@starci/hfs 4.0.8 → 4.0.9

package/runtime/modules/models/registry.yaml

@@ -0,0 +1,591 @@
+schema: starci/profile-registry@1
+purpose: >-
+  The ONE model catalog of the runtime. Concrete model ids — provider,
+  capability tier and per-token price — live under `models`; the provider
+  quota/capacity pools, their roles, concurrency and per-difficulty model pins
+  live under `pools`; every launch target lives under `targets`, carrying
+  `defaultModel` where it names a single model. No other file in the repo
+  states a model id, tier, price or pool: those cite these keys.
+
+# Canonical naming. Keep these roles distinct
+# in contracts and receipts; an `agent` and a `provider` may carry the same
+# string, but the fields are not interchangeable — `agent` names the execution
+# adapter while model-routing `provider` remains quota authority.
+glossary:
+  launcher: human chat surface explicitly selecting the StarCi entry (codex-chat | claude-chat | devin-chat)
+  host: Orca execution environment owning terminals, worktrees and managed operation workers
+  agent: execution adapter / Orca agent id (codex | claude | devin | cursor)
+  provider: credential, billing and quota family used by allocation
+  model: a concrete model id (a `models` key below) that worker-start --model takes
+  target: a StarCi routing/capability target (a `targets` key below)
+  pool: one provider quota/capacity window (a `pools` key below), routed to as a target
+
+# Price table that turns measured token counts (llm_usage, scripts/lib/llm-usage.mjs
+# priceOf/costOfRow) into cost_usd. The runtime never guesses a price: a model absent
+# from `models`, or with a null rate, leaves cost_usd NULL. Nothing reads a provider
+# price feed; the owner declares the rates below from the provider's own price page
+# and dates the edit (pricing.asOf).
+pricing:
+  currency: USD
+  unit: per-million-tokens
+  asOf: '2026-10-03'
+  source: >-
+    Official list prices read 2026-09-29 (WebFetch): claude-* from https://claude.com/pricing (5-minute cache write TTL);
+    gpt-6-luna from https://developers.openai.com/api/docs/pricing. GPT-6.1 Sol list prices read 2026-10-03 from
+    https://developers.openai.com/api/docs/models/gpt-6.1-sol: Standard processing tier, contexts at or below 272K
+    tokens (input 2, output 10, cached input 0.10 per 1M tokens). Larger-context and other processing-tier multipliers
+    are not applied because the CLI reports no billing tier. swe-2-max (Devin) has
+    no official per-token price page read, so its rates stay null and cost_usd stays NULL for it. A subscription seat
+    (Claude Max, Codex Pro, Devin plan) bills a flat fee, so cost_usd is the API-equivalent list price.
+  matching: >-
+    priceOf(model): the exact `models` key first, then the longest declared id that is a prefix of the model
+    (a dated snapshot id `claude-opus-5-5-20260901` prices as `claude-opus-5-5`). The four rates are USD per 1M tokens:
+    input = fresh (non-cached) input, cacheRead = cached input read, cacheWrite = cache creation, output = generated
+    tokens including reasoning. A model whose used rate is null gets cost_usd NULL (a partial sum is never written).
+
+# The concrete model ids the runtime may name: provider (quota family), tier (the
+# capability class the catalog assigns it) and the per-token price row costOfRow
+# consumes. A launch-only target's `targets.<t>.defaultModel` and every pool's
+# `pools.<p>.models`/`defaultModel` pin keys of this map — nothing else.
+models:
+  claude-opus-5-5:   {provider: claude, tier: frontier, price: {input: 4,   output: 20,  cacheRead: 0.2,  cacheWrite: 5,     source: official}}
+  claude-sonnet-5-5: {provider: claude, tier: standard, price: {input: 2,   output: 10,  cacheRead: 0.2,  cacheWrite: 2.5,   source: official}}
+  gpt-6.1-sol:       {provider: codex,  tier: frontier, price: {input: 2,   output: 10,  cacheRead: 0.1,  cacheWrite: 2.5,   source: official}}
+  gpt-6-luna:        {provider: codex,  tier: economy,  price: {input: 0.1, output: 0.5, cacheRead: 0.01, cacheWrite: 0.125, source: official}}
+  swe-2-max:         {provider: devin,  tier: frontier, price: {input: null, output: null, cacheRead: null, cacheWrite: null, source: unset}}
+
+# The provider quota/capacity pools the allocator serves. `models` pins the launch
+# model per difficulty (easy|medium|hard|insane) — a missing pin is a typed error,
+# never a fallback to a neighbouring tier's model; `defaultModel` is the model a
+# launch takes when no difficulty pin applies. `maxParallel` is the only concurrency
+# authority (registry.yaml executionModel.concurrency).
+pools:
+  # One Codex account window carries both models: Luna is the easy/medium model, Sol the hard and insane one.
+  # Role/tier/tool/quality gates still apply on top of the difficulty pin; an owner allocation changes
+  # capacity, never qualification or effect authority.
+  codex-agent:
+    target: codex-agent
+    provider: codex
+    roles: [implement, verify, write, decide, plan]
+    maxParallel: 10
+    defaultModel: gpt-6-luna
+    models:
+      easy: gpt-6-luna
+      medium: gpt-6-luna
+      hard: gpt-6.1-sol
+      insane: gpt-6.1-sol
+    effort:
+      easy: low
+      medium: medium
+      hard: high
+      insane: max
+  # One Claude session/week window, all five roles on the same pinned model at every difficulty. The Claude
+  # CLI lists no models, so the dispatch's model attestation is what proves the claude-opus-5-5 id.
+  claude-agent:
+    target: claude-agent
+    provider: claude
+    roles: [implement, verify, write, decide, plan]
+    maxParallel: 6
+    defaultModel: claude-opus-5-5
+    models:
+      easy: claude-opus-5-5
+      medium: claude-opus-5-5
+      hard: claude-opus-5-5
+      insane: claude-opus-5-5
+  # Devin has no machine-readable account headroom equivalent to Orca's provider windows. Owner-assigned
+  # capacity: 10 parallel lanes, opened by the owner's default grant (config.yaml allocation.grants
+  # devin-agent=10@implement+verify+write applies to every workflow; once config.yaml declares a grants list,
+  # `starci kernel route` rejects a grant-gated pool that list does not open). The CLI's auth/readiness and observed
+  # launch/refusal status are the live capacity signal on top of this cap. swe-2-max is a medium+ agent: no
+  # easy or insane pin, and the easy tier does not list the pool.
+  devin-agent:
+    target: devin-agent
+    provider: devin
+    roles: [implement, verify, write]
+    maxParallel: 10
+    capacityAuthority: explicit-workflow-quota
+    quotaTelemetry: launch-status
+    defaultModel: swe-2-max
+    models:
+      medium: swe-2-max
+      hard: swe-2-max
+
+runtimes:
+  - codex
+  - claude
+  - devin
+  - cursor
+aliases:
+  openai: codex
+  anthropic: claude
+  cognition: devin
+executionModel:
+  # Two agent levels, one host. A chat submits the goal and then monitors; it is
+  # never an agent layer above the kernel.
+  levels: [workflow-kernel, operation-agent]
+  host: orca
+  chat: trigger-and-monitor-only
+  workflowKernel: one-long-lived-agent-per-workflow
+  kernelAuthority: sole-workflow-state-writer-through-scripts/kernel/cli.mjs
+  operationAgent: one-ephemeral-agent-per-job
+  operationMapping: one-operation-instance-one-agent
+  isolationBoundary: operation
+  worktree: isolated-child-per-job
+  scheduling: dependency-dag
+  fanOutWithinOperation: forbidden
+  concreteAgentBinding: provider-profile-model
+  # Concurrency is one number per pool and it lives in one file.
+  concurrency: modules/models/registry.yaml pools.<pool>.maxParallel
+orchestration:
+  runtime: orca
+  owner: source-host
+  defaultOperationTarget: devin-agent
+  workspaceRouting: .workspaces/projects/<project>/work.json
+  # Owner ruling: owner gates are the StarCi entry's scope-bound acceptance
+  # for goal definition and native workflow startup, plus settle-time evidence verdicts — there is no
+  # separate approvals engine or policy file.
+  approvalMode: entry-skill-owner-ok
+  dispatch: The native lifecycle claims an accepted queued goal and spawns that workflow's one long-lived kernel agent
+    (scripts/kernel/start-workflow.mjs). The kernel is the sole workflow-state writer; `starci kernel dispatch --spawn`
+    launches one isolated agent per ready operation in the workflow's one worktree, using the first eligible target in
+    that operation's chain. The kernel never implements, repairs or tests on behalf of an operation agent.
+targets:
+  # Pool targets are named by a `pools` key above, whose `models` map pins the launch model per
+  # difficulty and whose `defaultModel` covers an unpinned difficulty. A pool target names no model itself.
+  codex-agent:
+    runtime: codex
+    profiles:
+      working: gpt-6-luna
+      reasoning: gpt-6.1-sol
+    orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
+  # Launch-only targets: an explicit `--model gpt-6.1-sol` or `--model gpt-6-luna` request reaches that one model
+  # on the Codex provider window. They are off every automatic chain; allocation routes the codex-agent pool.
+  # `defaultModel` is the launch model resolveWorkerLaunchModel returns for them (they hold no pools entry).
+  gpt-6.1-sol:
+    runtime: codex
+    defaultModel: gpt-6.1-sol
+    profiles:
+      working: gpt-6.1-sol
+      reasoning: gpt-6.1-sol
+    orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
+  gpt-6-luna:
+    runtime: codex
+    defaultModel: gpt-6-luna
+    profiles:
+      working: gpt-6-luna
+      reasoning: gpt-6-luna
+    orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
+  # Cursor: Orca agent id `cursor` (binary cursor-agent). A launch-only target like gpt-6.1-sol: off every automatic chain,
+  # reached by an explicit `--model auto` (the CLI's default) or any id of the account's `cursor-agent --list-models`.
+  # Live proof 2026-10-02: worker-start --agent cursor --model auto reached worker_done and released cleanly. No Cursor
+  # quota probe exists, so no automatic chain routes to it. `defaultModel: auto` is the CLI's selector keyword —
+  # Orca's catalog default — not a `models` entry (Cursor publishes no fixed priced catalog).
+  cursor-agent:
+    runtime: cursor
+    defaultModel: auto
+    profiles:
+      working: auto
+      reasoning: auto
+    orcaLaunch: {agent: cursor}   # orca orchestration worker-start --agent cursor
+  claude-agent:
+    runtime: claude
+    profiles:
+      working: opus
+      reasoning: opus-reviewer
+    orcaLaunch: {agent: claude}   # orca orchestration worker-start --agent claude
+  devin-agent:
+    runtime: devin
+    executionHosts: [orca]
+    profiles:
+      working: devin-worker
+      reasoning: devin-reviewer
+    orcaLaunch: {agent: devin}   # orca orchestration worker-start --agent devin
+targetAliases:
+  codex-gpt-6.1-sol: codex-agent
+  codex-gpt-6-luna: codex-agent
+  devin-devin-worker: devin-agent
+  devin-devin-reviewer: devin-agent
+  # Bare model ids that are not targets resolve to the provider-window pool that carries them, so workflow
+  # quota entries land on the right window. gpt-6.1-sol and gpt-6-luna are targets; their `runtime: codex`
+  # names the window.
+  claude-opus: claude-agent
+  claude-opus-5-5: claude-agent
+skills:
+  starci:
+    chains:
+      working:
+        - devin-agent
+        - codex-agent
+        - claude-agent
+      reasoning:
+        - claude-agent
+        - codex-agent
+# An operator whose kind runtimes.yaml roleOfKind marks think work with no declared order carries the
+# think order of runtimes.yaml allocation.preference.think (Opus, then Sol) and nothing else;
+# scripts/route/route-model.mjs refuses any other pool for it. A kind's declared order wins: owner routing
+# 2026-09-26 gives the ui order (Codex, then Devin) to interface.audit, e2e.verify,
+# security.verify and uat.assisted.verify, the implement order (Devin, Codex, Opus) to the
+# mechanical ops provision.ask, workspace.manage, task.execute and knowledge.repair, and sol-think (Sol,
+# Opus overflow) to the kernel's own model calls, which carry no operator entry. Owner decision 2026-09-25
+# (72h scripts/agent/model-scorecard.mjs evidence):
+# hands-on implementation chains lead with Devin; scaffold, docs, content and grammar chains (the
+# roleOfKind order scaffold) lead with Devin; the image-tool chains are Codex alone.
+operators:
+  architecture.decide:
+    skill: starci
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  backend.implement:
+    skill: starci
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  brand.decide:
+    skill: starci
+    # Owner ruling 2026-09-27 (draw-devin-brand-claude): Claude decides the brand and its direction (runtimes.yaml
+    # order brand), Codex is the fallback. A decide operation that also produces bytes: when the product has no
+    # mascot, the Codex runtime, the only one carrying the image model ($imagegen), generates one placeholder;
+    # Claude decides the identity and defers that artwork with a brief.
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  decision.prepare:
+    skill: starci
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  docs.author:
+    skill: starci
+    # Authoring reference docs is write-role work over the record tree: the full writing chain.
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  provision.ask:
+    skill: starci
+    # Asking for a provision is naming it exactly and waiting: a mechanical op the hands take — the
+    # implement order (owner routing 2026-09-26).
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  business.decide:
+    skill: starci
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  content.generate:
+    skill: starci
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  code.refactor:
+    skill: starci
+    # Restructuring code under a behaviour invariant is implementation work: the full coding chain.
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  e2e.verify:
+    skill: starci
+    # End-to-end proof is UI verification: the ui order, Sol first with the hands as fallback
+    # (owner routing 2026-09-26).
+    chain: [codex-agent, devin-agent]
+    environments:
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: devin, profiles: [devin-agent]}
+  integration.verify:
+    skill: starci
+    # A live call to a real provider is the same kind of work as the API proof: run code, read the response
+    # back, keep the output. Its hard floor starts the chain at Devin.
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  grammar.update:
+    skill: starci
+    # Growing the installed grammar is code, stories, tests, a published version and a canon entry: hands-on
+    # work at a hard floor on the scaffold order, Devin first (owner decision 2026-09-25).
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  goal.revise:
+    skill: starci
+    # Revising a live goal is a decision about the work, not work on it: the reasoning chain.
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  interface.asset:
+    skill: starci
+    # Generating the artwork a candidate embeds needs the same image model the drawing used, so the chain is
+    # the same single Codex link: a runtime that cannot render an image cannot carry this operation at all.
+    chain: [codex-agent]
+    environments:
+      - {environment: codex, profiles: [codex-agent]}
+  interface.draw:
+    skill: starci
+    # Owner ruling 2026-09-27 (draw-devin-brand-claude): Devin draws - token-render HTML/CSS in the Grammar's tokens
+    # captured by Playwright in the product checkout (its card carries browser-dom) - and Codex (Sol) is the fallback.
+    # No drawer paints raster art: a raster region is an artworkSlot interface.asset generates on Codex's image tool.
+    chain: [devin-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  interface.implement:
+    skill: starci
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  interface.audit:
+    skill: starci
+    # Visual/Grammar conformance is an independent verdict about quality: the ui order, Sol first
+    # (owner routing 2026-09-26). Its browser-dom host tool (route.riskHints) admits only a pool
+    # whose agent card lists it (capabilities.hostTools): Devin and Codex; Claude is passed over.
+    chain: [codex-agent, devin-agent]
+    environments:
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: devin, profiles: [devin-agent]}
+  knowledge.repair:
+    skill: starci
+    # Repairing a canonical rule file is a mechanical op: the implement order (owner routing 2026-09-26).
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  unit.verify:
+    skill: starci
+    # Running the whole unit suite is mechanical, hands-on verify work: the same chain as the performance run.
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  perf.verify:
+    skill: starci
+    # Measuring a performance budget runs the product and reads numbers back: the hands-on verify chain.
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  release.deliver:
+    skill: starci
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  request.analyze:
+    skill: starci
+    # Turning a raw request into a scoped, checkable goal is planning work: the reasoning chain, the cheap pool never.
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  review.verify:
+    skill: starci
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  handover.review:
+    skill: starci
+    # Writing the owner's handover is judging what was delivered and what was not proven: a verdict the hands
+    # give (owner decision 2026-09-25 review-hands), Opus and Sol as overflow.
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  runtime.operate:
+    skill: starci
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  scope.finish:
+    skill: starci
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  scope.define:
+    skill: starci
+    # Cutting a goal into bounded nodes is a decision about the work: the reasoning chain.
+    chain: [claude-agent, codex-agent]
+    environments:
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  security.verify:
+    skill: starci
+    # Auditing code against the security baseline is a verdict about quality: the ui order, Sol first
+    # (owner routing 2026-09-26).
+    chain: [codex-agent, devin-agent]
+    environments:
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: devin, profiles: [devin-agent]}
+  task.execute:
+    skill: starci
+    # A bounded, evidence-grounded workflow selection is a mechanical op: the implement order
+    # (owner routing 2026-09-26).
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  test.author:
+    skill: starci
+    # Authoring the regression check a behaviour-invariant change is measured against is implementation work:
+    # the full coding chain.
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  uat.verify:
+    skill: starci
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  uat.assisted.prepare:
+    skill: starci
+    # Preparation authors deterministic scripts/evidence but performs no product journey.
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+  uat.assisted.verify:
+    skill: starci
+    # Receipt acceptance is an elevated verdict over evidence: the ui order, Sol first
+    # (owner routing 2026-09-26).
+    chain: [codex-agent, devin-agent]
+    environments:
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: devin, profiles: [devin-agent]}
+  work.author:
+    skill: starci
+    # Authoring the Work records - a node's scope and checks, a whole feature's drafts - is authoring the hands
+    # do (owner decision 2026-09-25 review-hands: "work.author" with test/UAT authoring); the kernel's cut
+    # decision (implementation.plan) stays on the think order.
+    chain: [devin-agent, claude-agent, codex-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+  workspace.manage:
+    skill: starci
+    # Workspace bookkeeping is a mechanical op: the implement order (owner routing 2026-09-26).
+    chain: [devin-agent, codex-agent, claude-agent]
+    environments:
+      - {environment: devin, profiles: [devin-agent]}
+      - {environment: codex, profiles: [codex-agent]}
+      - {environment: claude, profiles: [claude-agent]}
+fallback:
+  allowedReasons:
+    - unavailable
+    - quota-exhausted
+    - rate-limited
+    - startup-failure
+    - unsupported
+  requiredEffectState: none
+  blockedReasons:
+    - permission-denied
+    - user-checkpoint
+    - business-ambiguity
+    - safety-block
+    - partial-or-unknown-effects
+selection: |-
+  Orca supplies the observed external-agent inventory. Resolve the selected skill and
+  operator chain from top to bottom, choosing the first ready runtime/profile. Fall through only
+  after an allowed failure with verified no-effect state. This policy never installs an agent,
+  authenticates a provider, grants tools or expands the workflow authority. Every pool launches the one
+  way (modules/kernel/contract-changes/launch-through-worker-start.yaml): `orca orchestration worker-start --agent
+  <runtime> [--model <id> --effort <level>] --spec <prompt>` (Orca files the Task), the unattended flags from Orca's per-agent
+  default args; the launcher takes the agent terminal from the start receipt (else worker-show) and attests the effective agent and model
+  (worker-show). Devin takes no model flag (Orca: --model is for Claude, Codex and Cursor) and starts on its CLI default.
+costPolicy: |-
+  Runtime pools are provider quota windows: the Codex pool carries gpt-6-luna for easy and medium work and
+  gpt-6.1-sol for hard and insane work, the Claude pool carries claude-opus-5-5 for every role,
+  and Devin opens through the owner's default grant (config.yaml allocation.grants). modules/models/runtimes.yaml
+  roleOfKind splits the kinds: strategy (decide, plan and every other think kind that is not a verdict, a
+  kernel call or a mechanical op) runs the Claude pool, then the Codex pool on Sol; the kernel's own model
+  calls walk sol-think - the Codex pool first, the Claude pool as overflow (owner routing 2026-09-26);
+  review - the verify kinds still on the review order and work.author (owner decision 2026-09-25
+  review-hands) - runs the Devin pool, with Claude and Codex as
+  overflow only (the cross-family rule sends a review of Devin's work to them); the ui order leads interface.audit, e2e.verify, security.verify and uat.assisted.verify
+  with the Codex pool, Devin behind it; the mechanical ops - provision.ask, workspace.manage,
+  task.execute and knowledge.repair - walk the implement order the hands serve whatever their kind role;
+  hands-on work runs the Devin and Codex pools with the Claude pool as overflow. brand.decide is think work that also generates a placeholder mascot when the product has none;
+  the Claude pool decides the identity and defers that artwork with a concrete brief, and the Codex pool, the
+  only one with an image generator, generates it when it takes the launch.
+  interface.draw token-renders its shapes (HTML/CSS in the Grammar's tokens, Playwright capture) and walks the
+  draw order: the Devin pool first, the Codex pool as fallback (owner ruling 2026-09-27); its raster regions are
+  artworkSlots, never painted by the drawer. interface.asset generates that artwork and therefore carries the
+  single image-capable Codex route, with no deferral fallback - a deferred
+  slot is exactly what this operation exists to close. grammar.update is the opposite case: it grows the
+  installed grammar as code - a typed unit with its stories, its tests, its published version and its canon
+  entry - so it carries the execution `implement` role at a hard floor; nothing in it is drawn, and a publish
+  is irreversible, so the chain is limited to declared coding runtimes. knowledge.repair rewrites a canonical
+  rule of this runtime and is think work the hands serve on the implement order. Every automatic chain contains only
+  worker-start candidates and advances only after a verified no-effect failure. Agents have explicit turn, wall-time
+  and tool-call ceilings; a ceiling stop is a failed attempt and never proof of completion.
+  Never infer price or quality superiority from a subscription label; benchmark bounded
+  representative operations before proposing another routing change. A native worker is released
+  after its exact worker_done result is accepted; the workflow child remains until integration is
+  complete. The chain does not decide who runs an operation - `modules/models/runtimes.yaml`
+  does, by role preference - so every operator's `environments` must declare every runtime that carries
+  that operation's role and owns a profile for it, and the chain lists exactly those targets so
+  `candidateFor` can answer with a launch shape for whichever runtime the allocator picked. A pool
+  whose roles do not cover an operation's role (Devin carries no `decide`, so they cannot take an
+  `architecture.decide`) stays out of that operator and is excluded from allocation by the roles gate
+  (scripts/agent/models.mjs poolRejectionReasons). The one widening: an order that names a role -
+  `implement` - lets a pool that serves the order take its kinds whatever the kind's own role, which is how
+  the mechanical ops reach the hands.
+assetFallback: When image generation is unavailable, reuse verified assets first; Claude may leave
+  decorative image slots blank with a concrete deferred brief. Never mark missing artwork generated
+  or satisfy a functional criterion with a blank slot.
+examples:
+  codexFrontend:
+    runtime: codex
+    profile: gpt-6.1-sol
+    model: gpt-6.1-sol
+    imageGenerationAvailable: true
+  claudeFrontend:
+    runtime: claude
+    profile: opus
+    model: claude-opus-5-5
+    imageGenerationAvailable: false
+  orcaInterfaceImplementation:
+    skill: starci
+    op: interface.implement
+    availableRuntimes:
+      - codex
+      - claude
+examplesNote: Examples of frontend context.execution only. Set availability from observed host
+  tools, never copy true as proof. Declared exact models still require effective runtime attestation.
+  Orca resolves ordered skill/operator candidates from observed readiness instead.