@sabaiway/agent-workflow-kit 11.2.0 → 12.1.0

package/CHANGELOG.md

@@ -4,6 +4,82 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 12.1.0 — a queue row carries a plain name a person can read, and `now` renders where the work stands from the evidence, never from the plan's own text (AD-134)
+
+**MINOR: two additive surfaces, one series, one new refusal.** The name judge is advisory until a gate line opts in, and `now` is
+a new read-only command beside `status`. The one behaviour a deployed `queue-audit --check` line can see change: a heading a row
+swallows (an ATX line indented one to three spaces inside a row's body) now refuses with exit 2 and both one-keystroke corrections,
+where the audit used to scope around it silently and misjudge the rows after it — a document the corpus never writes.
+
+**The name judge (plan 1 of the series, landed repo-only in `da196b9`).** `tools/queue-row-name.mjs` cuts a row's display
+title at the id the row PRESENTS as one and judges the rest as a sentence: three or more words, one of the first three carrying
+a lower-case letter, a letter somewhere, never the id restated, never a run of the row's own status segments. `titleOf` returns
+`{ text, name, id, judged, endLine }` from ONE parse and every `auditQueue` row now carries `name`, `id`, `nameFindings` and
+`buckets` — the full line-numbered heading LINEAGE above the row, computed once inside the one parser.
+`queue-audit-cli --check --require-names` is the opt-in that turns a name finding into exit 1; without it every finding is a
+note and a gate line written before this release keeps its verdict byte for byte. A heading a row swallows — an ATX line
+indented one to three spaces inside a row's body — is REFUSED with its line and both one-keystroke corrections, because the
+document and the row scan read that line two ways and the corpus writes none. Two classifier defects fixed red-first: a live
+marker counts at a segment head or wherever dated, and a record prefix owes an adjacent date at every segment head but the title's; `feedback-record`'s
+row writer puts the claim sentence ahead of the id so the kit passes the gate it offers. Measured over this repo's queue: the
+shipped judge reports findings on 165 of the 247 work-carrying rows of `## Pending / backlog` before the migration, and the migration moved no class cell.
+
+**`now` (plan 2).** `/agent-workflow-kit now` — `node tools/now-cli.mjs --dir <project> [--format plain|ansi|json | --json]` —
+renders four blocks: **NOW** (every plan `plansInFlight` returns, its derived phase, the current and the next step, the tree
+fingerprint, the per-backend review verdict, the final receipt and the red-proof currency from `buildSummaryState`), **STEPS**
+(the ledger rows of each plan, one status each), **QUEUE** (every work-carrying row of `docs/plans/queue.md` folded under the heading PATH it
+carries, per-bucket per-class counts over all five classes, names never ids — an unnamed row prints `unnamed (line N)`; position is called priority
+ONLY in a bucket whose path passes through `## Pending / backlog`, every other bucket is archive), **CAMPAIGN** (the source-size
+practice's figures and config state; an absent opt-in config is a rendered state). The contract is `docs/ai/specs/kit/now.md`
+(live, S1–S10 bound). Its red line: a status is a function of the row's (path, verb) pair and the evidence at that path — the
+path fact, the changed set (ONE cached `diff --cached --name-only -z --no-renames`, both sides of a rename listed, then
+`computeWorkingState`'s unstaged and untracked
+sets, then the path fact; a path in both staged and unstaged is the named disagreement), and the exclusion fact (ONE cached
+`check-ignore -z --stdin`) — and the row's prose moves none: a checked box or a terminal marker outside quotation is a CLAIM
+printed beside the evidence-derived status wherever the two disagree. Four statuses, a closed set (`landed`, `in progress`, `pending`, `unjudged`); three
+annotations (claim, over-budget anomaly, a red-proof bound to the row's path at the current base). A present, clean `modify`
+row is `unjudged` and the render names WHICH fact is missing — `excluded from git here, no changed-set evidence` or `no
+base-motion reader` — never `landed`. A sweep row (`dir/**`, `modify` only) is judged as a SET: present when its expansion on disk is non-empty, changed when
+its pattern matches any path of a changed set (a deleted member included), excluded only when every member is. A git-dir
+store the summary cannot trust (a malformed receipts or evidence line) withholds the tree line with the store's own cause
+while every plan still renders; the final-run line names the receipt's verdict and gate count before its coverage token.
+Every status line carries its evidence source. The command writes nothing in any state:
+every git query it adds runs under `GIT_OPTIONAL_LOCKS=0`, and the suite proves a recursive content hash of `.git` identical
+before and after a run. Exit 0 whenever anything rendered (a WITHHELD block with its cause included), 1 when nothing did (a
+`--dir` that is not a git work tree), 2 for usage. Five modules — `now-status.mjs` (pure rules), `now-plan-facts.mjs`,
+`now-facts.mjs` (the IO shell), `now-render.mjs`, `now-cli.mjs` — registered in the catalog (Inspect, read-only), `SKILL.md`,
+`references/modes/now.md` and the README; the tarball pin counts 294. Stated residual: no reader in this family tells a
+tracked, unmodified file a plan already rewrote from one it never touched, so STEPS is complete when the base-motion reader
+lands; the write-nothing claim is proved dynamically, the structural read-graph proof waits on the core-evidence decomposition.
+
+**Bundled codex bridge 3.8.0 — the pin moves to `gpt-6-astra` at effort `high` (AD-135).** Both wrappers pin the model
+and the effort the maintainer chose; the quality-first guard stays a pin-integrity guard and now refuses `xhigh` exactly as it
+refuses `low` — every shipped sentence that called the pin "the maximum effort" says "the pinned effort", in the wrappers,
+the manifest `posture`, the bridge docs and the kit surfaces composed from the manifest (`recipes --status-line`,
+`bridge-settings`, `procedures`). The Fast tier stays a consented per-host knob (AD-043); its copy carries the codex
+catalog's own words for gpt-6-astra ("2x speed, increased usage", cache fetched 2026-09-05, no credit-rate figure stated)
+and the sol-era figures (~1.5x speed, 2.5x credit rate, probed 2026-07-05) are retired from every reader. The tier caveat
+still rides every render (`SPEND KNOB`). Version anchors: `capability.json`, `SKILL.md`, both `AW_BRIDGE_VERSION`
+lines; the kit mirror is byte-equal to the canon. A host that arms `CODEX_SERVICE_TIER=priority` runs gpt-6-astra /
+high / priority.
+
+## 12.0.0 — the reader mirror refuses an open-list clause, the outgoing reader becomes a prior, the consult line names the second case and the lens walks around every check (AD-133)
+
+**MAJOR by the AD-117 class.** `references/scripts/spec-schema.mjs` and its test are the memory 8.0.0 bodies
+byte-identically — `spec-check` relays the new `open-list` rule unchanged, so a consumer store valid under the old canon
+can refuse under this kit; the remedy is the closing clause, never a fourth case. `tools/script-priors.mjs` and
+`FROZEN_PRIORS` gain the outgoing reader pair as `5.0.0`..`7.2.1` with its fixture bodies under
+`test/fixtures/script-priors/5.0.0/`, so a deployed 5.0.0–7.2.1 reader classifies `prior`, never `custom`.
+
+**The consult clause and the lens bullet.** `tools/procedures.mjs` `CONSULT_LINE` — two source literals joined into
+ONE rendered line, each under the 1000-byte cap — renders inside the agy `--focus` payload "If this finding is the
+second case against the same check, reply with the replacement invariant, not an added case."; the codex consult-brief
+and the lens re-dispatch forms say "with the same payload"; `tools/procedures.test.mjs` pins the payload order for both
+activities. `references/agents/review-lens.md` gains the "How to review" bullet **When the artifact is a plan, walk
+around every check** (the S12 arm in `cheap-agents-derived.test.mjs`; the placed copy takes the same line on refresh).
+`tools/spec-coverage.test/cli.test.mjs` characterizes the S6 exit partition (`--help` / `-h` as the sole argument, an
+unreadable store, a stray `--reason` beside `--check`, the debt-write failure as an exception).
+
 ## 11.2.0 — a field report is triaged through a rendered procedure over a checked record (AD-132)
 
 Three consumer field reports were triaged ad hoc — verify each claim on HEAD, record the verdict,

package/README.md

@@ -232,6 +232,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit gates` | any time | **project gate runner** — runs the verification commands **your project itself declares** in `docs/ai/gates.json` (seeded at deploy; hand-editable `{ id, title, cmd }` entries plus the optional boolean `lcovProducer`, each `cmd` one bash line) as one batch: a per-gate **PASS/FAIL table** + one machine-readable summary line, exit 0 iff all green; a failing gate's own output is shown verbatim; `--only <id>` re-runs one. Honest distinct outcomes for a missing / empty / malformed declaration — never a silent green. The runner writes nothing **by default** and never commits — opt-in `--final` runs the FULL declared matrix and mints ONE final-run receipt into the git-dir core-evidence store (status green/red, pre/post tree fingerprints, the declaration, the consumed lcov's sha; the receipt the commit-guard binds); it executes only your own declared commands (a batching convenience, not a sandbox). The velocity tier auto-approves only the exact no-`--final` form — the recording run stays explicit. |
 | `/agent-workflow-kit setup [backend]` | opt-in, any time | **link-only** auto-setup of a bridge: places the bundled bridge skill (only into an absent / empty / managed dir — never overwrites an unmanaged one) + links its wrappers onto `PATH` via managed symlinks (idempotent; refuses to clobber a non-symlink; try `--dry-run` to preview). The binary install + the one-time subscription login stay **manual**: it prints the exact **login** command and points the binary install at each bridge's `setup/README.md`. POSIX wrappers — on Windows use WSL. Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit status` | any time | **read-only** single view of **versions + deployment + settings + bridges**: which members (kit / memory / engine / the two bridges) are installed and at what version (with an honest "installed on this machine" note when one is behind) and — in a project — what's deployed (`docs/ai`, the version stamps, and the **visibility**: visible / hidden / unclear), and the **feature-spec adoption state** (`not adopted` / `adopting (N draft)` / `adopted (N live, M draft)` / `could not be read`, plus `declined` when recorded), plus your settings (orchestration recipes, attribution, velocity) and the bridges' readiness. The two version axes (package number vs deployment-structure head) stay decoupled. Never writes, never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit now` | any time | **read-only** answer to where work stands in four blocks: **NOW** names every plan in flight, its phase, current and next step, and the tree evidence; **STEPS** gives every ledger row its evidence-derived status; **QUEUE** folds named rows under their full heading paths and calls position priority only in the judged backlog; **CAMPAIGN** shows the source-size practice figures and config state. The plan's own text never sets a status; a contradicted claim prints beside it. A block that cannot be derived is WITHHELD with its cause; NOW has two halves, plans and tree, each independently a value or WITHHELD, and NOW itself is WITHHELD only when both are. Never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit recipes` | any time | **read-only** orchestration advisor: presents five named recipes for composing the carriers of a step — the bridges and the full-tool executor subagent — into plan → execute → review — **Solo / Reviewed / Council / Delegated / Subagent** — plans + recommends one for your environment (degrading with a stated reason when a backend isn't ready, or when the executor vehicle is missing/unusable), and offers the choice. The activity/slot registry (four activities) is rendered by `procedures` and by `set-recipe --help`. The orchestrator runs it via the bridge skills or the executor vehicle and **always commits**; the kit never executes a recipe, never runs a subscription CLI, never commits. |
 | `/agent-workflow-kit procedures <activity>` | any time | **read-only** activity-procedures advisor: prints a named activity's ordered steps (`plan-authoring` / `plan-execution` / `routine` / `feedback-triage`) read **live** from the engine, plus the **resolved recipe per slot** from your `docs/ai/orchestration.json` (agent-writable via `set-recipe`, or hand-edited) + carrier readiness (`plan-authoring`: author, fold, review; default Reviewed when a backend is ready, Council on request; slot-aware incl. Delegated and Subagent) — and, for every dispatched backend, the **full driving contract at the point of use** (exact copy-pasteable invocation, grounding levers like agy's `--facts`/`--decided`, the round-2 `--continue` delta, guarded passthrough), verbatim from the bridge manifests (drift-guarded; each wrapper's `--help` prints the same) — except `feedback-triage`, whose record-bound block carries the check with `--excerpts`, the resolved member lines (ready bridge commands, the ready lens brief, or explicit skipped members), and either the record round-table command for a bridge obligation or the no-receipt fact otherwise: the record is the artifact. `--override <slot>=<value>` adjusts one slot per run. Composes with `recipes`; never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit set-recipe` | any time | **config writer** for `docs/ai/orchestration.json`: tell the agent your preference in plain language and it maps it to explicit `--set <activity>.<slot>=<value>` / `--unset` ops; the kit validates, **previews by default**, and writes only on `--write` (deployment-gated, atomic, symlink/TOCTOU-safe), resolving the effective recipe vs live readiness. Writes **only** that file — **never runs a backend or a subagent, never commits**; hand-editing stays fully supported. |
@@ -251,7 +252,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit agents` | Claude Code · opt-in | **subagent vehicles** — places the five bundled subagent definitions into `.claude/agents/`: **four read-only vehicles + one full-tool `executor`**. **No read-only vehicle gets `Bash`**, and that is the load-bearing property: a read-only fan-out on a full-tool subagent shells out for facts it could have read, and every shelled command is an approval prompt you never needed to see. Three of the four ride a **cheap model** (haiku, low effort) for mechanical work — extraction sweeps, changelog fact-skeletons, gate-failure triage; the fourth, **`review-lens`**, is an ADDITIONAL independent read-only review opinion on code your configured backends have already seen (never a replacement for your review recipe, advisory like every review). The fifth, **`executor`** (`model: opus`, all tools), is the ONE vehicle with a shell and the instrument behind the **Subagent** recipe: dispatched only for a bounded, file-disjoint execution / authoring / routine slice you verify afterwards — never for read-only work, never as a review backend, and it never commits. Its state (`placed` / `customized` / `unusable` / `missing`) is what a `subagent` slot's readiness resolves from. Writing code and running gates stay off the four read-only vehicles; the executor carries a bounded slice you re-verify on your main lane, and every vehicle's output is verified. Preview by default (`--apply` writes); an existing customized file is **preserved, never overwritten**; never touches `settings*.json`, never commits. |
 | `/agent-workflow-kit hook` | Claude Code · opt-in | **gate-approval hook** — places a self-contained PreToolUse hook (`.claude/hooks/`) and wires it into `.claude/settings.json`: a Bash command **byte-identical** to a gate you declared in `docs/ai/gates.json` (run from the project root) is auto-approved — no prompt, no idle; a seeded read-only command carrying a runtime residual (output redirection, command substitution, `--output` writes) now **asks** even where an allow rule would have silently passed it (proven live — hook `ask` overrides an allow rule). Detection is a conservative string scan, so it over-asks on a byte that is ordinary text — searching for `=>`, or a read wearing `2>/dev/null`, prompts. That is a documented open limit: 4.1.0 built three mechanisms to narrow it and removed all three in review, each counterexample kept as a test (see Mode: hook). Exact matches only, never patterns; never `deny`; a broken `gates.json` only disables auto-approval, never the guard. An opt-in **read-lane** (`--read-lane` → `docs/ai/lanes.json`, a **separate** file from `gates.json`) additionally auto-approves *compounds* of seeded read-only commands carrying no shell metaprogramming; `--apply --read-lane` verifies the placed hook is current first (delete-to-reseed otherwise). Preview by default; never writes `settings.local.json`; never commits. |
 | `/agent-workflow-kit state-block-guard` | Claude Code · opt-in | **closing-block detector** — a `Stop` hook that reads the turn's final assistant message and warns when the closing state block is defective: the «what I need from you» slot answering *nothing* (a turn that ENDS always needs a resume, so the answer is false, not merely unhelpful), or a first-person promise of imminent work in a turn that is over. Judged on the slot's first clause, so a real ask followed by a clause break and "nothing else" passes, and a promise gated on something named passes; matching is word-bounded and Unicode-aware, quoted and fenced examples are stripped, and the last STARTED block decides — an incomplete tail counts as no block rather than falling back to an earlier one. A message carrying no block at all is silent unless you pass `--require-block` — this kit does not mandate the block, and a hook that runs every turn must not warn every turn. The judgement is lexical and the mode doc names every residual it leaves. **Detection, never prevention** — a `Stop` hook cannot un-send the message it judges; what it buys is that a silent recurrence becomes a visible one. Warns via `systemMessage` and **exits 0 on every path**: never `deny`, never blocks the stop, never re-enters the model. Reads nothing but the message, makes no network call, approves nothing. This mode is **read-only and has no writer** — it ships the self-contained hook and a paste-ready wiring block you merge into `.claude/settings.json` yourself. |
-| `/agent-workflow-kit bridge-settings` | opt-in, any time | **host-level bridge settings** — read or change the bridges' `KEY=VALUE` config file (`${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf`), the **one place a knob survives kit upgrades** (it lives outside every kit tree; a refresh never touches it, and now states loudly if it ever overwrote a local edit). First knobs: the **codex Fast tier** (`CODEX_SERVICE_TIER=priority` — ~1.5× speed at a **2.5× credit rate**, quality-neutral, default off — a consented spend), the codex/agy hard timeouts, the codex review byte cap, and `AGY_REVIEW_MAX_TOTAL_BYTES` (the ceiling on what an oversized agy code review may feed before it refuses pre-spend). `AGY_REVIEW_ALLOW_ADDDIR` is a **retired** compatibility key: still recognized so an existing line never warns as unknown, but it arms nothing — the writer refuses to set it and `--unset` clears it. Allowed keys + value rules come from the bundled bridge manifests; **model/effort are never settable** (the quality guard is untouched). **Previews by default**; refuses an unknown key, an out-of-range value, or a duplicate-carrying file; writes atomically (symlink/TOCTOU-safe). Never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit bridge-settings` | opt-in, any time | **host-level bridge settings** — read or change the bridges' `KEY=VALUE` config file (`${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf`), the **one place a knob survives kit upgrades** (it lives outside every kit tree; a refresh never touches it, and now states loudly if it ever overwrote a local edit). First knobs: the **codex Fast tier** (`CODEX_SERVICE_TIER=priority` — "2x speed, **increased usage**" in the catalog's own words, quality-neutral, default off — a consented spend), the codex/agy hard timeouts, the codex review byte cap, and `AGY_REVIEW_MAX_TOTAL_BYTES` (the ceiling on what an oversized agy code review may feed before it refuses pre-spend). `AGY_REVIEW_ALLOW_ADDDIR` is a **retired** compatibility key: still recognized so an existing line never warns as unknown, but it arms nothing — the writer refuses to set it and `--unset` clears it. Allowed keys + value rules come from the bundled bridge manifests; **model/effort are never settable** (the quality guard is untouched). **Previews by default**; refuses an unknown key, an out-of-range value, or a duplicate-carrying file; writes atomically (symlink/TOCTOU-safe). Never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit autonomy-doctor` | opt-in, any time | **guarded sandbox provisioner "doctor"** — can this machine run the Claude sandbox, and (only with your consent) fix it: macOS Seatbelt built-in / Linux+WSL2 needs `bwrap`+`socat` / native Windows → WSL2. Flagless = **FS-only preview** (the diagnosis, the exact absolute-path command it WOULD run, the exact `--apply <pm>:<pkgs>` consent tuple — runs nothing, never claims ready); `--verify` runs the unprivileged proof (a `bwrap` user-namespace smoke + `socat -V`) — the **only** source of a Linux "ready (verified)" claim; `--apply <pm>:<pkgs>` is the consent-gated privileged install (the tuple must equal the previewed plan; everything executed resolves to absolute paths inside `/usr/bin:/bin:/usr/sbin:/sbin`; the exact command is re-printed immediately before execution), then verifies. Honest loud degrades (unknown PM, untrusted location, nested-sandbox INDETERMINATE, root-unproven) and a stated restart step. Sits **outside every velocity auto-approve tier**; never auto-runs, never writes repo files, never commits. |
 
 It **never auto-commits** and **never overwrites** an existing `AGENTS.md` without asking.

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '11.2.0'
+  version: '12.1.0'
 ---
 
 # agent-workflow-kit
@@ -111,6 +111,10 @@ writer — read `${CLAUDE_SKILL_DIR}/references/modes/setup.md` before acting.
 
 read-only — read `${CLAUDE_SKILL_DIR}/references/modes/status.md` before acting.
 
+### Mode: now
+
+read-only — read `${CLAUDE_SKILL_DIR}/references/modes/now.md` before acting.
+
 ### Mode: recommendations
 
 read-only — read `${CLAUDE_SKILL_DIR}/references/modes/recommendations.md` before acting.

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.7.0'
+  version: '3.8.0'
 ---
 
 # codex-cli-bridge
@@ -48,9 +48,9 @@ this skill. Both wrappers enforce the subscription path before invoking codex:
 
 ## Models quality-first pinned
 
-Delegated codex work ALWAYS runs on the **PINNED model at maximum reasoning effort**: the wrappers
-**pin** `gpt-5.6-sol` / `xhigh` and **refuse** (exit 2, loud) a non-default `CODEX_MODEL` / `CODEX_EFFORT`
-— knowingly-worse output is never traded for quota. The pin is deliberate: an explicit `-m gpt-5.6-sol`
+Delegated codex work ALWAYS runs on the **PINNED model at the PINNED reasoning effort**: the wrappers
+**pin** `gpt-6-astra` / `high` and **refuse** (exit 2, loud) a non-default `CODEX_MODEL` / `CODEX_EFFORT`
+— knowingly-worse output is never traded for quota. The pin is deliberate: an explicit `-m gpt-6-astra`
 names one model rather than following the CLI's current default. That the pinned id is also the
 *strongest* selectable Codex model is a **separate, time-bounded claim**, checked BY HAND against
 <https://developers.openai.com/codex/models>. There is **no automated gate and this file records no
@@ -63,8 +63,10 @@ either way between releases:
   available until someone re-checks the page.
 
 The guard is therefore a **pin-integrity** guard, not a quality guarantee: it enforces that runs use
-the id named here, and it refuses a *stronger* model exactly as it refuses a weaker one. Read a
-refusal as "not the pinned id", never as "a downgrade was prevented".
+the id named here, and it refuses a *stronger* model exactly as it refuses a weaker one. The effort
+pin is the same kind of decision: `high` is a deliberate posture, not the catalog maximum (`xhigh`,
+`max` and `ultra` exist above it), and the guard refuses a higher effort exactly as it refuses a lower
+one. Read a refusal as "not the pinned id", never as "a downgrade was prevented".
 
 Economy comes only from **quality-neutral waste removal** (clean capture, a hard timeout,
 a precomputed review diff, `resume` instead of re-sending context), never from a downgrade.
@@ -75,8 +77,8 @@ output as real delegated work.
 
 | Variable | Default | Effect |
 |---|---|---|
-| `CODEX_MODEL` | `gpt-5.6-sol` (pinned) | model passed to `-m`; a non-default is REFUSED unless `CODEX_PROBE=1` |
-| `CODEX_EFFORT` | `xhigh` (pinned) | reasoning effort (`-c model_reasoning_effort=…`); non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_MODEL` | `gpt-6-astra` (pinned) | model passed to `-m`; a non-default is REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_EFFORT` | `high` (pinned) | reasoning effort (`-c model_reasoning_effort=…`); non-default REFUSED unless `CODEX_PROBE=1` |
 
 `codex --version` reports the CLI version, **not** the model list. Quota is metered in **messages**
 (a rolling 5h window + a weekly cap), not raw tokens — which is why the levers above are about removing
@@ -156,10 +158,10 @@ defeat a policy is guarded — see [§ Models](#models-quality-first-pinned).
 
 | Variable | Default | Effect |
 |---|---|---|
-| `CODEX_MODEL` | `gpt-5.6-sol` (pinned) | model; non-default REFUSED unless `CODEX_PROBE=1` |
-| `CODEX_EFFORT` | `xhigh` (pinned) | reasoning effort; non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_MODEL` | `gpt-6-astra` (pinned) | model; non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_EFFORT` | `high` (pinned) | reasoning effort; non-default REFUSED unless `CODEX_PROBE=1` |
 | `CODEX_HARD_TIMEOUT` | `3600` (exec) / `1800` (review) | hard wall-clock cap (seconds) via `timeout`/`gtimeout`; exit 124/137 ⇒ "exceeded hard cap". No `timeout` binary ⇒ a nonce-less exec warns loudly + runs uncapped, a **nonced** exec REFUSES pre-spend (an accounted dispatch that cannot be capped can never honour the terminal-exit rule), and `codex-review` REFUSES pre-spend (fail-closed preflight). |
-| `CODEX_SERVICE_TIER` | unset (standard tier) | **SPEND knob**: `priority` (catalog name "Fast") = ~1.5× token speed at a **2.5× credit rate** on gpt-5.6-sol — quality-neutral (same model). codex accepts any `-c service_tier` string silently (probe-pinned 2026-07-05), so the wrapper validates: an unsupported value warns and runs standard. Env or settings file. |
+| `CODEX_SERVICE_TIER` | unset (standard tier) | **SPEND knob**: `priority` (catalog name "Fast") = "2x speed, **increased usage**" in the codex catalog's own words for gpt-6-astra (cache fetched 2026-09-05); it states no credit-rate figure — quality-neutral (same model). codex accepts any `-c service_tier` string silently (probe-verified), so the wrapper validates: an unsupported value warns and runs standard. Env or settings file. |
 | `CODEX_SESSION_FILE` | `./.codex-last-session` | where `codex-exec` records the session id and where `--resume-last` reads it |
 | `CODEX_REVIEW_MAX_TOTAL_BYTES` | `1500000` | `codex-review code`: above this the assembled diff goes via a git-dir temp file instead of inline — never truncated |
 | `AW_REVIEW_NONCE` | unset | the flow dispatch nonce (safe grammar `[A-Za-z0-9._-]{1,64}` — anything else refuses pre-spend). `codex-review … --nonce <n>` is the plain-argument equivalent (one seam; flag and a non-empty env must agree, a disagreeing pair refuses pre-spend) — the lane for hosts whose dispatch policy has no env-prefix form. When supplied, a successful review first mints the finding MANIFEST `agent-workflow-finding-manifest-codex-<nonce>.json` beside the receipts file (atomic, no-clobber, ORDERED before the receipt append) — a failed mint EXCLUDES the receipt, so a nonce-supplied dispatch never lands a receipt without its readable manifest; nonce-less runs add no nonce field and mint nothing (the `wrapperVersion` field every receipt carries moves with each release) |
@@ -210,7 +212,7 @@ skipped entirely without a nonce: the wrapper is byte-unchanged, writes no artif
 `${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf` holds `KEY=VALUE` lines,
 **parsed, never sourced** — a file line can never execute code. Precedence: explicit env (even
 empty — `KEY=` disables a knob for one run) > file > built-in default. File-settable keys for this
-bridge: `CODEX_SERVICE_TIER` (the Fast tier — **2.5× credit rate**; enabling it is a consented
+bridge: `CODEX_SERVICE_TIER` (the Fast tier — **increased usage**; enabling it is a consented
 per-host spend decision, never a default), `CODEX_HARD_TIMEOUT`, `CODEX_REVIEW_MAX_TOTAL_BYTES` —
 exactly the manifest `settings` block (the single source; the wrapper constants and `--help` are
 drift-guarded against it). Model/effort keys are **not** file-settable — the quality guard above

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -13,12 +13,12 @@
 #   - network access OFF: new dependencies / network installs are done by a human
 #   - approval_policy=never: there is no TTY in exec; anything needing escalation
 #     is refused and reported, then handled by hand
-#   - the PINNED model at maximum reasoning effort (quality-first — see below)
+#   - the PINNED model at the PINNED reasoning effort (quality-first — see below)
 #   - git WRITES are blocked by a physical shim (codex spawns git via execve, which
 #     bypasses shell functions) — the orchestrator owns the commit boundary.
 #
 # Quality-first (hard rule): delegated codex work ALWAYS runs on the PINNED
-# model at maximum reasoning effort. The defaults below are pinned and the wrapper
+# model at the PINNED reasoning effort. The defaults below are pinned and the wrapper
 # REFUSES a non-default CODEX_MODEL/CODEX_EFFORT — knowingly-worse output is never
 # traded for quota. The ONLY exception is a throwaway probe whose result does not
 # depend on effort: set CODEX_PROBE=1 (echoed loudly) to relax the guard. Economy
@@ -149,7 +149,7 @@ Notes:
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
-  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — ~1.5x speed at a 2.5x credit rate on gpt-5.6-sol); a consented SPEND knob, default off (standard tier)
+  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6-astra, cache fetched 2026-09-05; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 3600)
 
 Environment: CODEX_HARD_TIMEOUT (seconds, default 3600), CODEX_PROBE=1 (throwaway probe only), AW_DISPATCH_NONCE (delegation dispatch nonce — mints the exec receipt; the --nonce <n> flag is its plain-argument equivalent), AW_DELEGATION_STORE (absolute delegation-store path; its dirname is where the receipt lands).
@@ -319,19 +319,20 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_CODEX_MODEL="gpt-5.6-sol"   # pinned model id (see SKILL.md: strongest-model status is hand-checked, ungated)
-DEFAULT_CODEX_EFFORT="xhigh"    # maximum reasoning effort — pinned
+DEFAULT_CODEX_MODEL="gpt-6-astra"   # pinned model id (see SKILL.md: strongest-model status is hand-checked, ungated)
+DEFAULT_CODEX_EFFORT="high"    # pinned reasoning effort — a deliberate posture, not the catalog maximum
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
-# Generous hard wall-clock cap, sized for a slow xhigh run (subscription latency
+# Generous hard wall-clock cap, sized for a slow run at the pinned effort (subscription latency
 # varies — a trivial reply was observed taking minutes). Raise for a known-healthy
 # long run; lowering it only risks killing real work.
 CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-3600}"
-# Codex service tier (quality-neutral speed knob; live-probed 2026-07-05): default EMPTY ⇒ no
+# Codex service tier (quality-neutral speed knob): default EMPTY ⇒ no
 # service_tier flag (standard tier) — enabling Fast is a consented per-host SPEND act, never a
 # silent default. The only server-catalog tier id on this subscription is 'priority' (catalog
-# display name "Fast": ~1.5x token speed at a 2.5x credit rate on gpt-5.6-sol; quality-neutral —
-# same model). codex itself accepts ANY -c service_tier string silently (probe-verified), so
+# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6-astra, cache
+# fetched 2026-09-05; it states no credit-rate figure; quality-neutral — same model). codex itself
+# accepts ANY -c service_tier string silently (probe-verified), so
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
 CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
@@ -372,14 +373,14 @@ CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 # receipt this wrapper mints; scripts/release/version-sync.mjs bumps it under the one-anchor-per-file
 # rule, so a release can never leave it behind (the AD-053 drift class).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.7.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="3.8.0"  # aw-version-anchor
 # The kill grace handed to timeout(1) as --kill-after, and recorded in the receipt as killGraceS:
 # ONE constant, so the number the ledger checks against the dispatch deadline is the number the run
 # actually applied.
 CODEX_KILL_GRACE_S=15
 
 # --- Quality-first guard: refuse any non-pinned model/effort ---------------
-# Real delegated runs must use the pinned model at max effort. A throwaway probe
+# Real delegated runs must use the pinned model at the pinned effort. A throwaway probe
 # (effort-independent result) may opt out with CODEX_PROBE=1, announced loudly.
 if [[ "${CODEX_PROBE:-}" == "1" ]]; then
   echo "warning: CODEX_PROBE=1 — THROWAWAY PROBE MODE. Quality guards relaxed; do NOT use this run's" >&2
@@ -387,13 +388,13 @@ if [[ "${CODEX_PROBE:-}" == "1" ]]; then
 else
   if [[ "$CODEX_MODEL" != "$DEFAULT_CODEX_MODEL" ]]; then
     echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned model '$DEFAULT_CODEX_MODEL'." >&2
-    echo "       Delegated codex work must run on the pinned model at max effort (quality-first)." >&2
+    echo "       Delegated codex work must run on the pinned model at the pinned effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi
   if [[ "$CODEX_EFFORT" != "$DEFAULT_CODEX_EFFORT" ]]; then
-    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned max effort '$DEFAULT_CODEX_EFFORT'." >&2
-    echo "       Delegated codex work must run at max reasoning effort (quality-first)." >&2
+    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned effort '$DEFAULT_CODEX_EFFORT'." >&2
+    echo "       Delegated codex work must run at the pinned reasoning effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi
@@ -932,7 +933,7 @@ if [[ -n "$resume_mode" ]]; then
 else
   # `-o` writes ONLY codex's final message; `--json` streams structured events
   # (thread.started carries the session id). CoT is dropped and colour disabled, so
-  # the captured surfaces stay clean. Reasoning still runs at xhigh — quality is
+  # the captured surfaces stay clean. Reasoning still runs at the pinned effort — quality is
   # unchanged; we only stop printing the noise.
   codex_cmd=(codex exec
     --ignore-user-config

package/bridges/codex-cli-bridge/bin/codex-exec.test.mjs

@@ -194,10 +194,10 @@ describe('codex-exec.sh — quality-first model/effort guard (1.1)', { concurren
 
   it('refuses a non-default CODEX_EFFORT', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_EFFORT: 'high' } });
+    const r = await run(sb, { env: { CODEX_EFFORT: 'xhigh' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0);
-    assert.match(r.stderr, /not the pinned max effort/);
+    assert.match(r.stderr, /not the pinned effort/);
   });
 
   it('CODEX_PROBE=1 allows a non-default model and warns loudly', async () => {
@@ -650,8 +650,8 @@ describe('codex-exec.sh — preflight (unchanged invariants)', { concurrency: 2
 
 describe('codex-exec.sh — resume entrypoint restates every invariant (3.1)', { concurrency: 2 }, () => {
   const RESUME_INVARIANTS = [
-    /(^|\n)resume(\n|$)/, /(^|\n)--ignore-user-config(\n|$)/, /(^|\n)gpt-5\.6-sol(\n|$)/,
-    /model_reasoning_effort=xhigh/, /sandbox_mode=workspace-write/,
+    /(^|\n)resume(\n|$)/, /(^|\n)--ignore-user-config(\n|$)/, /(^|\n)gpt-6-astra(\n|$)/,
+    /model_reasoning_effort=high/, /sandbox_mode=workspace-write/,
     /approval_policy=never/, /sandbox_workspace_write\.network_access=false/,
   ];
 
@@ -1546,7 +1546,7 @@ describe('codex-exec.sh — dispatch-posture labeling (D5, AD-061)', { concurren
     const lines = banners(r.stderr);
     assert.equal(lines.length, 1, 'EXACTLY ONE banner line per run');
     assert.equal(lines[0],
-      'exec posture: model=gpt-5.6-sol effort=xhigh tier=standard sandbox=workspace-write session=fresh timeout=3600s');
+      'exec posture: model=gpt-6-astra effort=high tier=standard sandbox=workspace-write session=fresh timeout=3600s');
   });
 
   it('an ARMED Fast tier rides the banner (tier=priority)', async () => {
@@ -1642,11 +1642,11 @@ describe('codex-exec.sh — dispatch-posture labeling (D5, AD-061)', { concurren
 
   it('a banner field carrying CONTROL BYTES refuses pre-spend (model / effort / tier / timeout / DEL)', async () => {
     const cases = [
-      { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(1)}` },
-      { CODEX_EFFORT: `xhigh${String.fromCharCode(2)}` },
+      { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(1)}` },
+      { CODEX_EFFORT: `high${String.fromCharCode(2)}` },
       { CODEX_SERVICE_TIER: `priority${String.fromCharCode(3)}` },
       { CODEX_HARD_TIMEOUT: `3600${String.fromCharCode(4)}` },
-      { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(127)}` },
+      { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(127)}` },
     ];
     for (const env of cases) {
       const sb = makeSandbox();
@@ -2047,7 +2047,7 @@ describe('codex-exec.sh — the pre-spend reservation (D1/D8)', { concurrency: 2
     assert.equal(r.status, 71, r.stderr);
     assert.equal(held.state, 'reserved');
     assert.equal(held.wrapperVersion, MANIFEST.version, 'the receipt stamps the bridge version version-sync bumps');
-    assert.deepEqual(held.posture, { model: 'gpt-5.6-sol', effort: 'xhigh', tier: null });
+    assert.deepEqual(held.posture, { model: 'gpt-6-astra', effort: 'high', tier: null });
     assert.equal(held.capS, 3600);
     assert.equal(held.killGraceS, 15);
     assert.match(held.contractDigest, /^[0-9a-f]{64}$/);

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -21,7 +21,7 @@
 # back as a validated JSON object, with a raw-text fallback.
 #
 # Auth/policy: subscription-only, identical to codex-exec.sh. Quality-first: the
-# review runs on the PINNED model at max effort (advisory findings still bear on
+# review runs on the PINNED model at the pinned effort (advisory findings still bear on
 # what ships, so the same pin-integrity guard applies; CODEX_PROBE=1 relaxes it for
 # a throwaway probe only).
 #
@@ -39,7 +39,7 @@ set -euo pipefail
 case "${1:-}" in
   --help|-h)
     cat <<'HELP'
-codex-review — read-only ADVISORY review by the OpenAI Codex CLI (subscription-only; the PINNED model at max effort).
+codex-review — read-only ADVISORY review by the OpenAI Codex CLI (subscription-only; the PINNED model at the pinned effort).
 
 Usage:
   codex-review plan <plan-file> [--nonce <n>]
@@ -91,7 +91,7 @@ Receipt:
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
-  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — ~1.5x speed at a 2.5x credit rate on gpt-5.6-sol); a consented SPEND knob, default off (standard tier)
+  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6-astra, cache fetched 2026-09-05; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 1800)
   CODEX_REVIEW_MAX_TOTAL_BYTES — inline-payload cap, integer bytes 1..100000000 (default 1500000); above it the diff rides via a git-dir temp file
 
@@ -279,15 +279,15 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_CODEX_MODEL="gpt-5.6-sol"
-DEFAULT_CODEX_EFFORT="xhigh"
+DEFAULT_CODEX_MODEL="gpt-6-astra"
+DEFAULT_CODEX_EFFORT="high"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.7.0"  # aw-version-anchor
+AW_BRIDGE_VERSION="3.8.0"  # aw-version-anchor
 CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
 CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
-# Generous hard cap for a slow xhigh review (subscription latency varies).
+# Generous hard cap for a slow review at the pinned effort (subscription latency varies).
 CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-1800}"
 # Above this assembled-payload size (bytes), the diff goes via a git-dir-local temp
 # file instead of inline — never truncated.
@@ -298,11 +298,12 @@ CODEX_REVIEW_MAX_TOTAL_BYTES="${CODEX_REVIEW_MAX_TOTAL_BYTES:-1500000}"
 # file), so the budget is pinned at the DEFAULT inline-payload cap — the map can never outgrow the
 # whole payload, and every realistic repo's map assembles byte-unchanged.
 AW_REVIEW_MAP_BUDGET_BYTES=1500000
-# Codex service tier (quality-neutral speed knob; live-probed 2026-07-05): default EMPTY ⇒ no
+# Codex service tier (quality-neutral speed knob): default EMPTY ⇒ no
 # service_tier flag (standard tier) — enabling Fast is a consented per-host SPEND act, never a
 # silent default. The only server-catalog tier id on this subscription is 'priority' (catalog
-# display name "Fast": ~1.5x token speed at a 2.5x credit rate on gpt-5.6-sol; quality-neutral —
-# same model). codex itself accepts ANY -c service_tier string silently (probe-verified), so
+# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6-astra, cache
+# fetched 2026-09-05; it states no credit-rate figure; quality-neutral — same model). codex itself
+# accepts ANY -c service_tier string silently (probe-verified), so
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
 CODEX_SERVICE_TIER="${CODEX_SERVICE_TIER:-}"
@@ -365,13 +366,13 @@ if [[ "${CODEX_PROBE:-}" == "1" ]]; then
 else
   if [[ "$CODEX_MODEL" != "$DEFAULT_CODEX_MODEL" ]]; then
     echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned model '$DEFAULT_CODEX_MODEL'." >&2
-    echo "       A delegated review must run on the pinned model at max effort (quality-first)." >&2
+    echo "       A delegated review must run on the pinned model at the pinned effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi
   if [[ "$CODEX_EFFORT" != "$DEFAULT_CODEX_EFFORT" ]]; then
-    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned max effort '$DEFAULT_CODEX_EFFORT'." >&2
-    echo "       A delegated review must run at max reasoning effort (quality-first)." >&2
+    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned effort '$DEFAULT_CODEX_EFFORT'." >&2
+    echo "       A delegated review must run at the pinned reasoning effort (quality-first)." >&2
     echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
     exit 2
   fi

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -172,10 +172,10 @@ describe('codex-review.sh — quality-first model/effort guard (1.1)', { concurr
 
   it('refuses a non-default CODEX_EFFORT', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_EFFORT: 'high' } });
+    const r = await run(sb, { env: { CODEX_EFFORT: 'xhigh' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0);
-    assert.match(r.stderr, /not the pinned max effort/);
+    assert.match(r.stderr, /not the pinned effort/);
   });
 
   it('CODEX_PROBE=1 relaxes the guard and warns', async () => {
@@ -1646,8 +1646,8 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /review posture: model=gpt-5\.6-sol effort=xhigh tier=standard/, 'the banner states the actual run posture');
-    assert.deepEqual(receipts[0].posture, { model: 'gpt-5.6-sol', effort: 'xhigh', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
+    assert.match(r.stderr, /review posture: model=gpt-6-astra effort=high tier=standard/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'gpt-6-astra', effort: 'high', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
     assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
   });
 
@@ -1657,7 +1657,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /review posture: model=gpt-5\.6-sol effort=xhigh tier=priority/);
+    assert.match(r.stderr, /review posture: model=gpt-6-astra effort=high tier=priority/);
     assert.equal(receipts[0].posture.tier, 'priority');
   });
 
@@ -1674,7 +1674,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
 
   it('a posture value carrying CONTROL BYTES refuses pre-spend, BEFORE the pinned-model guard', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(1)}` } });
+    const r = await run(sb, { env: { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(1)}` } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0);
@@ -1689,7 +1689,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /^review posture: model=gpt-5\.6-sol effort=xhigh tier=standard timeout=1800s$/m);
+    assert.match(r.stderr, /^review posture: model=gpt-6-astra effort=high tier=standard timeout=1800s$/m);
     assert.deepEqual(Object.keys(receipts[0].posture), ['model', 'effort', 'tier'], 'timeout never enters the receipt posture');
   });
 
@@ -1715,7 +1715,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
 
   it('a DEL (0x7f) byte in a banner field refuses pre-spend like the C0 range', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_MODEL: `gpt-5.6-sol${String.fromCharCode(127)}` } });
+    const r = await run(sb, { env: { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(127)}` } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0);

package/bridges/codex-cli-bridge/capability.json

@@ -3,8 +3,8 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "3.7.0",
-  "posture": { "model": "gpt-5.6-sol", "effort": "xhigh", "tier": null },
+  "version": "3.8.0",
+  "posture": { "model": "gpt-6-astra", "effort": "high", "tier": null },
   "provides": ["execute", "review"],
   "roles": {
     "execute": {
@@ -141,7 +141,7 @@
       ],
       "guardrails": [
         { "value": "read-only sandbox — codex cannot edit, create or delete a file", "enforcement": "enforced", "source": "bin/codex-review.sh" },
-        { "value": "runs on the pinned model at max effort", "enforcement": "enforced", "condition": "unless CODEX_PROBE=1 relaxes the guard for a throwaway probe", "source": "bin/codex-review.sh" },
+        { "value": "runs on the pinned model at the pinned effort", "enforcement": "enforced", "condition": "unless CODEX_PROBE=1 relaxes the guard for a throwaway probe", "source": "bin/codex-review.sh" },
         { "value": "a successful review appends one receipt line the review-state gate reads", "enforcement": "enforced", "condition": "a receipt write failure warns and the review still succeeds — the tree then reads un-receipted", "source": "capability.json roles.review.contract.receipt" }
       ],
       "customHooks": ["CODEX_PROBE"]
@@ -193,7 +193,7 @@
       "values": ["priority"],
       "default": null,
       "appliesTo": ["codex-exec", "codex-review"],
-      "effect": "codex service tier; 'priority' (catalog display name Fast) = ~1.5x token speed at a 2.5x credit rate on gpt-5.6-sol — quality-neutral (same model), live-probed 2026-07-05. Unset/empty ⇒ no service_tier flag (standard tier). SPEND KNOB: enabling it is a consented per-host act, never a default. codex itself accepts any -c service_tier string silently, so the wrapper validates the value."
+      "effect": "codex service tier; 'priority' (catalog display name Fast) = \"2x speed, increased usage\" in the codex catalog's own words for gpt-6-astra (cache fetched 2026-09-05); it states no credit-rate figure — quality-neutral (same model). Unset/empty ⇒ no service_tier flag (standard tier). SPEND KNOB: enabling it is a consented per-host act, never a default. codex itself accepts any -c service_tier string silently, so the wrapper validates the value."
     },
     {
       "key": "CODEX_HARD_TIMEOUT",

package/bridges/codex-cli-bridge/references/driving-codex.md

@@ -20,7 +20,7 @@ judgment.
 
 ## Quality-first: model & effort are pinned
 
-Delegated codex work ALWAYS runs on the PINNED model at max effort: `gpt-5.6-sol` / `xhigh` are **pinned**
+Delegated codex work ALWAYS runs on the PINNED model at the pinned effort: `gpt-6-astra` / `high` are **pinned**
 and a non-default `CODEX_MODEL`/`CODEX_EFFORT` is **refused** (exit 2). That the pinned id is still the
 strongest selectable model is a hand-checked claim with no automated gate and no recorded date — see
 SKILL.md. Do not try to "tune down" the
@@ -92,7 +92,7 @@ codex-exec --resume <session-id> <file|->  # explicit session id
 
 Resume continues the SAME codex session, so you avoid re-sending the original context. It runs through
 the wrapper, which **re-establishes every invariant** (subscription-only `*_API_KEY` scrub,
-`--ignore-user-config`, the pinned `gpt-5.6-sol`/`xhigh`) and **restates the full posture via `-c`** —
+`--ignore-user-config`, the pinned `gpt-6-astra`/`high`) and **restates the full posture via `-c`** —
 because `codex exec resume` resets the sandbox/approval/network posture and rejects `-s`/`--add-dir`/`-C`,
 the wrapper passes `-c sandbox_mode=workspace-write -c approval_policy=never -c
 sandbox_workspace_write.network_access=false` explicitly. A resume takes no passthrough flags and an

package/bridges/codex-cli-bridge/references/sandbox-and-flags.md

@@ -47,7 +47,7 @@ carries the session id) into the run trace, with stderr merged into it; `--color
 `--color`, which stays on the fresh lane), so the resume lane is no longer the odd one out: it used
 to print its final message straight to stdout with the event stream nowhere, which left the very
 mode a nested-sandbox incident fired on without a structured evidence surface. Net effect: the wrapper prints just the final answer. **Reasoning still runs at
-`xhigh`** — quality is unchanged; only the *noise* is dropped. On success `codex-exec` extracts the
+the pinned effort** — quality is unchanged; only the *noise* is dropped. On success `codex-exec` extracts the
 session id from the trace and records it to `${CODEX_SESSION_FILE:-./.codex-last-session}` (so
 `--resume-last` can find it) and echoes `session: <id>` to stderr. On a missing/empty final-message
 file it falls back to the trace tail (loud, never silent).
@@ -63,8 +63,8 @@ failure is proven.
 
 ## Quality-first guard (pinned model & effort)
 
-The wrappers default `CODEX_MODEL=gpt-5.6-sol` and `CODEX_EFFORT=xhigh` and **refuse** (exit 2, loud) any
-non-default — delegated work always uses the PINNED model at max effort; quality is never traded for
+The wrappers default `CODEX_MODEL=gpt-6-astra` and `CODEX_EFFORT=high` and **refuse** (exit 2, loud) any
+non-default — delegated work always uses the PINNED model at the pinned effort; quality is never traded for
 quota. (Whether the pinned id is still the strongest selectable model is a hand-checked claim with no
 automated gate — see SKILL.md.) `CODEX_PROBE=1` relaxes this for a throwaway, effort-independent probe only (echoed loudly), and
 a probe still runs on the subscription, in the sandbox, with clean capture.
@@ -164,7 +164,7 @@ EVIDENCE posture as a fresh run — `-o` for the final message, `--json` into th
 
 A backgrounded/hung run survives otherwise, so both wrappers wrap codex in `timeout`/`gtimeout`
 (`--kill-after=15s`): `CODEX_HARD_TIMEOUT` defaults to **3600s (exec)** / **1800s (review)**, sized for a
-slow `xhigh` run. Exit 124/137 ⇒ "exceeded the hard cap" (raise the cap or narrow the task). If neither
+slow run at the pinned effort. Exit 124/137 ⇒ "exceeded the hard cap" (raise the cap or narrow the task). If neither
 `timeout` nor `gtimeout` is on `PATH`, `codex-exec` **warns loudly and runs uncapped** — never a silent
 no-op — while `codex-review` **refuses pre-spend** (the fail-closed hard-timeout preflight).
 
@@ -205,8 +205,8 @@ exec` over the precomputed diff instead, keeping every invariant intact.
 | `-o, --output-last-message <f>` | write ONLY the final message (clean capture) |
 | `--json` | structured event stream (`thread.started` ⇒ session id) |
 | `--output-schema <f>` | constrain output to a JSON schema (`CODEX_REVIEW_SCHEMA=1`) |
-| `-m <model>` | model (wrapper default `gpt-5.6-sol`, pinned via `CODEX_MODEL`) |
-| `-c model_reasoning_effort=<effort>` | reasoning effort (wrapper default `xhigh`, pinned via `CODEX_EFFORT`) |
+| `-m <model>` | model (wrapper default `gpt-6-astra`, pinned via `CODEX_MODEL`) |
+| `-c model_reasoning_effort=<effort>` | reasoning effort (wrapper default `high`, pinned via `CODEX_EFFORT`) |
 | `--ignore-user-config` | do NOT load `$CODEX_HOME/config.toml`; auth still uses `CODEX_HOME` |
 | `--color never` | disable ANSI colour in output |