claude-dev-env 2.35.0 → 4.0.0

package/.agents/skills/_shared/advisor/scripts/README.md

@@ -4,7 +4,7 @@
 
 @~/.claude/_shared/advisor/scripts/model_tier_run_validator.py
 
-@~/.claude/_shared/advisor/scripts/codex_sol_advisor.py
+@~/.claude/_shared/advisor/scripts/codex_astra_advisor.py
 
 @~/.claude/_shared/advisor/scripts/tier_model_ids.py
 

package/.agents/skills/autoconverge/SKILL.md

@@ -59,8 +59,10 @@ python "$HOME/.claude/skills/_shared/pr-loop/scripts/select_converge_pacer.py" \
   [`../_shared/pr-loop/portable-driver.md`](../_shared/pr-loop/portable-driver.md).
   **Do not abort** because the Workflow tool is missing.
 
-Transport still needs authenticated GitHub access for the PR's owner (`gh` or
-`pr-loop-cloud-transport`).
+Set the GitHub transport directive before any GitHub step. Use `transport: "cloud"` in a
+Cloud session. Use `transport: "local"` in a local session. Cloud uses the
+connected GitHub MCP tools and never starts a local GitHub CLI authentication
+flow.
 
 ## Review-lens boundary
 
@@ -68,18 +70,19 @@ The code-review lens boundary (workflow agent versus the built-in `/code-review`
 command) is defined on the **Code-review lens** bullet in
 [`reference/convergence.md`](reference/convergence.md).
 
-## Transport check (before any GitHub step)
+## Select the GitHub transport directive before any GitHub step
 
-Run `command -v gh`; when it succeeds, run `gh auth status`; once the PR
-scope is resolved, run `gh api repos/<owner>/<repo> --jq .permissions.push`
-and take `true` as the pass. When any check fails, run the
-`pr-loop-cloud-transport` skill first and route every `gh` operation in this
-skill through its substitution matrix. The workflow script
-(`workflow/converge.mjs`) embeds `gh` commands and gh-backed helper scripts in
-its agent prompts, so a cloud run also applies the same substitution to those
-agent prompts when it authors the launch — the transport skill covers the
-orchestrating session's own steps, and the script's agent-prompt text carries
-`gh` calls the spawned agents cannot run in a cloud session.
+In a Cloud session, set `transport: "cloud"` and load the GitHub MCP schemas
+before the first GitHub tool call. Do not run any local GitHub CLI
+authentication, account-switch, or token command. Use the operation in
+[`cloud-pr-loop-compatibility.md`](../../../docs/references/cloud-pr-loop-compatibility.md)
+for each GitHub read or write. Use the Cloud session's credentialed push path
+for local commits. If that path rejects a push, report the exact error instead
+of trying to log in through the local CLI.
+
+In a local session, set `transport: "local"` and use the authenticated local
+GitHub CLI. The workflow defaults to this value when older callers omit the
+field.
 
 ## Pre-flight (main session)
 
@@ -161,7 +164,7 @@ orchestrating session's own steps, and the script's agent-prompt text carries
 ```
 Workflow({
   scriptPath: "<this skill dir>/workflow/converge.mjs",
-  args: { owner: "<O>", repo: "<R>", prNumber: <N>, bugbotDisabled: false, copilotDisabled: false, homeDirectory: "<HOME>" }
+  args: { owner: "<O>", repo: "<R>", prNumber: <N>, bugbotDisabled: false, copilotDisabled: false, homeDirectory: "<HOME>", transport: "<cloud|local>" }
 })
 ```
 
@@ -173,7 +176,8 @@ the absolute path to the directory that holds `.claude` (resolve it once from
 runs in a sandbox with no access to environment variables, so the run reads the
 home directory from this arg to build the path to the codex-review scripts the
 Codex gate calls; leave it out and the Codex gate cannot find those scripts. Set
-`bugbotDisabled: true` only when the user has opted Cursor Bugbot out for the
+`transport: "cloud"` for Cloud and `transport: "local"` for local execution.
+Set `bugbotDisabled: true` only when the user has opted Cursor Bugbot out for the
 run; otherwise the workflow detects an opt-out or an unreachable Bugbot on its
 own. Set `copilotDisabled: true` when the step 5 quota pre-check exits non-zero,
 and `false` when it exits 0; on `true` the workflow skips the Copilot gate with

package/.agents/skills/autoconverge/reference/gotchas.md

@@ -46,9 +46,9 @@ fails in a new way.
   not `~/.claude/...`; a tilde resolves to the wrong home and gives a
   file-not-found error that looks like a script failure.
 
-- **`gh` token drift across accounts.** When a run touches more than one GitHub
-  account, pin the token with `--user <login>`; `gh auth token` alone can return
-  another account's token after a switch.
+- **Local identity drift across accounts.** A local run that touches more than
+  one GitHub account must use the selected local account. Cloud runs use the
+  connected GitHub MCP identity and never use local CLI identity commands.
 
 - **Commit or push fails after a repair.** Read the hook or command output,
   repair the named issue, and record the rerun. Apply the

package/.agents/skills/autoconverge/reference/multi-pr.md

@@ -73,6 +73,7 @@ Workflow({
   args: {
     convergeScriptPath: "<this skill dir>/workflow/converge.mjs",
     homeDirectory: "<HOME>",
+    transport: "<cloud|local>",
     prs: [
       { owner: "<O>", repo: "<R>", prNumber: <N1>, repoPath: "<abs worktree 1>", bugbotDisabled: false, copilotDisabled: false },
       { owner: "<O>", repo: "<R>", prNumber: <N2>, repoPath: "<abs worktree 2>", bugbotDisabled: false, copilotDisabled: false }
@@ -87,8 +88,11 @@ checked out in. `homeDirectory` is the absolute path to the directory that holds
 `.claude` (resolve it once from `$HOME`, or `$env:USERPROFILE` on Windows, with
 forward slashes); the fan-out forwards it to every child run, which needs it to
 build the codex-review scripts path because the workflow sandbox has no access to
-environment variables. The workflow runs in the background and notifies the session on
-completion; watch live progress with `/workflows`, where each PR's child run
+environment variables. Set `transport: "cloud"` in a Cloud session and
+`transport: "local"` in a local session. Cloud uses the connected GitHub MCP
+tools and skips local CLI authentication. The workflow runs in the background
+and notifies the session on completion; watch live progress with `/workflows`,
+where each PR's child run
 appears under its own group.
 
 The workflow returns

package/.agents/skills/autoconverge/workflow/converge.contract.test.mjs

@@ -32,6 +32,17 @@ test('review tasks use code-quality-agent and keep the working tree read-only',
   assert.match(reviewTaskSource, /Make no edit to the tree under verification/)
 })
 
+test('workflow agents receive the selected GitHub transport before role instructions', () => {
+  assert.match(
+    workflowSource,
+    /HEADLESS_EDIT_PREAMBLE\}\$\{githubTransportDirective\(activeGithubTransport\)\}\$\{worktreeDirective/,
+  )
+  assert.match(
+    workflowSource,
+    /HEADLESS_READONLY_PREAMBLE\}\$\{githubTransportDirective\(activeGithubTransport\)\}\$\{worktreeDirective/,
+  )
+})
+
 test('review result parser accepts one standalone terminal disposition only', () => {
   const parseReviewResult = loadReviewResultParser()
 

package/.agents/skills/autoconverge/workflow/converge.mjs

@@ -91,6 +91,7 @@ const HEADLESS_READONLY_PREAMBLE = HEADLESS_EDIT_PREAMBLE.replace(
 )
 
 let activeRepoPath = null
+let activeGithubTransport = 'local'
 
 /**
  * Build the per-agent worktree directive for a path-scoped run.
@@ -111,33 +112,11 @@ const worktreeDirective = (repoPath) =>
     ? `WORKTREE — this PR is checked out at ${repoPath}. Unless a step explicitly names a different repository directory (for example an environment-hardening repo checkout, which you cd into exactly as that step directs), run every git, gh, diff, edit, commit, push, and test command for this PR in that worktree: cd "${repoPath}" before any such command, and resolve repository roots from there.\n\n`
     : ''
 
-/**
- * Spawn a workflow agent that edits code, with the full edit preamble prepended
- * to its prompt. An edit agent may run rm during cleanup, so it inherits the
- * rm-shape rules alongside the no-confirmation-prompt guidance. On a path-scoped
- * run the worktree directive is prepended too, so the agent runs in the PR's own
- * worktree (activeRepoPath); on a single-PR run that directive is empty and the
- * agent keeps its own working directory. A read-only agent (a review, verify, or
- * utility spawn) routes through convergeReadOnlyAgent for the trimmed preamble.
- * @param {string} prompt the agent's role-specific instruction body
- * @param {object} options the agent() options (label, phase, schema, agentType, model)
- * @returns {Promise<*>} the agent() result
- */
 const convergeAgent = (prompt, options) =>
-  agent(`${HEADLESS_EDIT_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
+  agent(`${HEADLESS_EDIT_PREAMBLE}${githubTransportDirective(activeGithubTransport)}${worktreeDirective(activeRepoPath)}${prompt}`, options)
 
-/**
- * Spawn a read-only workflow agent with the trimmed read-only preamble prepended
- * to its prompt. A review, verify, or utility agent edits nothing and never runs
- * rm, so it receives the read-only preamble that drops the rm-shape-rules bullet.
- * The worktree directive is prepended on a path-scoped run exactly as for
- * convergeAgent, so a read-only agent still runs in the PR's own worktree.
- * @param {string} prompt the agent's role-specific instruction body
- * @param {object} options the agent() options (label, phase, schema, agentType, model)
- * @returns {Promise<*>} the agent() result
- */
 const convergeReadOnlyAgent = (prompt, options) =>
-  agent(`${HEADLESS_READONLY_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
+  agent(`${HEADLESS_READONLY_PREAMBLE}${githubTransportDirective(activeGithubTransport)}${worktreeDirective(activeRepoPath)}${prompt}`, options)
 
 /**
  * Spawn a fresh git-utility Explore agent for a specific task. The one task,
@@ -1627,19 +1606,32 @@ function normalizeRunInput(rawArgs) {
   }
 }
 
-/**
- * Validate the normalized run input into either usable coordinates or a
- * structured blocker. The run cannot build a single GitHub call without owner,
- * repo, and prNumber, so a null payload (failed parse or missing args) or a
- * payload missing any coordinate yields a blocker the top-level run reports as
- * {converged:false, blocker} rather than throwing on input.owner at startup.
- * @param {string|object} rawArgs the workflow args global (JSON string or object)
- * @returns {{input: object|null, blocker: string|null}} usable coordinates or a blocker
- */
+const DEFAULT_GITHUB_TRANSPORT = 'local'
+const GITHUB_TRANSPORT_DIRECTIVES = {
+  local:
+    'LOCAL GITHUB TRANSPORT DIRECTIVE. Use the authenticated local GitHub CLI for GitHub operations. Report local authentication or permission failures directly.\n\n',
+  cloud:
+    'CLOUD GITHUB TRANSPORT DIRECTIVE. Use the connected GitHub MCP tools for every GitHub API read and write. Load the GitHub MCP schemas before the first MCP call and resolve the connected identity with mcp__github__get_me. Do not invoke a local GitHub CLI for authentication, account switching, token lookup, pull-request operations, review operations, or push setup. Replace local CLI steps in this prompt with the matching operation in docs/references/cloud-pr-loop-compatibility.md. For a local commit push, use only the credentialed push path supplied by the Cloud session. If no credentialed path is available, return a named blocker instead of attempting a login.\n\n',
+}
+const VALID_GITHUB_TRANSPORTS = new Set(Object.keys(GITHUB_TRANSPORT_DIRECTIVES))
+
+function githubTransportDirective(transport) {
+  return GITHUB_TRANSPORT_DIRECTIVES[transport] || GITHUB_TRANSPORT_DIRECTIVES[DEFAULT_GITHUB_TRANSPORT]
+}
+
 function classifyRunInput(rawArgs) {
   const candidate = normalizeRunInput(rawArgs)
   const hasUsableCoordinates =
     candidate != null && candidate.owner && candidate.repo && candidate.prNumber
+  const hasValidTransport =
+    candidate != null &&
+    (candidate.transport === undefined || VALID_GITHUB_TRANSPORTS.has(candidate.transport))
+  if (hasUsableCoordinates && !hasValidTransport) {
+    return {
+      input: null,
+      blocker: 'invalid run transport: expected "local" or "cloud"',
+    }
+  }
   if (hasUsableCoordinates) return { input: candidate, blocker: null }
   return {
     input: null,
@@ -1654,6 +1646,7 @@ if (runInput.blocker) {
 }
 const input = runInput.input
 activeRepoPath = typeof input.repoPath === 'string' && input.repoPath ? input.repoPath : null
+activeGithubTransport = input.transport === undefined ? DEFAULT_GITHUB_TRANSPORT : input.transport
 const prCoordinates = `owner=${input.owner} repo=${input.repo} PR #${input.prNumber} (https://github.com/${input.owner}/${input.repo}/pull/${input.prNumber})`
 
 /**

package/.agents/skills/autoconverge/workflow/converge.run-input.test.mjs

@@ -17,10 +17,10 @@ function sourceSliceBetween(startNeedle, endNeedle) {
 
 const productionModule = new Function(
   `${sourceSliceBetween('function normalizeRunInput(', '\nconst runInput =')}\n` +
-    'return { normalizeRunInput, classifyRunInput };',
+    'return { normalizeRunInput, classifyRunInput, githubTransportDirective };',
 )();
 
-const { normalizeRunInput, classifyRunInput } = productionModule;
+const { normalizeRunInput, classifyRunInput, githubTransportDirective } = productionModule;
 
 const VALID_COORDINATES = { owner: 'jl-cmd', repo: 'claude-dev-env', prNumber: 543 };
 
@@ -46,6 +46,19 @@ test('classifyRunInput accepts coordinates carrying owner, repo, and prNumber',
   assert.equal(classified.blocker, null);
 });
 
+test('classifyRunInput accepts the cloud transport without changing the input shape', () => {
+  const cloudInput = { ...VALID_COORDINATES, transport: 'cloud' };
+  const classified = classifyRunInput(cloudInput);
+  assert.deepEqual(classified.input, cloudInput);
+  assert.equal(classified.blocker, null);
+});
+
+test('classifyRunInput blocks an unknown transport before any GitHub work starts', () => {
+  const classified = classifyRunInput({ ...VALID_COORDINATES, transport: 'proxy' });
+  assert.equal(classified.input, null);
+  assert.match(classified.blocker, /transport/i);
+});
+
 test('classifyRunInput blocks a failed parse with a structured blocker and no input', () => {
   const classified = classifyRunInput('not json at all');
   assert.equal(classified.input, null);
@@ -90,3 +103,14 @@ test('classifyRunInput leaves copilotDisabled undefined when the input omits it'
   const classified = classifyRunInput(VALID_COORDINATES);
   assert.equal(classified.input.copilotDisabled, undefined);
 });
+
+test('the cloud transport directive selects MCP and contains no local CLI auth command', () => {
+  const cloudDirective = githubTransportDirective('cloud');
+  assert.match(cloudDirective, /mcp__github__/);
+  assert.match(cloudDirective, /credentialed push path/);
+  assert.doesNotMatch(cloudDirective, /gh auth/);
+});
+
+test('the local transport directive keeps the local CLI path', () => {
+  assert.match(githubTransportDirective('local'), /authenticated local GitHub CLI/);
+});

package/.agents/skills/autoconverge/workflow/converge_multi.mjs

@@ -57,18 +57,9 @@ function isUsablePrEntry(prEntry) {
   )
 }
 
-/**
- * Validate the normalized multi-PR input into usable coordinates or a blocker.
- *
- * A fan-out run needs the absolute converge.mjs script path and a non-empty list
- * of PR entries that each carry owner, repo, prNumber, and the absolute worktree
- * path the PR is checked out in. A payload that fails to parse, a non-string
- * convergeScriptPath, a missing or empty prs list, or any entry missing a
- * coordinate yields a blocker the top-level run reports as
- * {converged:false, blocker} rather than throwing on a missing field.
- * @param {string|object} rawArgs the workflow args global (JSON string or object)
- * @returns {{input: object|null, blocker: string|null}} usable coordinates or a blocker
- */
+const DEFAULT_GITHUB_TRANSPORT = 'local'
+const VALID_GITHUB_TRANSPORTS = new Set(['local', 'cloud'])
+
 function classifyMultiInput(rawArgs) {
   const candidate = normalizeMultiInput(rawArgs)
   if (candidate == null) {
@@ -84,6 +75,12 @@ function classifyMultiInput(rawArgs) {
         'invalid run coordinates: convergeScriptPath (absolute path to converge.mjs) is required',
     }
   }
+  if (candidate.transport !== undefined && !VALID_GITHUB_TRANSPORTS.has(candidate.transport)) {
+    return {
+      input: null,
+      blocker: 'invalid run transport: expected "local" or "cloud"',
+    }
+  }
   if (!Array.isArray(candidate.prs) || candidate.prs.length === 0) {
     return {
       input: null,
@@ -102,21 +99,7 @@ function classifyMultiInput(rawArgs) {
   return { input: candidate, blocker: null }
 }
 
-/**
- * Build the converge.mjs child-run args for one validated PR entry.
- *
- * Every per-run opt-out the child converge.mjs reads is forwarded here so the
- * fan-out honors it: bugbotDisabled skips the Bugbot phase, and copilotDisabled
- * short-circuits the Copilot quota gate when the account is out of premium
- * requests. An entry that omits an opt-out defaults it to false so the child
- * runs that phase. homeDirectory is a run-level value forwarded to every child
- * so the child can build its codex-review scripts path: the workflow sandbox
- * exposes no process global, so the child reads home from its args, not env.
- * @param {object} prEntry one validated element of the args.prs array
- * @param {string} homeDirectory the run-level home directory for every child
- * @returns {object} the args object passed to the converge.mjs child run
- */
-function childRunInput(prEntry, homeDirectory) {
+function childRunInput(prEntry, homeDirectory, transport = DEFAULT_GITHUB_TRANSPORT) {
   return {
     owner: prEntry.owner,
     repo: prEntry.repo,
@@ -125,6 +108,7 @@ function childRunInput(prEntry, homeDirectory) {
     bugbotDisabled: Boolean(prEntry.bugbotDisabled),
     copilotDisabled: Boolean(prEntry.copilotDisabled),
     homeDirectory,
+    transport,
   }
 }
 
@@ -141,7 +125,7 @@ const childResults = await parallel(
   input.prs.map((eachPr) => async () => {
     const childOutcome = await workflow(
       { scriptPath: input.convergeScriptPath },
-      childRunInput(eachPr, input.homeDirectory),
+      childRunInput(eachPr, input.homeDirectory, input.transport),
     )
     return {
       owner: eachPr.owner,

package/.agents/skills/autoconverge/workflow/converge_multi.run-input.test.mjs

@@ -68,6 +68,18 @@ test('valid coordinates classify with no blocker and keep every PR entry', () =>
   assert.equal(classified.input.prs.length, 2);
 });
 
+test('a cloud transport classifies with no blocker', () => {
+  const classified = classifyMultiInput({ ...validArgs(), transport: 'cloud' });
+  assert.equal(classified.blocker, null);
+  assert.equal(classified.input.transport, 'cloud');
+});
+
+test('an unknown transport is blocked before child workflows start', () => {
+  const classified = classifyMultiInput({ ...validArgs(), transport: 'proxy' });
+  assert.equal(classified.input, null);
+  assert.match(classified.blocker, /transport/i);
+});
+
 test('a missing convergeScriptPath is blocked', () => {
   const classified = classifyMultiInput({ prs: [validEntry(101)] });
   assert.equal(classified.input, null);
@@ -138,6 +150,10 @@ test('childRunInput defaults bugbotDisabled to false when the entry omits it', (
   assert.equal(childRunInput(validEntry(101)).bugbotDisabled, false);
 });
 
+test('childRunInput forwards the selected cloud transport', () => {
+  assert.equal(childRunInput(validEntry(101), '/home/dev', 'cloud').transport, 'cloud');
+});
+
 test('childRunInput forwards the run-level home directory to the child run', () => {
   const childArgs = childRunInput(validEntry(101), '/home/dev');
   assert.equal(childArgs.homeDirectory, '/home/dev');

package/.agents/skills/team-advisor/SKILL.md

@@ -16,23 +16,23 @@ One warm advisor at the strongest tier this session can reach. This session is t
 
 | Doc | Holds |
 |---|---|
-| [`docs/references/advisor-tool.md`](../../docs/references/advisor-tool.md) | **Consult cadence and weight** — when to call, hard rule before first write, how to treat advice. Read this for every consult. |
-| [`~/.claude/_shared/advisor/advisor-protocol.md`](../../_shared/advisor/advisor-protocol.md) | **Bind and lifecycle** — session identity, host detect, model floor, warm-up, CLI fallback; its read map routes each moment to a `reference/` detail file. |
-| [`agents/session-advisor.md`](../../agents/session-advisor.md) | **Reply contract** — ENDORSE / CORRECTION / PLAN / STOP; SendMessage only. |
-| [`reference/advisor-docs-review.md`](reference/advisor-docs-review.md) | Anthropic advisor-tool source facts: measured effects, Sonnet steering, cost levers, failure modes. Background — read it when tuning the bind, not on every consult. |
+| [`docs/references/advisor-tool.md`](../../docs/references/advisor-tool.md) | **Consult cadence and weight.** When to call, the hard rule before first write, and how to treat advice. Read this for every consult. |
+| [`~/.claude/_shared/advisor/advisor-protocol.md`](../../_shared/advisor/advisor-protocol.md) | **Bind and lifecycle.** Session identity, host detect, model floor, warm-up, CLI fallback. Its read map routes each moment to a `reference/` detail file. |
+| [`agents/session-advisor.md`](../../agents/session-advisor.md) | **Reply contract.** ENDORSE / CORRECTION / PLAN / STOP. SendMessage only. |
+| [`reference/advisor-docs-review.md`](reference/advisor-docs-review.md) | Anthropic advisor-tool source facts: measured effects, Sonnet steering, cost levers, failure modes. Background. Read it when tuning the bind, not on every consult. |
 
 ## Bind
 
 1. Name the session identity first (protocol **Host profiles**), then walk the model floor.
-2. Claude: Fable first in-session at `ADVISOR_EFFORT` (default low). When Fable is out of usage, bind Sol at the same effort. Codex: Sol in-session. Third-party: headless Fable then Sol. When the host's walk fails, fail closed.
-3. Name: `team-advisor-agent` on Claude (Agent spawn of `session-advisor`); a native Sol subagent on Codex; one CLI `session_id` on a third-party host via the protocol Claude-chain.
+2. Claude: Fable first in-session at `ADVISOR_EFFORT` (default low). When Fable is out of usage, bind Astra at the same effort. Codex: Astra in-session. Third-party: headless Fable then Astra. When the host's walk fails, fail closed.
+3. Name: `team-advisor-agent` on Claude (Agent spawn of `session-advisor`); a native Astra subagent on Codex; one CLI `session_id` on a third-party host via the protocol Claude-chain or Astra helper.
 4. A Fable-tier spawn or re-spawn carries the exact token `FABLE-SPAWN-AUTHORIZED` in its prompt (protocol warm-up; `fable_spawn_gate` requires it).
-5. Skip the multi-consumer "who you are" opener — sole consumer.
-6. When the bind or reply path fails, fail closed and report to the user. On a third-party host, only the bound Claude advisor issues ENDORSE / CORRECTION / PLAN / STOP.
+5. Skip the multi-consumer "who you are" opener. This session is the sole consumer.
+6. When the bind or reply path fails, fail closed and report to the user. On a third-party host, only the bound advisor issues ENDORSE / CORRECTION / PLAN / STOP.
 
-**GOTCHA (Cursor / ThirdParty + Sol):** when the walk reaches Sol or the user asks for Sol, first tool call is `python ~/.claude/_shared/advisor/scripts/codex_sol_advisor.py --bind --enable-sol --cwd <repo-root>` with the charter on stdin — not Agent/Task, not a probe-path search. Details: [`third-party-bind.md`](../../_shared/advisor/reference/third-party-bind.md) GOTCHA and [`sol-rung.md`](../../_shared/advisor/reference/sol-rung.md).
+**GOTCHA (Cursor / ThirdParty + Astra):** when the walk reaches Astra or the user asks for Astra, first tool call is `python ~/.claude/_shared/advisor/scripts/codex_astra_advisor.py --bind --enable-astra --cwd <repo-root>` with the charter on stdin. Do not use Agent or Task. Do not search for a probe path. Details: [`third-party-bind.md`](../../_shared/advisor/reference/third-party-bind.md) GOTCHA and [`astra-rung.md`](../../_shared/advisor/reference/astra-rung.md).
 
-Full walk, charter, consult packet, Sol routing, and drift re-bind live in the protocol read map and its authoritative `reference/` leaves.
+Full walk, charter, consult packet, Astra routing, and drift re-bind live in the protocol read map and its `reference/` files.
 
 ## Consult
 
@@ -44,6 +44,6 @@ Aim for two consults on a normal task: one after orientation and one after write
 
 ## Constraints
 
-- One bind per session; this session owns spawn, in-session Sol spawn, or CLI bind, drift re-bind, and shutdown.
+- One bind per session; this session owns spawn, in-session Astra spawn, or CLI bind, drift re-bind, and shutdown.
 - Bind at or above the protocol floor for this host.
 - The advisor only answers (messaging); the session runs tools and posts.

package/_shared/advisor/advisor-protocol.md

@@ -13,20 +13,20 @@ On Claude, continue with **Model floor** and the rest of this document.
 
 ## Read map
 
-The sections below hold the standing rules; open a reference file at the moment its row names.
+The sections below hold the standing rules. Open a reference file at the moment its row names.
 
 | Moment | Open |
 |---|---|
-| Naming the session identity | [`reference/identity.md`](reference/identity.md) — Claude, Codex, or neither |
-| Binding on a Claude host | [`reference/warm-up.md`](reference/warm-up.md) — spawn fields, Fable token, charter |
-| Binding on a Codex host | [`reference/identity.md`](reference/identity.md) — in-session Sol spawn |
-| Binding from a third-party host | [`reference/third-party-bind.md`](reference/third-party-bind.md) — CLI bind steps, fail-closed rule |
-| Fable is out of usage | [`reference/sol-rung.md`](reference/sol-rung.md) — Sol fallback at shared effort |
-| Composing a consult | [`reference/consult-format.md`](reference/consult-format.md) — packet, new-evidence and report-back rules |
-| Assembling an executor spawn prompt | [`reference/advisor-block.md`](reference/advisor-block.md) — the paste parts |
-| Advisor drifts, dies, or the task pivots | [`reference/lifecycle.md`](reference/lifecycle.md) — re-spawn and re-bind steps |
-| Logging or checking a bind walk | [`reference/spawn-walk-log.md`](reference/spawn-walk-log.md) — record shape, validator |
-| Any CLI call to a Claude advisor | [`reference/cli-chain.md`](reference/cli-chain.md) — runner modes, alias table, resume |
+| Naming the session identity | [`reference/identity.md`](reference/identity.md): Claude, Codex, or neither |
+| Binding on a Claude host | [`reference/warm-up.md`](reference/warm-up.md): spawn fields, Fable token, charter |
+| Binding on a Codex host | [`reference/identity.md`](reference/identity.md): in-session Astra spawn |
+| Binding from a third-party host | [`reference/third-party-bind.md`](reference/third-party-bind.md): CLI bind steps, fail-closed rule |
+| Fable is out of usage | [`reference/astra-rung.md`](reference/astra-rung.md): Astra fallback at shared effort |
+| Composing a consult | [`reference/consult-format.md`](reference/consult-format.md): packet, new-evidence and report-back rules |
+| Assembling an executor spawn prompt | [`reference/advisor-block.md`](reference/advisor-block.md): the paste parts |
+| Advisor drifts, dies, or the task pivots | [`reference/lifecycle.md`](reference/lifecycle.md): re-spawn and re-bind steps |
+| Logging or checking a bind walk | [`reference/spawn-walk-log.md`](reference/spawn-walk-log.md): record shape, validator |
+| Any CLI call to a Claude advisor | [`reference/cli-chain.md`](reference/cli-chain.md): runner modes, alias table, resume |
 
 ## Host profiles
 
@@ -42,95 +42,95 @@ Session identity:
 Mechanical override for scripts:
 
 1. `ADVISOR_HOST_PROFILE=ThirdParty` or `=Claude` or `=Codex` (explicit override; any letter case).
-2. `THIRD_PARTY=1` (or `true` / `yes` / `on`) — a third-party (non-Claude) harness.
+2. `THIRD_PARTY=1` (or `true` / `yes` / `on`) selects a third-party (non-Claude) harness.
 3. Default: Claude.
 
-### Shared effort — any host
+### Shared effort, any host
 
-Fable and Sol both read `ADVISOR_EFFORT` (`low`, `medium`, `high`, `xhigh`, `max`). The default is `low`.
-Pass `--effort <level>` on the Sol helper to set effort for that Sol run.
+Fable and Astra both read `ADVISOR_EFFORT` (`low`, `medium`, `high`, `xhigh`, `max`). The default is `low`.
+Pass `--effort <level>` on the Astra helper to set effort for that Astra run.
 Pass `--effort <level>` on the Claude CLI bind for Fable. An unset or unrecognized value uses `low`.
 
-### Sol rung
+### Astra rung
 
-On Claude and ThirdParty: when Fable is out of usage, bind Sol through the Codex helper.
-Open that attempt with `ADVISOR_SOL=1` (or `true` / `yes` / `on`) in the environment, or pass `--enable-sol` on the helper invocation.
+On Claude and ThirdParty: when Fable is out of usage, bind Astra through the Codex helper.
+Open that attempt with `ADVISOR_ASTRA=1` (or `true` / `yes` / `on`) in the environment, or pass `--enable-astra` on the helper invocation.
 Flag off both ways: fail closed when Fable did not bind.
-Flag on: run the Codex preflight and bind per [`reference/sol-rung.md`](reference/sol-rung.md); a failed preflight fails closed when Fable did not bind.
+Flag on: run the Codex preflight and bind per [`reference/astra-rung.md`](reference/astra-rung.md); a failed preflight fails closed when Fable did not bind.
 
-On Codex: Sol is the in-session default. The `ADVISOR_SOL` flag is not required. Fail closed when that spawn does not bind.
+On Codex: Astra is the in-session default. The `ADVISOR_ASTRA` flag is not required. Fail closed when that spawn does not bind.
 
 ### Claude host
 
-Use the **Model floor** ladder below (Fable first, then Sol when Fable is out of usage).
-Warm-up spawns `subagent_type: session-advisor` via the Agent tool; consults go through `SendMessage` to that warm agent.
+Use the **Model floor** ladder below (Fable first, then Astra when Fable is out of usage).
+Warm-up spawns `subagent_type: session-advisor` via the Agent tool for Fable; consults go through `SendMessage` to that warm agent. Astra uses the Codex helper.
 Assemble and paste each executor's Advisor block per the **Advisor block** section.
 
 ### Codex host
 
-Spawn a native in-session Sol subagent at `resolve_codex_model_id("Sol")`.
-Walk `candidate_tiers = ["Sol"]`. Record `{tier: "Sol", result: "spawned"}` on success.
-**Fail closed:** when Sol does not bind, set `selected_tier = null` and a `fallback_reason`, report that the advisor is unreachable, and **stop**.
-Do not walk Fable on a Codex host. Consults stay in-session with that Sol subagent.
+Spawn a native in-session Astra subagent at `resolve_codex_model_id("Astra")`.
+Walk `candidate_tiers = ["Astra"]`. Record `{tier: "Astra", result: "spawned"}` on success.
+**Fail closed:** when Astra does not bind, set `selected_tier = null` and a `fallback_reason`, report that the advisor is unreachable, and **stop**.
+Do not walk Fable on a Codex host. Consults stay in-session with that Astra subagent.
 Assemble and paste each executor's Advisor block per the **Advisor block** section.
 
 ### Third-party host
 
 On a third-party (non-Claude, non-Codex) harness, the shared CLI Claude-chain is the one path to a Claude advisor: bind Fable through it, per [`reference/third-party-bind.md`](reference/third-party-bind.md).
 The bound Claude session is the advisor; this third-party session stays the executor.
-Walk `candidate_tiers = ["Fable"]`. When Fable is out of usage, the sol rung binds after Fable (`candidate_tiers = ["Fable", "Sol"]`).
-**Cursor Sol first shot:** when the walk reaches Sol (or the user asks for Sol), bind through `codex_sol_advisor.py --bind --enable-sol` on the first tool call (see the GOTCHA in [`reference/third-party-bind.md`](reference/third-party-bind.md)) — not the Agent tool, and not a probe-path hunt.
-**Fail closed:** when every candidate fails, set `selected_tier = null` and a `fallback_reason`, report that the advisor is unreachable, and **stop** — ENDORSE / CORRECTION / PLAN / STOP come only from a bound advisor.
+Walk `candidate_tiers = ["Fable"]`. When Fable is out of usage, the Astra rung binds after Fable (`candidate_tiers = ["Fable", "Astra"]`).
+**Cursor Astra first shot:** when the walk reaches Astra (or the user asks for Astra), bind through `codex_astra_advisor.py --bind --enable-astra` on the first tool call (see the GOTCHA in [`reference/third-party-bind.md`](reference/third-party-bind.md)). Do not use the Agent tool, and do not hunt a probe path.
+**Fail closed:** when every candidate fails, set `selected_tier = null` and a `fallback_reason`, report that the advisor is unreachable, and **stop**. ENDORSE / CORRECTION / PLAN / STOP come only from a bound advisor.
 Executors report to the orchestrating session; that session consults the bound advisor and relays the four-signal reply.
 
 ## Model floor
 
-On Claude and ThirdParty the advisor ladder is `Fable` first, then sol (flag-gated, Codex CLI) when Fable is out of usage.
-On Codex the walk is Sol only, in-session.
+On Claude and ThirdParty the advisor ladder is `Fable` first, then Astra (flag-gated, Codex CLI) when Fable is out of usage.
+On Codex the walk is Astra only, in-session.
 Opus is not an advisor candidate. `Sonnet` and `Haiku` are executor tiers only.
 Consumer `own_tier` is recorded on the spawn-walk log; it does not add Opus to the advisor walk.
 Tier names are canonical Title Case; the validator accepts any letter case and normalizes to Title Case.
-Try binds top-down. Each try resolves its candidate tier to the short model alias via the tier-to-alias map in [`reference/cli-chain.md`](reference/cli-chain.md).
-The advisor is created at `selected_tier` — the first ladder tier that binds.
-When Fable fails on a Claude host, try Sol if the flag is on, else fail closed. The CLI chain is the Fable bind path on a third-party host and the Claude-host fallback for Fable; it does not bind Opus as advisor.
-On a Codex host a failed Sol spawn fails closed per **Host profiles → Codex host**.
-On a third-party host the CLI chain is already the primary path, so a failed Fable (and Sol, when enabled) walk fails closed per **Host profiles → Third-party host**.
+Try binds top-down. Fable resolves to the short model alias in [`reference/cli-chain.md`](reference/cli-chain.md); Astra resolves through `resolve_codex_model_id("Astra")` to `gpt-6-astra`.
+The advisor is created at `selected_tier`, the first ladder tier that binds.
+When Fable fails on a Claude host, try Astra if the flag is on, else fail closed. The CLI chain is the Fable bind path on a third-party host and the Claude-host fallback for Fable; it does not bind Opus as advisor.
+On a Codex host a failed Astra spawn fails closed per **Host profiles → Codex host**.
+On a third-party host the CLI chain is already the primary path, so a failed Fable (and Astra, when enabled) walk fails closed per **Host profiles → Third-party host**.
 
 Emit a structured spawn-walk log so the walk can be checked mechanically: [`reference/spawn-walk-log.md`](reference/spawn-walk-log.md).
 The validator checks ladder shape only; host policy sits on top.
 
-**Equal-tier pairings.** Bind Fable for an independent second pass on irreversible or security-sensitive work. The advisor is Fable or Sol.
+**Equal-tier pairings.** Bind Fable for an independent second pass on irreversible or security-sensitive work. The advisor is Fable or Astra.
 
 ## Warm-up (once per session)
 
-On a **Claude host**, walk the candidate tiers top-down, spawning `session-advisor` in the background at each candidate's alias with the charter as its prompt, stopping at the first successful spawn.
-A **Fable**-tier try carries the exact token `FABLE-SPAWN-AUTHORIZED` in its prompt — `hooks/blocking/fable_spawn_gate.py` denies a Fable-tier spawn without it.
+On a **Claude host**, spawn `session-advisor` at the Fable alias with the charter as its prompt. When Fable is out of usage and the Astra rung is open, bind Astra through the Codex helper instead.
+A **Fable**-tier try carries the exact token `FABLE-SPAWN-AUTHORIZED` in its prompt. `hooks/blocking/fable_spawn_gate.py` denies a Fable-tier spawn without it.
 Full spawn fields and the charter template: [`reference/warm-up.md`](reference/warm-up.md).
 
-On a **Codex host**, spawn a native in-session Sol subagent with the same charter. Bind fields: [`reference/identity.md`](reference/identity.md) and [`reference/warm-up.md`](reference/warm-up.md).
+On a **Codex host**, spawn a native in-session Astra subagent with the same charter. Bind fields: [`reference/identity.md`](reference/identity.md) and [`reference/warm-up.md`](reference/warm-up.md).
 
-On a **third-party host**, bind per [`reference/third-party-bind.md`](reference/third-party-bind.md) and charter the CLI session with the same charter — the reply contract is the same, and consults travel through the CLI runner.
+On a **third-party host**, bind per [`reference/third-party-bind.md`](reference/third-party-bind.md) and charter the CLI session with the same charter. The reply contract is the same, and consults travel through the CLI runner.
 
 ## Consulting the warm agent
 
-Send a consult at the trigger points `docs/references/advisor-tool.md` **When to call** defines — plan lock-in, believed completion, hard-to-reverse actions, repeated failure or stalled progress, and reconsidered approach.
+Send a consult at the trigger points `docs/references/advisor-tool.md` **When to call** defines: plan lock-in, believed completion, hard-to-reverse actions, repeated failure or stalled progress, and reconsidered approach.
 The paste parts in [`reference/advisor-block.md`](reference/advisor-block.md) restate them for executors.
 
-Each consult carries the sender's identity and assignment, the delta since the last consult, the live decision or blocker, and the paths or excerpts needed to answer well — full packet shape plus the new-evidence and report-back rules: [`reference/consult-format.md`](reference/consult-format.md).
+Each consult carries the sender's identity and assignment, the delta since the last consult, the live decision or blocker, and the paths or excerpts needed to answer well. Full packet shape plus the new-evidence and report-back rules: [`reference/consult-format.md`](reference/consult-format.md).
 Consult briefs embed the `docs/references/advisor-tool.md` **Brevity cue** line, sized per that section.
 
-Treat the reply as a serious second opinion: a CORRECTION — whether it names a wrong step or a risk worth closing — is something to address before treating the plan or the work as done.
+A CORRECTION names a wrong step or a risk worth closing. Address it before treating the plan or the work as done.
 Route a STOP, or an unreachable advisor, upward per [`reference/consult-format.md`](reference/consult-format.md).
 
-## Advisor block — assemble and paste into every executor spawn prompt
+## Advisor block
 
-Assemble each executor's block from the parts in [`reference/advisor-block.md`](reference/advisor-block.md), in order: one transport preamble picked by host profile, then the shared core, then — for an executor at Sonnet or below — the weak-executor add-on.
+Assemble each executor's block from the parts in [`reference/advisor-block.md`](reference/advisor-block.md), in order: one transport preamble picked by host profile, then the shared core, then the weak-executor add-on for an executor at Sonnet or below.
 Paste the assembled block at the **top** of the spawn prompt, ahead of any other sentence that mentions the advisor.
-The assembled block is self-contained — the executor receives this text alone.
+The assembled block is self-contained. The executor receives this text alone.
 
 ## Lifecycle ownership
 
-The session that binds the advisor owns its whole lifecycle — first bind, drift re-spawn or re-bind, and shutdown; every other consumer reaches the advisor by message alone.
+The session that binds the advisor owns its whole lifecycle: first bind, drift re-spawn or re-bind, and shutdown. Every other consumer reaches the advisor by message alone.
 Drift signals and the per-host re-spawn / re-bind steps: [`reference/lifecycle.md`](reference/lifecycle.md).
 
 ## CLI chain
@@ -140,14 +140,14 @@ Modes and failover, the tier-to-alias table, brief piping, and `--resume` sessio
 
 **Third-party host:** the primary bind and consult path; the walk order and fail-closed rule live in [`reference/third-party-bind.md`](reference/third-party-bind.md).
 
-**Codex host:** do not use this runner as the primary path. Sol binds in-session.
+**Codex host:** do not use this runner as the primary path. Astra binds in-session.
 
 **Claude host:** fall back to this runner exactly when one of these holds:
-- The Agent-tool spawn errors at every candidate tier down to the floor — the tool itself is unavailable.
+- The Agent-tool spawn errors at every candidate tier down to the floor. The tool itself is unavailable.
 - `SendMessage` to the shared advisor errors, or draws no reply within the bound in `ADVISOR_SENDMESSAGE_REPLY_WAIT_SECONDS` (120) in `$HOME/.claude/_shared/advisor/scripts/config/advisor_scripts_constants/model_tier_run_validator_constants.py`, and a re-spawn also fails.
 - The running session is itself a subagent barred from spawning further agents.
 
 ## State the mechanism
 
-One warm agent, addressed by name, whose transcript accumulates across consults — each consult sends only the delta since the last one.
+One warm agent, addressed by name, whose transcript accumulates across consults. Each consult sends only the delta since the last one.
 A consuming skill's own text states this mechanism; a token or cost saving becomes a claim only after a measured comparison against cold spawns.