@tekyzinc/gsd-t 4.4.11 → 4.6.10

package/commands/gsd-t-milestone.md

@@ -14,7 +14,32 @@ The agent defines the milestone — origin, goal, falsifiable success criteria
 
 Read `.gsd-t/progress.md` (current version + completed milestones), `docs/requirements.md`, and `docs/architecture.md` so the new milestone is framed against existing state.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 ```js
 {
@@ -25,7 +50,10 @@ Read `.gsd-t/progress.md` (current version + completed milestones), `docs/requir
   args: {
     phase: "milestone",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map (probe + judge use this).
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
     // M84 Competition Mode is AUTOMATIC — do NOT pass `competition` by default.
     // The workflow probes (opus) and self-decides; milestone decomposition is the
     // highest-altitude decision, so it competes whenever ≥2 genuinely different
@@ -37,7 +65,7 @@ Read `.gsd-t/progress.md` (current version + completed milestones), `docs/requir
 
 **Competition Mode (automatic).** Milestone decomposition auto-competes when the probe finds ≥2 genuinely different strategies. Because a decomposition is a *coupled thesis*, the judge selects one winner whole (pick-one) and salvages only non-overlapping good line-items from the losers — it never Frankensteins. No flag needed; override with `--no-competition` / `--competition N` on explicit request. See `.gsd-t/contracts/competition-mode-contract.md`.
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions }` (plus `competition: { n, winner, ranked }` when Competition Mode ran).
 

package/commands/gsd-t-partition.md

@@ -16,7 +16,39 @@ The agent decomposes the milestone into 2–5 file-disjoint domains, writes `.gs
 
 Read `.gsd-t/progress.md` to determine the active milestone and its defined scope. If a scan exists and is stale (>10 commits or >14 days), the agent refreshes the relevant dimensions before partitioning.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+# Output: { "ok": true, "profile": "...", "overrides": { "stage-key": "concrete-model-id", ... } }
+```
+
+**Resolver-failure handling (M86 — SC(f), pre-mortem c2 #2):** if the resolve call fails
+(`{ok:false}`, spawn error, or the `model-profile` subcommand is not present in the installed
+binary), do NOT silently proceed on the premium fallback. Either:
+- HALT with `blocked-needs-human` and explain the resolver is unavailable; OR
+- Proceed ONLY with a **loud, surfaced warning** that names the effective posture:
+
+  ```
+  ⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+    (configured profile unknown; stale global binary may lack model-profile subcommand)
+  ```
+
+A configured-standard project silently billing premium fable post-promo is the exact inverse of
+the spend-switch goal. Never silently fall through.
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 Call the `Workflow` tool with:
 
@@ -30,7 +62,11 @@ Call the `Workflow` tool with:
     phase: "partition",
     milestone: "M{NN}",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map so the workflow's ?? forms pick up the
+    // profile-tier assignments instead of falling back to the premium literals.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
     // M84 Competition Mode is AUTOMATIC — do NOT pass `competition` by default.
     // The workflow runs a solution-space probe and self-decides whether to fan out
     // N candidate partitions (judged by the file-disjointness oracle). Only pass an
@@ -42,7 +78,7 @@ Call the `Workflow` tool with:
 
 **Competition Mode (automatic).** Partition auto-competes when the workflow's probe finds ≥2 genuinely different ways to carve the domains; the objective file-disjointness oracle judges the candidates and picks the most-parallelizable valid one. No flag needed. Override only on explicit request: `/gsd-t-partition --no-competition` (force single draft) or `--competition N` (force N). See `.gsd-t/contracts/competition-mode-contract.md`.
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions }` (plus `competition: { n, winner, ranked }` when Competition Mode ran).
 

package/commands/gsd-t-plan.md

@@ -14,7 +14,32 @@ For each domain, the agent writes atomic `tasks.md` entries in parallel-executio
 
 Read `.gsd-t/progress.md` and each domain's `scope.md`/`constraints.md`. The partition output is the input to planning.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 ```js
 {
@@ -26,12 +51,15 @@ Read `.gsd-t/progress.md` and each domain's `scope.md`/`constraints.md`. The par
     phase: "plan",
     milestone: "M{NN}",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map (pre-mortem uses this).
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
   }
 }
 ```
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions, traceability?, preMortem? }`.
 

package/commands/gsd-t-prd.md

@@ -14,7 +14,32 @@ The agent takes a user's idea — however rough — reads available GSD-T projec
 
 Read any existing `docs/requirements.md`, `docs/architecture.md`, and `.gsd-t/progress.md`. Capture the user's idea from `$ARGUMENTS`.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 ```js
 {
@@ -25,12 +50,15 @@ Read any existing `docs/requirements.md`, `docs/architecture.md`, and `.gsd-t/pr
   args: {
     phase: "prd",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
   }
 }
 ```
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions }`.
 

package/commands/gsd-t-status.md

@@ -54,6 +54,7 @@ Present a concise status to the user:
 ```
 📊 GSD-T Status: {milestone name}
 Phase: {PARTITIONED | DISCUSSED | PLANNED | EXECUTING | INTEGRATED | VERIFIED}
+Model Profile: {profile-name} [{(default)} if no per-project config set]
 
 Domains:
   {domain-1}: {completed}/{total} tasks {✅ done | 🔄 in progress | ⏳ blocked}
@@ -72,6 +73,19 @@ Recent decisions:
   - {latest decision from Decision Log}
 ```
 
+### Active Model Profile Line (M86 — SC(f): no silent degradation)
+
+The **Model Profile** line MUST always name the active profile — never blank, never an implicit fallback.
+
+- Read `.gsd-t/model-profile.json` in the project root. If the file exists and contains a valid `profile` field (`standard` | `pro` | `premium`), display it by name: `Model Profile: pro`.
+- If the file is absent, display the global default by name with the `(default)` marker: `Model Profile: premium (default)`.
+- If the file is present but malformed or contains an unknown profile, display: `Model Profile: premium (default, config-error)` — never silently promote to the most expensive posture.
+
+Profiles control which workflow stages run on Fable vs. Opus/Sonnet:
+- `standard` — zero Fable stages (pre-M85 posture)
+- `pro` — Fable on red-team + pre-mortem + debug-cycle-2
+- `premium` — all 6 M85 designated Fable stages (full posture, global default)
+
 ### Backlog Section
 
 If `.gsd-t/backlog.md` exists, read and parse it. Show total count and top 3 items (position, title, type). If no backlog file exists, skip the Backlog section entirely. If the backlog file exists but is empty (no entries), show `Backlog: No items`.

package/commands/gsd-t-verify.md

@@ -28,7 +28,36 @@ Per `.gsd-t/contracts/orthogonal-validation-contract.md` v1.0.0 STABLE, the thre
 
 Read `.gsd-t/progress.md` to determine the active milestone.
 
-## Step 2: Invoke the verify Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+# Output: { "ok": true, "profile": "...", "overrides": { "stage-key": "concrete-model-id", ... } }
+```
+
+**Resolver-failure handling (M86 — SC(f), pre-mortem c2 #2):** if the resolve call fails
+(`{ok:false}`, spawn error, or the `model-profile` subcommand is not present in the installed
+binary), do NOT silently proceed on the premium fallback. Either:
+- HALT with `blocked-needs-human` and explain the resolver is unavailable; OR
+- Proceed ONLY with a **loud, surfaced warning** that names the effective posture:
+
+  ```
+  ⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+    (configured profile unknown; stale global binary may lack model-profile subcommand)
+  ```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the verify Workflow
 
 Call the `Workflow` tool with:
 
@@ -41,6 +70,10 @@ Call the `Workflow` tool with:
   args: {
     milestone: "M{NN}",
     projectDir: ".",
+    // M86: inject the resolved overrides map so the workflow's ?? forms (including
+    // red-team) pick up the profile-tier assignments instead of premium literals.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ },
     // Optional: skip /code-review ultra when rate-limited.
     // skipUltra: false,
     // skipUltraReason: "ultra rate-limited per error E429",
@@ -50,7 +83,7 @@ Call the `Workflow` tool with:
 
 `skipUltra: true` requires `skipUltraReason: string` per contract Rule #2. A run with `skipUltra: true` is INELIGIBLE for `VERIFIED` — best attainable verdict is `VERIFIED-WITH-WARNINGS`. Red Team and QA are non-skippable.
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns:
 

package/commands/gsd-t-wave.md

@@ -23,7 +23,35 @@ The native Workflow `workflow()` global runs each sub-workflow inline and return
 
 Read `.gsd-t/progress.md` to determine the active milestone and the wave domain list from `.gsd-t/contracts/m{NN}-integration-points.md`.
 
-## Step 2: Invoke the wave Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+The wave workflow forwards `overrides` to BOTH its `gsd-t-execute` and `gsd-t-verify`
+sub-workflow calls, so the spend switch is active across the full cycle (execute + verify).
+
+## Step 3: Invoke the wave Workflow
 
 Call the `Workflow` tool with:
 
@@ -36,12 +64,15 @@ Call the `Workflow` tool with:
   args: {
     milestone: "M{NN}",
     domains: ["m{NN}-d1-...", "m{NN}-d2-...", ...],  // domains for this wave only, per integration-points
-    projectDir: "."
+    projectDir: ".",
+    // M86: inject the resolved overrides map — forwarded to execute + verify sub-workflows.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
   }
 }
 ```
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 ```js
 {

package/docs/requirements.md

@@ -977,6 +977,12 @@ Supporting contracts (to be written during D1):
 | REQ-M79-02 | `genSystemArchitecture` draws up to 12 real domains from scan data with rounded classDefs. All 5 diagrams rendered with shared `MERMAID_CONFIG` (dark base theme + rounded corners + node padding/spacing) applied via `mmdc -c`, plus `-b transparent`. The Database Schema diagram is suppressed by default (`SUPPRESSED_TYPES`, opt-in via `includeSchemaDiagram` option) because Drizzle schema parsing produces inaccurate results on large repos. | m79-d1 | T3 | complete |
 | REQ-M79-03 | `genSequence` uses `"validate and sanitize"` (unquoted `&` broke the Mermaid sequence parser). `scan.test.js` and `verify-gates.js` reflect the 5-diagrams-by-default contract (schema diagram excluded unless opted-in). | m79-d1 | T4 | complete |
 | REQ-M79-VERIFY | +1 regression test (m79-diagram-quality). Suite 1325/1325 pass. Hilo report regenerated: 5/5 diagrams render, 35 real services, rounded corners present, schema section gone, no placeholders. Patch bump 4.0.26 → 4.0.27. | m79-d1 | T5 | complete |
+| REQ-M86-01 | Three model profiles (standard/pro/premium) as a second dimension over the M85 `STAGE_TIERS` — `PROFILE_STAGE_TIERS` + `resolveProfile` on `bin/gsd-t-model-tier-policy.cjs` (standard = zero fable; pro = red-team + pre-mortem + debug-cycle-2 fable; premium = all 6; producers HELD opus in every profile — M82). Precedence `stageOverrides[stage] ?? profile-tier ?? named global default`, blindness clamps at write AND resolve level, own-property validation (prototype-key bypass killed). | m86-d1 | T1–T5 | complete (M86, v4.5.10) |
+| REQ-M86-02 | Per-project config `.gsd-t/model-profile.json` + `gsd-t model-profile` CLI (show/set/set-stage/resolve/--json). Malformed/hand-edited configs produce defined envelopes with explicit configError — never a silent clean-premium fall-through. set-stage refuses to rewrite erroring configs. | m86-d1 | T2/T5 | complete (M86) |
+| REQ-M86-03 | Invoke-time injection (M69): ALL 10 workflow-invoking commands resolve the active config via the bare `resolve --json` form (stageOverrides WIN) and inject `overrides` into workflow args; designated stages read `model: overrides["<stage>"] ?? "<premium-literal>"`; wave forwards overrides to both sub-workflow calls; resolver-failure = halt or loud named-posture warning, never silent premium. NO tracked-file mutation on profile switch. | m86-d2 | T1–T10 | complete (M86) |
+| REQ-M86-04 | Drift lint unwraps the `??` form: validates bracket key against the 6 INJECTABLE stages (producers excluded), fallback literal against tier set + stage policy, flat AND combined-debug forms, fail-closed; 8 mandatory negatives incl. typo'd key + wrapped-producers + drifted combined-form. Invoker fleet lint pins the injection block + failure clause + configError surfacing + bare resolve form. | m86-d3 (+d2 T10) | lint suites | complete (M86) |
+| REQ-M86-05 | Active profile surfaced NAMED at every surface (SC f): `[GSD-T PROFILE]` banner token (GSD-T projects only), statusline segment, `gsd-t status` line, CLI envelopes — global default named when config absent; hook/statusline resilient to resolver absence/errors (exit 0, `[GSD-T NOW]` intact). | m86-d4 | m86-surfacing | complete (M86) |
+| REQ-M86-06 | Installer self-protection: `copyBinToolsToProject` skips the GSD-T source repo (copy loop AND stray sweep) — propagation must never revert in-flight source work; CLI carries a version-skew guard (structured error on pre-M86 sibling module). | m86-d1 (verify fix) | r2 killing tests | complete (M86) |
 
 ## Updated Functional Requirements (scan findings - v4.0.27)
 
@@ -1037,5 +1043,6 @@ The deep scan identified functional deficiencies not captured in previous requir
 | REQ-M77 | test/m77-renderer-table-summary.test.js | 4 | passing |
 | REQ-M78 | test/m78-plain-english-grouping.test.js | 3 | passing |
 | REQ-M79 | test/m79-diagram-quality.test.js | 1 | passing |
+| REQ-M86-* | test/m86-policy-profiles.test.js, test/m86-invoker-injection.test.js, test/m86-lint-unwrap-fallback.test.js, test/m86-surfacing.test.js, test/m85-workflow-tier-policy-lint.test.js (extended) | 146 | passing |
 
-**Total automated tests (v4.0.27)**: 1325 pass / 0 fail / 4 skip. Runner: `node --test` (zero dependencies). E2E: `playwright.config.ts` at project root, `e2e/` directory with journey, viewer, and live-journey specs.
+**Total automated tests (v4.5.10)**: 1598 pass / 0 fail / 4 skip. Runner: `node --test` (zero dependencies). E2E: `playwright.config.ts` at project root, `e2e/` directory with journey, viewer, and live-journey specs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "4.4.11",
+  "version": "4.6.10",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",

package/scripts/gsd-t-auto-route.js

@@ -10,13 +10,90 @@
  *     dated banner at the top of Claude's response. Fresh per turn so multi-day
  *     sessions and date-rollovers are reflected accurately.
  *
- * Conditionally emits (GSD-T projects only, plain text prompts only):
- *   - [GSD-T AUTO-ROUTE] signal so Claude routes via /gsd
+ * Conditionally emits (GSD-T projects only — dirs with .gsd-t/):
+ *   - [GSD-T PROFILE] {profile} — active model profile (M86). Gated like the
+ *     statusline segment: a model profile is a GSD-T concept; announcing
+ *     "premium (default)" in unrelated directories is noise (Red Team M86 LOW).
+ *   - [GSD-T AUTO-ROUTE] signal so Claude routes via /gsd (plain text prompts
+ *     in projects with .gsd-t/progress.md only)
+ *
+ * NOTE: resolveActiveProfile duplicates the read/validate logic of
+ * readConfig() in bin/gsd-t-model-profile.cjs (the canonical copy) — kept
+ * inline because this hook must be zero-dep and runs from ~/.claude/scripts
+ * where the package module may be absent. Keep the two in sync.
  */
 
 const fs = require("fs");
 const path = require("path");
 
+/**
+ * Resolve the active model profile from .gsd-t/model-profile.json.
+ *
+ * Resilience contract (pre-mortem r1 #7 MEDIUM — hook resilience):
+ *   - Resolver module/binary absent → named global default with (default) marker.
+ *   - Resolver error / malformed config → named global default or "unknown" marker.
+ *   - NEVER throws, NEVER suppresses the [GSD-T NOW] line, NEVER kills auto-routing.
+ *
+ * @param {string} cwd — project root (may be any dir; absent .gsd-t is fine)
+ * @returns {{ profile: string, isDefault: boolean, configError?: string }}
+ */
+function resolveActiveProfile(cwd) {
+  const GLOBAL_DEFAULT = 'premium';
+  const VALID_PROFILES = ['standard', 'pro', 'premium'];
+
+  try {
+    const configPath = path.join(cwd, '.gsd-t', 'model-profile.json');
+    if (!fs.existsSync(configPath)) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true };
+    }
+
+    let raw;
+    try {
+      raw = fs.readFileSync(configPath, 'utf8');
+    } catch (_) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'unreadable' };
+    }
+
+    let config;
+    try {
+      config = JSON.parse(raw);
+    } catch (_) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'invalid-json' };
+    }
+
+    if (!config || typeof config !== 'object' || Array.isArray(config)) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'wrong-type' };
+    }
+
+    const p = config.profile;
+    if (typeof p !== 'string' || !VALID_PROFILES.includes(p)) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'unknown-profile' };
+    }
+
+    return { profile: p, isDefault: false };
+  } catch (_) {
+    // Catch-all: never crash the hook
+    return { profile: GLOBAL_DEFAULT, isDefault: true };
+  }
+}
+
+/**
+ * Format the profile token for the banner.
+ * SC(f): always named — never blank, never an unsurfaced fallback.
+ */
+function profileToken(profileResult) {
+  if (!profileResult || typeof profileResult.profile !== 'string') {
+    return 'profile: unknown';
+  }
+  if (profileResult.configError) {
+    return `profile: ${profileResult.profile} (default, config-error: ${profileResult.configError})`;
+  }
+  if (profileResult.isDefault) {
+    return `profile: ${profileResult.profile} (default)`;
+  }
+  return `profile: ${profileResult.profile}`;
+}
+
 function liveTimestamp(now = new Date()) {
   const day  = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"][now.getDay()];
   const mon  = ["Jan", "Feb", "Mar", "Apr", "May", "Jun",
@@ -32,17 +109,40 @@ function liveTimestamp(now = new Date()) {
   return `${date} ${time}${tzShort ? " " + tzShort : ""}`;
 }
 
+// Hook runtime — guarded so require()-ing this module for unit tests
+// (test/m86-surfacing.test.js) does NOT attach stdin listeners. An unguarded
+// stdin listener holds the requiring test process's event loop open forever
+// (npm test runner children get a never-EOF stdin pipe → suite hang), and the
+// "end" handler's process.exit(0) would kill the test process on stdin EOF.
+if (require.main === module) {
 let input = "";
 process.stdin.setEncoding("utf8");
 process.stdin.on("data", (chunk) => { input += chunk; });
 process.stdin.on("end", () => {
   // Always emit live timestamp first — every turn, every project.
+  // [GSD-T NOW] format is date-guard-invariant: NEVER alter it.
   process.stdout.write(`[GSD-T NOW] ${liveTimestamp()}\n`);
 
+  // Parse stdin ONCE; both the profile token and auto-route reuse it.
+  let data = null;
+  try { data = JSON.parse(input); } catch (_) { /* tolerated — gates below skip */ }
+  const cwd = (data && typeof data.cwd === "string" && data.cwd) ? data.cwd : process.cwd();
+
+  // Emit the active model profile — GSD-T projects only (dirs with .gsd-t/),
+  // matching the statusline gate. SC(f): named, never blank, never a crash.
+  try {
+    if (fs.existsSync(path.join(cwd, ".gsd-t"))) {
+      const profileResult = resolveActiveProfile(cwd);
+      process.stdout.write(`[GSD-T PROFILE] ${profileToken(profileResult)}\n`);
+    }
+  } catch (_) {
+    // Belt-and-suspenders: if the gate or profileToken throws, emit the unknown marker.
+    process.stdout.write(`[GSD-T PROFILE] profile: unknown\n`);
+  }
+
   try {
-    const data = JSON.parse(input);
     // Auto-route is GSD-T-project-only.
-    const cwd = typeof data.cwd === "string" ? data.cwd : process.cwd();
+    if (!data) process.exit(0);
     if (!fs.existsSync(path.join(cwd, ".gsd-t", "progress.md"))) process.exit(0);
     const prompt = (typeof data.prompt === "string" ? data.prompt : "").trimStart();
     if (prompt.startsWith("/")) process.exit(0); // slash command — pass through
@@ -58,5 +158,6 @@ process.stdin.on("end", () => {
   }
   process.exit(0);
 });
+}
 
-module.exports = { liveTimestamp };
+module.exports = { liveTimestamp, resolveActiveProfile, profileToken };

package/scripts/gsd-t-statusline.js

@@ -12,6 +12,11 @@
 // never populated those env vars. When the state file is absent or stale
 // (>5min), the context segment is omitted.
 //
+// Active model profile is read from .gsd-t/model-profile.json (M86 — SC(f):
+// always named, never blank). When the file is absent, the named global default
+// (premium) is shown with a (default) marker. Resilient: never crashes on missing
+// or malformed config (propagation-gap class — pre-mortem c2 #5).
+//
 // Zero external dependencies.
 
 const fs = require('fs');
@@ -26,6 +31,53 @@ const DIM    = '\x1b[2m';
 const BOLD   = '\x1b[1m';
 const ORANGE = '\x1b[38;5;208m'; // 256-color orange
 
+// ─── Profile resolution (M86 — SC(f): always named, never blank) ─────────────
+
+/**
+ * Resolve the active model profile from .gsd-t/model-profile.json.
+ *
+ * Resilience contract (pre-mortem c2 #5 — statusline resilience):
+ *   - Config absent → named global default with (default) marker.
+ *   - Malformed config / parse error → named global default or configError marker.
+ *   - NEVER throws, NEVER crashes the statusline.
+ *
+ * @param {string|null} projectRoot — resolved project root (may be null)
+ * @returns {{ profile: string, isDefault: boolean, configError?: string }|null}
+ *   null when projectRoot is null (non-GSD-T directory — omit segment).
+ */
+// NOTE: duplicates the read/validate logic of readConfig() in bin/gsd-t-model-profile.cjs
+// (the canonical copy) — kept inline because the statusline must be zero-dep and runs from
+// ~/.claude/scripts where the package module may be absent. Keep the copies in sync.
+function readActiveProfile(projectRoot) {
+  if (!projectRoot) return null;
+  const GLOBAL_DEFAULT = 'premium';
+  const VALID_PROFILES = ['standard', 'pro', 'premium'];
+  try {
+    const configPath = path.join(projectRoot, '.gsd-t', 'model-profile.json');
+    if (!fs.existsSync(configPath)) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true };
+    }
+    let raw;
+    try { raw = fs.readFileSync(configPath, 'utf8'); } catch (_) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'unreadable' };
+    }
+    let config;
+    try { config = JSON.parse(raw); } catch (_) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'invalid-json' };
+    }
+    if (!config || typeof config !== 'object' || Array.isArray(config)) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'wrong-type' };
+    }
+    const p = config.profile;
+    if (typeof p !== 'string' || !VALID_PROFILES.includes(p)) {
+      return { profile: GLOBAL_DEFAULT, isDefault: true, configError: 'unknown-profile' };
+    }
+    return { profile: p, isDefault: false };
+  } catch (_) {
+    return { profile: GLOBAL_DEFAULT, isDefault: true };
+  }
+}
+
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
 function findProjectRoot() {
@@ -105,5 +157,24 @@ if (ctxPct !== null) {
   contextPart = ` │ ctx ${contextBar(ctxPct)}`;
 }
 
-const line = `gsd-t │ ${projectPart}${contextPart}`;
+// Active model profile (M86 — SC(f): always named when in a GSD-T project)
+let profilePart = '';
+try {
+  const profileResult = readActiveProfile(root);
+  if (profileResult) {
+    let label;
+    if (profileResult.configError) {
+      label = `${profileResult.profile}* (default)`;  // * signals config error
+    } else if (profileResult.isDefault) {
+      label = `${profileResult.profile} (default)`;
+    } else {
+      label = profileResult.profile;
+    }
+    profilePart = ` │ ${DIM}profile:${RESET} ${label}`;
+  }
+} catch (_) {
+  // Resilience: never crash the statusline
+}
+
+const line = `gsd-t │ ${projectPart}${profilePart}${contextPart}`;
 process.stdout.write(line + '\n');