@yunhozz/arc 0.0.0-stage → 0.1.1

package/codex/skill/references/superpowers/writing-plans/SKILL.md

@@ -0,0 +1,204 @@
+---
+name: writing-plans
+description: Use when you have a spec or requirements for a multi-step task, before touching code
+---
+
+# Writing Plans
+
+## Overview
+
+Write implementation plans for an engineer who has not seen this codebase or this spec. Assume they write idiomatic code in the project's language once they know the exact interface and the exact test, and that they will make a reasonable choice wherever the plan leaves one open. What they cannot know is what you decided: which files, which names and signatures, which values from the spec, which tests prove each task. Document those. Give them the whole plan as bite-sized tasks. DRY. YAGNI. TDD. Frequent commits.
+
+**Announce at start:** "I'm using the writing-plans skill to create the implementation plan."
+
+**Context:** If working in an isolated worktree, it should have been created via the `superpowers:using-git-worktrees` skill at execution time.
+
+**Save plans to:** `docs/superpowers/plans/YYYY-MM-DD-<feature-name>.md`
+- (User preferences for plan location override this default)
+
+## Scope Check
+
+If the spec covers multiple independent subsystems, it should have been broken into sub-project specs during brainstorming. If it wasn't, suggest breaking this into separate plans — one per subsystem. Each plan should produce working, testable software on its own.
+
+## File Structure
+
+Before defining tasks, map out which files will be created or modified and what each one is responsible for. This is where decomposition decisions get locked in.
+
+- Design units with clear boundaries and well-defined interfaces. Each file should have one clear responsibility.
+- You reason best about code you can hold in context at once, and your edits are more reliable when files are focused. Prefer smaller, focused files over large ones that do too much.
+- Files that change together should live together. Split by responsibility, not by technical layer.
+- In existing codebases, follow established patterns. If the codebase uses large files, don't unilaterally restructure - but if a file you're modifying has grown unwieldy, including a split in the plan is reasonable.
+
+This structure informs the task decomposition. Each task should produce self-contained changes that make sense independently.
+
+## Task Right-Sizing
+
+A task is the smallest unit that carries its own test cycle and is worth a
+fresh reviewer's gate. When drawing task boundaries: fold setup,
+configuration, scaffolding, and documentation steps into the task whose
+deliverable needs them; split only where a reviewer could meaningfully
+reject one task while approving its neighbor. Each task ends with an
+independently testable deliverable.
+
+## Step Granularity
+
+**Each step is one action with a checkable result:**
+- "Write the failing test" - step
+- "Run it to make sure it fails" - step
+- "Implement the minimal code to make the test pass" - step
+- "Run the tests and make sure they pass" - step
+- "Commit" - step
+
+## Plan Document Header
+
+**Every plan MUST start with this header:**
+
+```markdown
+# [Feature Name] Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** [One sentence describing what this builds]
+
+**Architecture:** [2-3 sentences about approach]
+
+**Tech Stack:** [Key technologies/libraries]
+
+**Spec:** [path to the spec/design doc this plan implements — the plan
+argues from the spec, so the spec travels with it; executors read both]
+
+## Global Constraints
+
+[The spec's project-wide requirements — version floors, dependency limits,
+naming and copy rules, platform requirements — one line each, with exact
+values copied verbatim from the spec. Every task's requirements implicitly
+include this section.]
+
+## Review Focus
+
+[The five input classes or failure modes the spec implies but no task's
+tests exercise that are most likely to bite a person using this software
+— one line each, naming the input or condition and the behavior a
+reasonable person would expect, most likely first. The spec is a vision
+document: it says what the software must do, not everything it will
+meet, and its silence on an input is not permission for that input to
+break the program. Write the list here, once, with the spec in front of
+you. Then, for each line, add the test that pins it to the task that
+owns the code, in that task's own step style.]
+
+---
+```
+
+## Task Structure
+
+````markdown
+### Task N: [Component Name]
+
+**Files:**
+- Create: `exact/path/to/file.py`
+- Modify: `exact/path/to/existing.py:123-145`
+- Test: `tests/exact/path/to/test.py`
+
+**Interfaces:**
+- Consumes: [what this task uses from earlier tasks — exact signatures]
+- Produces: [what later tasks rely on — exact function names, parameter
+  and return types. A task's implementer sees only their own task; this
+  block is how they learn the names and types neighboring tasks use.]
+
+- [ ] **Step 1: Write the failing test**
+
+```python
+def test_specific_behavior():
+    result = function(input)
+    assert result == expected
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `pytest tests/path/test.py::test_name -v`
+Expected: FAIL with "function not defined"
+
+- [ ] **Step 3: Implement `function(input: InputType) -> ResultType` in `exact/path/to/file.py`**
+
+One line on the approach when the signature and the test leave a choice
+(which library call, which data structure); a code block only for an
+algorithm they do not determine.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `pytest tests/path/test.py::test_name -v`
+Expected: PASS
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add tests/path/test.py src/path/file.py
+git commit -m "feat: add specific feature"
+```
+````
+
+## What a Step Contains
+
+A step is done when the implementer can write exactly one reasonable thing
+from it. That is the whole requirement: unambiguous, not complete. Each kind
+of step carries what makes it unambiguous and nothing more:
+
+- **A test step:** the test's name and its assertions, as code, with the
+  spec's exact values in them.
+- **A code step:** the exact signature (name, parameters, return type), the
+  file it lives in, and the specific values the spec pins. The implementer
+  writes the body. A body appears only for an algorithm the signature and
+  tests do not determine, or for exact copy the spec fixes.
+- **A verification step:** the command to run and the output that means it
+  passed.
+- **A reference to another task:** that task's Interfaces block says what
+  to use; the plan does not repeat that task's code.
+
+A plan is the set of decisions the implementer cannot make alone. A plan
+longer than the code it describes has written the code instead. Lines that
+decide nothing ("TBD", "handle edge cases", "add appropriate validation",
+"write tests for the above", a type or function no task defines) are the
+opposite failure, and the self-review catches both.
+
+## Self-Review
+
+After writing the complete plan, look at the spec with fresh eyes and check the plan against it. This is a checklist you run yourself — not a subagent dispatch.
+
+**1. Spec coverage:** Skim each section/requirement in the spec. Can you point to a task that implements it? List any gaps.
+
+**2. Step scan:** Every step must let the implementer write exactly one reasonable thing, and no step may carry more than that: a line that decides nothing is a gap, a function body the signature and tests already determine is a transcript. Fix both.
+
+**3. Type consistency:** Do the types, method signatures, and property names you used in later tasks match what you defined in earlier tasks? A function called `clearLayers()` in Task 3 but `clearFullLayers()` in Task 7 is a bug.
+
+**4. Review Focus:** For each input class or failure mode the spec implies, is there a task whose tests exercise it? The five uncovered ones most likely to bite a person go in the Review Focus section, and each line there gets its test added to the owning task. An empty section means you checked and found none, not that you skipped the check.
+
+**5. Proportion:** Compare the plan's length to the spec's. A plan several times longer than the spec it implements is a transcript of the program, not a plan. If code blocks are most of the document, replace bodies with signatures, test names and assertions, and check that each step is still unambiguous.
+
+If you find issues, fix them inline. No need to re-review — just fix and move on. If you find a spec requirement with no task, add the task.
+
+## Execution Handoff
+
+After saving and self-reviewing the plan, link it for your human partner
+to read. If they have already explicitly supplied an execution method, ask
+them to review the plan and confirm it captures what they want; wait for that
+review before implementation, then use the preserved method. Otherwise, ask
+them to review the plan and choose an execution method before implementation.
+
+**When no execution method has already been supplied:**
+
+**"Plan complete and saved to `docs/superpowers/plans/<filename>.md`. Please review the plan. Which execution approach would you prefer?**
+
+- **Subagent-driven** - A fresh subagent implements each task and a fresh reviewer checks it before the next one starts, then a whole-branch review at the end. Most thorough; costs a fresh context per task and per review.
+- **Native** - I implement every task myself in this session, the way this harness runs work, then one fresh reviewer on the most capable model checks the whole branch. Cheapest and fastest; no independent review until the end. Runs well with a mid-tier session model, since the plan carries the design.
+
+**For this plan I recommend <one of the two>, because <one sentence from the plan: how much the tasks depend on each other's interfaces, how many there are, what a shipped mistake would cost>. Does the plan capture what you want, and which approach should we use?"**
+
+**When an execution method has already been supplied:**
+
+**"Plan complete and saved to `docs/superpowers/plans/<filename>.md`. Please review the plan. Does it capture what you want?"**
+
+**If Subagent-driven chosen:**
+- **REQUIRED SUB-SKILL:** Use superpowers:subagent-driven-development
+
+**If Native chosen:**
+- **REQUIRED SUB-SKILL:** Use superpowers:executing-plans

package/codex/skill/references/verification.md

@@ -0,0 +1,163 @@
+# Verification contract
+
+Orchestrator reads before verification design, QA/Reviewer assignment, correction rechecks, or UI acceptance checks.
+QA and
+Reviewer contracts are in their profiles; they read this file only for sections the brief explicitly cites.
+Visual companion design discussion is distinct from QA UI acceptance.
+
+## Risk-scaled execution
+
+SKILL.md Risk-scaled execution holds the risk table, risk definitions, evidence-reuse rule, and role order,
+including Reviewer timing. Product/test edits belong exclusively to Coder except under the Orchestrator direct path;
+Orchestrator may inspect/run checks but
+routes code corrections to Coder. Determine the minimum
+flow from risk and any specific instruction or approved commitment, and record which requirements each check or review
+satisfies. For small, low-risk work with clear scope and acceptance evidence and no such requirement,
+Orchestrator's focused
+checks suffice; do not call QA or Reviewer automatically. Significant/high-risk work requires independent review of the
+full change at the final relevant state after the required QA/focused checks and any QA recheck.
+
+Many known metadata files are not significant solely because there are many, and a one-file permission or data-loss
+rule may be. A vague request to delete unnecessary files does not establish low risk; reclassify when installer,
+manifest, or other contracts are affected. For a verified ignore-pattern or metadata cleanup, confirm the targets are
+unused, required project materials are unaffected, ignore patterns cover only intended paths, and the diff matches the
+approved scope; Orchestrator's focused checks then suffice without automatically calling QA or Reviewer.
+An environment failure
+is distinct from a code failure; report the exact limitation and any remaining evidence gap to Orchestrator.
+
+Use additional Planner/Scouter only for unresolved planning/discovery questions. Reviewer covers substantial changes and
+correctness, factual, security, data, or interface risks. Orchestrator may use Planner/Scouter/Reviewer when justified
+and assigns
+all Coder/QA work. Specialists report unresolved questions to Orchestrator, who assigns support only when needed.
+
+QA runs applicable existing functional/test checks, or approved structural/consistency checks for policy and
+configuration changes. Reviewer reads the assigned diff/source for correctness, factual accuracy, and security. Outside the final plan Reviewer correction exception, after a
+behavior fix QA reruns affected checks, and Reviewer rechecks only when warranted. Reuse a Reviewer only when
+independent of the work and self-review and when evidence meets required scope and freshness.
+Resolve or explicitly disposition findings and confirm
+acceptance evidence before completion; claim checks only with verified output.
+
+## Task acceptance and final plan acceptance
+
+Task-local acceptance is distinct from overall final plan verification and acceptance. Orchestrator connects each task's
+acceptance criteria to actual evidence, currently required checks and findings before accepting it; checkbox
+completion, a Coder report or passing commands alone do not establish acceptance.
+
+Task acceptance and its focused commit require only the task's risk-scaled evidence: a FRESH QA instance per task that
+needs QA (same-task rechecks may reuse), or Orchestrator focused checks for small, low-risk tasks;
+Reviewer timing and task-boundary gates follow SKILL.md Risk-scaled execution. For an independently acceptable task,
+do not delay its acceptance/commit solely for later final plan verification. Currently required task checks must not
+be deferred to final verification to accept early. State the scope and timing of final-only integration criteria in
+the plan; with a plan, the required final whole-change review is final plan verification.
+
+A task commit record does not mark unperformed final verification complete. Orchestrator still decides final plan
+acceptance
+using final QA/Reviewer/integration evidence and findings, preserving unverified scope and explicit dispositions.
+Valid evidence may cover both task and plan requirements only under the existing scope/state/independence/freshness/flow
+rules. For final Reviewer findings on already committed plan work, Orchestrator defines a follow-up task and required
+planning/approvals. Coder leaves corrections uncommitted during rechecks. Orchestrator refreshes the latest committed
+state plus uncommitted diff and changed-file list in the Reviewer artifact/brief. Reuse an independent Reviewer or
+assign another independent Reviewer as needed. Repeat Coder → Reviewer without QA reassignment until findings are
+resolved; Orchestrator then accepts the corrections and creates one focused follow-up commit.
+Final QA findings retain Coder correction and QA recheck before a new focused commit.
+Do not automatically amend/reset or duplicate the original task commit. Scope expansion keeps existing new
+planning and approval obligations.
+
+### UI browser acceptance checks
+
+Only when assigned UI acceptance criteria and the brief supplies the workspace, existing launch command or URL,
+required account and test-data scope, and permitted interactions, QA may use the existing approved test environment
+to launch the app or open the URL with available approved browser tools. Follow tool instructions and any applicable
+installed browser skill. This permission does not authorize source/document/test/configuration editing, installing
+dependencies, or changing environment configuration. Report missing prerequisites to Orchestrator and leave affected
+criteria
+unverified. For each criterion record the command or URL, test state and viewport (or not applicable),
+interaction steps,
+expected and observed results, and accessible evidence. App startup, page load, and static checks alone do not prove
+complete UI behavior. For unavailable test environment or browser tools, report the exact limitation and affected
+unverified criteria. Clean up only QA-created processes and sessions; preserve existing shared services and sessions.
+When assigning UI acceptance criteria, Orchestrator cites this section with its accessible path in the QA brief.
+
+### Criterion evidence and finding handoff
+
+QA reports every acceptance criterion from the brief by identifier, or original wording when no identifier exists.
+Each criterion records method and scope, run status, accessible evidence, criterion verdict, and unverified reason
+and remaining scope. Run status is passed, failed, not run, or environment blocked; criterion verdict is proven,
+unmet, or unverified. Passing a check alone does not prove a criterion: evidence must connect its conditions and
+expected result to actual observations. Preserve partial confirmation and out-of-scope, missing-check, or environment
+blocked gaps as unverified; omit no criteria. PASS, if used, means only run status and cannot replace criterion
+verdicts.
+Structural checks prove structural criteria only; they do not prove actual behavior, installation, or live agent runtime
+compliance.
+
+For QA execution failure or an unmet criterion, Orchestrator assigns Coder correction and obtains a QA recheck before
+Reviewer.
+Do not enter Reviewer until QA reports the finding as resolved, unresolved, or unverified with evidence; unresolved
+execution failures or unmet criteria require correction and another QA recheck before that stage. QA rechecks the defect
+reproduction path and related checks invalidated by the fix. Environment blocks, missing checks, and out-of-scope
+criteria
+are evidence gaps, not presumed code defects; Orchestrator handles those gaps under the existing disposition policy
+without
+substituting Reviewer review for QA evidence.
+
+For an acceptance-linked behavior finding, Reviewer reports the criterion, expected behavior, observed problem, related
+source, reproduction conditions and steps, and evidence to Orchestrator, distinguishing source-inferred reproduction
+from
+execution-observed results without running QA tests. Outside the final plan Reviewer correction exception, Orchestrator routes it to Coder correction and QA post-fix recheck.
+Outside that exception, for significant/high-risk work, Reviewer then reviews the final full change once after QA recheck (the same Reviewer
+rechecks the same scope after a fix), or, for already committed
+plan work, rechecks only the affected findings when warranted. Reviewer continues handling
+structure, design, factual, and security findings that execution checks cannot settle; observable security/interface
+issues may require both QA verification and Reviewer source review.
+
+Orchestrator accepts using criterion verdicts, findings, recheck evidence, and remaining gaps, rather than an overall
+run result.
+Explicit disposition does not convert unverified to proven; completion reports preserve remaining unverified scope.
+For low-risk work without a QA agent, Orchestrator's focused checks likewise
+connect each criterion to evidence.
+
+
+Read brief-cited `references/superpowers/test-driven-development/SKILL.md`; retain ARC exceptions.
+
+
+### Final plan Reviewer correction loop
+
+For a plan's final overall Reviewer findings, including behavior findings, Orchestrator assigns
+Coder → Reviewer recheck with no QA reassignment. Repeat corrections and Reviewer rechecks until findings are resolved;
+the initial single full review does not prohibit necessary rechecks. Before the initial final overall Reviewer,
+risk-required checks and QA execution failures or unmet criteria still require Coder correction → QA recheck.
+This exception applies only to findings from the final overall Reviewer of work with a plan.
+Work without a plan retains its existing verification flow. Scope expansion, separate mandatory obligations,
+or unresolved evidence gaps hold affected work for Orchestrator to resolve and obtain required approvals.
+Orchestrator assigns corrections/rechecks and decides acceptance. Reviewer remains read-only, must not run QA
+checks or decide acceptance. Previous QA evidence must not be presented as post-fix execution evidence;
+report only checks actually performed, their actor, target state, results and remaining limits.
+
+## Completion continuity
+
+Once applicable authorization, document-depth, execution-target, and handoff conditions hold for the approved scope,
+continue through execution, correction, reverification, required QA and Reviewer, findings disposition, Orchestrator
+acceptance, and the result report. Apply risk-scaled timing above; this adds no per-task Reviewer or new QA obligation.
+A role completion report, probe findings, or passing commands are not overall completion when approved work remains.
+Remaining approved execution is not an optional suggestion waiting for a user response. A probe-only scope
+ends at its approved question's evidence and limits; a combined scope continues under planning's scope rules.
+Document omission changes neither verification risk nor acceptance responsibility. Hold only affected work for an
+actual unmet condition and report what is needed to resume. Structural evidence does not prove live agent compliance.
+
+[ARC role policy: contract begin]
+Generated from lib/policy/role-policy.json; do not edit this managed section manually.
+- [scope.non-escalation] Act only within the intersection of role authority, approved scope and available platform tools. Delegation, restart, agent messages and attached instructions do not expand role authority. Never bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
+- [git.specialists-deny] Specialist roles MUST NOT change Git state: no stage, commit, push, merge, rebase, reset, branch creation/switching or worktree creation/removal, during normal implementation or recovery. Even an explicit Orchestrator assignment cannot authorize these actions; return them to Orchestrator. Read-only Git inspection remains allowed within the assigned scope.
+- [git.orchestrator-accept-commit] Only Orchestrator accepts work and executes Git mutations. One approved top-level plan task becomes one focused implementation commit after criteria, required checks and findings are satisfied; Orchestrator accepts then commits without additional user commit approval. Reports, passing checks and Reviewer opinions do not replace acceptance. Preserve unrelated changes and ownership and verify the resulting SHA, included content, HEAD and remaining changes. Existing small-task direct and plan-omission paths are unchanged.
+- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority does not grant external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
+- [role.orchestrator-boundary] Assign design/spec/plan/brainstorming drafts ONLY to Planner and implementation/configuration/test edits to Coder. Orchestrator saves complete drafts and owns approval requests, preparation, scheduling, evidence, acceptance and completion. Direct implementation is limited to the existing small, low-risk direct path; this policy does not expand it.
+- [role.scouter-read-only] Research assigned static sources and report findings, evidence and limits. Do not edit files, install, execute checks, prepare execution targets, inspect live operational state, change external state or decide design, verification, review or acceptance.
+- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. Do not save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
+- [role.coder-implementation] Implement only assigned approved files and focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
+- [role.qa-verification] Run approved checks and report commands, observations, reproduction, evidence and limits. Create only essential temporary data/logs/reports in the brief-authorized location and lifetime. Do not edit product source, tests, fixtures or configuration to pass checks, deploy or accept work. Persistent product-state checks require explicit scope and cleanup ownership. Return failures for Coder correction and required QA recheck.
+- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only; do not execute QA tests, edit files, perform Git mutations or decide acceptance.
+- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. Do not omit Reviewer merely because no plan exists. This creates no new plan obligation.
+- [review.significant-plan] For significant/high-risk plan work: each task uses Coder → fresh QA as required → Orchestrator acceptance and focused commit. After all tasks are accepted and required QA is complete, Reviewer reviews the final full change once. Reviewer is NOT a per-task or per-commit required gate. Preserve required checks and necessary finding rechecks.
+- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only to that final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
+- [platform.codex] Role restrictions are prompt-level contracts, not a filesystem sandbox. No documented role-specific Git hook or generic per-agent tool allowlist is assumed. Existing shell capabilities are retained because static read access after shell reduction has not been verified; Coder and QA need shell for approved checks.
+[ARC role policy: contract end]

package/codex/skill/references/visual-companion.md

@@ -0,0 +1,23 @@
+# Visual companion contract
+
+Read before offering or operating a visual companion.
+
+## Visual companion
+
+Visual companion design discussion is distinct from QA UI acceptance checks under the approved test brief.
+
+Planner identifies a genuinely visual question, why a visual helps, options, the user decision, and a complete content
+draft; Planner does not write screens, start a server, operate a browser, or request approval.
+Orchestrator makes a just-in-time
+offer as its own message only when a question is clearer visually, then waits for acceptance. If declined, continue in
+text and do not offer again unless the user raises it. If accepted, decide per question whether to use the companion.
+Orchestrator owns its guide, server/browser, workspace paths, live-session checks, complete keyed URL, screens,
+session state,
+feedback/events, stale-screen clearing when returning to text, and cleanup. Check the server before showing a screen;
+after the user's reply, treat terminal text as primary and events as supplemental. A UI topic or accepted companion
+alone does not route every question through a browser.
+
+
+Upstream guide/scripts: `<installed ARC>/references/superpowers/brainstorming/visual-companion.md` and adjacent `scripts/`.
+ARC guide: `references/visual-companion.md`; Orchestrator briefs absolute paths and retains approval/server/browser
+ownership. Missing files stop dependent work without global fallback.

package/codex/skill/scripts/apply-models.py

@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+"""Apply the bundled model settings to installed Codex agent profiles."""
+
+from __future__ import annotations
+
+import argparse
+import importlib.util
+import os
+import stat
+import sys
+import tempfile
+from pathlib import Path
+from types import ModuleType
+
+
+class ValidationError(Exception):
+    """An invalid settings file, profile, or target path."""
+
+
+def load_model_module() -> ModuleType:
+    """Load the shared implementation from this script's resolved directory."""
+    module_path = Path(__file__).resolve().with_name("model_config.py")
+    try:
+        spec = importlib.util.spec_from_file_location("_arc_model_config", module_path)
+        if spec is None or spec.loader is None:
+            raise ValidationError(f"cannot load shared model configuration module: {module_path}")
+        module = importlib.util.module_from_spec(spec)
+        sys.modules[spec.name] = module
+        write_bytecode = sys.dont_write_bytecode
+        sys.dont_write_bytecode = True
+        try:
+            try:
+                spec.loader.exec_module(module)
+            except Exception:
+                sys.modules.pop(spec.name, None)
+                raise
+        finally:
+            sys.dont_write_bytecode = write_bytecode
+    except ValidationError:
+        raise
+    except Exception as exc:
+        raise ValidationError(f"cannot load shared model configuration module at {module_path}: {exc}") from exc
+    return module
+
+
+def _regular_path_info(path: Path, label: str = "profile") -> tuple[Path, os.stat_result]:
+    """Check every path component without following symlinks."""
+    expanded = path.expanduser()
+    absolute = expanded if expanded.is_absolute() else Path.cwd() / expanded
+    parts = absolute.parts
+    current = Path(absolute.anchor)
+    info: os.stat_result | None = None
+    for index, part in enumerate(parts[1:]):
+        if part in ("", "."):
+            continue
+        current = current / part
+        try:
+            info = current.lstat()
+        except OSError as exc:
+            raise ValidationError(f"cannot inspect {label} path {current}: {exc}") from exc
+        if stat.S_ISLNK(info.st_mode):
+            raise ValidationError(f"{label} path contains a symlink: {current}")
+        if index < len(parts[1:]) - 1 and not stat.S_ISDIR(info.st_mode):
+            raise ValidationError(f"{label} path component is not a directory: {current}")
+    if info is None or not stat.S_ISREG(info.st_mode):
+        raise ValidationError(f"{label} must be a regular file: {absolute}")
+    return absolute, info
+
+
+def read_profile_safely(path: Path) -> bytes:
+    """Read one regular profile after rejecting symlink path components."""
+    absolute, _ = _regular_path_info(path)
+    try:
+        return absolute.read_bytes()
+    except OSError as exc:
+        raise ValidationError(f"cannot read profile {absolute}: {exc}") from exc
+
+
+def resolve_agents_dir(explicit: Path | None) -> Path:
+    if explicit is not None:
+        return explicit.expanduser()
+    codex_home = os.environ.get("CODEX_HOME")
+    if codex_home is not None:
+        if not codex_home.strip():
+            raise ValidationError("CODEX_HOME must not be empty")
+        return Path(codex_home).expanduser() / "agents"
+    return Path.home() / ".codex" / "agents"
+
+
+def _load_settings(model_config: ModuleType, config_path: Path) -> dict:
+    settings_path, _ = _regular_path_info(config_path, "settings")
+    try:
+        return model_config.load_settings(settings_path)
+    except model_config.ValidationError as exc:
+        raise ValidationError(str(exc)) from exc
+
+
+def prepare_updates(config_path: Path, agents_dir: Path) -> dict[Path, tuple[bytes, bytes, int]]:
+    model_config = load_model_module()
+    settings = _load_settings(model_config, config_path)
+    updates: dict[Path, tuple[bytes, bytes, int]] = {}
+    # Read, parse, and render every profile before the caller can write any file.
+    for role, filename in model_config.ROLE_FILES.items():
+        path = agents_dir / filename
+        original = read_profile_safely(path)
+        try:
+            updated = model_config.render_profile(original, role, settings[role], path)
+        except model_config.ValidationError as exc:
+            raise ValidationError(str(exc)) from exc
+        _, info = _regular_path_info(path)
+        if original != updated:
+            updates[path] = (original, updated, info.st_mode)
+    return updates
+
+
+def stage_file(directory: Path, target: Path, content: bytes, mode: int) -> Path:
+    descriptor, temporary_name = tempfile.mkstemp(prefix=f".{target.name}.", suffix=".tmp", dir=directory)
+    temporary = Path(temporary_name)
+    try:
+        os.fchmod(descriptor, stat.S_IMODE(mode))
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(content)
+            handle.flush()
+            os.fsync(handle.fileno())
+    except BaseException:
+        try:
+            os.close(descriptor)
+        except OSError:
+            pass
+        temporary.unlink(missing_ok=True)
+        raise
+    return temporary
+
+
+def apply_updates(updates: dict[Path, tuple[bytes, bytes, int]]) -> None:
+    staged_new: dict[Path, Path] = {}
+    staged_old: dict[Path, Path] = {}
+    replaced: list[Path] = []
+    try:
+        for path, (original, updated, mode) in updates.items():
+            staged_new[path] = stage_file(path.parent, path, updated, mode)
+            staged_old[path] = stage_file(path.parent, path, original, mode)
+        for path in updates:
+            os.replace(staged_new[path], path)
+            replaced.append(path)
+    except OSError as exc:
+        rollback_errors = []
+        for path in reversed(replaced):
+            try:
+                os.replace(staged_old[path], path)
+            except OSError as rollback_exc:
+                rollback_errors.append(f"{path}: {rollback_exc}")
+        detail = f"failed to update profiles: {exc}"
+        if rollback_errors:
+            detail += "; rollback errors: " + "; ".join(rollback_errors)
+        raise ValidationError(detail) from exc
+    finally:
+        for temporary in (*staged_new.values(), *staged_old.values()):
+            temporary.unlink(missing_ok=True)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    default_config = Path(__file__).resolve().parent.parent / "models.toml"
+    parser = argparse.ArgumentParser(description="Validate and apply ARC model settings to Codex agent profiles.")
+    parser.add_argument("--config", type=Path, default=default_config, help=f"TOML settings file (default: {default_config})")
+    parser.add_argument("--agents-dir", type=Path, help="Codex agent profile directory")
+    action = parser.add_mutually_exclusive_group()
+    action.add_argument("--dry-run", action="store_true", help="show required changes without writing files")
+    action.add_argument("--check", action="store_true", help="exit 1 if agent profiles differ from the settings")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        agents_dir = resolve_agents_dir(args.agents_dir)
+        updates = prepare_updates(args.config, agents_dir)
+        if args.check:
+            if updates:
+                for path in updates:
+                    print(f"out of sync: {path}")
+                return 1
+            print("all five agent profiles match models.toml")
+            return 0
+        if args.dry_run:
+            if updates:
+                print("checking five agent profiles; planned updates:")
+                for path in updates:
+                    print(f"would update: {path}")
+            else:
+                print("all five agent profiles already match models.toml")
+            return 0
+        if updates:
+            apply_updates(updates)
+            print("applied settings across five agent profiles")
+            for path in updates:
+                print(f"updated: {path}")
+        else:
+            print("all five agent profiles already match models.toml")
+        return 0
+    except ValidationError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())