@sabaiway/agent-workflow-kit 14.19.1 → 14.21.0

package/bridges/codex-cli-bridge/bin/codex-exec.test.mjs

@@ -13,7 +13,7 @@ import { createHash } from 'node:crypto';
 const HERE = dirname(fileURLToPath(import.meta.url));
 const WRAPPER = join(HERE, 'codex-exec.sh');
 
-// A hermetic fake `codex`: answers `login status`, captures argv/env/stdin to the
+// A hermetic fake `codex`: answers `login status` and `debug models`, captures argv/env/stdin to the
 // files named by CODEX_FAKE_*, honours -o by writing a final-message file, and
 // emits a minimal --json event stream (thread.started carries the session id).
 // Written with shell double-quotes + a heredoc ONLY (no single-quotes, no
@@ -22,6 +22,10 @@ const FAKE_CODEX = [
   '#!/usr/bin/env bash',
   'set -u',
   'if [[ "${1:-}" == "login" ]]; then echo "${CODEX_FAKE_LOGIN:-Logged in using ChatGPT}"; exit 0; fi',
+  'if [[ "${1:-}" == "debug" ]]; then cat <<EOF',
+  '{"models":[{"slug":"gpt-6.1-sol","priority":1,"visibility":"list","default_reasoning_level":"low","supported_reasoning_levels":[{"effort":"low"},{"effort":"medium"},{"effort":"high"}]},{"slug":"gpt-6-astra","priority":2,"visibility":"list","default_reasoning_level":"medium","supported_reasoning_levels":[{"effort":"medium"},{"effort":"high"}]}]}',
+  'EOF',
+  'exit 0; fi',
   'if [[ -n "${CODEX_FAKE_STDERR:-}" ]]; then echo "$CODEX_FAKE_STDERR" >&2; fi',
   ': "${CODEX_FAKE_ARGV:=/dev/null}"',
   ': "${CODEX_FAKE_ENV:=/dev/null}"',
@@ -182,31 +186,14 @@ const run = ({ repo, bin }, { args = ['-'], input = 'do the thing', env = {}, pa
 // run() IS that twin now, so the twin is one name pointing at it — two spawn paths could only drift.
 const runAsync = run;
 
-describe('codex-exec.sh — quality-first model/effort guard (1.1)', { concurrency: 2 }, () => {
-  it('refuses a non-default CODEX_MODEL and never spends a run', async () => {
-    const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_MODEL: 'gpt-5.4-mini' } });
-    rmSync(sb.root, { recursive: true, force: true });
-    assert.notEqual(r.status, 0);
-    assert.match(r.stderr, /not the pinned model/);
-    assert.equal(r.capStdin, '', 'codex must not be invoked when the guard fires');
-  });
-
-  it('refuses a non-default CODEX_EFFORT', async () => {
+describe('codex-exec.sh — the probe one-off (1.1)', { concurrency: 2 }, () => {
+  it('CODEX_PROBE=1 runs a one-off model and warns loudly', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_EFFORT: 'xhigh' } });
-    rmSync(sb.root, { recursive: true, force: true });
-    assert.notEqual(r.status, 0);
-    assert.match(r.stderr, /not the pinned effort/);
-  });
-
-  it('CODEX_PROBE=1 allows a non-default model and warns loudly', async () => {
-    const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: 'gpt-5.4-mini' } });
+    const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: 'gpt-6-astra' } });
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stderr, /THROWAWAY PROBE MODE/);
-    assert.match(r.argv, /gpt-5\.4-mini/, 'the probe model must reach codex');
+    assert.match(r.argv, /gpt-6-astra/, 'the probe model must reach codex');
   });
 });
 
@@ -650,7 +637,7 @@ describe('codex-exec.sh — preflight (unchanged invariants)', { concurrency: 2
 
 describe('codex-exec.sh — resume entrypoint restates every invariant (3.1)', { concurrency: 2 }, () => {
   const RESUME_INVARIANTS = [
-    /(^|\n)resume(\n|$)/, /(^|\n)--ignore-user-config(\n|$)/, /(^|\n)gpt-6-astra(\n|$)/,
+    /(^|\n)resume(\n|$)/, /(^|\n)--ignore-user-config(\n|$)/, /(^|\n)gpt-6\.1-sol(\n|$)/,
     /model_reasoning_effort=high/, /sandbox_mode=workspace-write/,
     /approval_policy=never/, /sandbox_workspace_write\.network_access=false/,
   ];
@@ -1216,23 +1203,8 @@ describe('codex-exec.sh — mode catalog ⟷ wrapper reality (manifest-pinned)',
     }
   });
 
-  it('the catalog claims CODEX_PROBE over the resume modes because the guard really precedes resume parsing', async () => {
-    // Verified in source: the quality guard runs BEFORE the resume dispatch, so a resume run is
-    // relaxed too — the catalog must say so, and this pins the ORDER the claim rests on.
-    const lines = executableLines(source);
-    const guardAt = lines.findIndex((l) => /\$\{?CODEX_PROBE/.test(l));
-    const resumeAt = lines.findIndex((l) => /^\s*--resume-last\)/.test(l));
-    assert.ok(guardAt !== -1 && resumeAt !== -1, 'both the probe guard and the resume arm must exist');
-    assert.ok(guardAt < resumeAt, 'the probe guard must precede resume parsing — else the resume parents are a false claim');
-    const hook = catalog.find((e) => e.key === 'CODEX_PROBE');
-    for (const key of ['exec.resume-last', 'exec.resume']) {
-      assert.ok(hook.parents.includes(key), `${key} is relaxed by the hook, so the catalog must declare it a parent`);
-    }
-  });
-
-  it('CODEX_PROBE really relaxes the guard on EVERY execute parent the catalog claims (behavioural)', async () => {
-    // Source ORDER alone is not the claim: a branch bug after resume parsing would keep it green.
-    // Drive each claimed parent for real — the guard must stop the dispatch without the hook, and
+  it('a one-off is refused on EVERY execute parent and CODEX_PROBE=1 runs it (behavioural)', async () => {
+    // Drive each claimed parent for real — the one-off must stop the dispatch without the hook, and
     // codex must really be reached with it (r.argv is non-empty only on a real invocation).
     const hook = catalog.find((e) => e.key === 'CODEX_PROBE');
     const drive = {
@@ -1244,20 +1216,21 @@ describe('codex-exec.sh — mode catalog ⟷ wrapper reality (manifest-pinned)',
       'exec.resume': () => ({ args: ['--resume', 'sess-xyz', '-'], input: 'continue' }),
     };
     const execParents = hook.parents.filter((p) => execEntries.some((x) => x.key === p));
-    assert.ok(execParents.length > 0, 'CODEX_PROBE must claim at least one execute parent');
+    assert.deepEqual(execParents, ['exec', 'exec.resume-last', 'exec.resume'], 'CODEX_PROBE claims every execute parent');
     for (const parent of execParents) {
       assert.ok(drive[parent], `no behavioural drive for claimed parent "${parent}" — add one`);
 
       const guarded = makeSandbox();
-      const off = await run(guarded, { ...drive[parent](guarded), env: { CODEX_MODEL: 'not-the-pinned-model' } });
+      const off = await run(guarded, { ...drive[parent](guarded), env: { CODEX_MODEL: 'gpt-6-astra' } });
       rmSync(guarded.root, { recursive: true, force: true });
-      assert.equal(off.status, 2, `${parent}: the quality guard must refuse an off-pin model without the hook`);
-      assert.equal(off.argv, '', `${parent}: the guard must refuse BEFORE spending a run`);
+      assert.equal(off.status, 2, `${parent}: a one-off must be refused without the hook`);
+      assert.match(off.stderr, /one-off/, `${parent}: the refusal names the one-off`);
+      assert.equal(off.argv, '', `${parent}: the one-off must refuse BEFORE spending a run`);
 
       const probed = makeSandbox();
-      const on = await run(probed, { ...drive[parent](probed), env: { CODEX_MODEL: 'not-the-pinned-model', CODEX_PROBE: '1' } });
+      const on = await run(probed, { ...drive[parent](probed), env: { CODEX_MODEL: 'gpt-6-astra', CODEX_PROBE: '1' } });
       rmSync(probed.root, { recursive: true, force: true });
-      assert.equal(on.status, 0, `${parent}: CODEX_PROBE=1 must really relax the guard — the catalog claims it does`);
+      assert.equal(on.status, 0, `${parent}: CODEX_PROBE=1 must really run the one-off — the catalog claims it does`);
       assert.notEqual(on.argv, '', `${parent}: CODEX_PROBE=1 must really reach codex, not merely exit 0`);
     }
   });
@@ -1489,7 +1462,7 @@ describe('codex-exec.sh — settings surface ⟷ manifest (D6, manifest-pinned)'
     const help = runHelp('--help').stdout;
     const section = helpSection(help, SETTINGS_HEADER);
     const got = section.filter((l) => /^[A-Z][A-Z0-9_]+ —/.test(l)).map((l) => l.split(' ')[0]);
-    const want = (MANIFEST.settings ?? []).filter((s) => s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
+    const want = (MANIFEST.settings ?? []).filter((s) => s.kind !== 'posture' && s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
     assert.ok(want.length > 0, 'the manifest must declare settings for this wrapper');
     setEq(got, want, 'help Settings keys ⟷ manifest settings.appliesTo');
     assert.ok(section.some((l) => l.includes('agent-workflow/bridge-settings.conf')), 'the section names the settings file');
@@ -1507,7 +1480,7 @@ describe('codex-exec.sh — settings surface ⟷ manifest (D6, manifest-pinned)'
   it('AW_SETTINGS_APPLIED equals the manifest appliesTo subset for this wrapper', async () => {
     const m = source.match(/^AW_SETTINGS_APPLIED="([^"]*)"$/m);
     assert.ok(m, 'AW_SETTINGS_APPLIED not found');
-    const want = ALL_SETTINGS.filter((s) => s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
+    const want = ALL_SETTINGS.filter((s) => s.kind !== 'posture' && s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
     assert.ok(want.length > 0);
     setEq(m[1].trim().split(/\s+/), want, 'applied subset ⟷ manifest appliesTo');
   });
@@ -1516,8 +1489,8 @@ describe('codex-exec.sh — settings surface ⟷ manifest (D6, manifest-pinned)'
     const body = source.match(/aw_settings_valid\(\) \{[\s\S]*?\n\}/);
     assert.ok(body, 'aw_settings_valid not found');
     const armKeys = [...body[0].matchAll(/^    ([A-Z][A-Z0-9_]*)\)/gm)].map((x) => x[1]);
-    setEq(armKeys, ALL_SETTINGS.map((s) => s.key), 'validation arms ⟷ manifest keys');
-    for (const s of ALL_SETTINGS) {
+    setEq(armKeys, ALL_SETTINGS.filter((s) => s.kind !== 'posture').map((s) => s.key), 'validation arms ⟷ manifest keys (a posture key is read by aw_read_posture, never validated here)');
+    for (const s of ALL_SETTINGS.filter((x) => x.kind !== 'posture')) {
       const arm = body[0].match(new RegExp(`^    ${s.key}\\) (.*) ;;$`, 'm'));
       assert.ok(arm, `no validation arm for ${s.key}`);
       if (s.kind === 'enum') for (const v of s.values) assert.ok(arm[1].includes(`"${v}"`), `${s.key}: enum value '${v}' not pinned`);
@@ -1546,7 +1519,7 @@ describe('codex-exec.sh — dispatch-posture labeling (D5, AD-061)', { concurren
     const lines = banners(r.stderr);
     assert.equal(lines.length, 1, 'EXACTLY ONE banner line per run');
     assert.equal(lines[0],
-      'exec posture: model=gpt-6-astra effort=high tier=standard sandbox=workspace-write session=fresh timeout=3600s');
+      'exec posture: model=gpt-6.1-sol effort=high tier=standard sandbox=workspace-write session=fresh source=model:default,effort:default timeout=3600s');
   });
 
   it('an ARMED Fast tier rides the banner (tier=priority)', async () => {
@@ -1642,11 +1615,11 @@ describe('codex-exec.sh — dispatch-posture labeling (D5, AD-061)', { concurren
 
   it('a banner field carrying CONTROL BYTES refuses pre-spend (model / effort / tier / timeout / DEL)', async () => {
     const cases = [
-      { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(1)}` },
+      { CODEX_MODEL: `gpt-6.1-sol${String.fromCharCode(1)}` },
       { CODEX_EFFORT: `high${String.fromCharCode(2)}` },
       { CODEX_SERVICE_TIER: `priority${String.fromCharCode(3)}` },
       { CODEX_HARD_TIMEOUT: `3600${String.fromCharCode(4)}` },
-      { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(127)}` },
+      { CODEX_MODEL: `gpt-6.1-sol${String.fromCharCode(127)}` },
     ];
     for (const env of cases) {
       const sb = makeSandbox();
@@ -2014,7 +1987,7 @@ describe('codex-exec.sh — the pre-spend reservation (D1/D8)', { concurrency: 2
     assert.match(plain.stderr, /running codex WITHOUT a hard wall-clock cap/, 'the nonce-less lane is unchanged');
   });
 
-  it('a PREFLIGHT refusal leaves NO reservation (login guard, missing AGENTS.md, off-pin model)', async () => {
+  it('a PREFLIGHT refusal leaves NO reservation (login guard, missing AGENTS.md, an unoffered model)', async () => {
     const cases = [
       { label: 'login', env: { CODEX_FAKE_LOGIN: 'Not logged in' } },
       { label: 'model', env: { CODEX_MODEL: 'gpt-5.4-mini' } },
@@ -2047,7 +2020,7 @@ describe('codex-exec.sh — the pre-spend reservation (D1/D8)', { concurrency: 2
     assert.equal(r.status, 71, r.stderr);
     assert.equal(held.state, 'reserved');
     assert.equal(held.wrapperVersion, MANIFEST.version, 'the receipt stamps the bridge version version-sync bumps');
-    assert.deepEqual(held.posture, { model: 'gpt-6-astra', effort: 'high', tier: null });
+    assert.deepEqual(held.posture, { model: 'gpt-6.1-sol', effort: 'high', tier: null });
     assert.equal(held.capS, 3600);
     assert.equal(held.killGraceS, 15);
     assert.match(held.contractDigest, /^[0-9a-f]{64}$/);

package/bridges/codex-cli-bridge/bin/codex-model-posture.test.mjs

@@ -0,0 +1,371 @@
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync, existsSync, cpSync, readdirSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const EXEC = join(HERE, 'codex-exec.sh');
+const REVIEW = join(HERE, 'codex-review.sh');
+const MANIFEST = JSON.parse(readFileSync(join(HERE, '..', 'capability.json'), 'utf8'));
+const REAL_TIMEOUT = spawnSync('bash', ['-c', 'type -P timeout'], { encoding: 'utf8' }).stdout.trim();
+const ESC = String.fromCharCode(27);
+
+const FAKE_CODEX = [
+  '#!/usr/bin/env bash',
+  'set -u',
+  'if [[ "${1:-}" == "login" ]]; then echo "Logged in using ChatGPT"; exit 0; fi',
+  'if [[ "${1:-}" == "debug" ]]; then',
+  '  echo "catalog argv=[$*] home=${CODEX_HOME:-} keys=${OPENAI_API_KEY:-unset},${FOO_API_KEY:-unset},${OPENAI_BASE_URL:-unset}" >>"$CODEX_FAKE_LOG"',
+  '  if [[ -n "${CODEX_FAKE_CATALOG_SLEEP:-}" ]]; then sleep "$CODEX_FAKE_CATALOG_SLEEP"; fi',
+  '  if [[ -n "${CODEX_FAKE_CATALOG_EXIT:-}" ]]; then exit "$CODEX_FAKE_CATALOG_EXIT"; fi',
+  '  if grep -q model_provider "${CODEX_HOME:-$HOME/.codex}/config.toml" 2>/dev/null && [[ "$*" != *model_provider=openai* ]]; then',
+  '    cat "$CODEX_FAKE_USER_CATALOG"; exit 0',
+  '  fi',
+  '  cat "$CODEX_FAKE_CATALOG"; exit 0',
+  'fi',
+  'echo "run argv=[$*]" >>"$CODEX_FAKE_LOG"',
+  'cat >/dev/null',
+  'out=""; prev=""',
+  'for a in "$@"; do if [[ "$prev" == "-o" ]]; then out="$a"; fi; prev="$a"; done',
+  'if [[ -n "$out" ]]; then printf "fake answer\\nVerdict: ship\\n" >"$out"; fi',
+  'echo "{\\"type\\":\\"thread.started\\",\\"thread_id\\":\\"sess-fake\\"}"',
+  '',
+].join('\n');
+
+const FAKE_TIMEOUT = [
+  '#!/usr/bin/env bash',
+  'if [[ " $* " == *" debug models "* ]]; then',
+  '  while [[ $# -gt 0 && "$1" != "codex" ]]; do shift; done',
+  `  exec "${REAL_TIMEOUT}" 1 "$@"`,
+  'fi',
+  `exec "${REAL_TIMEOUT}" "$@"`,
+  '',
+].join('\n');
+
+const entry = (slug, priority, efforts, level = 'medium', visibility = 'list') => ({
+  slug, priority, visibility, default_reasoning_level: level, supported_reasoning_levels: efforts.map((effort) => ({ effort })),
+});
+const ALL = ['low', 'medium', 'high', 'xhigh'];
+const STANDARD = { models: [entry('gpt-6.1-sol', 1, ALL, 'low'), entry('gpt-6-astra', 2, ALL), entry('gpt-6-luna', 3, ['low', 'medium', 'high'])] };
+const HOST_SETTING = 'CODEX_MODEL=gpt-6-luna\nCODEX_EFFORT=medium\n';
+
+const SHARED = mkdtempSync(join(tmpdir(), 'codex-posture-'));
+after(() => rmSync(SHARED, { recursive: true, force: true }));
+const TEMPLATE = (() => {
+  const home = join(SHARED, 'template');
+  const repo = join(home, 'repo');
+  mkdirSync(join(home, 'bin'), { recursive: true });
+  mkdirSync(repo);
+  writeFileSync(join(home, 'bin', 'codex'), FAKE_CODEX, { mode: 0o755 });
+  const git = (...args) => spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  git('init', '-q');
+  git('config', 'user.email', 'probe@example.com');
+  git('config', 'user.name', 'probe');
+  writeFileSync(join(repo, 'AGENTS.md'), '# AGENTS\n\nHard Constraints: none (test fixture).\n');
+  git('add', '-A');
+  git('commit', '-qm', 'base');
+  writeFileSync(join(repo, 'plan.md'), '# a plan under review\n');
+  return home;
+})();
+
+let sequence = 0;
+const sandbox = ({ settings, catalog = STANDARD, catalogText, userCatalog, fakeTimeout = false } = {}) => {
+  const home = join(SHARED, `sb-${++sequence}`);
+  cpSync(TEMPLATE, home, { recursive: true });
+  const sb = {
+    home, repo: join(home, 'repo'), bin: join(home, 'bin'), log: join(home, 'calls.log'),
+    catalog: join(home, 'catalog.json'), userCatalog: join(home, 'user-catalog.json'),
+    settingsFile: join(home, '.config', 'agent-workflow', 'bridge-settings.conf'),
+  };
+  writeFileSync(sb.catalog, catalogText ?? JSON.stringify(catalog));
+  writeFileSync(sb.userCatalog, JSON.stringify(userCatalog ?? { models: [] }));
+  if (settings !== undefined) {
+    mkdirSync(dirname(sb.settingsFile), { recursive: true });
+    writeFileSync(sb.settingsFile, settings);
+  }
+  if (fakeTimeout) writeFileSync(join(sb.bin, 'timeout'), FAKE_TIMEOUT, { mode: 0o755 });
+  return sb;
+};
+
+const drive = (sb, [wrapper, args], env = {}) => {
+  const r = spawnSync('bash', [wrapper, ...args], {
+    cwd: sb.repo, input: 'do the thing', encoding: 'utf8', timeout: 60000,
+    env: {
+      PATH: `${sb.bin}:${process.env.PATH}`, HOME: sb.home, TMPDIR: process.env.TMPDIR ?? '/tmp',
+      CODEX_FAKE_LOG: sb.log, CODEX_FAKE_CATALOG: sb.catalog, CODEX_FAKE_USER_CATALOG: sb.userCatalog, ...env,
+    },
+  });
+  const log = existsSync(sb.log) ? readFileSync(sb.log, 'utf8') : '';
+  return { status: r.status, stderr: r.stderr, log, ran: log.includes('run argv='), runArgv: (log.match(/^run argv=\[(.*)\]$/m) ?? [])[1] ?? '' };
+};
+
+const FRESH_EXEC = [EXEC, ['-']];
+const PLAN_REVIEW = [REVIEW, ['plan', 'plan.md']];
+const PARENTS = {
+  exec: () => FRESH_EXEC,
+  'exec.resume-last': (sb) => {
+    writeFileSync(join(sb.repo, '.codex-last-session'), 'sess-1\n');
+    return [EXEC, ['--resume-last', '-']];
+  },
+  'exec.resume': () => [EXEC, ['--resume', 'sess-1', '-']],
+  'review.plan': () => PLAN_REVIEW,
+  'review.code': (sb) => {
+    writeFileSync(join(sb.repo, 'pending.txt'), 'an uncommitted change\n');
+    return [REVIEW, ['code']];
+  },
+};
+
+const quote = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const remedyRe = (sb, model, effort) => new RegExp(
+  `remedy: set these lines in ${quote(sb.settingsFile)}:\\s+CODEX_MODEL=${quote(model)}\\s+CODEX_EFFORT=${quote(effort)}\\s+and unset CODEX_MODEL and CODEX_EFFORT in the environment`);
+const bannerOf = (stderr) => stderr.split('\n').find((line) => /^(exec|review) posture: /.test(line)) ?? '';
+const assertRan = (r, model, effort) => {
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.runArgv, new RegExp(`(^| )-m ${quote(model)}( |$)`), r.log);
+  assert.match(r.runArgv, new RegExp(`model_reasoning_effort=${quote(effort)}( |$)`), r.log);
+};
+const assertRefusedUnspent = (r) => {
+  assert.equal(r.status, 2, r.stderr);
+  assert.equal(r.ran, false, 'refused before any run is spent');
+};
+
+describe('a fresh host runs the built-in default — spec:bridge-model/S1', () => {
+  it('codex-exec and codex-review run gpt-6.1-sol at effort high and the banner names source default', () => {
+    const exec = drive(sandbox(), FRESH_EXEC);
+    assertRan(exec, 'gpt-6.1-sol', 'high');
+    assert.equal(bannerOf(exec.stderr),
+      'exec posture: model=gpt-6.1-sol effort=high tier=standard sandbox=workspace-write session=fresh source=model:default,effort:default timeout=3600s');
+    const review = drive(sandbox(), PLAN_REVIEW);
+    assertRan(review, 'gpt-6.1-sol', 'high');
+    assert.equal(bannerOf(review.stderr),
+      'review posture: model=gpt-6.1-sol effort=high tier=standard source=model:default,effort:default timeout=1800s');
+  });
+});
+
+describe('the setting is the host posture of every codex wrapper — spec:bridge-model/S2', () => {
+  for (const [label, parent] of [['codex-exec', FRESH_EXEC], ['codex-review', PLAN_REVIEW]]) {
+    it(`${label} runs the set model and effort without a probe flag, the banner naming source setting`, () => {
+      const r = drive(sandbox({ settings: HOST_SETTING }), parent);
+      assertRan(r, 'gpt-6-luna', 'medium');
+      assert.match(bannerOf(r.stderr), / model=gpt-6-luna effort=medium .*source=model:setting,effort:setting timeout=/);
+      assert.doesNotMatch(r.stderr, /unknown key/, 'the model keys are recognised beside the registry');
+    });
+  }
+});
+
+describe('an environment value equal to the host posture is no one-off — spec:bridge-model/S3', () => {
+  const cases = [
+    ['the setting restated in the env', HOST_SETTING, { CODEX_MODEL: 'gpt-6-luna', CODEX_EFFORT: 'medium' }, 'gpt-6-luna', 'medium', 'model:environment,effort:environment'],
+    ['env gpt-6.1-sol on a fresh host', undefined, { CODEX_MODEL: 'gpt-6.1-sol' }, 'gpt-6.1-sol', 'high', 'model:environment,effort:default'],
+    ['explicitly empty env keys on a fresh host', undefined, { CODEX_MODEL: '', CODEX_EFFORT: '' }, 'gpt-6.1-sol', 'high', 'model:environment,effort:environment'],
+  ];
+  for (const [label, settings, env, model, effort, source] of cases) {
+    for (const parent of [FRESH_EXEC, PLAN_REVIEW]) {
+      it(`${label}: ${parent[0] === EXEC ? 'codex-exec' : 'codex-review'} runs without a probe flag, source environment`, () => {
+        const r = drive(sandbox({ settings }), parent, env);
+        assertRan(r, model, effort);
+        assert.match(bannerOf(r.stderr), new RegExp(` source=${source} timeout=`));
+      });
+    }
+  }
+});
+
+const ONE_OFFS = [
+  ['env gpt-6.1-sol', { CODEX_MODEL: 'gpt-6.1-sol' }, 'gpt-6.1-sol', 'medium'],
+  ['env CODEX_EFFORT=high alone', { CODEX_EFFORT: 'high' }, 'gpt-6-luna', 'high'],
+  ['an explicitly empty CODEX_MODEL=', { CODEX_MODEL: '' }, 'gpt-6.1-sol', 'medium'],
+  ['an explicitly empty CODEX_EFFORT=', { CODEX_EFFORT: '' }, 'gpt-6-luna', 'high'],
+];
+
+describe('a one-off is refused pre-spend unless it is a probe — spec:bridge-model/S4', () => {
+  it('the probe hook names exactly the parents driven here', () => {
+    const hook = MANIFEST.modeCatalog.find((mode) => mode.key === 'CODEX_PROBE');
+    assert.deepEqual([...hook.parents].sort(), Object.keys(PARENTS).sort());
+  });
+  for (const [label, env, model, effort] of ONE_OFFS) {
+    for (const [parent, argsOf] of Object.entries(PARENTS)) {
+      it(`${label} on ${parent}: refused with the remedy, run under CODEX_PROBE=1`, () => {
+        const refusedSb = sandbox({ settings: HOST_SETTING });
+        const refused = drive(refusedSb, argsOf(refusedSb), env);
+        assertRefusedUnspent(refused);
+        assert.match(refused.stderr, /one-off/);
+        assert.match(refused.stderr, remedyRe(refusedSb, model, effort));
+        const probeSb = sandbox({ settings: HOST_SETTING });
+        const probed = drive(probeSb, argsOf(probeSb), { ...env, CODEX_PROBE: '1' });
+        assertRan(probed, model, effort);
+        assert.match(bannerOf(probed.stderr), / source=model:(environment|setting),effort:(environment|setting) timeout=/);
+      });
+    }
+  }
+});
+
+const CONTRACT = '# dispatch\n\n```aw-dispatch-contract\n{"nonce":"n1","scope":"probe"}\n```\n';
+describe('a nonced probe one-off is refused; a probe review keeps its nonce — spec:bridge-model/S6', () => {
+  const nonced = [
+    ['AW_DISPATCH_NONCE', ['task.md'], { AW_DISPATCH_NONCE: 'n1' }],
+    ['--nonce', ['--nonce', 'n1', 'task.md'], {}],
+    ['--nonce on a resume', ['--resume', 'sess-1', '--nonce', 'n1', 'task.md'], {}],
+  ];
+  for (const [label, args, env] of nonced) {
+    it(`${label}: a probe one-off is refused before any reservation`, () => {
+      const sb = sandbox({ settings: HOST_SETTING });
+      writeFileSync(join(sb.repo, 'task.md'), CONTRACT);
+      const r = drive(sb, [EXEC, args], { ...env, CODEX_PROBE: '1', CODEX_MODEL: 'gpt-6.1-sol' });
+      assertRefusedUnspent(r);
+      assert.match(r.stderr, /cannot carry a dispatch nonce/);
+      assert.equal(existsSync(join(sb.repo, '.git', 'agent-workflow-exec-receipt-5-codex-n1.json')), false);
+    });
+  }
+  it('a nonced probe on the host posture runs and mints its receipt', () => {
+    const sb = sandbox({ settings: HOST_SETTING });
+    writeFileSync(join(sb.repo, 'task.md'), CONTRACT);
+    const r = drive(sb, [EXEC, ['--nonce', 'n1', 'task.md']], { CODEX_PROBE: '1' });
+    assertRan(r, 'gpt-6-luna', 'medium');
+    const receipt = JSON.parse(readFileSync(join(sb.repo, '.git', 'agent-workflow-exec-receipt-5-codex-n1.json'), 'utf8'));
+    assert.deepEqual(receipt.posture, { model: 'gpt-6-luna', effort: 'medium', tier: null });
+  });
+  it('a probe review one-off keeps its --nonce', () => {
+    const r = drive(sandbox({ settings: HOST_SETTING }), [REVIEW, ['plan', 'plan.md', '--nonce', 'n1']], { CODEX_PROBE: '1', CODEX_MODEL: 'gpt-6.1-sol' });
+    assertRan(r, 'gpt-6.1-sol', 'medium');
+  });
+});
+
+describe('a model or effort flag after -- is refused pre-spend — spec:bridge-model/S7', () => {
+  for (const flag of [['-m', 'gpt-6-luna'], ['--model=gpt-6-luna'], ['-c', 'model_reasoning_effort=low'], ['--config', 'model=x'], ['-p', 'fast']]) {
+    it(`codex-exec refuses ${flag[0]} on the host posture`, () => {
+      const r = drive(sandbox(), [EXEC, ['-', '--', ...flag]]);
+      assertRefusedUnspent(r);
+      assert.match(r.stderr, /is not allowed/);
+    });
+  }
+});
+
+describe('a model the catalog does not offer is refused with the offered list — spec:bridge-model/S8', () => {
+  const offered = 'offered: gpt-6.1-sol, gpt-6-astra, gpt-6-luna';
+  const sources = [['the setting', { settings: 'CODEX_MODEL=gpt-unknown\n' }, {}], ['the environment', {}, { CODEX_MODEL: 'gpt-unknown' }]];
+  for (const [label, options, env] of sources) {
+    for (const parent of [FRESH_EXEC, PLAN_REVIEW]) {
+      it(`a model from ${label} on ${parent[0] === EXEC ? 'codex-exec' : 'codex-review'}: the built-in default lines, whatever was refused`, () => {
+        const sb = sandbox(options);
+        const r = drive(sb, parent, env);
+        assertRefusedUnspent(r);
+        assert.match(r.stderr, /CODEX_MODEL='gpt-unknown' .*not a model the installed codex offers/);
+        assert.ok(r.stderr.includes(offered), r.stderr);
+        assert.match(r.stderr, remedyRe(sb, 'gpt-6.1-sol', 'high'));
+      });
+    }
+  }
+  for (const parent of [FRESH_EXEC, PLAN_REVIEW]) {
+    it(`a dash-leading model on ${parent[0] === EXEC ? 'codex-exec' : 'codex-review'} is refused as not offered, never read as a node option`, () => {
+      const r = drive(sandbox({ settings: 'CODEX_MODEL=--version\n' }), parent);
+      assertRefusedUnspent(r);
+      assert.match(r.stderr, /CODEX_MODEL='--version' \(setting\) is not a model the installed codex offers/);
+    });
+  }
+  it('the default is restored even when another offered slug has a smaller priority number', () => {
+    const sb = sandbox({ settings: 'CODEX_MODEL=gpt-unknown\n', catalog: { models: [entry('gpt-6-luna', 0, ALL), entry('gpt-6.1-sol', 1, ALL, 'low')] } });
+    assert.match(drive(sb, FRESH_EXEC).stderr, remedyRe(sb, 'gpt-6.1-sol', 'high'));
+  });
+  it('the default itself is refused when not offered; the remedy is the smallest-priority entry whole', () => {
+    const sb = sandbox({ catalog: { models: [entry('gpt-6-astra', 5, ALL), entry('gpt-6-luna', 2, ['low', 'medium'], 'low')] } });
+    const r = drive(sb, FRESH_EXEC);
+    assertRefusedUnspent(r);
+    assert.match(r.stderr, /CODEX_MODEL='gpt-6\.1-sol' \(default\)/);
+    assert.match(r.stderr, remedyRe(sb, 'gpt-6-luna', 'low'));
+  });
+  it('on a mixed catalog only visibility=list entries count — a hidden slug is refused and never named', () => {
+    const mixed = { models: [entry('gpt-secret', 0, ALL, 'xhigh', 'hide'), entry('gpt-6-luna', 2, ALL), entry('gpt-6.1-sol', 3, ['low', 'medium'], 'low')] };
+    const sb = sandbox({ settings: 'CODEX_MODEL=gpt-secret\n', catalog: mixed });
+    const r = drive(sb, FRESH_EXEC);
+    assertRefusedUnspent(r);
+    const afterRefusal = r.stderr.slice(r.stderr.indexOf('offered:'));
+    assert.ok(afterRefusal.includes('offered: gpt-6-luna, gpt-6.1-sol'), r.stderr);
+    assert.doesNotMatch(afterRefusal, /gpt-secret/);
+    assert.match(r.stderr, remedyRe(sb, 'gpt-6-luna', 'medium'));
+  });
+});
+
+describe('an effort the model does not offer is refused the same way — spec:bridge-model/S9', () => {
+  for (const parent of [FRESH_EXEC, PLAN_REVIEW]) {
+    it(`${parent[0] === EXEC ? 'codex-exec' : 'codex-review'} names the model's efforts and the built-in default lines`, () => {
+      const sb = sandbox({ settings: 'CODEX_MODEL=gpt-6-luna\nCODEX_EFFORT=xhigh\n' });
+      const r = drive(sb, parent);
+      assertRefusedUnspent(r);
+      assert.match(r.stderr, /CODEX_EFFORT='xhigh' \(setting\) is not an effort the installed codex offers for gpt-6-luna/);
+      assert.ok(r.stderr.includes('offered: low, medium, high'), r.stderr);
+      assert.match(r.stderr, remedyRe(sb, 'gpt-6.1-sol', 'high'));
+    });
+  }
+});
+
+describe('an unreadable catalog is one stderr line and the run proceeds — spec:bridge-model/S10', () => {
+  const unreadable = [
+    ['a failing read', {}, { CODEX_FAKE_CATALOG_EXIT: '3' }],
+    ['a timed-out read', { fakeTimeout: true }, { CODEX_FAKE_CATALOG_SLEEP: '5' }],
+    ['output that is not JSON', { catalogText: 'not json at all' }, {}],
+    ['JSON without models[]', { catalog: { data: [] } }, {}],
+    ['a catalog that offers no model', { catalog: { models: [entry('gpt-6.1-sol', 1, ALL, 'low', 'hide')] } }, {}],
+    ['an offered entry without a slug', { catalog: { models: [{ ...entry('', 0, ALL), slug: undefined }, entry('gpt-6-luna', 2, ALL)] } }, {}],
+    ['the effective entry without supported_reasoning_levels', { catalog: { models: [{ slug: 'gpt-6.1-sol', priority: 1, visibility: 'list', default_reasoning_level: 'low' }] } }, {}],
+  ];
+  for (const [label, options, env] of unreadable) {
+    for (const parent of [FRESH_EXEC, PLAN_REVIEW]) {
+      it(`${label} on ${parent[0] === EXEC ? 'codex-exec' : 'codex-review'}`, () => {
+        const r = drive(sandbox(options), parent, env);
+        assertRan(r, 'gpt-6.1-sol', 'high');
+        assert.equal(r.stderr.split('\n').filter((line) => /catalog/.test(line)).length, 1, r.stderr);
+        assert.match(r.stderr, /^warning: the codex model catalog is unreadable \(.+\) — the run proceeds/m);
+      });
+    }
+  }
+  it('without a timeout binary the nonce-less codex-exec still reads the catalog, unbounded', () => {
+    const sb = sandbox();
+    const farm = join(sb.home, 'farm');
+    mkdirSync(farm);
+    const linked = new Set(['timeout', 'gtimeout']);
+    for (const dir of process.env.PATH.split(':').filter(Boolean)) {
+      for (const name of existsSync(dir) ? readdirSync(dir) : []) {
+        if (!linked.has(name)) symlinkSync(resolve(dir, name), join(farm, name));
+        linked.add(name);
+      }
+    }
+    const r = drive(sb, FRESH_EXEC, { PATH: `${sb.bin}:${farm}` });
+    assertRan(r, 'gpt-6.1-sol', 'high');
+    assert.match(r.log, /^catalog /m);
+    assert.match(bannerOf(r.stderr), / timeout=uncapped$/);
+  });
+});
+
+describe('the catalog read follows the subscription guard and ignores a user config — spec:bridge-model/S11', () => {
+  for (const parent of [FRESH_EXEC, PLAN_REVIEW]) {
+    it(`${parent[0] === EXEC ? 'codex-exec' : 'codex-review'} reads the run's CODEX_HOME catalog with the built-in provider, keys cleared`, () => {
+      const sb = sandbox({ userCatalog: { models: [entry('their-model', 1, ALL)] } });
+      const codexHome = join(sb.home, 'codex-home');
+      mkdirSync(codexHome);
+      writeFileSync(join(codexHome, 'config.toml'), 'model_provider = "their-proxy"\n');
+      const r = drive(sb, parent, { CODEX_HOME: codexHome, OPENAI_API_KEY: 'sk-live', FOO_API_KEY: 'foo', OPENAI_BASE_URL: 'http://proxy' });
+      assertRan(r, 'gpt-6.1-sol', 'high');
+      assert.match(r.log, new RegExp(`^catalog argv=\\[.*\\] home=${quote(codexHome)} keys=unset,unset,unset$`, 'm'));
+    });
+  }
+});
+
+describe('a settings-file model value with a control byte or an empty one falls back — spec:bridge-model/S17', () => {
+  const values = [
+    ['a control byte', `CODEX_MODEL=gpt-6-luna${ESC}[31m\nCODEX_EFFORT=medium${ESC}\n`],
+    ['an empty value', 'CODEX_MODEL=\nCODEX_EFFORT=\n'],
+  ];
+  for (const [label, settings] of values) {
+    it(`${label}: each key warns without the raw byte and the run takes the built-in default`, () => {
+      const r = drive(sandbox({ settings }), FRESH_EXEC);
+      assertRan(r, 'gpt-6.1-sol', 'high');
+      assert.equal(r.stderr.includes(ESC), false, 'no raw control byte reaches stderr');
+      assert.match(r.stderr, /warning: CODEX_MODEL in bridge settings file .* built-in default/);
+      assert.match(r.stderr, /warning: CODEX_EFFORT in bridge settings file .* built-in default/);
+      assert.match(bannerOf(r.stderr), / source=model:default,effort:default timeout=/);
+    });
+  }
+});