claude-dev-env 2.35.0 → 4.0.0

package/_shared/advisor/reference/advisor-block.md

@@ -3,26 +3,26 @@
 Detail behind the **Advisor block** section of [`advisor-protocol.md`](../advisor-protocol.md).
 Open this when assembling the block for an executor spawn prompt.
 
-Assembly order: one transport preamble picked by host profile, then the shared core, then — for an executor at Sonnet or below — the weak-executor add-on.
+Assembly order: one transport preamble picked by host profile, then the shared core, then the weak-executor add-on for an executor at Sonnet or below.
 Paste the assembled block at the **top** of the spawn prompt, ahead of any other sentence that mentions the advisor.
-The assembled block is self-contained — the executor receives this text alone, so every path it names is absolute.
+The assembled block is self-contained. The executor receives this text alone, so every path it names is absolute.
 The consult rules it restates are owned by [`consult-format.md`](consult-format.md); edit that file first and carry the change here.
 
-## Transport preamble — Claude host
+## Transport preamble for a Claude host
 
 > A shared session advisor named `<name>` is reachable via SendMessage; send each consult to it directly by that name.
 
-## Transport preamble — Codex host
+## Transport preamble for a Codex host
 
-> A shared session advisor named `<name>` is reachable as a native Codex Sol subagent; send each consult to it in-session by that name.
+> A shared session advisor named `<name>` is reachable as a native Codex Astra subagent; send each consult to it in-session by that name.
 
-## Transport preamble — third-party host
+## Transport preamble for a third-party host
 
 > The orchestrating session owns a standing advisor for this run.
-> The advisor chain: Claude Fable, then Sol through the Codex CLI when Fable is out of usage and the sol flag and its preflight open that rung. Both rungs use `ADVISOR_EFFORT` (default low). When neither binds, there is no advisor.
+> The advisor chain: Claude Fable, then Astra through the Codex CLI when Fable is out of usage and the Astra flag and its preflight open that rung. Both rungs use `ADVISOR_EFFORT` (default low). When neither binds, there is no advisor.
 > The orchestrating session is your one path to it: send each consult as a report to the session that assigned you, and it relays the advisor's reply.
 
-## Shared core — every host
+## Shared core for every host
 
 > Consult before locking in a nontrivial approach, once you believe your assignment is done, before any hard-to-reverse action, when the same failure repeats or progress has stalled, and when the chosen approach is being reconsidered.
 > Build the first consult with the complete format in `$HOME/.claude/_shared/advisor/reference/consult-format.md`: assignment, desired outcome, constraints and exclusions, actions taken in order, real output and current state, live decision or blocker, validation evidence, unresolved risks, and load-bearing paths or excerpts. Later consults carry only changed evidence.
@@ -31,7 +31,7 @@ The consult rules it restates are owned by [`consult-format.md`](consult-format.
 > Replies open with one of ENDORSE, CORRECTION, PLAN, or STOP — treat CORRECTION and PLAN as actions to take.
 > On STOP, or when the advisor is unreachable, stop and report that back to whoever assigned you; advisor binding and the four signals stay with the session that owns the advisor.
 
-## Weak-executor add-on — Sonnet or below, either host
+## Weak-executor add-on for Sonnet or below, either host
 
 > Send your first consult right after orientation and before your first write.
 > Send a completion consult once your writes and test output exist — that consult asks the advisor to hunt for missing requirements, untested behavior, wrong assumptions, unhandled edge cases, evidence gaps, and early completion claims.

package/_shared/advisor/reference/astra-rung.md

@@ -0,0 +1,39 @@
+# Astra rung
+
+Detail behind the **Host profiles → Astra rung** section of [`advisor-protocol.md`](../advisor-protocol.md).
+Open this when Fable is out of usage on a Claude or ThirdParty host and an Astra fallback bind is starting.
+On a Codex host, Astra is the in-session default. See [`identity.md`](identity.md).
+
+## Flag
+
+`ADVISOR_ASTRA=1` (or `true` / `yes` / `on`) opens the Astra fallback after Fable is out of usage. Set the variable in the helper's process environment, or pass `--enable-astra` on the helper invocation. The CLI flag opens the rung for that run without touching the environment.
+Flag off both ways: fail closed when Fable did not bind.
+A Windows `setx` write only updates the persisted user environment; only a process started after that write inherits the new value, so an already-running session either sets the flag in its own invoking process environment or passes `--enable-astra`.
+
+## Effort
+
+`ADVISOR_EFFORT` selects Codex `model_reasoning_effort` for Astra and `--effort` for Fable: `low`, `medium`, `high`, `xhigh`, or `max`. The default is `low`, which sends `model_reasoning_effort="low"`. Pass `--effort <level>` on the helper to set effort for that Astra run without changing the environment. An unset or unrecognized value uses `low`.
+
+Every fallback reply carries a `fallback_kind` field. `declined` means policy closed the rung (flag off, usage meter at or below the gate). `broken` means the Astra path itself failed (missing executable, spawn error, timeout, malformed reply). A `broken` fallback is a defect to report.
+
+## Preflight
+
+Flag on: run the Codex preflight first.
+
+```
+python ~/.claude/_shared/pr-loop/scripts/codex_usage_probe.py
+```
+
+**GOTCHA. Probe path.** That installed path is the only one. `codex_astra_advisor.resolve_usage_probe_path` builds `~/.claude/_shared/pr-loop/scripts/codex_usage_probe.py` and stops. Do not hunt `skills/codex-review/`, Codex worktrees under `C:\dev\.codex\worktrees\`, or other copies. Repo home: `packages/claude-dev-env/_shared/pr-loop/scripts/`.
+
+The shared entry point is `~/.claude/_shared/advisor/scripts/codex_astra_advisor.py`. It calls the installed probe and owns Astra bind or resume parsing. Bind with `python ~/.claude/_shared/advisor/scripts/codex_astra_advisor.py --bind --enable-astra --cwd <repo-root>` and pipe the charter on stdin. Resume with `--resume <session_id>` and pipe the delta consult on stdin.
+
+The gate passes only when the probe exits 0, `percent_left` is finite numeric data, and `percent_left` is strictly greater than `WEEKLY_USAGE_GATE_THRESHOLD_PERCENT` from the existing probe. The exact-threshold case fails closed when Fable did not bind.
+
+## Branches
+
+**Preflight pass.** Bind one Codex CLI session at `gpt-6-astra` with `model_reasoning_effort` set from `ADVISOR_EFFORT` (default `low`), `--sandbox read-only`, and JSON output. The helper receives the standing-reviewer charter on stdin and returns only parsed ENDORSE / CORRECTION / PLAN / STOP guidance with a session ID.
+
+**Preflight fail.** Probe failure, non-zero exit, timeout, missing or malformed usage, `null`, non-finite usage, or usage at or below the threshold fails closed when Fable did not bind.
+
+The helper owns the Astra attempt and returns an explicit fallback result. The consuming advisor path owns the Fable bind. Apply the same gate to every Astra attempt, including resume.

package/_shared/advisor/reference/identity.md

@@ -9,7 +9,7 @@ Call `resolve_session_identity` from `$HOME/.claude/_shared/advisor/scripts/tier
 
 | Identity text | Host profile | Bind path |
 |---|---|---|
-| a `codex` token | Codex | In-session Sol spawn |
+| a `codex` token | Codex | In-session Astra spawn |
 | a `claude` token | Claude | In-session Fable spawn of `session-advisor` |
 | any other identity | ThirdParty | Headless CLI chain |
 
@@ -17,11 +17,11 @@ When both `codex` and `claude` tokens appear, Codex wins. Empty text is ThirdPar
 
 ## Bind path
 
-**Claude.** Spawn `subagent_type: session-advisor` at Fable through the Agent tool. When Fable is out of usage, bind Sol through the Codex helper if `ADVISOR_SOL` is on. Fail closed when neither binds.
+**Claude.** Spawn `subagent_type: session-advisor` at Fable through the Agent tool. When Fable is out of usage, bind Astra through the Codex helper if `ADVISOR_ASTRA` is on. Fail closed when neither binds.
 
-**Codex.** Spawn a native in-session Sol subagent at `resolve_codex_model_id("Sol")` (`gpt-5.6-sol`). Walk `candidate_tiers = ["Sol"]`. Record `{tier: "Sol", result: "spawned"}` on success. The `ADVISOR_SOL` flag is not required. Fail closed when Sol does not bind. Do not walk Fable on a Codex host.
+**Codex.** Spawn a native in-session Astra subagent at `resolve_codex_model_id("Astra")` (`gpt-6-astra`). Walk `candidate_tiers = ["Astra"]`. Record `{tier: "Astra", result: "spawned"}` on success. The `ADVISOR_ASTRA` flag is not required. Fail closed when Astra does not bind. Do not walk Fable on a Codex host.
 
-**ThirdParty.** Bind Fable through the CLI Claude-chain. When Fable is out of usage, bind Sol through the Codex helper if `ADVISOR_SOL` is on. Fail closed when neither binds.
+**ThirdParty.** Bind Fable through the CLI Claude-chain. When Fable is out of usage, bind Astra through the Codex helper if `ADVISOR_ASTRA` is on. Fail closed when neither binds.
 
 ## Mechanical override
 

package/_shared/advisor/reference/lifecycle.md

@@ -5,7 +5,7 @@ Open this when the advisor drifts, dies, or the task pivots.
 
 ## Claude host
 
-The session that spawns the shared advisor owns its whole lifecycle — spawn, drift-respawn, and shutdown.
+The session that spawns the shared advisor owns its whole lifecycle: spawn, drift-respawn, and shutdown.
 Every other consumer (executors, or any other consulting session) reaches it by message alone; spawn, respawn, and shutdown belong to the owning session.
 One shared advisor exists per orchestrated session, owned by the session that spawned it.
 
@@ -14,15 +14,15 @@ A **Fable**-tier re-spawn carries the exact token `FABLE-SPAWN-AUTHORIZED` in th
 
 ## Codex host
 
-The session that spawns the shared Sol subagent owns its whole lifecycle — spawn, drift-respawn, and shutdown.
+The session that spawns the shared Astra subagent owns its whole lifecycle: spawn, drift-respawn, and shutdown.
 Every other consumer reaches it by message alone; spawn, respawn, and shutdown belong to the owning session.
 
-**Re-spawn on drift.** If a reply shows the agent working from a stale picture, or the session pivots to an unrelated task, the owning session ends that agent and spawns a fresh native Sol subagent with a new charter.
+**Re-spawn on drift.** If a reply shows the agent working from a stale picture, or the session pivots to an unrelated task, the owning session ends that agent and spawns a fresh native Astra subagent with a new charter.
 
 ## Third-party host
 
-The orchestrating session owns the Claude CLI advisor bind for the whole run — first bind, re-bind on drift or lost `session_id`, and fail-closed report when the chain cannot serve.
+The orchestrating session owns the CLI advisor bind for the whole run: first bind, re-bind on drift or lost `session_id`, and fail-closed report when the bound path cannot serve.
 
-**Re-bind on drift.** If a reply shows a stale picture, the task pivots, or `--resume` fails after a usage-limit failover (session stores are per binary/account), re-bind through `claude_chain_runner.py` with the charter plus a compact recap of consults so far.
-Capture the new `session_id`, and log a fresh Fable walk with `result: "cli"` on success, then Sol when that rung is open.
+**Re-bind on drift.** If a reply shows a stale picture, the task pivots, or `--resume` fails after a usage-limit failover (session stores are per binary/account), re-bind Fable through `claude_chain_runner.py` with the charter plus a compact recap of consults so far.
+Capture the new `session_id`, and log a fresh Fable walk with `result: "cli"` on success, then Astra when that rung is open. An Astra re-bind uses `codex_astra_advisor.py --bind --enable-astra` with the same charter and recap, and records `result: "codex"` on success.
 Executors keep reporting to the orchestrating session; advisor binding stays with that session alone.

package/_shared/advisor/reference/spawn-walk-log.md

@@ -6,16 +6,16 @@ Detail behind the **Model floor** section of [`advisor-protocol.md`](../advisor-
 
 Write the log as JSON with these field names:
 
-- `own_tier` — the consuming session's tier (recorded; it does not add Opus to the advisor walk).
-- `host_profile` — `Claude`, `Codex`, or `ThirdParty`. Omit to default to `Claude`.
-- `candidate_tiers` — on Claude and ThirdParty, Fable, plus Sol when `sol_enabled` is true. On Codex, Sol only.
-- `sol_enabled` — a boolean recorded before candidate selection; on Claude and ThirdParty, `true` adds Sol after Fable and `false` walks Fable alone. On Codex this flag does not change the walk.
-- `attempts` — one `{tier, result}` entry appended as each bind try happens; `result` is `codex` for a Sol helper bind, `spawned` for an in-session spawn (Claude Agent or Codex native Sol), `cli` for a CLI Claude-chain bind, or a failure reason such as `unavailable`.
-- `selected_tier` — the tier of the first successful bind (first `codex`, `spawned`, or `cli` entry), or `null` paired with a `fallback_reason` string when none bound.
+- `own_tier`: the consuming session's tier (recorded; it does not add Opus to the advisor walk).
+- `host_profile`: `Claude`, `Codex`, or `ThirdParty`. Omit to default to `Claude`.
+- `candidate_tiers`: on Claude and ThirdParty, Fable, plus Astra when `astra_enabled` is true. On Codex, Astra only.
+- `astra_enabled`: a boolean recorded before candidate selection. On Claude and ThirdParty, `true` adds Astra after Fable and `false` walks Fable alone. On Codex this flag does not change the walk.
+- `attempts`: one `{tier, result}` entry appended as each bind try happens. `result` is `codex` for an Astra helper bind, `spawned` for an in-session spawn (Claude Agent or Codex native Astra), `cli` for a CLI Claude-chain bind, or a failure reason such as `unavailable`.
+- `selected_tier`: the tier of the first successful bind (first `codex`, `spawned`, or `cli` entry), or `null` paired with a `fallback_reason` string when none bound.
 
 ## Log path
 
-Write to a path the session controls — typically `<job-temp-dir>/model-tier-run.json`, or the OS temp directory when no job directory exists.
+Write to a path the session controls, typically `<job-temp-dir>/model-tier-run.json`, or the OS temp directory when no job directory exists.
 
 ## Validator
 
@@ -28,5 +28,5 @@ Exit code `1` means a ladder invariant failed.
 Exit code `2` means the path or JSON was unusable.
 The same checks are available in-process via `validate_model_tier_run(run)`.
 
-The validator checks ladder shape only: the candidate slice, the order of bind tries, and the success-token rules per tier and host. On Claude and ThirdParty, Sol is attempted after Fable when `sol_enabled` is true, and `selected_tier: "Sol"` requires `result: "codex"`. On Codex, the walk is Sol only, and `result: "spawned"` or `result: "codex"` counts as success.
-Host policy sits on top of it — see the Model floor section of the protocol.
+The validator checks ladder shape only: the candidate slice, the order of bind tries, and the success-token rules per tier and host. On Claude and ThirdParty, Astra is attempted after Fable when `astra_enabled` is true, and `selected_tier: "Astra"` requires `result: "codex"`. On Codex, the walk is Astra only, and `result: "spawned"` or `result: "codex"` counts as success.
+Host policy sits on top of it. See the Model floor section of the protocol.

package/_shared/advisor/reference/third-party-bind.md

@@ -3,23 +3,23 @@
 Detail behind the **Host profiles → Third-party host** section of [`advisor-protocol.md`](../advisor-protocol.md).
 Open this when binding or re-binding the advisor from a third-party (non-Claude, non-Codex) harness.
 
-## GOTCHA — Cursor Sol first shot
+## GOTCHA: Cursor Astra first shot
 
-Cursor is a third-party host. When the walk reaches Sol (`ADVISOR_SOL=1` / `--enable-sol` after Fable is out of usage, or the user asks for Sol), bind Sol on the **first** tool call through the headless Codex helper. Do not use the Agent or Task tool, do not spawn Grok as a substitute, and do not search the filesystem for `codex_usage_probe.py`.
+Cursor is a third-party host. When the walk reaches Astra (`ADVISOR_ASTRA=1` / `--enable-astra` after Fable is out of usage, or the user asks for Astra), bind Astra on the **first** tool call through the headless Codex helper. Do not use the Agent or Task tool, do not spawn Grok as a substitute, and do not search the filesystem for `codex_usage_probe.py`.
 
 ```
-python "$HOME/.claude/_shared/advisor/scripts/codex_sol_advisor.py" --bind --enable-sol --cwd <repo-root>
+python "$HOME/.claude/_shared/advisor/scripts/codex_astra_advisor.py" --bind --enable-astra --cwd <repo-root>
 ```
 
-Pipe the standing-reviewer charter on stdin. Persist `session_id` from the JSON reply. Later consults: `--resume <session_id>` with the delta on stdin. Capture helper / `codex` stdout as UTF-8 on Windows (`encoding="utf-8"`, `errors="replace"`). Probe path and preflight: [`sol-rung.md`](sol-rung.md).
+Pipe the standing-reviewer charter on stdin. Persist `session_id` from the JSON reply. Later consults: `--resume <session_id>` with the delta on stdin. Capture helper / `codex` stdout as UTF-8 on Windows (`encoding="utf-8"`, `errors="replace"`). Probe path and preflight: [`astra-rung.md`](astra-rung.md).
 
-When the Sol flag is off, follow the Claude-chain steps below.
+When the Astra flag is off, follow the Claude-chain steps below.
 
 ## Bind steps
 
 1. Name the session identity first (protocol **Host profiles**). This path is for a ThirdParty profile.
-2. Walk `candidate_tiers = ["Fable"]`. When Fable is out of usage, the sol rung ([`sol-rung.md`](sol-rung.md)) binds Sol after Fable (`candidate_tiers = ["Fable", "Sol"]`).
-3. **CLI bind (primary path):** for each candidate top-down, pipe a charter file into:
+2. Walk `candidate_tiers = ["Fable"]`. When Fable is out of usage, the Astra rung ([`astra-rung.md`](astra-rung.md)) binds Astra after Fable (`candidate_tiers = ["Fable", "Astra"]`).
+3. **CLI bind (primary path):** for Fable, pipe a charter file into:
 
    ```
    python "$HOME/.claude/scripts/claude_chain_runner.py" --routing-mode ordered_account -- -p --model <alias> --effort <effort> --output-format json
@@ -27,15 +27,15 @@ When the Sol flag is off, follow the Claude-chain steps below.
 
    Use `--model fable --effort` with the value of `ADVISOR_EFFORT` (default `low`) on Fable.
    User-facing wording follows [`rules/asd-ste100-language.md`](../../../rules/asd-ste100-language.md).
-   A root advisor bind uses `--routing-mode ordered_account` — walk order, failover, and the `advisor_blocked` terminal status are in [`cli-chain.md`](cli-chain.md).
+   A root advisor bind uses `--routing-mode ordered_account`. Walk order, failover, and the `advisor_blocked` terminal status are in [`cli-chain.md`](cli-chain.md).
 4. Stop at the first successful bind.
-   Record `{tier, result: "cli"}` and set `selected_tier` to that tier.
+   Record `{tier, result: "cli"}` for Fable or `{tier: "Astra", result: "codex"}` for the Astra helper, and set `selected_tier` to that tier.
    Persist `session_id` from the JSON events (any event carries it; the runner also surfaces it on `ChainInvocationOutcome.session_id`; reply text is the `type == "result"` event's `.result` field).
-   Run every bind and every later consult with cwd set to the repo root the work is for — Claude sessions are project-scoped by working directory.
+   Run every bind and every later consult with cwd set to the repo root the work is for. Claude sessions are project-scoped by working directory.
 5. **Fail closed:** when every candidate fails (chain exhausted, `advisor_blocked`, or model unavailable), set `selected_tier = null` and a `fallback_reason`, report that the advisor is unreachable, and **stop**. ENDORSE / CORRECTION / PLAN / STOP come only from a bound advisor.
 6. Assemble and paste each executor's Advisor block from [`advisor-block.md`](advisor-block.md). Executors report to the orchestrating session; that session consults the bound advisor and relays the four-signal reply.
 
 ## Session model field
 
 Resolve a third-party session's own model field with `resolve_cli_model_id("ThirdParty")` → `third-party` when a host model alias is required.
-The **advisor** bind uses the Fable alias. Sol binds through the Codex helper.
+The **advisor** bind uses the Fable alias. Astra binds through the Codex helper.

package/_shared/advisor/reference/warm-up.md

@@ -3,39 +3,39 @@
 Detail behind the **Warm-up** section of [`advisor-protocol.md`](../advisor-protocol.md).
 Open this when binding the warm advisor on a Claude host or a Codex host, and for the charter text on every host.
 
-## Spawn fields — Claude host
+## Spawn fields for a Claude host
 
-The consuming skill's session walks the candidate tiers top-down. For each try, spawn with:
+The consuming skill's session tries Fable first. Spawn with:
 
 - `subagent_type: session-advisor` (see [`agents/session-advisor.md`](../../../agents/session-advisor.md) for the full signal contract).
-- `model`: the short alias for that try's candidate tier via `resolve_cli_model_id` (alias table: [`cli-chain.md`](cli-chain.md)) — for example `fable`. The walk tries Fable first, then Sol when that rung is open.
+- `model`: the short alias via `resolve_cli_model_id("Fable")` (alias table: [`cli-chain.md`](cli-chain.md)): `fable`. When Fable is out of usage and the Astra rung is open, continue with the Codex helper in [`astra-rung.md`](astra-rung.md) as the Astra fallback.
 - `name`: a name the session and every consumer will use to reach it (e.g. `team-advisor-agent`).
 - `run_in_background: true`.
-- `prompt`: the charter below. A **Fable**-tier try carries the exact token `FABLE-SPAWN-AUTHORIZED` in that prompt — `hooks/blocking/fable_spawn_gate.py` denies every `Agent` or `Task` spawn at `model: fable` whose prompt lacks that token. A try at any other tier needs no token.
+- `prompt`: the charter below. A **Fable**-tier try carries the exact token `FABLE-SPAWN-AUTHORIZED` in that prompt. `hooks/blocking/fable_spawn_gate.py` denies every `Agent` or `Task` spawn at `model: fable` whose prompt lacks that token. A try at any other tier needs no token.
 
-Stop at the first successful spawn. That try's tier is `selected_tier`; the warm agent lives at that tier for the rest of the session.
+Stop at the first successful bind. That try's tier is `selected_tier`; the warm advisor lives at that tier for the rest of the session.
 
 ## Charter (the spawn prompt)
 
-The charter states: the agent's role — standing reviewer, answers only via SendMessage, with file edits and commands out of its scope — the repo path, and the session's current goal in two or three sentences.
+The charter states the agent's role, the repo path, and the session's current goal in two or three sentences. The agent is a standing reviewer. It answers only via SendMessage. File edits and commands are out of its scope.
 On a Fable-tier try, include the exact token `FABLE-SPAWN-AUTHORIZED` as plain text in this prompt (substring match; the gate reads the token alone, wherever it came from).
 State plainly:
 
 - Every consult carries: who is asking (name and assignment), what changed since their last consult, the live decision or question, and any load-bearing paths or excerpts.
-- Reply via SendMessage to whoever sent the consult, by name — each reply goes back to its own sender, and many different consumers may reach this one agent.
-- Treat each consult on its own terms, keyed to the sender's stated assignment. Different consumers' consults will interleave in this one transcript — keep each consumer's context separate, and blend only when a consult explicitly asks for that.
+- Reply via SendMessage to whoever sent the consult, by name. Each reply goes back to its own sender, and many different consumers may reach this one agent.
+- Treat each consult on its own terms, keyed to the sender's stated assignment. Different consumers' consults will interleave in this one transcript. Keep each consumer's context separate, and blend only when a consult explicitly asks for that.
 - If a consult re-raises a question already answered, with nothing new attached, reply by restating the prior answer and naming it as a restatement.
-- Every reply, including this first bind turn, opens its first line with exactly one of the four uppercase signal words — `ENDORSE`, `CORRECTION`, `PLAN`, `STOP` — and nothing else on that line. Standing by after the bind is itself an `ENDORSE` of the charter, stated as that first line.
+- Every reply, including this first bind turn, opens its first line with exactly one of the four uppercase signal words: `ENDORSE`, `CORRECTION`, `PLAN`, `STOP`. Nothing else on that line. Standing by after the bind is itself an `ENDORSE` of the charter, stated as that first line.
 
 The agent finishes its first turn standing by. `SendMessage` alone resumes it; between consults it waits quietly.
 
 ## Codex host
 
-Spawn a native in-session Sol subagent at `resolve_codex_model_id("Sol")` (`gpt-5.6-sol`) with the charter as its prompt.
-Record `{tier: "Sol", result: "spawned"}` on success. Fail closed when that spawn does not bind.
-The `ADVISOR_SOL` flag is not required. Do not walk Fable. Consults stay in-session with that Sol subagent.
+Spawn a native in-session Astra subagent at `resolve_codex_model_id("Astra")` (`gpt-6-astra`) with the charter as its prompt.
+Record `{tier: "Astra", result: "spawned"}` on success. Fail closed when that spawn does not bind.
+The `ADVISOR_ASTRA` flag is not required. Do not walk Fable. Consults stay in-session with that Astra subagent.
 Identity routing: [`identity.md`](identity.md).
 
 ## Third-party host
 
-Bind per [`third-party-bind.md`](third-party-bind.md) and charter the CLI session with the same charter — the reply contract is the same, and consults travel through the CLI runner.
+Bind per [`third-party-bind.md`](third-party-bind.md) and charter the CLI session with the same charter. The reply contract is the same, and consults travel through the CLI runner.

package/_shared/advisor/scripts/codex_astra_advisor.py

@@ -0,0 +1,308 @@
+"""Bind and consult a read-only Codex CLI session through Astra."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import subprocess
+import sys
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import asdict
+from pathlib import Path
+
+_scripts_directory = Path(__file__).resolve().parent
+_config_directory = _scripts_directory / "config"
+for each_import_directory in (_scripts_directory, _config_directory):
+    each_import_directory_text = str(each_import_directory)
+    if each_import_directory_text not in sys.path:
+        sys.path[:0] = [each_import_directory_text]
+
+from advisor_scripts_constants.astra_advisor_constants import (
+    ADVISOR_CODEX_EXECUTABLE_ENV_VAR,
+    ALL_ASTRA_TRUTHY_VALUES,
+    ASTRA_BIND_FAILURE_REASON,
+    ASTRA_CODEX_TIMEOUT_REASON,
+    ASTRA_CODEX_TIMEOUT_SECONDS,
+    ASTRA_EFFORT_FLAG,
+    ASTRA_ENABLE_FLAG,
+    ASTRA_ENV_VAR,
+    ASTRA_EXECUTABLE_NOT_FOUND_REASON,
+    ASTRA_FALLBACK_KIND_BROKEN,
+    ASTRA_FALLBACK_KIND_DECLINED,
+    ASTRA_SESSION_ID_METAVAR,
+    CLAUDE_CONFIG_DIRECTORY_NAME,
+    CODEX_CONFIG_FLAG,
+    CODEX_EXECUTABLE,
+    CODEX_EXEC_SUBCOMMAND,
+    CODEX_JSON_FLAG,
+    CODEX_MODEL_FLAG,
+    CODEX_PROMPT_FROM_STDIN,
+    CODEX_READ_ONLY_SANDBOX,
+    CODEX_REASONING_CONFIG_TEMPLATE,
+    CODEX_RESUME_SUBCOMMAND,
+    CODEX_SANDBOX_FLAG,
+    USAGE_PROBE_FILENAME,
+    USAGE_PROBE_PACKAGE_DIRECTORY_NAME,
+    USAGE_PROBE_SCRIPTS_DIRECTORY_NAME,
+    USAGE_PROBE_SHARED_DIRECTORY_NAME,
+)
+from advisor_scripts_constants.advisor_route_constants import (
+    ADVISOR_CODEX_MODEL_ID,
+    ADVISOR_EFFORT_DEFAULT,
+    ADVISOR_EFFORT_ENV_VAR,
+    ALL_ADVISOR_EFFORT_LEVELS,
+    SPAWN_OUTCOME_KEY,
+)
+from codex_astra_reply import (
+    CodexAstraAdvisorReply,
+    build_fallback_reply,
+    parse_codex_jsonl_reply,
+)
+from codex_astra_preflight import AstraPreflight, run_astra_preflight
+
+
+def _resolved_settings(
+    all_settings: Mapping[str, str] | None,
+) -> Mapping[str, str]:
+    return os.environ if all_settings is None else all_settings
+
+
+def is_astra_advisor_enabled(all_settings: Mapping[str, str] | None) -> bool:
+    """Return whether the Astra advisor flag is on.
+
+    Args:
+        all_settings: Environment mapping, or None to read os.environ.
+
+    Returns:
+        True when the flag holds a truthy value.
+    """
+    raw_setting = _resolved_settings(all_settings).get(ASTRA_ENV_VAR, "")
+    return raw_setting.strip().lower() in ALL_ASTRA_TRUTHY_VALUES
+
+
+def resolve_advisor_effort(all_settings: Mapping[str, str] | None) -> str:
+    """Return ADVISOR_EFFORT, or low when the value is missing or unknown.
+
+    Args:
+        all_settings: Environment mapping, or None to read os.environ.
+
+    Returns:
+        The requested effort, or low.
+    """
+    requested = _resolved_settings(all_settings).get(ADVISOR_EFFORT_ENV_VAR, "")
+    normalized = requested.strip().lower()
+    return normalized if normalized in ALL_ADVISOR_EFFORT_LEVELS else ADVISOR_EFFORT_DEFAULT
+
+
+def resolve_usage_probe_path(home_directory: Path) -> Path:
+    """Return the Codex usage-probe path under home_directory.
+
+    Args:
+        home_directory: Home directory that holds the installed probe.
+
+    Returns:
+        Path to the usage probe under that home.
+    """
+    return (
+        home_directory
+        / CLAUDE_CONFIG_DIRECTORY_NAME
+        / USAGE_PROBE_SHARED_DIRECTORY_NAME
+        / USAGE_PROBE_PACKAGE_DIRECTORY_NAME
+        / USAGE_PROBE_SCRIPTS_DIRECTORY_NAME
+        / USAGE_PROBE_FILENAME
+    )
+
+
+def resolve_codex_executable(all_settings: Mapping[str, str] | None) -> str | None:
+    """Return the Codex executable from the override or PATH.
+
+    Args:
+        all_settings: Environment mapping, or None to read os.environ.
+
+    Returns:
+        Executable path or name, or None if neither is set.
+    """
+    override = _resolved_settings(all_settings).get(ADVISOR_CODEX_EXECUTABLE_ENV_VAR, "").strip()
+    return override or shutil.which(CODEX_EXECUTABLE)
+
+
+def build_codex_arguments(
+    codex_executable: str,
+    session_id: str | None = None,
+    reasoning_effort: str = ADVISOR_EFFORT_DEFAULT,
+) -> list[str]:
+    """Build the Codex command list for bind or resume.
+
+    Args:
+        codex_executable: Codex executable path or name.
+        session_id: Session to resume, or None for a new bind.
+        reasoning_effort: Codex reasoning effort.
+
+    Returns:
+        Command arguments for Codex exec.
+    """
+    arguments = [
+        codex_executable,
+        CODEX_EXEC_SUBCOMMAND,
+        CODEX_MODEL_FLAG,
+        ADVISOR_CODEX_MODEL_ID,
+        CODEX_CONFIG_FLAG,
+        CODEX_REASONING_CONFIG_TEMPLATE.format(effort=reasoning_effort),
+        CODEX_SANDBOX_FLAG,
+        CODEX_READ_ONLY_SANDBOX,
+        CODEX_JSON_FLAG,
+    ]
+    if session_id is not None:
+        arguments.extend([CODEX_RESUME_SUBCOMMAND, session_id])
+    arguments.append(CODEX_PROMPT_FROM_STDIN)
+    return arguments
+
+
+def _resolve_preflight(
+    preflight: AstraPreflight | None,
+    probe_path: Path | None,
+    process_runner: Callable[..., subprocess.CompletedProcess[str]],
+) -> AstraPreflight:
+    if preflight is not None:
+        return preflight
+    resolved_path = resolve_usage_probe_path(Path.home()) if probe_path is None else probe_path
+    return run_astra_preflight(resolved_path, process_runner)
+
+
+def _run_codex(
+    prompt: str,
+    working_directory: Path,
+    session_id: str | None,
+    all_settings: Mapping[str, str] | None,
+    executable: str,
+    process_runner: Callable[..., subprocess.CompletedProcess[str]],
+) -> subprocess.CompletedProcess[str]:
+    return process_runner(
+        build_codex_arguments(
+            executable,
+            session_id=session_id,
+            reasoning_effort=resolve_advisor_effort(all_settings),
+        ),
+        cwd=str(working_directory),
+        input=prompt,
+        capture_output=True,
+        text=True,
+        check=False,
+        shell=False,
+        timeout=ASTRA_CODEX_TIMEOUT_SECONDS,
+    )
+
+
+def _run_enabled_advisor(
+    prompt: str,
+    working_directory: Path,
+    setting_by_name: Mapping[str, str] | None,
+    session_id: str | None,
+    executable: str,
+    resolved_preflight: AstraPreflight,
+    process_runner: Callable[..., subprocess.CompletedProcess[str]],
+) -> CodexAstraAdvisorReply:
+    if not resolved_preflight.eligible:
+        return build_fallback_reply(resolved_preflight.reason, True, resolved_preflight.fallback_kind)
+    try:
+        completed = _run_codex(
+            prompt, working_directory, session_id, setting_by_name, executable, process_runner
+        )
+    except subprocess.TimeoutExpired as error:
+        return build_fallback_reply(f"{ASTRA_CODEX_TIMEOUT_REASON}: {error}", True)
+    except (OSError, subprocess.SubprocessError) as error:
+        return build_fallback_reply(f"{ASTRA_BIND_FAILURE_REASON}: {error}", True)
+    if completed.returncode != 0:
+        return build_fallback_reply(
+            f"{ASTRA_BIND_FAILURE_REASON}: process exit {completed.returncode}", True
+        )
+    return parse_codex_jsonl_reply(completed.stdout, session_id, True)
+
+
+def run_codex_astra_advisor(
+    prompt: str,
+    working_directory: Path,
+    preflight: AstraPreflight | None,
+    probe_path: Path | None,
+    setting_by_name: Mapping[str, str] | None,
+    session_id: str | None,
+    process_runner: Callable[..., subprocess.CompletedProcess[str]],
+) -> CodexAstraAdvisorReply:
+    """Bind or resume a read-only Codex Astra advisor.
+
+    Args:
+        prompt: Advisor prompt text.
+        working_directory: Working directory for Codex.
+        preflight: Usage probe result, or None to run the probe.
+        probe_path: Usage-probe path, or None for the installed path.
+        setting_by_name: Environment mapping, or None to read os.environ.
+        session_id: Session to resume, or None for a new bind.
+        process_runner: Callable that runs the probe and Codex.
+
+    Returns:
+        Advisor reply, or a fallback.
+    """
+    if not is_astra_advisor_enabled(setting_by_name):
+        return build_fallback_reply("Astra advisor flag is disabled", False, ASTRA_FALLBACK_KIND_DECLINED)
+    executable = resolve_codex_executable(setting_by_name)
+    if executable is None:
+        return build_fallback_reply(ASTRA_EXECUTABLE_NOT_FOUND_REASON, True)
+    resolved_preflight = _resolve_preflight(preflight, probe_path, process_runner)
+    return _run_enabled_advisor(prompt, working_directory, setting_by_name, session_id, executable, resolved_preflight, process_runner)
+
+
+def build_argument_parser() -> argparse.ArgumentParser:
+    """Build the command-line parser for bind and resume.
+
+    Returns:
+        Argument parser for this helper.
+    """
+    parser = argparse.ArgumentParser(description="Bind or consult a read-only Codex Astra advisor.")
+    mode_group = parser.add_mutually_exclusive_group(required=True)
+    mode_group.add_argument("--bind", action="store_true")
+    mode_group.add_argument("--resume", metavar=ASTRA_SESSION_ID_METAVAR)
+    parser.add_argument("--cwd", required=True, type=Path)
+    parser.add_argument(ASTRA_ENABLE_FLAG, dest="is_astra_requested", action="store_true")
+    parser.add_argument(
+        ASTRA_EFFORT_FLAG,
+        dest="astra_effort",
+        choices=ALL_ADVISOR_EFFORT_LEVELS,
+        default=None,
+    )
+    return parser
+
+
+def main(all_cli_arguments: Sequence[str]) -> int:
+    """Run one bind or resume request from stdin.
+
+    Args:
+        all_cli_arguments: CLI arguments after the program name.
+
+    Returns:
+        0 when the advisor reply succeeds, 1 on fallback.
+    """
+    parsed = build_argument_parser().parse_args(list(all_cli_arguments))
+    all_settings = dict(os.environ)
+    if parsed.is_astra_requested:
+        all_settings[ASTRA_ENV_VAR] = "1"
+    if parsed.astra_effort is not None:
+        all_settings[ADVISOR_EFFORT_ENV_VAR] = parsed.astra_effort
+    reply = run_codex_astra_advisor(
+        sys.stdin.read(),
+        parsed.cwd,
+        None,
+        None,
+        all_settings,
+        parsed.resume if not parsed.bind else None,
+        subprocess.run,
+    )
+    payload = asdict(reply)
+    payload[SPAWN_OUTCOME_KEY] = payload.pop("outcome")
+    sys.stdout.write(f"{json.dumps(payload, sort_keys=True)}\n")
+    return 0 if reply.successful else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))