@smartmemory/compose 0.4.1 → 0.5.1

package/server/compose-mcp-tools.js

@@ -68,24 +68,46 @@ function _guardOn(capsOverride) {
   try { return loadProjectConfig()?.capabilities?.guard === true; } catch { return false; }
 }
 
-/** True iff a valid, non-agent-mintable override token accompanies the call. */
-function _overrideOk(args) {
-  const expected = process.env.STRATUM_GUARD_OVERRIDE_TOKEN;
-  return !!expected && args?.override_token === expected;
-}
+/**
+ * COMP-MCP-ENFORCE Slice 3, amended 2026-09-07: the override token is GONE.
+ *
+ * These gates used to admit a caller who supplied `override_token` matching this
+ * server process's `STRATUM_GUARD_OVERRIDE_TOKEN`. The audit in
+ * docs/decisions/2026-09-07-override-token-audit.md removed it, on evidence
+ * rather than on threat-modelling taste:
+ *
+ *   - the hatch had no user and could not have one — the variable was unset in
+ *     every environment we ship, and `override_token` appeared in no MCP tool
+ *     schema, so no agent could discover it and no operator workflow used it;
+ *   - both capabilities it nominally unlocked already have first-class doors:
+ *     KILLED through the guarded lifecycle route (`kill_feature`), COMPLETE
+ *     through the completion gate (which `lib/feature-writer.js` enforces
+ *     unconditionally anyway);
+ *   - what remained was `force`, i.e. skipping the roadmap transition table and
+ *     the prose-loss and duplicate-match refusals — the thing these gates exist
+ *     to stop, kept reachable by a secret harder to use than editing the file;
+ *   - and it was never the real protection. Anything that can call these tools
+ *     can write the files directly. The tamper-EVIDENT ledger and the pre-push
+ *     canon guard are what hold; this gate only ever stopped a well-meaning
+ *     agent from casually passing force:true, and a plain refusal does that
+ *     better than a secret nobody can hold.
+ *
+ * If a break-glass path is ever genuinely needed, the answer is stratum's signed
+ * one-shot authorization (`stratum/ts/src/guard/authorization.ts`), not a shared
+ * secret — and the trigger for building it is a real incident where someone hit
+ * one of these refusals with nowhere to go.
+ */
 
 export function assertForceAuthorized(args, toolName, capsOverride) {
   if (!args?.force) return;
   if (!_guardOn(capsOverride)) return;
-  if (!_overrideOk(args)) {
-    const e = new Error(
-      `${toolName}: force is disabled under capabilities.guard — supply a valid override_token ` +
-      `(out-of-band STRATUM_GUARD_OVERRIDE_TOKEN; not agent-mintable) to deviate, or drive the ` +
-      `change through the lifecycle.`,
-    );
-    e.code = 'FORCE_REQUIRES_OVERRIDE';
-    throw e;
-  }
+  const e = new Error(
+    `${toolName}: force is disabled under capabilities.guard. There is no override token — ` +
+    `drive the change through the lifecycle (/lifecycle routes, kill_feature) or the completion ` +
+    `gate (record_completion). If neither can express it, that is a gap to fix, not to bypass.`,
+  );
+  e.code = 'FORCE_REQUIRES_OVERRIDE';
+  throw e;
 }
 
 /**
@@ -103,15 +125,13 @@ export function assertTerminalStatusAuthorized(args, toolName, capsOverride) {
   const status = args?.status;
   if (!status || !LIFECYCLE_OWNED_STATUS.has(status)) return;
   if (!_guardOn(capsOverride)) return;
-  if (!_overrideOk(args)) {
-    const e = new Error(
-      `${toolName}: status ${status} is lifecycle-owned under capabilities.guard — drive it through ` +
-      `/lifecycle (evidence-gated for complete, guarded for kill) instead of setting it directly, ` +
-      `or supply a valid override_token.`,
-    );
-    e.code = 'STATUS_OWNED_BY_LIFECYCLE';
-    throw e;
-  }
+  const e = new Error(
+    `${toolName}: status ${status} is lifecycle-owned under capabilities.guard — drive it through ` +
+    `/lifecycle (evidence-gated for complete, guarded for kill) instead of setting it directly. ` +
+    `There is no override token.`,
+  );
+  e.code = 'STATUS_OWNED_BY_LIFECYCLE';
+  throw e;
 }
 import { resolveWorkspace } from '../lib/resolve-workspace.js';
 import { discoverWorkspaces } from '../lib/discover-workspaces.js';
@@ -474,29 +494,6 @@ export async function toolAddChangelogEntry(args) {
   return addChangelogEntry(getTargetRoot(), args);
 }
 
-/**
- * COMP-CANON-OVERRIDE — mint a single-use, path-scoped canon override.
- *
- * `actor` is deliberately not forwarded from args: it is stamped by the writer
- * per Decision 3 and must never be caller-supplied.
- */
-export async function toolCanonOverrideGrant(args) {
-  const { mintGrant } = await import('../lib/canon-override.js');
-  const { loadFeaturesDir } = await import('../lib/project-paths.js');
-  const root = getTargetRoot();
-  const grant = mintGrant(root, {
-    path: args?.path,
-    reason: args?.reason,
-    operation: args?.operation,
-    featuresDir: loadFeaturesDir(root),
-  });
-  return {
-    ...grant,
-    recorded_in: '.compose/canon-overrides.jsonl',
-    note: 'Single-use and path-scoped. Audit tooling for the Claude Write/Edit path, not enforcement.',
-  };
-}
-
 export async function toolGetChangelogEntries(args) {
   const { getChangelogEntries } = await import('../lib/changelog-writer.js');
   return getChangelogEntries(getTargetRoot(), args);
@@ -1002,8 +999,10 @@ function _targetMatchesBoundFeature(tool, args) {
 
 /**
  * Throw PHASE_TOOL_DENIED if the tool is not allowed for the current
- * profile×phase. No-op when the capability is off (default) or on a valid
- * override token. On unresolved CONTEXT the behavior is graduated, NOT blanket
+ * profile×phase. No-op when the capability is off (default). The override-token
+ * escape was REMOVED 2026-09-07 with the other two (see the note above
+ * `assertForceAuthorized`): same secret, same absence of any caller who could
+ * hold it. On unresolved CONTEXT the behavior is graduated, NOT blanket
  * fail-open: an unresolved PROFILE (no/unknown env) normalizes to orchestrator →
  * unrestricted; an unresolved PHASE only fails open the phase *refinement* — the
  * profile BASE policy (implementer deny / reviewer allowlist) still applies
@@ -1013,7 +1012,6 @@ function _targetMatchesBoundFeature(tool, args) {
 export function assertToolPhaseAllowed(tool, args = {}, _testCtx) {
   const guardOn = _testCtx?.phaseScopedTools ?? (loadProjectConfig()?.capabilities?.phaseScopedTools === true);
   if (!guardOn) return;
-  if (_overrideOk(args)) return;
 
   const profile = _testCtx?.profile ?? sessionContext().profile;
   const phase = _testCtx?.phase ?? resolveBoundPhase();
@@ -1024,7 +1022,7 @@ export function assertToolPhaseAllowed(tool, args = {}, _testCtx) {
     const e = new Error(
       `${tool} is not available to profile '${profile}'` +
       (phase ? ` in phase '${phase}'` : '') + `: ${verdict.reason}. ` +
-      `Supply a valid override_token to deviate.`,
+      `There is no override token; use a session bound to a profile that owns this tool.`,
     );
     e.code = 'PHASE_TOOL_DENIED';
     e.profile = profile;

package/server/compose-mcp.js

@@ -55,7 +55,6 @@ import {
   toolGetFeatureLinks,
   toolProposeFollowup,
   toolAddChangelogEntry,
-  toolCanonOverrideGrant,
   toolGetChangelogEntries,
   toolWriteJournalEntry,
   toolGetJournalEntries,
@@ -175,7 +174,6 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         case 'get_feature_artifacts':    result = await toolGetFeatureArtifacts(args); break;
         case 'get_feature_links':        result = await toolGetFeatureLinks(args); break;
         case 'add_changelog_entry':      result = await toolAddChangelogEntry(args); break;
-        case 'canon_override_grant':     result = await toolCanonOverrideGrant(args); break;
         case 'get_changelog_entries':    result = await toolGetChangelogEntries(args); break;
         case 'write_journal_entry':      result = await toolWriteJournalEntry(args); break;
         case 'get_journal_entries':      result = await toolGetJournalEntries(args); break;

package/server/design-routes.js

@@ -13,7 +13,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { parseDecisionBlocks } from '../src/components/vision/designSessionState.js';
+import { parseDecisionBlocks } from '../lib/decision-blocks.js';
 import { StratumMcpClient } from '../lib/stratum-mcp-client.js';
 import { KNOWN_VERSIONS } from '../lib/build-stream-schema.js';
 import { getTargetRoot, resolveProjectPath, trackProjectWork } from './project-root.js';

package/server/file-watcher.js

@@ -288,6 +288,20 @@ export class FileWatcherServer {
 
           onChanged(relativePath, fullPath);
         });
+        // A watcher can die AFTER construction, and fs.watch reports that as an
+        // 'error' event, not a throw — with no handler Node has historically
+        // treated it as unhandled. Either way the failure was completely silent:
+        // the pane simply stops updating.
+        //
+        // Deliberately NOT given the backstop poll that cc-session-watcher and
+        // the build-stream bridge now carry. Those lose data that never returns
+        // (branch DecisionEvents, a build's live output); this one loses a
+        // hot-reload, and the REST path already serves current content on load,
+        // so a refresh recovers it. A recursive re-stat of docs/** on a timer is
+        // real cost for a recoverable symptom. Logged, so it stops being silent.
+        watcher.on?.('error', (err) => {
+          console.error(`[file-watcher] watch on ${prefix}/ died — changes there stop live-updating until restart: ${err?.message}`);
+        });
         this.watchers.push(watcher);
       } catch (err) {
         console.error(`[file-watcher] Failed to watch ${prefix}/:`, err.message);

package/server/ideabox-routes.js

@@ -51,6 +51,7 @@ import {
   IdeaboxRenderFailed,
 } from '../lib/fluid/ideabox-ops.js'
 import { writeIdeaboxProjection } from '../lib/fluid/render-ideabox.js'
+import { IdeaboxMigrationConflict, IdeaboxUnreadable } from '../lib/fluid/ideabox-migrate.js'
 import { ideaboxView, toClientIdeaWith } from '../lib/fluid/ideabox-view.js'
 import { relForDisplay } from '../lib/project-paths.js'
 
@@ -109,6 +110,12 @@ export function attachIdeaboxRoutes(app, { getProjectRoot, broadcastMessage }) {
       if (err instanceof IdeaboxNotFound) return res.status(404).json({ error: err.message, code: err.code })
       if (err instanceof IdeaboxInvalid) return res.status(400).json({ error: err.message, code: err.code, field: err.field })
       if (err instanceof IdeaboxConflict) return res.status(409).json({ error: err.message, code: err.code })
+      // The migration gate's two refusals. Both mean "the file on disk is in a
+      // state this operation must not write over", which is a conflict, not a
+      // server fault — and the client needs the code to say so.
+      if (err instanceof IdeaboxMigrationConflict || err instanceof IdeaboxUnreadable) {
+        return res.status(409).json({ error: err.message, code: err.code })
+      }
       return res.status(500).json({ error: err.message })
     }
   }
@@ -214,6 +221,9 @@ export function attachIdeaboxRoutes(app, { getProjectRoot, broadcastMessage }) {
   app.post('/api/ideabox/render', async (_req, res) => {
     await send(res, async () => {
       const ctx = await context()
+      // The migration gate is no longer applied here: it lives inside
+      // `writeIdeaboxProjection`, which every projection write goes through.
+      // This route reached that writer without a guard once already.
       await writeIdeaboxProjection(ctx.provider, ctx.ideaboxPath)
       return { body: { ok: true } }
     })

package/server/index.js

@@ -222,7 +222,11 @@ const _distExists = () => {
   catch { return false; }
 };
 
-app.use(express.static(_distDir, { index: false }));
+// Source checkouts keep Vite/HMR on :5195. Published installs have no Vite or
+// src/ by design, so compose start serves the prebuilt desktop shell on :4001.
+app.use(express.static(_distDir, {
+  index: process.env.COMPOSE_PACKAGED_UI === '1' ? 'index.html' : false,
+}));
 
 // /m/* SPA fallback — paths matching /m or /m/...
 app.get(/^\/m(\/|$)/, (_req, res) => {

package/server/lifecycle-guard.js

@@ -70,6 +70,19 @@ export const isGuardError = (result) => !result || Boolean(result.error) || resu
 export const guardErrorType = (result) => (result && (result.error?.code ?? result.error_type)) ?? null;
 export const guardErrorMessage = (result) => (result && (result.error?.message ?? result.message)) ?? 'no guard response';
 
+/**
+ * Infrastructure failures: the guard was never reached, or never answered, so
+ * the evidence was NOT evaluated. Distinct from a refusal (the guard ran and
+ * said no) and from a policy error (the guard ran and could not apply). Routes
+ * must not render these as "refused by guard" — for two months a timed-out
+ * `guard transition` was reported to the user as a rejection of their evidence
+ * (stratum-client.js, f7865d4), and nothing at the surface could tell the two
+ * apart.
+ */
+const GUARD_INFRA_CODES = new Set(['TIMEOUT', 'SPAWN', 'GUARD_UNREACHABLE', 'PARSE_ERROR', 'UNKNOWN']);
+export const isGuardInfraError = (result) =>
+  !!result && result.applied !== true && result.refused !== true && GUARD_INFRA_CODES.has(guardErrorType(result));
+
 /**
  * Assemble the FULL guarded graph the design requires: the forward
  * `BASE_TRANSITIONS` PLUS the `ship → complete` edge and a `<any non-terminal>

package/server/maya-routes.js

@@ -44,7 +44,9 @@ import {
   MayaWorkspaceCollisionError,
 } from '../lib/maya-identity.js';
 import { ideaboxContext } from '../lib/fluid/ideabox-ops.js';
-import { composeColleagueContext } from '../lib/colleague/context.js';
+import { composeColleagueContext, composePortfolioContext, toMayaContext } from '../lib/colleague/context.js';
+import { openPortfolio, recallAcrossPortfolio, assertMemberWorkspacesDistinct } from '../lib/fluid/portfolio.js';
+import { parsePortfolioConfig } from '../lib/fluid/factory.js';
 import { writebackReply } from '../lib/colleague/writeback.js';
 
 /**
@@ -67,11 +69,51 @@ const CAPABILITIES = Object.freeze({
 // `author:'maya'` plus the embedded msg marker. `ui:ideabox` is the cockpit
 // door these contexts genuinely come through; a colleague-specific origin
 // joins the contract enum only when the panel gains a record-creating op.
-async function defaultComposeContext(root, { focusId }) {
+async function defaultComposeContext(root, { focusId, scope, text }) {
+  if (scope === 'portfolio') {
+    // The declaring root's ideabox context is NOT built here. A portfolio turn
+    // reads through the members' own providers, so constructing this first made
+    // a failure in the declaring root's provider abort the turn before a single
+    // member was asked — the one product being broken silencing the other N,
+    // which is the whole failure mode this feature exists to avoid.
+    // The portfolio path is a separate composer, not a widened one: the
+    // project-scoped turn must stay byte-identical so a portfolio bug can never
+    // degrade the ordinary one.
+    const portfolio = await openPortfolio(root);
+    return composePortfolioContext({ text }, { portfolio, recallAcross: recallAcrossPortfolio });
+  }
   const ctx = await ideaboxContext(root, { origin: 'ui:ideabox' });
   return composeColleagueContext(ctx, { focusId });
 }
 
+/**
+ * Is a portfolio declared here at all, and is it valid?
+ *
+ * Read through the AUTHORITATIVE validating parser, never the lenient
+ * `maya-config` reader: a portfolio with a typo in it must refuse, not come back
+ * as "none declared" and quietly answer for one product.
+ */
+function portfolioDeclared(root) {
+  try {
+    return parsePortfolioConfig(root) !== null;
+  } catch {
+    // Invalid is not absent. Let the caller name the real reason.
+    return false;
+  }
+}
+
+/** The exact reason, so the funnel points at the setting that is actually wrong. */
+function portfolioMisconfigReason(root) {
+  try {
+    if (parsePortfolioConfig(root) === null) {
+      return 'this project declares no fluid.portfolio, so a portfolio turn has no members to ask';
+    }
+  } catch (e) {
+    return `fluid.portfolio is declared but invalid — ${shortReason(e)}`;
+  }
+  return 'fluid.portfolio is declared but unusable';
+}
+
 /** The real write-back (S4): reconcile-then-append through the shared ops
  *  module. Returns an OUTCOME, never throws (lib/colleague/writeback.js). */
 async function defaultPerformWriteback(root, args) {
@@ -168,6 +210,54 @@ export function attachMayaRoutes(app, {
     }
     const focusId = req.body?.focusId ? String(req.body.focusId) : null;
 
+    // A CLOSED enum. Without this a typo ('portoflio') falls through to a
+    // project-scoped answer that looks exactly like a correct one — the silent
+    // downgrade this feature exists to refuse, arriving through the door left
+    // open by not checking.
+    // Validated as the RAW value. Coercing first made `null` look like "absent"
+    // (silently selecting project scope) and turned `["portfolio"]` into the
+    // string "portfolio" — both of which are the silent widening/downgrade this
+    // enum exists to refuse, arriving through the coercion rather than the check.
+    const rawScope = req.body?.scope;
+    const turnScope = rawScope === undefined ? undefined : rawScope;
+    if (turnScope !== undefined && turnScope !== 'project' && turnScope !== 'portfolio') {
+      return {
+        errorBody: {
+          ok: false,
+          error: {
+            kind: 'invalid',
+            message: `unknown scope ${JSON.stringify(turnScope)} — expected "project" or "portfolio"`,
+          },
+        },
+      };
+    }
+    if (turnScope === 'portfolio' && focusId) {
+      return {
+        errorBody: {
+          ok: false,
+          error: {
+            kind: 'invalid',
+            message: 'a portfolio turn spans products and cannot also be focused on one idea',
+          },
+        },
+      };
+    }
+
+    if (turnScope === 'portfolio' && !portfolioDeclared(root)) {
+      // Named, never a silent downgrade. Without its own branch this surfaces as
+      // the generic `context` funnel, which tells the user nothing about
+      // membership — and a portfolio question answered for one product looks
+      // exactly like a correct answer.
+      return {
+        errorBody: {
+          ok: false,
+          error: {
+            kind: 'misconfigured',
+            message: portfolioMisconfigReason(root),
+          },
+        },
+      };
+    }
     try {
       if (!hasSmartmemoryFluidProvider(root)) {
         return { errorBody: { ok: false, error: { kind: 'connect-smartmemory' } } };
@@ -204,11 +294,25 @@ export function attachMayaRoutes(app, {
         await ensureIdentity(root, { smBaseUrl: getSmartmemoryConfig(root)?.baseUrl, mode });
       }
 
+      // BEFORE composition, not after. Composition is what fans out to the
+      // members, so checking afterwards let a member configured at Maya's own
+      // workspace be READ and only then refused — the guard reported a refusal
+      // for an access that had already happened, which is not a guard.
+      if (turnScope === 'portfolio') {
+        try {
+          assertMemberWorkspacesDistinct(root, workspaceClaimOf(identity));
+        } catch (e) {
+          return {
+            errorBody: { ok: false, error: { kind: 'workspace-collision', message: e.message } },
+          };
+        }
+      }
+
       // Context composition is load-bearing: a failure here is a funnel, never
       // a silent fall-through to plain chat (COLLEAGUE-ALL-IN).
       let context;
       try {
-        context = await composeContext(root, { focusId });
+        context = await composeContext(root, { focusId, scope: turnScope, text });
       } catch (e) {
         return {
           errorBody: {
@@ -315,7 +419,7 @@ export function attachMayaRoutes(app, {
 
     if (req.query?.stream !== '1') {
       try {
-        const reply = await client.chat({ message: text, channelContext: context.blocks });
+        const reply = await client.chat({ message: text, channelContext: toMayaContext(context.blocks) });
 
         // Write-back (S4): the chat result is AUTHORITATIVE — her reply renders
         // whatever happens here, and a write-back failure is an outcome field,
@@ -332,7 +436,7 @@ export function attachMayaRoutes(app, {
           memory_available: reply.memory_available ?? null,
           writeback,
           context: {
-            sent: context.blocks.map((b) => b.author),
+            sent: [...new Set(context.blocks.map((b) => b.author))],
             omissions: context.omissions,
             // The composed blocks themselves — the panel's findings accordion
             // renders these (design §4); authors carry the provenance labels.
@@ -382,7 +486,7 @@ export function attachMayaRoutes(app, {
     try {
       const reply = await client.chatStream({
         message: text,
-        channelContext: context.blocks,
+        channelContext: toMayaContext(context.blocks),
         onToken: (token) => {
           openStream();
           writeEvent('token', { text: token });
@@ -395,7 +499,7 @@ export function attachMayaRoutes(app, {
         message_id: reply.message_id,
         memory_available: reply.memory_available ?? null,
         context: {
-          sent: context.blocks.map((b) => b.author),
+          sent: [...new Set(context.blocks.map((b) => b.author))],
           omissions: context.omissions,
           blocks: context.blocks,
         },

package/server/mcp-tool-defs.js

@@ -527,31 +527,6 @@ export const TOOLS = [
       },
     },
   },
-  // -------------------------------------------------------------------------
-  // Canon override — COMP-CANON-OVERRIDE (COMP-CANON-GUARD Decision 4)
-  // -------------------------------------------------------------------------
-  {
-    name: 'canon_override_grant',
-    effect: 'mutating',
-    writes: ["override-ledger", "override-attest", "override-grants"],
-    description:
-      'Mint a single-use, path-scoped grant permitting ONE direct write to a guarded canon path. '
-      + 'The bypass row is appended to .compose/canon-overrides.jsonl BEFORE the grant exists, so a grant '
-      + 'cannot be unrecorded. The token expires in 5 minutes and is burned by the first write. '
-      + 'Governance state (the bypass ledger, its baseline, the grant directory) is deliberately NOT grantable. '
-      + 'SCOPE: this is audit and careless-drift tooling for the Claude Write/Edit path — it is not enforcement. '
-      + 'Bash and Codex writes never reach the guard, and `operation` is a declared label recorded for later '
-      + 'analysis, never verified against the write that follows.',
-    inputSchema: {
-      type: 'object',
-      required: ['path', 'reason'],
-      properties: {
-        path: { type: 'string', description: 'Repo-relative path to grant one write for. Must be guarded at the write-time hook and override-eligible.' },
-        reason: { type: 'string', description: 'Why the bypass is justified. Empty or whitespace-only is rejected — the recorded reason is the point.' },
-        operation: { type: 'string', description: 'Caller-declared intent label (e.g. "repair-malformed-record"). Recorded for analysis; unverifiable by construction.' },
-      },
-    },
-  },
   {
     name: 'get_changelog_entries',
     effect: 'read',

package/server/mcp-tool-policy.js

@@ -26,18 +26,12 @@ export const SETUP_TOOLS = new Set([
 /**
  * Management/approval/completion tools an implementer context must not wield.
  *
- * COMP-COVERAGE-GATE (2026-08-24) added the last two, found by
+ * COMP-COVERAGE-GATE (2026-08-24) added `roadmap_xref_push`, found by
  * `checkAuthorizationCoverage`'s C4 check — mutating tools this list had never
- * been asked about. Both postdate COMP-MCP-ENFORCE-1's charter ("cannot
- * self-approve, self-complete, or mutate roadmap status") and no design ever
- * ruled that an implementer may call them:
+ * been asked about. It postdates COMP-MCP-ENFORCE-1's charter ("cannot
+ * self-approve, self-complete, or mutate roadmap status"), and no design ever
+ * ruled that an implementer may call it:
  *
- *  - `canon_override_grant` — the escape hatch FROM canon enforcement was
- *    callable by the profile SUBJECT to it. COMP-CANON-OVERRIDE already reasoned
- *    that the override must not be grantable for its own governance state
- *    (`overrideEligible: false`); this is the same argument one level up, at the
- *    caller instead of the target. An implementer that hits a canon block must
- *    escalate, not self-authorise.
  *  - `roadmap_xref_push` — writes EXTERNAL trackers (github issues, sibling
  *    repos). An implementer session should not be reaching outside the repo.
  *
@@ -47,8 +41,8 @@ export const SETUP_TOOLS = new Set([
  * recorded decision, not an omission. That ruling is now recorded machine-side
  * in `C4_EXCEPTIONS` (lib/coverage-gate.js) so the gate stops re-raising it.
  *
- * Verified before adding the two: no pipeline spec, prompt template or server
- * flow invokes either from an implementer-profile session.
+ * Verified before adding it: no pipeline spec, prompt template or server flow
+ * invokes it from an implementer-profile session.
  */
 const IMPLEMENTER_DENY = [
   'approve_gate', 'complete_feature', 'kill_feature',
@@ -56,7 +50,6 @@ const IMPLEMENTER_DENY = [
   // COMP-LIFECYCLE-BACKFILL: a completion is a management act, backfilled or not.
   'backfill_completion',
   // ── added by COMP-COVERAGE-GATE C4 ──
-  'canon_override_grant',
   'roadmap_xref_push',
 ];
 

package/server/model-tiers.js

@@ -2,21 +2,26 @@
  * model-tiers.js — Model tier routing for STRAT-TIER.
  *
  * Maps symbolic tier names to provider-specific model IDs.
- * Tiers let pipeline specs declare intent (critical / standard / fast)
- * without hard-coding model strings — the map here is the single source of truth.
+ * Tiers let pipeline specs declare intent (critical / standard / fast / coordinator)
+ * without hard-coding model strings — the map here is the single source of truth,
+ * including the agent-string tier allow-list. Coordinator lets one preset role
+ * explicitly name Fable while critical stays Opus 5; other presets do not move
+ * silently to Fable.
  */
 
 /** @type {Record<string, string>} */
 export const MODEL_TIERS = {
-  critical: 'claude-opus-4-7',
-  standard: 'claude-sonnet-4-6',
+  critical: 'claude-opus-5',
+  standard: 'claude-sonnet-5',
   fast: 'claude-haiku-4-5-20251001',
+  coordinator: 'claude-fable-5-1',
 };
 
 export const CODEX_MODEL_TIERS = {
   critical: 'gpt-6-astra',
   standard: 'gpt-5.6-terra',
   fast: 'gpt-5.3-codex-spark',
+  coordinator: null,
 };
 
 // C12: codex efforts follow the routing convention — `low` is for trivial
@@ -26,11 +31,13 @@ const CODEX_TIER_THINKING = {
   critical: { mode: null, effort: 'high' },
   standard: { mode: null, effort: 'high' },
   fast: { mode: null, effort: 'medium' },
+  coordinator: null,
 };
 
 /**
  * Default thinking config per tier.
- * - Opus 4.7 / Sonnet 4.6 support adaptive thinking and the effort parameter.
+ * - Opus 5 / Sonnet 5 support adaptive thinking and the effort parameter.
+ * - Fable 5.1 thinking is always on; adaptive thinking uses effort to control depth.
  * - Haiku 4.5 doesn't accept the effort parameter (400 error), so fast tier stays off.
  *
  * @type {Record<string, { mode: 'adaptive'|'off', effort: 'low'|'medium'|'high'|'xhigh'|'max'|null }>}
@@ -39,13 +46,14 @@ export const TIER_THINKING = {
   critical: { mode: 'adaptive', effort: 'xhigh' },
   standard: { mode: 'adaptive', effort: 'high' },
   fast:     { mode: 'off',      effort: null   },
+  coordinator: { mode: 'adaptive', effort: 'high' },
 };
 
 /**
  * Resolve a tier name to a concrete model ID.
  *
  * @param {string|null|undefined} tier
- * @returns {string|null}  Model ID, or null if tier is unknown / not provided.
+ * @returns {string|null}  Model ID, or null if tier is unknown, unavailable for the provider, or not provided.
  */
 export function resolveTierModel(tier, provider = 'claude') {
   if (!tier) return null;