axstack 0.50.2 → 0.52.0

package/README.md

@@ -174,3 +174,7 @@ Regenerate `bun.lock` with the minimum Bun version in `package.json.engines`
 ## License
 
 [MIT](LICENSE) © 2026 Axat Bhardwaj.
+
+The [opt-in saved New-chat default script](skills/axstack/references/default-routing.md)
+uses subscription capacity and preserves project overrides; its five-minute timer
+is never enabled by installation. Role-labelled title instructions need T3 >=0.1.3.

package/docs/installation.md

@@ -294,10 +294,11 @@ missing either holds this role without substitution, including Haiku 4.5.
 The `codex-only` assignments for these roles are unchanged.
 Scout adds `axstack-explore-codebase-luna` at Codex Luna xhigh in `mixed` and
 `codex-only`. Luna has an explicit null model in `claude-only`.
-The three `-sol` pair seats for auditor, research-code, and explore-execution
-use Sol high in `mixed` and `codex-only`; `claude-only` records intentional
-absences. The paired seats run independently on one brief and the driver
-reconciles their findings.
+The `-sol` research-code and explore-execution pair seats use Terra high in
+`mixed` and Sol high in `codex-only`; the auditor pair stays Sol high in both.
+Their role IDs remain unchanged. `claude-only` records intentional absences.
+The paired seats run independently on one brief and the driver reconciles
+their findings.
 
 The mixed checker uses the Claude Sonnet class at low effort, resolved from
 saved capabilities. Mixed `axstack-research-x` uses `grok` with

package/docs/workflows.md

@@ -140,14 +140,15 @@ and `codex-only`. In `claude-only`, Luna is intentionally absent.
 The mixed X route uses Grok.
 The mixed `axstack-auditor` uses Haiku 5.5 xhigh, pinned to `claude-haiku-5-5`;
 missing that ID or xhigh effort holds without substitution. The mixed
-`axstack-explainer-review` uses Sol medium; `axstack-explainer` pins
+`axstack-explainer-review` uses Terra medium; `axstack-explainer` pins
 `claude-sonnet-5-5` high with class `sonnet`. Both roles cover every Explain
 visual, including chat Mermaid and anatomy figures.
 In `claude-only`, `axstack-auditor` uses the Claude Sonnet class at high effort.
-The new `-sol` auditor, research-code, and explore-execution seats use Sol high
-in `mixed` and `codex-only`; `claude-only` records each as intentionally absent.
-Dispatch the base and Sol seats independently on the same brief, then reconcile
-their findings per claim without averaging.
+The `-sol` research-code and explore-execution seats use Terra high in `mixed`
+and Sol high in `codex-only`; the auditor pair stays Sol high in both.
+`claude-only` records each as intentionally absent. Their stable role IDs remain
+unchanged. Dispatch the base and paired seats independently on the same brief,
+then reconcile their findings per claim without averaging.
 
 The installed `<skills-dir>/axstack/roles.json` adds the selected preset name:
 `{ "version": 1, "preset": "<name>", "roles": [...] }`. The runtime reads it
@@ -162,7 +163,8 @@ Peer roles use the stable IDs `axstack-reviewer-primary` and
 `axstack-reviewer-peer`; their provider/class mappings come only from the
 selected preset and the ordered reviewer table above. The mixed peer coordinator and review-lane binding
 `axstack-owner` uses Sol high and never reviews. `axstack-reviewer-secondary`
-is used in the authored mapping and, alongside `axstack-reviewer-primary`,
+uses Terra xhigh for Sol-authored candidates in `codex-only`. It is used
+in the authored mapping and, alongside `axstack-reviewer-primary`,
 in codebase findings mode.
 
 The unavailable adviser in each single-provider preset stays explicitly

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axstack",
-  "version": "0.50.2",
+  "version": "0.52.0",
   "description": "Axstack installer and setup CLI: installs owned chat skills and role data, configures supported harness settings, and checks T3 Code capabilities.",
   "keywords": [
     "claude-code",

package/profiles/presets/codex-only.json

@@ -52,8 +52,8 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "xhigh",
-      "notes": "Eligible authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance.",
-      "modelClass": "luna"
+      "notes": "Terra xhigh authored reviewer for a Sol-authored candidate. Never author or owner; review exact SHA and base across all six angles and acceptance.",
+      "modelClass": "terra"
     },
     {
       "id": "axstack-reviewer-peer",

package/profiles/presets/mixed.json

@@ -102,12 +102,12 @@
     },
     {
       "id": "axstack-research-code-sol",
-      "name": "Axstack research code Sol",
+      "name": "Axstack research code Terra",
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Independent Sol high research code investigator: verifies code behavior and executable evidence on the same bounded brief without cross-reading. Reports findings for driver reconciliation.",
-      "modelClass": "sol"
+      "notes": "Independent Terra high research code investigator: verifies code behavior and executable evidence on the same bounded brief without cross-reading. Reports findings for driver reconciliation.",
+      "modelClass": "terra"
     },
     {
       "id": "axstack-research-web",
@@ -143,8 +143,8 @@
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "medium",
-      "notes": "Independent Sol medium explanation reviewer: always reviews every visual. Reviews consequential or complex driver-written prose or on request. Checks the exact artifact for text and source fidelity. The browser interaction pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution. Design review follows design.md hard rules and FRONTEND-DESIGN.md (calibration defaults, restraint and quality floor) for every inline HTML page and every Publish article adaptation. For inline pages the reviewer itself renders exact bytes with html_preview at 728px dark and 360px light as a non-publishing self-check. For Publish the reviewer opens axstack-ui-verifier PNGs at 728px dark and 360px light plus 390px mobile and 1440px desktop, covering all four widths in both themes with paths bound to the artifact SHA-256 and recorded before review. Inspect the 1440px desktop screenshot for balanced composition, intentional horizontal margins, bounded prose measure, typography, section spacing and chart legibility. Inspect the 360px and 390px mobile screenshots for gutters, readable text and chart labels. A page failing to look decent is a blocking design finding, repaired by the same author within the two-round visual limit. If only design findings remain after the second round, deliver the visual with each finding named. Never describe a remaining finding as fixed or a clean pass. Apply Delivery's normal holds for other failures and unknown renders. Chat Mermaid and anatomy keep their existing review.",
-      "modelClass": "sol"
+      "notes": "Independent Terra medium explanation reviewer: always reviews every visual. Reviews consequential or complex driver-written prose or on request. Checks the exact artifact for text and source fidelity. The browser interaction pass belongs to axstack-ui-verifier. Any artifact change invalidates its review. Resolve the class from saved T3 capabilities at run start; rejection and unavailable settings hold without substitution. Design review follows design.md hard rules and FRONTEND-DESIGN.md (calibration defaults, restraint and quality floor) for every inline HTML page and every Publish article adaptation. For inline pages the reviewer itself renders exact bytes with html_preview at 728px dark and 360px light as a non-publishing self-check. For Publish the reviewer opens axstack-ui-verifier PNGs at 728px dark and 360px light plus 390px mobile and 1440px desktop, covering all four widths in both themes with paths bound to the artifact SHA-256 and recorded before review. Inspect the 1440px desktop screenshot for balanced composition, intentional horizontal margins, bounded prose measure, typography, section spacing and chart legibility. Inspect the 360px and 390px mobile screenshots for gutters, readable text and chart labels. A page failing to look decent is a blocking design finding, repaired by the same author within the two-round visual limit. If only design findings remain after the second round, deliver the visual with each finding named. Never describe a remaining finding as fixed or a clean pass. Apply Delivery's normal holds for other failures and unknown renders. Chat Mermaid and anatomy keep their existing review.",
+      "modelClass": "terra"
     },
     {
       "id": "axstack-ui-verifier",
@@ -185,12 +185,12 @@
     },
     {
       "id": "axstack-explore-execution-sol",
-      "name": "Axstack execution explorer Sol",
+      "name": "Axstack execution explorer Terra",
       "provider": "codex",
       "modeId": "full-access",
       "thinkingOptionId": "high",
-      "notes": "Independent Sol high execution explorer: runs authorized bounded runtime checks on the same brief without cross-reading. Reports findings for driver reconciliation.",
-      "modelClass": "sol"
+      "notes": "Independent Terra high execution explorer: runs authorized bounded runtime checks on the same brief without cross-reading. Reports findings for driver reconciliation.",
+      "modelClass": "terra"
     },
     {
       "id": "axstack-auditor",

package/skills/axstack/references/default-routing.md

@@ -0,0 +1,166 @@
+# Saved New-chat default (opt-in)
+
+Run these commands from the installed Axstack skill directory (containing
+`scripts/` and `systemd/`). `bun scripts/sync-default.js --help` lists all inputs
+and writes. Dry-run is the default. `--apply` changes only the global saved
+`defaultModelSelection`; existing chats, dispatch roles and provider settings
+are untouched. Manual New chat may retain a draft model choice; project overrides
+still win. Output lists saved project override IDs. On older T3 settings where
+`projectSettingsFolded` is false/absent, legacy project defaults may also live in
+T3's project records and are not enumerated by this script; inspect Project Settings.
+There is no per-start hook or guarantee that a client has refreshed its saved default.
+
+## Inputs and policy
+
+The live path reads the one enabled `cliproxy` source from settings, using its
+URL and management key in memory. When settings contain the literal masked key
+`••••••`, resolve only `secrets/usage-limit-source-<base64url(sourceId)>.bin` beside
+the explicit settings file, using T3's UTF-8/base64url naming. Inline keys still work.
+The settings object stays masked; only a temporary hub config is hydrated. Secret
+files must be owned private regular files, with no symlinks or shared writable
+parent; malformed, missing or unsafe keys hold with a sanitized reason. Neither
+secret bytes nor raw settings/headers/responses are logged or persisted. Like installed T3 0.1.3 `makeCliproxyApi`, it
+GETs `v0/management/auth-files`, then POSTs `api-call` envelopes requesting GET
+Anthropic OAuth `/api/oauth/usage` or Codex `/backend-api/wham/usage`. Hub-side
+`$TOKEN$` substitution keeps account tokens out of the script. It never requests
+account credential contents, reset credits or reset-quota operations. HTTPS is required except
+loopback fixtures, redirects are refused, requests time out after 15 seconds,
+and at most 32 accounts are queried in batches of four. A source/account failure
+holds; reports contain only policy diagnostics, never raw settings or responses.
+No live requests were needed to develop the adapter.
+
+The default model catalog comes from existing T3 `caches/<instanceId>.json`
+(sibling to `userdata`), with ready/enabled/installed status, matching driver,
+model slug and effort descriptor. Catalogs older than 24 hours hold; the script
+never refreshes providers. Exactly one enabled instance per target driver is
+required because usage sources do not establish which of several instances
+shares which accounts. Refresh catalogs in T3 if held. These checks establish
+catalog evidence, not successful provider execution.
+
+Routes: Claude `claude-opus-5-5` medium; Codex `gpt-6-astra` medium;
+Codex `gpt-6.1-sol` xhigh. The configured instance IDs are discovered, not renamed.
+Both source and account telemetry must be no older than five minutes, with
+valid applicable session/weekly percentages and durations. A supplied reset must
+be a valid future date within its window duration. Missing,
+stale, malformed or ambiguous data holds the entire decision, without failover.
+A successful Codex response containing only a seven-day primary window (secondary
+absent/null) is authoritative single-window telemetry: the adapter explicitly marks
+session n/a. It does not synthesize session capacity. A plain incomplete snapshot
+without this provenance still holds; weekly is always required. An account needs
+remaining quota in every applicable window. Null or absent reset timing is valid for
+Claude session/weekly/scoped Opus and Codex windows. The adapter omits the missing
+reset; it never invents a timestamp. Unknown reset timing alone does **not** mean
+unused or not started: the reported used percentage still governs remaining quota,
+same-account eligibility and Astra's reserve, including exhaustion at 100% used.
+For pressure, an untimed window earns zero elapsed-window credit, a conservative
+lower bound, while its full reported usage is subtracted. `untimedWindows` reports
+these windows (including relevant Opus scope); n/a session windows are separate.
+Malformed non-null dates, stale telemetry and missing applicable windows still hold. A blocked account does not
+exhaust other accounts. Opus scoped weekly limits also constrain eligibility.
+
+Installed T3 0.1.3 client `main-lZWM_z1N.js` functions `g7`/`_7` display **equal
+account arithmetic means**, not a weighted quota total: each account contributes
+one percentage. Codex groups by window kind; Claude uses kind plus window ID.
+A weekly-exhausted account contributes 100% session usage. Different resets stay
+per account; T3 lists refill events scaled by member count, rather than inventing
+one pool reset. An n/a session contributes neither a zero nor 100% observation;
+only accounts with an applicable session enter its mean, and an all-n/a session
+is reported as null with status n/a. This script uses that unrounded mean for the reserve check:
+Astra is excluded if either applicable Codex window has less than 25% remaining; exactly
+25% is eligible. Opus has no Codex reserve exclusion. Percentages do not establish
+absolute tokens or relative subscription sizes. Duplicate identities hold
+instead of silently adding capacity from overlapping sources.
+
+Pressure is the worse session/weekly mean of elapsed-window percentage minus
+used percentage, higher meaning more underused capacity. As in T3's pace display,
+a weekly-blocked synthetic session has no duration and is omitted from pace,
+while still contributing 100% to remaining-capacity aggregation. Reset timing is
+computed per account before averaging. Similar pressure is within five percentage
+points; an existing eligible default stays unless a challenger is at least ten
+points better or a fair tie-break is justified.
+
+The timer automatically reads the existing `statev2.sqlite` beside settings using
+Bun's built-in SQLite read-only mode. It queries only recent thread metadata from
+`orchestration_v2_projection_threads` across all projects, including archived and
+soft-deleted records still present. It creates no DB, migrates nothing, and issues
+no T3 auth session. Symlink/unsafe DB or WAL/shared-memory paths hold history;
+a WAL without existing shared memory is refused to avoid creating sidecars.
+SQLite's normal transient reader locks are required. Metadata reads are capped at
+50,000 rows. Missing, incompatible, incomplete or malformed history reports an
+explicit unavailable reason, without pretending the counts are all zero.
+
+This route avoids installed CLI limitations: 0.1.0 has no thread-list command;
+0.1.3's thread list exhausts pagination but issues/revokes an auth session, and
+its project command has no list subcommand. No CLI auth or settings updates are
+needed. `--history-db` selects another existing projection DB; `--history-file`
+overrides the DB with a saved native thread-list array or complete result object.
+A non-null cursor (including zero), hasMore, total mismatch, duplicates or missing
+manual identity makes the inventory unavailable.
+
+Count identifiable top-level `createdBy:user` starts from web **or mobile** in the
+preceding seven days, using native `providerInstanceId` and `model` fields (legacy
+modelSelection snapshots also work). Two extra starts can break a pressure tie.
+Projection metadata describes the **current saved model** of a thread created in
+that period, not an immutable record of its original model; hard-deleted/pruned
+records and manual model changes limit fidelity. The source/coverage is reported.
+A supplied project-only list remains caller-scoped, not global history.
+
+When history is unavailable, similarly pressured eligible models receive fixed
+six-hour UTC slots in Opus/Astra/Sol order. The target is stable within a slot;
+pressure hysteresis still protects a current default outside a fair tie. This
+prevents indefinite starvation without timer state, a new database, per-tick
+rotation, or any claim of equal chat counts. Quota eligibility/reserves always win.
+
+## Run or enable
+
+First inspect a dry-run, including any hold and project overrides:
+
+```bash
+bun scripts/sync-default.js
+bun scripts/sync-default.js --apply
+```
+
+`--usage-file` accepts an array of normalized T3 `UsageLimitSourceSnapshot`
+objects, including per-account `usageLimits`. `--catalog-dir` selects provider
+caches. `--now <ISO>` is fixture-only and requires `--usage-file`.
+Settings symlinks are refused. Apply creates a sibling lock directory and unique
+temporary file, preserves mode, fsyncs, compares current bytes/inode/mode before
+atomic rename, then reads back. A non-cooperating writer still has a small
+compare-to-rename race; this is not a transaction with T3's settings watcher.
+An existing lock holds; after a crash inspect ownership/process state before
+manually removing that exact lock. Dry-run creates no lock or file.
+
+The five-minute user timer is a separate explicit opt-in. It runs one bounded
+process, never an agent. It is not enabled by the installer. After accepting its
+writes, install the shipped units:
+
+```bash
+mkdir -p ~/.config/systemd/user
+cp systemd/axstack-default-sync.{service,timer} ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now axstack-default-sync.timer
+journalctl --user -u axstack-default-sync.service -n 20
+# Stop future updates:
+systemctl --user disable --now axstack-default-sync.timer
+```
+
+Exit 2 means held; inspect the sanitized reason. Systemd may show that bounded
+run as failed and will try again at the next timer tick. No automatic retry loop,
+provider failover, account routing, or live service upgrade is included.
+
+## Titles
+
+On **T3 server >=0.1.3** paste [the short instructions](thread-title-instructions.txt)
+into global Settings → Threads → title instructions, or use the supported
+`server.updateSettings` patch containing only `threadTitleInstructions`.
+Preserve `textGenerationModelSelection`.
+This script never writes title settings; 0.1.0 does not support that field.
+Do not upgrade or restart T3 as part of enabling this script.
+
+These are best-effort generation instructions; deterministic child titles come
+from [runtime naming guidance](t3-runtime.md). Supply `Worker: <dispatch-key>`,
+`Reviewer: <dispatch-key>`, `Researcher: <dispatch-key>` or `Subagent: <dispatch-key>`
+explicitly, with a first message. Regeneration and empty-then-human-fed threads
+can invoke generation again; preserve the complete prior title and `Needs you:`.
+Verify New chat selection, settings watcher refresh and title regeneration on the
+actual supported client/server before claiming live behavior.

package/skills/axstack/references/role-roster.md

@@ -15,7 +15,7 @@
   | --- | --- | --- |
   | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
-  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/terra` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
 - `axstack-advisor-astra`/`axstack-advisor-opus` advise and author candidates;
   `axstack-arena-candidate-grok` adds a family.
@@ -24,7 +24,7 @@
   `axstack-auditor` audits; `axstack-checker` reports discrepancies.
 - `axstack-explainer` authors every visual Explain delivers, including pages,
   chat Mermaid and anatomy figures; mixed pins Sonnet 5.5 high exactly.
-- `axstack-explainer-review` always reviews every visual; `codex/sol` medium in mixed.
+- `axstack-explainer-review` always reviews every visual; `codex/terra` medium in mixed.
   Consequential or complex driver-written prose keeps its review rule; every
   whiteboard defense is consequential, in chat too.
 - `axstack-diligence`: read-only [diligence checks](diligence.md) for every authored PR
@@ -45,9 +45,10 @@
   `axstack-explore-codebase-luna` per facet in mixed (Haiku high + Luna
   xhigh) and codex-only (Sol high + Luna xhigh). Claude-only requires
   the Haiku high base seat per facet.
-- Sol pairs `axstack-auditor-sol`/`axstack-research-code-sol`/
+- Sol pairs (stable `-sol` IDs) `axstack-auditor-sol`/`axstack-research-code-sol`/
   `axstack-explore-execution-sol`: `codex/sol` high in
-  mixed/codex-only; intentionally absent in claude-only. Dispatch each
+  mixed/codex-only; intentionally absent in claude-only. In mixed,
+  research-code and explore-execution use `codex/terra` high instead. Dispatch each
   independently from its base seat on the same bounded brief without
   cross-reading. The driver reconciles findings per claim, never averages.
   Record intentional absence and continue with Sonnet alone.

package/skills/axstack/references/t3-runtime.md

@@ -75,9 +75,9 @@ configuration; unrelated configurations remain eligible.
 
 | Roles | Mechanism and permitted workspace | Completion |
 |---|---|---|
-| Advisers, research, read-only explorers, explainers, diligence, checker, auditor, arena prose candidates and judges, escalation | Must use async `delegate_task` in the driver worktree, title = dispatch key; tracked and untracked files stay untouched; writes only `<run>/evidence/<key>/` | Native notification followed by persisted `task_status` |
-| Reviewers (peer/authored), release checks, debug investigators, execution investigators (`axstack-explore-execution`), UI verifier candidate checks (`axstack-ui-verifier`) | Must use async `delegate_task`, title = dispatch key; driver makes a disposable detached checkout of candidate SHA and pinned base with `git worktree add --detach <run>/checkouts/<key> <sha>` (plus pinned debug patch); brief requires `cd` into it; only disposable probes write there, outputs go to `<run>/evidence/<key>/` | Same delegated terminal checks |
-| Author and repairs | Fresh authors must use async `delegate_task` with `isolation:"worktree"`, title = dispatch key, stable `clientRequestId` in their own worktree, kept until PR merges or closes; repairs use `t3_thread_send` to the same child | Delegated terminal checks plus verified candidate |
+| Advisers, research, read-only explorers, explainers, diligence, checker, auditor, arena prose candidates and judges, escalation | Must use async `delegate_task` in the driver worktree, title = role-labelled dispatch key; tracked and untracked files stay untouched; writes only `<run>/evidence/<key>/` | Native notification followed by persisted `task_status` |
+| Reviewers (peer/authored), release checks, debug investigators, execution investigators (`axstack-explore-execution`), UI verifier candidate checks (`axstack-ui-verifier`) | Must use async `delegate_task`, title = role-labelled dispatch key; driver makes a disposable detached checkout of candidate SHA and pinned base with `git worktree add --detach <run>/checkouts/<key> <sha>` (plus pinned debug patch); brief requires `cd` into it; only disposable probes write there, outputs go to `<run>/evidence/<key>/` | Same delegated terminal checks |
+| Author and repairs | Fresh authors must use async `delegate_task` with `isolation:"worktree"`, title = role-labelled dispatch key, stable `clientRequestId` in their own worktree, kept until PR merges or closes; repairs use `t3_thread_send` to the same child | Delegated terminal checks plus verified candidate |
 | Owner | Driver thread in Driver worktree; never writes tracked candidate source or tests; planning artifacts allowed only for repository Markdown; scope, integration, forge mutations and record | No worker launch |
 
 The UI verifier checkout row applies to candidate checks, while a page without
@@ -89,15 +89,21 @@ The driver may write planning artifacts (spec, ticket map) in its own worktree w
 Repairs return to that author. Missing or idle sessions grant no ownership transfer.
 The current chat/driver has no role row in any preset.
 
-At launch and rename, visible driver thread titles express a plain outcome of
-at most 30 characters.
+At launch and rename, visible driver thread titles express a plain outcome with
+`Driver:` prefix, at most 30 characters including the prefix.
 Visible driver thread titles use no repo, issue or size prefix.
-Hidden children keep dispatch-key titles.
+Hidden children keep role-labelled dispatch-key titles.
 D9 applies to driver threads only, while flagged unbound pass threads retain the
 `Needs you: <kind> <repo>#<n>` (or `<lane>`) rename under Automations.
 
 The dispatch key must be `<run>:<role>:<task>:a<n>`, recorded before launch and
-used as the exact whole T3 title. Substring matches do not establish identity.
+preserved byte-for-byte after its role prefix in the exact whole T3 title.
+Use `Worker: <dispatch-key>` for authors, `Reviewer: <dispatch-key>` for reviewers,
+`Researcher: <dispatch-key>` for research, and `Subagent: <dispatch-key>` for other children.
+Record both the key and complete display title; compare the exact complete title
+during recovery. Substring matches do not establish identity. Branch and task
+identity continue to use the original dispatch key. On title regeneration preserve
+explicit role-labelled dispatch keys and `Needs you:` notices unchanged.
 Each dispatch binds the approved spec or small-change intent, brief, authority, role snapshot, base and candidate to its dispatch key.
 Every dispatch brief must state that dispatched roles never call `html_render`.
 Dispatched roles may call `html_preview` within [UI verification](ui-verification.md).

package/skills/axstack/references/thread-title-instructions.txt

@@ -0,0 +1,3 @@
+Return only the title. For a new ordinary manual chat, use "Driver: " followed by a short sentence-case outcome naming the actual request. Aim for 30 characters including the prefix. No quotes, emoji, final punctuation, repository, issue or size prefix. Do not invent scope or turn a question into a repair task.
+Use an explicit delegated role from the supplied context only: Worker:, Reviewer:, Researcher:, or Subagent:. Merely discussing a role does not assign it.
+On regeneration preserve an existing role prefix and every explicit dispatch/tracking key byte-for-byte. Return a complete explicit role-labelled title containing a dispatch key unchanged, regardless of length. Preserve Needs you: notices and identifying details unchanged.

package/skills/axstack/scripts/default-policy.js

@@ -0,0 +1,134 @@
+import { historyCounts } from './driver-history.js';
+const routes = [
+  ['claudeAgent', 'claude-opus-5-5', 'effort', 'medium'],
+  ['codex', 'gpt-6-astra', 'reasoningEffort', 'medium'],
+  ['codex', 'gpt-6.1-sol', 'reasoningEffort', 'xhigh'],
+];
+const mean = (values) => values.reduce((a, b) => a + b, 0) / values.length;
+const fresh = (date, now, age) => Number.isFinite(Date.parse(date)) && now >= Date.parse(date) && now - Date.parse(date) <= age;
+const same = (a, b) => a?.instanceId === b?.instanceId && a?.model === b?.model;
+
+// Unknown reset timing earns no elapsed-window allowance; reported usage remains authoritative.
+function elapsed(window, now, minutes) {
+  if (window.resetsAt == null) return 0;
+  const reset = typeof window.resetsAt === 'string' ? Date.parse(window.resetsAt) : NaN;
+  if (!Number.isFinite(reset) || reset <= now || reset - now > minutes * 60000) throw Error('malformed reset timing');
+  return 1 - (reset - now) / (minutes * 60000);
+}
+
+function pool(accounts, driver, now) {
+  const members = accounts.filter((a) => a.driver === driver);
+  if (!members.length) throw Error(`missing ${driver} accounts`);
+  const rows = members.map((a) => {
+    const u = a.usageLimits;
+    if (u?.unavailable || !fresh(u?.checkedAt, now, 300000) || !Array.isArray(u?.windows)) throw Error(`unknown ${driver} telemetry`);
+    const windows = ['session', 'weekly'].map((kind) => {
+      const found = u.windows.filter((w) => w.kind === kind && !(driver === 'claudeAgent' && w.id?.startsWith('seven_day_')));
+      if (!found.length && driver === 'codex' && kind === 'session'
+        && u.notApplicable?.session === 'verified Codex weekly-only response') return null;
+      if (found.length !== 1) throw Error(`missing or ambiguous ${driver} ${kind} window`);
+      const w = found[0];
+      if (!Number.isFinite(w.usedPercent) || w.usedPercent < 0 || w.usedPercent > 100
+        || !Number.isFinite(w.windowDurationMins) || w.windowDurationMins <= 0) throw Error(`malformed ${driver} ${kind} window`);
+      return { used: w.usedPercent, elapsed: elapsed(w, now, w.windowDurationMins), resetKnown: w.resetsAt != null };
+    });
+    const scoped = u.windows.filter((w) => w.id?.startsWith('seven_day_') && /opus/i.test(w.label ?? ''));
+    for (const w of scoped) {
+      if (!Number.isFinite(w.usedPercent) || w.usedPercent < 0 || w.usedPercent > 100) throw Error('unknown Opus scoped telemetry');
+      elapsed(w, now, 10080);
+    }
+    const untimedWindows = windows.filter((w) => w?.resetKnown === false).length
+      + scoped.filter((w) => w.resetsAt == null).length;
+    const viable = windows.every((w) => w === null || w.used < 100) && scoped.every((w) => w.usedPercent < 100);
+    // Match T3's pool display: a weekly-blocked account contributes 100% session used.
+    if (windows[0] && windows[1].used >= 100) windows[0] = { used: 100, elapsed: null };
+    return { windows, viable, untimedWindows };
+  });
+  const applicable = [0, 1].map((i) => rows.flatMap((r) => r.windows[i] ? [r.windows[i]] : []));
+  const remaining = applicable.map((ws) => ws.length ? 100 - mean(ws.map((w) => w.used)) : null);
+  const pace = applicable.flatMap((ws) => {
+    const timed = ws.filter((w) => w.elapsed !== null);
+    return timed.length ? [mean(timed.map((w) => w.elapsed * 100 - w.used))] : [];
+  });
+  return { sessionRemaining: remaining[0], weeklyRemaining: remaining[1],
+    sessionStatus: applicable[0].length ? 'applicable' : 'n/a', sessionAccounts: applicable[0].length,
+    eligibleAccounts: rows.filter((r) => r.viable).length,
+    untimedWindows: rows.reduce((sum, r) => sum + r.untimedWindows, 0), score: Math.min(...pace) };
+}
+
+function candidates(settings, catalogs, now) {
+  return routes.map(([driver, model, option, effort]) => {
+    const instances = Object.entries(settings.providerInstances ?? {}).filter(([, p]) => p.enabled === true && p.driver === driver);
+    if (instances.length !== 1) throw Error(`missing or ambiguous enabled ${driver} instance`);
+    const instanceId = instances[0][0];
+    const found = catalogs.filter((c) => c.instanceId === instanceId);
+    const c = found[0];
+    const m = c?.models?.find((m) => m.slug === model);
+    if (found.length !== 1 || c.driver !== driver || c.enabled !== true || c.installed !== true || c.status !== 'ready'
+      || !fresh(c.checkedAt, now, 86400000)
+      || !m?.capabilities?.optionDescriptors?.some((o) => o.id === option && o.options?.some((v) => v.id === effort))) {
+      throw Error(`unverified ${driver} model catalog`);
+    }
+    return { driver, selection: { instanceId, model, options: [{ id: option, value: effort }] } };
+  });
+}
+
+export function decide(settings, snapshots, catalogs, now, history = null) {
+  const result = { action: 'held', selection: settings.defaultModelSelection,
+    projectOverrides: Object.entries(settings.projectSettingsOverrides ?? {})
+      .filter(([, p]) => p?.defaultModelSelection !== undefined).map(([id]) => id),
+    projectOverrideCoverage: settings.projectSettingsFolded === true ? 'saved settings overrides'
+      : 'saved settings overrides only; legacy project records not inspected',
+    fairness: 'history unavailable; six-hour UTC tie rotation (not equal chat counts)' };
+  try {
+    if (!Number.isFinite(now) || !Array.isArray(snapshots) || !snapshots.length || !Array.isArray(catalogs)) throw Error('missing input');
+    const all = [];
+    const seen = new Set();
+    for (const s of snapshots) {
+      if (s.error === 'hub management key missing or unsafe') throw Error('hub management key missing or unsafe');
+      if (s.kind !== 'cliproxy' || s.error || !fresh(s.checkedAt, now, 300000) || !Array.isArray(s.accounts)) throw Error('unknown source telemetry');
+      for (const a of s.accounts) {
+        if (!['codex', 'claudeAgent'].includes(a.driver)) continue;
+        // Multiple sources may expose one account. Hold rather than double-count capacity.
+        const key = `${a.driver}:${a.workspaceId ?? a.email ?? a.id}`;
+        if (!a.id || seen.has(key)) throw Error('ambiguous duplicate account');
+        seen.add(key); all.push(a);
+      }
+    }
+    const choices = candidates(settings, catalogs, now);
+    result.pools = Object.fromEntries(['claudeAgent', 'codex'].map((d) => [d, pool(all, d, now)]));
+    const eligible = choices.filter((c) => result.pools[c.driver].eligibleAccounts > 0
+      && (c.selection.model !== 'gpt-6-astra'
+        || Math.min(...[result.pools.codex.sessionRemaining, result.pools.codex.weeklyRemaining].filter((v) => v !== null)) >= 25));
+    if (!eligible.length) throw Error('both pools exhausted; no account has both windows available');
+    const best = Math.max(...eligible.map((c) => result.pools[c.driver].score));
+    const tied = eligible.filter((c) => best - result.pools[c.driver].score <= 5);
+    const current = eligible.find((c) => same(c.selection, result.selection));
+    result.history = historyCounts(history, choices, now);
+    const counts = result.history.status === 'available' ? result.history.counts : null;
+    let chosen;
+    if (counts) {
+      result.fairness = 'seven-day manual driver starts';
+      const count = (c) => counts[c.selection.model];
+      const least = Math.min(...tied.map(count));
+      // A difference of one is normal; avoid shifting on every timer tick.
+      if (!current || best - result.pools[current.driver].score >= 10 || count(current) - least >= 2) {
+        chosen = tied.find((c) => count(c) === least);
+      }
+    }
+    if (!chosen && current && best - result.pools[current.driver].score < 10) {
+      // Fixed UTC slots prevent starvation without persistent timer state or per-tick rotation.
+      const rotation = Math.floor(now / (6 * 3600000)) % choices.length;
+      const target = [...choices.slice(rotation), ...choices.slice(0, rotation)].find((c) => tied.includes(c));
+      chosen = !counts && tied.includes(current) ? target : current;
+    }
+    if (!chosen) {
+      const index = choices.findIndex((c) => same(c.selection, result.selection));
+      chosen = [...choices.slice(index + 1), ...choices.slice(0, index + 1)].find((c) => tied.includes(c));
+    }
+    const equal = JSON.stringify(chosen.selection) === JSON.stringify(result.selection);
+    return { ...result, action: equal ? 'unchanged' : 'update', reason: equal ? 'stable default' : 'capacity or fair tie-break', selection: chosen.selection };
+  } catch (error) {
+    return { ...result, reason: error.message };
+  }
+}

package/skills/axstack/scripts/default-settings.js

@@ -0,0 +1,36 @@
+import * as fs from 'node:fs';
+
+// Cooperating writers share this lock; non-cooperating T3 writes are compared immediately before rename.
+export function commit(path, original, selection) {
+  const lock = `${path}.axstack-default-sync.lock`;
+  try { fs.mkdirSync(lock, { mode: 0o700 }); }
+  catch (error) { if (error.code === 'EEXIST') return 'locked'; throw error; }
+  let temp;
+  let fd;
+  try {
+    const info = fs.lstatSync(path);
+    if (!info.isFile() || info.isSymbolicLink()) throw Error('settings must be a regular file; symlinks are refused');
+    if (fs.readFileSync(path, 'utf8') !== original) return 'concurrent-edit';
+    const settings = JSON.parse(original);
+    settings.defaultModelSelection = selection;
+    const next = `${JSON.stringify(settings, null, 2)}\n`;
+    if (JSON.stringify(JSON.parse(original).defaultModelSelection) === JSON.stringify(selection)) return 'unchanged';
+    temp = `${path}.axstack-default-sync-${crypto.randomUUID()}.tmp`;
+    fd = fs.openSync(temp, 'wx', info.mode & 0o7777);
+    fs.fchmodSync(fd, info.mode & 0o7777);
+    fs.writeFileSync(fd, next);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd); fd = undefined;
+    const latest = fs.lstatSync(path);
+    if (latest.ino !== info.ino || latest.dev !== info.dev || latest.mode !== info.mode
+      || fs.readFileSync(path, 'utf8') !== original) return 'concurrent-edit';
+    // A non-cooperating writer still has a small compare-to-rename race; no file API provides CAS.
+    fs.renameSync(temp, path); temp = undefined;
+    if (fs.readFileSync(path, 'utf8') !== next) throw Error('settings read-back mismatch');
+    return 'updated';
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    if (temp) fs.unlinkSync(temp);
+    fs.rmdirSync(lock);
+  }
+}

package/skills/axstack/scripts/driver-history.js

@@ -0,0 +1,70 @@
+import { Database } from 'bun:sqlite';
+import * as fs from 'node:fs';
+const week = 7 * 86400000;
+
+// Read existing projections across all projects; never create a DB, migrate, or use auth sessions.
+export function readHistory(settingsPath, now, explicitPath) {
+  const path = explicitPath ?? `${settingsPath.slice(0, settingsPath.lastIndexOf('/'))}/statev2.sqlite`;
+  let db;
+  try {
+    const info = fs.lstatSync(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid?.() || (info.mode & 0o022)) throw Error();
+    for (const suffix of ['-wal', '-shm']) {
+      try {
+        const s = fs.lstatSync(`${path}${suffix}`);
+        if (!s.isFile() || s.isSymbolicLink() || s.uid !== info.uid || (s.mode & 0o022)) throw Error();
+      } catch (e) { if (e.code !== 'ENOENT') throw e; }
+    }
+    if (fs.existsSync(`${path}-wal`) && !fs.existsSync(`${path}-shm`)) {
+      return { unavailable: 'T3 history WAL has no existing shared memory; refusing sidecar creation' };
+    }
+    db = new Database(path, { readonly: true });
+    const threads = db.query(`SELECT thread_id AS threadId, created_at AS createdAt,
+      provider_instance_id AS providerInstanceId,
+      json_extract(payload_json, '$.createdBy') AS createdBy,
+      json_extract(payload_json, '$.creationSource') AS creationSource,
+      json_extract(payload_json, '$.modelSelection.model') AS model,
+      json_extract(payload_json, '$.lineage.parentThreadId') AS parentThreadId,
+      json_type(payload_json, '$.lineage.parentThreadId') AS parentType
+      FROM orchestration_v2_projection_threads WHERE created_at >= ? AND created_at <= ?
+      ORDER BY created_at, thread_id LIMIT 50001`).all(new Date(now - week).toISOString(), new Date(now).toISOString());
+    if (threads.length > 50000) return { unavailable: 'T3 history exceeds bounded inventory limit' };
+    if (threads.some((t) => t.createdBy === 'user' && ['web', 'mobile'].includes(t.creationSource)
+      && !['null', 'text'].includes(t.parentType))) return { unavailable: 'T3 history lacks parent identity' };
+    return { threads, complete: true, total: threads.length,
+      source: 'T3 projection database: all projects, current saved models of threads created in seven days' };
+  } catch {
+    return { unavailable: 'T3 history database unavailable, unsafe or incompatible' };
+  } finally { db?.close(); }
+}
+
+export function historyCounts(history, choices, now) {
+  const unknown = (reason) => ({ status: 'unavailable', reason });
+  if (history?.unavailable) {
+    const reasons = ['T3 history database unavailable, unsafe or incompatible', 'T3 history exceeds bounded inventory limit',
+      'T3 history lacks parent identity', 'T3 history WAL has no existing shared memory; refusing sidecar creation',
+      'history file unavailable or malformed'];
+    return unknown(reasons.includes(history.unavailable) ? history.unavailable : 'T3 history unavailable; check database or supplied snapshot');
+  }
+  const threads = Array.isArray(history) ? history : history?.threads;
+  if (!Array.isArray(threads)) return unknown('no complete T3 history inventory');
+  if (history.hasMore === true || history.nextCursor != null
+    || (history.total !== undefined && history.total !== threads.length)) return unknown('incomplete or paginated T3 history');
+  const counts = Object.fromEntries(choices.map((c) => [c.selection.model, 0]));
+  const seen = new Set();
+  for (const t of threads) {
+    const id = t.threadId ?? t.id;
+    const at = Date.parse(t.createdAt);
+    if (typeof id !== 'string' || !id || seen.has(id) || !Number.isFinite(at)
+      || typeof t.createdBy !== 'string' || typeof t.creationSource !== 'string') return unknown('malformed T3 history record');
+    seen.add(id);
+    if (t.createdBy !== 'user' || !['web', 'mobile'].includes(t.creationSource) || at > now || now - at > week) continue;
+    if (!Object.hasOwn(t, 'parentThreadId')) return unknown('manual history lacks parent identity');
+    if (t.parentThreadId !== null) continue;
+    const instance = t.providerInstanceId ?? t.modelSelection?.instanceId;
+    const model = t.model ?? t.modelSelection?.model;
+    if (typeof instance !== 'string' || typeof model !== 'string') return unknown('manual history lacks provider/model identity');
+    if (choices.some((c) => c.selection.instanceId === instance && c.selection.model === model)) counts[model]++;
+  }
+  return { status: 'available', counts, source: history.source ?? 'saved thread list; caller-supplied scope' };
+}

package/skills/axstack/scripts/hub-secret.js

@@ -0,0 +1,27 @@
+import * as fs from 'node:fs';
+
+// Resolve only T3's masked usage-source field; never hydrate or persist the settings object.
+export function managementKey(value, sourceId, settingsPath) {
+  try {
+    if (value === '••••••') {
+      if (typeof settingsPath !== 'string' || !settingsPath.includes('/') || typeof sourceId !== 'string'
+        || !sourceId || sourceId.length > 512 || Buffer.from(sourceId, 'utf8').toString('utf8') !== sourceId) throw Error();
+      const directory = `${settingsPath.slice(0, settingsPath.lastIndexOf('/'))}/secrets`;
+      const parent = fs.lstatSync(directory);
+      if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid?.() || (parent.mode & 0o022)) throw Error();
+      const path = `${directory}/usage-limit-source-${Buffer.from(sourceId, 'utf8').toString('base64url')}.bin`;
+      const fd = fs.openSync(path, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+      try {
+        const info = fs.fstatSync(fd);
+        if (!info.isFile() || info.uid !== process.getuid?.() || (info.mode & 0o077) || info.nlink !== 1
+          || info.size < 1 || info.size > 4096) throw Error();
+        value = new TextDecoder('utf-8', { fatal: true }).decode(fs.readFileSync(fd));
+      } finally { fs.closeSync(fd); }
+    }
+    // HTTP bearer keys must be bounded, unmasked printable ASCII without whitespace/control bytes.
+    if (typeof value !== 'string' || !/^[!-~]{1,4096}$/.test(value)) throw Error();
+    return value;
+  } catch {
+    throw Error('hub management key missing or unsafe');
+  }
+}

package/skills/axstack/scripts/hub-usage.js

@@ -0,0 +1,93 @@
+import { managementKey } from './hub-secret.js';
+// Read-only subset of T3 0.1.3 makeCliproxyApi. Never fetch token files or reset credits.
+async function management(config, path, body) {
+  const base = new URL(config.url.endsWith('/') ? config.url : `${config.url}/`);
+  if (base.protocol !== 'https:' && !(base.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(base.hostname))) {
+    throw Error('hub requires HTTPS or loopback HTTP');
+  }
+  if (base.username || base.password || !config.managementKey) throw Error('invalid hub configuration');
+  const response = await fetch(new URL(`v0/management/${path}`, base), {
+    method: body === undefined ? 'GET' : 'POST', redirect: 'error', signal: AbortSignal.timeout(15000),
+    headers: { Authorization: `Bearer ${config.managementKey}`, 'Content-Type': 'application/json' },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+  });
+  if (!response.ok) throw Error('hub management request refused');
+  return response.json();
+}
+
+async function accountUsage(config, account, now) {
+  const checkedAt = new Date(now).toISOString();
+  const driver = account.provider === 'claude' ? 'claudeAgent' : 'codex';
+  const base = { id: account.id, driver,
+    ...(account.email ? { email: account.email } : {}),
+    ...(account.id_token?.chatgpt_account_id ? { workspaceId: account.id_token.chatgpt_account_id } : {}) };
+  try {
+    if (typeof account.auth_index !== 'string' || !account.auth_index) throw Error('invalid auth index');
+    const header = driver === 'codex' ? { Authorization: 'Bearer $TOKEN$', 'Content-Type': 'application/json',
+      'OpenAI-Beta': 'codex-1', Originator: 'Codex Desktop',
+      ...(base.workspaceId ? { 'Chatgpt-Account-Id': base.workspaceId } : {}) }
+      : { Authorization: 'Bearer $TOKEN$', 'anthropic-beta': 'oauth-2025-04-20', 'User-Agent': 'claude-code/2.1.273' };
+    const response = await management(config, 'api-call', { auth_index: account.auth_index, method: 'GET',
+      url: driver === 'codex' ? 'https://chatgpt.com/backend-api/wham/usage' : 'https://api.anthropic.com/api/oauth/usage', header });
+    if (!Number.isInteger(response.status_code) || response.status_code < 200 || response.status_code >= 300 || typeof response.body !== 'string') throw Error('provider refused');
+    const usage = JSON.parse(response.body);
+    if (!usage || typeof usage !== 'object' || usage.error || usage.errors) throw Error('provider payload error');
+    const windows = [];
+    if (driver === 'codex') {
+      for (const key of ['primary_window', 'secondary_window']) {
+        const w = usage.rate_limit?.[key];
+        if (w?.reset_at != null && (typeof w.reset_at !== 'number' || !Number.isFinite(w.reset_at))) throw Error('invalid Codex reset');
+        const minutes = w?.limit_window_seconds / 60;
+        const kind = minutes >= 43200 ? 'monthly' : minutes >= 10080 ? 'weekly' : 'session';
+        if (w) windows.push({ id: key === 'primary_window' ? 'primary' : 'secondary', kind, label: kind, usedPercent: w.used_percent,
+          ...(typeof w.reset_at === 'number' ? { resetsAt: new Date(w.reset_at * 1000).toISOString() } : {}),
+          windowDurationMins: w.limit_window_seconds / 60 });
+      }
+    } else {
+      for (const [key, kind, duration] of [['five_hour', 'session', 300], ['seven_day', 'weekly', 10080]]) {
+        const w = usage[key];
+        if (w) windows.push({ id: key, kind, label: key, usedPercent: w.utilization,
+          ...(w.resets_at == null ? {} : { resetsAt: w.resets_at }), windowDurationMins: duration });
+      }
+      for (const w of usage.limits ?? []) {
+        if (w.kind === 'weekly_scoped') windows.push({ id: `seven_day_${String(w.scope?.model?.display_name ?? '').toLowerCase().replace(/[^a-z0-9]+/g, '_')}`, kind: 'weekly',
+          label: `Weekly · ${w.scope?.model?.display_name ?? ''}`, usedPercent: w.percent, ...(w.resets_at == null ? {} : { resetsAt: w.resets_at }), windowDurationMins: 10080 });
+      }
+    }
+    const weeklyOnly = driver === 'codex' && usage.rate_limit?.primary_window?.limit_window_seconds === 604800
+      && usage.rate_limit.secondary_window == null && windows.length === 1 && windows[0].kind === 'weekly';
+    return { ...base, usageLimits: { checkedAt, windows,
+      ...(weeklyOnly ? { notApplicable: { session: 'verified Codex weekly-only response' } } : {}) } };
+  } catch {
+    return { ...base, usageLimits: { checkedAt, windows: [], unavailable: { reason: 'probeFailed' } } };
+  }
+}
+
+export async function readHub(settings, now = Date.now(), settingsPath) {
+  const sources = Object.entries(settings.usageLimitSources ?? {}).filter(([, s]) => s.enabled === true && s.kind === 'cliproxy');
+  if (sources.length !== 1) throw Error('expected exactly one enabled cliproxy usage source');
+  const snapshots = [];
+  for (const [id, source] of sources) {
+    let config;
+    try { config = { ...source, managementKey: managementKey(source.managementKey, id, settingsPath) }; }
+    catch {
+      snapshots.push({ id, kind: 'cliproxy', checkedAt: new Date(now).toISOString(), accounts: [], error: 'hub management key missing or unsafe' });
+      continue;
+    }
+    try {
+      const raw = await management(config, 'auth-files');
+      if (!Array.isArray(raw.files)) throw Error('invalid account list');
+      const files = raw.files.filter((a) => !a.disabled && ['claude', 'codex'].includes(a.provider));
+      // Bound work and duration; a large hub needs a separately accepted batching policy.
+      if (files.length > 32) throw Error('hub account limit exceeded');
+      const accounts = [];
+      for (let i = 0; i < files.length; i += 4) {
+        accounts.push(...await Promise.all(files.slice(i, i + 4).map((a) => accountUsage(config, a, now))));
+      }
+      snapshots.push({ id, kind: 'cliproxy', checkedAt: new Date(now).toISOString(), accounts });
+    } catch {
+      snapshots.push({ id, kind: 'cliproxy', checkedAt: new Date(now).toISOString(), accounts: [], error: 'hub usage unavailable' });
+    }
+  }
+  return snapshots;
+}

package/skills/axstack/scripts/sync-default.js

@@ -0,0 +1,76 @@
+import * as fs from 'node:fs';
+import { decide } from './default-policy.js';
+import { commit } from './default-settings.js';
+import { readHistory } from './driver-history.js';
+import { readHub } from './hub-usage.js';
+export { decide } from './default-policy.js';
+
+const help = `Usage: bun sync-default.js [--settings path] [--dry-run | --apply]
+  --usage-file path   T3 UsageLimitSourceSnapshot array (otherwise read configured hub)
+  --catalog-dir path T3 provider cache directory (default: T3 caches beside userdata)
+  --history-file path Complete saved native T3 thread-list JSON (overrides database read)
+  --history-db path   Existing T3 projection DB (default: statev2.sqlite beside settings)
+  --now ISO          Deterministic clock for fixtures; cannot combine with live hub
+  --help             Print this help
+Dry-run is the default and writes nothing. Reads settings, provider model caches,
+existing T3 projection history read-only (no create/migrate/auth updates), optional snapshots,
+or configured cliproxy auth-files/api-call usage endpoints.
+Masked hub keys read ONLY userdata/secrets/usage-limit-source-<base64url(sourceId)>.bin
+beside --settings, in memory. Secret symlinks, unsafe permissions and malformed keys hold.
+--apply writes ONLY global defaultModelSelection in --settings (default ~/.t3/userdata/settings.json).
+Apply creates a sibling .axstack-default-sync.lock directory and unique .tmp file,
+fsyncs and atomically renames settings, preserves mode, compares concurrent edits
+and reads back; removes its lock/temp. Existing locks hold (no stale-lock stealing).
+Symlinks refused. Other settings, project overrides, threads, roles and credentials
+are never modified. Does not install/enable timers or write title instructions.
+Exit: 0 decision/unchanged, 1 input/I/O error, 2 held. Output contains no secrets.`;
+
+async function main() {
+  const options = {};
+  const values = ['--settings', '--usage-file', '--catalog-dir', '--history-file', '--history-db', '--now'];
+  const args = process.argv.slice(2);
+  for (let i = 0; i < args.length; i++) {
+    const flag = args[i];
+    if (flag === '--help') { console.log(help); return; }
+    if (Object.hasOwn(options, flag)) throw Error('duplicate flag');
+    if (['--apply', '--dry-run'].includes(flag)) options[flag] = true;
+    else if (values.includes(flag) && args[i + 1] && !args[i + 1].startsWith('--')) options[flag] = args[++i];
+    else throw Error('invalid arguments');
+  }
+  if (options['--apply'] && options['--dry-run']) throw Error('conflicting modes');
+  if (options['--now'] && !options['--usage-file']) throw Error('--now requires --usage-file');
+  const requested = options['--settings'] ?? `${process.env.HOME}/.t3/userdata/settings.json`;
+  const stat = fs.lstatSync(requested);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw Error('settings must be a regular file');
+  const path = fs.realpathSync(requested);
+  const original = fs.readFileSync(path, 'utf8');
+  const settings = JSON.parse(original);
+  const now = options['--now'] ? Date.parse(options['--now']) : Date.now();
+  const cache = options['--catalog-dir'] ?? `${path.slice(0, path.lastIndexOf('/'))}/../caches`;
+  const catalogs = [];
+  for (const [id, p] of Object.entries(settings.providerInstances ?? {})) {
+    if (p.enabled !== true || !['claudeAgent', 'codex'].includes(p.driver)) continue;
+    if (!/^[a-zA-Z0-9_-]+$/.test(id)) throw Error('invalid instance ID');
+    try { catalogs.push(JSON.parse(fs.readFileSync(`${cache}/${id}.json`, 'utf8'))); }
+    catch { /* Policy reports an unknown catalog; never guess a model. */ }
+  }
+  const usage = options['--usage-file'] ? JSON.parse(fs.readFileSync(options['--usage-file'], 'utf8')) : await readHub(settings, now, path);
+  let history;
+  if (options['--history-file']) {
+    try { history = JSON.parse(fs.readFileSync(options['--history-file'], 'utf8')); }
+    catch { history = { unavailable: 'history file unavailable or malformed' }; }
+  } else history = readHistory(path, now, options['--history-db']);
+  const result = decide(settings, usage, catalogs, now, history);
+  if (result.action === 'update' && options['--apply']) {
+    const status = commit(path, original, result.selection);
+    result.action = status === 'updated' ? 'updated' : 'held';
+    if (status !== 'updated') result.reason = status;
+  }
+  result.mode = options['--apply'] ? 'apply' : 'dry-run';
+  console.log(JSON.stringify(result));
+  if (result.action === 'held') process.exitCode = 2;
+}
+if (import.meta.main) main().catch(() => {
+  console.error('default sync failed: invalid input or settings I/O; no sensitive details logged');
+  process.exitCode = 1;
+});

package/skills/axstack/systemd/axstack-default-sync.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Choose the saved T3 New-chat default from subscription capacity
+
+[Service]
+Type=oneshot
+Environment=PATH=%h/.bun/bin:/usr/local/bin:/usr/bin:/bin
+UMask=0077
+TimeoutStartSec=180
+ExecStart=/usr/bin/env bun %h/.agents/skills/axstack/scripts/sync-default.js --apply

package/skills/axstack/systemd/axstack-default-sync.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Refresh the saved T3 New-chat default every five minutes (opt-in)
+
+[Timer]
+OnStartupSec=5min
+OnUnitActiveSec=5min
+Unit=axstack-default-sync.service
+
+[Install]
+WantedBy=timers.target

package/skills/axstack-audit/SKILL.md

@@ -109,7 +109,7 @@ counts with denominators plus the evidence behind the count:
   | --- | --- | --- |
   | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
   | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
-  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+  | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/terra` xhigh) |
   | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
 - Simplification applicability determinations evidenced / total candidate diffs,
   and complete simplification receipts / total candidates, broken down as

package/skills/axstack-implement/SKILL.md

@@ -65,7 +65,7 @@ Immediately before an actual role dispatch, read and follow the
 [T3 runtime boundary](../axstack/references/t3-runtime.md). Ordinary local
 reading and writing does not require that launch reference.
 
-Authors must use async `delegate_task` with `isolation:"worktree"`, title = dispatch key
+Authors must use async `delegate_task` with `isolation:"worktree"`, title = role-labelled dispatch key
 and stable `clientRequestId` under the runtime contract's fresh-checkout bootstrap,
 same-child repair and recorded launch fallback rules.
 

package/skills/axstack-improve/SKILL.md

@@ -22,8 +22,8 @@ materially helps. Do not create a new profile.
 When dispatching `axstack-research-code`, dispatch `axstack-research-code-sol`
 independently on the same bounded brief without cross-reading. The driver
 reconciles findings per claim and never averages them. Record an intentionally
-absent Sol pair and proceed with the base seat alone. A configured optional
-Sol pair that fails to launch is fenced, recorded `absent (<reason>)`, and
+absent `-sol` pair and proceed with the base seat alone. A configured optional
+`-sol` pair that fails to launch is fenced, recorded `absent (<reason>)`, and
 named once in the next read-back, then skipped without relay or substitution.
 In mixed fan-out retain a Codex and a Claude seat or hold the affected work.
 

package/skills/axstack-research/SKILL.md

@@ -55,13 +55,13 @@ is part of research.
 
    - `axstack-research-requirements`: requirements and intent.
    - `axstack-research-code`: code behavior.
-   - `axstack-research-code-sol`: independent Sol code investigation.
+   - `axstack-research-code-sol`: independent code investigation (Terra high in mixed, Sol high in codex-only).
    - `axstack-research-web`: web and external sources.
    - `axstack-research-x`: X (Twitter) posts and threads via Grok; cite post URLs and dates.
    - For broad codebase mapping, use `axstack-scout`.
      Never dispatch `axstack-explore-codebase` directly for broad mapping.
    - `axstack-explore-execution`: execution and runtime traces.
-   - `axstack-explore-execution-sol`: independent Sol execution investigation.
+   - `axstack-explore-execution-sol`: independent execution investigation (Terra high in mixed, Sol high in codex-only).
 
    When dispatching `axstack-research-code` or `axstack-explore-execution`,
    dispatch its `-sol` pair independently on the same bounded brief without

package/skills/axstack-review/references/review-candidate.md

@@ -36,7 +36,7 @@ This section applies to peer and authored PR modes.
      | --- | --- | --- |
      | `mixed` | `codex/sol` | `axstack-reviewer-secondary` (`claude/opus` high) |
      | `mixed` | `claude/opus` | `axstack-reviewer-primary` (`codex/sol` high) |
-     | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/luna` xhigh) |
+     | `codex-only` | `codex/sol` | `axstack-reviewer-secondary` (`codex/terra` xhigh) |
      | `claude-only` | `claude/opus` | `axstack-reviewer-secondary` (`claude/sonnet` high) |
 
      The diligence receipt is separate and does not count as a reviewer receipt.

package/src/roles.js

@@ -6,12 +6,12 @@ const PROVIDER_BOUNDS = Object.freeze({
 
 const CLASS_PROVIDERS = Object.freeze({
   fable: 'claude', opus: 'claude', sonnet: 'claude', haiku: 'claude',
-  astra: 'codex', sol: 'codex', luna: 'codex',
+  astra: 'codex', sol: 'codex', luna: 'codex', terra: 'codex',
 });
 
 export function deriveModelClass(model) {
   if (typeof model !== 'string') return null;
-  return model.match(/^gpt-(\d+(?:\.\d+)*)-(astra|sol|luna)$/)?.[2]
+  return model.match(/^gpt-(\d+(?:\.\d+)*)-(astra|sol|luna|terra)$/)?.[2]
     ?? model.match(/^claude-(fable|opus|sonnet|haiku)-/)?.[1]
     ?? null;
 }
@@ -22,7 +22,7 @@ const AUTHORED_ROUTES = Object.freeze({
     'claude/opus': ['axstack-reviewer-primary', 'codex/sol', 'high'],
   },
   'codex-only': {
-    'codex/sol': ['axstack-reviewer-secondary', 'codex/luna', 'xhigh'],
+    'codex/sol': ['axstack-reviewer-secondary', 'codex/terra', 'xhigh'],
   },
   'claude-only': {
     'claude/opus': ['axstack-reviewer-secondary', 'claude/sonnet', 'high'],