@sabaiway/agent-workflow-kit 14.20.0 → 14.21.0

package/bridges/codex-cli-bridge/bin/codex-review.sh

@@ -20,10 +20,11 @@
 # (never silently truncated). Optionally (CODEX_REVIEW_SCHEMA=1) the findings come
 # back as a validated JSON object, with a raw-text fallback.
 #
-# Auth/policy: subscription-only, identical to codex-exec.sh. Quality-first: the
-# review runs on the PINNED model at the pinned effort (advisory findings still bear on
-# what ships, so the same pin-integrity guard applies; CODEX_PROBE=1 relaxes it for
-# a throwaway probe only).
+# Auth/policy: subscription-only, identical to codex-exec.sh. The review runs on the host
+# posture — the built-in default gpt-6.1-sol at effort high unless the user set another with
+# `/agent-workflow-kit bridge-settings` (advisory findings still bear on what ships, so the same
+# one-off refusal applies; CODEX_PROBE=1 is the one route to a one-off, and a probe receipt never
+# attests).
 #
 # Best-effort read hygiene: the review runs under a temporary HOME / XDG_* with an
 # ABSOLUTE CODEX_HOME so codex auth + history still resolve, but its default config
@@ -39,7 +40,7 @@ set -euo pipefail
 case "${1:-}" in
   --help|-h)
     cat <<'HELP'
-codex-review — read-only ADVISORY review by the OpenAI Codex CLI (subscription-only; the PINNED model at the pinned effort).
+codex-review — read-only ADVISORY review by the OpenAI Codex CLI (subscription-only; the host posture's model and effort).
 
 Usage:
   codex-review plan <plan-file> [--nonce <n>]
@@ -91,15 +92,17 @@ Receipt:
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
-  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6-astra, cache fetched 2026-09-05; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
+  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6.1-sol, cache fetched 2026-10-03; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 1800)
   CODEX_REVIEW_MAX_TOTAL_BYTES — inline-payload cap, integer bytes 1..100000000 (default 1500000); above it the diff rides via a git-dir temp file
 
 Notes:
-  the review posture banner appends a banner-only timeout=<duration> field — exactly the duration
-  handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary
-  exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer
-  happen), and the field never enters the receipt posture or the D5 banner↔receipt parity
+  the review posture banner appends a banner-only source=model:<s>,effort:<s> field — where each
+  value came from: default, setting or environment — then a banner-only timeout=<duration> field —
+  exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no
+  timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped
+  review run can no longer happen), and neither field enters the receipt posture or the D5
+  banner↔receipt parity
   quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
   posture; a prose re-type drifts
 
@@ -107,7 +110,7 @@ Honesty + posture (D4/D5):
   a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or
   missing output included — exits 4 with NO receipt: a FAILED review to RE-RUN, never a fatal
   session error. One stderr banner line states the ACTUAL run posture (review posture: model=…
-  effort=… tier=… timeout=…) and the receipt records the same posture {model, effort, tier} (tier
+  effort=… tier=… source=… timeout=…) and the receipt records the same posture {model, effort, tier} (tier
   null on the standard tier; the timeout field is banner-only — never a receipt field). Quote the
   posture banner verbatim when labeling this dispatch. A posture value carrying control bytes
   refuses pre-spend in every mode.
@@ -121,6 +124,8 @@ esac
 
 # This wrapper's applied settings-file subset (see the shared reader block below).
 AW_SETTINGS_APPLIED="CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES"
+DEFAULT_CODEX_MODEL="gpt-6.1-sol"
+DEFAULT_CODEX_EFFORT="high"
 
 # --- Bridge settings file (host-level, kit-independent) — byte-identical across the four wrappers ---
 # ${XDG_CONFIG_HOME:-$HOME/.config}/agent-workflow/bridge-settings.conf holds KEY=VALUE lines,
@@ -141,7 +146,7 @@ aw_settings_file() {
   printf '%s/agent-workflow/bridge-settings.conf' "${XDG_CONFIG_HOME:-$HOME/.config}"
 }
 aw_settings_known() {
-  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES " in
+  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES CODEX_MODEL CODEX_EFFORT AGY_MODEL " in
     *" $1 "*) return 0 ;;
     *) return 1 ;;
   esac
@@ -226,6 +231,37 @@ aw_apply_settings() {
   done
   return 0
 }
+aw_read_posture() {
+  local key="$1" default="$2" empty="$3" file line value notify=1
+  AW_HOST_VALUE="$default"
+  AW_HOST_SOURCE="default"
+  file="$(aw_settings_file)"
+  [[ -n "${AW_SETTINGS_NOTIFIED:-}" ]] && notify=0
+  if [[ -f "$file" && -r "$file" ]]; then
+    line="$(grep "^${key}=" "$file" 2>/dev/null || true)"
+    if [[ -n "$line" ]]; then
+      value="${line##*$'\n'}"
+      value="${value#*=}"
+      if [[ -n "$value" && "$value" != *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+        AW_HOST_VALUE="$value"
+        AW_HOST_SOURCE="setting"
+      elif (( notify )); then
+        echo "warning: $key in bridge settings file '$file' is empty or carries a control byte — using the built-in default '$default'." >&2
+      fi
+    fi
+  fi
+  AW_RUN_VALUE="$AW_HOST_VALUE"
+  AW_RUN_SOURCE="$AW_HOST_SOURCE"
+  if [[ -n "${!key+x}" ]]; then
+    AW_RUN_VALUE="${!key:-$empty}"
+    AW_RUN_SOURCE="environment"
+  fi
+  return 0
+}
+aw_read_posture CODEX_MODEL "$DEFAULT_CODEX_MODEL" "$DEFAULT_CODEX_MODEL"
+HOST_CODEX_MODEL="$AW_HOST_VALUE"; CODEX_MODEL="$AW_RUN_VALUE"; CODEX_MODEL_SOURCE="$AW_RUN_SOURCE"
+aw_read_posture CODEX_EFFORT "$DEFAULT_CODEX_EFFORT" "$DEFAULT_CODEX_EFFORT"
+HOST_CODEX_EFFORT="$AW_HOST_VALUE"; CODEX_EFFORT="$AW_RUN_VALUE"; CODEX_EFFORT_SOURCE="$AW_RUN_SOURCE"
 aw_apply_settings
 
 # --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
@@ -279,15 +315,11 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_CODEX_MODEL="gpt-6-astra"
-DEFAULT_CODEX_EFFORT="high"
 # Review-receipt identity (AD-038). AW_BRIDGE_VERSION mirrors this bridge's SKILL.md/capability.json
 # version (drift-guarded by codex-review.test.mjs against capability.json).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.8.1"  # aw-version-anchor
-CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
-CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
-# Generous hard cap for a slow review at the pinned effort (subscription latency varies).
+AW_BRIDGE_VERSION="4.0.0"  # aw-version-anchor
+# Generous hard cap for a slow review at the host posture's effort (subscription latency varies).
 CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-1800}"
 # Above this assembled-payload size (bytes), the diff goes via a git-dir-local temp
 # file instead of inline — never truncated.
@@ -301,8 +333,8 @@ AW_REVIEW_MAP_BUDGET_BYTES=1500000
 # Codex service tier (quality-neutral speed knob): default EMPTY ⇒ no
 # service_tier flag (standard tier) — enabling Fast is a consented per-host SPEND act, never a
 # silent default. The only server-catalog tier id on this subscription is 'priority' (catalog
-# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6-astra, cache
-# fetched 2026-09-05; it states no credit-rate figure; quality-neutral — same model). codex itself
+# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6.1-sol, cache
+# fetched 2026-10-03; it states no credit-rate figure; quality-neutral — same model). codex itself
 # accepts ANY -c service_tier string silently (probe-verified), so
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
@@ -353,29 +385,15 @@ if [[ -z "$timeout_bin" ]]; then
   exit 127
 fi
 aw_timeout_banner="$(aw_timeout_label "$timeout_bin" "$CODEX_HARD_TIMEOUT")"
-echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} timeout=$aw_timeout_banner" >&2
+echo "review posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} source=model:$CODEX_MODEL_SOURCE,effort:$CODEX_EFFORT_SOURCE timeout=$aw_timeout_banner" >&2
 
-# --- Quality-first guard: refuse any non-pinned model/effort ---------------
-# A relaxed run is RECORDED, not just warned about: the receipt carries probe:true so the kit's
+# A probe run is RECORDED, not just warned about: the receipt carries probe:true so the kit's
 # review-state gate rejects it — "do NOT use this as a real review" becomes a mechanism, not a plea.
 REVIEW_PROBE=false
 if [[ "${CODEX_PROBE:-}" == "1" ]]; then
   REVIEW_PROBE=true
   echo "warning: CODEX_PROBE=1 — THROWAWAY PROBE MODE. Quality guards relaxed; do NOT use this run's" >&2
   echo "         output as a real review (model='$CODEX_MODEL' effort='$CODEX_EFFORT')." >&2
-else
-  if [[ "$CODEX_MODEL" != "$DEFAULT_CODEX_MODEL" ]]; then
-    echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned model '$DEFAULT_CODEX_MODEL'." >&2
-    echo "       A delegated review must run on the pinned model at the pinned effort (quality-first)." >&2
-    echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
-    exit 2
-  fi
-  if [[ "$CODEX_EFFORT" != "$DEFAULT_CODEX_EFFORT" ]]; then
-    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned effort '$DEFAULT_CODEX_EFFORT'." >&2
-    echo "       A delegated review must run at the pinned reasoning effort (quality-first)." >&2
-    echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
-    exit 2
-  fi
 fi
 
 # --- Subscription-only guard (see codex-exec.sh) -----------------------------
@@ -412,6 +430,86 @@ if [[ ! -f AGENTS.md ]]; then
   exit 2
 fi
 
+# --- The effective model checked against the installed CLI's catalog, then the one-off rule ---
+# Both refuse BEFORE any spend; the read runs with the review's CODEX_HOME and the built-in provider.
+catalog_env=(env CODEX_HOME="$real_codex_home")
+CODEX_CATALOG_TIMEOUT_S=15
+aw_codex_remedy() {
+  echo "       remedy: set these lines in $(aw_settings_file):" >&2
+  echo "         CODEX_MODEL=$1" >&2
+  echo "         CODEX_EFFORT=$2" >&2
+  echo "       and unset CODEX_MODEL and CODEX_EFFORT in the environment." >&2
+}
+aw_codex_catalog_check() {
+  local raw="" rc=0 verdict="" kind="" offered="" model="" effort="" catalog_js=""
+  if [[ -n "$timeout_bin" ]]; then
+    raw="$("${catalog_env[@]}" "$timeout_bin" --kill-after=5s "$CODEX_CATALOG_TIMEOUT_S" codex debug models -c model_provider=openai </dev/null 2>/dev/null)" || rc=$?
+  else
+    raw="$("${catalog_env[@]}" codex debug models -c model_provider=openai </dev/null 2>/dev/null)" || rc=$?
+  fi
+  if (( rc == 124 || rc == 137 )); then
+    verdict="unreadable"$'\t'"it exceeded ${CODEX_CATALOG_TIMEOUT_S}s"
+  elif (( rc != 0 )); then
+    verdict="unreadable"$'\t'"codex debug models exited $rc"
+  elif ! command -v node >/dev/null 2>&1; then
+    verdict="unreadable"$'\t'"no node to parse it"
+  else
+    IFS= read -r -d '' catalog_js <<'CATALOG_JS' || true
+const [model, effort, defaultModel, defaultEffort] = process.argv.slice(1);
+const answer = (...fields) => { process.stdout.write(fields.join("\t")); process.exit(0); };
+const CONTROL = /[\u0000-\u001f\u007f]/;
+let doc;
+try { doc = JSON.parse(require("node:fs").readFileSync(0, "utf8")); } catch { answer("unreadable", "its output is not JSON"); }
+if (doc === null || typeof doc !== "object" || !Array.isArray(doc.models)) answer("unreadable", "it carries no models[]");
+const offered = doc.models.filter((m) => m !== null && typeof m === "object" && m.visibility === "list");
+if (offered.some((m) => typeof m.slug !== "string" || m.slug === "" || CONTROL.test(m.slug))) answer("unreadable", "an offered entry carries no usable slug");
+if (offered.length === 0) answer("unreadable", "it offers no model");
+const effortsOf = (m) => (Array.isArray(m.supported_reasoning_levels)
+  && m.supported_reasoning_levels.every((l) => l !== null && typeof l === "object" && typeof l.effort === "string" && !CONTROL.test(l.effort))
+  ? m.supported_reasoning_levels.map((l) => l.effort) : null);
+const rank = (m) => (typeof m.priority === "number" ? m.priority : Number.MAX_SAFE_INTEGER);
+const refuse = (kind, list) => {
+  const builtIn = offered.find((m) => m.slug === defaultModel);
+  if (builtIn && (effortsOf(builtIn) ?? []).includes(defaultEffort)) answer(kind, list, defaultModel, defaultEffort);
+  const first = [...offered].sort((a, b) => rank(a) - rank(b))[0];
+  const level = first.default_reasoning_level;
+  if (typeof level !== "string" || level === "" || CONTROL.test(level)) answer("unreadable", "the entry for " + first.slug + " carries no default_reasoning_level");
+  answer(kind, list, first.slug, level);
+};
+const entry = offered.find((m) => m.slug === model);
+if (entry === undefined) refuse("model", offered.map((m) => m.slug).join(", "));
+const efforts = effortsOf(entry);
+if (efforts === null) answer("unreadable", "the entry for " + model + " carries no supported_reasoning_levels");
+if (!efforts.includes(effort)) refuse("effort", efforts.join(", "));
+answer("ok");
+CATALOG_JS
+    verdict="$(printf '%s' "$raw" | NODE_OPTIONS= node -e "$catalog_js" -- "$CODEX_MODEL" "$CODEX_EFFORT" "$DEFAULT_CODEX_MODEL" "$DEFAULT_CODEX_EFFORT" 2>/dev/null)" || verdict="unreadable"$'\t'"its parser failed"
+  fi
+  IFS=$'\t' read -r kind offered model effort <<<"$verdict" || true
+  case "$kind" in
+    ok) return 0 ;;
+    model)
+      echo "error: CODEX_MODEL='$CODEX_MODEL' ($CODEX_MODEL_SOURCE) is not a model the installed codex offers — refusing before any run is spent." >&2
+      echo "       offered: $offered" >&2 ;;
+    effort)
+      echo "error: CODEX_EFFORT='$CODEX_EFFORT' ($CODEX_EFFORT_SOURCE) is not an effort the installed codex offers for $CODEX_MODEL — refusing before any run is spent." >&2
+      echo "       offered: $offered" >&2 ;;
+    *)
+      echo "warning: the codex model catalog is unreadable (${offered:-no answer}) — the run proceeds unchecked; codex itself refuses a model it does not serve." >&2
+      return 0 ;;
+  esac
+  aw_codex_remedy "$model" "$effort"
+  exit 2
+}
+aw_codex_catalog_check
+if [[ "$CODEX_MODEL" != "$HOST_CODEX_MODEL" || "$CODEX_EFFORT" != "$HOST_CODEX_EFFORT" ]]; then
+  if [[ "${CODEX_PROBE:-}" != "1" ]]; then
+    echo "error: model=$CODEX_MODEL effort=$CODEX_EFFORT is a one-off — the host posture is model=$HOST_CODEX_MODEL effort=$HOST_CODEX_EFFORT, and only a probe (CODEX_PROBE=1) runs a one-off; refusing before any run is spent." >&2
+    aw_codex_remedy "$CODEX_MODEL" "$CODEX_EFFORT"
+    exit 2
+  fi
+fi
+
 # Register the cleanup trap up front (before allocating any temp path), so a
 # failure mid-assembly cannot leak the diff temp file, the schema, or the fence.
 fence_home=""

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -19,6 +19,10 @@ const FAKE_CODEX = [
   '#!/usr/bin/env bash',
   'set -u',
   'if [[ "${1:-}" == "login" ]]; then echo "${CODEX_FAKE_LOGIN:-Logged in using ChatGPT}"; exit 0; fi',
+  'if [[ "${1:-}" == "debug" ]]; then [[ -z "${CODEX_FAKE_NO_CATALOG:-}" ]] || exit 1; cat <<EOF',
+  '{"models":[{"slug":"gpt-6.1-sol","priority":1,"visibility":"list","default_reasoning_level":"low","supported_reasoning_levels":[{"effort":"low"},{"effort":"medium"},{"effort":"high"}]},{"slug":"gpt-6-astra","priority":2,"visibility":"list","default_reasoning_level":"medium","supported_reasoning_levels":[{"effort":"medium"},{"effort":"high"}]}]}',
+  'EOF',
+  'exit 0; fi',
   ': "${CODEX_FAKE_ARGV:=/dev/null}"',
   ': "${CODEX_FAKE_ENV:=/dev/null}"',
   ': "${CODEX_FAKE_STDIN:=/dev/null}"',
@@ -160,25 +164,8 @@ const run = ({ repo, bin }, { args = ['code'], env = {}, path, cwd } = {}) => ne
 // run() IS that twin now, so the twin is one name pointing at it — two spawn paths could only drift.
 const runAsync = run;
 
-describe('codex-review.sh — quality-first model/effort guard (1.1)', { concurrency: 2 }, () => {
-  it('refuses a non-default CODEX_MODEL', async () => {
-    const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_MODEL: 'gpt-5.4-mini' } });
-    rmSync(sb.root, { recursive: true, force: true });
-    assert.notEqual(r.status, 0);
-    assert.match(r.stderr, /not the pinned model/);
-    assert.equal(r.capStdin, '', 'codex must not be invoked when the guard fires');
-  });
-
-  it('refuses a non-default CODEX_EFFORT', async () => {
-    const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_EFFORT: 'xhigh' } });
-    rmSync(sb.root, { recursive: true, force: true });
-    assert.notEqual(r.status, 0);
-    assert.match(r.stderr, /not the pinned effort/);
-  });
-
-  it('CODEX_PROBE=1 relaxes the guard and warns', async () => {
+describe('codex-review.sh — the probe one-off (1.1)', { concurrency: 2 }, () => {
+  it('CODEX_PROBE=1 runs a one-off effort and warns', async () => {
     const sb = makeSandbox();
     const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_EFFORT: 'low' } });
     rmSync(sb.root, { recursive: true, force: true });
@@ -890,27 +877,28 @@ describe('codex-review.sh — mode catalog ⟷ wrapper reality (manifest-pinned)
     }
   });
 
-  it('CODEX_PROBE really relaxes the guard on EVERY review parent the catalog claims (behavioural)', async () => {
+  it('a one-off is refused on EVERY review parent and CODEX_PROBE=1 runs it (behavioural)', async () => {
     // The catalog CLAIMS these modes are modified by the hook; prove it per parent rather than
-    // trusting a source scan: an off-pin model is exit 2 normally, exit 0 under probe.
+    // trusting a source scan: a one-off model is exit 2 normally, exit 0 under probe.
     const hook = catalog.find((e) => e.key === 'CODEX_PROBE');
     const drive = { 'review.plan': ['plan', 'plan.md'], 'review.code': ['code'] };
     const reviewParents = hook.parents.filter((p) => reviewPrimaries.some((r) => r.key === p));
-    assert.ok(reviewParents.length > 0, 'CODEX_PROBE must claim at least one review parent');
+    assert.deepEqual(reviewParents, ['review.plan', 'review.code'], 'CODEX_PROBE claims every review parent');
     for (const parent of reviewParents) {
       assert.ok(drive[parent], `no behavioural drive for claimed parent "${parent}" — add one`);
       // The exit code alone is weak evidence: pin the real DISPATCH too (capStdin is non-empty only
       // when codex was actually invoked), so a run that dies early can never pass the probe-on branch.
       const guarded = makeSandbox();
-      const off = await run(guarded, { args: drive[parent], env: { CODEX_MODEL: 'not-the-pinned-model' } });
+      const off = await run(guarded, { args: drive[parent], env: { CODEX_MODEL: 'gpt-6-astra' } });
       rmSync(guarded.root, { recursive: true, force: true });
-      assert.equal(off.status, 2, `${parent}: the quality guard must refuse an off-pin model without the hook`);
-      assert.equal(off.capStdin, '', `${parent}: the guard must refuse BEFORE spending a run`);
+      assert.equal(off.status, 2, `${parent}: a one-off must be refused without the hook`);
+      assert.match(off.stderr, /one-off/, `${parent}: the refusal names the one-off`);
+      assert.equal(off.capStdin, '', `${parent}: the one-off must refuse BEFORE spending a run`);
 
       const probed = makeSandbox();
-      const on = await run(probed, { args: drive[parent], env: { CODEX_MODEL: 'not-the-pinned-model', CODEX_PROBE: '1' } });
+      const on = await run(probed, { args: drive[parent], env: { CODEX_MODEL: 'gpt-6-astra', CODEX_PROBE: '1' } });
       rmSync(probed.root, { recursive: true, force: true });
-      assert.equal(on.status, 0, `${parent}: CODEX_PROBE=1 must really relax the guard — the catalog claims it does`);
+      assert.equal(on.status, 0, `${parent}: CODEX_PROBE=1 must really run the one-off — the catalog claims it does`);
       assert.notEqual(on.capStdin, '', `${parent}: CODEX_PROBE=1 must really reach codex, not merely exit 0`);
     }
   });
@@ -958,8 +946,8 @@ describe('codex-review.sh — review receipts (AD-038)', { concurrency: 2 }, ()
     for (const field of ['durationS', 'blocking', 'artifactPath']) assert.ok(REVIEW_CONTRACT.receipt.includes(`${field} = `), `the manifest receipt contract declares ${field}`);
   });
 
-  // The probe marker (BRIDGE-MODES-CATALOG, D3): a CODEX_PROBE=1 review runs with the
-  // pinned-model/max-effort guard OFF, so its receipt must be distinguishable — the kit's
+  // The probe marker (BRIDGE-MODES-CATALOG, D3): a CODEX_PROBE=1 review is the one route to a
+  // one-off model or effort, so its receipt must be distinguishable — the kit's
   // review-state gate rejects a probe-marked receipt. EVERY receipt carries the marker (true or
   // false): it self-declares, so the gate reads the fact rather than inferring it from a version
   // string that bumps in a different release phase. Silence is not a declaration.
@@ -983,13 +971,13 @@ describe('codex-review.sh — review receipts (AD-038)', { concurrency: 2 }, ()
     assert.equal(receipts[0].probe, false, 'silence is not a declaration — the gate rejects an unmarked receipt');
   });
 
-  it('the marker tracks the RELAXED GUARD, not the model — a probe on an off-pinned model still marks', async () => {
+  it('the marker tracks the probe flag, not the model — a probe one-off still marks', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: 'gpt-5-mini', CODEX_EFFORT: 'low', CODEX_FAKE_FINAL: 'Verdict: ship' } });
+    const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: 'gpt-6-astra', CODEX_EFFORT: 'medium', CODEX_FAKE_FINAL: 'Verdict: ship' } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.equal(receipts[0].probe, true, 'exactly the runs the guard let through unpinned are marked');
+    assert.equal(receipts[0].probe, true, 'exactly the probe runs are marked');
   });
 
   it('the code-mode fingerprint tracks the uncommitted state (same tree → same hash; edit → different)', async () => {
@@ -1561,7 +1549,7 @@ describe('codex-review.sh — settings surface ⟷ manifest (D6, manifest-pinned
     const help = runHelp('--help').stdout;
     const section = helpSection(help, SETTINGS_HEADER);
     const got = section.filter((l) => /^[A-Z][A-Z0-9_]+ —/.test(l)).map((l) => l.split(' ')[0]);
-    const want = (MANIFEST.settings ?? []).filter((s) => s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
+    const want = (MANIFEST.settings ?? []).filter((s) => s.kind !== 'posture' && s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
     assert.ok(want.length > 0, 'the manifest must declare settings for this wrapper');
     setEq(got, want, 'help Settings keys ⟷ manifest settings.appliesTo');
     assert.ok(section.some((l) => l.includes('agent-workflow/bridge-settings.conf')), 'the section names the settings file');
@@ -1579,7 +1567,7 @@ describe('codex-review.sh — settings surface ⟷ manifest (D6, manifest-pinned
   it('AW_SETTINGS_APPLIED equals the manifest appliesTo subset for this wrapper', async () => {
     const m = source.match(/^AW_SETTINGS_APPLIED="([^"]*)"$/m);
     assert.ok(m, 'AW_SETTINGS_APPLIED not found');
-    const want = ALL_SETTINGS.filter((s) => s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
+    const want = ALL_SETTINGS.filter((s) => s.kind !== 'posture' && s.appliesTo.includes(SETTINGS_CMD)).map((s) => s.key);
     assert.ok(want.length > 0);
     setEq(m[1].trim().split(/\s+/), want, 'applied subset ⟷ manifest appliesTo');
   });
@@ -1588,8 +1576,8 @@ describe('codex-review.sh — settings surface ⟷ manifest (D6, manifest-pinned
     const body = source.match(/aw_settings_valid\(\) \{[\s\S]*?\n\}/);
     assert.ok(body, 'aw_settings_valid not found');
     const armKeys = [...body[0].matchAll(/^    ([A-Z][A-Z0-9_]*)\)/gm)].map((x) => x[1]);
-    setEq(armKeys, ALL_SETTINGS.map((s) => s.key), 'validation arms ⟷ manifest keys');
-    for (const s of ALL_SETTINGS) {
+    setEq(armKeys, ALL_SETTINGS.filter((s) => s.kind !== 'posture').map((s) => s.key), 'validation arms ⟷ manifest keys (a posture key is read by aw_read_posture, never validated here)');
+    for (const s of ALL_SETTINGS.filter((x) => x.kind !== 'posture')) {
       const arm = body[0].match(new RegExp(`^    ${s.key}\\) (.*) ;;$`, 'm'));
       assert.ok(arm, `no validation arm for ${s.key}`);
       if (s.kind === 'enum') for (const v of s.values) assert.ok(arm[1].includes(`"${v}"`), `${s.key}: enum value '${v}' not pinned`);
@@ -1646,8 +1634,8 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /review posture: model=gpt-6-astra effort=high tier=standard/, 'the banner states the actual run posture');
-    assert.deepEqual(receipts[0].posture, { model: 'gpt-6-astra', effort: 'high', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
+    assert.match(r.stderr, /review posture: model=gpt-6\.1-sol effort=high tier=standard source=model:default,effort:default/, 'the banner states the actual run posture');
+    assert.deepEqual(receipts[0].posture, { model: 'gpt-6.1-sol', effort: 'high', tier: null }, 'banner ↔ receipt parity (standard tier = null)');
     assert.deepEqual(Object.keys(receipts[0]), Object.keys(RECEIPT_FIXTURE), 'fixture key set + order');
   });
 
@@ -1657,24 +1645,24 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /review posture: model=gpt-6-astra effort=high tier=priority/);
+    assert.match(r.stderr, /review posture: model=gpt-6\.1-sol effort=high tier=priority/);
     assert.equal(receipts[0].posture.tier, 'priority');
   });
 
   it('a HOSTILE model string (quotes + backslash) rides the receipt strictly JSON-encoded (probe lane)', async () => {
     const hostile = 'we"ird \\ mo"del';
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: hostile } });
+    const r = await run(sb, { env: { CODEX_PROBE: '1', CODEX_MODEL: hostile, CODEX_FAKE_NO_CATALOG: '1' } });
     const receipts = readReceipts(sb.repo); // JSON.parse throwing here IS the encoding failure
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
     assert.equal(receipts[0].posture.model, hostile, 'the exact bytes round-trip through strict encoding');
-    assert.equal(receipts[0].probe, true, 'an off-pinned model runs only on the probe lane');
+    assert.equal(receipts[0].probe, true, 'a one-off model runs only on the probe lane');
   });
 
-  it('a posture value carrying CONTROL BYTES refuses pre-spend, BEFORE the pinned-model guard', async () => {
+  it('a posture value carrying CONTROL BYTES refuses pre-spend, BEFORE the catalog check', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(1)}` } });
+    const r = await run(sb, { env: { CODEX_MODEL: `gpt-6.1-sol${String.fromCharCode(1)}` } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0);
@@ -1689,7 +1677,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stderr, /^review posture: model=gpt-6-astra effort=high tier=standard timeout=1800s$/m);
+    assert.match(r.stderr, /^review posture: model=gpt-6\.1-sol effort=high tier=standard source=model:default,effort:default timeout=1800s$/m);
     assert.deepEqual(Object.keys(receipts[0].posture), ['model', 'effort', 'tier'], 'timeout never enters the receipt posture');
   });
 
@@ -1715,7 +1703,7 @@ describe('codex-review.sh — dispatch-posture labeling (D5)', { concurrency: 2
 
   it('a DEL (0x7f) byte in a banner field refuses pre-spend like the C0 range', async () => {
     const sb = makeSandbox();
-    const r = await run(sb, { env: { CODEX_MODEL: `gpt-6-astra${String.fromCharCode(127)}` } });
+    const r = await run(sb, { env: { CODEX_MODEL: `gpt-6.1-sol${String.fromCharCode(127)}` } });
     const receipts = readReceipts(sb.repo);
     rmSync(sb.root, { recursive: true, force: true });
     assert.notEqual(r.status, 0);

package/bridges/codex-cli-bridge/capability.json

@@ -3,8 +3,8 @@
   "schema": 1,
   "name": "codex-cli-bridge",
   "kind": "execution-backend",
-  "version": "3.8.1",
-  "posture": { "model": "gpt-6-astra", "effort": "high", "tier": null },
+  "version": "4.0.0",
+  "posture": { "model": "gpt-6.1-sol", "effort": "high", "tier": null },
   "provides": ["execute", "review"],
   "roles": {
     "execute": {
@@ -21,7 +21,7 @@
           "codex-exec --resume-last [--nonce <n>] <plan-file|->",
           "codex-exec --resume <session-id> [--nonce <n>] <plan-file|->"
         ],
-        "receipt": "side effect — a NONCED run mints ONE exec receipt beside the delegation store: the dispatch nonce seam is the AW_DISPATCH_NONCE environment value or its plain-argument equivalent --nonce <n>, recognised ONLY before the prompt operand (after the operand or a literal '--' it is passthrough payload, never a flag), under the safe grammar [A-Za-z0-9._-]{1,64} — anything else, a duplicate, or a flag disagreeing with a non-empty env value refuses PRE-SPEND. The store directory resolves exactly as the kit's delegation store does: the dirname of an ABSOLUTE AW_DELEGATION_STORE (a relative one, or one ending in a path separator, refuses), else the git common dir. The artifact is agent-workflow-exec-receipt-<backendLength>-<backend>-<nonce>.json in two states: 'reserved' is written atomically and NO-CLOBBER immediately before the CLI runs — that write IS the nonce reservation, so a second dispatch on the same nonce, or an already-taken report name, refuses BEFORE any spend — and 'terminal' replaces it in place at exit. A nonced run also refuses pre-spend when no timeout/gtimeout binary can cap it (an accounted dispatch that cannot be capped can never honour the terminal-exit rule; a nonce-LESS run still warns and runs uncapped), when node is missing (the mint core), and when the prompt rides on stdin instead of a contract FILE — contractDigest is computed BY THIS WRAPPER from the dispatch file it was actually handed, so the kit can refuse a run that executed a different contract than the one it opened. That digest is taken from the SAME bytes already read as the prompt, never a second open of the path: two reads leave a window in which the file can be swapped, and the run would then execute one contract while its receipt claimed the digest of another. The header's own nonce must EQUAL the dispatch nonce — 'dispatch open' copies the nonce FROM the header, so a disagreeing --nonce could only reserve an identity no return would ever absorb, and it refuses pre-spend. A contract file edited BETWEEN 'dispatch open' and the run is caught at ABSORB by the contractDigest comparison, not pre-spend: the wrapper never reads the ledger, and that boundary is what the whole lane rests on. At exit the wrapper FIRST re-reads its reservation and verifies its own opaque owner token — a foreign owner refuses having published NOTHING, neither report nor receipt — THEN writes the delegate's final message atomically to agent-workflow-exec-report-<backendLength>-<backend>-<nonce>.txt, THEN re-verifies the owner and REPLACES the reservation with the terminal receipt {schema, kind, state, backend, nonce, owner, contractDigest, wrapperVersion, posture {model, effort, tier}, capS, killGraceS, sessionId, exitStatus, outcome, reportDigest, reportLength, timestamp}: the report is complete on disk before any artifact says the run arrived. capS and killGraceS are the cap the run ACTUALLY applied. outcome is the wrapper's own SUBSET of the ledger's vocabulary — exit 0 with a session id -> success, exit 0 without one -> missing-identity, ANY nonzero exit including the timeout codes 124 and 137 -> transport-failure; every orchestrator judgment is recorded at absorb time, never claimed here. The session id is captured BEFORE outcome branching, so a FAILED run records one too; in resume mode it is the validated resume id. FAIL-CLOSED, deliberately NOT the review lane's warn-only receipt: a publication that cannot complete exits nonzero with a DISTINCT status, and the message states only what the run can still prove. 70: the reservation could not be verified BEFORE any publication — NOTHING was published, not the report and not the receipt, and because the artifact found there belongs to another run it is never a '--no-receipt' source. 71: a publication stopped after that point — either the report write failed (nothing beyond the reservation was published; the '--no-receipt' absorb then records reportLength 0, ineligible by the name empty-report) or the report IS on disk and the terminal receipt was not completed (the absorb reads it, report-if-present). The post-report lane never claims the reservation still stands, because after that point its fate is no longer something this run observed. Every lane names the tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no reservation, no receipt, no artifact, no node.",
+        "receipt": "side effect — a NONCED run mints ONE exec receipt beside the delegation store: the dispatch nonce seam is the AW_DISPATCH_NONCE environment value or its plain-argument equivalent --nonce <n>, recognised ONLY before the prompt operand (after the operand or a literal '--' it is passthrough payload, never a flag), under the safe grammar [A-Za-z0-9._-]{1,64} — anything else, a duplicate, or a flag disagreeing with a non-empty env value refuses PRE-SPEND. The store directory resolves exactly as the kit's delegation store does: the dirname of an ABSOLUTE AW_DELEGATION_STORE (a relative one, or one ending in a path separator, refuses), else the git common dir. The artifact is agent-workflow-exec-receipt-<backendLength>-<backend>-<nonce>.json in two states: 'reserved' is written atomically and NO-CLOBBER immediately before the CLI runs — that write IS the nonce reservation, so a second dispatch on the same nonce, or an already-taken report name, refuses BEFORE any spend — and 'terminal' replaces it in place at exit. A nonced run also refuses pre-spend when no timeout/gtimeout binary can cap it (an accounted dispatch that cannot be capped can never honour the terminal-exit rule; a nonce-LESS run still warns and runs uncapped), when node is missing (the mint core), and when the prompt rides on stdin instead of a contract FILE — contractDigest is computed BY THIS WRAPPER from the dispatch file it was actually handed, so the kit can refuse a run that executed a different contract than the one it opened. That digest is taken from the SAME bytes already read as the prompt, never a second open of the path: two reads leave a window in which the file can be swapped, and the run would then execute one contract while its receipt claimed the digest of another. The header's own nonce must EQUAL the dispatch nonce — 'dispatch open' copies the nonce FROM the header, so a disagreeing --nonce could only reserve an identity no return would ever absorb, and it refuses pre-spend. A contract file edited BETWEEN 'dispatch open' and the run is caught at ABSORB by the contractDigest comparison, not pre-spend: the wrapper never reads the ledger, and that boundary is what the whole lane rests on. At exit the wrapper FIRST re-reads its reservation and verifies its own opaque owner token — a foreign owner refuses having published NOTHING, neither report nor receipt — THEN writes the delegate's final message atomically to agent-workflow-exec-report-<backendLength>-<backend>-<nonce>.txt, THEN re-verifies the owner and REPLACES the reservation with the terminal receipt {schema, kind, state, backend, nonce, owner, contractDigest, wrapperVersion, posture {model, effort, tier}, capS, killGraceS, sessionId, exitStatus, outcome, reportDigest, reportLength, timestamp}: the report is complete on disk before any artifact says the run arrived. capS and killGraceS are the cap the run ACTUALLY applied. outcome is the wrapper's own SUBSET of the ledger's vocabulary — exit 0 with a session id -> success, exit 0 without one -> missing-identity, ANY nonzero exit including the timeout codes 124 and 137 -> transport-failure; every orchestrator judgment is recorded at absorb time, never claimed here. The session id is captured BEFORE outcome branching, so a FAILED run records one too; in resume mode it is the validated resume id. FAIL-CLOSED, deliberately NOT the review lane's warn-only receipt: a publication that cannot complete exits nonzero with a DISTINCT status, and the message states only what the run can still prove. 70: the reservation could not be verified BEFORE any publication — NOTHING was published, not the report and not the receipt, and because the artifact found there belongs to another run it is never a '--no-receipt' source. 71: a publication stopped after that point — either the report write failed (nothing beyond the reservation was published; the '--no-receipt' absorb then records reportLength 0, ineligible by the name empty-report) or the report IS on disk and the terminal receipt was not completed (the absorb reads it, report-if-present). The post-report lane never claims the reservation still stands, because after that point its fate is no longer something this run observed. Every lane names the tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no reservation, no receipt, no artifact, and it needs no node.",
         "passthrough": {
           "policy": "guarded",
           "blocked": ["-c*", "--config*", "-s*", "--sandbox*", "--dangerously-bypass-approvals-and-sandbox", "--dangerously-bypass-hook-trust", "--full-auto", "--oss", "--local-provider*", "-p*", "--profile*", "-m*", "--model*", "-o*", "--output-last-message*", "--json*", "--color*", "--output-schema*", "--ephemeral*"],
@@ -29,9 +29,9 @@
         },
         "notes": [
           "nested-sandbox limit: codex-exec ships its OWN OS sandbox (bwrap workspace-write) and cannot run nested inside a harness sandbox (the FS turns read-only) — route it OUTSIDE the harness sandbox (excludedCommands / a per-run consented bypass) on the OBSERVED bwrap/EPERM failure, never a preemptive blanket",
-          "exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend",
+          "exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture — exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> source=… timeout=… — from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in any banner field refuse pre-spend",
           "threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent environment. A hostile parent environment — including exported shell functions or PATH substitution of core/backend commands — is outside the threat model and can substitute the backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental shadowing; it is not an environment security boundary",
-          "the exec posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: it is never persisted in a receipt or session sidecar",
+          "the exec posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration|uncapped> field — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run; INFORMATIONAL only: neither is persisted in a receipt or session sidecar",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts",
           "every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on EVERY completed run, not only a failed one, because a run that SURVIVES the nested-sandbox failure exits 0 with an ungrounded answer and nothing said so. Failed run (rc != 0): the existing loose whole-trace combination rule prints the recovery hint. Successful run (rc == 0): a warning fires ONLY on precise per-item evidence — both a sandbox-mechanism token AND a permission/read-only failure token inside the aggregated_output of ONE command_execution item whose failure is PROVEN (a nonzero exit_code, or the serialized status \"failed\"); a null exit_code is never failure by itself, tokens split across two items never fire, and a successful command's output never fires. The answer is printed FIRST on stdout, then the warning on stderr. HONEST RESIDUAL: the exit status does NOT change on that lane (a distinct nonzero exit would give a heuristic scan DENY polarity, refusing real work whenever the scan over-warns), so an orchestrator keying on exit status alone can still bank an ungrounded answer — the stderr warning is the signal"
         ]
@@ -51,7 +51,7 @@
         "continue": [],
         "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan mode; durationS = integer wall-clock seconds from CLI start through verdict parsing and the wrapper prints review duration: <n>s; blocking = the count of [blocker] and [major] lines (schema mode: findings with either severity; a payload whose findings cannot be counted fails the run, no receipt); artifactPath = the normalized realpath on plan receipts only (repo-relative inside the work tree, absolute otherwise), while a double quote, backslash or control byte refuses pre-spend because the receipt encoder cannot carry it; verdict parsed from the mandated literal verdict line (schema mode: the verdict field); always fresh:true (one-shot) + grounded:true (native AGENTS.md auto-merge, factsHash null); probe = whether the run relaxed the quality guards (CODEX_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model, effort, tier} (tier null on the standard tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, and a posture value carrying control bytes refuses pre-spend in every mode; a run whose final message carries NO recognized 'Verdict: <ship|revise|rethink>' line — empty or missing output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         "notes": [
-          "the review posture banner appends a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity",
+          "the review posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value came from: default, setting or environment — then a banner-only timeout=<duration> field — exactly the duration handed to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and neither field enters the receipt posture or the D5 banner↔receipt parity",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
         ]
       }
@@ -141,7 +141,7 @@
       ],
       "guardrails": [
         { "value": "read-only sandbox — codex cannot edit, create or delete a file", "enforcement": "enforced", "source": "bin/codex-review.sh" },
-        { "value": "runs on the pinned model at the pinned effort", "enforcement": "enforced", "condition": "unless CODEX_PROBE=1 relaxes the guard for a throwaway probe", "source": "bin/codex-review.sh" },
+        { "value": "runs on the host posture's model and effort", "enforcement": "enforced", "condition": "a one-off is refused pre-spend unless CODEX_PROBE=1 marks a throwaway probe", "source": "bin/codex-review.sh" },
         { "value": "a successful review appends one receipt line the review-state gate reads", "enforcement": "enforced", "condition": "a receipt write failure warns and the review still succeeds — the tree then reads un-receipted", "source": "capability.json roles.review.contract.receipt" }
       ],
       "customHooks": ["CODEX_PROBE"]
@@ -187,13 +187,27 @@
     }
   ],
   "settings": [
+    {
+      "key": "CODEX_MODEL",
+      "kind": "posture",
+      "default": "gpt-6.1-sol",
+      "appliesTo": ["codex-exec", "codex-review"],
+      "effect": "the codex model every run uses (the host posture); a set value is checked against the installed codex's catalog first. /agent-workflow-kit bridge-settings shows the models offered."
+    },
+    {
+      "key": "CODEX_EFFORT",
+      "kind": "posture",
+      "default": "high",
+      "appliesTo": ["codex-exec", "codex-review"],
+      "effect": "the codex reasoning effort every run uses (the host posture); a set value is checked against the efforts the model offers first. /agent-workflow-kit bridge-settings shows them."
+    },
     {
       "key": "CODEX_SERVICE_TIER",
       "kind": "enum",
       "values": ["priority"],
       "default": null,
       "appliesTo": ["codex-exec", "codex-review"],
-      "effect": "codex service tier; 'priority' (catalog display name Fast) = \"2x speed, increased usage\" in the codex catalog's own words for gpt-6-astra (cache fetched 2026-09-05); it states no credit-rate figure — quality-neutral (same model). Unset/empty ⇒ no service_tier flag (standard tier). SPEND KNOB: enabling it is a consented per-host act, never a default. codex itself accepts any -c service_tier string silently, so the wrapper validates the value."
+      "effect": "codex service tier; 'priority' (catalog display name Fast) = \"2x speed, increased usage\" in the codex catalog's own words for gpt-6.1-sol (cache fetched 2026-10-03); it states no credit-rate figure — quality-neutral (same model). Unset/empty ⇒ no service_tier flag (standard tier). SPEND KNOB: enabling it is a consented per-host act, never a default. codex itself accepts any -c service_tier string silently, so the wrapper validates the value."
     },
     {
       "key": "CODEX_HARD_TIMEOUT",