIds(registry.userSelected?.models)
+    .filter((candidate) => ![...disabled].some((prefix) => candidate.toLowerCase().startsWith(prefix)));
+  const hints = registry.userSelected?.tierHints && typeof registry.userSelected.tierHints === 'object'
+    ? registry.userSelected.tierHints
+    : {};
+  // The operator's picker is authoritative. A matching tier hint narrows the
+  // pool; otherwise all enabled picks remain eligible rather than silently
+  // falling back to repository-supplied candidates.
+  const hinted = selected.filter((candidate) => hints[candidate] === chosenTier);
+  const candidates = (hinted.length > 0 ? hinted : selected.length > 0 ? selected : normalizeModelIds(definition.models))
     .filter((candidate) => ![...disabled].some((prefix) => candidate.toLowerCase().startsWith(prefix)));
   if (candidates.length === 0) fail('NO_ENABLED_TIER_MODEL', `Tier ${chosenTier} has no enabled candidate models.`);
   const available = availableModelIds == null ? null : new Set(normalizeModelIds(availableModelIds));

package/config/claude/CLAUDE.md

@@ -69,21 +69,18 @@ still deny prohibited actions and escalate externally visible or irreversible
 actions with `permissionDecision: "ask"`; that escalation list is the
 authoritative floor, not a starting point.
 
-Native dynamic workflows under `config/workflows/` and `~/.claude/workflows/`
-are the required dispatch mechanism for every primary request except an
-unmistakably tiny single-target copy/style/format edit with no behavior or test
-change. Mike may execute that narrow exception directly. All other work enters
-the matching research / implement / debug / review workflow and uses at least
-one explicitly modeled editing subagent with call-level worktree isolation.
-Do not add unnecessary phases or duplicate workers. For work that needs 3+
-long-lived workers with bounded cross-talk,
-Mike invokes a workflow that fans out as a native agent team; the team is
+Mike selects the coordination mode after bounded read-only orientation and one
+user clarification checkpoint: direct work only for an unmistakably tiny
+single-target copy/style/format edit; one isolated Agent for a clear bounded
+change; a native workflow for repeatable phased work; parallel Agents for
+disjoint scopes; and an Agent team for 3+ sustained roles that genuinely need
+cross-talk. Do not add unnecessary phases or duplicate workers. The team is
 host-side state under `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`, and per
-Anthropic's docs `team_name` is deprecated and ignored. When two or more
-subtasks have non-overlapping writable scopes and no data dependency, the
-orchestrator MUST dispatch them concurrently through `parallel([...])`, each
-with call-level `isolation: "worktree"`. Sequential dispatch is reserved for
-dependent phases and integration; never create artificial parallel work.
+Anthropic's docs `team_name` is deprecated and ignored. Every editing dispatch
+uses an explicit configured model and call-level `isolation: "worktree"`.
+When two or more subtasks have non-overlapping writable scopes and no data
+dependency, dispatch them concurrently; serialize only dependencies and
+integration.
 
 Agent roles are model-agnostic. Mike selects the cheapest sufficient enabled
 configured-tier model for each dispatch, with explicit user picks taking
@@ -147,11 +144,13 @@ The autonomy and approval policy above governs this execution model. The project
 Every non-empty primary request enters Bizar through `office-manager` (`@mike`).
 The installer sets Claude Code's global `agent` setting to Mike's frontmatter
 name (`mike`),
-and a session-scoped routing guard requires a successful native Workflow before
-substantive primary-session mutation. Read-only inspection remains available.
-Mike directly executes only the tiny edit exception above. Every other request
-must invoke a native Bizar workflow before mutation; the workflow dispatches
-worktree-isolated subagents while Mike owns integration and final verification.
+and the routing hook supplies the adaptive coordination policy. For non-tiny
+work, Mike first gathers only bounded read-only context, asks one concise
+clarification question that names the inferred outcome and proposed mode, then
+continues autonomously after the answer. A native workflow is one available
+mode, not a universal gate; Mike may select an isolated Agent, parallel Agents,
+or an Agent team when that better fits the work. Mike owns integration and
+final verification.
 A Bizar custom agent already executing its assigned role does not recursively
 dispatch itself.
 
@@ -163,8 +162,8 @@ relevant page. Guess-and-try integration work is prohibited. When official
 documentation is unavailable or ambiguous, inspect authoritative source code
 and report the evidence gap.
 
-For workflow-routed requests, `office-manager` uses only the phases that reduce
-a known risk; only the tiny edit exception skips this pipeline:
+For a workflow or team, `office-manager` uses only phases and members that
+reduce a known risk:
 
 1. Research: `greg` (`research-analyst.md`) plus an implementation-context specialist.
 2. Plan: `planner` drafts; `qa-reviewer` challenges assumptions and test shape.

package/config/claude/agents/office-manager.md

@@ -1,7 +1,7 @@
 ---
 name: mike
-description: Mike — workflow-first orchestrator with a tiny direct-edit exception.
-tools: Workflow, Agent, Read, Write, Edit, Bash, Grep, Glob, WebFetch, WebSearch, Skill
+description: Mike — adaptive orchestrator that selects the lightest safe coordination mode.
+tools: Workflow, Agent, Read, Write, Edit, Bash, Grep, Glob, WebFetch, WebSearch, Skill, AskUserQuestion
 skills:
   - i-have-adhd
 ---
@@ -12,24 +12,29 @@ Follow `_shared/AGENT_BASELINE.md`. You own the user outcome, integration, and
 final verification. Direct execution is a narrow exception; workflows are the
 default for meaningful work.
 
-## Route, then reassess if scope expands
+## Orient, clarify, then select the coordination mode
 
 | Shape | Signals | Execution |
 |---|---|---|
 | Tiny direct | one obvious copy, typo, comment, whitespace, or single style-token edit; one target; no behavior or test change | inspect, make the micro-edit, run the smallest proving check yourself |
-| Bounded workflow | known non-trivial implementation, including a logical bug or any behavioral change | invoke `bizar-implement`; it dispatches at least one editing worker with `isolation: "worktree"`; merge and verify |
-| Debug workflow | failing behavior, unclear cause, regression, or interacting state | invoke `bizar-debug`; keep diagnosis and fix evidence separate |
-| Research/shaped | external/version-sensitive behavior, architecture/security, broad review, or interacting components | invoke `bizar-research` or the matching `ultracode*` workflow; parallelize independent lanes and serialize dependencies |
-
-If a request could reasonably require a regression test, touch multiple files,
-or needs inspection to discover its scope, it is not tiny: invoke a workflow
-before editing. The primary session does not substitute an ad-hoc Agent call
-for the workflow. Research current official docs only for external or
+| Single isolated worker | one bounded implementation after scope is clear | dispatch one worktree-isolated Agent with an explicit Bizar model; integrate and verify |
+| Native workflow | repeatable diagnosis, research, review, or an implementation needing visible phase barriers | invoke the matching Bizar workflow with explicit Bizar routing |
+| Agent team | three or more sustained, independent roles need bounded cross-talk or coordinated handoff | use the native Agent-team capability; writers use worktrees and explicit Bizar models |
+| Parallel agents | two disjoint writable scopes with no cross-talk needed | dispatch concurrently with explicit models and worktree isolation |
+
+For every non-tiny request, first make only enough read-only inspection to
+understand the repository boundary and current constraints. Then ask the user
+one concise clarification checkpoint: state the inferred outcome, the material
+choice or risk, and the proposed coordination mode. Wait for the answer before
+writing, dispatching editors, creating branches, or running tests. If the user
+explicitly says to proceed without questions, record that choice and continue.
+After the answer, work autonomously until the requested outcome and verification
+are complete. Research current official docs only for external or
 version-sensitive claims. Inspect installed skills before hard or specialized
 work; if stuck with no match, search skills.sh and review the candidate before
 proposing installation.
 
-Before every Workflow call, read the global Bizar model router and construct a
+Before every Workflow, Agent, or Agent-team call, read the global Bizar model router and construct a
 small `args.routing` object whose `default`, `medium`, and `high` values are
 explicit enabled configured model IDs (user picks win; otherwise use enabled
 tier candidates). Include the user's task in the same args object under the
@@ -58,9 +63,10 @@ only when the router explicitly supplies it.
 
 ## Worktree Discipline and integration
 
-Every editing subagent call uses call-level `isolation: "worktree"`. Parallel
-writers receive disjoint file ownership and sibling scopes. Read-only research
-stays foreground. When a writer finishes, merge its queued branch with
+Every editing subagent call uses call-level `isolation: "worktree"`. Use teams
+only when collaboration changes the result; do not manufacture a team or a
+workflow for a simple isolated task. Parallel writers receive disjoint file
+ownership and sibling scopes. Read-only research stays foreground. When a writer finishes, merge its queued branch with
 `bizar worktree-merge`; report conflicts instead of guessing. The integration
 branch runs final tests once after all required results are incorporated.
 Worktree branches use `wt/<agent_type>-<short-task-id>`.

package/config/claude/agents/planner.md

@@ -43,7 +43,8 @@ Every plan you produce MUST follow this shape. The user (or Mike, or any downstr
 
 ## Subagent Model Selection
 
-When you delegate implementation, you recommend the model tier. Read `.claude/model-router.json` to confirm.
+When you delegate implementation, you recommend the model tier. Read the
+operator-global Bizar router (`$BIZAR_HOME/config/claude/model-router.json`) to confirm.
 
 | Task shape | Route to | Tier |
 |---|---|---|

package/config/claude/hooks/README.md

@@ -11,7 +11,7 @@ All hooks read Claude Code JSON from stdin and emit either no decision, addition
 | `simplify-guard.mjs` | PostToolUse Skill + PreToolUse Bash | require one `/simplify` per commit attempt |
 | `posttooluse-editwrite.mjs` | PostToolUse writes | local telemetry and test reminder |
 | `worker-suggest.mjs` | UserPromptSubmit | ranked skill/agent suggestions |
-| `workflow-route-guard.mjs` | UserPromptSubmit, PreToolUse, PostToolUse | requires a proven successful native workflow before substantive primary mutation; permits narrowly whitelisted, redirect-free Git inspection |
+| `workflow-route-guard.mjs` | UserPromptSubmit, PreToolUse, PostToolUse | records adaptive Bizar routing state without blocking Mike's selected coordination mode; workflow success clears the pending route record |
 | `thinking-route.mjs` | UserPromptSubmit | slash and mental-model routing |
 | `telemetry.mjs` | SessionStart/UserPromptSubmit | local correlation and rejection categories |
 | `sessionstart-prime.mjs` | SessionStart | bounded project and handoff context |

package/config/claude/hooks/agent-model-guard.mjs

@@ -44,9 +44,11 @@
  */
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 import { loadModelRouter } from '../../../config/agents/model-assignment.mjs';
+import { resolveClaudeConfigDir } from '../../../cli/config-paths.mjs';
 
 function deny(reason) {
   return {
@@ -152,6 +154,17 @@ function readFailoverBlock(toolInput) {
   };
 }
 
+function readConfiguredParentModel(options = {}) {
+  if (typeof options.parentModel === 'string') return options.parentModel.trim();
+  const settingsPath = options.settingsPath || join(resolveClaudeConfigDir(), 'settings.json');
+  try {
+    const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+    return typeof settings?.model === 'string' ? settings.model.trim() : '';
+  } catch {
+    return '';
+  }
+}
+
 export async function guardAgentModel(input, options = {}) {
   if (!input || typeof input !== 'object') return {};
   if (input.hook_event_name !== 'PreToolUse' || input.tool_name !== 'Agent') return {};
@@ -160,10 +173,6 @@ export async function guardAgentModel(input, options = {}) {
   const failoverBlock = readFailoverBlock(toolInput);
   const hasFailoverContract = Boolean(failoverBlock.routingDecisionId) && Boolean(failoverBlock.fallback);
 
-  if (!requested || requested === 'inherit') {
-    return deny('Bizar Agent dispatch blocked: every Agent call requires an explicit enabled model from `bizar models`; session/provider inheritance is prohibited.');
-  }
-
   let registry;
   try {
     registry = options.registry || loadModelRouter(options.routerPath);
@@ -181,6 +190,20 @@ export async function guardAgentModel(input, options = {}) {
   const allowed = configuredModels(registry);
   const userPicks = userSelectedModels(registry);
 
+  // The native Agent tool rejects arbitrary gateway IDs in its `model` enum.
+  // Inheritance is safe only when the auditable Bizar selection equals the
+  // actual global Claude parent model and is a selected, enabled user pick.
+  if (!requested || requested === 'inherit') {
+    const configured = typeof toolInput.additionalContext?.bizarConfiguredModel === 'string'
+      ? toolInput.additionalContext.bizarConfiguredModel.trim()
+      : '';
+    const parent = readConfiguredParentModel(options);
+    if (!configured || configured !== parent || !userPicks.has(configured)) {
+      return deny('Bizar Agent dispatch blocked: native Agent inheritance requires the global Claude parent model to exactly match an enabled Bizar user selection. Run `bizar models` and restart Claude Code.');
+    }
+    return {};
+  }
+
   // F-185 contract: when the orchestrator passes both `routingDecisionId`
   // and `fallback`, validate the fallback against the userSelected pool
   // but skip the live-discovery re-probe. The fallback's eligibility was

package/config/claude/hooks/sessionstart-model-sync.mjs

@@ -61,16 +61,12 @@ function readRouterPath() {
 
 /**
  * 10.22.0 / Phase 4: read the operator's `disabledProviders: string[]`
- * list with the same dual-path contract as `cli/commands/models.mjs`.
- * The Bizar path (`~/.config/bizar/config/claude/model-router.json`) wins
- * when both exist (even with explicit `[]`); the legacy
- * `~/.claude/model-router.json` mirror is the fallback. Whitespace +
- * lowercase normalization happens here. Returns `[]` on any failure —
+ * list from the sole global Bizar router. Whitespace + lowercase
+ * normalization happens here. Returns `[]` on any failure —
  * the hook is advisory and must NEVER block session start.
  */
 function readDisabledProviders() {
   const bizarPath = readRouterPath();
-  const legacyPath = join(resolveClaudeConfigDir(), 'model-router.json');
   const extract = (parsed) => {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
     if (!Array.isArray(parsed.disabledProviders)) return null;
@@ -85,18 +81,12 @@ function readDisabledProviders() {
   };
   if (existsSync(bizarPath)) {
     const parsed = readJsonIfObject(bizarPath);
-    // Bizar path exists — its `disabledProviders` is authoritative even
-    // when explicit `[]`. Missing key still falls back to the legacy.
+    // An explicit empty global list is a valid operator policy.
     if (parsed && Array.isArray(parsed.disabledProviders)) {
       const extracted = extract(parsed);
       if (extracted !== null) return extracted;
     }
   }
-  const legacy = readJsonIfObject(legacyPath);
-  if (legacy && Array.isArray(legacy.disabledProviders)) {
-    const extracted = extract(legacy);
-    if (extracted !== null) return extracted;
-  }
   return [];
 }
 
@@ -193,8 +183,7 @@ function syncOnce() {
     : {};
   // 10.22.0 / Phase 4: filter the operator's disabled-provider ids out
   // of the SessionStart re-apply so Claude Code's `/model` picker never
-  // surfaces e.g. `anthropic/*` after a session restart. Dual-path read
-  // matches `cli/commands/models.mjs#readDisabledProviders`.
+  // surfaces e.g. `anthropic/*` after a session restart.
   const disabled = readDisabledProviders();
   const selectedIds = filterDisabled(
     models.filter((id) => typeof id === 'string' && id.trim()),

package/config/claude/hooks/sessionstart-prime.mjs

@@ -186,13 +186,13 @@ function startupBriefing(cwd, featureBrief, recentCommits, projectLine, progress
     }
   }
   if (progressLast) lines.push(`- Progress: ${progressLast}.`);
-  lines.push('- You are @mike. Only an unmistakably tiny single-target copy/style/format edit is direct; every other change enters the matching native workflow before mutation. Use one isolated writer by default and parallel worktrees only for independent scopes.');
+  lines.push('- You are @mike. For non-tiny work, do bounded read-only orientation, ask one clarification checkpoint, then choose a single isolated worker, native workflow, parallel workers, or an Agent team by actual dependency. Use worktrees for editors and explicit Bizar models for every Agent.');
   lines.push('- External/version-sensitive work requires current official docs via WebSearch/WebFetch. Use relevant installed skills; apply i-have-adhd to user output. WIP=1.');
   lines.push('- TaskCompleted/SubagentStop/<task-notification> is terminal: consume <result>, mark done/failed, merge queued work, continue the objective.');
   // Default-first-stop hint when nothing is active yet.
   if (featureBrief && featureBrief.active.length === 0) {
     lines.push(
-      '- First move: read PROGRESS.md and feature_list.json; then choose the matching workflow, except for an unmistakably tiny direct edit.',
+      '- First move: read PROGRESS.md and feature_list.json, then do bounded orientation and ask the clarification checkpoint before choosing the fitting coordination mode.',
     );
   }
   return lines.join('\n');
@@ -203,14 +203,14 @@ function clearBriefing(cwd, recentCommits, progressLast) {
   if (progressLast) lines.push(`- Progress: ${progressLast}.`);
   if (recentCommits.length > 0) lines.push(`- Last commit: ${recentCommits[0]}.`);
   lines.push('- Context preserved in same repo / cwd — only the model turn was reset.');
-  lines.push('- You are @mike: continue through the active workflow; only an unmistakably tiny edit may stay direct.');
+  lines.push('- You are @mike: continue the active coordination plan; adapt it when new evidence changes the fit.');
   lines.push('- First move: continue from where the model left off; no need to reread project files.');
   return lines.join('\n');
 }
 
 function resumeBriefing(cwd, state) {
   const lines = ['Bizar SessionStart (resume):'];
-  lines.push('- You are @mike: restore state, then continue the active workflow; only an unmistakably tiny edit may stay direct.');
+  lines.push('- You are @mike: restore state, then continue the active coordination plan and adapt it if the evidence changed.');
   if (state) {
     if (state.activeFeature) lines.push(`- Last active feature: ${state.activeFeature}.`);
     if (state.reason) lines.push(`- Last session ended with: ${state.reason}.`);

package/config/claude/hooks/worker-suggest.mjs

@@ -6,7 +6,8 @@
  *
  * Runs on every user prompt. Only unmistakably tiny, single-scope edits take
  * a cheap fast path. Every other request is routed into a native Bizar
- * workflow that owns subagent dispatch.
+ * adaptive coordination mode selected by Mike after bounded orientation and a
+ * clarification checkpoint.
  *
  * Uses import.meta.url + dynamic import() to resolve the sibling CLI module so
  * the hook works regardless of install path (fixes ERR_MODULE_NOT_FOUND after
@@ -56,10 +57,10 @@ const FAST_ROUTE_POLICY = [
 ].join('\n');
 
 const ROUTE_POLICY = [
-  'Workflow-required Bizar routing policy:',
-  '- If this is the primary session, you ARE @mike. Do not implement this request directly in the primary session. Before any edit or mutation, invoke the matching native Bizar workflow; the primary owns routing, integration, and final verification.',
-  '- Use bizar-implement for known bounded changes, bizar-debug for bugs needing diagnosis, bizar-research for external or uncertain implementation context, and ultracode / ultracode-research / ultracode-review for broad, high-risk, or review-heavy objectives. Use only phases that reduce a concrete risk.',
-  '- The workflow must dispatch at least one implementation subagent with an explicit configured model and call-level `isolation: "worktree"`. For genuinely disjoint writable scopes, dispatch them concurrently; otherwise use one isolated writer. Never create duplicate workers merely to satisfy fan-out.',
+  'Adaptive Bizar routing policy:',
+  '- If this is the primary session, you ARE @mike. First do only bounded read-only orientation. Then ask one concise clarification question describing the inferred outcome, the material choice/risk, and your proposed coordination mode. Wait for the answer before edits, branches, tests, or editor dispatch. If the user explicitly waives questions, continue autonomously.',
+  '- After clarification, choose the lightest coordination mode: a direct tiny edit, one isolated Agent for a bounded change, a native Bizar Workflow for repeatable phased work, parallel Agents for disjoint scopes, or an Agent team only when 3+ sustained roles need cross-talk. Do not force a workflow or team when it adds no value.',
+  '- Every Agent or team member receives an explicit enabled configured Bizar model; use no provider alias, inheritance, or default. Every editing worker uses call-level `isolation: "worktree"`. For genuinely disjoint writable scopes, dispatch concurrently; otherwise use one owner.',
   '- Consume terminal agent results, merge queued worktrees with bizar worktree-merge, and run integration checks in the primary session. A subagent may not recursively dispatch itself.',
   '- Do NOT execute any tool you do not have. If a tool you need is missing from your tools list, dispatch to a subagent that has it — do not pretend you have it.',
   '- If you are already running as a Bizar custom agent, follow your assigned role and do not recursively dispatch yourself.',

package/config/claude/hooks/workflow-route-guard.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/** Enforce native-workflow entry before substantive primary-session mutation. */
+/** Preserve a mutation barrier while Mike selects an adaptive coordination mode. */
 'use strict';
 
 import {
@@ -13,6 +13,9 @@ import { parseGitCommands } from './git-command-parser.mjs';
 const READ_ONLY_GIT_SUBCOMMANDS = new Set([
   'diff', 'log', 'ls-files', 'rev-parse', 'show', 'status',
 ]);
+const READ_ONLY_BRANCH_OPTIONS = new Set([
+  '--all', '--list', '--remotes', '--show-current', '--verbose', '-a', '-r', '-v', '-vv',
+]);
 const WORKFLOW_SUCCESS = new Set(['completed', 'dry', 'ready-for-integration', 'succeeded', 'success']);
 const WORKFLOW_FAILURE = new Set(['blocked', 'budget-exhausted', 'cancelled', 'canceled', 'error', 'failed', 'failure']);
 
@@ -22,10 +25,17 @@ export function isReadOnlyShellInspection(command) {
 
   return source.split(/\s*&&\s*/).every((segment) => {
     const trimmed = segment.trim();
-    if (/^echo(?:\s|$)/.test(trimmed)) return true;
+    // These commands can inspect a newly opened project but cannot mutate it.
+    // Permit them before workflow launch so the primary can choose the right
+    // native workflow instead of deadlocking on its standard orientation step.
+    if (/^(?:echo|ls)(?:\s|$)/.test(trimmed) || trimmed === 'pwd') return true;
     if (!/^git(?:\s|$)/.test(trimmed) || /(?:^|\s)--(?:output|ext-diff)(?:=|\s|$)/.test(trimmed)) return false;
     const parsed = parseGitCommands(trimmed);
-    return parsed.length === 1 && READ_ONLY_GIT_SUBCOMMANDS.has(parsed[0].subcommand);
+    if (parsed.length !== 1) return false;
+    const [git] = parsed;
+    if (READ_ONLY_GIT_SUBCOMMANDS.has(git.subcommand)) return true;
+    return git.subcommand === 'branch'
+      && git.args.every((argument) => READ_ONLY_BRANCH_OPTIONS.has(argument));
   });
 }
 
@@ -77,17 +87,10 @@ process.stdin.on('end', () => {
       return;
     }
 
-    const readOnlyBash = toolName === 'Bash' && isReadOnlyShellInspection(input.tool_input?.command);
-    if (!readOnlyBash && /^(?:Edit|Write|MultiEdit|Bash|Agent)$/.test(toolName)) {
-      process.stdout.write(`${JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'PreToolUse',
-          permissionDecision: 'deny',
-          permissionDecisionReason: `Bizar workflow routing guard: ${toolName} is unavailable in the primary session until the required native Workflow runs successfully. Invoke bizar-implement, bizar-debug, bizar-research, or the matching ultracode workflow first.`,
-        },
-      })}\n`);
-      return;
-    }
+    // Coordination is an orchestrator decision, not a hard-coded tool gate.
+    // Instructions require orientation + clarification before mutation; Agent
+    // calls are independently protected by agent-model-guard.mjs. Keeping this
+    // hook advisory avoids trapping valid single-worker and Agent-team plans.
   } catch (error) {
     process.stderr.write(`[bizar.workflow-route] ${error?.message || String(error)}\n`);
   }

package/config/workflows/bizar-implement.js

@@ -3,7 +3,10 @@ export const meta = {
   description: 'Implement one bounded change in one worktree, or run explicitly supplied disjoint lanes concurrently',
   whenToUse: 'Use when implementation scope is understood and external research or root-cause discovery is unnecessary.',
   phases: [
-    { title: 'Implement', detail: 'Run one isolated writer, or explicit disjoint writers concurrently' },
+    { title: 'Scope', detail: 'Independently confirm the local implementation boundary and risks' },
+    { title: 'Plan', detail: 'Turn the bounded objective into owned edit lanes and checks' },
+    { title: 'Implement', detail: 'Run isolated writers for the approved lanes' },
+    { title: 'Review', detail: 'Independently verify each implementation result before integration' },
   ],
 }
 
@@ -52,9 +55,20 @@ const TOPIC = typeof args === 'string'
     : JSON.stringify(args || {})
 const SCOPE = (args && Array.isArray(args.scope)) ? args.scope : []
 const suppliedLanes = (args && Array.isArray(args.lanes)) ? args.lanes : []
+const fallbackLanes = [{ name: 'bounded-change', scope: SCOPE, task: TOPIC }]
+
+phase('Scope')
+const scopeEvidence = await parallel([
+  () => dispatchAgent(agent, 'scope-researcher', `Confirm the smallest repository-local implementation boundary for "${TOPIC}". Identify existing code, tests, configuration, and reusable utilities. Do not edit.`, { role: 'research-analyst', risk: 'medium', capabilities: ['structured-output', 'reasoning'], label: 'scope-repository', phase: 'Scope' }),
+  () => dispatchAgent(agent, 'scope-critic', `Independently challenge the assumed scope for "${TOPIC}". Identify hidden integration points, ownership conflicts, and the minimum regression evidence needed. Do not edit.`, { role: 'adversarial', risk: 'high', capabilities: ['structured-output', 'reasoning'], label: 'scope-risk', phase: 'Scope' }),
+])
+const scopeSummary = scopeEvidence.map((entry) => JSON.stringify(entry ?? '')).join('\n').slice(0, 4000)
+
+phase('Plan')
+const plan = await dispatchAgent(agent, 'bounded-planner', `Produce a minimal reversible plan for "${TOPIC}". Return disjoint edit lanes with a single owner for shared files, plus the smallest proving tests. Do not edit.\n${barrierRef({ phase: 'Scope', label: 'scope-evidence', summary: scopeSummary, payload: scopeEvidence }).promptBlock}`, { role: 'architect', risk: 'medium', capabilities: ['structured-output', 'reasoning', 'architecture'], label: 'plan', phase: 'Plan' })
 const lanes = (suppliedLanes.length > 0
   ? suppliedLanes
-  : [{ name: 'bounded-change', scope: SCOPE, task: TOPIC }]
+  : (Array.isArray(plan?.lanes) && plan.lanes.length > 0 ? plan.lanes : fallbackLanes)
 ).slice(0, 6)
 
 phase('Implement')
@@ -70,14 +84,23 @@ const implementations = lanes.length === 1
   : await parallel(lanes.map((lane, index) => () => runLane(lane, index)))
 const completed = implementations.filter(Boolean)
 
-if (completed.length === 0) {
-  return { status: 'blocked', reason: 'No implementation lane completed successfully.', lanes }
-}
+if (completed.length === 0) return { status: 'blocked', reason: 'No implementation lane completed successfully.', scopeEvidence, plan, lanes }
+
+phase('Review')
+const reviews = await parallel(completed.map((implementation, index) => () => dispatchAgent(
+  agent,
+  `implementation-reviewer-${index + 1}`,
+  `Review implementation lane "${lanes[index]?.name || index + 1}" for "${TOPIC}". Verify scope, correctness, regression evidence, and integration assumptions. Report only actionable defects and required checks; do not edit.\n${barrierRef({ phase: 'Implement', label: `implement:${index + 1}:${lanes[index]?.name || 'bounded-change'}`, summary: typeof implementation === 'string' ? implementation.slice(0, 400) : 'implementation artifact', payload: implementation }).promptBlock}`,
+  { role: 'adversarial', risk: 'high', capabilities: ['structured-output', 'reasoning'], label: `review:${index + 1}:${lanes[index]?.name || 'bounded-change'}`, phase: 'Review' },
+)))
 
 return {
   status: 'ready-for-integration',
   topic: TOPIC,
+  scopeEvidence,
+  plan,
   lanes,
   implementations: completed,
+  reviews: reviews.filter(Boolean),
   next: 'Merge queued worktrees and run integration verification in the primary session.',
 }

package/config/workflows/lib/dispatch.js

@@ -793,15 +793,17 @@ export function classifyDispatchOutcome(result, error, startMs) {
 }
 
 /**
- * Build the augmented agent-call payload. Adds `model`,
- * `routingDecisionId`, `tier`, and `selectorReason` so the Agent
- * tool can route correctly and the audit trail can prove which
- * selector step fired.
+ * Build the augmented agent-call payload. The native Agent model field cannot
+ * carry arbitrary gateway IDs, so the selected Bizar ID is audit context and
+ * the guard permits inheritance only from an identical configured parent.
  */
 export function augmentPayload(opts, decision, agentName) {
   return {
     ...opts,
-    model: decision.modelId ?? undefined,
+    additionalContext: {
+      ...(opts.additionalContext && typeof opts.additionalContext === 'object' ? opts.additionalContext : {}),
+      bizarConfiguredModel: decision.modelId ?? null,
+    },
     routingDecisionId: decision.routingDecisionId,
     tier: decision.tier,
     selectorReason: decision.reason,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "10.23.8",
+  "version": "10.23.10",
   "description": "Autonomous, human-in-the-loop multi-agent harness for Claude Code with guarded workflows, typed SDK primitives, and MCP tools.",
   "type": "module",
   "bin": {
@@ -25,7 +25,6 @@
     "config/claude/hooks/*.mjs",
     "config/claude/hooks/*.sh",
     "config/claude/hooks/README.md",
-    "config/claude/model-router.json",
     "config/claude/settings.json",
     "scripts/git-hooks/commit-msg",
     "scripts/git-hooks/pre-commit",
@@ -35,11 +34,11 @@
   ],
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "build:sdk": "node scripts/build-sdk.mjs",
+    "build:sdk": "node scripts/with-sdk-dist-lock.mjs node scripts/build-sdk.mjs",
     "test:sdk": "vitest run --root packages/sdk",
     "test:sdk:watch": "vitest --root packages/sdk",
     "test:node": "node scripts/run-node-tests.mjs",
-    "test": "npm run build:sdk && npm run test:sdk && npm run test:node",
+    "test": "node scripts/with-sdk-dist-lock.mjs node scripts/run-test-with-sdk-build.mjs",
     "build": "npm run build:sdk",
     "prepack": "npm run build",
     "prepublishOnly": "npm run build",

package/packages/sdk/dist/mcp/server.js

@@ -385,7 +385,7 @@ const bizarAuditTool = defineTool("bizar_audit", "Wrapper around `bizar audit --
     }
 }, { readOnlyHint: true });
 // `bizar model list --json` — gateway model inventory.
-const bizarModelListTool = defineTool("bizar_model_list", "Wrapper around `bizar models --json`. Returns ONLY the models the user has explicitly enabled via `bizar models` (the `userSelected` block of `config/claude/model-router.json`). Live discovery is filtered out by default to avoid surfacing dozens of unrelated models. Empty list = orchestrator inherits the active session model.", {}, async () => {
+const bizarModelListTool = defineTool("bizar_model_list", "Wrapper around `bizar models --json`. Returns ONLY the models the user has explicitly enabled via `bizar models` in the global Bizar router (`$BIZAR_HOME/config/claude/model-router.json#userSelected`). Live discovery is filtered out by default to avoid surfacing dozens of unrelated models. An empty list means no agent dispatch is permitted until the operator configures models.", {}, async () => {
     try {
         // Prefer the new `bizar models` surface; fall back to the legacy
         // `bizar model list` alias for older installs. The CLI is responsible

package/packages/sdk/dist/version.d.ts

@@ -1,5 +1,5 @@
 /**
  * SDK version constant. Keep synchronized with the workspace package versions.
  */
-export declare const SDK_VERSION: "10.23.8";
+export declare const SDK_VERSION: "10.23.9";
 //# sourceMappingURL=version.d.ts.map

package/packages/sdk/dist/version.js

@@ -1,5 +1,5 @@
 /**
  * SDK version constant. Keep synchronized with the workspace package versions.
  */
-export const SDK_VERSION = "10.23.8";
+export const SDK_VERSION = "10.23.9";
 //# sourceMappingURL=version.js.map

package/packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar-sdk",
-  "version": "10.23.8",
+  "version": "10.23.10",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/config/claude/model-router.json

@@ -1,131 +0,0 @@
-{
-  "$schema": "https://bizar.dev/schema/model-router.v3.json",
-  "version": "13.0.0",
-  "endpoint": null,
-  "disabledProviders": ["anthropic"],
-  "comment": "Mike selects the cheapest sufficient enabled configured model per dispatch. Explicit user-selected models take precedence; configured dynamic tiers are the fallback pool. The orchestrator always supplies an Agent model and fails closed when no enabled configured candidate exists, so Claude Code cannot select an unconfigured provider default. The gateway endpoint is intentionally null in the shipped config — operators MUST configure it via the `ANTHROPIC_BASE_URL` or `BIZAR_MODEL_ROUTER_URL` environment variable. Bizar is provider-agnostic and ships no default provider. `disabledProviders` (top-level, optional) is a case-insensitive-at-write, case-sensitive-at-filter list of provider prefixes whose model ids are stripped from every read site (CLI sync, picker, settings.json sync, SessionStart hook, Agent model guard). Defaults to `[]`; ships with `[\"anthropic\"]` so a fresh install never dispatches `anthropic/*` ids even if a gateway reports them.",
-  "userSelected": {
-    "models": [],
-    "lastUpdated": null,
-    "source": "default-empty",
-    "tierHints": {}
-  },
-  "gateway": {
-    "required": false,
-    "endpoint": null,
-    "availabilityProbe": "/models",
-    "discoveryTimeoutMs": 3000,
-    "unavailableBehavior": "configured-tier-fallback",
-    "documentation": "https://code.claude.com/docs/en/llm-gateway"
-  },
-  "tiers": {
-    "premium": {
-      "models": [
-        "qct/qwen3.8-max-preview",
-        "codex/gpt-5.6-sol",
-        "codex/gpt-5.6-luna"
-      ],
-      "purpose": "Architecture, high-risk planning, adversarial verification, and last-resort debugging where mistakes are expensive.",
-      "effort": "high"
-    },
-    "high": {
-      "models": [
-        "codex/gpt-5.6-sol",
-        "qct/qwen3.8-max-preview"
-      ],
-      "purpose": "Complex implementation, security review, and cross-cutting reasoning.",
-      "effort": "high"
-    },
-    "mid-design": {
-      "models": [
-        "codex/gpt-5.6-luna",
-        "minimax/MiniMax-M3"
-      ],
-      "purpose": "UI/UX design and product-quality implementation where visual judgment matters.",
-      "effort": "medium"
-    },
-    "default": {
-      "models": [
-        "minimax/MiniMax-M3",
-        "minimax/MiniMax-M2.7"
-      ],
-      "purpose": "Broad research, git operations, and ordinary engineering work.",
-      "effort": "medium"
-    },
-    "mid": {
-      "models": [
-        "minimax/MiniMax-M2.7",
-        "minimax/MiniMax-M2.7-highspeed",
-        "qct/deepseek-v4-pro",
-        "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free"
-      ],
-      "purpose": "Bounded technical analysis, code search, and moderate implementation.",
-      "effort": "medium"
-    },
-    "budget": {
-      "models": [
-        "glm/glm-5.3-flash",
-        "minimax/MiniMax-M2.7-highspeed"
-      ],
-      "purpose": "Routine deterministic edits, targeted clarification, and scripted verification.",
-      "effort": "low"
-    }
-  },
-  "roleDefaults": {
-    "mike": "premium",
-    "paul": "premium",
-    "carl": "premium",
-    "karen": "high",
-    "linda": "high",
-    "ria": "mid-design",
-    "greg": "default",
-    "steve": "default",
-    "oscar": "mid",
-    "todd": "mid",
-    "susan": "mid",
-    "pam": "budget",
-    "brenda": "budget",
-    "janet": "budget",
-    "kevin": "budget",
-    "brad": "mid-design"
-  },
-  "complexityRules": [
-    {
-      "when": "irreversible, security-sensitive, architectural, or previously failed twice",
-      "tier": "premium"
-    },
-    {
-      "when": "cross-cutting implementation or adversarial review",
-      "tier": "high"
-    },
-    {
-      "when": "UI or product design judgment dominates",
-      "tier": "mid-design"
-    },
-    {
-      "when": "bounded implementation or codebase research",
-      "tier": "mid"
-    },
-    {
-      "when": "deterministic, mechanical, or clarification-only",
-      "tier": "budget"
-    }
-  ],
-  "policies": {
-    "mainOrchestrator": "mike",
-    "selectionOwner": "orchestrator",
-    "dispatchModelOverride": "required-configured-candidate",
-    "unknownAgent": "configured-tier-fallback",
-    "discoveryFailure": "configured-tier-fallback",
-    "unavailableModel": "configured-tier-fallback",
-    "silentProviderSubstitution": false,
-    "retryModelAliases": false,
-    "snapshotDecisions": true,
-    "maxDispatchModelAttempts": 1
-  },
-  "costControls": {
-    "maxConcurrentAgents": 10,
-    "maxPremiumAgentsPerWorkflow": 3,
-    "preferInheritanceWhenDiscoveryUnavailable": false
-  }
-}