@tekyzinc/gsd-t 4.4.11 → 4.6.11

package/bin/gsd-t-model-tier-policy.cjs

@@ -5,7 +5,7 @@
  * Zero external runtime deps — installer-package invariant.
  * No top-level side effects.
  *
- * Contract: .gsd-t/contracts/model-tier-policy-contract.md v1.0.0 STABLE
+ * Contract: .gsd-t/contracts/model-tier-policy-contract.md v1.1.0 STABLE
  */
 
 'use strict';
@@ -91,6 +91,158 @@ function resolve(stageKey) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Profile Dimension (M86 — additive over the frozen M85 STAGE_TIERS)
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen profile → stage-key → tier map.
+ *
+ * Three named profiles:
+ *   standard  — ZERO fable (pre-M85 tiers: probes→opus, judge→sonnet,
+ *                pre-mortem→opus, red-team→opus, debug both cycles→opus).
+ *   pro       — red-team + pre-mortem + debug-cycle-2 → fable; everything
+ *                else reverts to standard.
+ *   premium   — all 6 M85 fable stages (the full M85 posture).
+ *
+ * competition-producers is HELD at opus in ALL profiles (M82 blindness
+ * invariant — never fable). It is NOT included here because it is never
+ * overridable; the resolver enforces this separately.
+ *
+ * @type {Readonly<Record<string, Readonly<Record<string, string>>>>}
+ */
+const PROFILE_STAGE_TIERS = Object.freeze({
+  standard: Object.freeze({
+    'solution-space-probe': 'opus',
+    'partition-probe':      'opus',
+    'competition-judge':    'sonnet',
+    'pre-mortem':           'opus',
+    'red-team':             'opus',
+    'debug-cycle-2':        'opus',
+  }),
+  pro: Object.freeze({
+    'solution-space-probe': 'opus',
+    'partition-probe':      'opus',
+    'competition-judge':    'sonnet',
+    'pre-mortem':           'fable',
+    'red-team':             'fable',
+    'debug-cycle-2':        'fable',
+  }),
+  premium: Object.freeze({
+    'solution-space-probe': 'fable',
+    'partition-probe':      'fable',
+    'competition-judge':    'fable',
+    'pre-mortem':           'fable',
+    'red-team':             'fable',
+    'debug-cycle-2':        'fable',
+  }),
+});
+
+/** The 6 injectable designated stages (competition-producers excluded). */
+const INJECTABLE_STAGES = Object.freeze([
+  'solution-space-probe',
+  'partition-probe',
+  'competition-judge',
+  'pre-mortem',
+  'red-team',
+  'debug-cycle-2',
+]);
+
+/** The HELD producers model id — used by blindness clamps. */
+const PRODUCERS_MODEL_ID = MODEL_IDS.opus; // claude-opus-4-8
+
+/**
+ * Resolves the concrete model id for a given stage key under a profile,
+ * honoring precedence: stageOverrides[stage] ?? profile-tier ?? global-default.
+ *
+ * Blindness clamps (M82 / pre-mortem c2 #4 — enforced at RESOLVE, not only at
+ * write time because the config file is hand-editable):
+ *   - competition-producers key in stageOverrides: silently dropped (never in overrides map).
+ *   - competition-judge resolved to the producers' model id: BLOCKED — drops the override
+ *     and uses the profile tier for competition-judge instead.
+ *
+ * @param {string} stageKey
+ * @param {{ profile?: string, stageOverrides?: Record<string,string> }} opts
+ * @returns {{ model: string, tier: string, requiresThinkingOmitted: boolean,
+ *             configError?: string }}
+ */
+// Own-property lookup guard. Validation-by-truthiness (`!MODEL_IDS[x]`) is a
+// validation BYPASS for Object.prototype keys ("constructor", "toString", …):
+// the inherited value is truthy, the resolved "model" is a function, and
+// JSON.stringify silently DROPS the key from the envelope — the workflow's
+// `?? "fable"` fallback then bills premium on a cost-control profile
+// (Red Team M86 HIGH). Every tier/profile/stage map lookup goes through this.
+function hasOwn(obj, key) {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function resolveProfile(stageKey, opts) {
+  opts = opts || {};
+  const profileValid = typeof opts.profile === 'string' && hasOwn(PROFILE_STAGE_TIERS, opts.profile);
+  const profile = profileValid ? opts.profile : 'premium'; // named global default
+
+  const stageOverrides = (opts.stageOverrides && typeof opts.stageOverrides === 'object' && !Array.isArray(opts.stageOverrides))
+    ? opts.stageOverrides
+    : {};
+
+  // competition-producers is held at opus — not resolvable via profile dimension.
+  if (stageKey === 'competition-producers') {
+    return {
+      model: PRODUCERS_MODEL_ID,
+      tier: 'opus',
+      requiresThinkingOmitted: requiresThinkingOmitted(PRODUCERS_MODEL_ID),
+    };
+  }
+
+  // Resolve tier from precedence chain:
+  // 1. stageOverrides[stage] if it's a valid tier and not a blindness violation
+  // 2. profile-tier
+  // global-default (premium) is the fallback when profile is unknown — MARKED,
+  // never silent (Red Team M86 r2 LOW: library callers bypassing readConfig got
+  // silent premium for an invalid profile).
+
+  const profileTierMap = PROFILE_STAGE_TIERS[profile];
+  const stageKnown = hasOwn(profileTierMap, stageKey);
+  const errors = [];
+  if (!profileValid && opts.profile !== undefined) {
+    errors.push(`unknown profile "${opts.profile}" — using the named global default "premium"`);
+  }
+  if (!stageKnown) {
+    // Unknown stage key — defensive sonnet, but NEVER silently (Red Team M86 MEDIUM:
+    // a typo'd stage returning ok:true sonnet regressed the M85 explicit unknown-stage error)
+    errors.push(`unknown stage "${stageKey}" — not a designated stage; defensive sonnet fallback`);
+  }
+  let resolvedTier;
+
+  const rawOverrideTier = hasOwn(stageOverrides, stageKey) ? stageOverrides[stageKey] : undefined;
+  if (rawOverrideTier !== undefined) {
+    if (typeof rawOverrideTier !== 'string' || !hasOwn(MODEL_IDS, rawOverrideTier)) {
+      // Invalid tier in override — fall back to profile tier, record configError.
+      // The fallback for an UNKNOWN stage is the cheap defensive tier, never fable
+      // (Red Team M86 r2 LOW: unknown stage + invalid override resolved fable on standard).
+      errors.push(`stageOverrides["${stageKey}"] has invalid tier "${rawOverrideTier}"; falling back to profile tier`);
+      resolvedTier = stageKnown ? profileTierMap[stageKey] : 'sonnet';
+    } else if (stageKey === 'competition-judge' && MODEL_IDS[rawOverrideTier] === PRODUCERS_MODEL_ID) {
+      // Blindness clamp: competition-judge must not equal producers' model
+      errors.push(`stageOverrides["competition-judge"] resolves to "${MODEL_IDS[rawOverrideTier]}" (=producers' model); blindness clamp rejected — falling back to profile tier`);
+      resolvedTier = stageKnown ? profileTierMap[stageKey] : 'sonnet';
+    } else {
+      resolvedTier = rawOverrideTier;
+    }
+  } else {
+    resolvedTier = stageKnown ? profileTierMap[stageKey] : 'sonnet';
+  }
+
+  const modelId = hasOwn(MODEL_IDS, resolvedTier) ? MODEL_IDS[resolvedTier] : MODEL_IDS.sonnet;
+  const result = {
+    model: modelId,
+    tier: resolvedTier,
+    requiresThinkingOmitted: requiresThinkingOmitted(modelId),
+  };
+  if (errors.length) result.configError = errors.join('; ');
+  return result;
+}
+
 // ---------------------------------------------------------------------------
 // Exports
 // ---------------------------------------------------------------------------
@@ -98,8 +250,11 @@ function resolve(stageKey) {
 module.exports = {
   MODEL_IDS,
   STAGE_TIERS,
+  PROFILE_STAGE_TIERS,
+  INJECTABLE_STAGES,
   requiresThinkingOmitted,
   resolve,
+  resolveProfile,
 };
 
 // ---------------------------------------------------------------------------

package/bin/gsd-t.js

@@ -1011,12 +1011,17 @@ function configureAutoRouteHook(scriptPath) {
 const HOOKS_DIR = path.join(SCRIPTS_DIR, "hooks");
 const PKG_HOOKS = path.join(PKG_SCRIPTS, "hooks");
 
-// Each entry: { script, events, async } — `events` is the array of hook event
-// names this script must be wired into. The `gsd-t-conversation-capture.js`
-// hook runs on SessionStart, UserPromptSubmit, and Stop (per the global
-// CLAUDE.md M45 D2 install block — PostToolUse stays opt-in via the
-// GSD_T_CAPTURE_TOOL_USES env flag, so we don't auto-register it).
-// `gsd-t-in-session-usage-hook.js` runs on Stop (per M43 D1 contract).
+// Each entry: { script, events, async, runner } — `events` is the array of hook
+// event names this script must be wired into. `runner` is the interpreter
+// ("node" default, "bash" for *.sh hooks). `async: true` lets the hook run
+// detached; OMIT it for hooks whose stdout must reach the terminal (the
+// ctx-cue banner is synchronous by design — see its header).
+// The `gsd-t-conversation-capture.js` hook runs on SessionStart,
+// UserPromptSubmit, and Stop (per the global CLAUDE.md M45 D2 install block —
+// PostToolUse stays opt-in via the GSD_T_CAPTURE_TOOL_USES env flag, so we
+// don't auto-register it). `gsd-t-in-session-usage-hook.js` runs on Stop (per
+// M43 D1 contract). `gsd-t-ctx-cue.sh` runs synchronously on Stop (M85 —
+// low-context red banner; sync so its stdout reaches the terminal).
 const IN_SESSION_HOOKS = [
   {
     script: "gsd-t-conversation-capture.js",
@@ -1028,6 +1033,11 @@ const IN_SESSION_HOOKS = [
     events: ["Stop"],
     async: true,
   },
+  {
+    script: "gsd-t-ctx-cue.sh",
+    events: ["Stop"],
+    runner: "bash",
+  },
 ];
 
 function installInSessionHooks() {
@@ -1072,7 +1082,8 @@ function configureInSessionHooks() {
   let added = 0;
   for (const hook of IN_SESSION_HOOKS) {
     const scriptPath = path.join(HOOKS_DIR, hook.script);
-    const cmd = `node "${scriptPath.replace(/\\/g, "\\\\")}"`;
+    const runner = hook.runner || "node";
+    const cmd = `${runner} "${scriptPath.replace(/\\/g, "\\\\")}"`;
 
     for (const event of hook.events) {
       if (!settings.hooks[event]) settings.hooks[event] = [];
@@ -1106,6 +1117,67 @@ function configureInSessionHooks() {
   }
 }
 
+// ─── Status Line ─────────────────────────────────────────────────────────────
+
+// The GSD-T status bar. Canonical source: scripts/statusline-command.sh. Copy
+// it to ~/.claude/statusline-command.sh and point settings.statusLine at it so
+// edits in the package survive install/update/update-all. We only set
+// statusLine when it is absent or already points at our script — never clobber
+// a user's custom status line.
+const STATUSLINE_SCRIPT = "statusline-command.sh";
+
+function installStatusLine() {
+  ensureDir(CLAUDE_DIR);
+  const src = path.join(PKG_SCRIPTS, STATUSLINE_SCRIPT);
+  if (!fs.existsSync(src)) {
+    info("No statusline-command.sh in package — skipping status line");
+    return;
+  }
+  const dest = path.join(CLAUDE_DIR, STATUSLINE_SCRIPT);
+  const srcContent = fs.readFileSync(src, "utf8");
+  const destContent = fs.existsSync(dest) ? fs.readFileSync(dest, "utf8") : "";
+  if (normalizeEol(srcContent) !== normalizeEol(destContent)) {
+    copyFile(src, dest, STATUSLINE_SCRIPT);
+    try { fs.chmodSync(dest, 0o755); } catch {}
+  } else {
+    info("Status line script unchanged");
+  }
+
+  const parsed = readSettingsJson();
+  if (parsed === null && fs.existsSync(SETTINGS_JSON)) {
+    warn("settings.json has invalid JSON — cannot configure status line");
+    return;
+  }
+  const settings = parsed || {};
+  const desiredCmd = `bash ${dest}`;
+  const existing = settings.statusLine;
+  // Set only when absent or already ours (command references our script).
+  const isOurs =
+    existing &&
+    existing.type === "command" &&
+    typeof existing.command === "string" &&
+    existing.command.includes(STATUSLINE_SCRIPT);
+  if (existing && !isOurs) {
+    info("Custom status line present — leaving it untouched");
+    return;
+  }
+  if (isOurs && existing.command === desiredCmd) {
+    info("Status line already configured");
+    return;
+  }
+  if (isSymlink(SETTINGS_JSON)) {
+    warn("Skipping settings.json write — target is a symlink");
+    return;
+  }
+  settings.statusLine = { type: "command", command: desiredCmd };
+  try {
+    fs.writeFileSync(SETTINGS_JSON, JSON.stringify(settings, null, 2));
+    success("Status line configured in settings.json");
+  } catch (e) {
+    warn(`Failed to write settings.json: ${e.message}`);
+  }
+}
+
 // ─── Figma MCP ──────────────────────────────────────────────────────────────
 
 const FIGMA_MCP_URL = "https://mcp.figma.com/mcp";
@@ -1188,6 +1260,8 @@ const GLOBAL_BIN_TOOLS = [
   "gsd-t-traceability-gate.cjs",
   // M85 — Model-tier policy single source of truth (resolver + predicate).
   "gsd-t-model-tier-policy.cjs",
+  // M86 — Model-profile config + resolver CLI (standard/pro/premium tier-spend switch).
+  "gsd-t-model-profile.cjs",
 ];
 
 function installGlobalBinTools() {
@@ -1537,9 +1611,12 @@ async function doInstall(opts = {}) {
   heading("Auto-Route (UserPromptSubmit)");
   installAutoRoute();
 
-  heading("In-Session Hooks (Conversation Capture + Token Usage)");
+  heading("In-Session Hooks (Conversation Capture + Token Usage + Ctx Cue)");
   installInSessionHooks();
 
+  heading("Status Line");
+  installStatusLine();
+
   heading("Figma MCP (Design-to-Code)");
   configureFigmaMcp();
 
@@ -2484,6 +2561,8 @@ const PROJECT_BIN_TOOLS = [
   // M85 — Model-tier policy resolver, so command invokers in consumer projects
   // can resolve stage tiers at invoke time (M69 injection pattern).
   "gsd-t-model-tier-policy.cjs",
+  // M86 — Model-profile config + resolver CLI (standard/pro/premium tier-spend switch).
+  "gsd-t-model-profile.cjs",
 ];
 
 // Files that older versions of this installer copied into project bin/ but
@@ -2543,7 +2622,37 @@ function _matchedStraySignature(name, content) {
   return null;
 }
 
+// Self-protection identity check: is this project dir GSD-T's own source repo?
+// Guards BOTH the bin-tool copy loop (copying the installed package's tools over
+// the source repo reverts in-flight work — Red Team M86 r2 HIGH, fired live) and
+// the deprecated-stray sweep (signature-matching bin/gsd-t.js — the installer
+// itself — would delete the source file). Identity is by package.json name, NOT
+// by path — when update-all runs from the globally-installed package, PKG_ROOT
+// points to the global install and realpath comparison against the local source
+// always fails.
+function _isGsdTSourcePackage(projectDir) {
+  try {
+    const pkgPath = path.join(projectDir, "package.json");
+    if (!fs.existsSync(pkgPath)) return false;
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+    return !!pkg && pkg.name === "@tekyzinc/gsd-t";
+  } catch {
+    return false;
+  }
+}
+
 function copyBinToolsToProject(projectDir, projectName) {
+  // Self-protection for the COPY loop, not just the stray sweep below: the GSD-T
+  // source repo is legitimately registered as a project during development, and
+  // copying the installed package's bin tools over it REVERTS in-flight work —
+  // fired live during M86 verify (Red Team r2 HIGH: a 4.4.11 update-all clobbered
+  // the committed M86 policy module mid-run; every model-profile call then
+  // hard-crashed until restored from HEAD). The source repo IS the canonical
+  // origin of these tools; propagating into it is wrong in every case.
+  if (_isGsdTSourcePackage(projectDir)) {
+    info(`${projectName} — GSD-T source repo: bin propagation skipped (canonical origin)`);
+    return false;
+  }
   const projectBinDir = path.join(projectDir, "bin");
   if (!fs.existsSync(projectBinDir)) {
     try {
@@ -2577,25 +2686,8 @@ function copyBinToolsToProject(projectDir, projectName) {
       }
     }
   }
-  // Self-protection: NEVER sweep GSD-T's own source repo. Without this guard,
-  // running `gsd-t update-all` with the GSD-T source repo itself registered
-  // as a project (legitimate during development) would signature-match
-  // bin/gsd-t.js — which IS the installer — and delete the source file.
-  // Identity is by package.json name, NOT by path — when update-all runs from
-  // the globally-installed package, PKG_ROOT points to the global install and
-  // realpath comparison against the local source always fails.
-  const isSourcePackage = (() => {
-    try {
-      const pkgPath = path.join(projectDir, "package.json");
-      if (!fs.existsSync(pkgPath)) return false;
-      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-      return pkg && pkg.name === "@tekyzinc/gsd-t";
-    } catch {
-      return false;
-    }
-  })();
   let cleaned = 0;
-  if (!isSourcePackage) {
+  if (!_isGsdTSourcePackage(projectDir)) {
     for (const stray of DEPRECATED_BIN_STRAYS) {
       const strayPath = path.join(projectBinDir, stray);
       if (!fs.existsSync(strayPath)) continue;
@@ -4590,6 +4682,16 @@ if (require.main === module) {
       });
       process.exit(res.status == null ? 1 : res.status);
     }
+    case "model-profile": {
+      // M86 — `gsd-t model-profile` thin dispatcher to the profile config +
+      // resolver (standard/pro/premium tier-spend switch, per-project config).
+      const { spawnSync } = require("child_process");
+      const js = path.join(__dirname, "gsd-t-model-profile.cjs");
+      const res = spawnSync(process.execPath, [js, ...args.slice(1)], {
+        stdio: "inherit",
+      });
+      process.exit(res.status == null ? 1 : res.status);
+    }
     case "metrics":
       doMetrics(args.slice(1));
       break;

package/commands/gsd-t-debug.md

@@ -19,7 +19,36 @@ preflight → brief → Cycle 1 (diagnose → hypothesis → fix → test → re
 
 Read `.gsd-t/progress.md`. Note any failing tests or runtime errors in the Decision Log.
 
-## Step 2: Invoke the debug Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+# Output: { "ok": true, "profile": "...", "overrides": { "stage-key": "concrete-model-id", ... } }
+```
+
+**Resolver-failure handling (M86 — SC(f), pre-mortem c2 #2):** if the resolve call fails
+(`{ok:false}`, spawn error, or the `model-profile` subcommand is not present in the installed
+binary), do NOT silently proceed on the premium fallback. Either:
+- HALT with `blocked-needs-human` and explain the resolver is unavailable; OR
+- Proceed ONLY with a **loud, surfaced warning** that names the effective posture:
+
+  ```
+  ⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+    (configured profile unknown; stale global binary may lack model-profile subcommand)
+  ```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the debug Workflow
 
 Call the `Workflow` tool with:
 
@@ -31,14 +60,18 @@ Call the `Workflow` tool with:
   scriptPath: "<absolute path printed by `gsd-t workflow-path debug`>",
   args: {
     symptom: "describe the failing test or runtime error in one sentence",
-    projectDir: "."
+    projectDir: ".",
+    // M86: inject the resolved overrides map so the workflow's ?? form for debug-cycle-2
+    // picks up the profile-tier assignment instead of the premium fable literal.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
   }
 }
 ```
 
 The Workflow runs up to 2 cycles. Cycle 2 receives Cycle 1's failed hypothesis to prevent re-trying the same approach.
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 ```js
 {

package/commands/gsd-t-design-decompose.md

@@ -14,7 +14,32 @@ preflight → brief (kind=design-decompose) → design agent (opus, with phase p
 
 Capture the design reference from `$ARGUMENTS` (Figma URL / image path). If Figma MCP is configured, the agent uses it to extract tokens. Read any existing `.gsd-t/contracts/design/` to avoid duplication.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 ```js
 {
@@ -25,7 +50,10 @@ Capture the design reference from `$ARGUMENTS` (Figma URL / image path). If Figm
   args: {
     phase: "design-decompose",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map (probe + judge use this).
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
     // M84 Competition Mode is AUTOMATIC — do NOT pass `competition` by default.
     // The workflow probes (opus) and self-decides; it competes when a design is
     // ambiguous or the element/widget/page boundaries aren't obvious (a blind,
@@ -37,7 +65,7 @@ Capture the design reference from `$ARGUMENTS` (Figma URL / image path). If Figm
 
 **Competition Mode (`--competition N`).** When a design is ambiguous or the element/widget/page boundaries aren't obvious, `/gsd-t-design-decompose --competition 3` fans out N candidate decompositions and a blind, different-model rubric judge picks the best. Parse N (clamped 2..5). See `.gsd-t/contracts/competition-mode-contract.md`. Default off.
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions }` (plus `competition: { n, winner, ranked }` when Competition Mode ran).
 

package/commands/gsd-t-doc-ripple.md

@@ -14,7 +14,32 @@ The agent identifies the full blast radius of recent code changes and updates ev
 
 Read the recent commit range (or `$ARGUMENTS` if a specific scope is given) and `.gsd-t/progress.md` Decision Log to learn what changed.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 ```js
 {
@@ -25,12 +50,15 @@ Read the recent commit range (or `$ARGUMENTS` if a specific scope is given) and
   args: {
     phase: "doc-ripple",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
   }
 }
 ```
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions }`.
 

package/commands/gsd-t-help.md

@@ -500,7 +500,21 @@ Use these when user asks for help on a specific command:
 - **Files**: `bin/gsd-t-model-tier-policy.cjs` (zero external deps — installer invariant).
 - **Use when**: Any phase that needs to resolve a concrete model id from a stage key at invoke time (M69 pattern). Workflows NEVER `require` this module (sandbox ban) — they use hard-coded tier alias literals the lint proves match the policy.
 - **CLI**: `gsd-t model-tier-policy resolve <stageKey> [--json]`. Emits `{ok, stageKey, tier, model, requiresThinkingOmitted}`. Exit 0 resolved · 1 unknown stage key.
-- **Contract**: `.gsd-t/contracts/model-tier-policy-contract.md` v1.0.0 STABLE.
+- **Contract**: `.gsd-t/contracts/model-tier-policy-contract.md` v1.1.0 STABLE.
+
+### model-profile (M86)
+- **Summary**: Per-project model-tier profile switcher — a SECOND dimension over the M85 stage-tier policy. Manages `.gsd-t/model-profile.json` and resolves which concrete model id each workflow stage runs on under the active profile. Three named profiles: `standard` (zero Fable — pre-M85 posture), `pro` (Fable on red-team + pre-mortem + debug-cycle-2), `premium` (all 6 M85 designated Fable stages — global default). Switching profiles injects the overrides into workflow args at invoke time (M69 pattern — NO tracked-file rewriting). Competition producers are HELD at opus in ALL profiles (M82 blindness invariant). The active profile is surfaced in the session banner (`[GSD-T PROFILE]`), the statusline, and `gsd-t status` — always named, never an implicit fallback (SC(f)).
+- **Files**: `bin/gsd-t-model-profile.cjs` (zero external deps — installer invariant). Config: `.gsd-t/model-profile.json` (`{ "profile": "pro", "stageOverrides": { ... } }`).
+- **Use when**: A project needs a different spend posture than the global default (e.g., run `standard` on a CI cost budget, or `pro` for a production release with targeted Fable quality gates). Per-stage overrides allow fine-grained control beyond the named profiles.
+- **CLI**:
+  - `gsd-t model-profile show [--json]` — display active profile + per-stage resolution
+  - `gsd-t model-profile set <standard|pro|premium>` — switch the project profile
+  - `gsd-t model-profile set-stage <stage> <tier>` — per-stage override (rejects `competition-producers` and `competition-judge→opus` — M82 blindness clamps)
+  - `gsd-t model-profile resolve --json` — resolve the ACTIVE config (profile + stageOverrides) into the overrides envelope consumed by workflow invokers (the invoker form)
+  - `gsd-t model-profile resolve --profile <p> [stage] [--json]` — diagnostic form: pure profile envelope, stageOverrides ZEROED by design (census/divergence checks only — never for invocation)
+  - Emits `{ok, profile, overrides: { "<stage>": "<concreteModelId>" }, requiresThinkingOmitted?}`. Exit 0 resolved · 1 unknown profile/tier.
+- **Out of scope**: Session default model (`/model`) — profiles govern WORKFLOW STAGES only.
+- **Contract**: `.gsd-t/contracts/model-profile-config-contract.md` v1.0.0 STABLE.
 
 ## Unknown Command
 

package/commands/gsd-t-impact.md

@@ -14,7 +14,32 @@ The agent analyzes the downstream effects of proposed changes: what might break,
 
 Read `.gsd-t/progress.md`, the relevant domain `tasks.md`, and `docs/architecture.md`/`.gsd-t/contracts/` for the surfaces in scope.
 
-## Step 2: Invoke the phase Workflow
+## Step 2: Resolve the active model profile (M86 — invoke-time injection)
+
+Before calling the Workflow, resolve the active model profile to build the `overrides` map:
+
+```bash
+# Run via Bash at invoke time:
+gsd-t model-profile resolve --json
+# Bare form (NO --profile flag): reads .gsd-t/model-profile.json — profile AND stageOverrides
+# (set-stage overrides MUST win — contract precedence; --profile is a config-blind diagnostic
+# form that ZEROES stageOverrides and must never be used for invocation — Red Team M86 r3)
+```
+
+**Resolver-failure handling (M86 — pre-mortem c2 #2):** if the resolve call fails, do NOT
+silently proceed on the premium fallback. Either HALT with `blocked-needs-human`, or proceed
+ONLY with a loud, surfaced warning:
+```
+⚠ model-profile resolver unavailable — running on PREMIUM fallback literals
+  (configured profile unknown; stale global binary may lack model-profile subcommand)
+```
+
+Also surface a SUCCESSFUL resolve that carries a `configError` field (the resolver returns a
+named default + `configError` for malformed/hand-edited configs — Red Team M86): print the
+`configError` as a visible warning naming the effective profile before proceeding. A clean-looking
+run on a posture the user did not configure is the same silent-spend failure class.
+
+## Step 3: Invoke the phase Workflow
 
 ```js
 {
@@ -26,12 +51,15 @@ Read `.gsd-t/progress.md`, the relevant domain `tasks.md`, and `docs/architectur
     phase: "impact",
     milestone: "M{NN}",
     projectDir: ".",
-    userInput: "$ARGUMENTS"
+    userInput: "$ARGUMENTS",
+    // M86: inject the resolved overrides map.
+    // Pass {} when the resolver failed AND you chose the loud-warning path (not halt).
+    overrides: { /* ...from resolver result.overrides, or {} on failure */ }
   }
 }
 ```
 
-## Step 3: Interpret the result
+## Step 4: Interpret the result
 
 The Workflow returns `{ status, artifacts, summary, decisions }`.