ceo-orchestration 1.0.0

package/.claude/adr/ADR-141-reduce-protocol.md

@@ -0,0 +1,124 @@
+---
+id: ADR-141
+title: Evidence-bound REDUCE protocol for swarm fan-out — Kimi-inspired, internally grounded
+status: ACCEPTED
+date: 2026-05-27
+related: [ADR-058, ADR-052, ADR-108, ADR-104, ADR-055]
+accepted_at: 2026-05-28
+accepting_session: S177
+authorization: PLAN-117 WS-B sentinel `.claude/plans/PLAN-117/architect/round-4/approved.md` + `.asc` (Owner GPG 0000000000000000000000000000000000000000)
+---
+
+# ADR-141: Evidence-bound REDUCE protocol for swarm fan-out
+
+**Status:** ACCEPTED (S177, 2026-05-28)
+**Date:** 2026-05-27
+**Enforcement commit:** `fa9a5c4` (PLAN-115 Batch-3 — REDUCE protocol doc + worker return-status contract, S170)
+(`docs/triage-reduce-protocol.md` + the `core/ai-llm-orchestration`
+cross-link + the `team.md` §Worker return-status contract). Tier-1 metrics are
+derivable now from audit-log timestamps; Tier-2 metrics require the 8-field
+schema wired as typed `audit_emit` events (future work) — until then they are
+documented as NOT-yet-measured to avoid a false-green._
+**Decision drivers:** the REDUCE step is the laundering risk in fan-out;
+PLAN-113 reopened 4 laundered drops; PLAN-114 found ~57% stale findings; the
+"+2 sweeps" deferral trigger for this doctrine has already fired.
+
+## Context
+
+The S163 session analyzed the Moonshot "Kimi Agent Swarm" (reported as K2.6,
+~300 parallel sub-agents trained via PARL — these external specifics were NOT
+independently verified; see §Attribution) against this framework and asked
+whether to adopt a swarm architecture. The Codex pair-rail (thread `019e5f6b`) **converged** on
+the verdict: **NOT a new SOTA architecture for us.** Kimi optimizes
+embarrassingly-parallel, low-error-cost workloads; this framework operates at
+the opposite end — coupled, high-error-cost mutations over shared state (the
+repo), where one wrong canonical edit is a governance incident. Write-path
+parallelism here is **dependency-graph-bound**, not agent-count-bound.
+
+The one worth-importing kernel is the **REDUCE** step. We already run the safe
+MAP half (PLAN-112/113 fan out 8–31 shards with evidence pointers + an
+author/reviewer split + Codex anti-laundering). What was implicit and
+unspecified is the REDUCE contract: how the reducer adversarially verifies shard
+outputs against evidence instead of merging summaries.
+
+When this doctrine was first sketched (S163), the framework convention (ADR
+README) was to defer a dedicated ADR until a pattern recurs in **+2 sweeps**.
+That trigger has now fired: PLAN-112 and PLAN-113 are two independent sweeps
+that both depended on exactly this REDUCE discipline (PLAN-113's anti-laundering
+pass reopened 4 laundered drops). The ADR is therefore no longer premature.
+
+## Decision drivers
+
+- The REDUCE step is the single laundering point in any fan-out.
+- Empirical: PLAN-113 reopened 4 laundered drops; PLAN-114 found ~57% of a 307
+  backlog stale → verification must scale by risk + drop-rate, not fan-out.
+- Same-model shards share correlated blind spots (ADR-052/108 same-LLM problem).
+- A float in an HMAC-covered emit raises `CanonicalJsonError`; `audit_emit`
+  fail-opens (writes `hmac=null` + `hmac_error`, breadcrumbs to `audit-log.errors`)
+  → the event persists but loses HMAC coverage (S164 class) — the schema's
+  `confidence` must be integer basis-points.
+
+## Options considered
+
+### Option A: Standalone reference doc + ADR-141 (CHOSEN)
+
+`docs/triage-reduce-protocol.md`, cross-linked from `core/ai-llm-orchestration`,
+backed by this ADR. **No new core skill** (no count bump).
+
+- **Pros:** lightest form; discoverable; does not bloat the 549-line,
+  security-owned `ai-llm-orchestration` SKILL.md (which already carries a
+  stale-metric apology) nor add a second count ceremony.
+- **Cons:** a doc is not auto-loaded as a skill — relies on the cross-link.
+
+### Option B: Fold into `ai-llm-orchestration`
+
+- **Cons:** worsens that skill's CSO/length problem; entangles a new doctrine
+  with an already-overloaded skill. **Rejected** (Wave A Q5).
+
+### Option C: Full core skill `triage-reduce-protocol`
+
+- **Cons:** a second count-bump ceremony (core 42→43, total 151→152) for content
+  that is reference doctrine, not an archetype operating manual. Deferred — the
+  Owner may promote later if it earns skill-level activation.
+
+## Decision
+
+Adopt the **evidence-bound REDUCE protocol** as a standalone reference doc
+(`docs/triage-reduce-protocol.md`), cross-linked from `core/ai-llm-orchestration`
+and paired MAP-side with the `team.md` worker return-status contract (WS-C). The
+protocol mandates an 8-field shard-output schema (with redaction +
+integer-basis-point `confidence`), a reducer rule (no evidence-free
+accept/drop; security/canonical require independent cross-rail review),
+two-tier metrics (Tier-1 derivable now, Tier-2 needs schema wiring), four
+failure modes each with a concrete mitigation (shard-size/straggler sub-rules;
+≥40% drop-density two-pass reducer; `scan_harness_mimicry` quarantine), and the
+hard anti-pattern that an evidence-free summary merge is a governance failure.
+**PARL is imported as instrumentation only** (critical-path accounting +
+serial-collapse detection) — not a bigger swarm and not training.
+
+## Consequences
+
+- **(+)** Closes the REDUCE-side gap with an auditable, evidence-bound contract;
+  pairs with WS-C to give both halves of map-reduce swarm orchestration.
+- **(+)** Encodes the S164 float-in-HMAC lesson into the schema (basis-points).
+- **(−)** Tier-2 metrics are not yet wired (typed `audit_emit` events) — honestly
+  flagged as future work, not claimed as live.
+- **(~)** Reference-doc form (not a skill) → discoverability depends on the
+  cross-link, accepted to avoid a premature second count ceremony.
+
+## Blast radius
+
+**L3+** — cross-cutting orchestration doctrine touching a new doc, a core-skill
+cross-link, `team.md`, and the framework ADR/count surface (ADR 151→152).
+
+## Attribution (AC-E4)
+
+The Moonshot "Kimi Agent Swarm" (K2.6 / PARL) is cited as **inspiration only**
+(ADR-058 attribution style). The protocol's load-bearing claims trace to
+**internal precedent** — the PLAN-112/113 fan-out + anti-laundering and the
+S164/S167 burndown — not to the external analysis. External Kimi URLs and a
+plan-filename-with-line-numbers cited during S163 were **NOT independently
+verified** and are deliberately not referenced as fact in any shipped artifact.
+Analysis record + Codex convergence: memory `reference-kimi-agent-swarm-analysis-s163`
+(thread `019e5f6b`). PLAN-113 remains the living experiment — this ADR
+forward-specifies the contract; it does not reopen or retro-audit PLAN-113.

package/.claude/adr/ADR-142-opus-4-8-model-bump.md

@@ -0,0 +1,116 @@
+---
+id: ADR-142
+title: Opus 4.8 model bump — atomic VETO-floor + dispatch-table modernization
+status: ACCEPTED
+decision_date: 2026-05-29
+accepted_at: 2026-05-29
+accepting_session: S186
+ratified_by: "Owner (S186) — 'ratifica o model-bump'; VETO-floor ceremony"
+proposing_session: S185
+authorization: "PLAN-120 readiness audit (Eixo 5) E5-F2..F15 + E7-F4 — Opus 4.8 currency gap. Web-confirmed 2026-05-29 from docs.anthropic.com/en/docs/about-claude/models/overview: claude-opus-4-8 is the current Opus API ID at $5/$25 per MTok (3x cheaper than claude-opus-4-7 at $15/$75); a 'Migrating to Claude Opus 4.8' guide exists. PROPOSED pending Owner GPG + the standard ADR-052 §Model-ID-bump benchmark gate."
+owner: vp-engineering
+plan: PLAN-120-framework-readiness-closure-audit
+amends: ADR-052
+related: [ADR-052, ADR-064, ADR-080, ADR-063]
+---
+
+# ADR-142 — Opus 4.8 model bump (atomic)
+
+**Status:** PROPOSED (S185, 2026-05-29)
+**Blast radius:** L2 (model-ID string across VETO-floor enforcement + dispatch table + cost tables; no schema-shape change)
+**Supersedes:** none
+**Superseded by:** none
+**Depends on:** ADR-052 (multi-model dispatch by role) §Model-ID-bump recipe; ADR-064 (VETO-floor enforcement)
+
+## Context
+
+The framework pins every VETO-floor agent role and the CEO orchestration
+model to `claude-opus-4-7`. As of 2026-05-29, Anthropic's current Opus
+flagship is **`claude-opus-4-8`**, priced at **$5 / MTok input, $25 /
+MTok output** — 3x cheaper than `claude-opus-4-7` ($15 / $75). The
+framework's Opus-heavy cost estimates are therefore ~3x inflated against
+the live rate, and the closed `MODEL_ID` enum / `VETO_FLOOR_MODEL`
+constant / `_ADR_052_ROLE_TO_MODEL` dispatch table all name a
+non-current model ID. PLAN-120 eixo-0 preflight recorded
+`claude-opus-4-8 = 0 files; claude-opus-4-7 = 240 files`.
+
+ADR-052 §Role-to-model distribution names the specific Opus ID, and
+`VERSIONING.md` §Model ID bumps documents that an ID change is **not
+silent** — it requires this ADR + a benchmark gate.
+
+## Decision
+
+Adopt `claude-opus-4-8` as the canonical Opus model ID, replacing
+`claude-opus-4-7` everywhere it appears as a VETO-floor / dispatch /
+route / cost / template / SPEC value. The bump is **ONE ATOMIC change**:
+a partial application produces split-brain VETO enforcement (the
+closed-enum membership gate at `loader.py:432` `is_known_model()` and
+the spawn-time VETO-floor check at `agent_frontmatter.py:204` would
+disagree on the canonical Opus string).
+
+The atomic bump-set is exactly the sites enumerated below (also recorded
+in PLAN-120 deliverables `remediation-backlog.md` E5-F2..F15 + E7-F4):
+
+1. `MODEL_ID` enum — `.claude/hooks/_lib/tier_policy/_types.py:94`
+   (`OPUS47 = "claude-opus-4-8"`; KERNEL).
+2. CLI `VALID_MODEL_IDS` + `MODEL_ID` Literal — `.claude/scripts/tier_policy_cli/_types.py:26,29`.
+3. `VETO_FLOOR_MODEL` — `.claude/hooks/_lib/agent_frontmatter.py:118` (KERNEL).
+4. 5 VETO agent frontmatter `model:` fields — `.claude/agents/{code-reviewer,security-engineer,incident-commander,identity-trust-architect,threat-detection-engineer}.md:6` (canonical-guarded).
+5. `_ADR_052_ROLE_TO_MODEL` dispatch table — `.claude/hooks/audit_log.py:890-917` (7 Opus rows) + secondary devops drift fix `claude-sonnet-4-6` -> `claude-haiku-4-5-20251001` at L894 (KERNEL).
+6. ADR-052 normative table + inline example + validation snippet — `.claude/adr/ADR-052-multi-model-dispatch-by-role.md:68-69,105,300,342`.
+7. Tier-policy templates — `templates/.claude/tier-policy.json:7,12` + `npm/templates/.claude/tier-policy.json:7,12`.
+8. Test rebaseline — `test_tier_policy_types.py`, `test_veto_floor_bijection.py`, `test_adr_052_role_to_model_coverage.py` (`_EXPECTED_FLOOR`), `test_audit_log_v2_8_model.py`, `test_model_routing_resolve.py`, `test_model_routing_resolve_full.py`.
+9. `model_routing.py` routing table — `.claude/hooks/_lib/model_routing.py:61-62` (KERNEL).
+10. SPEC Literal enum + VERSIONING bump SOP — `SPEC/v1/tier-policy.schema.md:105-106`, `SPEC/v1/tournament-report.schema.md:50`, `VERSIONING.md:146`.
+11. FROZEN_BASELINE default_model — `.claude/hooks/_lib/tier_policy/_constants.py:324` (KERNEL).
+12. Skill routing tables — `.claude/skills/core/llm-routing-and-finops/SKILL.md`, `.claude/skills/domains/fintech/skills/blockchain-security-audit/SKILL.md` (advisory).
+13. CLI VETO_HARDCODE — `.claude/scripts/tier_policy_cli/_constants.py:45-46`.
+14. Spawn router — `.claude/scripts/task-route.py:511,520,528,539`.
+15. Tournament pricing/judge — `.claude/scripts/tournament/runner.py:39,45,88` + `reporter.py:133`.
+16. npm published mirror — every item above mirrored under `npm/.claude/**` in lockstep (byte-identical at HEAD).
+
+### Haiku registry normalization — DEFERRED (E0-F3 / E5-F1 stays open)
+
+Audit E5-F1 / E0-F3 found two registries disagree on the Haiku ID form
+(hook `MODEL_ID` enum stores **bare** `claude-haiku-4-5`; CLI/agent/template
+store **date-stamped** `claude-haiku-4-5-20251001`). Full normalization has a
+large blast radius (the enum + `loader.py is_known_model()` + ~6 test files +
+stub routing tables + configs), so this bump is **scoped to the Opus 4.8 bump
+ONLY** and leaves Haiku **consistently bare** everywhere it was bare (enum,
+`model_routing.py`, and the model_routing tests all stay bare — no split-brain).
+The ONE Haiku change here is the **E5-F7 devops drift fix**: `audit_log.py`
+devops `claude-sonnet-4-6` -> `claude-haiku-4-5-20251001` (a doc-dict row, not
+enum-validated) to match ADR-052 §Role-to-model + `agents/devops.md`. The full
+registry normalization (E0-F3) is DEFERRED to a separate focused effort with
+its own test pass — see PLAN-120-FOLLOWUP receipts/disposition.md.
+
+## Pricing (current flagship, web-verified 2026-05-29)
+
+| Model | Input $/MTok | Output $/MTok |
+|-------|-------------:|--------------:|
+| `claude-opus-4-8` (current flagship) | 5.00 | 25.00 |
+| `claude-sonnet-4-6` | 3.00 | 15.00 |
+| `claude-haiku-4-5-20251001` | 1.00 | 5.00 |
+
+(Prior `claude-opus-4-7` was $15 / $75; stale tables that show Haiku at
+$0.25 / $1.25 are out of date.)
+
+## Consequences
+
+- VETO-floor enforcement, the closed `MODEL_ID` membership gate, the
+  spawn-time frontmatter check, the audit dispatch fallback, the
+  tier-policy templates, the SPEC Literal enum, and both cost/tournament
+  pricing paths all name `claude-opus-4-8` consistently.
+- Opus-heavy plan `budget_usd_estimate` fields drop ~3x against the live
+  rate; historical `claude-opus-4-7` cost rows are RETAINED in pricing
+  tables for log-replay of past sessions.
+- The Haiku registry split is closed; no more silent `unknown_model`
+  fallback for date-stamped Haiku policies.
+
+## ADR-052 §Model-ID-bump recipe compliance
+
+This ADR is the not-silent authorization VERSIONING.md §Model ID bumps
+requires. Before MERGE the Owner must run the benchmark gate
+(`.claude/plans/PLAN-020/rubrics/<archetype>.yaml`, pass-rate ≥ baseline)
+and attach the evidence file, per ADR-052 §Consequences. ADR-064
+VETO-floor semantics are unchanged — only the model string moves.

package/.claude/adr/ADR-143-git-hook-bypass-guard.md

@@ -0,0 +1,166 @@
+---
+id: ADR-143
+title: Git hook-bypass guard — new audit action + dual-auth escape hatch + fail-closed parse mode
+status: ACCEPTED
+decision_date: 2026-06-02
+proposing_session: S20x
+accepted_at: 2026-06-17
+accepting_session: S242
+enforcement_commit: bf11d3a0
+authorization: "PLAN-124 WS-1 (ECC value-harvest) — debate R1 PROCEED (MF-A..MF-L folded) + Codex pair-rail R1 BLOCK->R2 EXECUTE-READY. Owner GPG ceremony pending; this ADR is the not-silent authorization for the SPEC/kernel contract change (a NEW closed-enum audit action) per VERSIONING.md."
+owner: security-engineer
+plan: PLAN-124-ecc-value-harvest
+amends: none
+related: [ADR-040, ADR-055, ADR-056, ADR-139, ADR-124, ADR-125, ADR-126]
+---
+
+# ADR-143 — Git hook-bypass guard
+
+**Status:** ACCEPTED (S242, 2026-06-17 — git-bypass guard live in the Tier-1
+`check_bash_safety.py`, registered in `.claude/settings.json`, 85 tests, SPEC v2.38;
+Codex pair-rail R1 BLOCK→R2 EXECUTE-READY at PLAN-124 WS-1 + Codex R-sweep ACCEPT
+thread `019ed788`)
+**Enforcement commit:** `bf11d3a0` (PLAN-124 WS-1 — `_lib/git_bypass.py` wired into
+`check_bash_safety.py` + the `git_hook_bypass_blocked` closed-enum action; later fix `97ed70cb`)
+**Blast radius:** L3 (a NEW closed-enum audit action = SPEC/kernel contract
+change; a new PreToolUse Bash decision branch on the Tier-1 `check_bash_safety.py`)
+**Supersedes:** none
+**Superseded by:** none
+**Depends on:** ADR-040-AMEND-2 §Layer-1 (import-time `trusted_env` snapshot as
+the trust root for `CEO_*` escape-hatch reads); ADR-055/ADR-056 (audit-emit
+closed-enum + per-action field allowlist contract); ADR-139 (Tier-1 86%
+enforcing coverage floor for `check_bash_safety.py`)
+
+## Context
+
+PLAN-124 harvests governance/correctness mechanisms from `affaan-m/ECC`
+("Everything Claude Code", MIT). WS-1 ports the *idea* of ECC's
+`scripts/hooks/block-no-verify.js` — a tokenizer that blocks git hook-bypass
+flags — as a clean-room stdlib-Python re-implementation.
+
+**Honest framing (debate K2 / MF-A — the "crown jewel" framing is RETRACTED):**
+this is **defense-in-depth + adopter protection + git hygiene**, NOT a fix for
+a structural hole in *this* repo's moat. Our pre-commit governance is a Claude
+Code **PreToolUse** hook (`settings.stack.node.json`) that fires regardless of
+`--no-verify` / `core.hooksPath`, and our `.git/hooks/` holds only `.sample`
+files. The real beneficiary is an **adopter** repo that relies on git-native
+hooks. WS-1 ships at the corrected (lower) priority debate K2 assigned it.
+
+ECC covers **6** subcommands (`commit`/`push`/`merge`/`cherry-pick`/`rebase`/
+`am` — Codex falsified an earlier debate "no `am`" claim, MF-C), treats `-n` as
+`--no-verify` for `commit` only, and blocks the inline `-c core.hooksPath=…`
+global. ECC does **not** cover the `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_<n>`/
+`GIT_CONFIG_VALUE_<n>` env channel, `git config` *writes* to `core.hooksPath`
+(the split attack), or `--git-dir`/`-C`/alias smuggling. Our guard must
+therefore **exceed** ECC, not match it (MF-D).
+
+## Decision
+
+Add a pure stdlib tokenizer + decision function in a NEW module
+`.claude/hooks/_lib/git_bypass.py` (`scan_command(command) -> Optional[GitBypassMatch]`),
+consumed by the Tier-1 PreToolUse `check_bash_safety.py` hook, that blocks the
+git hook-bypass vectors below, and a NEW closed-enum audit action
+`git_hook_bypass_blocked` (the SPEC/kernel contract change this ADR authorizes).
+
+### Blocked vectors (exceeds ECC, MF-C / MF-D)
+
+1. `--no-verify` on the **6** subcommands `commit`/`push`/`merge`/
+   `cherry-pick`/`rebase`/`am`.
+2. `-n` (and combined short bundles `-nm` / `-nFm`) counts as `--no-verify`
+   **only for `commit`** (MF-B). For `push`, `-n` is `--dry-run` and **passes**.
+3. Inline `-c core.hooksPath=…` (case-insensitive key), incl. the glued
+   `-ccore.hooksPath=…` short form.
+4. `git config` **writes** to `core.hooksPath` — the split attack (a `--get`
+   read passes; a value, `--unset`/`--add`/`--replace-all` is a write).
+5. The `GIT_CONFIG_COUNT` + `GIT_CONFIG_KEY_<n>`=`core.hooksPath` env channel,
+   set via inline `VAR=value git …`, `env VAR=value git …`, or `export VAR=…`.
+6. `--git-dir=` / `-C <dir>` repo redirection **paired with** a hook-bearing
+   write subcommand (a plain `git -C ../other status` read passes — MF-F).
+7. `-c alias.X=<body>` whose body smuggles `--no-verify` / `core.hooksPath`.
+
+### Closed-enum audit action `git_hook_bypass_blocked` (MF-G)
+
+A NEW kernel-allowlisted action (`_KNOWN_ACTIONS`, 270 → 271) with a
+**dedicated** `emit_git_hook_bypass_blocked(...)` emitter routing through a
+**dedicated scrub branch + per-action field allowlist**
+(`_GIT_HOOK_BYPASS_BLOCKED_ALLOWLIST`). It **never** routes through
+`emit_generic`'s verbatim-passthrough set
+([[feedback-closed-enum-breadcrumb-must-not-echo-rejected-value]]). The ONLY
+caller-supplied field is `flag_class`, a member of a CLOSED set:
+
+```
+no_verify_commit · no_verify_other_subcmd · hookspath_inline ·
+hookspath_config_write · git_config_env_channel · git_dir_redirect ·
+alias_abuse · parse_failure · escape_hatch_used
+```
+
+The matched **command bytes are NEVER persisted** — a flag value such as
+`-c http.extraHeader="Bearer <secret>"` is a secret (MF-G). An unrecognized
+`flag_class` is **coerced to `parse_failure`** at the typed emitter AND again in
+the `emit_generic` dispatch branch (defense-in-depth — a direct `emit_generic`
+caller smuggling a raw command substring into `flag_class` cannot reach the
+signed HMAC chain). A test asserts no ≥8-char substring of a malicious command
+leaks into the emitted event. The closed set is mirrored as a literal frozenset
+in `audit_emit.py` (zero import-time dependency on the hook-side tokenizer); a
+test asserts the two frozensets are equal.
+
+### Dual-auth escape hatch (MF-E)
+
+The bypass is allowed only via the proven dual-auth pattern
+(`check_canonical_edit.py`, ADR-040-AMEND-2 §Layer-1) on a NEW dedicated env
+pair: `CEO_GIT_BYPASS_ALLOW` (a reason/ticket matching
+`^(ADR-\d{3,4}|PLAN-\d{3})-[a-z0-9-]{3,100}$`) **+** `CEO_GIT_BYPASS_ALLOW_ACK`
+== `I-ACCEPT`. **Both are read from the import-time `trusted_env` snapshot, NOT
+live `os.environ`** — a late-set value injected by a sub-agent / subprocess
+cannot grant the bypass. When the hatch is used the hook ALLOWs and emits
+`flag_class=escape_hatch_used`. Tested on-path (valid dual-auth allows) AND
+off-path (missing/invalid ACK or bad ticket still blocks; a live `os.environ`
+value absent from the snapshot does NOT grant).
+
+### Fail-closed parse mode (MF-L)
+
+An unparseable command that **clearly invokes git** is treated as a potential
+bypass → **fail-CLOSED BLOCK** (`flag_class=parse_failure`). The fail-closed is
+**bounded** so a tokenizer/infra bug cannot brick the whole session: a command
+that does NOT clearly invoke git (e.g. an `awk` one-liner with an unbalanced
+quote) passes through untouched. A tokenizer exception inside the hook fails
+**OPEN** per the §5 hook contract — only the deliberate `parse_failure` path of
+the pure detector is fail-closed.
+
+## Consequences
+
+- A new SPEC row (`audit-log.schema.md`, schema note **v2.38**) documents
+  `git_hook_bypass_blocked` and its closed `flag_class` enum; the version note
+  is bumped consistently with the S202 PLAN-125 `tool_call_lifecycle_recorded`
+  precedent (v2.37 → v2.38).
+- `check_bash_safety.py` (Tier-1, ADR-139:63) gains a new decision branch that
+  runs BEFORE the destructive matchers; the new branches in `git_bypass.py` +
+  `check_bash_safety.py` are branch-complete tested to meet the **86%** Tier-1
+  enforcing floor.
+- No new always-loaded context surface and no new hot-path subprocess: the
+  tokenizer is pure stdlib invoked inline in the existing PreToolUse hook.
+- The dual-auth hatch makes a legitimate, audited bypass possible without
+  weakening the default-block posture.
+
+## MIT attribution (MF / open question 5)
+
+The `--no-verify` tokenizer **idea** is credited to `affaan-m/ECC`
+`scripts/hooks/block-no-verify.js` (MIT, v2.0.0-rc.1). This is a clean-room
+stdlib-Python re-implementation — no vendored JavaScript — that **exceeds** the
+original (env channel, `git config` split-attack write, `--git-dir`/`-C`/alias
+coverage, the dual-auth escape hatch, the closed-enum tamper-evident audit
+action, and the bounded fail-closed parse mode). The MIT license of ECC permits
+this re-implementation with attribution.
+
+## Alternatives considered
+
+- **Match ECC 1:1 (the 6 subcommands + inline `-c` only):** rejected — leaves
+  the env channel + split-attack write + redirect/alias smuggle open, which
+  would re-create the exact ECC overclaim anti-pattern PLAN-124 rejects.
+- **Block ALL `git config` edits / ALL `-C` redirects:** rejected — too much
+  friction; a `git config --get core.hooksPath` read and a `git -C ../x status`
+  read are legitimate and MUST pass (MF-F regression corpus).
+- **A single-env-var (no-ACK) escape hatch:** rejected — the proven dual-auth
+  (reason/ticket + `_ACK=I-ACCEPT` + import-time snapshot) is the established
+  trust-root contract (ADR-040-AMEND-2); a weaker hatch would be the new
+  weakest link.

package/.claude/adr/ADR-144-subagent-model-tiering-frontmatter.md

@@ -0,0 +1,111 @@
+---
+id: ADR-144
+title: Subagent model tiering via per-agent frontmatter — global CLAUDE_CODE_SUBAGENT_MODEL override prohibited
+status: ACCEPTED
+enforcement_commit: c2285999
+decision_date: 2026-06-08
+proposing_session: S218
+authorization: "PLAN-128-FOLLOWUP — Codex pair-rail 019ea463 (design) + 019ea473 (applied diff) ACCEPT-WITH-FIXES + Wave-A debate (llm-finops/security/qa). Fix already SHIPPED Owner-GPG c2285999 + closeout 9c87dea5; this ADR is the not-silent, intent-level codification of the doctrine the fix enforces mechanically. Reinforces ADR-052 per-role dispatch."
+owner: llm-finops-architect
+plan: PLAN-128-sota-solo-accelerator
+amends: none
+related: [ADR-052, ADR-064, ADR-139]
+---
+
+# ADR-144 — Subagent model tiering via per-agent frontmatter
+
+**Status:** ACCEPTED (S218, 2026-06-08) — the decision is live; settings/template/
+installer already enforce it and the regression test guards it.
+**Enforcement commit:** `c2285999` (fix) + `9c87dea5` (closeout) — `.claude/settings.json`
++ `templates/settings/settings.base.json` + `.claude/hooks/route.py` +
+`scripts/install-accelerators.sh` + `.claude/hooks/tests/test_subagent_model_override_removed.py`
+**Blast radius:** L3 (governance-rite integrity + cost doctrine; a settings/template
+contract constraint enforced by a Tier-bypass regression test)
+**Supersedes:** none
+**Superseded by:** none
+**Depends on:** ADR-052 (multi-model dispatch by role — the per-agent `model:`
+frontmatter mechanism this ADR makes the *sole* tiering channel); ADR-064
+(llm-routing/FinOps)
+
+## Context
+
+ADR-052 established per-role model dispatch: each agent definition in
+`.claude/agents/*.md` declares its own `model:` frontmatter (code-reviewer /
+security-engineer / identity-trust / incident-commander / threat-detection =
+opus; llm-finops / performance / qa-architect = sonnet; devops = haiku).
+
+At S206 (PLAN-128 Wave-1, Owner-GPG `c9504982`) the env var
+`CLAUDE_CODE_SUBAGENT_MODEL=haiku` was wired **globally** into
+`.claude/settings.json`, the adopter template `templates/settings/settings.base.json`,
+`route.py`'s documented `SETTINGS_DELTA`, and propagated to app repos by
+`scripts/install-accelerators.sh` — intending "cheap Explore/read helpers."
+
+But that env var is **documented** (https://code.claude.com/docs/en/model-config)
+to *override* the per-invocation `model` parameter **and** the subagent
+definition's `model:` frontmatter; `inherit` restores normal resolution. So the
+global `haiku` **flattened the entire ADR-052 tier to haiku** for ~11 sessions
+(S206→S217): the framework's own VETO rites (code-review, security) ran on a
+weaker model than declared, and in 3 adopter lab repos the Owner's deliberately
+sonnet/opus subagents ran haiku too — silent degradation discovered at S218 only
+via the turbo banner showing `model=haiku`. (Codex, an external GPT-5-codex CLI,
+was unaffected — which mechanically explains why the cross-model pair-rail kept
+catching what the [haiku] debate missed.) No test asserted the env value, which
+is why it shipped and ran unnoticed; the existing template/dogfood parity test
+diffs only HOOK tuples, not `env`.
+
+## Decision
+
+**Subagent model tier is declared EXCLUSIVELY via per-agent `model:` frontmatter
+(the ADR-052 mechanism). A global `CLAUDE_CODE_SUBAGENT_MODEL` model-pin is
+PROHIBITED in framework `settings.json`, the adopter template, and anything the
+installers write.** The key, where present, MUST be `inherit` (normal resolution:
+explicit `model:` honored; omitted → main-loop model).
+
+- "Cheap" is **opt-in per helper** — set `model:` in the agent's frontmatter
+  (e.g. `devops`, or an Explore/search agent), or pass `model` at spawn time —
+  never a global override.
+- `scripts/install-accelerators.sh` FORCES `inherit` into an adopter's env
+  (corrective: re-running repairs a previously poisoned app) and announces the
+  reset rather than silently propagating the framework's value.
+- Enforcement is mechanical: `.claude/hooks/tests/test_subagent_model_override_removed.py`
+  asserts both settings files are `inherit` (+ env-parity, since the hook-parity
+  test does not cover `env`), the `route.py` doctrine, that strong rites' frontmatter
+  is not haiku, and that the installer forces `inherit` and never propagates/hardcodes
+  a global value.
+
+## Consequences
+
+- Governance VETO rites run their declared opus/sonnet models again; adopter model
+  intent is honored. Cost rises modestly (~$1–3/session of restored opus/sonnet
+  subagent spend) — accepted: a VETO rite's correctness dominates its token cost,
+  and the FinOps lever stays available per-agent.
+- Any pre-S218 §7 A/B "ON" arm is confounded (cheap-model forcing was bundled with
+  the accelerators, not isolated) — a clean multiplier needs a re-run.
+- The doctrine is intent-level: a future contributor (or a future session's Claude)
+  cannot re-introduce the global override without explicitly **superseding** this
+  ADR, and the regression test blocks it at CI. Two-layer guard (test + ADR).
+- **S220 nuance — per-call override is inert for Workflow subagents:** with the env
+  at `inherit`, a Workflow-tool `agent({model:'haiku'})` per-call override ALSO does
+  not take effect — `inherit` dominates and `opts.model` is silently ignored. So
+  model tiering for WORKFLOW subagents is NOT achievable today: the only levers that
+  change a subagent's tier are env/settings (`CLAUDE_CODE_SUBAGENT_MODEL`, which this
+  ADR pins to `inherit`) and the per-AGENT-definition `model:` frontmatter. This
+  qualifies the Decision's "or pass `model` at spawn time" — that path works for
+  agent-definition dispatch but is a no-op via the Workflow `agent()` tool. No
+  re-pin is warranted (it would re-introduce the prohibited global flatten); the
+  per-agent `model:` frontmatter remains the sole working tiering channel.
+
+## Alternatives considered
+
+- **Keep the global `haiku` override (status quo pre-S218):** rejected — it is
+  documented to beat explicit `model:` and silently degrades governance rites +
+  adopter work; the whole defect.
+- **Swap the global pin to a `sonnet` minimum:** rejected — still a *global*
+  override that beats explicit `model:`; same class of bug, just a different
+  silent value. Per-agent frontmatter is the only channel that respects intent.
+- **Rely on the regression test alone, no ADR:** rejected — the test blocks the
+  mechanism but not the *intent*; the ADR is the not-silent decision record so the
+  constraint survives a refactor that rewrites the test.
+- **Set `CLAUDE_CODE_SUBAGENT_MODEL=inherit` explicitly vs delete the key:**
+  chose `inherit` — it is self-documenting and corrective (re-running the installer
+  overwrites a poisoned `haiku` back to `inherit`), whereas an absent key is silent.

package/.claude/adr/ADR-145-cross-model-review-persona-demand-modality.md

@@ -0,0 +1,103 @@
+# ADR-145 — Cross-model Codex review as a recognized persona-demand satisfaction modality
+
+- **Status:** PROPOSED (PLAN-132, S221)
+- **Date:** 2026-06-08
+- **Deciders:** CEO + Wave-A debate (security-engineer / identity-trust-architect / qa-architect / code-reviewer / llm-finops-architect, 0 VETO) + Codex pair-rail
+- **Supersedes / Amends:** none (PLAN-104 shipped with no ADR under ADR-124 §Part 2 hotfix scope; this is the first ADR over the persona-demand ledger doctrine)
+
+## Context
+
+The `/ceo-boot` 19th Tier-S check `persona_atrophy_7d` (PLAN-104 demand ledger)
+opens a `branch_ahead -> code-reviewer` demand whenever a non-trunk branch is
+ahead of `origin/main`, and marks it satisfied only when a NATIVE
+`code-reviewer` `agent_spawn` fires within 24h. On the meta-repo the canonical
+review path is a Codex pair-rail call (`mcp__codex__codex`, an MCP tool that
+emits NO `agent_spawn`), so a genuine cross-model review can never satisfy the
+demand by construction — a STRUCTURAL false-RED that recurs on every PR-branch
+session (S210/S211/S214/S218/S219). A detector that cries wolf trains the
+operator to ignore the channel.
+
+## Decision
+
+Recognize a branch-bound, in-window cross-model Codex review as a satisfaction
+modality for `code-reviewer` demands **ONLY**, recorded as a distinct
+closed-enum `match_modality = "codex_review"` on `persona_demand_matched`.
+
+1. **Observability (Component A).** The existing `check_codex_response.py`
+   PostToolUse hook (matcher `mcp__codex__codex|mcp__codex__codex-reply`) is
+   extended to emit `codex_review_invoked` when the call is REVIEW-shaped. The
+   review-intent gate requires BOTH a review verb AND a diff/code artifact, and
+   suppresses generation-shaped prompts (R2). It is biased to under-emission: a
+   missed real review only preserves the advisory false-RED (status quo, safe),
+   whereas a false match would silently GREEN the detector (unsafe). No new hook
+   file is added (no hook-count / settings / parity cascade).
+
+2. **Branch-binding (R1).** The emitted event carries `target_ref_hash =
+   sha256(NFKC("branch:" + current_branch))[:12]`, IDENTICAL to
+   `persona_demand_scan._target_ref_hash`. The resolver match requires
+   `review.target_ref_hash == demand.target_ref_hash`, so a review of branch A
+   cannot satisfy branch B's demand. An unresolvable branch (detached HEAD,
+   trunk, git failure) yields an empty hash and the resolver FAILS CLOSED (no
+   match). This keeps the match path no weaker than the ledger's own waive path,
+   which already enforces branch reachability.
+
+3. **Provenance / anti-blur (Component B).** The resolver emits
+   `persona_demand_matched` with `match_modality = "codex_review"` and
+   `actual_persona = "code-reviewer"`, so the published SPEC v1 invariant
+   `actual_persona == expected_persona` STILL HOLDS — we do NOT poison
+   `actual_persona` with a non-persona sentinel. The modality is a dedicated
+   closed enum `{native_spawn, codex_review}` (default `native_spawn` for the
+   legacy path, byte-stable for existing chains).
+
+4. **Source discrimination.** Only `review_source` in
+   `{adhoc_mcp, user_code_auto}` with a non-empty `target_ref_hash` can satisfy
+   a demand. A `phase_gate` review (per-plan-phase review from
+   `check_pair_rail`) is EXCLUDED — it belongs to a different workflow and
+   carries no branch binding.
+
+## Scope (NON-EXTENSIBLE)
+
+The `codex_review` modality is recognized for `code-reviewer` demands ONLY. The
+other three demand types — `security-engineer`, `qa-architect`,
+`threat-detection-engineer` — keep strict native-spawn match: a generalist
+cross-model code review is a legitimate substitute for code REVIEW but NOT for a
+security VETO, a QA test-adequacy gate, or SIEM detection coverage. The
+relaxation is a single hard-coded literal guard (`expected_persona ==
+"code-reviewer"`) in `persona_demand_resolver.py`, NOT a config toggle, so
+widening to any other persona requires a CODE change AND a fresh ADR (R3
+doctrine-creep closure).
+
+## Consequences
+
+- The recurrent structural false-RED is fixed prospectively: a branch reviewed
+  via Codex within its 24h window now reads as matched (modality=codex_review),
+  green. A review arriving AFTER the window legitimately stays unmet (the demand
+  really was unreviewed for 24h — doctrine-consistent with the native path).
+- The check stays advisory / never-blocks; kill-switches
+  `CEO_PERSONA_DEMAND_LEDGER_DISABLED=1` (whole ledger) and
+  `CEO_CODEX_REVIEW_OBSERVE=0` (Component A emit) remain authoritative.
+- SPEC v1 audit-log schema bumped to v2.40 (no new actions; new fields
+  `review_source` + `target_ref_hash` on `codex_review_invoked`, `match_modality`
+  on `persona_demand_matched`).
+
+## Residual risks (accepted; surfaced by the Codex pair-rail review)
+
+- **Branch checkout assumption (Codex P1 #2):** branch-binding uses the
+  CURRENTLY-CHECKED-OUT branch, not the artifact actually reviewed. Two sub-cases:
+  (a) reviewing a branch from a `main` checkout yields an empty hash ->
+  fail-closed -> false-RED preserved (safe); (b) while on branch A (with an open
+  demand) pasting a diff for branch B emits branch A's hash and can mark A
+  "reviewed" though B was the artifact -> a false-GREEN for A. Case (b) requires
+  a deliberate, anomalous operator action on a single-operator advisory signal,
+  and there is no trustworthy signal in the event to recover the reviewed
+  branch from a pasted diff. Accepted; the normal flow (review the checked-out
+  branch) is correct. Re-open if multi-branch pasted-diff review becomes common.
+- **Review completing just after the window (Codex P2 #1):** the event `ts` is
+  stamped at write time (PostToolUse, after Codex returns). A review STARTED
+  in-window but completing just after `window_end` is missed -> false-RED
+  preserved. This is the SAFE direction (under-emission), consistent with the
+  plan's high-precision bias; not fixed.
+- **A3 (user_code_auto) inert until bound:** `codex_review_user_code.py` still
+  emits `codex_review_invoked` for its own §7 telemetry but WITHOUT a
+  `target_ref_hash`, so it cannot satisfy a demand (fail-closed). Wiring A3
+  branch-binding is a tracked follow-up, not required for this fix.