@sabaiway/agent-workflow-kit 14.20.0 → 14.22.0

package/bridges/codex-cli-bridge/SKILL.md

@@ -2,7 +2,7 @@
 name: codex-cli-bridge
 description: Delegate work to the OpenAI Codex CLI (`codex`) under a ChatGPT subscription — run plan/instruction EXECUTION in a sandboxed workspace, or get a read-only ADVISORY review of a plan or working-tree diff — as a second delegated-execution backend beside Antigravity. Use when the user wants to hand a bounded coding task or plan to `codex exec`, get a second-opinion review from codex, install or authenticate Codex CLI, understand its sandbox/network/approval policy, drive codex efficiently from the main agent (exec vs review, resume, the commit boundary), bridge project context (`AGENTS.md`) into codex, or troubleshoot codex flags, models, auth, or its no-TTY headless behaviour.
 metadata:
-  version: '3.8.1'
+  version: '4.0.0'
 ---
 
 # codex-cli-bridge
@@ -46,39 +46,40 @@ this skill. Both wrappers enforce the subscription path before invoking codex:
   regardless of that flag);
 - they **preflight `codex login status`** and refuse to run unless it reports `Logged in using ChatGPT`.
 
-## Models quality-first pinned
-
-Delegated codex work ALWAYS runs on the **PINNED model at the PINNED reasoning effort**: the wrappers
-**pin** `gpt-6-astra` / `high` and **refuse** (exit 2, loud) a non-default `CODEX_MODEL` / `CODEX_EFFORT`
-— knowingly-worse output is never traded for quota. The pin is deliberate: an explicit `-m gpt-6-astra`
-names one model rather than following the CLI's current default. That the pinned id is also the
-*strongest* selectable Codex model is a **separate, time-bounded claim**, checked BY HAND against
-<https://developers.openai.com/codex/models>. There is **no automated gate and this file records no
-date for that check**, so treat "strongest" as unverified until someone looks. Upstream can move
-either way between releases:
-- **retirement** is loud — the pinned id stops being served and codex fails with an error naming the
-  model. That is an upstream failure, not a wrapper refusal; the fix is a pin bump in its own reviewed
-  commit, never a `CODEX_PROBE=1` run, whose output is never delegated work.
-- **a newer, stronger model is SILENT** — nothing fails, and the pin simply stops being the best
-  available until someone re-checks the page.
-
-The guard is therefore a **pin-integrity** guard, not a quality guarantee: it enforces that runs use
-the id named here, and it refuses a *stronger* model exactly as it refuses a weaker one. The effort
-pin is the same kind of decision: `high` is a deliberate posture, not the catalog maximum (`xhigh`,
-`max` and `ultra` exist above it), and the guard refuses a higher effort exactly as it refuses a lower
-one. Read a refusal as "not the pinned id", never as "a downgrade was prevented".
+## Models: the host posture
+
+Delegated codex work runs on the **host posture**: `CODEX_MODEL` and `CODEX_EFFORT` from the bridge
+settings file `${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf`, else the built-in
+default `gpt-6.1-sol` / `high`. **`/agent-workflow-kit bridge-settings`** shows the models the
+installed `codex` offers and sets the host posture (checked against that list before it writes).
+Before any run is spent the wrappers check the effective model and
+effort against the installed CLI's catalog (`codex debug models`, the entries offered for listing): a
+model or effort it does not offer is refused (exit 2) with the offered list and the settings-file lines
+that set an offered posture. An unreadable catalog is one stderr warning and the run proceeds — codex
+itself then refuses a model it does not serve.
+
+The environment overrides the host posture for one run. A run on anything other than the host posture
+is a **one-off**, whatever set it, and only a probe runs one: without `CODEX_PROBE=1` the wrappers refuse
+it pre-spend (exit 2) and name the remedy — the settings-file lines that make it the host posture, plus
+unsetting `CODEX_MODEL` and `CODEX_EFFORT` in the environment. An environment value equal to the host
+posture is not a one-off; an explicitly empty `CODEX_MODEL=` or `CODEX_EFFORT=` selects the built-in
+default. A nonced `codex-exec` probe one-off is refused too (the exec receipt could not say it ran off
+the host posture), and a probe review's receipt is `probe:true` and never attests.
+
+A weaker model is therefore the user's choice in the setting, never the orchestrator's per call. `high`
+is the default effort, not the catalog maximum (`xhigh`, `max` and `ultra` exist above it). Whether the
+default is also the *strongest* selectable Codex model is a hand-checked claim against
+<https://developers.openai.com/codex/models>, with **no automated gate and no recorded date** — a newer
+model is silent until the user sets it or a bridge release moves the default. A retired model fails
+loudly: the catalog check refuses it pre-spend with the offered list and the remedy.
 
 Economy comes only from **quality-neutral waste removal** (clean capture, a hard timeout,
-a precomputed review diff, `resume` instead of re-sending context), never from a downgrade.
-
-The ONLY escape is a **throwaway probe** whose result is effort-independent (a reachability / smoke
-check): set `CODEX_PROBE=1` (echoed loudly) to relax the model/effort guard. Never use a probe run's
-output as real delegated work.
+a precomputed review diff, `resume` instead of re-sending context), never from a per-call downgrade.
 
 | Variable | Default | Effect |
 |---|---|---|
-| `CODEX_MODEL` | `gpt-6-astra` (pinned) | model passed to `-m`; a non-default is REFUSED unless `CODEX_PROBE=1` |
-| `CODEX_EFFORT` | `high` (pinned) | reasoning effort (`-c model_reasoning_effort=…`); non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_MODEL` | the setting, else `gpt-6.1-sol` | model passed to `-m`; an environment value off the host posture is a one-off, REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_EFFORT` | the setting, else `high` | reasoning effort (`-c model_reasoning_effort=…`); an environment value off the host posture is a one-off, REFUSED unless `CODEX_PROBE=1` |
 
 `codex --version` reports the CLI version, **not** the model list. Quota is metered in **messages**
 (a rolling 5h window + a weekly cap), not raw tokens — which is why the levers above are about removing
@@ -117,14 +118,15 @@ codex-review code "focus on the new reducer"     # review with extra focus
 **Honesty + posture (D4/D5):** a run whose final message has no recognized
 `Verdict: <ship|revise|rethink>` line — empty or missing output included — **exits 4 with NO
 receipt**: treat it as a *failed review to re-run*, never a fatal session error. One stderr banner
-states the actual posture (`review posture: model=… effort=… tier=… timeout=…`) and the receipt
-records the same `posture {model, effort, tier}` (tier `null` on the standard tier); control bytes
-in a posture value refuse pre-spend in every mode. `codex-exec` states its posture the same way —
+states the actual posture (`review posture: model=… effort=… tier=… source=… timeout=…`) and the
+receipt records the same `posture {model, effort, tier}` (tier `null` on the standard tier); control
+bytes in a posture value refuse pre-spend in every mode. `codex-exec` states its posture the same way —
 ONE `exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id>
-timeout=…` stderr line before dispatch (the resume id validated pre-spend). The `timeout=` field
-is **banner-only** (exactly the duration handed to `timeout(1)`; on exec `uncapped` without a
-capping binary, while `codex-review` **fails CLOSED pre-spend** there) — informational, never a
-receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
+source=… timeout=…` stderr line before dispatch (the resume id validated pre-spend). The `source=`
+field (`model:<s>,effort:<s>`, each `default`, `setting` or `environment`) and the `timeout=` field
+are **banner-only** (`timeout=` is exactly the duration handed to `timeout(1)`; on exec `uncapped`
+without a capping binary, while `codex-review` **fails CLOSED pre-spend** there) — informational,
+never a receipt field. **Quote the posture banner verbatim** when labeling a dispatch.
 
 Every successful review receipt carries integer `durationS` and `blocking`; the wrapper prints
 `review duration: <n>s`. A plan receipt also carries `artifactPath`, normalized to a repo-relative
@@ -146,29 +148,29 @@ failure carries both a sandbox-mechanism and a permission/read-only token in its
 The exit status stays 0 there (warning, not gate) — read the stderr line. A successful **non-resume**
 `codex-exec` also records the session id to a sidecar
 (`${CODEX_SESSION_FILE:-./.codex-last-session}`) so `--resume-last` can find it. Extra `codex` flags
-go after a literal `--`; the wrapper rejects any that would defeat the policy or the pinned model (see
+go after a literal `--`; the wrapper rejects any that would defeat the policy or the host posture (see
 [§ Environment knobs](#environment-knobs) and the flag tiers in
 [`references/sandbox-and-flags.md`](references/sandbox-and-flags.md)); args without the separator are
 rejected, never silently dropped.
 
 ## Environment knobs
 
-All optional; the defaults are the supported path. Anything that would lower quality (model/effort) or
-defeat a policy is guarded — see [§ Models](#models-quality-first-pinned).
+All optional; the defaults are the supported path. The model and effort are the host posture, and
+anything that would defeat a policy is guarded — see [§ Models](#models-the-host-posture).
 
 | Variable | Default | Effect |
 |---|---|---|
-| `CODEX_MODEL` | `gpt-6-astra` (pinned) | model; non-default REFUSED unless `CODEX_PROBE=1` |
-| `CODEX_EFFORT` | `high` (pinned) | reasoning effort; non-default REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_MODEL` | the setting, else `gpt-6.1-sol` | model; off the host posture REFUSED unless `CODEX_PROBE=1` |
+| `CODEX_EFFORT` | the setting, else `high` | reasoning effort; off the host posture REFUSED unless `CODEX_PROBE=1` |
 | `CODEX_HARD_TIMEOUT` | `3600` (exec) / `1800` (review) | hard wall-clock cap (seconds) via `timeout`/`gtimeout`; exit 124/137 ⇒ "exceeded hard cap". No `timeout` binary ⇒ a nonce-less exec warns loudly + runs uncapped, a **nonced** exec REFUSES pre-spend (an accounted dispatch that cannot be capped can never honour the terminal-exit rule), and `codex-review` REFUSES pre-spend (fail-closed preflight). |
-| `CODEX_SERVICE_TIER` | unset (standard tier) | **SPEND knob**: `priority` (catalog name "Fast") = "2x speed, **increased usage**" in the codex catalog's own words for gpt-6-astra (cache fetched 2026-09-05); it states no credit-rate figure — quality-neutral (same model). codex accepts any `-c service_tier` string silently (probe-verified), so the wrapper validates: an unsupported value warns and runs standard. Env or settings file. |
+| `CODEX_SERVICE_TIER` | unset (standard tier) | **SPEND knob**: `priority` (catalog name "Fast") = "2x speed, **increased usage**" in the codex catalog's own words for gpt-6.1-sol (cache fetched 2026-10-03); it states no credit-rate figure — quality-neutral (same model). codex accepts any `-c service_tier` string silently (probe-verified), so the wrapper validates: an unsupported value warns and runs standard. Env or settings file. |
 | `CODEX_SESSION_FILE` | `./.codex-last-session` | where `codex-exec` records the session id and where `--resume-last` reads it |
 | `CODEX_REVIEW_MAX_TOTAL_BYTES` | `1500000` | `codex-review code`: above this the assembled diff goes via a git-dir temp file instead of inline — never truncated |
 | `AW_REVIEW_NONCE` | unset | the flow dispatch nonce (safe grammar `[A-Za-z0-9._-]{1,64}` — anything else refuses pre-spend). `codex-review … --nonce <n>` is the plain-argument equivalent (one seam; flag and a non-empty env must agree, a disagreeing pair refuses pre-spend) — the lane for hosts whose dispatch policy has no env-prefix form. When supplied, a successful review first mints the finding MANIFEST `agent-workflow-finding-manifest-codex-<nonce>.json` beside the receipts file (atomic, no-clobber, ORDERED before the receipt append) — a failed mint EXCLUDES the receipt, so a nonce-supplied dispatch never lands a receipt without its readable manifest; nonce-less runs add no nonce field and mint nothing (the `wrapperVersion` field every receipt carries moves with each release) |
 | `AW_DISPATCH_NONCE` | unset | the **delegation** dispatch nonce (same safe grammar; anything else refuses pre-spend). `codex-exec [--nonce <n>] <plan-file>` is the plain-argument equivalent — ONE seam, recognised only BEFORE the prompt operand (after it, or after a literal `--`, it is passthrough payload). When supplied, the run is ACCOUNTED: see [§ Dispatch identity](#dispatch-identity-the-accounted-exec-lane). |
 | `AW_DELEGATION_STORE` | unset (the git common dir) | absolute path of the delegation ledger; its **dirname** is where a nonced run's receipt and report land. Relative, or ending in a path separator, refuses pre-spend — the same rule the kit's store applies. |
 | `CODEX_REVIEW_SCHEMA` | unset | `codex-review`: `=1` returns findings as a validated JSON object (`--output-schema`), with a raw-text fallback. Default off. |
-| `CODEX_PROBE` | unset | `=1` ⇒ throwaway-probe mode: relaxes the model/effort guard AND the tier-2 passthrough guard (echoed loudly). Never for real work. |
+| `CODEX_PROBE` | unset | `=1` ⇒ throwaway-probe mode: the one route to a one-off model or effort, and it relaxes the tier-2 passthrough guard (echoed loudly); a probe review's receipt never attests. Never for real work. |
 
 The git-write shim, `--ignore-user-config`, and the `*_API_KEY` scrub are NOT env-tunable — they are
 fixed invariants.
@@ -212,11 +214,11 @@ skipped entirely without a nonce: the wrapper is byte-unchanged, writes no artif
 `${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf` holds `KEY=VALUE` lines,
 **parsed, never sourced** — a file line can never execute code. Precedence: explicit env (even
 empty — `KEY=` disables a knob for one run) > file > built-in default. File-settable keys for this
-bridge: `CODEX_SERVICE_TIER` (the Fast tier — **increased usage**; enabling it is a consented
-per-host spend decision, never a default), `CODEX_HARD_TIMEOUT`, `CODEX_REVIEW_MAX_TOTAL_BYTES` —
-exactly the manifest `settings` block (the single source; the wrapper constants and `--help` are
-drift-guarded against it). Model/effort keys are **not** file-settable — the quality guard above
-is untouched. The file lives **outside every kit-managed tree**, so a kit refresh/upgrade can
+bridge: `CODEX_MODEL` and `CODEX_EFFORT` (the host posture — see [§ Models](#models-the-host-posture)),
+`CODEX_SERVICE_TIER` (the Fast tier — **increased usage**; enabling it is a consented per-host spend
+decision, never a default), `CODEX_HARD_TIMEOUT`, `CODEX_REVIEW_MAX_TOTAL_BYTES` — exactly the
+manifest `settings` block (the single source; the wrapper constants and `--help` are drift-guarded
+against it, the model keys read by the posture reader instead). The file lives **outside every kit-managed tree**, so a kit refresh/upgrade can
 never wipe it; edit it by hand or via `/agent-workflow-kit bridge-settings` (preview-first,
 consent-gated).
 
@@ -259,7 +261,7 @@ See [`references/driving-codex.md`](references/driving-codex.md) for the full pl
   embed the goal, the relevant paths, and the expected result; codex reads `AGENTS.md` for the rules.
 - **Iterate with `codex-exec --resume-last` / `--resume <id>`** instead of re-sending context. The
   resume entrypoint re-establishes EVERY wrapper invariant (subscription-only, `--ignore-user-config`,
-  the pinned model/effort) and **restates the full posture via `-c`** — `codex exec resume` resets the
+  the host posture's model/effort) and **restates the full posture via `-c`** — `codex exec resume` resets the
   sandbox/approval/network posture and rejects the `-s`/`--add-dir`/`-C` posture flags, so the wrapper
   sets `sandbox_mode=workspace-write` + `approval_policy=never` +
   `sandbox_workspace_write.network_access=false` explicitly. It reads the session id from the sidecar

package/bridges/codex-cli-bridge/bin/codex-exec.sh

@@ -13,17 +13,17 @@
 #   - network access OFF: new dependencies / network installs are done by a human
 #   - approval_policy=never: there is no TTY in exec; anything needing escalation
 #     is refused and reported, then handled by hand
-#   - the PINNED model at the PINNED reasoning effort (quality-first — see below)
+#   - the host posture's model and reasoning effort (see below)
 #   - git WRITES are blocked by a physical shim (codex spawns git via execve, which
 #     bypasses shell functions) — the orchestrator owns the commit boundary.
 #
-# Quality-first (hard rule): delegated codex work ALWAYS runs on the PINNED
-# model at the PINNED reasoning effort. The defaults below are pinned and the wrapper
-# REFUSES a non-default CODEX_MODEL/CODEX_EFFORT — knowingly-worse output is never
-# traded for quota. The ONLY exception is a throwaway probe whose result does not
-# depend on effort: set CODEX_PROBE=1 (echoed loudly) to relax the guard. Economy
-# comes from quality-neutral waste removal (clean capture, a hard timeout, a lean
-# prompt, resume instead of re-sending context), never from a downgrade.
+# Host posture (hard rule): delegated codex work runs on the host posture — CODEX_MODEL and
+# CODEX_EFFORT from the bridge settings file, else the built-in default gpt-6.1-sol at effort high
+# (`/agent-workflow-kit bridge-settings` shows the models offered and sets one) — checked against the
+# installed CLI's catalog before any spend. A run on anything else is a one-off, refused unless
+# it is a probe (CODEX_PROBE=1); a nonced dispatch never runs a one-off. Economy comes from
+# quality-neutral waste removal (clean capture, a hard timeout, a lean prompt, resume instead of
+# re-sending context), never from a per-call downgrade.
 #
 # Auth: SUBSCRIPTION ONLY. Uses the cached ChatGPT login under CODEX_HOME
 # (~/.codex). The wrapper unsets every *_API_KEY plus OPENAI_BASE_URL and passes
@@ -37,7 +37,7 @@
 #   codex-exec --resume-last <file|->                # continue the last session (iterate, no re-send)
 #   codex-exec --resume <session-id> <file|->        # continue a specific session
 #   CODEX_HARD_TIMEOUT=7200 codex-exec <file>        # raise the hard wall-clock cap (integer seconds)
-#   CODEX_PROBE=1 CODEX_MODEL=<slug> codex-exec <file>   # throwaway probe (relaxes the guard)
+#   CODEX_PROBE=1 CODEX_MODEL=<slug> codex-exec <file>   # throwaway probe (the one route to a one-off)
 set -euo pipefail
 
 # --- --help / -h (pre-preflight: no codex, no login, no git tree needed) -------
@@ -113,7 +113,7 @@ Receipt:
   reads it, report-if-present). The post-report lane never claims the reservation still stands,
   because after that point its fate is no longer something this run observed. Every lane names the
   tree as partial/dirtied rather than untouched. A nonce-LESS invocation is byte-unchanged: no
-  reservation, no receipt, no artifact, no node.
+  reservation, no receipt, no artifact, and it needs no node.
 
 Notes:
   nested-sandbox limit: codex-exec ships its OWN OS sandbox (bwrap workspace-write) and cannot run
@@ -121,7 +121,7 @@ Notes:
   (excludedCommands / a per-run consented bypass) on the OBSERVED bwrap/EPERM failure, never a
   preemptive blanket
   exec posture banner: ONE stderr line before dispatch states the ACTUAL run posture —
-  exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> timeout=… —
+  exec posture: model=… effort=… tier=… sandbox=workspace-write session=fresh|resume:<id> source=… timeout=… —
   from RESOLVED post-validation values; the resume id is validated pre-spend, and control bytes in
   any banner field refuse pre-spend
   threat model: the sidecar byte and grammar screens detect corrupted input under a trusted parent
@@ -129,9 +129,10 @@ Notes:
   substitution of core/backend commands — is outside the threat model and can substitute the
   backend itself. Targeted shadow-proof resolution protects banner/dispatch honesty from accidental
   shadowing; it is not an environment security boundary
-  the exec posture banner appends a banner-only timeout=<duration|uncapped> field — exactly the
-  duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the run;
-  INFORMATIONAL only: it is never persisted in a receipt or session sidecar
+  the exec posture banner appends a banner-only source=model:<s>,effort:<s> field — where each value
+  came from: default, setting or environment — then a banner-only timeout=<duration|uncapped> field
+  — exactly the duration handed to timeout(1), uncapped when no timeout/gtimeout binary caps the
+  run; INFORMATIONAL only: neither is persisted in a receipt or session sidecar
   quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated
   posture; a prose re-type drifts
   every-run nested-sandbox scan (DUAL policy, deliberately two different rules): the scan runs on
@@ -149,7 +150,7 @@ Notes:
 
 Settings file (KEY=VALUE, parsed never sourced; env wins over file, file wins over built-in default):
   ${XDG_CONFIG_HOME:-~/.config}/agent-workflow/bridge-settings.conf
-  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6-astra, cache fetched 2026-09-05; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
+  CODEX_SERVICE_TIER — service tier: 'priority' (Fast — "2x speed, increased usage", the codex catalog's own words for gpt-6.1-sol, cache fetched 2026-10-03; it states no credit-rate figure); a consented SPEND knob, default off (standard tier)
   CODEX_HARD_TIMEOUT — hard wall-clock cap, integer seconds 1..86400 (built-in default 3600)
 
 Environment: CODEX_HARD_TIMEOUT (seconds, default 3600), CODEX_PROBE=1 (throwaway probe only), AW_DISPATCH_NONCE (delegation dispatch nonce — mints the exec receipt; the --nonce <n> flag is its plain-argument equivalent), AW_DELEGATION_STORE (absolute delegation-store path; its dirname is where the receipt lands).
@@ -161,6 +162,8 @@ esac
 
 # This wrapper's applied settings-file subset (see the shared reader block below).
 AW_SETTINGS_APPLIED="CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT"
+DEFAULT_CODEX_MODEL="gpt-6.1-sol"
+DEFAULT_CODEX_EFFORT="high"
 
 # --- Bridge settings file (host-level, kit-independent) — byte-identical across the four wrappers ---
 # ${XDG_CONFIG_HOME:-$HOME/.config}/agent-workflow/bridge-settings.conf holds KEY=VALUE lines,
@@ -181,7 +184,7 @@ aw_settings_file() {
   printf '%s/agent-workflow/bridge-settings.conf' "${XDG_CONFIG_HOME:-$HOME/.config}"
 }
 aw_settings_known() {
-  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES " in
+  case " CODEX_SERVICE_TIER CODEX_HARD_TIMEOUT CODEX_REVIEW_MAX_TOTAL_BYTES AGY_HARD_TIMEOUT AGY_REVIEW_ALLOW_ADDDIR AGY_REVIEW_MAX_TOTAL_BYTES CODEX_MODEL CODEX_EFFORT AGY_MODEL " in
     *" $1 "*) return 0 ;;
     *) return 1 ;;
   esac
@@ -266,6 +269,37 @@ aw_apply_settings() {
   done
   return 0
 }
+aw_read_posture() {
+  local key="$1" default="$2" empty="$3" file line value notify=1
+  AW_HOST_VALUE="$default"
+  AW_HOST_SOURCE="default"
+  file="$(aw_settings_file)"
+  [[ -n "${AW_SETTINGS_NOTIFIED:-}" ]] && notify=0
+  if [[ -f "$file" && -r "$file" ]]; then
+    line="$(grep "^${key}=" "$file" 2>/dev/null || true)"
+    if [[ -n "$line" ]]; then
+      value="${line##*$'\n'}"
+      value="${value#*=}"
+      if [[ -n "$value" && "$value" != *[$'\x01'-$'\x1f'$'\x7f']* ]]; then
+        AW_HOST_VALUE="$value"
+        AW_HOST_SOURCE="setting"
+      elif (( notify )); then
+        echo "warning: $key in bridge settings file '$file' is empty or carries a control byte — using the built-in default '$default'." >&2
+      fi
+    fi
+  fi
+  AW_RUN_VALUE="$AW_HOST_VALUE"
+  AW_RUN_SOURCE="$AW_HOST_SOURCE"
+  if [[ -n "${!key+x}" ]]; then
+    AW_RUN_VALUE="${!key:-$empty}"
+    AW_RUN_SOURCE="environment"
+  fi
+  return 0
+}
+aw_read_posture CODEX_MODEL "$DEFAULT_CODEX_MODEL" "$DEFAULT_CODEX_MODEL"
+HOST_CODEX_MODEL="$AW_HOST_VALUE"; CODEX_MODEL="$AW_RUN_VALUE"; CODEX_MODEL_SOURCE="$AW_RUN_SOURCE"
+aw_read_posture CODEX_EFFORT "$DEFAULT_CODEX_EFFORT" "$DEFAULT_CODEX_EFFORT"
+HOST_CODEX_EFFORT="$AW_HOST_VALUE"; CODEX_EFFORT="$AW_RUN_VALUE"; CODEX_EFFORT_SOURCE="$AW_RUN_SOURCE"
 aw_apply_settings
 
 # --- Effective-timeout resolver (D5 banner honesty; AD-061) --------------------
@@ -319,19 +353,15 @@ aw_resolve_timeout_bin() {
   printf '%s' "$bin"
 }
 
-DEFAULT_CODEX_MODEL="gpt-6-astra"   # pinned model id (see SKILL.md: strongest-model status is hand-checked, ungated)
-DEFAULT_CODEX_EFFORT="high"    # pinned reasoning effort — a deliberate posture, not the catalog maximum
-CODEX_MODEL="${CODEX_MODEL:-$DEFAULT_CODEX_MODEL}"
-CODEX_EFFORT="${CODEX_EFFORT:-$DEFAULT_CODEX_EFFORT}"
-# Generous hard wall-clock cap, sized for a slow run at the pinned effort (subscription latency
+# Generous hard wall-clock cap, sized for a slow run at the host posture's effort (subscription latency
 # varies — a trivial reply was observed taking minutes). Raise for a known-healthy
 # long run; lowering it only risks killing real work.
 CODEX_HARD_TIMEOUT="${CODEX_HARD_TIMEOUT:-3600}"
 # Codex service tier (quality-neutral speed knob): default EMPTY ⇒ no
 # service_tier flag (standard tier) — enabling Fast is a consented per-host SPEND act, never a
 # silent default. The only server-catalog tier id on this subscription is 'priority' (catalog
-# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6-astra, cache
-# fetched 2026-09-05; it states no credit-rate figure; quality-neutral — same model). codex itself
+# display name "Fast": "2x speed, increased usage" in the catalog's own words for gpt-6.1-sol, cache
+# fetched 2026-10-03; it states no credit-rate figure; quality-neutral — same model). codex itself
 # accepts ANY -c service_tier string silently (probe-verified), so
 # the wrapper validates the effective value: an unsupported one warns and runs on the standard
 # tier — a typo can never silently masquerade as Fast.
@@ -373,31 +403,15 @@ CHATGPT_LOGIN_GUARD="Logged in using ChatGPT"
 # receipt this wrapper mints; scripts/release/version-sync.mjs bumps it under the one-anchor-per-file
 # rule, so a release can never leave it behind (the AD-053 drift class).
 AW_RECEIPT_BACKEND="codex"
-AW_BRIDGE_VERSION="3.8.1"  # aw-version-anchor
+AW_BRIDGE_VERSION="4.0.0"  # aw-version-anchor
 # The kill grace handed to timeout(1) as --kill-after, and recorded in the receipt as killGraceS:
 # ONE constant, so the number the ledger checks against the dispatch deadline is the number the run
 # actually applied.
 CODEX_KILL_GRACE_S=15
 
-# --- Quality-first guard: refuse any non-pinned model/effort ---------------
-# Real delegated runs must use the pinned model at the pinned effort. A throwaway probe
-# (effort-independent result) may opt out with CODEX_PROBE=1, announced loudly.
 if [[ "${CODEX_PROBE:-}" == "1" ]]; then
   echo "warning: CODEX_PROBE=1 — THROWAWAY PROBE MODE. Quality guards relaxed; do NOT use this run's" >&2
   echo "         output as real delegated work (model='$CODEX_MODEL' effort='$CODEX_EFFORT')." >&2
-else
-  if [[ "$CODEX_MODEL" != "$DEFAULT_CODEX_MODEL" ]]; then
-    echo "error: CODEX_MODEL='$CODEX_MODEL' is not the pinned model '$DEFAULT_CODEX_MODEL'." >&2
-    echo "       Delegated codex work must run on the pinned model at the pinned effort (quality-first)." >&2
-    echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
-    exit 2
-  fi
-  if [[ "$CODEX_EFFORT" != "$DEFAULT_CODEX_EFFORT" ]]; then
-    echo "error: CODEX_EFFORT='$CODEX_EFFORT' is not the pinned effort '$DEFAULT_CODEX_EFFORT'." >&2
-    echo "       Delegated codex work must run at the pinned reasoning effort (quality-first)." >&2
-    echo "       For a throwaway probe whose result is effort-independent, set CODEX_PROBE=1." >&2
-    exit 2
-  fi
 fi
 
 # --- Subscription-only guard -------------------------------------------------
@@ -624,10 +638,10 @@ else
   #  (1) ALWAYS rejected — they would defeat the subscription / sandbox / approval /
   #      config-isolation policy (-c/-s/--full-auto/bypass), switch the provider off
   #      the subscription (--oss/--local-provider), load alternate config (-p/--profile),
-  #      override the pinned model (-m), or break the wrapper-owned clean
+  #      override the host posture's model (-m), or break the wrapper-owned clean
   #      output / session capture (-o/--json/--color/--output-schema/--ephemeral).
   #      CODEX_PROBE=1 NEVER relaxes these: a probe still runs on the subscription, in
-  #      the sandbox, with clean capture; its model is chosen via CODEX_MODEL, not -m.
+  #      the sandbox, with clean capture; its model is chosen via CODEX_MODEL, never a flag.
   #  (2) Probe-relaxable — context/discovery knobs the wrapper otherwise pins; a
   #      throwaway probe (CODEX_PROBE=1) may pass them. Need more? invoke `codex` direct.
   if [[ ${#passthrough[@]} -gt 0 ]]; then
@@ -635,7 +649,7 @@ else
       case "$_arg" in
         -c*|--config*|-s*|--sandbox*|--dangerously-bypass-approvals-and-sandbox|--dangerously-bypass-hook-trust|--full-auto|--oss|--local-provider*|-p*|--profile*|-m*|--model*|-o*|--output-last-message*|--json*|--color*|--output-schema*|--ephemeral*)
           echo "error: passthrough flag '$_arg' is not allowed — it would defeat the subscription / sandbox /" >&2
-          echo "       approval / config-isolation policy, the pinned model, or the clean output/session" >&2
+          echo "       approval / config-isolation policy, the host posture, or the clean output/session" >&2
           echo "       capture. It stays blocked even under CODEX_PROBE=1. Invoke 'codex' directly if you must." >&2
           exit 2
           ;;
@@ -666,7 +680,7 @@ if [[ -z "${task//[[:space:]]/}" ]]; then
 fi
 
 # --- The ACCOUNTED lane: everything below fires only for a NONCED run ---------
-# A nonce-LESS invocation is byte-unchanged — no reservation, no receipt, no artifact, no node —
+# A nonce-LESS invocation is byte-unchanged — no reservation, no receipt, no artifact, needs no node —
 # which is what keeps every existing caller working. The whole mint core rides ONE node script per
 # step (the family floor, codex-review.sh's finding-manifest precedent): a bash re-implementation of
 # atomic no-clobber publication, JSON composition and canonical digesting would be a second, drifting
@@ -933,7 +947,7 @@ if [[ -n "$resume_mode" ]]; then
 else
   # `-o` writes ONLY codex's final message; `--json` streams structured events
   # (thread.started carries the session id). CoT is dropped and colour disabled, so
-  # the captured surfaces stay clean. Reasoning still runs at the pinned effort — quality is
+  # the captured surfaces stay clean. Reasoning still runs at the run's effort — quality is
   # unchanged; we only stop printing the noise.
   codex_cmd=(codex exec
     --ignore-user-config
@@ -981,6 +995,91 @@ if [[ -z "$timeout_bin" ]]; then
   echo "         (install coreutils to enable CODEX_HARD_TIMEOUT=$CODEX_HARD_TIMEOUT)." >&2
 fi
 
+# --- The effective model checked against the installed CLI's catalog, then the one-off rule ---
+# Both refuse BEFORE any spend. The read runs after the subscription guard, with the run's
+# CODEX_HOME and the built-in provider, bounded by the same timeout binary as the run.
+catalog_env=(env)
+CODEX_CATALOG_TIMEOUT_S=15
+aw_codex_remedy() {
+  echo "       remedy: set these lines in $(aw_settings_file):" >&2
+  echo "         CODEX_MODEL=$1" >&2
+  echo "         CODEX_EFFORT=$2" >&2
+  echo "       and unset CODEX_MODEL and CODEX_EFFORT in the environment." >&2
+}
+aw_codex_catalog_check() {
+  local raw="" rc=0 verdict="" kind="" offered="" model="" effort="" catalog_js=""
+  if [[ -n "$timeout_bin" ]]; then
+    raw="$("${catalog_env[@]}" "$timeout_bin" --kill-after=5s "$CODEX_CATALOG_TIMEOUT_S" codex debug models -c model_provider=openai </dev/null 2>/dev/null)" || rc=$?
+  else
+    raw="$("${catalog_env[@]}" codex debug models -c model_provider=openai </dev/null 2>/dev/null)" || rc=$?
+  fi
+  if (( rc == 124 || rc == 137 )); then
+    verdict="unreadable"$'\t'"it exceeded ${CODEX_CATALOG_TIMEOUT_S}s"
+  elif (( rc != 0 )); then
+    verdict="unreadable"$'\t'"codex debug models exited $rc"
+  elif ! command -v node >/dev/null 2>&1; then
+    verdict="unreadable"$'\t'"no node to parse it"
+  else
+    IFS= read -r -d '' catalog_js <<'CATALOG_JS' || true
+const [model, effort, defaultModel, defaultEffort] = process.argv.slice(1);
+const answer = (...fields) => { process.stdout.write(fields.join("\t")); process.exit(0); };
+const CONTROL = /[\u0000-\u001f\u007f]/;
+let doc;
+try { doc = JSON.parse(require("node:fs").readFileSync(0, "utf8")); } catch { answer("unreadable", "its output is not JSON"); }
+if (doc === null || typeof doc !== "object" || !Array.isArray(doc.models)) answer("unreadable", "it carries no models[]");
+const offered = doc.models.filter((m) => m !== null && typeof m === "object" && m.visibility === "list");
+if (offered.some((m) => typeof m.slug !== "string" || m.slug === "" || CONTROL.test(m.slug))) answer("unreadable", "an offered entry carries no usable slug");
+if (offered.length === 0) answer("unreadable", "it offers no model");
+const effortsOf = (m) => (Array.isArray(m.supported_reasoning_levels)
+  && m.supported_reasoning_levels.every((l) => l !== null && typeof l === "object" && typeof l.effort === "string" && !CONTROL.test(l.effort))
+  ? m.supported_reasoning_levels.map((l) => l.effort) : null);
+const rank = (m) => (typeof m.priority === "number" ? m.priority : Number.MAX_SAFE_INTEGER);
+const refuse = (kind, list) => {
+  const builtIn = offered.find((m) => m.slug === defaultModel);
+  if (builtIn && (effortsOf(builtIn) ?? []).includes(defaultEffort)) answer(kind, list, defaultModel, defaultEffort);
+  const first = [...offered].sort((a, b) => rank(a) - rank(b))[0];
+  const level = first.default_reasoning_level;
+  if (typeof level !== "string" || level === "" || CONTROL.test(level)) answer("unreadable", "the entry for " + first.slug + " carries no default_reasoning_level");
+  answer(kind, list, first.slug, level);
+};
+const entry = offered.find((m) => m.slug === model);
+if (entry === undefined) refuse("model", offered.map((m) => m.slug).join(", "));
+const efforts = effortsOf(entry);
+if (efforts === null) answer("unreadable", "the entry for " + model + " carries no supported_reasoning_levels");
+if (!efforts.includes(effort)) refuse("effort", efforts.join(", "));
+answer("ok");
+CATALOG_JS
+    verdict="$(printf '%s' "$raw" | NODE_OPTIONS= node -e "$catalog_js" -- "$CODEX_MODEL" "$CODEX_EFFORT" "$DEFAULT_CODEX_MODEL" "$DEFAULT_CODEX_EFFORT" 2>/dev/null)" || verdict="unreadable"$'\t'"its parser failed"
+  fi
+  IFS=$'\t' read -r kind offered model effort <<<"$verdict" || true
+  case "$kind" in
+    ok) return 0 ;;
+    model)
+      echo "error: CODEX_MODEL='$CODEX_MODEL' ($CODEX_MODEL_SOURCE) is not a model the installed codex offers — refusing before any run is spent." >&2
+      echo "       offered: $offered" >&2 ;;
+    effort)
+      echo "error: CODEX_EFFORT='$CODEX_EFFORT' ($CODEX_EFFORT_SOURCE) is not an effort the installed codex offers for $CODEX_MODEL — refusing before any run is spent." >&2
+      echo "       offered: $offered" >&2 ;;
+    *)
+      echo "warning: the codex model catalog is unreadable (${offered:-no answer}) — the run proceeds unchecked; codex itself refuses a model it does not serve." >&2
+      return 0 ;;
+  esac
+  aw_codex_remedy "$model" "$effort"
+  exit 2
+}
+aw_codex_catalog_check
+if [[ "$CODEX_MODEL" != "$HOST_CODEX_MODEL" || "$CODEX_EFFORT" != "$HOST_CODEX_EFFORT" ]]; then
+  if [[ "${CODEX_PROBE:-}" != "1" ]]; then
+    echo "error: model=$CODEX_MODEL effort=$CODEX_EFFORT is a one-off — the host posture is model=$HOST_CODEX_MODEL effort=$HOST_CODEX_EFFORT, and only a probe (CODEX_PROBE=1) runs a one-off; refusing before any run is spent." >&2
+    aw_codex_remedy "$CODEX_MODEL" "$CODEX_EFFORT"
+    exit 2
+  fi
+  if [[ -n "$aw_nonce" ]]; then
+    echo "error: a probe one-off (model=$CODEX_MODEL effort=$CODEX_EFFORT) cannot carry a dispatch nonce — the exec receipt could not say it ran off the host posture; refusing before any run is spent (drop the nonce, or run on the host posture)." >&2
+    exit 2
+  fi
+fi
+
 # --- D5 exec banner (one line, the ACTUAL run posture; AD-061) -----------------
 # Emitted from RESOLVED post-validation values, AFTER the resume id is resolved and validated,
 # BEFORE the dispatch. The timeout field is banner-only (never a receipt/sidecar field): it
@@ -988,7 +1087,7 @@ fi
 aw_timeout_banner="$(aw_timeout_label "$timeout_bin" "$CODEX_HARD_TIMEOUT")"
 aw_session_label="fresh"
 [[ -n "$resume_mode" ]] && aw_session_label="resume:$resume_id"
-echo "exec posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} sandbox=workspace-write session=$aw_session_label timeout=$aw_timeout_banner" >&2
+echo "exec posture: model=$CODEX_MODEL effort=$CODEX_EFFORT tier=${CODEX_SERVICE_TIER:-standard} sandbox=workspace-write session=$aw_session_label source=model:$CODEX_MODEL_SOURCE,effort:$CODEX_EFFORT_SOURCE timeout=$aw_timeout_banner" >&2
 
 # --- The PRE-SPEND reservation (delegation Plan 2 / D1) ------------------------
 # Written immediately before the CLI runs — after EVERY preflight and after the posture banner, so a