@topolo/cli 0.13.17 → 0.13.21

package/agent-packs/src/topolo_agent_pack/native.py

@@ -589,7 +589,7 @@ def materialize(library, components, runtime, mappings=None):
     # Generate the dual desktop/server section mapping from the selected composition.
     catalog_conn = sqlite3.connect(home / 'state_5.sqlite')
     import uuid
-    groups = {}; pins = []; titles = {}; descriptions = {}; account_ids = set()
+    groups = {}; pins = []; titles = {}; descriptions = {}
     for agent in chosen:
         groupkey = (agent['pack'],agent['set'])
         if groupkey not in groups:
@@ -610,9 +610,10 @@ def materialize(library, components, runtime, mappings=None):
                          ('complete',None,int(time.time()),int(time.time())))
     catalog_conn.commit(); catalog_conn.close()
     for manifest in manifests:
-        account_ids.update(manifest['ui'].get('sourceAccountIds',[])); descriptions.update(manifest['ui'].get('descriptions',{}))
+        descriptions.update(manifest['ui'].get('descriptions',{}))
     groups_list = [g for (_,sid),g in groups.items() if sid!='intakes']
-    sections = {account:{'sections':groups_list,'sectionOrder':['pinned']+[g['id'] for g in groups_list]+['chats','threads'],'collapsedSectionIds':[]} for account in account_ids}
+    # Portable source-account IDs are not destination authentication.
+    sections = {}
     gs={'thread-titles':{'titles':titles,'order':list(titles)},'pinned-thread-ids':[k.rsplit(':',1)[1] for k in pins],
         'thread-workspace-root-hints':{a['threadId']:remap(thread_sources[a['threadId']][1]['cwd'],mapping) for a in chosen},
         'electron-persisted-atom-state':{'sidebar-custom-sections-v3':sections,'unified-sidebar-pinned-order-v1':pins,'thread-descriptions-v1':descriptions,'flat-project-sidebar-preferences-v1':{'initialized':True,'mode':'project','chatSortMode':'updated_at','projectSortMode':'updated_at'}}}
@@ -640,6 +641,161 @@ def materialize(library, components, runtime, mappings=None):
     from .topolo import attach_runtime
     attach_runtime(library,runtime)
     result={'threads':len(thread_sources),'agents':len(chosen),'historyOffsetsRebased':True,'activeGoalsPaused':sorted(set(paused_goals)),
-            'home':str(home),'userData':str(runtime/'desktop-data'),'dependencies':dependencies,'mappings':mapping}
+            'home':str(home),'userData':str(runtime/'desktop-data'),'dependencies':dependencies,'mappings':mapping,
+            'sidebar':{'state':'pending-account-read','frontendVerified':False}}
     atomic_json(runtime/'verification.json',result)
     return result
+
+
+def sidebar_binding(runtime, account_response):
+    """Bind the existing roster to a native account/read result, never pack IDs.
+
+    The caller owns the selected idle runtime or current managed generation.
+    Authentication and provider configuration are not read or changed here.
+    """
+    from .storage import read_json
+    import uuid
+    runtime = pathlib.Path(runtime)
+    if (not isinstance(account_response, dict) or
+            type(account_response.get('requiresOpenaiAuth')) is not bool):
+        raise PackError('Native account/read response unavailable')
+    account = account_response.get('account')
+    routing = account_response.get('workspaceRouting')
+    account_id = None
+    if account is None:
+        state = 'pending-sign-in'
+    elif not isinstance(account, dict) or account.get('type') not in {'chatgpt', 'apiKey', 'amazonBedrock'}:
+        raise PackError('Unknown native account type')
+    elif account['type'] != 'chatgpt':
+        state = 'pending-chatgpt-account'
+    elif routing is None:
+        state = 'pending-account-identity'
+    elif (not isinstance(routing, dict) or not isinstance(routing.get('chatgptAccountId'), str) or
+          not re.fullmatch(r'[A-Za-z0-9_-]{1,200}', routing['chatgptAccountId'])):
+        raise PackError('Native workspace account identity unavailable')
+    else:
+        account_id = routing['chatgptAccountId']
+        state = 'configured-rendering-unverified'
+    agents = read_json(runtime / 'agents.json')['agents']
+    groups = {}; pins = []
+    conn = ro(runtime / 'home/state_5.sqlite')
+    try:
+        for agent in agents:
+            row = conn.execute('SELECT thread_section_id FROM threads WHERE id=?', (agent['threadId'],)).fetchone()
+            if not row or not row[0]:
+                raise PackError('Native sidebar roster membership unavailable')
+            key = 'codex:thread:local:' + agent['threadId']
+            if agent.get('pinned'):
+                pins.append(key)
+                continue
+            groupkey = (agent['pack'], agent['set'])
+            if groupkey not in groups:
+                groups[groupkey] = {'id':str(uuid.uuid5(uuid.NAMESPACE_URL, 'codex-pack-desktop:' + '/'.join(groupkey))),
+                                    'name':agent['sectionName'], 'hostSectionIds':{'local':row[0]},
+                                    'itemKeys':[], 'appearance':None}
+            if groups[groupkey]['hostSectionIds']['local'] != row[0]:
+                raise PackError('Native sidebar group membership conflicts')
+            groups[groupkey]['itemKeys'].append(key)
+    finally:
+        conn.close()
+    layout = {'sections':list(groups.values()),
+              'sectionOrder':['pinned'] + [g['id'] for g in groups.values()] + ['chats','threads'],
+              'collapsedSectionIds':[]}
+    return {'state':state, 'accountId':account_id, 'sections':{account_id:layout} if account_id else {},
+            'pins':pins, 'agents':len(agents), 'frontendVerified':False, 'sectionsRenderedVerified':False}
+
+
+class SidebarJournal:
+    """Presentation steps use the existing library transaction/recovery store."""
+    def __init__(self, lib, runtime, context, before, expected, report, parent=None):
+        import uuid
+        from .storage import read_json
+        self.lib=lib;self.runtime=pathlib.Path(runtime).resolve()
+        if not self.runtime.is_relative_to(lib.root.resolve()):
+            raise PackError('Sidebar runtime is outside the owned library')
+        self.parent=parent is not None;self.dispatched=False
+        if parent is None:
+            if lib.pending():raise PackError('Pending operation requires original-context recovery')
+            transaction=uuid.uuid4().hex
+            self.path=lib.root/'journals'/(transaction+'.json')
+            self.document={'id':transaction,'phase':'sidebar-binding','operation':'sidebar-bind',
+                           'before':lib.active(),'targetRuntime':str(self.runtime),'createdAt':now()}
+        else:
+            self.path,self.document=parent
+            self.path=pathlib.Path(self.path)
+            if (self.path.parent!=lib.root/'journals' or read_json(self.path)!=self.document or
+                    str(self.runtime) not in {self.document.get('targetRuntime'),self.document.get('before',{}).get('runtime'),self.document.get('after',{}).get('runtime')} or
+                    self.document.get('phase') in {'complete','rolled-back'} or
+                    any(path!=self.path for path in lib.pending())):
+                raise PackError('Original presentation transaction changed')
+            if self.document.get('sidebar',{}).get('state') in {'UNKNOWN','may-have-effects'}:
+                raise PackError('Original sidebar effects require reconciliation before another write')
+        self.document['sidebar']={'state':'may-have-effects','runtime':str(self.runtime),
+                                  'context':context,'before':before,'expected':expected,'report':report}
+        atomic_json(self.path,self.document)
+
+    def complete(self):
+        self.document['sidebar']['state']='complete'
+        if not self.parent:self.document['phase']='complete'
+        atomic_json(self.path,self.document)
+
+    def failed(self,error):
+        self.document['sidebar']['state']='UNKNOWN' if self.dispatched else 'not-executed'
+        if not self.dispatched and not self.parent:self.document['phase']='rolled-back'
+        self.document['sidebar']['errorClass']=type(error).__name__
+        try:atomic_json(self.path,self.document)
+        except Exception as journal_error:
+            # The original may-have-effects entry is already durable. Preserve
+            # the primary failure; never turn a failed status write into success.
+            error.add_note('Sidebar uncertainty journal update failed: '+type(journal_error).__name__)
+
+
+def bind_sidebar(runtime, account_response, *, lib, guard, journal=None, context=None):
+    """Write only under an existing/new journal and a current native guard."""
+    from .storage import read_json
+    binding=sidebar_binding(runtime,account_response)
+    path=pathlib.Path(runtime)/'home/.codex-global-state.json'
+    before=read_json(path);gs=copy.deepcopy(before)
+    atoms=gs.setdefault('electron-persisted-atom-state',{})
+    if binding['accountId']:
+        sections=dict(atoms.get('sidebar-custom-sections-v3',{}));sections.update(binding['sections'])
+        atoms['sidebar-custom-sections-v3']=sections
+    atoms['unified-sidebar-pinned-order-v1']=binding['pins']
+    report={k:v for k,v in binding.items() if k not in {'sections','pins'}}
+    current=guard()
+    mutation=SidebarJournal(lib,runtime,context or current,before,gs,report,parent=journal)
+    try:
+        if read_json(path)!=before:raise PackError('Sidebar file changed before write')
+        if guard()!=current:raise PackError('Sidebar native context changed before write')
+        mutation.dispatched=True;atomic_json(path,gs)
+        if read_json(path)!=gs or guard()!=current:raise PackError('Sidebar file or native context changed after write')
+        report_path=pathlib.Path(runtime)/'sidebar-binding.json';atomic_json(report_path,report)
+        if read_json(report_path)!=report or guard()!=current:raise PackError('Sidebar report/context read-back differs')
+        mutation.complete();return report
+    except BaseException as error:
+        mutation.failed(error);raise
+
+
+def reconcile_sidebar(lib,path,document,current,actual,guard):
+    """Reconcile exact observed presentation; never replay a presentation setter."""
+    from .storage import read_json
+    entry=document.get('sidebar')
+    targets={document.get('targetRuntime'),document.get('before',{}).get('runtime'),document.get('after',{}).get('runtime')}
+    if not entry or entry['runtime'] not in targets or actual!=entry['expected']:
+        raise PackError('Sidebar effects UNKNOWN; original destination presentation needs reconciliation')
+    original=entry['context']
+    # A new read-only connection is allowed; it never impersonates the original
+    # process generation. Account/home/config/binary/roster scope must agree.
+    stable=lambda value:{k:v for k,v in value.items() if k not in {'generation','readerPID'}}
+    if stable(current)!=stable(original) or guard()!=current:
+        raise PackError('Sidebar recovery owner/account/home/config changed')
+    report_path=pathlib.Path(entry['runtime'])/'sidebar-binding.json'
+    # Completing a missing local report follows exact authoritative readback;
+    # neither offline state nor the managed desktop setter is replayed.
+    atomic_json(report_path,entry['report'])
+    if read_json(report_path)!=entry['report'] or guard()!=current:
+        raise PackError('Sidebar reconciliation report/context changed')
+    entry['state']='complete';entry['reconciledCurrentContext']=current
+    if document.get('operation')=='sidebar-bind':document['phase']='complete'
+    atomic_json(path,document)
+    return entry['report']

package/agent-packs/src/topolo_agent_pack/policy.py

@@ -59,6 +59,14 @@ def settings(agent, harness, consent=None):
     spec = PROFILES[profile]
     model = MODELS[harness][spec['tier']]
     if harness == 'codex':
+        if 'modelPreset' in agent:
+            preset = agent['modelPreset']
+            if (not isinstance(preset, dict) or set(preset) != {'model', 'reasoningEffort'} or
+                    not isinstance(preset['model'], str) or not preset['model'] or
+                    preset['model'].endswith('-latest') or preset['reasoningEffort'] not in {'low', 'medium', 'high'}):
+                raise PackError('Invalid explicit fresh-role model preset')
+            model = preset['model']
+            spec = {**spec, 'effort': preset['reasoningEffort']}
         native = {'model': model, 'model_reasoning_effort': spec['effort'],
                   'approval_policy': 'on-request', 'approvals_reviewer': 'user',
                   'sandbox_mode': spec['localAccess'],

package/agent-packs/src/topolo_agent_pack/review_context.py

@@ -0,0 +1,33 @@
+"""Selected canonical lifecycle evidence for one independent task review."""
+import copy
+from .storage import atomic_json
+from .work import require
+
+
+def materialize(store, task, cwd):
+    current = store.get(task['id'])
+    require(current == task, 'Review task changed before workflow context materialization')
+    workers = [w for w in store.workers() if w['taskId'] == task['id']
+               and w.get('attempt', 1) == task.get('attempt', 1)]
+    require(len(workers) <= 32 and any(w['phase'] == 'execute' and w['id'] == task['result']['workerId']
+            and w['state'] == 'archived' and w.get('nativeArchived') is True
+            and w.get('checkpoint') == task['result']['checkpoint'] for w in workers),
+            'Review requires the exact archived execution checkpoint')
+    fields = ['id', 'phase', 'role', 'state', 'nativeId', 'turnId', 'resolution', 'roleSource',
+              'checkpoint', 'reviewGeneration', 'nativeArchived', 'nativeRetirement', 'createdAt']
+    selected = [{k: copy.deepcopy(w[k]) for k in fields if k in w} for w in workers]
+    started = min(w['createdAt'] for w in workers)
+    events = [{k: e[k] for k in ['sequence', 'kind', 'at']}
+              for e in store.events(task['id']) if e['at'] >= started]
+    require(len(events) <= 512, 'Selected review workflow events exceed boundary')
+    packet = {'format': 'topolo-task-review-workflow-v1', 'taskId': task['id'],
+              'attempt': task.get('attempt', 1), 'revision': task['revision'],
+              'cloudReference': {k: store.binding[k] for k in
+                                 ['organizationId', 'workspaceId', 'documentId', 'datasetId']},
+              'route': copy.deepcopy(task['route']), 'workers': selected, 'events': events,
+              'evidenceContract': {'workspace': str(cwd.resolve()),
+                  'readOutputExample': str(cwd.resolve() / 'evidence/retained-page-0.json'),
+                  'instructions': 'Create an evidence directory in this reviewer workspace and save newly performed read-only command output there before citing it. Return absolute paths to existing nonempty regular files inside this workspace. Existing inspected context files may also be cited. Never cite /tmp, /private/tmp, another worker directory, a symlink or a path containing .. . Do not copy external temporary files to bypass this boundary, invent evidence or claim a read that was not performed. Each declared file is validated before any evidence upload; one external path rejects the entire declared evidence list.'},
+              'boundary': 'Canonical cloud lifecycle records for this task attempt only. A specialization role and its task type are separate fields. Event persistence proves recorded progress, not rendered browser delivery. The current reviewer is intentionally not archived until its result is checkpointed; the coordinator must verify that archival and live Activity delivery afterward.'}
+    atomic_json(cwd / 'context/workflow-evidence.json', packet)
+    return packet

package/agent-packs/src/topolo_agent_pack/role_catalog.py

@@ -0,0 +1,137 @@
+"""Specialization metadata independent of native chats and captured histories."""
+import copy,hashlib,json,pathlib
+from .storage import Library,atomic_json,canonical,read_json,component_key
+from .work import require
+from .task_models import default_configuration
+from .cicd import DISCIPLINES
+from .domain_context import references
+
+COORDINATORS={'engineering':'engineering','operations':'operator-01','cicd':'cicd'}
+REVIEWS={'engineering':'adversarial-qa','operations':'workflow-integration-specialist','cicd':'release-verification'}
+
+def digest(value):
+    return hashlib.sha256(canonical(value)).hexdigest()
+
+def install(lib,pack,agent_workspace,bytes_workspace,max_workers=4,client=None):
+    manifest,revision=lib.load(pack)
+    require(len(manifest['agents'])==3 and {(a['set'],a['id']) for a in manifest['agents']}=={('intakes',v) for v in COORDINATORS.values()},'A fresh three-coordinator pack is required; no specialist native chats')
+    require(type(max_workers) is int and 1<=max_workers<=8,'Invalid dispatch capacity')
+    root=lib.root/'work';root.mkdir(exist_ok=True,mode=0o700)
+    require(not (root/'config.json').exists(),'Existing task installation must be reconciled before replacement')
+    if client is None:
+        from .topolo import Client
+        client=Client('production','org:org_topolo_platform')
+    rows=client.action('app_topolo_agent.agents.list',{},agent_workspace)['agents'];roles=[];refs={};seen=set()
+    for agent in rows:
+        config=json.loads(agent['config']) if isinstance(agent['config'],str) else agent['config'];spec=config.get('specialization',{})
+        if spec.get('format')!='topolo-role-specialization-v1':continue
+        logical=spec.get('logicalId','');parts=logical.split('/')
+        require(len(parts)==2,'Invalid logical specialization identity')
+        group,identifier=parts
+        if group=='intakes' and identifier not in COORDINATORS.values():continue
+        require(group in {'intakes','specialists','operators','operator-skills'} and logical not in seen,'Unknown or duplicate specialization')
+        instructions=spec.get('instructions')
+        require(agent['organizationId']=='org_topolo_platform' and agent['workspaceId']==agent_workspace and isinstance(instructions,str) and 100<=len(instructions)<=16000 and config.get('purpose')==instructions,'Unqualified specialization definition')
+        seen.add(logical);role={'pack':pack,'set':group,'id':identifier,'title':identifier.replace('-',' ').title()};key=component_key(role)
+        roles.append(role);refs[key]={'agentId':agent['id'],'workspaceId':agent_workspace,'logicalId':logical,'instructionsSHA256':hashlib.sha256(instructions.encode()).hexdigest()}
+        domain=references(config,logical)
+        if domain:refs[key]['domainContextRefs']=domain
+    channels={}
+    for channel,intake in COORDINATORS.items():
+        eligible=[r for r in roles if (r['set']=='intakes' and r['id']==intake) or
+                  (channel=='engineering' and r['set']=='specialists' and r['id'] not in DISCIPLINES) or
+                  (channel=='operations' and r['set'] in {'operators','operator-skills'}) or
+                  (channel=='cicd' and r['set']=='specialists' and r['id'] in DISCIPLINES)]
+        require(sum(r['set']=='intakes' for r in eligible)==1 and sum(r['id']==REVIEWS[channel] for r in eligible)==1,'Channel specialization or independent reviewer is missing')
+        require(len({r['id'] for r in eligible})==len(eligible),'Ambiguous discipline names in channel')
+        channels[channel]={'intakeRole':intake,'reviewRole':REVIEWS[channel],'roleKeys':[component_key(r) for r in eligible]}
+    configuration=default_configuration();ceiling={'allowedModels':sorted({model for harness in configuration['harnesses'].values() for model in harness['tiers'].values()}),'allowedEfforts':['low','medium','high']}
+    constraints={'pack':ceiling,'groups':{r['set']:copy.deepcopy(ceiling) for r in roles},'roles':{component_key(r):copy.deepcopy(ceiling) for r in roles}}
+    registry={'format':'topolo-role-bindings-v1','organizationId':'org_topolo_platform','roles':refs}
+    catalog={'format':'topolo-task-role-catalog-v1','pack':pack,'nativePackRevision':revision,'roles':roles,'bindings':refs,'channels':channels,'configuration':configuration,'constraints':constraints}
+    atomic_json(root/'role-catalog.json',catalog);atomic_json(root/'role-bindings.json',registry)
+    atomic_json(root/'context-authority.json',{'format':'topolo-task-context-authority-v1','organizationId':'org_topolo_platform','workspaceId':bytes_workspace,'scope':'org'})
+    atomic_json(root/'config.json',{'format':'topolo-task-dispatch-v2','pack':pack,'catalogDigest':digest(catalog),'maxWorkers':max_workers,'frontdoorDispatch':True,'requireCloudAuthority':True})
+    return {'state':'three-coordinator-dispatch-prepared','nativeCoordinators':3,'specializationReferences':len(refs),'specialistNativeChatsCreated':0,'instructionsCached':False,'cloudAuthorityRequired':True,'nativeActivationVerified':False}
+
+def configuration(owner,saved,channel):
+    require(set(saved)=={'format','pack','catalogDigest','maxWorkers','frontdoorDispatch','requireCloudAuthority'} and saved['frontdoorDispatch'] is True and saved['requireCloudAuthority'] is True,'Unqualified source-independent task configuration')
+    require(channel in COORDINATORS,'Unknown task channel')
+    root=owner.lib.root/'work';catalog=read_json(root/'role-catalog.json')
+    require(catalog.get('format')=='topolo-task-role-catalog-v1' and catalog.get('pack')==saved['pack'] and digest(catalog)==saved['catalogDigest'],'Specialization catalog changed; review before dispatch')
+    registry=read_json(root/'role-bindings.json');require(registry.get('organizationId')=='org_topolo_platform' and registry.get('roles')==catalog['bindings'],'Role reference registry differs from the reviewed catalog')
+    native,revision=owner.lib.load(saved['pack']);require(revision==catalog['nativePackRevision'] and len(native['agents'])==3,'Native coordinator roster changed')
+    selected=catalog['channels'][channel];expected=saved['pack']+'/intakes/'+selected['intakeRole']
+    matches=[c for c in owner.lib.active()['components'] if c['key']==expected]
+    require(len(matches)==1 and owner.execution.roles.get(matches[0]['threadId'],{}).get('key')==expected,'Channel has no current owned coordinator')
+    require(type(saved['maxWorkers']) is int and 1<=saved['maxWorkers']<=8,'Invalid native capacity')
+    manifest={'packId':saved['pack'],'sourceIndependent':True,'agents':[r for r in catalog['roles'] if component_key(r) in selected['roleKeys']]}
+    return {'pack':saved['pack'],'revision':revision,'maxWorkers':saved['maxWorkers'],'catalogOnly':True,**selected},manifest,{'configuration':catalog['configuration'],'constraints':catalog['constraints']}
+
+
+def repair_model_ceilings(lib,expected_catalog_digest,expected_native,client=None,native_call=None,live_request=None):
+    with Library(lib.root).lock():
+        return _repair_model_ceilings_locked(lib,expected_catalog_digest,expected_native,client,native_call,live_request)
+
+def _repair_model_ceilings_locked(lib,expected_catalog_digest,expected_native,client,native_call,live_request):
+    """Add only the three already-configured Claude IDs to stale GPT-only ceilings.
+
+    No task, role definition, native session, permission or model preference is
+    changed. A digest mismatch fences dispatch throughout metadata publication.
+    """
+    from .claude_desktop import call
+    from .live import request
+    from .cloud_work import CloudStore
+    native_call=native_call or call;live_request=live_request or request
+    root=lib.root/'work';journal=root/'model-ceiling-repair.json'
+    require(not journal.exists() and not journal.is_symlink(),'Existing model ceiling repair requires reconciliation; no replay')
+    saved=read_json(root/'config.json');catalog=read_json(root/'role-catalog.json');registry=read_json(root/'role-bindings.json')
+    require(saved.get('format')=='topolo-task-dispatch-v2' and saved.get('requireCloudAuthority') is True and saved.get('catalogDigest')==expected_catalog_digest==digest(catalog) and catalog.get('format')=='topolo-task-role-catalog-v1' and catalog.get('pack')==saved.get('pack') and registry.get('roles')==catalog.get('bindings'),'Expected source-independent catalog beforeimage changed')
+    native_pack,revision=lib.load(saved['pack'])
+    require(revision==catalog['nativePackRevision'] and len(native_pack['agents'])==3,'Original three-coordinator pack changed')
+    connection=read_json(root/'claude-frontdoors.json')['nativeConnection']
+    require(isinstance(expected_native,dict) and set(expected_native)=={'harness','pid','identity','models','workers','codeIdentity','qualified'} and expected_native['harness']=='claude-desktop' and expected_native['qualified'] is True and expected_native['workers']==0 and type(expected_native['pid']) is int and expected_native['pid']>1 and expected_native['pid']==connection['pid'] and expected_native['identity']==connection['identity'] and isinstance(expected_native['models'],list) and expected_native['models'] and all(isinstance(v,str) and v for v in expected_native['models']) and len(expected_native['models'])==len(set(expected_native['models'])),'Exact qualified idle native model catalog required')
+    configured=catalog['configuration']['harnesses'];claude=configured['claude']['tiers'];codex=set(configured['codex']['tiers'].values())
+    require(set(claude)=={'economy','standard','deep'} and len(set(claude.values()))==3 and all(isinstance(v,str) and v.startswith('claude-') and not v.endswith('-latest') and v in expected_native['models'] for v in claude.values()),'Configured three Claude tiers are not in the current native catalog')
+    reviewed=copy.deepcopy(catalog);constraints=reviewed['constraints']
+    require(set(constraints)=={'pack','groups','roles'} and set(constraints['roles'])==set(catalog['bindings']) and set(constraints['groups'])=={r['set'] for r in catalog['roles']},'Exact catalog role/group constraint coverage required')
+    for layer in [constraints['pack'],*constraints['groups'].values(),*constraints['roles'].values()]:
+        require(isinstance(layer,dict) and set(layer)=={'allowedModels','allowedEfforts'} and set(layer['allowedModels'])==codex and len(layer['allowedModels'])==len(codex) and layer['allowedEfforts']==['low','medium','high'],'Only unchanged stale GPT-only model ceilings may be repaired')
+        layer['allowedModels']=sorted(codex|set(claude.values()))
+    require(digest(reviewed)!=expected_catalog_digest,'Catalog has no stale model ceilings to repair')
+    if client is None:
+        from .topolo import Client
+        client=Client('production','org:org_topolo_platform')
+    store=CloudStore(lib.root,client=client)
+    def quiescent():
+        require(native_call(connection,{'kind':'status'})==expected_native,'Current native model catalog or idle connection changed')
+        status=live_request(lib,'status',{})
+        require(status.get('harness')=='claude' and status.get('cloudDispatchReady') is True and status.get('desktopPid')==expected_native['pid'] and status.get('activeTurns')==[],'Owning Claude dispatcher is not quiescent')
+        version,state=store.load()
+        for row in state['tables']['workers']:
+            w=json.loads(row[2])
+            require(w['state']=='archived' and w.get('nativeArchived') is True or w['state']=='failed' and not w.get('turnId') and (not w.get('nativeId') or w.get('nativeArchived') is True),'Existing cloud worker custody is unresolved')
+        for row in state['tables']['tasks']:
+            t=json.loads(row[2])
+            require(t.get('ownerInstallationId')!=store.binding['installationId'] or t['state'] not in {'queued','routing','executing','reviewing'},'Runnable owned cloud work must settle before model ceiling repair')
+        return {'versionId':version,'stateSHA256':digest(state),'datasetId':state['datasetId']}
+    cloud=quiescent()
+    held={**saved,'catalogDigest':'0'*64};after={**saved,'catalogDigest':digest(reviewed)}
+    record={'format':'topolo-model-ceiling-repair-v1','state':'prepared','harness':'claude','native':expected_native,'cloud':cloud,'before':{'config':saved,'catalog':catalog},'after':{'config':after,'catalog':reviewed},'addedModels':sorted(claude.values()),'cloudTaskStateChanged':False,'nativeSessionsCreated':0}
+    require(read_json(root/'config.json')==saved and read_json(root/'role-catalog.json')==catalog and read_json(root/'role-bindings.json')==registry,'Catalog metadata changed before publication')
+    atomic_json(journal,record)
+    try:
+        atomic_json(root/'config.json',held)
+        atomic_json(root/'role-catalog.json',reviewed)
+        require(quiescent()==cloud,'Protected cloud/native beforeimage changed during repair')
+        require(read_json(root/'config.json')==held and read_json(root/'role-catalog.json')==reviewed and read_json(root/'role-bindings.json')==registry,'Protected catalog metadata changed during repair')
+        atomic_json(root/'config.json',after)
+        require(read_json(root/'config.json')==after and read_json(root/'role-catalog.json')==reviewed,'Model ceiling publication readback differs')
+        atomic_json(journal,{**record,'state':'verified'})
+    except Exception:
+        # Retain a digest fence after partial publication; never roll back cloud
+        # work, rewrite a foreign catalog, or silently resume from an old copy.
+        if read_json(root/'config.json') in (held,after):
+            atomic_json(root/'config.json',held)
+        raise
+    return {'state':'reviewed-model-ceilings-repaired','catalogDigest':after['catalogDigest'],'addedModels':sorted(claude.values()),'roles':len(constraints['roles']),'cloudTaskStateChanged':False,'nativeSessionsCreated':0,'existingRoleSettingsChanged':False}

package/agent-packs/src/topolo_agent_pack/role_context.py

@@ -0,0 +1,63 @@
+"""Fetch exactly one Agent specialization. Never load a pack export or memory."""
+import hashlib,json,pathlib
+from .storage import read_json,atomic_json,canonical
+from .work import require
+from .domain_context import references,materialize as materialize_domain
+
+def materialize(root,key,cwd,client=None,*,harness='codex'):
+    require(harness in {'codex','claude'},'Unsupported role instruction harness')
+    require(read_json(pathlib.Path(root)/'role-refresh.json',{}).get('state') in {None,'verified'},'Role metadata refresh is incomplete; reconcile before native startup')
+    registry=read_json(pathlib.Path(root)/'role-bindings.json')
+    require(registry.get('format')=='topolo-role-bindings-v1' and registry.get('organizationId')=='org_topolo_platform','Unqualified Agent role bindings')
+    ref=registry['roles'].get(key)
+    require(isinstance(ref,dict) and set(ref) in [{'agentId','workspaceId','logicalId','instructionsSHA256'},{'agentId','workspaceId','logicalId','instructionsSHA256','domainContextRefs'}],'Selected role has no qualified Agent definition')
+    if client is None:
+        from .topolo import Client
+        client=Client('production','org:org_topolo_platform')
+    result=client.action('app_topolo_agent.agents.get',{'id':ref['agentId']},ref['workspaceId'])
+    agent=result['agent']
+    require(agent['id']==ref['agentId'] and agent['workspaceId']==ref['workspaceId'] and agent['organizationId']==registry['organizationId'],'Agent specialization identity differs')
+    config=json.loads(agent['config']) if isinstance(agent['config'],str) else agent['config']
+    spec=config.get('specialization',{})
+    require(set(spec)=={'format','logicalId','instructions'} and spec['format']=='topolo-role-specialization-v1' and spec['logicalId']==ref['logicalId'],'Agent specialization is missing or belongs to another role')
+    instructions=spec['instructions']
+    require(isinstance(instructions,str) and 100<=len(instructions)<=16000 and config.get('purpose')==instructions,'Agent specialization body is unqualified')
+    digest=hashlib.sha256(instructions.encode()).hexdigest()
+    require(digest==ref['instructionsSHA256'],'Agent role changed; review its new definition before dispatch')
+    refs=references(config,spec['logicalId'])
+    require(refs==ref.get('domainContextRefs',[]),'Reviewed operating reference binding changed')
+    cwd=pathlib.Path(cwd);require(cwd.is_dir() and not cwd.is_symlink(),'New worker directory required')
+    filename='CLAUDE.md' if harness=='claude' else 'AGENTS.md'
+    target=cwd/filename
+    require(not target.is_symlink(),'Role instruction file cannot be a symlink')
+    domain=materialize_domain(refs,cwd,client)
+    target.write_text(instructions+'\n')
+    receipt={'source':'topolo-agent-definition','agentId':agent['id'],'workspaceId':agent['workspaceId'],'logicalId':spec['logicalId'],'instructionsSHA256':digest,'instructionBytes':len(instructions.encode()),'action':'app_topolo_agent.agents.get','rolesLoaded':1,'wholePackExportLoaded':False,'memoryLoaded':False}
+    if domain:receipt['domainContextRefs']=domain
+    atomic_json(cwd/'role-source.json',receipt)
+    return receipt
+
+def bind(root,manifests,workspace,client=None):
+    """Installation discovery only; registry contains references, never bodies."""
+    if client is None:
+        from .topolo import Client
+        client=Client('production','org:org_topolo_platform')
+    agents=client.action('app_topolo_agent.agents.list',{},workspace)['agents']
+    roles={}
+    for manifest in manifests:
+        for role in manifest['agents']:
+            logical=role['set']+'/'+role['id'];matches=[]
+            for agent in agents:
+                config=json.loads(agent['config']) if isinstance(agent['config'],str) else agent['config']
+                spec=config.get('specialization',{})
+                if spec.get('format')=='topolo-role-specialization-v1' and spec.get('logicalId')==logical:
+                    require(agent['organizationId']=='org_topolo_platform' and agent['workspaceId']==workspace and config.get('purpose')==spec.get('instructions'),'Agent specialization discovery differs')
+                    matches.append((agent,spec))
+            require(len(matches)==1,'Missing or ambiguous Agent specialization: '+logical)
+            agent,spec=matches[0];key=role['pack']+'/'+logical
+            roles[key]={'agentId':agent['id'],'workspaceId':workspace,'logicalId':logical,'instructionsSHA256':hashlib.sha256(spec['instructions'].encode()).hexdigest()}
+            refs=references(json.loads(agent['config']) if isinstance(agent['config'],str) else agent['config'],logical)
+            if refs:roles[key]['domainContextRefs']=refs
+    registry={'format':'topolo-role-bindings-v1','organizationId':'org_topolo_platform','roles':roles}
+    atomic_json(pathlib.Path(root)/'role-bindings.json',registry)
+    return {'state':'agent-role-references-bound','roles':len(roles),'instructionsCached':False,'dispatchLookup':'one Agent id per selected worker'}

package/agent-packs/src/topolo_agent_pack/role_refresh.py

@@ -0,0 +1,50 @@
+"""Explicit reviewed metadata refresh for the same inactive cloud installation."""
+import copy,hashlib,json,os,pathlib
+from .storage import read_json,atomic_json,canonical
+from .work import require
+from .domain_context import references
+
+
+def refresh_refs(lib,expected_catalog_digest,expected_bindings,reviewed_bindings,client=None):
+    root=lib.root/'work';journal=root/'role-refresh.json'
+    require(not journal.exists(),'Role metadata refresh already recorded; reconcile its existing journal')
+    saved=read_json(root/'config.json');catalog=read_json(root/'role-catalog.json');registry=read_json(root/'role-bindings.json')
+    digest=lambda value:hashlib.sha256(canonical(value)).hexdigest()
+    require(saved.get('catalogDigest')==expected_catalog_digest==digest(catalog) and registry.get('roles')==catalog.get('bindings')==expected_bindings,'Expected role metadata changed')
+    require(not lib.active().get('components'),'Native owner must be stopped before role metadata refresh')
+    for record,field in [(root/'claude-frontdoors.json','desktopPid'),(lib.root/'live-bridge.json','pid')]:
+        owner=read_json(record,{})
+        if owner:
+            pid=owner.get(field);require(type(pid) is int and pid>1,'Native owner identity is unverified')
+            try:os.kill(pid,0)
+            except ProcessLookupError:pass
+            else:require(False,'Native owner must be stopped before role metadata refresh')
+    if client is None:
+        from .topolo import Client
+        client=Client('production','org:org_topolo_platform')
+    binding=read_json(root/'cloud.json')
+    require(binding.get('format')=='topolo-cloud-work-binding-v1' and binding.get('organizationId')=='org_topolo_platform','Inactive cloud installation binding required')
+    response=client.action('app_topolo_docs.documents.get',{'documentId':binding['documentId']},binding['workspaceId']);doc=response['document'];versions=[v for v in response['versions'] if v['id']==doc['currentVersionId']]
+    require(doc['id']==binding['documentId'] and doc['workspaceId']==binding['workspaceId'] and doc['organizationId']==binding['organizationId'] and len(versions)==1,'Inactive cloud installation identity differs')
+    state=json.loads(versions[0]['bodyMarkdown'])
+    require(state.get('format')=='topolo-cloud-work-state-v1' and state.get('datasetId')==binding['datasetId'] and state.get('activated') is False,'Role refresh requires the existing inactive prepared dataset')
+    for row in state['tables']['workers']:
+        worker=json.loads(row[2])
+        require(worker['state']=='archived' and worker.get('nativeArchived') is True or worker['state']=='failed' and not worker.get('turnId') and (not worker.get('nativeId') or worker.get('nativeArchived') is True),'Existing native worker closure is unresolved before role refresh')
+    required={key for key,ref in expected_bindings.items() if ref['logicalId']=='intakes/cicd' or ref['logicalId'] in {'specialists/'+v for v in ['queue-recovery','runner-capacity','pipeline-engineering','promotion-deployment','release-verification']}}
+    require(len(required)==6 and isinstance(reviewed_bindings,dict) and set(reviewed_bindings)==required,'Exactly the six existing CI/CD roles must be reviewed')
+    updated=copy.deepcopy(expected_bindings)
+    for key,ref in reviewed_bindings.items():
+        previous=expected_bindings[key]
+        require(set(ref)=={'agentId','workspaceId','logicalId','instructionsSHA256','domainContextRefs'} and all(ref[field]==previous[field] for field in ['agentId','workspaceId','logicalId']),'Reviewed role identity changed')
+        agent=client.action('app_topolo_agent.agents.get',{'id':ref['agentId']},ref['workspaceId'])['agent'];config=json.loads(agent['config']) if isinstance(agent['config'],str) else agent['config'];spec=config.get('specialization',{})
+        require(agent['id']==ref['agentId'] and agent['workspaceId']==ref['workspaceId'] and agent['organizationId']=='org_topolo_platform' and spec.get('format')=='topolo-role-specialization-v1' and spec.get('logicalId')==ref['logicalId'] and isinstance(spec.get('instructions'),str) and config.get('purpose')==spec['instructions'] and hashlib.sha256(spec['instructions'].encode()).hexdigest()==ref['instructionsSHA256'] and references(config,ref['logicalId'])==ref['domainContextRefs'],'Reviewed live Agent definition differs')
+        updated[key]=copy.deepcopy(ref)
+    new_catalog={**catalog,'bindings':updated};new_registry={**registry,'roles':updated};new_saved={**saved,'catalogDigest':digest(new_catalog)}
+    record={'format':'topolo-role-refresh-v1','state':'prepared','datasetId':binding['datasetId'],'cloudVersionId':doc['currentVersionId'],'oldCatalogDigest':expected_catalog_digest,'newCatalogDigest':new_saved['catalogDigest'],'before':{'catalog':catalog,'registry':registry,'config':saved},'after':{'catalog':new_catalog,'registry':new_registry,'config':new_saved}}
+    atomic_json(journal,record)
+    # Partial writes remain a visible administrative hold, never a fallback.
+    atomic_json(root/'role-catalog.json',new_catalog);atomic_json(root/'role-bindings.json',new_registry);atomic_json(root/'config.json',new_saved)
+    require(read_json(root/'role-catalog.json')==new_catalog and read_json(root/'role-bindings.json')==new_registry and read_json(root/'config.json')==new_saved,'Role metadata refresh readback differs')
+    atomic_json(journal,{**record,'state':'verified'})
+    return {'state':'reviewed-role-metadata-refreshed','roles':6,'catalogDigest':new_saved['catalogDigest'],'datasetId':binding['datasetId'],'cloudTaskStateChanged':False,'nativeOwnersStarted':False}

package/agent-packs/src/topolo_agent_pack/task_models.py

@@ -16,23 +16,27 @@ def digest(value):
 def default_configuration():
     """Explicit template for a new pack configuration; existing roles are unchanged."""
     return {
-        'format': 'topolo-task-model-configuration', 'schemaVersion': 1, 'revision': '1',
+        'format': 'topolo-task-model-configuration', 'schemaVersion': 1, 'revision': '2',
         'rules': [
-            {'id': 'routine', 'complexity': ['routine'], 'risk': ['low'], 'profile': 'routine'},
+            {'id': 'trivial', 'complexity': ['trivial'], 'risk': ['low'], 'profile': 'trivial',
+             'types': ['format', 'extract-fields', 'reference-lookup', 'status-read']},
+            {'id': 'routine', 'complexity': ['routine'], 'risk': ['low', 'normal'], 'profile': 'routine'},
             {'id': 'deep', 'complexity': ['complex'], 'risk': ['low', 'normal', 'security-critical'], 'profile': 'deep'},
             {'id': 'security', 'complexity': ['routine', 'standard'], 'risk': ['security-critical'], 'profile': 'deep'},
             {'id': 'standard', 'complexity': ['standard'], 'risk': ['low', 'normal'], 'profile': 'standard'},
         ],
         'harnesses': {
             'codex': {
-                'tiers': {'standard': 'gpt-6.1-sol', 'deep': 'gpt-6-astra'},
-                'profiles': {'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
+                'tiers': {'standard': 'gpt-6.1-sol', 'deep': 'gpt-6-astra', 'economy': 'gpt-6-luna'},
+                'profiles': {'trivial': {'tier': 'economy', 'efforts': ['low']},
+                             'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
                              'standard': {'tier': 'standard', 'efforts': ['medium']},
-                             'deep': {'tier': 'deep', 'efforts': ['high']}},
+                             'deep': {'tier': 'standard', 'efforts': ['high']}},
             },
             'claude': {
                 'tiers': {'economy': 'claude-haiku-5-5', 'standard': 'claude-sonnet-5-5', 'deep': 'claude-opus-5-5'},
-                'profiles': {'routine': {'tier': 'economy', 'efforts': ['low', 'medium']},
+                'profiles': {'trivial': {'tier': 'economy', 'efforts': ['low']},
+                             'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
                              'standard': {'tier': 'standard', 'efforts': ['medium']},
                              'deep': {'tier': 'deep', 'efforts': ['high']}},
             },
@@ -80,7 +84,7 @@ def _selection(configuration, task, harness, constraints, *, override_authorized
     if (not isinstance(task, dict) or not {'type', 'complexity', 'risk'} <= set(task) or
             set(task) - {'type', 'complexity', 'risk', 'override'} or
             not isinstance(task['type'], str) or not task['type'] or len(task['type']) > 120 or
-            task['complexity'] not in {'routine', 'standard', 'complex'} or
+            task['complexity'] not in {'trivial', 'routine', 'standard', 'complex'} or
             task['risk'] not in {'low', 'normal', 'security-critical'}):
         raise PackError('An intake must supply an exact task type, complexity and risk')
     rules = configuration.get('rules')