@starci/hfs 4.0.9 → 4.1.0

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -0,0 +1,168 @@
+# Every spelling the runtime refuses by name, each with what replaced it. engine/removed-vocabulary.mjs reads this file:
+# the config and routing-bias refusals take their names and replacements from it, and the `removed-vocabulary` self-check
+# refuses any of these spellings in text an agent or the owner reads, outside this file, CHANGELOG.md and a block marked
+# `[removed-list]` (CONTRIBUTING.md, "Removing or renaming a spelling").
+# Fields: id; kind (config-key | bias-field | verb | flag | code | vocabulary | file; a file is named by its base name); name (the removed spelling); use (the
+# replacement, worded to finish the sentence "<name> is removed (<use>)"); since (the release that removed it);
+# match (optional regular expression the scan uses instead of the literal name); scan (false when the name is too common
+# a word to scan for).
+kinds: [config-key, bias-field, verb, flag, code, vocabulary, file]
+removed:
+  - id: bias-require
+    kind: bias-field
+    name: require
+    use: 'a requirement is now `only`, which keeps just the named members of the tier chain: write each as "<agent>", "<agent>/<model>" or a {pool, provider, model} selector, e.g. {"only":["claude"]}'
+    since: 1.0.0-alpha.6
+    match: '\brequire\s*:\s*[\[{]|"require"\s*:|\brequire bias\b|\bbias[^\n.]{0,30}`require`'
+  - id: config-models-pools
+    kind: config-key
+    name: models.pools
+    use: 'tiers are ordered member chains in modules/models/tiers.yaml; override one with models.tiers'
+    since: 1.0.0-alpha.6
+  - id: config-models-nonoperation
+    kind: config-key
+    name: models.nonOperation
+    use: 'planner, validator and kernelManager take the frontier tier (modules/models/tiers.yaml seats); remap with models.seats'
+    since: 1.0.0-alpha.6
+  - id: config-models-selection
+    kind: config-key
+    name: models.selection
+    use: 'selection is always quota-aware; there is no key'
+    since: 1.0.0-alpha.6
+  - id: config-allocation-shares
+    kind: config-key
+    name: allocation.shares
+    use: 'the picker balances by models.balance (maxStreak, maxSharePercent); there are no per-provider weights'
+    since: 1.0.0-alpha.6
+    match: 'allocation[. ]shares'
+  - id: config-allocation-windowhours
+    kind: config-key
+    name: allocation.windowHours
+    use: 'balance reads the recent picks of one tier (models.balance); there is no window'
+    since: 1.0.0-alpha.6
+  - id: config-allocation-preferredprovider
+    kind: config-key
+    name: allocation.preferredProvider
+    use: 'an owner preference is a goal routing bias (prefer <agent>)'
+    since: 1.0.0-alpha.6
+    match: 'preferredProvider'
+  - id: config-allocation-policy
+    kind: config-key
+    name: allocation.policy
+    use: 'the picker is the one policy; there is no key'
+    since: 1.0.0-alpha.6
+  - id: config-allocation-mode
+    kind: config-key
+    name: allocation.mode
+    use: 'allocation holds grants only'
+    since: 1.0.0-alpha.6
+  - id: config-kernel-group
+    kind: config-key
+    name: kernel.group
+    use: 'the Kernel takes the high tier; pin with kernel.agent / kernel.model (an `only` bias)'
+    since: 1.0.0-alpha.6
+  - id: config-supervisor-kernel-group
+    kind: config-key
+    name: supervisor.kernel.group
+    use: 'the Supervisor takes the frontier tier; pin with supervisor.kernel.agent / .model (an `only` bias)'
+    since: 1.0.0-alpha.6
+  - id: config-coredebug
+    kind: config-key
+    name: coreDebug
+    use: 'the debug watcher is a /loop of the calling chat, not a seat; the cadence and the worktree alert limit are debugLoop.interval and debugLoop.worktreeLimit'
+    since: 1.0.0-alpha.6
+  - id: config-debug
+    kind: config-key
+    name: debug
+    use: 'the debug watcher is started by the /starci skill in the calling chat; there is no switch (debugLoop.interval sets its cadence)'
+    since: 1.0.0-alpha.6
+    scan: false
+  - id: vocabulary-sol-opus
+    kind: vocabulary
+    name: sol-opus
+    use: 'a pool of two providers is a tier chain of members (modules/models/tiers.yaml)'
+    since: 1.0.0-alpha.6
+  - id: seat-core-debug
+    kind: vocabulary
+    name: core-debug seat
+    use: 'the debug watcher is a /loop of the calling chat running `starci debug digest`'
+    since: 1.0.0-alpha.6
+    match: '\bcore-debug\s+(?:seat|watcher|worker|pass)\b'
+  - id: verb-debug-pass
+    kind: verb
+    name: debug pass
+    use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])debug pass\b'
+  - id: config-supervisor-landgate-push
+    kind: config-key
+    name: supervisor.landGate.push
+    use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
+    since: 1.0.0-alpha.7
+    match: 'landGate\.push\b'
+  - id: flag-land-no-push
+    kind: flag
+    name: --no-push
+    use: 'a land never pushes, so there is nothing to leave unpushed'
+    since: 1.0.0-alpha.7
+  - id: code-landed-push-owed
+    kind: code
+    name: landed-push-owed
+    use: 'a land has no push step; the outcome is landed'
+    since: 1.0.0-alpha.7
+  - id: flag-caller-agent
+    kind: flag
+    name: --caller-agent
+    use: 'the debug digest runs in the calling chat; it takes no caller flag'
+    since: 1.0.0-alpha.6
+  - id: flag-caller-model
+    kind: flag
+    name: --caller-model
+    use: 'the debug digest runs in the calling chat; it takes no caller flag'
+    since: 1.0.0-alpha.6
+  - id: flag-caller-effort
+    kind: flag
+    name: --caller-effort
+    use: 'the debug digest runs in the calling chat; it takes no caller flag'
+    since: 1.0.0-alpha.6
+  - id: code-workflow-debug-not-ready
+    kind: code
+    name: workflow-debug-not-ready
+    use: 'there is no debug seat to be ready; the digest reads the ledger directly'
+    since: 1.0.0-alpha.6
+  - id: file-core-debug
+    kind: file
+    name: core-debug.mjs
+    use: 'the debug watcher is a /loop of the calling chat running `starci debug digest`; the core-watch probe is scripts/reconciler/core-watch.mjs'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])core-debug\.mjs\b'
+  - id: file-debug-pass
+    kind: file
+    name: debug-pass.mjs
+    use: '`starci debug digest` (read-only)'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])debug-pass\.mjs\b'
+  - id: file-caller-context
+    kind: file
+    name: caller-context.mjs
+    use: 'there is no declared caller context; the debug digest runs in the calling chat'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])caller-context\b'
+  - id: file-host-maintenance
+    kind: file
+    name: host-maintenance.md
+    use: 'skills/starci/references/host-startup.md'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])host-maintenance\b'
+  - id: file-sonar-secrets-keys
+    kind: file
+    name: KEYS.md
+    use: 'secret.env.example lists the names of the host secrets; ext/sonar/README.md describes the stack'
+    since: 1.0.0-alpha.7
+    match: '(?<![\w/.-])secrets/KEYS\.md'
+  - id: vocab-example-sonar-token-member
+    kind: vocabulary
+    name: per-example Sonar token custody
+    use: 'the examples are analysed on SonarCloud with the SONAR_TOKEN of the runtime secret.env (runtimeSecrets in their services.sonar declaration)'
+    since: 1.0.0-alpha.7
+    match: 'sonarqube-(?:lite-app|shape-slot|starci-ecommerce-app)-token'

package/runtime/modules/models/registry.yaml

@@ -2,8 +2,8 @@ schema: starci/profile-registry@1
 purpose: >-
   The ONE model catalog of the runtime. Concrete model ids — provider,
   capability tier and per-token price — live under `models`; the provider
-  quota/capacity pools, their roles, concurrency and per-difficulty model pins
-  live under `pools`; every launch target lives under `targets`, carrying
+  quota/capacity pools, their roles and concurrency live under `pools` (which
+  model takes which work is modules/models/tiers.yaml); every launch target lives under `targets`, carrying
   `defaultModel` where it names a single model. No other file in the repo
   states a model id, tier, price or pool: those cite these keys.
 
@@ -54,50 +54,31 @@ models:
   gpt-6-luna:        {provider: codex,  tier: economy,  price: {input: 0.1, output: 0.5, cacheRead: 0.01, cacheWrite: 0.125, source: official}}
   swe-2-max:         {provider: devin,  tier: frontier, price: {input: null, output: null, cacheRead: null, cacheWrite: null, source: unset}}
 
-# The provider quota/capacity pools the allocator serves. `models` pins the launch
-# model per difficulty (easy|medium|hard|insane) — a missing pin is a typed error,
-# never a fallback to a neighbouring tier's model; `defaultModel` is the model a
-# launch takes when no difficulty pin applies. `maxParallel` is the only concurrency
-# authority (registry.yaml executionModel.concurrency).
+# The provider quota/capacity pools the allocator serves. Which model a seat or operation takes is
+# modules/models/tiers.yaml; `defaultModel` is the model a launch takes when it names none. `maxParallel` is
+# the only concurrency authority (registry.yaml executionModel.concurrency).
 pools:
-  # One Codex account window carries both models: Luna is the easy/medium model, Sol the hard and insane one.
-  # Role/tier/tool/quality gates still apply on top of the difficulty pin; an owner allocation changes
-  # capacity, never qualification or effect authority.
+  # One Codex account window carries every Codex model. Role, tool and quality gates still apply on top of tier
+  # membership; an owner allocation changes capacity, never qualification or effect authority.
   codex-agent:
     target: codex-agent
     provider: codex
     roles: [implement, verify, write, decide, plan]
     maxParallel: 10
     defaultModel: gpt-6-luna
-    models:
-      easy: gpt-6-luna
-      medium: gpt-6-luna
-      hard: gpt-6.1-sol
-      insane: gpt-6.1-sol
-    effort:
-      easy: low
-      medium: medium
-      hard: high
-      insane: max
-  # One Claude session/week window, all five roles on the same pinned model at every difficulty. The Claude
-  # CLI lists no models, so the dispatch's model attestation is what proves the claude-opus-5-5 id.
+  # One Claude session/week window, all five roles. The Claude CLI lists no models, so the dispatch's model
+  # attestation is what proves the model id a tier member names.
   claude-agent:
     target: claude-agent
     provider: claude
     roles: [implement, verify, write, decide, plan]
     maxParallel: 6
     defaultModel: claude-opus-5-5
-    models:
-      easy: claude-opus-5-5
-      medium: claude-opus-5-5
-      hard: claude-opus-5-5
-      insane: claude-opus-5-5
   # Devin has no machine-readable account headroom equivalent to Orca's provider windows. Owner-assigned
   # capacity: 10 parallel lanes, opened by the owner's default grant (config.yaml allocation.grants
   # devin-agent=10@implement+verify+write applies to every workflow; once config.yaml declares a grants list,
   # `starci kernel route` rejects a grant-gated pool that list does not open). The CLI's auth/readiness and observed
-  # launch/refusal status are the live capacity signal on top of this cap. swe-2-max is a medium+ agent: no
-  # easy or insane pin, and the easy tier does not list the pool.
+  # launch/refusal status are the live capacity signal on top of this cap.
   devin-agent:
     target: devin-agent
     provider: devin
@@ -106,9 +87,6 @@ pools:
     capacityAuthority: explicit-workflow-quota
     quotaTelemetry: launch-status
     defaultModel: swe-2-max
-    models:
-      medium: swe-2-max
-      hard: swe-2-max
 
 runtimes:
   - codex
@@ -154,9 +132,6 @@ targets:
   # difficulty and whose `defaultModel` covers an unpinned difficulty. A pool target names no model itself.
   codex-agent:
     runtime: codex
-    profiles:
-      working: gpt-6-luna
-      reasoning: gpt-6.1-sol
     orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
   # Launch-only targets: an explicit `--model gpt-6.1-sol` or `--model gpt-6-luna` request reaches that one model
   # on the Codex provider window. They are off every automatic chain; allocation routes the codex-agent pool.
@@ -164,16 +139,10 @@ targets:
   gpt-6.1-sol:
     runtime: codex
     defaultModel: gpt-6.1-sol
-    profiles:
-      working: gpt-6.1-sol
-      reasoning: gpt-6.1-sol
     orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
   gpt-6-luna:
     runtime: codex
     defaultModel: gpt-6-luna
-    profiles:
-      working: gpt-6-luna
-      reasoning: gpt-6-luna
     orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
   # Cursor: Orca agent id `cursor` (binary cursor-agent). A launch-only target like gpt-6.1-sol: off every automatic chain,
   # reached by an explicit `--model auto` (the CLI's default) or any id of the account's `cursor-agent --list-models`.
@@ -183,328 +152,14 @@ targets:
   cursor-agent:
     runtime: cursor
     defaultModel: auto
-    profiles:
-      working: auto
-      reasoning: auto
     orcaLaunch: {agent: cursor}   # orca orchestration worker-start --agent cursor
   claude-agent:
     runtime: claude
-    profiles:
-      working: opus
-      reasoning: opus-reviewer
     orcaLaunch: {agent: claude}   # orca orchestration worker-start --agent claude
   devin-agent:
     runtime: devin
     executionHosts: [orca]
-    profiles:
-      working: devin-worker
-      reasoning: devin-reviewer
     orcaLaunch: {agent: devin}   # orca orchestration worker-start --agent devin
-targetAliases:
-  codex-gpt-6.1-sol: codex-agent
-  codex-gpt-6-luna: codex-agent
-  devin-devin-worker: devin-agent
-  devin-devin-reviewer: devin-agent
-  # Bare model ids that are not targets resolve to the provider-window pool that carries them, so workflow
-  # quota entries land on the right window. gpt-6.1-sol and gpt-6-luna are targets; their `runtime: codex`
-  # names the window.
-  claude-opus: claude-agent
-  claude-opus-5-5: claude-agent
-skills:
-  starci:
-    chains:
-      working:
-        - devin-agent
-        - codex-agent
-        - claude-agent
-      reasoning:
-        - claude-agent
-        - codex-agent
-# An operator whose kind runtimes.yaml roleOfKind marks think work with no declared order carries the
-# think order of runtimes.yaml allocation.preference.think (Opus, then Sol) and nothing else;
-# scripts/route/route-model.mjs refuses any other pool for it. A kind's declared order wins: owner routing
-# 2026-09-26 gives the ui order (Codex, then Devin) to interface.audit, e2e.verify,
-# security.verify and uat.assisted.verify, the implement order (Devin, Codex, Opus) to the
-# mechanical ops provision.ask, workspace.manage, task.execute and knowledge.repair, and sol-think (Sol,
-# Opus overflow) to the kernel's own model calls, which carry no operator entry. Owner decision 2026-09-25
-# (72h scripts/agent/model-scorecard.mjs evidence):
-# hands-on implementation chains lead with Devin; scaffold, docs, content and grammar chains (the
-# roleOfKind order scaffold) lead with Devin; the image-tool chains are Codex alone.
-operators:
-  architecture.decide:
-    skill: starci
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  backend.implement:
-    skill: starci
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  brand.decide:
-    skill: starci
-    # Owner ruling 2026-09-27 (draw-devin-brand-claude): Claude decides the brand and its direction (runtimes.yaml
-    # order brand), Codex is the fallback. A decide operation that also produces bytes: when the product has no
-    # mascot, the Codex runtime, the only one carrying the image model ($imagegen), generates one placeholder;
-    # Claude decides the identity and defers that artwork with a brief.
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  decision.prepare:
-    skill: starci
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  docs.author:
-    skill: starci
-    # Authoring reference docs is write-role work over the record tree: the full writing chain.
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  provision.ask:
-    skill: starci
-    # Asking for a provision is naming it exactly and waiting: a mechanical op the hands take — the
-    # implement order (owner routing 2026-09-26).
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  business.decide:
-    skill: starci
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  content.generate:
-    skill: starci
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  code.refactor:
-    skill: starci
-    # Restructuring code under a behaviour invariant is implementation work: the full coding chain.
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  e2e.verify:
-    skill: starci
-    # End-to-end proof is UI verification: the ui order, Sol first with the hands as fallback
-    # (owner routing 2026-09-26).
-    chain: [codex-agent, devin-agent]
-    environments:
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: devin, profiles: [devin-agent]}
-  integration.verify:
-    skill: starci
-    # A live call to a real provider is the same kind of work as the API proof: run code, read the response
-    # back, keep the output. Its hard floor starts the chain at Devin.
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  grammar.update:
-    skill: starci
-    # Growing the installed grammar is code, stories, tests, a published version and a canon entry: hands-on
-    # work at a hard floor on the scaffold order, Devin first (owner decision 2026-09-25).
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  goal.revise:
-    skill: starci
-    # Revising a live goal is a decision about the work, not work on it: the reasoning chain.
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  interface.asset:
-    skill: starci
-    # Generating the artwork a candidate embeds needs the same image model the drawing used, so the chain is
-    # the same single Codex link: a runtime that cannot render an image cannot carry this operation at all.
-    chain: [codex-agent]
-    environments:
-      - {environment: codex, profiles: [codex-agent]}
-  interface.draw:
-    skill: starci
-    # Owner ruling 2026-09-27 (draw-devin-brand-claude): Devin draws - token-render HTML/CSS in the Grammar's tokens
-    # captured by Playwright in the product checkout (its card carries browser-dom) - and Codex (Sol) is the fallback.
-    # No drawer paints raster art: a raster region is an artworkSlot interface.asset generates on Codex's image tool.
-    chain: [devin-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  interface.implement:
-    skill: starci
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  interface.audit:
-    skill: starci
-    # Visual/Grammar conformance is an independent verdict about quality: the ui order, Sol first
-    # (owner routing 2026-09-26). Its browser-dom host tool (route.riskHints) admits only a pool
-    # whose agent card lists it (capabilities.hostTools): Devin and Codex; Claude is passed over.
-    chain: [codex-agent, devin-agent]
-    environments:
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: devin, profiles: [devin-agent]}
-  knowledge.repair:
-    skill: starci
-    # Repairing a canonical rule file is a mechanical op: the implement order (owner routing 2026-09-26).
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  unit.verify:
-    skill: starci
-    # Running the whole unit suite is mechanical, hands-on verify work: the same chain as the performance run.
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  perf.verify:
-    skill: starci
-    # Measuring a performance budget runs the product and reads numbers back: the hands-on verify chain.
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  release.deliver:
-    skill: starci
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  request.analyze:
-    skill: starci
-    # Turning a raw request into a scoped, checkable goal is planning work: the reasoning chain, the cheap pool never.
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  review.verify:
-    skill: starci
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  handover.review:
-    skill: starci
-    # Writing the owner's handover is judging what was delivered and what was not proven: a verdict the hands
-    # give (owner decision 2026-09-25 review-hands), Opus and Sol as overflow.
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  runtime.operate:
-    skill: starci
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  scope.finish:
-    skill: starci
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  scope.define:
-    skill: starci
-    # Cutting a goal into bounded nodes is a decision about the work: the reasoning chain.
-    chain: [claude-agent, codex-agent]
-    environments:
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  security.verify:
-    skill: starci
-    # Auditing code against the security baseline is a verdict about quality: the ui order, Sol first
-    # (owner routing 2026-09-26).
-    chain: [codex-agent, devin-agent]
-    environments:
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: devin, profiles: [devin-agent]}
-  task.execute:
-    skill: starci
-    # A bounded, evidence-grounded workflow selection is a mechanical op: the implement order
-    # (owner routing 2026-09-26).
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  test.author:
-    skill: starci
-    # Authoring the regression check a behaviour-invariant change is measured against is implementation work:
-    # the full coding chain.
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  uat.verify:
-    skill: starci
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  uat.assisted.prepare:
-    skill: starci
-    # Preparation authors deterministic scripts/evidence but performs no product journey.
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-  uat.assisted.verify:
-    skill: starci
-    # Receipt acceptance is an elevated verdict over evidence: the ui order, Sol first
-    # (owner routing 2026-09-26).
-    chain: [codex-agent, devin-agent]
-    environments:
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: devin, profiles: [devin-agent]}
-  work.author:
-    skill: starci
-    # Authoring the Work records - a node's scope and checks, a whole feature's drafts - is authoring the hands
-    # do (owner decision 2026-09-25 review-hands: "work.author" with test/UAT authoring); the kernel's cut
-    # decision (implementation.plan) stays on the think order.
-    chain: [devin-agent, claude-agent, codex-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: claude, profiles: [claude-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-  workspace.manage:
-    skill: starci
-    # Workspace bookkeeping is a mechanical op: the implement order (owner routing 2026-09-26).
-    chain: [devin-agent, codex-agent, claude-agent]
-    environments:
-      - {environment: devin, profiles: [devin-agent]}
-      - {environment: codex, profiles: [codex-agent]}
-      - {environment: claude, profiles: [claude-agent]}
 fallback:
   allowedReasons:
     - unavailable
@@ -520,52 +175,25 @@ fallback:
     - safety-block
     - partial-or-unknown-effects
 selection: |-
-  Orca supplies the observed external-agent inventory. Resolve the selected skill and
-  operator chain from top to bottom, choosing the first ready runtime/profile. Fall through only
-  after an allowed failure with verified no-effect state. This policy never installs an agent,
-  authenticates a provider, grants tools or expands the workflow authority. Every pool launches the one
-  way (modules/kernel/contract-changes/launch-through-worker-start.yaml): `orca orchestration worker-start --agent
+  Orca supplies the observed external-agent inventory. The tier chain (modules/models/tiers.yaml) names the
+  candidates; a member is taken only when it passes the picker's hard filter and has tokens (scripts/lib/tier-pick.mjs).
+  A launch falls to the next member only after an allowed failure with verified no-effect state. This policy never
+  installs an agent, authenticates a provider, grants tools or expands the workflow authority. Every member launches
+  the one way (modules/kernel/start-workflow.yaml): `orca orchestration worker-start --agent
   <runtime> [--model <id> --effort <level>] --spec <prompt>` (Orca files the Task), the unattended flags from Orca's per-agent
   default args; the launcher takes the agent terminal from the start receipt (else worker-show) and attests the effective agent and model
   (worker-show). Devin takes no model flag (Orca: --model is for Claude, Codex and Cursor) and starts on its CLI default.
 costPolicy: |-
-  Runtime pools are provider quota windows: the Codex pool carries gpt-6-luna for easy and medium work and
-  gpt-6.1-sol for hard and insane work, the Claude pool carries claude-opus-5-5 for every role,
-  and Devin opens through the owner's default grant (config.yaml allocation.grants). modules/models/runtimes.yaml
-  roleOfKind splits the kinds: strategy (decide, plan and every other think kind that is not a verdict, a
-  kernel call or a mechanical op) runs the Claude pool, then the Codex pool on Sol; the kernel's own model
-  calls walk sol-think - the Codex pool first, the Claude pool as overflow (owner routing 2026-09-26);
-  review - the verify kinds still on the review order and work.author (owner decision 2026-09-25
-  review-hands) - runs the Devin pool, with Claude and Codex as
-  overflow only (the cross-family rule sends a review of Devin's work to them); the ui order leads interface.audit, e2e.verify, security.verify and uat.assisted.verify
-  with the Codex pool, Devin behind it; the mechanical ops - provision.ask, workspace.manage,
-  task.execute and knowledge.repair - walk the implement order the hands serve whatever their kind role;
-  hands-on work runs the Devin and Codex pools with the Claude pool as overflow. brand.decide is think work that also generates a placeholder mascot when the product has none;
-  the Claude pool decides the identity and defers that artwork with a concrete brief, and the Codex pool, the
-  only one with an image generator, generates it when it takes the launch.
-  interface.draw token-renders its shapes (HTML/CSS in the Grammar's tokens, Playwright capture) and walks the
-  draw order: the Devin pool first, the Codex pool as fallback (owner ruling 2026-09-27); its raster regions are
-  artworkSlots, never painted by the drawer. interface.asset generates that artwork and therefore carries the
-  single image-capable Codex route, with no deferral fallback - a deferred
-  slot is exactly what this operation exists to close. grammar.update is the opposite case: it grows the
-  installed grammar as code - a typed unit with its stories, its tests, its published version and its canon
-  entry - so it carries the execution `implement` role at a hard floor; nothing in it is drawn, and a publish
-  is irreversible, so the chain is limited to declared coding runtimes. knowledge.repair rewrites a canonical
-  rule of this runtime and is think work the hands serve on the implement order. Every automatic chain contains only
-  worker-start candidates and advances only after a verified no-effect failure. Agents have explicit turn, wall-time
-  and tool-call ceilings; a ceiling stop is a failed attempt and never proof of completion.
-  Never infer price or quality superiority from a subscription label; benchmark bounded
-  representative operations before proposing another routing change. A native worker is released
-  after its exact worker_done result is accepted; the workflow child remains until integration is
-  complete. The chain does not decide who runs an operation - `modules/models/runtimes.yaml`
-  does, by role preference - so every operator's `environments` must declare every runtime that carries
-  that operation's role and owns a profile for it, and the chain lists exactly those targets so
-  `candidateFor` can answer with a launch shape for whichever runtime the allocator picked. A pool
-  whose roles do not cover an operation's role (Devin carries no `decide`, so they cannot take an
-  `architecture.decide`) stays out of that operator and is excluded from allocation by the roles gate
-  (scripts/agent/models.mjs poolRejectionReasons). The one widening: an order that names a role -
-  `implement` - lets a pool that serves the order take its kinds whatever the kind's own role, which is how
-  the mechanical ops reach the hands.
+  Runtime pools are provider quota windows. Which model takes which seat or operation is modules/models/tiers.yaml:
+  a seat or an op difficulty names a tier, a tier is an ordered member chain, and the picker takes the first member
+  with tokens after the owner bias and the balance step. Devin opens through the owner's default grant (config.yaml
+  allocation.grants). Drawing and artwork ops (interface.draw, interface.asset, brand.decide) take the tier of their
+  difficulty like every core op and make images through the headless `starci work imagegen` call, which is picked from the
+  imagegen call tier (tiers.yaml calls, tierUse) and holds one provider slot while it runs. Every automatic launch contains only worker-start candidates and advances only
+  after a verified no-effect failure. Agents have explicit turn, wall-time and tool-call ceilings; a ceiling stop is a
+  failed attempt and never proof of completion. Never infer price or quality superiority from a subscription label;
+  benchmark bounded representative operations before proposing another tier change. A native worker is released
+  after its exact worker_done result is accepted; the workflow child remains until integration is complete.
 assetFallback: When image generation is unavailable, reuse verified assets first; Claude may leave
   decorative image slots blank with a concrete deferred brief. Never mark missing artwork generated
   or satisfy a functional criterion with a blank slot.