cairn-ai 0.4.0 → 0.5.0

package/.agents/workflows/cairn-plan.md

@@ -14,7 +14,7 @@ Procedure:
 
 1. Every agent reads project-root `MEMORY.md` when present and continues without repository memory when absent before repository exploration, tool selection, work, or delegation.
 2. For non-trivial implementation or continuation of planned work, write an initial `docs/plan/<topic>.md` and `PLAN.md` entry with `triage-plan` as the first active task. This initial plan is decision-complete for triage and explicitly not implementation-ready.
-3. Before exploration, toolcheck, triage, or delegation, call Codex `update_plan` and then `create_goal` when available, and start the repository Cairn goal with the same roadmap. Copy the session-start hook's `Cairn CLI:` prefix literally into each command; never store it in a shell variable. `--root` may be omitted when the cwd is inside the repository. Fold new work into an unfinished goal with `goal replan` instead of cancelling it; when a hook reports another session owns the goal you continue, run `goal claim --session <id>`.
+3. Before exploration, toolcheck, triage, or delegation, call Codex `update_plan` and then `create_goal` when available (main agent only; subagents skip), and start the repository Cairn goal with the same roadmap. Copy the session-start hook's `Cairn CLI:` prefix literally into each command; never store it in a shell variable. `--root` may be omitted when the cwd is inside the repository. Fold new work into an unfinished goal with `goal replan` instead of cancelling it; when a hook reports another session owns the goal you continue, run `goal claim --session <id>`.
 4. Read relevant `docs/memory/*.md` and, under the locator's `resources.modelGuidance`, `claude.md` for Claude-family or `codex.md` for Codex-family models; invoke Node with the locator's absolute `entrypoints.cli`, `toolcheck`, and `--root` for the target repository (installation only with explicit approval), and explore before asking the user.
 5. Classify the whole work into executable tasks with `dependsOn`, `writeScope`, and handoff files, finalize triage, and update the same plan and `update_plan` roadmap to a decision-complete implementation plan: selected path, checked Heavy Path signals, tool readiness, file scope, dry-run/check, module acceptance, surface integration, stable IDs, and fail-closed evidence. Heavy Path adds an explicit automated test command and `Tests:` evidence line.
 6. Resolve the skill's reference files through the locator's `pluginRoot` and read them only when needed: `cairn://skills/cairn-plan/planning-rules.md` when finalizing, `cairn://skills/cairn-plan/delegation.md` before dispatching, `cairn://skills/cairn-plan/heavy-path.md` only on a Heavy signal or route change.

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cairn",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Token-efficient agent harness with tool readiness for Codex, Claude Code, and Antigravity.",
   "author": {
     "name": "WkNam"

package/agents/worker.md

@@ -31,6 +31,8 @@ Before the first edit, inspect the assigned exact files, callers, and tests and
 
 Read the task's `Requested model` and `Effective model` too: model is chosen per task (fast `haiku`, balanced `sonnet`, stronger `opus`, strongest `fable`). Read the task's `Requested reasoning effort` and `Effective reasoning effort`: Requested is Cairn's desired profile; Effective is what the dispatch response confirms. Every child task/worker you dispatch MUST receive the requested model and effort through the host-exposed task/subagent reasoning-effort option or host-native equivalent (Claude Code: Agent `model`/`effort`, never `fork`); recording without passing is a defect. Report Effective as the requested value when passed and not rejected, `not-applied: <reason>` when not passed, and `inherited` only when the host exposes no effort option. Describe capability only from the exposed interface or dispatch response, distinguish Cairn non-integration from host non-support, and do not alter global/user config.
 
+Include the exact model ID from your own system prompt in the final report (`unreported` if not stated; never guess). A dispatch that changes a child's model or effort MUST be a new dispatch (Claude Code: a new Agent call), never `SendMessage`. Host task-list tools (`update_plan`, `create_goal`, `wrap_up`) are called by the main agent only; skip them and report in your final report.
+
 Use this prompt format:
 
 ```text

package/commands/cairn-plan.md

@@ -14,7 +14,7 @@ Procedure:
 
 1. Every agent reads project-root `MEMORY.md` when present and continues without repository memory when absent before repository exploration, tool selection, work, or delegation.
 2. For non-trivial implementation or continuation of planned work, write an initial `docs/plan/<topic>.md` and `PLAN.md` entry with `triage-plan` as the first active task. This initial plan is decision-complete for triage and explicitly not implementation-ready.
-3. Before exploration, toolcheck, triage, or delegation, call Codex `update_plan` and then `create_goal` when available, and start the repository Cairn goal with the same roadmap. Copy the session-start hook's `Cairn CLI:` prefix literally into each command; never store it in a shell variable. `--root` may be omitted when the cwd is inside the repository. Fold new work into an unfinished goal with `goal replan` instead of cancelling it; when a hook reports another session owns the goal you continue, run `goal claim --session <id>`.
+3. Before exploration, toolcheck, triage, or delegation, call Codex `update_plan` and then `create_goal` when available (main agent only; subagents skip), and start the repository Cairn goal with the same roadmap. Copy the session-start hook's `Cairn CLI:` prefix literally into each command; never store it in a shell variable. `--root` may be omitted when the cwd is inside the repository. Fold new work into an unfinished goal with `goal replan` instead of cancelling it; when a hook reports another session owns the goal you continue, run `goal claim --session <id>`.
 4. Read relevant `docs/memory/*.md` and the installed model guidance, run `toolcheck --root <repoRoot>` (installation only with explicit approval), and explore before asking the user.
 5. Classify the whole work into executable tasks with `dependsOn`, `writeScope`, and handoff files, finalize triage, and update the same plan and `update_plan` roadmap to a decision-complete implementation plan: selected path, checked Heavy Path signals, tool readiness, file scope, dry-run/check, module acceptance, surface integration, stable IDs, and fail-closed evidence. Heavy Path adds an explicit automated test command and `Tests:` evidence line.
 6. Read the skill's reference files only when needed: `cairn://skills/cairn-plan/planning-rules.md` when finalizing, `cairn://skills/cairn-plan/delegation.md` before dispatching, `cairn://skills/cairn-plan/heavy-path.md` only on a Heavy signal or route change.

package/docs/model-guidance/README.md

@@ -50,8 +50,8 @@ The goal is not to make prompts long by model. The goal is to stabilize the same
 
 ## Model and Reasoning Effort Routing
 
-- The plan decides each task's model from its nature and records `Requested model` and `Effective model`; models are not always inherited. Tiers: fast = read-only exploration, search, inventory, summarization (Claude Code `haiku`); balanced = Light Path implementation and routine verification (`sonnet`); stronger = planning, complexity triage, Heavy Path implementation, review, and final verification/review (`opus`); strongest = Heavy Path design only (`fable`). Antigravity `invoke_subagent` `Model` accepts only a tier enum (fast `flash_lite`, balanced `flash`, stronger `pro`, strongest `pro`; no tier above `pro`) and has no effort option, so Effective reasoning effort is `inherited`. Codex slugs: fast `gpt-6-luna`, balanced `gpt-6.1-terra`, stronger `gpt-6-sol`, strongest `gpt-6-astra`.
-- Model Effective: passed and not rejected is that value; not passed is `not-applied: <reason>`; `inherited` only when the host has no model option. If a lower-tier worker fails a gate, re-dispatch that task one tier up (fast, balanced, stronger, strongest) before recording a blocker.
+- The plan decides each task's model from its nature and records `Requested model` and `Effective model`; models are not always inherited. Tiers: fast = read-only exploration, search, inventory, summarization (Claude Code `haiku`); balanced = Light Path implementation and routine verification (`sonnet`); stronger = planning, complexity triage, Heavy Path implementation, review, and final verification/review (`opus`); strongest = Heavy Path design only (`fable`), run as a separate `kind: "design"` task dispatched to that tier rather than part of planning. Antigravity `invoke_subagent` `Model` accepts only a tier enum (fast `flash_lite`, balanced `flash`, stronger `pro`, strongest `pro`; no tier above `pro`) and has no effort option, so Effective reasoning effort is `inherited`. Codex slugs: fast `gpt-6-luna`, balanced `gpt-6.1-terra`, stronger `gpt-6-sol`, strongest `gpt-6-astra`.
+- Model Effective: the passed value plus the exact model ID the worker reports from its own system prompt (e.g. `fable (claude-fable-5-1)`; `<value> (unreported)` when absent, never guess; `goal assign --effective-model <id|unreported>`); not passed is `not-applied: <reason>`; `inherited` only when the host has no model option. If a lower-tier worker fails a gate, re-dispatch that task one tier up (fast, balanced, stronger, strongest) before recording a blocker. A subagent's model and effort are fixed at dispatch; any re-dispatch that changes either (one tier up, Light → Heavy promotion, route-change recalculation) MUST be a new dispatch (Claude Code: a new Agent call), never `SendMessage` to the existing subagent. A design model that is not the host's strongest tier (`--host claude-code` `fable`, `codex` `gpt-6-astra`, `antigravity` `pro`; any of the three when `--host` is omitted) fails completion unless `--allow-no-design-model <reason>`.
 - Routing is per dispatch only; never change model or global/user config files. `Model routing: inherited` in `MEMORY.md` or the plan disables per-task selection.
 - Light Path planning, implementation, and verification request `medium`.
 - Heavy Path planning, review, and implementation request `high`; final verification and review request `xhigh`.

package/docs/model-guidance/claude.md

@@ -18,7 +18,7 @@ Claude-family models are strong at long-context retention, policy interpretation
 - Do not skip the two verification gates even on Light Path.
 - Do not approve a plan that lacks dry-run or check evidence for external-state-changing work.
 - Do not allow open-ended verification loops. Require a blocker or sub-task split after two failed passes.
-- Choose the model per task (fast `haiku`, balanced `sonnet`, stronger `opus`: planning, triage, Heavy implementation, review, final verification/review; strongest `fable`: Heavy design only) and record `Requested model`/`Effective model`; Effective is the passed value, `not-applied: <reason>`, or `inherited` when the host has no model option. Re-dispatch one tier up (fast, balanced, stronger, strongest) if a lower-tier worker fails a gate. `Model routing: inherited` disables this. `Requested reasoning effort` is Cairn's desired profile; `Effective reasoning effort` is what the dispatch response confirms. Every new task/worker dispatch MUST pass the task's requested effort through the host option together with the chosen model; recording without passing is a defect. Effective is the requested value when the dispatch passed it and the host did not reject it, `not-applied: <reason>` when it was not passed, and `inherited` only when the host exposes no effort option. Infer capability only from the exposed interface or dispatch response, distinguish Cairn non-integration from host non-support, and change no global/user configuration.
+- Choose the model per task (fast `haiku`, balanced `sonnet`, stronger `opus`: planning, triage, Heavy implementation, review, final verification/review; strongest `fable`: Heavy design only, as a separate `kind: "design"` task dispatched to that tier rather than part of planning) and record `Requested model`/`Effective model`; Effective is the passed value plus the exact model ID the worker reports from its own system prompt (`<value> (unreported)` when absent, never guess), `not-applied: <reason>`, or `inherited` when the host has no model option. Re-dispatch one tier up (fast, balanced, stronger, strongest) if a lower-tier worker fails a gate. A subagent's model and effort are fixed at dispatch; any re-dispatch that changes either (one tier up, Light → Heavy promotion, route-change recalculation) MUST be a new dispatch (Claude Code: a new Agent call), never `SendMessage` to the existing subagent. A design model that is not the host's strongest tier (`--host claude-code` `fable`, `codex` `gpt-6-astra`, `antigravity` `pro`; any of the three when `--host` is omitted) fails completion unless `--allow-no-design-model <reason>`. `Model routing: inherited` disables this. `Requested reasoning effort` is Cairn's desired profile; `Effective reasoning effort` is what the dispatch response confirms. Every new task/worker dispatch MUST pass the task's requested effort through the host option together with the chosen model; recording without passing is a defect. Effective is the requested value when the dispatch passed it and the host did not reject it, `not-applied: <reason>` when it was not passed, and `inherited` only when the host exposes no effort option. Infer capability only from the exposed interface or dispatch response, distinguish Cairn non-integration from host non-support, and change no global/user configuration.
 - In Claude Code, pass model with the Agent tool `model` parameter (`haiku|sonnet|opus|fable`) and effort with `effort` (`low|medium|high|xhigh|max`, same as Cairn values), for example `{"description": "Implement task-1", "subagent_type": "general-purpose", "model": "sonnet", "effort": "medium", "prompt": "..."}`. `subagent_type: "fork"` ignores `model` and `effort`; never dispatch routed work as a fork.
 - On Heavy Path, check plan gaps before implementation.
 - Review all three complexity records: the provisional request checkpoint, post-exploration planning checkpoint, and code checkpoint after exact file/caller/test inspection immediately before the first edit. Before editing, evidence may change either route. Every change must synchronize the plan artifact, repository goal task roadmap through `goal replan`, and native UI plan, including reviews and required evidence. After editing begins, a new Heavy signal promotes Light Path to Heavy Path: stop further edits, mark affected evidence stale, synchronize all three roadmaps, and repeat the code checkpoint.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cairn-ai",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Token-efficient agent harness with tool readiness for Codex, Claude Code, and Antigravity",
   "license": "MIT",
   "author": {

package/scripts/cairn-goal-cli.mjs

@@ -54,6 +54,7 @@ export async function runGoalCli(args, {
       status: options.status ?? taskAction ?? positional[1],
       blocker: options.reason,
       effortWaiver: options["allow-inherited-effort"],
+      designWaiver: options["allow-no-design-model"],
     });
     emit(JSON.stringify(state));
     return state;
@@ -77,11 +78,21 @@ export async function runGoalCli(args, {
       effortSource: options["effort-source"],
       route: options.route,
       effortWaiver: options["allow-inherited-effort"],
+      kind: options.kind,
+      model: options.model,
+      modelSource: options["model-source"],
+      designWaiver: options["allow-no-design-model"],
+      effectiveModel: options["effective-model"],
+      modelHost: options.host,
     });
     const task = state.tasks.find((item) => item.id === String(options.task ?? positional[0]).trim());
     if (task?.route === "heavy" && task.assignedAgentId && (!task.effort || task.effortSource === "not-applied")) {
       stderr(`Cairn warning: Heavy task ${task.id} is assigned without an applied effort (effort ${task.effort ?? "none"}, source ${task.effortSource ?? "none"}); dispatch with the plan's effort and record --effort <level> --effort-source host-option.`);
     }
+    // A worker-reported ID that does not contain the passed alias hints at a silent fallback; warn, never block.
+    if (task?.model && task.effectiveModel && task.effectiveModel !== "unreported" && !task.effectiveModel.toLowerCase().includes(task.model.toLowerCase())) {
+      stderr(`Cairn warning: Task ${task.id} effective model ${task.effectiveModel} does not match the passed model ${task.model}; check the dispatch result.`);
+    }
     emit(JSON.stringify(state));
     return state;
   }
@@ -214,10 +225,10 @@ function allowedOptions(command) {
   const byCommand = {
     start: ["goal", "plan", "tasks", "criteria", "requiredEvidence", "session", "evidencePolicy", "evidence-policy"],
     status: [],
-    task: ["task", "status", "reason", "allow-inherited-effort"],
+    task: ["task", "status", "reason", "allow-inherited-effort", "allow-no-design-model"],
     replan: ["tasks"],
     claim: ["session"],
-    assign: ["task", "agent", "effort", "effort-source", "route", "allow-inherited-effort"],
+    assign: ["task", "agent", "effort", "effort-source", "route", "allow-inherited-effort", "kind", "model", "model-source", "allow-no-design-model", "effective-model", "host"],
     receipt: ["task", "kind", "scope", "command", "exitCode", "exit-code", "exit", "timestamp", "goalId", "goal-id", "plan"],
     verify: ["task", "kind", "scope", "watch", "timeout-ms"],
     finish: ["watch", "timeout-ms"],

package/scripts/cairn-goal-operations-evidence.mjs

@@ -182,6 +182,12 @@ export function goalStats(state, root = process.cwd()) {
       effort: task.effort ?? null,
       effortSource: task.effortSource ?? null,
       ...(task.effortWaiver ? { effortWaiver: task.effortWaiver } : {}),
+      ...(task.kind ? { kind: task.kind } : {}),
+      ...(task.model ? { model: task.model } : {}),
+      ...(task.modelSource ? { modelSource: task.modelSource } : {}),
+      ...(task.designWaiver ? { designWaiver: task.designWaiver } : {}),
+      ...(task.modelHost ? { modelHost: task.modelHost } : {}),
+      ...(task.effectiveModel ? { effectiveModel: task.effectiveModel } : {}),
     })),
   };
 }

package/scripts/cairn-goal-operations.mjs

@@ -4,10 +4,10 @@ import { cairnHome, worktreeId } from "./cairn-paths.mjs";
 import { assertNoSymlinkComponents } from "./cairn-safe-fs.mjs";
 import { goalStatePath, readGoalState, readGoalStateUnlocked, withGoalStateLock, writeGoalStateUnlocked } from "./cairn-goal-state.mjs";
 import {
-  GOAL_STATE_VERSION, PLAN_ID_MAX_LENGTH, assertRecoveryReferenceBudget, boundedRequiredText,
-  assertCanBeActive, assertEffortRecord, assertTaskGraph,
+  GOAL_STATE_VERSION, PLAN_ID_MAX_LENGTH, STRONGEST_MODEL_BY_HOST, assertRecoveryReferenceBudget, boundedRequiredText,
+  assertCanBeActive, assertEffortRecord, assertModelRecord, assertTaskGraph,
   defaultGoalEvidence, normalizeCriteria, normalizeTask, optionalText, requiredText,
-  terminalGoalStatuses, timestamp, validEvidencePolicy, validGoalStatus, validTaskRoute, validTaskStatus, validateState,
+  terminalGoalStatuses, timestamp, validEvidencePolicy, validGoalStatus, validModelHost, validTaskKind, validTaskRoute, validTaskStatus, validateState,
 } from "./cairn-goal-state-validation.mjs";
 import {
   advanceGoal, assertGoalMutable, ensureGoalCanComplete, ensureTaskCanComplete,
@@ -119,11 +119,13 @@ function applyGoalTransition(state, nextStatus, blocker, root) {
   return state;
 }
 
-export async function setTaskStatus({ root = process.cwd(), taskId, status, blocker, effortWaiver } = {}) {
+export async function setTaskStatus({ root = process.cwd(), taskId, status, blocker, effortWaiver, designWaiver } = {}) {
   const nextStatus = validTaskStatus(status);
   const normalizedTaskId = requiredText(taskId, "taskId");
   const normalizedWaiver = optionalText(effortWaiver, "effortWaiver");
   if (normalizedWaiver !== null && nextStatus !== "completed") throw new Error("--allow-inherited-effort applies only when completing a task");
+  const normalizedDesignWaiver = optionalText(designWaiver, "designWaiver");
+  if (normalizedDesignWaiver !== null && nextStatus !== "completed") throw new Error("--allow-no-design-model applies only when completing a task");
   return mutateGoal(root, (state) => {
     assertGoalMutable(state);
     const task = taskById(state, normalizedTaskId);
@@ -134,7 +136,9 @@ export async function setTaskStatus({ root = process.cwd(), taskId, status, bloc
     }
     if (nextStatus === "completed") {
       if (normalizedWaiver !== null) task.effortWaiver = normalizedWaiver;
+      if (normalizedDesignWaiver !== null) task.designWaiver = normalizedDesignWaiver;
       ensureHeavyEffortApplied(task);
+      ensureHeavyDesignRecorded(state, task);
       ensureTaskCanComplete(state, task, root);
     }
     if (nextStatus === "blocked") task.blocker = requiredText(blocker, "blocker");
@@ -201,10 +205,29 @@ function ensureHeavyEffortApplied(task) {
   throw new Error(`Heavy task ${task.id} assigned to ${task.assignedAgentId} has no applied effort (effort ${task.effort ?? "none"}, source ${source ?? "none"}); record goal assign ${task.id} --effort <low|medium|high|xhigh|max> --effort-source host-option, or complete with --allow-inherited-effort <reason>`);
 }
 
+// A kind "design" task must record the strongest-tier model it was dispatched with (host-option). Any other assigned
+// Heavy task needs a completed design task in the goal. A designWaiver reason bypasses both; Light and unassigned
+// tasks are not checked.
+function ensureHeavyDesignRecorded(state, task) {
+  if (task.designWaiver) return;
+  if (task.kind === "design") {
+    if (!(task.model && task.modelSource === "host-option")) {
+      throw new Error(`Design task ${task.id} has no recorded design model (model ${task.model ?? "none"}, source ${task.modelSource ?? "none"}); dispatch it to the strongest tier and record goal assign ${task.id} --model <value> --model-source host-option, or complete with --allow-no-design-model <reason>`);
+    }
+    // The host is declared, never guessed; without it any supported host's strongest value passes.
+    const expected = task.modelHost ? [STRONGEST_MODEL_BY_HOST[task.modelHost]] : Object.values(STRONGEST_MODEL_BY_HOST);
+    if (expected.includes(task.model)) return;
+    throw new Error(`Design task ${task.id} recorded model ${task.model}, expected ${expected.join(" | ")}${task.modelHost ? ` for host ${task.modelHost}` : ""}; dispatch it to the strongest tier and record goal assign ${task.id} --model <value> --model-source host-option, or complete with --allow-no-design-model <reason>`);
+  }
+  if (task.route !== "heavy" || !task.assignedAgentId) return;
+  if (state.tasks.some((item) => item.kind === "design" && item.status === "completed")) return;
+  throw new Error(`Heavy task ${task.id} assigned to ${task.assignedAgentId} has no completed design task; add a kind "design" task with goal replan, complete it with goal assign <design-task> --model <value> --model-source host-option, or complete with --allow-no-design-model <reason>`);
+}
+
 // Omitted effort/route/waiver options keep stored values, so a reassignment can change only the agent. When effort
 // or effortSource is given, both are replaced together; an omitted source is inferred from the effort.
 export async function assignTask({
-  root = process.cwd(), taskId, agentId = null, effort, effortSource, route, effortWaiver,
+  root = process.cwd(), taskId, agentId = null, effort, effortSource, route, effortWaiver, kind, model, modelSource, designWaiver, effectiveModel, modelHost,
 } = {}) {
   const normalizedTaskId = requiredText(taskId, "taskId");
   const normalizedAgentId = agentId === null ? null : requiredText(agentId, "agentId");
@@ -215,6 +238,14 @@ export async function assignTask({
     if (normalizedEffort === null && normalizedSource !== "not-applied") throw new Error("--effort-source requires --effort unless it is not-applied");
     assertEffortRecord(normalizedEffort, normalizedSource, "assign");
   }
+  const modelGiven = model !== undefined || modelSource !== undefined;
+  const normalizedModel = model === undefined || model === null ? null : requiredText(model, "model");
+  const normalizedModelSource = modelSource ?? (normalizedModel === null ? null : normalizedModel === "inherited" ? "inherited" : "host-option");
+  if (modelGiven) assertModelRecord(normalizedModel, normalizedModelSource, "assign");
+  const normalizedKind = kind === undefined ? undefined : validTaskKind(kind);
+  const normalizedDesignWaiver = designWaiver === undefined ? undefined : requiredText(designWaiver, "designWaiver");
+  const normalizedEffectiveModel = effectiveModel === undefined ? undefined : requiredText(effectiveModel, "effectiveModel");
+  const normalizedModelHost = modelHost === undefined ? undefined : validModelHost(modelHost);
   const normalizedRoute = route === undefined ? undefined : validTaskRoute(route);
   const normalizedWaiver = effortWaiver === undefined ? undefined : requiredText(effortWaiver, "effortWaiver");
   return mutateGoal(root, (state) => {
@@ -225,6 +256,14 @@ export async function assignTask({
       task.effort = normalizedEffort;
       task.effortSource = normalizedSource;
     }
+    if (modelGiven) {
+      task.model = normalizedModel;
+      task.modelSource = normalizedModelSource;
+    }
+    if (normalizedKind !== undefined) task.kind = normalizedKind;
+    if (normalizedDesignWaiver !== undefined) task.designWaiver = normalizedDesignWaiver;
+    if (normalizedEffectiveModel !== undefined) task.effectiveModel = normalizedEffectiveModel;
+    if (normalizedModelHost !== undefined) task.modelHost = normalizedModelHost;
     if (normalizedRoute !== undefined) task.route = normalizedRoute;
     if (normalizedWaiver !== undefined) task.effortWaiver = normalizedWaiver;
     task.updatedAt = timestamp();

package/scripts/cairn-goal-state-validation.mjs

@@ -25,6 +25,9 @@ export const TASK_ROUTES = new Set(["light", "heavy"]);
 export const CONCRETE_EFFORTS = new Set(["low", "medium", "high", "xhigh", "max"]);
 export const TASK_EFFORTS = new Set([...CONCRETE_EFFORTS, "inherited"]);
 export const EFFORT_SOURCES = new Set(["host-option", "inherited", "not-applied"]);
+export const TASK_KINDS = new Set(["design"]);
+// The host's strongest tier is the value passed at dispatch; mirrors the strongest column in skills/cairn-plan/delegation.md.
+export const STRONGEST_MODEL_BY_HOST = Object.freeze({ "claude-code": "fable", codex: "gpt-6-astra", antigravity: "pro" });
 
 export function validateState(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Cairn goal state must be an object");
@@ -66,6 +69,11 @@ export function validateState(value) {
     if (task.route !== null && task.route !== undefined) validTaskRoute(task.route, `task ${task.id} route`);
     assertEffortRecord(task.effort ?? null, task.effortSource ?? null, `task ${task.id}`);
     if (task.effortWaiver !== null && task.effortWaiver !== undefined) requiredText(task.effortWaiver, `task ${task.id} effortWaiver`);
+    if (task.kind !== null && task.kind !== undefined) validTaskKind(task.kind, `task ${task.id} kind`);
+    assertModelRecord(task.model ?? null, task.modelSource ?? null, `task ${task.id}`);
+    if (task.designWaiver !== null && task.designWaiver !== undefined) requiredText(task.designWaiver, `task ${task.id} designWaiver`);
+    if (task.modelHost !== null && task.modelHost !== undefined) validModelHost(task.modelHost, `task ${task.id} modelHost`);
+    if (task.effectiveModel !== null && task.effectiveModel !== undefined) requiredText(task.effectiveModel, `task ${task.id} effectiveModel`);
     validTimestamp(task.createdAt);
     validTimestamp(task.updatedAt);
   }
@@ -120,6 +128,12 @@ export function normalizeTask(task, index, defaultStatus, previousTaskId = null)
     effort: null,
     effortSource: null,
     effortWaiver: null,
+    kind: source.kind === undefined || source.kind === null ? null : validTaskKind(source.kind, `tasks[${index}].kind`),
+    model: null,
+    modelSource: null,
+    designWaiver: null,
+    modelHost: null,
+    effectiveModel: null,
     blocker: null,
     createdAt: timestamp(),
     updatedAt: timestamp(),
@@ -131,6 +145,25 @@ export function validTaskRoute(value, label = "route") {
   return value;
 }
 
+export function validModelHost(value, label = "modelHost") {
+  if (!Object.hasOwn(STRONGEST_MODEL_BY_HOST, value)) throw new Error(`${label} must be one of: ${Object.keys(STRONGEST_MODEL_BY_HOST).join(", ")}`);
+  return value;
+}
+
+export function validTaskKind(value, label = "kind") {
+  if (!TASK_KINDS.has(value)) throw new Error(`${label} must be one of: ${[...TASK_KINDS].join(", ")}`);
+  return value;
+}
+
+// A model is a non-empty host-specific string; source "host-option" needs a model, and a model needs a source.
+export function assertModelRecord(model, source, label = "task") {
+  if (model !== null) requiredText(model, `${label} model`);
+  if (source !== null && !EFFORT_SOURCES.has(source)) throw new Error(`${label} modelSource must be one of: ${[...EFFORT_SOURCES].join(", ")}`);
+  if (source === "host-option" && model === null) throw new Error(`${label} modelSource host-option requires a model`);
+  if (source === "inherited" && model === null) throw new Error(`${label} modelSource inherited requires a model`);
+  if (model !== null && source === null) throw new Error(`${label} model requires a modelSource`);
+}
+
 // effort "inherited" pairs only with source "inherited"; source "host-option" needs a concrete level; a source
 // without an effort is only meaningful as "not-applied".
 export function assertEffortRecord(effort, source, label = "task") {

package/skills/cairn-plan/SKILL.md

@@ -42,7 +42,7 @@ Record three triage checkpoints: request (provisional), planning (after explorat
 1. Run `node "<pluginRoot>/scripts/cairn.mjs" init --root "<repoRoot>"`. If unavailable, create `MEMORY.md`, `PLAN.md`, `docs/memory`, `docs/plan` and report that `cairn doctor`/`cairn upgrade` is needed.
 2. Read `MEMORY.md` when present. A non-trivial implementation request authorizes the plan and goal even if the user never says "goal".
 3. Write the initial plan `docs/plan/<topic>.md` from `cairn://templates/work-plan.md` plus its `PLAN.md` entry from the request and `MEMORY.md`: outcome, anticipated surfaces, stable roadmap, and `triage-plan` as first active task (investigation scope, toolcheck, Heavy criteria, update condition); mark it `initial: decision-complete for triage; not implementation-ready`.
-4. Before exploration, toolcheck, delegation, or a non-blocking question, call Codex `update_plan` first and then `create_goal` when available (record unavailability; never claim sync that did not occur), then start the repository goal:
+4. Before exploration, toolcheck, delegation, or a non-blocking question, call Codex `update_plan` first and then `create_goal` when available (main agent only, subagents skip; record unavailability; never claim sync that did not occur), then start the repository goal:
 
 ```sh
 node "<pluginRoot>/scripts/cairn.mjs" goal start --root "<repoRoot>" --goal "<objective>" --plan "docs/plan/<topic>.md" --tasks '[{"id":"triage-plan","title":"Run planned triage and finalize the plan","requiredEvidence":["planArtifact","triageDecision"]},{"id":"implement","title":"Implement the finalized plan"},{"id":"verify","title":"Verify and review the result"}]' --criteria "<completion criterion>" --session "<current session_id>"

package/skills/cairn-plan/delegation.md

@@ -13,6 +13,7 @@ Reference for `cairn-plan`. Read before dispatching `explorer` or `worker` agent
 - If subagent tools are unavailable, the main agent takes over implementation directly and records that takeover in evidence; do not stop solely because subagent tools are unavailable.
 - Keep urgent non-implementation blocking work local when the next step depends immediately on the result.
 - Tell every delegated agent and child subagent to read project-root `MEMORY.md` when present and continue when absent, keep scope, and tell workers they are not alone in the codebase and must not revert others' edits.
+- Host task-list tools (`update_plan`, `create_goal`, `wrap_up`) are called by the main agent only; a worker or subagent skips them (hosts reject them from subagents) and reports in its final report.
 - Every plan must require these status, final-report, close-and-review, and recursive-delegation rules.
 
 ## Task Graph
@@ -30,7 +31,7 @@ EXPECTED OUTCOME: Return concrete decisions, file paths, dependencies, risks, an
 REQUIRED TOOLS: Read-only repository exploration, tool readiness checks, LSP/symbol tools, local command checks.
 MODEL: <tier/value> (passed via host option)
 REASONING EFFORT: <value> (passed via host option)
-MUST DO: Read the project-root `MEMORY.md` before doing assigned work. Preserve proper nouns exactly. Prefer repository evidence. Report missing tools and obtain explicit user approval before any installation. Identify assumptions. Follow the subagent lifecycle rules (status reporting when a channel exists, final report before leaving, recursive delegation only for bounded sub-tasks, passing each child's reasoning effort through the host option). Tell workers they are not alone in the codebase and must not revert others' edits. Use the OS locale for user-visible responses and generated or updated documentation, plans, and memory artifacts.
+MUST DO: Read the project-root `MEMORY.md` before doing assigned work. Preserve proper nouns exactly. Prefer repository evidence. Report missing tools and obtain explicit user approval before any installation. Identify assumptions. Follow the subagent lifecycle rules (status reporting when a channel exists, final report before leaving, recursive delegation only for bounded sub-tasks, passing each child's reasoning effort through the host option; report the exact model ID from your own system prompt in the final report, `unreported` if absent, never guess; skip host task-list tools `update_plan`, `create_goal`, `wrap_up`). Tell workers they are not alone in the codebase and must not revert others' edits. Use the OS locale for user-visible responses and generated or updated documentation, plans, and memory artifacts.
 MUST NOT DO: Edit production code. Ask the user. Expand scope. Delegate vague or unbounded work.
 CONTEXT: User request, MEMORY.md, relevant docs/memory notes, applied model guidance, repository root, Cairn CLI prefix line from the session-start hook.
 ```
@@ -40,8 +41,9 @@ CONTEXT: User request, MEMORY.md, relevant docs/memory notes, applied model guid
 This skill explicitly instructs the effort level for delegated work. It also instructs each task's model.
 
 - The plan decides each task's model from its nature and records `Requested model` and `Effective model`; models are not always inherited. Tiers: fast = read-only exploration, search, inventory, summarization (Claude Code `haiku`); balanced = Light Path implementation and routine verification (`sonnet`); stronger = planning, complexity triage, Heavy Path implementation, review, and final verification/review (`opus`); strongest = Heavy Path design only (`fable`).
-- Model Effective: passed and not rejected is that value; not passed is `not-applied: <reason>`; `inherited` only when the host has no model option. Codex passes the tier's slug (table below) through the host-native model option, else `inherited`.
+- Model Effective is the passed value plus the exact model ID the worker reports from its own system prompt, e.g. `fable (claude-fable-5-1)`; when the report has no ID, record `<value> (unreported)` and never guess, via `goal assign --effective-model <id|unreported>`. Not passed is `not-applied: <reason>`; `inherited` only when the host has no model option. Codex passes the tier's slug (table below) through the host-native model option, else `inherited`.
 - If a lower-tier worker fails a gate, re-dispatch that task one tier up (fast, balanced, stronger, strongest) before recording a blocker.
+- A subagent's model and effort are fixed at dispatch. Any re-dispatch that changes either (one tier up, Light → Heavy promotion, route-change recalculation) MUST be a new dispatch (Claude Code: a new Agent call); never continue the existing subagent with `SendMessage`, which keeps its original model and effort.
 - Routing is per dispatch only; never change model or global/user config files. `Model routing: inherited` in `MEMORY.md` or the plan disables per-task selection.
 - Light Path planning, implementation, and verification request `medium`.
 - Heavy Path planning, review, and implementation request `high`; final verification and review request `xhigh`.
@@ -58,5 +60,5 @@ This skill explicitly instructs the effort level for delegated work. It also ins
 | Antigravity | `invoke_subagent` `Model` takes only a tier enum: fast `flash_lite`, balanced `flash`, stronger `pro`, strongest `pro` (no tier above `pro`); `inherit` is not used for routed work. No effort option. | model: passed value; effort: `inherited` |
 | Host without an option | None. | `inherited` |
 
-- After each dispatch, record state with `goal assign --task <id> --agent <id> --effort <value> --effort-source <host-option|inherited|not-applied>`. Mark Heavy tasks with `route: "heavy"` (tasks JSON field or `goal assign --route heavy`). A Heavy task with no effort, `not-applied`, or `inherited` fails `goal task --status completed` unless `--allow-inherited-effort <reason>` records why.
+- After each dispatch, record state with `goal assign --task <id> --agent <id> --effort <value> --effort-source <host-option|inherited|not-applied>`; for a `kind: "design"` task also `--model <value> --model-source host-option --host <claude-code|codex|antigravity>`. A design model that is not the host's strongest tier (`--host claude-code` `fable`, `codex` `gpt-6-astra`, `antigravity` `pro`; any of the three when `--host` is omitted) fails completion unless `--allow-no-design-model <reason>`. Mark Heavy tasks with `route: "heavy"` (tasks JSON field or `goal assign --route heavy`). A Heavy task with no effort, `not-applied`, or `inherited` fails `goal task --status completed` unless `--allow-inherited-effort <reason>` records why.
 - On every route change, synchronize the plan artifact, repository goal task roadmap through `goal replan`, native UI plan, and reasoning effort profile before mutation. Completed task profiles are preserved as audit history; incomplete task profiles are recalculated for the new path.

package/skills/cairn-plan/heavy-path.md

@@ -4,8 +4,9 @@ Reference for `cairn-plan`. Read only when a Heavy Path signal is present or a r
 
 ## Heavy Path Flow
 
-Heavy Path flow: plan -> pre-implementation review -> bounded `worker` implementation -> verification worker or read-only review.
+Heavy Path flow: plan -> Heavy design task -> pre-implementation review -> bounded `worker` implementation -> verification worker or read-only review.
 
+- On a Heavy route, `goal replan` adds a `kind: "design"` task (`heavy-design`, `route: "heavy"`, `requiredEvidence: ["designRecord"]`) after `triage-plan`, and implementation tasks depend on it. The main agent never does this design inline: dispatch it read-only to the strongest tier (Claude Code Agent `model: "fable"`, `effort: "high"`, never `fork`), record `goal assign heavy-design --model <value> --model-source host-option --host <claude-code|codex|antigravity>`, merge the result into the plan's `## Heavy Design`, and bind that plan with `goal verify --kind designRecord`. A design model that is not the host's strongest tier (`--host claude-code` `fable`, `codex` `gpt-6-astra`, `antigravity` `pro`; any of the three when `--host` is omitted) fails completion unless `--allow-no-design-model <reason>`. This is the only bypass.
 - Record the pre-implementation decisions that review must resolve before any mutation.
 - Every Heavy Path task includes an explicit automated test command and a `Tests:` evidence line; completion cannot rely on generic verification wording without test evidence.
 - Planning, review, and implementation request `high` reasoning effort; final verification and review request `xhigh` (see `cairn://skills/cairn-plan/delegation.md`).
@@ -23,4 +24,5 @@ Use three mandatory checkpoints and record each result, evidence, newly discover
 - Before the first edit, the planning or code checkpoint may change Light Path to Heavy Path or Heavy Path to Light Path when the evidence supports it.
 - Every route change rebuilds and synchronizes the plan artifact, the repository goal task roadmap through `goal replan`, and the native UI plan, including assignments, reviews, required evidence, and the reasoning effort profile. Do not mutate until all agree.
 - After editing starts, only promote Light Path to Heavy Path: stop further edits, mark affected evidence stale, revise and synchronize all roadmaps, run newly required Heavy Path review, and repeat the code checkpoint before resuming.
+- A subagent's model and effort are fixed at dispatch; any re-dispatch that changes either (one tier up, Light → Heavy promotion, route-change recalculation) MUST be a new dispatch (Claude Code: a new Agent call), never `SendMessage` to the existing subagent.
 - A Quick Path change that meets any failed Quick Path criterion escalates to Light Path first (plan + goal) before further edits; a Heavy signal then follows this file.

package/skills/cairn-plan/planning-rules.md

@@ -11,7 +11,7 @@ Plan from the whole work down. First understand the full requested outcome and a
 ## Planning Rules
 
 - Every initial plan must be decision-complete for its triage task and explicitly not implementation-ready; the post-triage revision must be decision-complete for implementation.
-- Every non-trivial implementation or planned-work continuation plan must be shown through Codex `update_plan` and `create_goal` before triage when those tools are available, then synchronized again after triage. Routine known-target Git/GitHub operations and Quick Path work do not create a plan or goal.
+- Every non-trivial implementation or planned-work continuation plan must be shown through Codex `update_plan` and `create_goal` before triage when those tools are available (host task-list tools `update_plan`, `create_goal`, `wrap_up` are called by the main agent only; a worker or subagent skips them and reports in its final report), then synchronized again after triage. Routine known-target Git/GitHub operations and Quick Path work do not create a plan or goal.
 - Every plan must describe the whole work first, then classify it into executable tasks and any needed sub-tasks.
 - Every plan must treat the user-called/main agent as the orchestrator and assign implementation edits to `worker` whenever subagent tools are available, regardless of Light Path or Heavy Path (see `cairn://skills/cairn-plan/delegation.md`).
 - Every plan must include complexity triage, the selected path, and the Heavy Path signals checked, even when Light Path is selected.

package/skills/cairn-work/delegation.md

@@ -9,6 +9,7 @@ Reference for `cairn-work`. Read before dispatching a `worker` or `explorer`, or
 - When the subagent tool provides a progress-reporting channel, subagents report status to the orchestrator when starting work, when deciding or confirming direction, during periodic progress, and when finishing. The orchestrator must immediately relay received status events to the user. If no mid-run reporting channel exists, the orchestrator relays observable events such as assignment, waiting, and final completion.
 - Delegated subagents must provide a final report before leaving. After the orchestrator captures the final report and evidence, it must close or release the completed subagent, then review the final report and evidence before marking the work complete.
 - When subagent tools are available, each agent may recursively delegate bounded sub-tasks to subagents. Every child subagent reads project-root `MEMORY.md` when present and continues when absent, keeps the assigned scope, and preserves others' edits.
+- Host task-list tools (`update_plan`, `create_goal`, `wrap_up`) are called by the main agent only; a worker or subagent skips them (hosts reject them from subagents) and reports in its final report.
 - If subagent tools are unavailable, the main agent takes over implementation directly and records that takeover in evidence.
 - `worker` returns a structured handoff for only its assigned goal/task: changed files, tool readiness result, dry-run or check result when applicable, automated test result for Heavy Path, module acceptance command and result, surface integration command or QA artifact, blocker, and cleanup notes. A worker must not select the next task.
 
@@ -30,7 +31,7 @@ EXPECTED OUTCOME: Minimal code or documentation change satisfying the task contr
 REQUIRED TOOLS: Scoped file editing, tool readiness checks, existing test/build commands, surface QA commands.
 MODEL: <tier/value> (passed via host option)
 REASONING EFFORT: <value> (passed via host option)
-MUST DO: Read the project-root `MEMORY.md` before doing assigned work and follow its policy. Stay within the listed file scope and the task's `writeScope`. Assume you are not alone in the codebase; do not revert others' edits. Follow the subagent lifecycle rules (status reporting when a channel exists, final report before leaving, recursive delegation only for bounded sub-tasks with these same constraints, passing each child's reasoning effort through the host option). Obtain explicit user approval before installing missing tools. Run dry-run or check mode before external-state mutation when available. Provide module evidence, surface evidence, and a structured handoff scoped to the assigned goal/task. Never edit, weaken, skip, or delete existing tests, fixtures, or verification commands to pass a gate without a reason recorded in the plan. After a defect fix, search for other implementations of the same rule or pattern and report them. Copy the Cairn CLI prefix line literally; never store it in a shell variable. Use the OS locale for user-visible responses and generated or updated documentation, plans, and memory artifacts.
+MUST DO: Read the project-root `MEMORY.md` before doing assigned work and follow its policy. Stay within the listed file scope and the task's `writeScope`. Assume you are not alone in the codebase; do not revert others' edits. Follow the subagent lifecycle rules (status reporting when a channel exists, final report before leaving, recursive delegation only for bounded sub-tasks with these same constraints, passing each child's reasoning effort through the host option; report the exact model ID from your own system prompt in the final report, `unreported` if absent, never guess; skip host task-list tools `update_plan`, `create_goal`, `wrap_up`). Obtain explicit user approval before installing missing tools. Run dry-run or check mode before external-state mutation when available. Provide module evidence, surface evidence, and a structured handoff scoped to the assigned goal/task. Never edit, weaken, skip, or delete existing tests, fixtures, or verification commands to pass a gate without a reason recorded in the plan. After a defect fix, search for other implementations of the same rule or pattern and report them. Copy the Cairn CLI prefix line literally; never store it in a shell variable. Use the OS locale for user-visible responses and generated or updated documentation, plans, and memory artifacts.
 MUST NOT DO: Ask the user. Skip LSP/typecheck/lint because a tool is missing without attempting installation. Refactor unrelated code. Continue an open-ended verification loop. Treat a side question as permission to abandon the active task. Delegate vague or unbounded work. Claim completion without evidence. Modify files outside the assigned ownership.
 CONTEXT: docs/plan/<topic>.md task, relevant docs/memory notes, applied model guidance, exact files, verification commands, Cairn CLI prefix line.
 ```
@@ -40,8 +41,9 @@ CONTEXT: docs/plan/<topic>.md task, relevant docs/memory notes, applied model gu
 This skill explicitly instructs the effort level for delegated work. It also instructs each task's model.
 
 - The plan decides each task's model from its nature and records `Requested model` and `Effective model`; models are not always inherited. Tiers: fast = read-only exploration, search, inventory, summarization (Claude Code `haiku`); balanced = Light Path implementation and routine verification (`sonnet`); stronger = planning, complexity triage, Heavy Path implementation, review, and final verification/review (`opus`); strongest = Heavy Path design only (`fable`).
-- Model Effective: passed and not rejected is that value; not passed is `not-applied: <reason>`; `inherited` only when the host has no model option. Codex passes the tier's slug (table below) through the host-native model option, else `inherited`.
+- Model Effective is the passed value plus the exact model ID the worker reports from its own system prompt, e.g. `fable (claude-fable-5-1)`; when the report has no ID, record `<value> (unreported)` and never guess, via `goal assign --effective-model <id|unreported>`. Not passed is `not-applied: <reason>`; `inherited` only when the host has no model option. Codex passes the tier's slug (table below) through the host-native model option, else `inherited`.
 - If a lower-tier worker fails a gate, re-dispatch that task one tier up (fast, balanced, stronger, strongest) before recording a blocker.
+- A subagent's model and effort are fixed at dispatch. Any re-dispatch that changes either (one tier up, Light → Heavy promotion, route-change recalculation) MUST be a new dispatch (Claude Code: a new Agent call); never continue the existing subagent with `SendMessage`, which keeps its original model and effort.
 - Routing is per dispatch only; never change model or global/user config files. `Model routing: inherited` in `MEMORY.md` or the plan disables per-task selection.
 - Light Path planning, implementation, and verification request `medium`.
 - Heavy Path planning, review, and implementation request `high`; final verification and review request `xhigh`.
@@ -58,5 +60,5 @@ This skill explicitly instructs the effort level for delegated work. It also ins
 | Antigravity | `invoke_subagent` `Model` takes only a tier enum: fast `flash_lite`, balanced `flash`, stronger `pro`, strongest `pro` (no tier above `pro`); `inherit` is not used for routed work. No effort option. | model: passed value; effort: `inherited` |
 | Host without an option | None. | `inherited` |
 
-- After each dispatch, record state with `goal assign --task <id> --agent <id> --effort <value> --effort-source <host-option|inherited|not-applied>`. Mark Heavy tasks with `route: "heavy"` (tasks JSON field or `goal assign --route heavy`). A Heavy task with no effort, `not-applied`, or `inherited` fails `goal task --status completed` unless `--allow-inherited-effort <reason>` records why.
+- After each dispatch, record state with `goal assign --task <id> --agent <id> --effort <value> --effort-source <host-option|inherited|not-applied>`; for a `kind: "design"` task also `--model <value> --model-source host-option --host <claude-code|codex|antigravity>`. A design model that is not the host's strongest tier (`--host claude-code` `fable`, `codex` `gpt-6-astra`, `antigravity` `pro`; any of the three when `--host` is omitted) fails completion unless `--allow-no-design-model <reason>`. Mark Heavy tasks with `route: "heavy"` (tasks JSON field or `goal assign --route heavy`). A Heavy task with no effort, `not-applied`, or `inherited` fails `goal task --status completed` unless `--allow-inherited-effort <reason>` records why.
 - On every route change, synchronize the plan artifact, repository goal task roadmap through `goal replan`, native UI plan, and reasoning effort profile before edits resume. Completed task profiles are preserved as audit history; incomplete task profiles are recalculated for the new path.

package/skills/cairn-work/heavy-path.md

@@ -5,6 +5,7 @@ Reference for `cairn-work`. Read only when the recorded route is Heavy Path, a n
 ## Heavy Path Execution
 
 - Follow the full planning and review pipeline recorded in the plan without role-mapping shortcuts: pre-implementation review before mutation, bounded `worker` implementation, then verification worker or read-only review after evidence exists.
+- Heavy implementation cannot complete until a completed `kind: "design"` task exists (record it with `--host <claude-code|codex|antigravity>`). A design model that is not the host's strongest tier (`--host claude-code` `fable`, `codex` `gpt-6-astra`, `antigravity` `pro`; any of the three when `--host` is omitted) fails completion unless `--allow-no-design-model <reason>`. This is the only bypass.
 - Run the recorded automated test command and record explicit `Tests:` evidence in the plan before claiming completion. This is required even when module acceptance uses a broader check command.
 - Planning, review, and implementation request `high` reasoning effort; final verification and review request `xhigh`.
 
@@ -13,4 +14,5 @@ Reference for `cairn-work`. Read only when the recorded route is Heavy Path, a n
 1. Confirm the request checkpoint and planning checkpoint, inspect the exact files, callers, and tests, then record the code checkpoint immediately before the first edit. Missing or pending checkpoints block mutation.
 2. Before the first edit, evidence may change Light Path to Heavy Path or Heavy Path to Light Path. On every route change, update the plan artifact first, replace the incomplete repository goal task roadmap with `goal replan`, update the native UI plan to the same stable task order, and synchronize assignments, reviews, required evidence, and the reasoning effort profile. Do not mutate until all agree.
 3. After editing starts, only promote Light Path to Heavy Path. On a new Heavy Path signal, stop further edits, mark affected evidence stale, revise and synchronize the plan artifact, repository goal task roadmap, and native UI plan, run newly required Heavy Path review, and repeat the code checkpoint before resuming.
-4. Quick Path work that hits any failed Quick Path criterion first escalates to Light Path (create plan + goal) before further edits; a Heavy signal then follows step 3.
+4. A subagent's model and effort are fixed at dispatch; any re-dispatch that changes either (one tier up, Light → Heavy promotion, route-change recalculation) MUST be a new dispatch (Claude Code: a new Agent call), never `SendMessage` to the existing subagent.
+5. Quick Path work that hits any failed Quick Path criterion first escalates to Light Path (create plan + goal) before further edits; a Heavy signal then follows step 3.

package/templates/work-plan.md

@@ -41,14 +41,14 @@ Describe the observable result.
 
 ## Reasoning Effort Profile
 
-- Model: decided per task (fast `haiku` for read-only exploration/search/summarization; balanced `sonnet` for Light implementation and routine verification; stronger `opus` for planning, complexity triage, Heavy implementation, review, and final verification/review; strongest `fable` for Heavy design only). Pass it through the host option on every dispatch (Claude Code: Agent `model`, never `fork`); re-dispatch one tier up (fast, balanced, stronger, strongest) if a lower-tier worker fails a gate; `Model routing: inherited` disables this. Never change model/global config.
+- Model: decided per task (fast `haiku` for read-only exploration/search/summarization; balanced `sonnet` for Light implementation and routine verification; stronger `opus` for planning, complexity triage, Heavy implementation, review, and final verification/review; strongest `fable` for Heavy design only, as a separate `kind: "design"` task dispatched to that tier rather than part of planning). Pass it through the host option on every dispatch (Claude Code: Agent `model`, never `fork`); re-dispatch one tier up (fast, balanced, stronger, strongest) if a lower-tier worker fails a gate; `Model routing: inherited` disables this. Effective model adds the exact model ID the worker reports from its own system prompt (`unreported` when absent; never guess). A re-dispatch that changes model or effort MUST be a new dispatch, never `SendMessage`. A design model below the host's strongest tier (`--host`: `fable`/`gpt-6-astra`/`pro`) fails completion unless `--allow-no-design-model <reason>`. Never change model/global config.
 - Light Path: planning=`medium`, implementation=`medium`, verification=`medium`.
 - Heavy Path: planning/review=`high`, implementation=`high`, final verification/review=`xhigh`.
 - Host boundary: every new task/worker dispatch MUST pass the task's requested effort through the host option (Claude Code: Agent `effort`, never `fork`; Codex: host-native option). Recording without passing is a defect. Use `inherited` only when the host has no option.
 - Route-change gate: synchronize the plan artifact, repository goal task roadmap through `goal replan`, native UI plan, and reasoning effort profile before edits resume. Completed task profiles are preserved as audit history; incomplete task profiles are recalculated for the new path.
 - Every module task records:
   - Requested model:
-- Effective model: <applied value | not-applied: reason | inherited: host has no option>
+- Effective model: <applied value (reported model ID | unreported) | not-applied: reason | inherited: host has no option>
 - Requested reasoning effort:
   - Effective reasoning effort: <applied value | not-applied: reason | inherited: host has no option>
 
@@ -121,7 +121,7 @@ Describe the observable result.
 - Task ID: `triage-plan`
 - Initial status: `active`
 - Requested model:
-- Effective model: <applied value | not-applied: reason | inherited: host has no option>
+- Effective model: <applied value (reported model ID | unreported) | not-applied: reason | inherited: host has no option>
 - Requested reasoning effort:
 - Effective reasoning effort: <applied value | not-applied: reason | inherited: host has no option>
 - Contract: execute the investigation scope and Heavy Path criteria declared by the initial plan, then update this file and the Codex UI plan to the decision-complete implementation revision.
@@ -134,7 +134,7 @@ Describe the observable result.
 - Task ID: `task-1`
 - Initial status: `pending` or `active`
 - Requested model:
-- Effective model: <applied value | not-applied: reason | inherited: host has no option>
+- Effective model: <applied value (reported model ID | unreported) | not-applied: reason | inherited: host has no option>
 - Requested reasoning effort:
 - Effective reasoning effort: <applied value | not-applied: reason | inherited: host has no option>
 - Contract: