@tekyzinc/gsd-t 4.4.11 → 4.6.11

package/CHANGELOG.md

@@ -2,16 +2,27 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
-## [4.4.11] - 2026-06-10 (Playwright No-Focus-Steal — patch)
+## [4.6.11] - 2026-06-16 (Output Style — six named conciseness tics + backlog #33 — patch)
 
-### Added — E2E tests must never steal keyboard focus (all projects)
+### Changed — tightened the CONCISE Output Style rule with six named anti-patterns
 
-Headed Playwright runs on macOS ACTIVATE the browser app and yank keyboard focus from the terminal — regardless of window position, so the old "off-screen window" mitigation stopped screen takeover but not focus theft (reported live from binvoice: extension specs commandeered the cursor on every spec). Root cause of the prior "new-headless can't load MV3 extensions" verdict was a binary mix-up: `headless: true` alone launches the chromium_headless_shell (OLD headless, silently no extensions) and a raw `--headless=new` arg fights it. The fix: `channel: 'chromium'` + `headless: true` selects the FULL build's new headless — extensions load, service workers register, zero windows (binvoice: 21/21 in 9.8s).
+User feedback that replies stayed wordy despite the existing CONCISE rule. Extracted six specific tics — three from live examples, three from the user's own wordy→concise rewrites (binvoice `Wordy Example 1/2.txt`, a labeled before/after set where ~70 wordy lines collapsed to ~25 with identical information) — and added a litmus test. Synced the template to the live global CLAUDE.md (blocks kept identical — ripple invariant). Also added backlog #33 from the binvoice FB-modal debug-loop retrospective.
 
-- `templates/CLAUDE-global.md`: new "Playwright No-Focus-Steal Invariant" section — headless default everywhere, one launch helper owns visibility, `HEADED=1` opt-in only, the channel pitfall documented; mirrored to the live `~/.claude/CLAUDE.md`.
-- `templates/test-helpers/launch-extension.ts`: NEW generalized MV3-extension launch helper (newheadless default / offscreen fallback / HEADED=1), proven in binvoice (commit 87e3233 there).
+- `templates/CLAUDE-global.md`: Output Style block gains six rules — no process narration, no answer sandwich, no affirmation throat-clearing, no honesty theater, a table replaces its prose (never repeats it), ask once — plus a litmus test ("delete any sentence that survives deletion without info loss").
+- `.gsd-t/backlog.md`: #33 firing debug-cycle circuit-breaker + repro-fixture-on-regression + anchor-last scraping stack rule (completes #31/TD-294 from the loop-governance side).
 
-No code-path changes; propagates via `gsd-t update-all` (CLAUDE-global section sync).
+Behavioral/doc-only — no test changes. Suite: 1603/1607 pass, 0 fail.
+
+## [4.6.10] - 2026-06-15 (Installer wiring for status line + low-context cue — minor)
+
+### Added — installer now copies and wires the status line + ctx-cue Stop hook
+
+Both `statusline-command.sh` (the M85 two-line GSD-T status bar) and `scripts/hooks/gsd-t-ctx-cue.sh` (the M85 low-context red banner) were canonical sources but had NO installer copy/wire path — dead source that never reached projects on `install` / `update-all` (the global-bin-propagation-gap pattern). This release wires both into `bin/gsd-t.js` so they propagate, ships the M85/M86 template sync (`templates/CLAUDE-global.md` now matches the live tightened global CLAUDE.md, adding the Output Style + Git Worktree Location sections), and commits the per-project `.gsd-t/model-profile.json` default (`{profile: standard}` — Fable 5 not used; all 6 high-leverage stages run on Opus/Sonnet).
+
+- `bin/gsd-t.js`: `IN_SESSION_HOOKS` gains a `runner` field (`node` default, `bash` for `.sh` hooks); `gsd-t-ctx-cue.sh` registered as a SYNCHRONOUS Stop hook (its banner stdout must reach the terminal — async would swallow it). New `installStatusLine()` copies `statusline-command.sh` to `~/.claude/` and sets `settings.statusLine` only when absent or already ours (never clobbers a custom status line). Both wired into the shared `doInstall` path, so `update` / `update-all` propagate them.
+- `templates/CLAUDE-global.md`: synced to the live global CLAUDE.md (Output Style default-CONCISE + Git Worktree Location MANDATORY sections added; verbose Update-Notices block condensed).
+- `.gsd-t/model-profile.json`: committed default `{profile: standard}`.
+- `test/m86-installer-statusline-ctxcue.test.js`: NEW black-box regression — runs the real installer against a sandbox HOME and asserts statusLine wiring, the bash-runner ctx-cue Stop hook, its synchronous registration, and both file copies.
 
 ## [4.4.10] - 2026-06-09 (M85 Model-Tier Policy + Fable 5 — minor)
 

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v4.4.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v4.5.10** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.
@@ -18,7 +18,7 @@
 **Rigorous User-Journey Coverage + Anti-Drift Test Quality** — `bin/journey-coverage.cjs` regex listener detector + `gsd-t check-coverage` CLI + `scripts/hooks/pre-commit-journey-coverage` commit gate blocks viewer-source commits when uncovered listeners exist. Journey specs in `e2e/journeys/` use functional assertions (zero `toBeVisible`-only tests) per the E2E Test Quality Standard in CLAUDE.md.
 **Universal Playwright Bootstrap + Deterministic UI Enforcement (M50)** — three executable enforcement layers: (1) `bin/playwright-bootstrap.cjs` + `bin/ui-detection.cjs` - idempotent installer detects package manager, installs `@playwright/test` + chromium, scaffolds `e2e/`; (2) Workflow runtime runs `playwright-bootstrap.cjs::installPlaywright()` before any E2E stage when `hasUI && !hasPlaywright`; install failure halts with `blocked-needs-human`; (3) `scripts/hooks/pre-commit-playwright-gate` (opt-in via `gsd-t doctor --install-hooks`) blocks viewer-source commits when staged files are newer than `.gsd-t/.last-playwright-pass`. The `gsd-t setup-playwright [path]` subcommand handles manual install.
 **Visualizer (`/gsd-t-visualize`)** — launches a real-time browser dashboard with dual-pane view: top pane streams the main session, bottom pane streams whichever spawn the user clicks. Left rail shows Live Spawns and Completed (last 100 spawns, status-badged, collapsible). Right rail shows Spawn Plan / Parallelism / Tool Cost. Powered by `gsd-t-stream-feed-server.js` + `gsd-t-dashboard.html`.
-**Surgical model selection** — `bin/model-selector.js` assigns haiku/sonnet/opus/fable per phase via a declarative rules table; `/advisor` escalation path with convention-based fallback. **M85 single-source tier policy:** `bin/gsd-t-model-tier-policy.cjs` is the SINGLE source of truth for model-tier assignments; the 5 highest-leverage stages (solution-space probe, partition probe, competition judge, pre-mortem, Red Team) run on `fable` (Claude Fable 5, tier above Opus); competition producers stay `opus` (M82 blindness); debug escalates cycle-1→opus, cycle-2→fable. Drift is mechanically enforced by the M71-family lint (`test/m85-workflow-tier-policy-lint.test.js`).
+**Surgical model selection** — `bin/model-selector.js` assigns haiku/sonnet/opus/fable per phase via a declarative rules table; `/advisor` escalation path with convention-based fallback. **M85 single-source tier policy:** `bin/gsd-t-model-tier-policy.cjs` is the SINGLE source of truth for model-tier assignments; the 5 highest-leverage stages (solution-space probe, partition probe, competition judge, pre-mortem, Red Team) run on `fable` (Claude Fable 5, tier above Opus); competition producers stay `opus` (M82 blindness); debug escalates cycle-1→opus, cycle-2→fable. Drift is mechanically enforced by the M71-family lint (`test/m85-workflow-tier-policy-lint.test.js`). **M86 model profiles:** `bin/gsd-t-model-profile.cjs` adds a per-project SECOND dimension — three named profiles (`standard` / `pro` / `premium`) that control which stages run on Fable vs. Opus/Sonnet (see [Model Profiles](#model-profiles) below).
 **Token Telemetry** — `gsd-t-calibration-hook.js` records token usage per spawn to `.gsd-t/token-metrics.jsonl` (18-field rows). `gsd-t-token-aggregator.js` aggregates across tasks for the `/gsd-t-metrics` view. Use the native Claude Code `/context` command for live in-session context percentage.
 **Quality North Star** — projects define a `## Quality North Star` section in CLAUDE.md (1–3 sentences, e.g., "This is a published npm library. Every public API must be intuitive and backward-compatible."). `gsd-t-init` auto-detects preset (library/web-app/cli) from package.json signals; `gsd-t-setup` configures it for existing projects. Subagents read it as a quality lens; absent = silent skip (backward compatible).
 **Design Brief Artifact** — during partition, UI/frontend projects (React, Vue, Svelte, Flutter, Tailwind) automatically get `.gsd-t/contracts/design-brief.md` with color palette, typography, spacing system, component patterns, and tone/voice. Non-UI projects skip silently. User-customized briefs are preserved. Referenced in plan phase for visual consistency.
@@ -124,6 +124,12 @@ gsd-t test-data --list [--run ID] [--json]              # M58: list test-data le
 gsd-t test-data --purge --run ID [--dry-run] [--json]   # M58: purge tagged test data after Verify (Step 4.5)
 gsd-t competition-judge --in SPEC.json [--project-dir P] # M82: generate-and-judge selection oracle (partition / generic)
 gsd-t traceability-gate --milestone Mxx [--project-dir P] # M83: plan-phase acceptance-traceability gate (AC → path → killing test)
+
+# Model Profiles (M86 — per-project tier-spend switch)
+gsd-t model-profile show [--json]                        # Show active profile + per-stage resolution
+gsd-t model-profile set <standard|pro|premium>           # Switch the project profile
+gsd-t model-profile set-stage <stage> <tier>             # Per-stage override (M82 blindness clamps enforced)
+gsd-t model-profile resolve --profile <p> [stage] [--json] # Resolve a profile into the overrides envelope
 ```
 
 **Plan Hardening (M83).** The `plan` phase now runs two blocking gates before execute, so a plan can't ship a dead deliverable: a deterministic **acceptance-traceability gate** (`gsd-t traceability-gate` — every AC must bind to a code path + a killing test; the headline capability needs both impl and test) and an adversarial **pre-mortem** agent (opus, fresh-context, predicts edge-case/NFR/dead-deliverable failures and requires a test for each). The temporal dual of the Red Team — attack the design at plan, not just the code at verify. Origin: a build where the headline capability shipped as dead code and burned 4 verify cycles. See `.gsd-t/contracts/plan-hardening-contract.md`.
@@ -233,6 +239,16 @@ This will replace changed command files, back up your CLAUDE.md if customized, a
 | `/gsd-t-backlog-promote` | Refine, classify, launch GSD-T workflow | Manual |
 | `/gsd-t-backlog-settings` | Manage types, apps, categories, defaults | Manual |
 
+### Model Management
+
+| CLI Command | Purpose |
+|-------------|---------|
+| `gsd-t model-profile show [--json]` | Display active profile + per-stage resolution |
+| `gsd-t model-profile set <standard\|pro\|premium>` | Switch the per-project profile |
+| `gsd-t model-profile set-stage <stage> <tier>` | Per-stage override (M82 blindness clamps enforced) |
+| `gsd-t model-profile resolve --profile <p> [stage] [--json]` | Resolve a profile into the overrides envelope |
+| `gsd-t model-tier-policy resolve <stageKey> [--json]` | Resolve a stage key to a concrete model id (M85) |
+
 ### Git Helpers
 
 | Command | Purpose | Auto |
@@ -323,6 +339,44 @@ your-project/
 
 ---
 
+## Model Profiles
+
+M86 adds a per-project **tier-spend switch** as a second dimension over the M85 stage-tier policy. Instead of always running the full Fable posture, you can dial back which stages use Fable vs. Opus/Sonnet to match your cost-vs-quality tradeoff.
+
+### Three named profiles
+
+| Profile | Fable stages | When to use |
+|---------|--------------|-------------|
+| `standard` | None — pre-M85 posture (probes→opus, judge→sonnet, red-team→opus, pre-mortem→opus, debug both cycles→opus) | CI runs, draft milestones, tight budget |
+| `pro` | red-team + pre-mortem + debug-cycle-2 | Targeted quality gates; production-bound milestones |
+| `premium` | All 6 M85 designated stages (global default) | Full posture — highest quality gates |
+
+`competition-producers` is **always `opus`** in every profile (M82 blindness invariant — judge must differ from producers).
+
+### Per-project configuration
+
+```json
+// .gsd-t/model-profile.json
+{ "profile": "pro", "stageOverrides": { "competition-judge": "fable" } }
+```
+
+- `profile` ∈ `standard | pro | premium`. Absent file → global default (`premium`), always NAMED in the banner/statusline (SC(f) — no silent degradation).
+- `stageOverrides` (optional) — per-stage tier that beats the profile.
+- Blindness clamps enforced at resolve time: `competition-producers` is not overridable; `competition-judge` cannot be set equal to the producers' model.
+
+### Surfacing
+
+The active profile is always surfaced in three places:
+- **Session banner**: `[GSD-T PROFILE] profile: pro` (emitted by the UserPromptSubmit hook every turn)
+- **Statusline**: `│ profile: pro` (in `gsd-t-statusline.js`)
+- **`gsd-t status`**: `Model Profile: pro` (in the status report header)
+
+### Out of scope
+
+The session default model (`/model`) is unaffected — profiles govern workflow stages only. The `standard` profile does not disable any workflow step; it only changes which model tier runs them.
+
+---
+
 ## Security
 
 - **Wave mode** spawns phase agents with `bypassPermissions` — agents execute without per-action user approval. Use Level 1 or Level 2 autonomy for sensitive projects to review each phase.

package/bin/gsd-t-model-profile.cjs

@@ -0,0 +1,480 @@
+/**
+ * gsd-t-model-profile.cjs
+ *
+ * Brain for the `gsd-t model-profile` CLI subcommand.
+ * Reads/writes `.gsd-t/model-profile.json` and exposes a profile-aware
+ * resolver that injects concrete model ids into workflow args.
+ *
+ * Zero external runtime deps — installer-package invariant.
+ * No top-level side effects (require-safe).
+ *
+ * Contract: .gsd-t/contracts/model-profile-config-contract.md v1.0.0 STABLE
+ */
+
+'use strict';
+
+const path = require('path');
+const fs   = require('fs');
+const policy = require('./gsd-t-model-tier-policy.cjs');
+
+// Version-skew guard (Red Team M86 r2): if the sibling policy module is an older
+// copy lacking the M86 profile surface (seen live when a pre-M86 propagation pass
+// overwrote it), fail with a STRUCTURED error instead of a raw TypeError at the
+// Object.keys() lines below — the contracted envelope shape even on skew.
+const _missingPolicyExports = ['MODEL_IDS', 'PROFILE_STAGE_TIERS', 'INJECTABLE_STAGES', 'resolveProfile', 'requiresThinkingOmitted']
+  .filter((k) => policy[k] === undefined);
+if (_missingPolicyExports.length) {
+  const msg = `gsd-t-model-tier-policy.cjs is missing the M86 profile surface (${_missingPolicyExports.join(', ')}) — ` +
+    'version skew: an older policy module is installed alongside this CLI. Reinstall/update @tekyzinc/gsd-t.';
+  if (require.main === module) {
+    // The guard runs before flag parsing; honor the output convention manually.
+    if (process.argv.includes('--json')) {
+      process.stdout.write(JSON.stringify({ ok: false, error: msg }) + '\n');
+    } else {
+      process.stderr.write(msg + '\n');
+    }
+    process.exit(1);
+  }
+  throw new Error(msg);
+}
+
+const { MODEL_IDS, PROFILE_STAGE_TIERS, INJECTABLE_STAGES, resolveProfile, requiresThinkingOmitted } = policy;
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+/** The global default profile (SC(f) — named, never blank). */
+const GLOBAL_DEFAULT_PROFILE = 'premium';
+
+/** Valid profile names. */
+const VALID_PROFILES = Object.keys(PROFILE_STAGE_TIERS); // ['standard','pro','premium']
+
+/** Valid tier names. */
+const VALID_TIERS = Object.keys(MODEL_IDS); // ['opus','fable','sonnet','haiku']
+
+/**
+ * Stages that CANNOT be overridden (M82 blindness invariant).
+ * competition-producers is always opus — not injectable.
+ */
+const NON_INJECTABLE_STAGES = ['competition-producers'];
+
+// ---------------------------------------------------------------------------
+// Config read/write helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Read and parse `.gsd-t/model-profile.json` from the given project root.
+ * Returns { ok, profile, stageOverrides, configError? } — never throws.
+ * Absent file → named global default (SC(f)).
+ *
+ * @param {string} projectDir
+ * @returns {{ ok: boolean, profile: string, stageOverrides: Record<string,string>, configError?: string }}
+ */
+function readConfig(projectDir) {
+  const configPath = path.join(projectDir, '.gsd-t', 'model-profile.json');
+
+  if (!fs.existsSync(configPath)) {
+    return { ok: true, profile: GLOBAL_DEFAULT_PROFILE, stageOverrides: {} };
+  }
+
+  let raw;
+  try {
+    raw = fs.readFileSync(configPath, 'utf8');
+  } catch (err) {
+    return {
+      ok: false,
+      profile: GLOBAL_DEFAULT_PROFILE,
+      stageOverrides: {},
+      configError: `Failed to read config file: ${err.message}`,
+    };
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return {
+      ok: false,
+      profile: GLOBAL_DEFAULT_PROFILE,
+      stageOverrides: {},
+      configError: `model-profile.json is not valid JSON: ${err.message}`,
+    };
+  }
+
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return {
+      ok: false,
+      profile: GLOBAL_DEFAULT_PROFILE,
+      stageOverrides: {},
+      configError: 'model-profile.json must be a JSON object',
+    };
+  }
+
+  // Validate profile field
+  let profile = GLOBAL_DEFAULT_PROFILE;
+  let configError;
+  if ('profile' in parsed) {
+    if (typeof parsed.profile !== 'string') {
+      configError = `model-profile.json "profile" field must be a string, got ${typeof parsed.profile}`;
+    } else if (!VALID_PROFILES.includes(parsed.profile)) {
+      configError = `model-profile.json "profile" is unknown: "${parsed.profile}"; defaulting to "${GLOBAL_DEFAULT_PROFILE}"`;
+    } else {
+      profile = parsed.profile;
+    }
+  }
+
+  // Validate stageOverrides field. Per-entry validation is OWN-PROPERTY and
+  // membership-based — a string that merely indexes something truthy (e.g.
+  // "constructor") is NOT a valid tier (Red Team M86 HIGH: prototype-key tier
+  // values produced a clean envelope with the stage silently dropped → the
+  // workflow fallback billed premium on a cost-control profile).
+  let stageOverrides = {};
+  if ('stageOverrides' in parsed) {
+    if (parsed.stageOverrides === null || typeof parsed.stageOverrides !== 'object' || Array.isArray(parsed.stageOverrides)) {
+      configError = configError || `model-profile.json "stageOverrides" must be an object`;
+    } else {
+      for (const [k, v] of Object.entries(parsed.stageOverrides)) {
+        if (NON_INJECTABLE_STAGES.includes(k)) {
+          configError = configError || `model-profile.json stageOverrides["${k}"]: competition-producers is not overridable (M82); entry ignored`;
+        } else if (!INJECTABLE_STAGES.includes(k)) {
+          configError = configError || `model-profile.json stageOverrides has unknown stage "${k}"; entry ignored`;
+        } else if (typeof v !== 'string' || !VALID_TIERS.includes(v)) {
+          configError = configError || `model-profile.json stageOverrides["${k}"] has invalid tier ${JSON.stringify(v)}; entry ignored`;
+        } else {
+          stageOverrides[k] = v;
+        }
+      }
+    }
+  }
+
+  if (configError) {
+    return { ok: false, profile, stageOverrides, configError };
+  }
+
+  return { ok: true, profile, stageOverrides };
+}
+
+/**
+ * Write `.gsd-t/model-profile.json`.
+ *
+ * @param {string} projectDir
+ * @param {{ profile?: string, stageOverrides?: Record<string,string> }} data
+ * @returns {{ ok: boolean, error?: string }}
+ */
+function writeConfig(projectDir, data) {
+  const dir = path.join(projectDir, '.gsd-t');
+  const configPath = path.join(dir, 'model-profile.json');
+
+  try {
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(configPath, JSON.stringify(data, null, 2) + '\n', 'utf8');
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Blindness clamp validation (enforced at WRITE and at RESOLVE)
+// ---------------------------------------------------------------------------
+
+/**
+ * Validate that a set-stage operation is permitted.
+ * Returns { ok, error? } — does NOT throw.
+ *
+ * Clamps:
+ *   - competition-producers: not overridable (M82 blindness invariant)
+ *   - competition-judge = opus (producers' model): judge ≠ producers (M82)
+ *
+ * @param {string} stageKey
+ * @param {string} tier
+ * @returns {{ ok: boolean, error?: string }}
+ */
+function validateSetStage(stageKey, tier) {
+  if (NON_INJECTABLE_STAGES.includes(stageKey)) {
+    return {
+      ok: false,
+      error: `Stage "${stageKey}" is not overridable (M82 blindness invariant — competition-producers is always held at opus)`,
+    };
+  }
+
+  // Unknown stage keys are rejected, not persisted (Red Team M86 MEDIUM: a typo'd
+  // stage got a success message + a persisted override that never takes effect,
+  // and `show` silently hid it).
+  if (!INJECTABLE_STAGES.includes(stageKey)) {
+    return {
+      ok: false,
+      error: `Unknown stage "${stageKey}". Injectable stages: ${INJECTABLE_STAGES.join(', ')}`,
+    };
+  }
+
+  if (!VALID_TIERS.includes(tier)) {
+    return {
+      ok: false,
+      error: `Unknown tier "${tier}". Valid tiers: ${VALID_TIERS.join(', ')}`,
+    };
+  }
+
+  if (stageKey === 'competition-judge' && MODEL_IDS[tier] === MODEL_IDS.opus) {
+    return {
+      ok: false,
+      error: `competition-judge cannot be set to "${tier}" (resolves to "${MODEL_IDS[tier]}") — judge model must differ from producers' model (M82 blindness invariant)`,
+    };
+  }
+
+  return { ok: true };
+}
+
+// ---------------------------------------------------------------------------
+// Resolve envelope builder (the seam D2/D4 consume)
+// ---------------------------------------------------------------------------
+
+/**
+ * Build the full resolve envelope for a profile + stageOverrides combo.
+ * Enforces blindness clamps at resolve time (hand-edited configs are safe).
+ *
+ * @param {string} profile
+ * @param {Record<string,string>} stageOverrides
+ * @param {string} [specificStage] — if given, return single-stage result
+ * @param {string} [configError] — propagate from config read
+ * @returns {object}
+ */
+function buildResolveEnvelope(profile, stageOverrides, specificStage, configError) {
+  // Validate profile
+  if (!VALID_PROFILES.includes(profile)) {
+    return { ok: false, error: `Unknown profile "${profile}". Valid profiles: ${VALID_PROFILES.join(', ')}` };
+  }
+
+  // If a specific stage is requested
+  if (specificStage !== undefined) {
+    // Unknown stage → explicit error (Red Team M86 MEDIUM: silently returning
+    // ok:true sonnet for a typo'd stage regressed the M85 explicit unknown-stage error).
+    if (specificStage !== 'competition-producers' && !INJECTABLE_STAGES.includes(specificStage)) {
+      return {
+        ok: false,
+        error: `Unknown stage "${specificStage}". Valid stages: ${INJECTABLE_STAGES.join(', ')}, competition-producers`,
+      };
+    }
+    if (specificStage === 'competition-producers') {
+      const modelId = MODEL_IDS.opus;
+      const result = { ok: true, profile, stage: specificStage, model: modelId, requiresThinkingOmitted: requiresThinkingOmitted(modelId) };
+      if (configError) result.configError = configError;
+      return result;
+    }
+    const r = resolveProfile(specificStage, { profile, stageOverrides });
+    const result = { ok: true, profile, stage: specificStage, model: r.model, requiresThinkingOmitted: r.requiresThinkingOmitted };
+    if (r.configError) result.configError = r.configError;
+    else if (configError) result.configError = configError;
+    return result;
+  }
+
+  // Build overrides map for all injectable stages
+  const overrides = {};
+  const thinkingMap = {};
+  let envelopeConfigError = configError;
+
+  for (const stage of INJECTABLE_STAGES) {
+    const r = resolveProfile(stage, { profile, stageOverrides });
+    overrides[stage] = r.model;
+    thinkingMap[stage] = r.requiresThinkingOmitted;
+    if (r.configError && !envelopeConfigError) envelopeConfigError = r.configError;
+  }
+
+  // Verify competition-judge !== producers' model (final assertion)
+  if (overrides['competition-judge'] === MODEL_IDS.opus) {
+    // This should never reach here (resolveProfile clamps it), but defense in depth
+    envelopeConfigError = envelopeConfigError || 'blindness clamp: competition-judge resolved to producers model — using profile fallback';
+    const fallbackR = resolveProfile('competition-judge', { profile, stageOverrides: {} });
+    overrides['competition-judge'] = fallbackR.model;
+    thinkingMap['competition-judge'] = fallbackR.requiresThinkingOmitted;
+  }
+
+  const result = {
+    ok: true,
+    profile,
+    overrides,
+    requiresThinkingOmitted: thinkingMap,
+  };
+  if (envelopeConfigError) result.configError = envelopeConfigError;
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// CLI dispatch
+// ---------------------------------------------------------------------------
+
+if (require.main === module) {
+  const rawArgs = process.argv.slice(2);
+  const jsonFlag = rawArgs.includes('--json');
+  const positional = rawArgs.filter(a => !a.startsWith('-'));
+  const subcommand = positional[0];
+
+  // Detect project dir: look for .gsd-t relative to cwd
+  const projectDir = process.cwd();
+
+  function emit(obj, exitCode) {
+    if (jsonFlag) {
+      process.stdout.write(JSON.stringify(obj) + '\n');
+    } else {
+      if (!obj.ok) {
+        process.stderr.write((obj.error || obj.configError || 'Unknown error') + '\n');
+      } else {
+        // Human-readable output
+        if (obj.message) process.stdout.write(obj.message + '\n');
+        if (obj.warning) process.stderr.write(`warning: ${obj.warning}\n`);
+        if (obj.profile !== undefined && obj.overrides !== undefined) {
+          process.stdout.write(`profile: ${obj.profile}\n`);
+          for (const [k, v] of Object.entries(obj.overrides)) {
+            process.stdout.write(`  ${k}: ${v}${obj.requiresThinkingOmitted[k] ? ' (requiresThinkingOmitted)' : ''}\n`);
+          }
+          if (obj.configError) process.stderr.write(`warning: ${obj.configError}\n`);
+        } else if (obj.model !== undefined) {
+          process.stdout.write(`model: ${obj.model}\n`);
+          if (obj.requiresThinkingOmitted) process.stdout.write(`requiresThinkingOmitted: true\n`);
+          if (obj.configError) process.stderr.write(`warning: ${obj.configError}\n`);
+        } else {
+          process.stdout.write(JSON.stringify(obj, null, 2) + '\n');
+        }
+      }
+    }
+    process.exit(exitCode !== undefined ? exitCode : (obj.ok ? 0 : 1));
+  }
+
+  if (subcommand === 'show') {
+    const cfg = readConfig(projectDir);
+    if (!cfg.ok && cfg.configError) {
+      emit({ ok: false, error: cfg.configError, profile: cfg.profile, stageOverrides: cfg.stageOverrides }, 1);
+    } else {
+      const envelope = buildResolveEnvelope(cfg.profile, cfg.stageOverrides, undefined, cfg.configError);
+      emit(envelope);
+    }
+  } else if (subcommand === 'set') {
+    const newProfile = positional[1];
+    if (!newProfile) {
+      emit({ ok: false, error: 'Usage: gsd-t model-profile set <profile>' }, 1);
+      return;
+    }
+    if (!VALID_PROFILES.includes(newProfile)) {
+      emit({ ok: false, error: `Unknown profile "${newProfile}". Valid profiles: ${VALID_PROFILES.join(', ')}` }, 1);
+      return;
+    }
+    const cfg = readConfig(projectDir);
+    // Setting the profile is the user's explicit intent — proceed even over a
+    // config with errors, but NAME what the rewrite normalizes away (Red Team
+    // M86 r2 LOW: a silent rewrite dropped invalid entries with no mention).
+    const newData = { profile: newProfile, stageOverrides: cfg.stageOverrides || {} };
+    const result = writeConfig(projectDir, newData);
+    if (!result.ok) {
+      emit({ ok: false, error: result.error }, 1);
+    } else {
+      const out = { ok: true, profile: newProfile, message: `Profile set to "${newProfile}"` };
+      if (cfg.configError) out.warning = `previous config had an error and was normalized: ${cfg.configError}`;
+      emit(out);
+    }
+  } else if (subcommand === 'set-stage') {
+    const stage = positional[1];
+    const tier  = positional[2];
+    if (!stage || !tier) {
+      emit({ ok: false, error: 'Usage: gsd-t model-profile set-stage <stage> <tier>' }, 1);
+      return;
+    }
+    const valid = validateSetStage(stage, tier);
+    if (!valid.ok) {
+      emit({ ok: false, error: valid.error }, 1);
+      return;
+    }
+    const cfg = readConfig(projectDir);
+    // REFUSE to rewrite over an erroring config (Red Team M86 r2 MEDIUM: the
+    // rewrite persisted readConfig's defaulted "premium" over a typo'd
+    // standard-intent profile — a stage tweak silently ESCALATING the spend
+    // posture — and silently dropped invalid entries). set-stage must never
+    // change the profile as a side effect; fix the config (or run `set`) first.
+    if (cfg.configError) {
+      emit({
+        ok: false,
+        error: `config has an error — refusing to rewrite (a rewrite would persist normalized values the user never set): ${cfg.configError}. ` +
+          `Fix .gsd-t/model-profile.json or run \`gsd-t model-profile set <profile>\` first.`,
+      }, 1);
+      return;
+    }
+    const newOverrides = Object.assign({}, cfg.stageOverrides || {}, { [stage]: tier });
+    const newData = { profile: cfg.profile, stageOverrides: newOverrides };
+    const result = writeConfig(projectDir, newData);
+    if (!result.ok) {
+      emit({ ok: false, error: result.error }, 1);
+    } else {
+      emit({ ok: true, stage, tier, model: MODEL_IDS[tier], message: `Stage "${stage}" override set to tier "${tier}" (${MODEL_IDS[tier]})` });
+    }
+  } else if (subcommand === 'resolve') {
+    // Flags: --profile <p> [stage]
+    const profileFlagIdx = rawArgs.indexOf('--profile');
+    let profileArg;
+    if (profileFlagIdx !== -1 && rawArgs[profileFlagIdx + 1] && !rawArgs[profileFlagIdx + 1].startsWith('-')) {
+      profileArg = rawArgs[profileFlagIdx + 1];
+    }
+
+    // Determine profile: from --profile flag, or from config file
+    let profile, stageOverrides, configError;
+    if (profileArg) {
+      if (!VALID_PROFILES.includes(profileArg)) {
+        emit({ ok: false, error: `Unknown profile "${profileArg}". Valid profiles: ${VALID_PROFILES.join(', ')}` }, 1);
+        return;
+      }
+      profile = profileArg;
+      stageOverrides = {};
+    } else {
+      const cfg = readConfig(projectDir);
+      profile = cfg.profile;
+      stageOverrides = cfg.stageOverrides;
+      configError = cfg.configError;
+      if (!cfg.ok) {
+        emit({ ok: false, error: configError || 'Failed to read config' }, 1);
+        return;
+      }
+    }
+
+    // Optional specific stage as a positional arg AFTER 'resolve', excluding
+    // the value of --profile <p> from the positional array.
+    // rawArgs example: ['resolve', '--profile', 'pro', 'red-team', '--json']
+    // We want 'red-team' but not 'pro' (consumed by --profile flag).
+    const profileFlagValuesToExclude = new Set();
+    if (profileFlagIdx !== -1 && rawArgs[profileFlagIdx + 1] && !rawArgs[profileFlagIdx + 1].startsWith('-')) {
+      profileFlagValuesToExclude.add(rawArgs[profileFlagIdx + 1]);
+    }
+    const resolvePositional = rawArgs.filter((a, i) => {
+      if (a.startsWith('-')) return false;
+      // exclude the value immediately following --profile
+      if (profileFlagIdx !== -1 && i === profileFlagIdx + 1) return false;
+      return true;
+    });
+    // resolvePositional[0] = 'resolve', [1] = optional stage
+    const specificStage = resolvePositional[1];
+
+    const envelope = buildResolveEnvelope(profile, stageOverrides, specificStage, configError);
+    emit(envelope);
+  } else {
+    const usage = 'Usage: gsd-t model-profile <show|set <profile>|set-stage <stage> <tier>|resolve [--profile <p>] [stage]> [--json]';
+    if (jsonFlag) {
+      process.stdout.write(JSON.stringify({ ok: false, error: usage }) + '\n');
+    } else {
+      process.stderr.write(usage + '\n');
+    }
+    process.exit(1);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Exports (for require() consumers and tests)
+// ---------------------------------------------------------------------------
+
+module.exports = {
+  GLOBAL_DEFAULT_PROFILE,
+  VALID_PROFILES,
+  VALID_TIERS,
+  NON_INJECTABLE_STAGES,
+  readConfig,
+  writeConfig,
+  validateSetStage,
+  buildResolveEnvelope,
+};