@raishin/vanguard-frontier-agentic 3.14.0 → 3.16.0

package/catalog/model-policy.json

@@ -15,42 +15,42 @@
     {
       "scope": "provider:dotnet",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:generic",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:hr",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:java",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:legal",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:netsuite",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:salesforce",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "agent:nextjs-specialist-agent",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "agent:oci-cloud-guard-responder-agent",
@@ -145,7 +145,7 @@
     {
       "scope": "agent:svelte-sveltekit-specialist-agent",
       "harness": "codex",
-      "model": "gpt-5.5"
+      "model": "gpt-6-sol"
     },
     {
       "scope": "provider:aws",

package/catalog/model-registry.json

@@ -1,12 +1,12 @@
 {
   "manifest_version": 1,
   "description": "Verified model-name and reasoning-effort capability matrix per harness. scripts/model-policy.mjs fails closed on model names and reasoning efforts not covered here, so a policy can never project a value that would 404 (OpenAI: HTTP 404 invalid_request_error/model_not_found; OpenRouter: HTTP 404) or be silently dropped at request time. Namespaces are evaluated in order; first 'match' wins. Human-readable matrix: docs/model-policy-matrix.md. Refresh workflow: .claude/skills/model-registry-refresh/SKILL.md.",
-  "last_refreshed": "2026-09-23",
+  "last_refreshed": "2026-10-06",
   "harnesses": {
     "codex": {
       "reasoning_key": "model_reasoning_effort",
       "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"],
-      "reasoning_note": "Codex does not check a configured effort against the model's advertised supported_reasoning_levels: resolve_reasoning_effort (codex-rs/protocol/src/openai_models/reasoning_effort.rs) passes every value through unchanged except ultra (sent as the model's multi_agent_reasoning_effort, else max) and persistent (sent as Custom(\"disabled\")), and the advertised list is used only to fill the TUI effort picker and to remap the effort when a session switches model (core/src/session/turn_context.rs). An unsupported pairing therefore fails, if at all, at the provider, so the registry narrows per model family below to make it fail at check time instead. o-series models predate none/minimal/xhigh; \"max\" is advertised only by the gpt-6 and gpt-5.6 families, and \"ultra\" only by gpt-6-astra, gpt-6-sol, gpt-5.6-sol and gpt-5.6-terra. The Responses reasoning guide states the accepted set is \"model-dependent and can include none, minimal, low, medium, high, xhigh, and max\", with defaults also model-dependent (gpt-5.6 and gpt-5.5 default to medium) — which is why narrowing lives per model here rather than at the harness level. Note that guide's detailed table omits \"minimal\" while its own opening sentence lists it; that is not treated as removal, since absence from one table contradicted by the same page's prose is not evidence a value was withdrawn. The Codex ReasoningEffort enum carries None|Minimal|Low|Medium|High|XHigh|Max|Ultra|Persistent plus a Custom(String) fallback, and the config schema types the key as a free-form non-empty string, so the harness itself does not reject a value — the narrowing here is what makes an unsupported pairing fail at check time instead of at the provider. \"ultra\" joined this vocabulary on 2026-09-23. It had been excluded because https://learn.chatgpt.com/docs/models documented the CLI effort list as Low|Medium|High|Extra high|Max and placed Ultra on web/desktop only; that page now lists \"Ultra — Maximum reasoning with automatic task delegation\" for the CLI surface, and https://learn.chatgpt.com/docs/config-file/config-reference documents model_reasoning_effort as \"low\", \"medium\", \"high\", \"xhigh\", \"max\", or \"ultra\" (\"Available levels depend on the model and client\"). It is registered only on the models whose entry in codex-rs/models-manager/models.json advertises it (gpt-6-astra, gpt-6-sol, gpt-5.6-sol, gpt-5.6-terra); the docs state GPT-6 Luna stops at Max, which the catalog agrees with. \"persistent\" stays out: it is an enum variant only — absent from the config reference and advertised by no model. This registry governs codex.toml, which is the CLI — an enum variant existing is not evidence the configured surface accepts it, the same distinction that applies to the ollama and openrouter routes. Note also that UI labels differ from wire values (the app shows \"Light\" for low, \"Extra High\" for xhigh), and that the app's Speed control (Fast/Standard) is a separate axis from effort with no documented codex.toml key, so it is not projectable at all.",
+      "reasoning_note": "Codex does not check a configured effort against the model's advertised supported_reasoning_levels: resolve_reasoning_effort (codex-rs/protocol/src/openai_models/reasoning_effort.rs) passes every value through unchanged except ultra (sent as the model's multi_agent_reasoning_effort, else max) and persistent (sent as Custom(\"disabled\")), and the advertised list is used only to fill the TUI effort picker and to remap the effort when a session switches model (core/src/session/turn_context.rs). An unsupported pairing therefore fails, if at all, at the provider, so the registry narrows per model family below to make it fail at check time instead. o-series models predate none/minimal/xhigh; \"max\" is advertised only by the gpt-6, gpt-6.1 and gpt-5.6 families, and \"ultra\" only by gpt-6-astra, gpt-6.1-sol, gpt-6-sol, gpt-5.6-sol and gpt-5.6-terra. The Responses reasoning guide states the accepted set is \"model-dependent and can include none, minimal, low, medium, high, xhigh, and max\", with defaults also model-dependent (gpt-5.6 and gpt-5.5 default to medium) — which is why narrowing lives per model here rather than at the harness level. Note that guide's detailed table omits \"minimal\" while its own opening sentence lists it; that is not treated as removal, since absence from one table contradicted by the same page's prose is not evidence a value was withdrawn. The Codex ReasoningEffort enum carries None|Minimal|Low|Medium|High|XHigh|Max|Ultra|Persistent plus a Custom(String) fallback, and the config schema types the key as a free-form non-empty string, so the harness itself does not reject a value — the narrowing here is what makes an unsupported pairing fail at check time instead of at the provider. \"ultra\" joined this vocabulary on 2026-09-23. It had been excluded because https://learn.chatgpt.com/docs/models documented the CLI effort list as Low|Medium|High|Extra high|Max and placed Ultra on web/desktop only; that page now lists \"Ultra — Maximum reasoning with automatic task delegation\" for the CLI surface, and https://learn.chatgpt.com/docs/config-file/config-reference documents model_reasoning_effort as \"low\", \"medium\", \"high\", \"xhigh\", \"max\", or \"ultra\" (\"Available levels depend on the model and client\"). It is registered only on the models whose entry in codex-rs/models-manager/models.json advertises it (gpt-6-astra, gpt-6.1-sol, gpt-6-sol, gpt-5.6-sol, gpt-5.6-terra); the docs state GPT-6 Luna stops at Max, which the catalog agrees with. \"persistent\" stays out: it is an enum variant only — absent from the config reference and advertised by no model. This registry governs codex.toml, which is the CLI — an enum variant existing is not evidence the configured surface accepts it, the same distinction that applies to the ollama and openrouter routes. Note also that UI labels differ from wire values (the app shows \"Light\" for low, \"Extra High\" for xhigh), and that the app's Speed control (Fast/Standard) is a separate axis from effort with no documented codex.toml key, so it is not projectable at all.",
       "namespaces": [
         {
           "id": "openai",
@@ -24,22 +24,26 @@
             "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json (gpt-6-sol, gpt-6-luna and per-model ultra support, verified 2026-09-23)",
             "https://learn.chatgpt.com/docs/config-file/config-reference (model_reasoning_effort values including ultra, verified 2026-09-23)",
             "https://learn.chatgpt.com/docs/models?surface=cli (CLI effort list including Ultra; GPT-6 Luna stops at Max, verified 2026-09-23)",
-            "Context7 /openai/codex resolve_reasoning_effort, build_reasoning and turn_context (a configured effort is sent unchanged except ultra and persistent; verified 2026-09-23)"
+            "Context7 /openai/codex resolve_reasoning_effort, build_reasoning and turn_context (a configured effort is sent unchanged except ultra and persistent; verified 2026-09-23)",
+            "https://developers.openai.com/api/docs/models (GPT-6.1 Sol model ID and reasoning list, verified 2026-10-06)",
+            "https://developers.openai.com/api/docs/deprecations (2026-10-01 GPT-5.3-Codex, GPT-5.1, GPT-5.4-Nano deprecation, verified 2026-10-06)",
+            "https://learn.chatgpt.com/docs/models?surface=cli (GPT-5.5 leaves ChatGPT sign-in Codex on 2026-10-14, API unaffected; verified 2026-10-06)"
           ],
           "models": [
             { "id": "gpt-6-astra", "reasoning_efforts": ["low", "medium", "high", "xhigh", "max", "ultra"], "last_verified": "2026-09-23", "source": "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json", "note": "flagship end-to-end coding model; the reasoning guide states outright that GPT-6 Astra does not support \"none\" reasoning effort; ultra is advertised in the Codex model catalog" },
+            { "id": "gpt-6.1-sol", "reasoning_efforts": ["low", "medium", "high", "xhigh", "max", "ultra"], "last_verified": "2026-10-06", "source": "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json", "note": "GPT-6.1 Sol; the API models page lists reasoning low|medium|high|xhigh|max and the reasoning guide states it does not support none or minimal; ultra is advertised in the Codex model catalog. Default effort is documented inconsistently (the API reasoning guide says medium, the Codex catalog default_reasoning_level is low), so pin an effort rather than relying on the default; requires Codex CLI 0.153.0 or later" },
             { "id": "gpt-6-sol", "reasoning_efforts": ["low", "medium", "high", "xhigh", "max", "ultra"], "last_verified": "2026-09-23", "source": "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json", "note": "flagship coding and agentic model per the API models page; listed in the Codex picker, default medium; requires Codex CLI 0.155.0 or later" },
             { "id": "gpt-6-luna", "reasoning_efforts": ["low", "medium", "high", "xhigh", "max"], "last_verified": "2026-09-23", "source": "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json", "note": "efficient high-volume model per the API models page; the Codex docs state it supports efforts up to Max but not Ultra; requires Codex CLI 0.155.0 or later" },
             { "id": "gpt-5.6", "reasoning_efforts": ["none", "low", "medium", "high", "xhigh", "max"], "last_verified": "2026-09-05", "source": "https://developers.openai.com/api/docs/models", "note": "alias routing to gpt-5.6-sol; family drops minimal" },
             { "id": "gpt-5.6-sol", "reasoning_efforts": ["none", "low", "medium", "high", "xhigh", "max", "ultra"], "last_verified": "2026-09-23", "source": "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json", "note": "ultra is advertised in the Codex model catalog; none comes from the API models page. The Codex catalog does not list none for this model, but Codex sends a configured effort unchanged, so the API decides whether it is accepted" },
             { "id": "gpt-5.6-terra", "reasoning_efforts": ["none", "low", "medium", "high", "xhigh", "max", "ultra"], "last_verified": "2026-09-23", "source": "https://raw.githubusercontent.com/openai/codex/main/codex-rs/models-manager/models.json", "note": "ultra is advertised in the Codex model catalog; none comes from the API models page. The Codex catalog does not list none for this model, but Codex sends a configured effort unchanged, so the API decides whether it is accepted" },
             { "id": "gpt-5.6-luna", "reasoning_efforts": ["none", "low", "medium", "high", "xhigh", "max"], "last_verified": "2026-09-05", "source": "https://developers.openai.com/api/docs/models" },
-            { "id": "gpt-5.5", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-09-08", "source": "Context7 /openai/codex codex-rs/models-manager/models.json (Codex model map, verified 2026-09-08)", "note": "still listed and visible in the Codex model map" },
+            { "id": "gpt-5.5", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "status": "retiring", "retirement_date": "2026-10-14", "successor": "gpt-6-sol", "last_verified": "2026-10-06", "source": "https://learn.chatgpt.com/docs/models?surface=cli", "note": "retires from ChatGPT, ChatGPT Work and Codex on all plans on 2026-10-14; the page directs ChatGPT sign-in users to replace gpt-5.5 \"in ... custom agents\" with gpt-6-sol (gpt-6-luna on Free/Go). That page states the retirement does not apply to the OpenAI API, so API-key Codex users can still call it — the entry is kept, and kept as the documented successor of gpt-5-2025-08-07, but marked retiring because Codex under ChatGPT sign-in is a surface this namespace governs. The repo policy no longer pins it" },
             { "id": "gpt-5.5-pro", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-07-09" },
             { "id": "gpt-5.4", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-09-08", "source": "Context7 /openai/codex codex-rs/models-manager/models.json (Codex model map, verified 2026-09-08)", "note": "present but visibility:hide in the Codex model map — legacy, kept because the policy still pins it; not a lifecycle status, and no retirement date is documented" },
             { "id": "gpt-5.4-mini", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-09-08", "source": "Context7 /openai/codex codex-rs/models-manager/models.json (Codex model map, verified 2026-09-08)", "note": "present but visibility:hide in the Codex model map — legacy" },
-            { "id": "gpt-5.4-nano", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-07-09" },
-            { "id": "gpt-5.3-codex", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-07-09" },
+            { "id": "gpt-5.4-nano", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "status": "retiring", "retirement_date": "2027-04-01", "successor": "gpt-6-luna", "last_verified": "2026-10-06", "source": "https://developers.openai.com/api/docs/deprecations", "note": "deprecation announced 2026-10-01; shutdown 2027-04-01, replacement gpt-6-luna" },
+            { "id": "gpt-5.3-codex", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "status": "retiring", "retirement_date": "2027-04-01", "successor": "gpt-6-sol", "last_verified": "2026-10-06", "source": "https://developers.openai.com/api/docs/deprecations", "note": "deprecation announced 2026-10-01; shutdown 2027-04-01, replacement gpt-6-sol" },
             { "id": "gpt-5.1-codex-mini", "reasoning_efforts": ["none", "minimal", "low", "medium", "high", "xhigh"], "last_verified": "2026-07-09" },
             { "id": "gpt-4.1-mini", "reasoning_efforts": [], "last_verified": "2026-07-09", "note": "non-reasoning text model" },
             { "id": "gpt-4.1-nano", "reasoning_efforts": [], "last_verified": "2026-07-09", "note": "non-reasoning text model" },
@@ -95,7 +99,7 @@
             "https://openrouter.ai/docs/guides/best-practices/reasoning-tokens (chat-completions surface — wider vocabulary, not the route used here)",
             "https://openrouter.ai/docs/api_reference/responses/reasoning (Responses route; the vocabulary this namespace enforces, verified 2026-09-08)"
           ],
-          "examples": ["anthropic/claude-sonnet-4.5", "openai/gpt-4o", "google/gemini-2.5-pro"]
+          "examples": ["openai/gpt-6.1-sol", "anthropic/claude-sonnet-5.5", "google/gemini-3.8-flash", "anthropic/claude-sonnet-4.5", "openai/gpt-4o", "google/gemini-2.5-pro"]
         }
       ]
     },
@@ -109,9 +113,9 @@
           "description": "Version-floating aliases resolved by Claude Code to maintained defaults. Enumerated rather than shape-only so that per-alias effort narrowing is expressible: the alias namespace is matched before the pinned anthropic namespace, so leaving it open would let model \"haiku\" inherit the full harness vocabulary and bypass the empty reasoning_efforts carried by the pinned Claude Haiku 4.5 ids.",
           "match": "^(sonnet|opus|haiku|fable|inherit)$",
           "membership": "closed",
-          "sources": ["https://code.claude.com/docs/en/sub-agents", "https://platform.claude.com/docs/en/about-claude/models/overview"],
+          "sources": ["https://code.claude.com/docs/en/sub-agents", "https://platform.claude.com/docs/en/about-claude/models/overview", "https://code.claude.com/docs/en/model-config (per-provider alias resolution, verified 2026-10-06)"],
           "models": [
-            { "id": "sonnet", "last_verified": "2026-09-05", "note": "floating alias for the maintained Sonnet default" },
+            { "id": "sonnet", "last_verified": "2026-10-06", "source": "https://code.claude.com/docs/en/model-config", "note": "floating alias for the maintained Sonnet default; resolves per provider — Sonnet 5.5 on the Anthropic API, Sonnet 4.6 on Claude Platform on AWS, Sonnet 4.5 on Amazon Bedrock, Google Cloud and Microsoft Foundry. Inherits the full vocabulary, which matches the Anthropic API resolution only: on a provider where it resolves to Sonnet 4.5 an effort value is unsupported" },
             { "id": "opus", "last_verified": "2026-09-05", "note": "floating alias for the maintained Opus default" },
             { "id": "haiku", "reasoning_efforts": [], "last_verified": "2026-09-05", "source": "https://platform.claude.com/docs/en/about-claude/models/overview", "note": "resolves to Claude Haiku 4.5, which does not support effort; gated here so the alias matches the pinned ids" },
             { "id": "fable", "last_verified": "2026-09-05", "note": "floating alias for the maintained Fable default" },
@@ -133,10 +137,11 @@
             { "id": "claude-opus-4-6", "reasoning_efforts": ["low", "medium", "high", "max"], "last_verified": "2026-09-08", "source": "https://platform.claude.com/docs/en/build-with-claude/effort", "note": "effort page lists max but not xhigh for Opus 4.6" },
             { "id": "claude-opus-4-5", "reasoning_efforts": ["low", "medium", "high"], "last_verified": "2026-09-08", "source": "https://platform.claude.com/docs/en/about-claude/models/model-ids-and-versions", "note": "preferred readable form; pre-4.6 alias pointing at claude-opus-4-5-20251101. Supports effort but is absent from both the xhigh and max availability lists" },
             { "id": "claude-opus-4-5-20251101", "reasoning_efforts": ["low", "medium", "high"], "last_verified": "2026-09-08", "source": "https://platform.claude.com/docs/en/build-with-claude/effort", "note": "dated snapshot the claude-opus-4-5 alias resolves to; pin only when an exact snapshot is required" },
+            { "id": "claude-sonnet-5-5", "last_verified": "2026-10-06", "source": "https://platform.claude.com/docs/en/build-with-claude/effort", "note": "current Sonnet lineup; the dateless ID is its own pinned snapshot; on both the xhigh and max lists (\"supports all five effort levels, and high is the default\"); requires Claude Code v2.1.284 or later" },
             { "id": "claude-sonnet-5", "last_verified": "2026-09-05", "source": "https://platform.claude.com/docs/en/about-claude/models/overview" },
             { "id": "claude-sonnet-4-6", "reasoning_efforts": ["low", "medium", "high", "max"], "last_verified": "2026-09-08", "source": "https://platform.claude.com/docs/en/build-with-claude/effort", "note": "effort page lists max but not xhigh for Sonnet 4.6" },
-            { "id": "claude-sonnet-4-5", "reasoning_efforts": [], "last_verified": "2026-09-08", "source": "https://platform.claude.com/docs/en/about-claude/models/model-ids-and-versions", "note": "preferred readable form; pre-4.6 alias pointing at claude-sonnet-4-5-20250929. Absent from the effort page supported-models list, so effort is not projectable" },
-            { "id": "claude-sonnet-4-5-20250929", "reasoning_efforts": [], "last_verified": "2026-09-08", "source": "https://platform.claude.com/docs/en/build-with-claude/effort", "note": "dated snapshot the claude-sonnet-4-5 alias resolves to; pin only when an exact snapshot is required" },
+            { "id": "claude-sonnet-4-5", "reasoning_efforts": [], "last_verified": "2026-10-06", "source": "https://platform.claude.com/docs/en/about-claude/models/model-ids-and-versions", "status": "retiring", "retirement_date": "2026-11-30", "successor": "claude-sonnet-5-5", "note": "preferred readable form; pre-4.6 alias pointing at claude-sonnet-4-5-20250929, so it retires with that snapshot (deprecated 2026-09-30, replacement claude-sonnet-5-5). Absent from the effort page supported-models list, so effort is not projectable" },
+            { "id": "claude-sonnet-4-5-20250929", "reasoning_efforts": [], "status": "retiring", "retirement_date": "2026-11-30", "successor": "claude-sonnet-5-5", "last_verified": "2026-10-06", "source": "https://platform.claude.com/docs/en/about-claude/model-deprecations", "note": "dated snapshot the claude-sonnet-4-5 alias resolves to; deprecated 2026-09-30, retiring 2026-11-30, replacement claude-sonnet-5-5" },
             { "id": "claude-haiku-4-5", "reasoning_efforts": [], "last_verified": "2026-09-05", "source": "https://platform.claude.com/docs/en/build-with-claude/effort", "note": "absent from the effort page supported-models list" },
             { "id": "claude-haiku-4-5-20251001", "reasoning_efforts": [], "last_verified": "2026-09-05", "source": "https://platform.claude.com/docs/en/about-claude/models/overview", "note": "dated snapshot ID; effort not supported" },
             { "id": "claude-fable-5", "last_verified": "2026-09-05", "source": "https://platform.claude.com/docs/en/about-claude/model-deprecations" }
@@ -158,12 +163,22 @@
         },
         {
           "id": "named",
-          "description": "Named models documented for Cursor subagent frontmatter. Cursor's picker evolves quickly and availability is plan/admin-dependent — verify with Cursor.models.list() and extend via the refresh workflow. A model id may carry Cursor's documented per-model parameter group in square brackets (cursor.com/docs/subagents), e.g. claude-opus-5[effort=high,context=300k]; the documented keys are fast, effort and context. The allowlist below enumerates BASE ids only — the parameter group is a per-rule modifier, so membership is checked against the id with the group stripped. This pattern deliberately shapes the group only (charset, single trailing pair of brackets) rather than encoding key=value structure: a nested-quantifier pattern is rejected by the registry ReDoS guard, and the precise structure — key=value pairs, no duplicates, keys restricted to the documented set — is enforced semantically by scripts/model-policy.mjs, which gives a clearer error than a regex miss would.",
+          "description": "Named models documented for Cursor subagent frontmatter. Cursor's picker evolves quickly and availability is plan/admin-dependent — verify with Cursor.models.list() and extend via the refresh workflow. A model id may carry Cursor's documented per-model parameter group in square brackets (cursor.com/docs/subagents), e.g. claude-opus-5[effort=high,context=300k]; the documented keys are fast, effort and context. The allowlist below enumerates BASE ids only — the parameter group is a per-rule modifier, so membership is checked against the id with the group stripped. This pattern deliberately shapes the group only (charset, single trailing pair of brackets) rather than encoding key=value structure: a nested-quantifier pattern is rejected by the registry ReDoS guard, and the precise structure — key=value pairs, no duplicates, keys restricted to the documented set — is enforced semantically by scripts/model-policy.mjs, which gives a clearer error than a regex miss would. Evidence for entries verified 2026-10-06: the subagents page says a specific model ID may be used and points to the models reference for available IDs; each per-model page under cursor.com/docs/models states a \"Model ID\" (e.g. claude-sonnet-5-5, hyphenated, not claude-sonnet-5.5) and those are the values registered. The subagents page itself names only composer-2 and gpt-5.6-sol, so confirm with Cursor.models.list() before relying on one.",
           "match": "^[a-z0-9][a-z0-9.-]*(\\[[a-z0-9.=,]+\\])?$",
           "membership": "closed",
-          "sources": ["https://cursor.com/docs/subagents", "https://cursor.com/docs/cli/reference/configuration"],
+          "sources": ["https://cursor.com/docs/subagents", "https://cursor.com/docs/cli/reference/configuration", "https://cursor.com/docs/models (per-model pages give the Model ID, verified 2026-10-06)"],
           "models": [
             { "id": "gpt-5.6-sol", "last_verified": "2026-09-05", "source": "https://cursor.com/docs/subagents" },
+            { "id": "claude-sonnet-5-5", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/claude-sonnet-5-5" },
+            { "id": "claude-opus-5-5", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/claude-opus-5-5" },
+            { "id": "claude-fable-5-1", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/claude-fable-5-1" },
+            { "id": "gpt-5.6-terra", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/gpt-5-6-terra" },
+            { "id": "gpt-5.6-luna", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/gpt-5-6-luna" },
+            { "id": "gemini-3.1-pro", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/gemini-3-1-pro" },
+            { "id": "gemini-3.8-flash", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/gemini-3-8-flash" },
+            { "id": "grok-4.7", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/grok-4-7" },
+            { "id": "grok-4.6", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/grok-4-6" },
+            { "id": "muse-spark-1.3", "last_verified": "2026-10-06", "source": "https://cursor.com/docs/models/muse-spark-1-3" },
             { "id": "gpt-5.5", "last_verified": "2026-07-09" },
             { "id": "gpt-5", "last_verified": "2026-07-09" },
             { "id": "claude-opus-5", "last_verified": "2026-09-05", "source": "https://cursor.com/docs/subagents" },

package/catalog/mods.json

@@ -0,0 +1,131 @@
+[
+  {
+    "id": "audit-trail",
+    "name": "Audit Trail",
+    "version": "1.0.0",
+    "description": "Appends one JSON line per tool call to a per-session log with sha256 hashes of the arguments and result.",
+    "reach_level": 1,
+    "events": [
+      "PostToolUse"
+    ],
+    "harnesses": [
+      "claude-code",
+      "codex",
+      "kiro"
+    ],
+    "path": "mods/audit-trail",
+    "footprint": {
+      "env_reads": [
+        "VANGUARD_AUDIT_TRAIL_LOG_DIR",
+        "VANGUARD_AUDIT_TRAIL_SESSION_ID",
+        "VANGUARD_AUDIT_TRAIL_AGENT_ID"
+      ],
+      "file_writes": [
+        ".audit/**"
+      ],
+      "spawns": [],
+      "egress_hosts": []
+    }
+  },
+  {
+    "id": "blast-radius-guard",
+    "name": "Blast Radius Guard",
+    "version": "1.0.0",
+    "description": "Asks before, or blocks, destructive shell commands and writes to system paths.",
+    "reach_level": 0,
+    "events": [
+      "PreToolUse"
+    ],
+    "harnesses": [
+      "claude-code",
+      "codex",
+      "kiro"
+    ],
+    "path": "mods/blast-radius-guard",
+    "footprint": {
+      "env_reads": [
+        "VANGUARD_BLAST_RADIUS_GUARD_MODE",
+        "VANGUARD_BLAST_RADIUS_GUARD_PATTERNS"
+      ],
+      "file_writes": [],
+      "spawns": [],
+      "egress_hosts": []
+    }
+  },
+  {
+    "id": "context-burn",
+    "name": "Context Burn",
+    "version": "1.0.0",
+    "description": "Tracks context use per session in a status file and warns at 70% and 90% where the harness reports token use.",
+    "reach_level": 1,
+    "events": [
+      "PostToolUse",
+      "SessionStart"
+    ],
+    "harnesses": [
+      "claude-code",
+      "codex",
+      "kiro"
+    ],
+    "path": "mods/context-burn",
+    "footprint": {
+      "env_reads": [
+        "VANGUARD_CONTEXT_BURN_STATUS_PATH"
+      ],
+      "file_writes": [
+        ".claude/context-burn-status/*.json",
+        ".kiro/context-burn-status/*.json",
+        ".codex/context-burn-status/*.json"
+      ],
+      "spawns": [],
+      "egress_hosts": []
+    }
+  },
+  {
+    "id": "live-guard-gate",
+    "name": "Live Guard Gate",
+    "version": "1.0.0",
+    "description": "Asks before live cloud mutations and names the guard agent that should review them.",
+    "reach_level": 0,
+    "events": [
+      "PreToolUse"
+    ],
+    "harnesses": [
+      "claude-code",
+      "codex",
+      "kiro"
+    ],
+    "path": "mods/live-guard-gate",
+    "footprint": {
+      "env_reads": [],
+      "file_writes": [],
+      "spawns": [],
+      "egress_hosts": []
+    }
+  },
+  {
+    "id": "secret-redactor",
+    "name": "Secret Redactor",
+    "version": "1.0.0",
+    "description": "Asks before tool calls whose input carries a credential and redacts credentials from tool output.",
+    "reach_level": 0,
+    "events": [
+      "PreToolUse",
+      "PostToolUse"
+    ],
+    "harnesses": [
+      "claude-code",
+      "codex",
+      "kiro"
+    ],
+    "path": "mods/secret-redactor",
+    "footprint": {
+      "env_reads": [
+        "VANGUARD_SECRET_REDACTOR_PATTERNS"
+      ],
+      "file_writes": [],
+      "spawns": [],
+      "egress_hosts": []
+    }
+  }
+]

package/mods/README.md

@@ -0,0 +1,220 @@
+# Vanguard Mods
+
+<div align="center">
+
+  <img src="../assets/logos/vanguard-frontier-agentic-logo.png" alt="Vanguard Frontier Agentic" width="140" />
+
+  <p><strong>Less “oops.” More visibility.</strong></p>
+  <p>Tool-call guardrails and observers for Claude Code, Kiro and Codex.</p>
+
+  <p>
+    <a href="#pick-a-mod">Pick a mod</a> &nbsp;·&nbsp;
+    <a href="#get-started">Get started</a> &nbsp;·&nbsp;
+    <a href="#know-the-limits">Know the limits</a> &nbsp;·&nbsp;
+    <a href="#under-the-hood">Under the hood</a>
+  </p>
+
+</div>
+
+---
+
+Skills guide the agent. **Mods inspect its tool calls.** Ask before risky actions,
+redact supported output, or record what happened. Pick what you need—not everything at once.
+
+<a id="pick-a-mod"></a>
+
+## 🧰 Pick your guardrails
+
+| Mod | The job | Reach |
+| --- | --- | --- |
+| [Secret Redactor](secret-redactor/README.md) | Spot credential-shaped input; redact supported output. | L0 |
+| [Blast Radius Guard](blast-radius-guard/README.md) | Ask or deny on destructive commands and system-path writes. | L0 |
+| [Live Guard Gate](live-guard-gate/README.md) | Flag cloud mutations and name guard agents to consult. | L0 |
+| [Context Burn](context-burn/README.md) | Count tool calls; warn on reported context use where supported. | L1 |
+| [Audit Trail](audit-trail/README.md) | Append call hashes and per-session sequence numbers. | L1 |
+
+**Reach is a label, not a sandbox:** L0 = no declared writes/spawns/network;
+L1 = file writes; L2 = subprocesses; L3 = network (warned, not blocked).
+Reads are allowed at L0; starting the Node adapter is not a mod-spawned subprocess.
+
+**Support differs:** Kiro/Codex deny instead of asking and cannot redact output.
+Claude Code Audit Trail needs classic. Classic Post hooks miss failed calls.
+
+<details>
+<summary><strong>🔎 Same mod, different harness? Check the fine print.</strong></summary>
+
+| Mod | Claude Code native | Claude Code classic | Kiro / Codex |
+| --- | --- | --- | --- |
+| Secret Redactor | Ask on input; redact or withhold output | Ask on input; replace successful output only | Deny matching input; no output redaction |
+| Blast Radius Guard | Ask in confirm mode; deny in block mode | Same | Deny in either mode |
+| Live Guard Gate | Ask and name guard agents | Same | Deny and name guard agents |
+| Context Burn | Session context usage and threshold toasts | Tool-call counter only | Tool-call counter only |
+| Audit Trail | Unsupported—use classic | Append after successful calls | Append; Kiro payload interpretation is degraded |
+
+Guards use `PreToolUse`; supported redaction and observers use `PostToolUse`;
+Context Burn also uses `SessionStart`.
+Native equivalents are `tool.check`, `tool.call` and `session.start`.
+
+Kiro's stdin fields are undocumented: guards scan the whole payload if input is
+unrecognized; Audit Trail hashes that payload as arguments and `null` as the result.
+Set `VANGUARD_AUDIT_TRAIL_SESSION_ID` to avoid its shared `unsessioned` fallback.
+See generated `<harness>/UNSUPPORTED.md` for remaining limits.
+
+</details>
+
+---
+
+<a id="get-started"></a>
+
+## 🚀 Get started
+
+Use a local checkout. Command adapters need **Node 22+**; native modules use the
+harness runtime. No service needed.
+
+```bash
+source=/absolute/path/to/vanguard-frontier-agentic
+target=/absolute/path/to/your/project
+mod=blast-radius-guard
+```
+
+> [!IMPORTANT]
+> **Native or classic. Not both for the same mod.** They duplicate checks and can
+> double-count Context Burn. Audit Trail has no native adapter—use classic.
+
+<details>
+<summary><strong>🤖 Claude Code native</strong> — load a plugin root</summary>
+
+```bash
+cd "$target"
+claude --plugin-dir "$source/mods/$mod"
+```
+
+Not for `audit-trail`. Native API: early access. Check the verified build in the
+[implementation notes](#under-the-hood) before upgrading.
+
+</details>
+
+<details>
+<summary><strong>🤖 Claude Code classic</strong> — copy, then merge hooks</summary>
+
+```bash
+mkdir -p "$target/.claude/vanguard-mods/$mod"
+cp -R "$source/mods/$mod/bin" "$source/mods/$mod/lib" "$target/.claude/vanguard-mods/$mod/"
+```
+
+Append `mods/<id>/claude-code/settings.hooks.json` entries under `hooks` in the
+target's `.claude/settings.json`. **Keep existing hooks/settings.** Generated command:
+
+```text
+node "$CLAUDE_PROJECT_DIR/.claude/vanguard-mods/<id>/bin/hook.mjs" --harness claude-code --event <event>
+```
+
+`CLAUDE_PROJECT_DIR` stays at the initial project root, even across worktree changes.
+Observers resolve relative writes from the installed adapter location.
+
+</details>
+
+<details>
+<summary><strong>🔮 Kiro</strong> — copy the adapters and hook JSON</summary>
+
+```bash
+mkdir -p "$target/.kiro/hooks" "$target/.kiro/vanguard-mods/$mod"
+cp -R "$source/mods/$mod/bin" "$source/mods/$mod/lib" "$target/.kiro/vanguard-mods/$mod/"
+cp "$source/mods/$mod/kiro/"*-hook.json "$target/.kiro/hooks/"
+```
+
+Copy only `*-hook.json`, not `UNSUPPORTED.md`. Replace the relative script path
+inside each hook with its **absolute installed path**: hook cwd is undocumented.
+Commands use `--harness kiro --event <event>`; confirmation requests deny with exit 2.
+
+</details>
+
+<details>
+<summary><strong>⚡ Codex</strong> — copy, merge, then review trust</summary>
+
+```bash
+mkdir -p "$target/.codex/vanguard-mods/$mod"
+cp -R "$source/mods/$mod/bin" "$source/mods/$mod/lib" "$target/.codex/vanguard-mods/$mod/"
+```
+
+Append event entries from `mods/<id>/codex/hooks.json` to the target's
+`.codex/hooks.json`, preserving existing hooks. Replace relative script paths with
+**absolute installed paths**; hook cwd is undocumented. Complete Codex's hook trust review.
+
+Commands use `--harness codex --event <event>`; asks deny with exit 2.
+Redactor Post is unsupported; the narrower MCP output field is not substituted.
+
+</details>
+
+**Try it before trusting it:** run ordinary and harmless pattern-matching calls in
+the harness. Inspect the decision, output or observer file—not just exit codes.
+Repeat after path, permission, Node or harness changes.
+
+---
+
+<a id="know-the-limits"></a>
+
+## ⚠️ Guardrails, not guarantees
+
+- **A hook must run to help.** Guards deny handler/input errors; missing Node,
+  moved scripts, startup crashes and timeouts can leave calls unguarded.
+  CLI errors may not block; Kiro IDE handling differs.
+- **Regex is not complete DLP.** Pre checks never rewrite arguments; approved input
+  still reaches the tool. Post redaction does not scrub other logs or network traffic.
+  Redactor errors attempt withholding; classic shape mismatches may be ignored.
+  [Withholding has limits, too](secret-redactor/README.md#limitations).
+- **A review prompt is not authorization.** Live Guard Gate names agents—it never
+  spawns them or verifies production accounts. Guards scan strings, not shell semantics;
+  relative paths stay unresolved. Bypass modes can auto-approve an ask.
+- **Observers are not compliance proof.** Node counters track calls, not tokens or
+  spend; only native Context Burn uses reported context data. Unlocked updates can
+  lose increments. Audit logs are mutable, unsigned and not tamper-evident.
+  Observer failures do not block tools.
+
+<details>
+<summary><strong>🗂️ State files and custom patterns</strong></summary>
+
+- **Context Burn:** `.<harness>/context-burn-status/<session-hash>.json`
+  (`.claude` for Claude Code). Filenames use the full lowercase SHA-256 of the UTF-8
+  session ID, never raw IDs. Missing/empty Node IDs share `unsessioned` state.
+  `VANGUARD_CONTEXT_BURN_STATUS_PATH` is an exact override; sharing it opts out of
+  isolation. Old single-file state is not migrated automatically.
+- **Audit Trail:** `.audit/<UTC-date>/<session>.jsonl`; an earlier file is reused
+  across dates. `VANGUARD_AUDIT_TRAIL_LOG_DIR` overrides the directory.
+- **Footprints disclose defaults, not containment.** Overrides can write outside
+  declared globs; overlap checks do not constrain operator overrides.
+- **Patterns append, never replace.** `VANGUARD_SECRET_REDACTOR_PATTERNS` and
+  `VANGUARD_BLAST_RADIUS_GUARD_PATTERNS` accept extra pattern files. Use absolute paths.
+  Unreadable/invalid configured files deny guards or withhold redactor output.
+  Each mod README documents schemas and environment names.
+
+</details>
+
+<a id="under-the-hood"></a>
+
+## 🔧 Under the hood
+
+`mod.toml` declares support and footprint; `lib/core.mjs` holds shared behavior.
+Edit those sources, `patterns.json`, entries and native modules—not generated adapters.
+The generator produces manifests, shared runtime copies, pattern modules and `catalog/mods.json`.
+
+<details>
+<summary><strong>🛠️ Contributing? Run the gates.</strong></summary>
+
+```bash
+npm run mods:write
+npm run validate:mods
+npm run test:fuzz
+npm run asset-integrity:write  # last generator, on its own
+npm run validate
+```
+
+The Python gate needs **Python 3.11+**. For each supported native mod, also run
+`claude plugin validate mods/<id>` and `claude plugin test mods/<id>` locally;
+CI has no native CLI. Spelling and Markdown lint are separate gates.
+Static checks are not proof that an installed hook runs.
+
+</details>
+
+[Implementation plan](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic/blob/dc8b29c823fb89dc4246413f38a7b82fdd34aa18/.claude/plan/cross-harness-mods.md)
+· [Spec deviations](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic/blob/dc8b29c823fb89dc4246413f38a7b82fdd34aa18/.kiro/specs/cross-harness-mods/deviations.md)

package/mods/audit-trail/README.md

@@ -0,0 +1,70 @@
+# Audit Trail
+
+Appends one JSON line per tool call to a per-session log. It is an honest append log: it makes
+no claim of immutability, carries no signatures, and any process with write access can edit or
+delete the file.
+
+## Reach and declared footprint
+
+**L1 (file writes).** The manifest declares default writes to `.audit/**`, reads
+`VANGUARD_AUDIT_TRAIL_LOG_DIR`, `VANGUARD_AUDIT_TRAIL_SESSION_ID` and
+`VANGUARD_AUDIT_TRAIL_AGENT_ID`, and declares no subprocess spawns or network egress.
+This is capability disclosure, not isolation; the log-directory override can write
+outside the declared default footprint.
+
+## What it records
+
+| Field | Value |
+|---|---|
+| `timestamp` | UTC ISO 8601 time of the hook run |
+| `session_id` | The safe session id (see below) |
+| `agent_id` | `VANGUARD_AUDIT_TRAIL_AGENT_ID`, or `null` |
+| `tool_name` | The payload `tool_name`, or `null` |
+| `args_hash` | SHA-256 of the canonical JSON of `tool_input` (`null` when absent) |
+| `result_hash` | SHA-256 of the canonical JSON of `tool_response` (`null` when absent) |
+| `sequence_number` | 1, 2, 3 ... per session file |
+
+Only hashes are stored, never the arguments or results themselves.
+
+## File layout
+
+`<dir>/<YYYY-MM-DD>/<session>.jsonl`, where `<dir>` defaults to `.audit` and dates are UTC. If
+the session already has a file under an earlier date directory, that file is reused, so the
+sequence does not reset at midnight. A relative `<dir>` resolves against the project root when
+the hook runs from its installed location, otherwise against the working directory.
+
+## Session ids
+
+1. `VANGUARD_AUDIT_TRAIL_SESSION_ID`, when set and non-empty.
+2. The payload `session_id`, when a non-empty string.
+3. Otherwise `unsessioned`.
+
+An id that does not match `[A-Za-z0-9._-]{1,128}` is replaced by the first 32 hex characters of
+its SHA-256, so it can never escape the date directory.
+
+## Environment
+
+| Variable | Purpose |
+|---|---|
+| `VANGUARD_AUDIT_TRAIL_LOG_DIR` | Log directory (default `.audit`). It can point outside the declared `.audit/**` write footprint; that is the operator's choice. |
+| `VANGUARD_AUDIT_TRAIL_SESSION_ID` | Session id override |
+| `VANGUARD_AUDIT_TRAIL_AGENT_ID` | Value for `agent_id` |
+
+## Harness support
+
+| Harness | Status |
+|---|---|
+| Claude Code native | Unsupported: the native API has no file append. Install the classic hook instead. |
+| Claude Code classic | Supported. `PostToolUse` fires only after a tool succeeds, so failed calls are not logged. |
+| Kiro | Degraded: stdin field names are undocumented, so `args_hash` covers the whole payload, `result_hash` hashes `null`, and without a session id env var every session shares the `unsessioned` log. |
+| Codex | Supported. |
+
+## Locking and failure
+
+Each append takes an exclusive `<dir>/<session>.lock` before selecting the session file
+(retrying for up to 2 s). Locks are never automatically stolen or removed based on age.
+After a crash, confirm no writer remains before manually removing its orphaned lock.
+A corrupt or unterminated last line, a lock timeout, or any I/O error exits 1 with a message on stderr and
+appends nothing. A failure is loud but never blocks the tool call.
+
+Requires Node 22+. Install: see `mods/README.md`.