create-byan-agent 2.50.0 → 2.53.0

package/install/templates/.claude/workflows/byan-auto-dispatch.js

@@ -0,0 +1,210 @@
+export const meta = {
+  name: 'byan-auto-dispatch',
+  description: 'Decoupe une tache en etapes typees, route chaque etape sur le bon modele (haiku/sonnet/opus/fable par complexite ; Codex pour shell/deploiement), ecrit _byan-output/plan.md, execute et verifie.',
+  whenToUse: 'Rail automatique de /byan-byan : toute tache non-conversationnelle passe par ce workflow sans demande explicite. Le gate humain reste en fin, sur le livrable.',
+  phases: [
+    { title: 'Decoupage', detail: 'un agent d analyse decoupe la tache en etapes typees (nature + complexite 0-100)', model: 'sonnet' },
+    { title: 'Routage', detail: 'pur code : echelle haiku<34 / sonnet<67 / opus<90 / fable>=90 ; moteur Codex pour shell/deploiement, verification toujours Claude' },
+    { title: 'Plan', detail: 'ecrit _byan-output/plan.md (table etape x modele x moteur)', model: 'sonnet' },
+    { title: 'Execution', detail: 'un agent par etape, sequentiel, sur le modele route' },
+    { title: 'Verification', detail: 'controle du livrable sur le modele de session (jamais delegue)' },
+  ],
+};
+
+// BYAN-TIER: reviewed — les modeles des etapes d'execution sont CALCULES par le
+// routeur inline (echelle v3 par complexite), pas des choix statiques ; les deux
+// leaves statiques (analyse -> sonnet, ecriture mecanique du plan -> sonnet)
+// portent leur niveau en litteral, verifiable par le linter.
+//
+// Un script natif n'a NI import NI acces fichier : l'echelle de routage est donc
+// posee ici en clair (la meme table que _byan/mcp/byan-mcp-server/lib/
+// dispatch-router.js, qui reste la source de verite testee cote lib), et le
+// plan.md est ecrit par un agent (qui, lui, a l'outil Write).
+//
+// args attendus : { task: string, stamp?: string ISO }
+// (stamp vient du fil principal — un script natif n a pas le droit de lire
+// l horloge lui-meme, ca casserait la reprise sur relance.)
+
+// Accepte args en objet OU en chaine JSON (selon le chemin d'invocation), et, en
+// dernier recours, une chaine nue traitee comme la tache elle-meme.
+let entree = {};
+if (args && typeof args === 'object') {
+  entree = args;
+} else if (typeof args === 'string' && args.trim()) {
+  try {
+    const p = JSON.parse(args);
+    entree = (p && typeof p === 'object') ? p : { task: String(p) };
+  } catch {
+    entree = { task: args };
+  }
+}
+const tache = String(entree.task || '').trim();
+const stamp = String(entree.stamp || 'horodatage non fourni');
+if (!tache) return { ok: false, erreur: 'args.task manquant : rien a dispatcher' };
+
+// --- Phase 1 : DECOUPAGE (analyse -> sonnet, conforme a la doctrine des niveaux)
+phase('Decoupage');
+const PLAN_SCHEMA = {
+  type: 'object',
+  required: ['resume', 'etapes'],
+  additionalProperties: false,
+  properties: {
+    resume: { type: 'string', description: 'La tache reformulee en une phrase.' },
+    etapes: {
+      type: 'array',
+      minItems: 1,
+      maxItems: 10,
+      items: {
+        type: 'object',
+        required: ['id', 'titre', 'nature', 'complexite', 'consigne'],
+        additionalProperties: false,
+        properties: {
+          id: { type: 'string', description: 'E1, E2, ...' },
+          titre: { type: 'string' },
+          nature: {
+            enum: ['exploration', 'analyse', 'implementation', 'verification', 'shell', 'deploiement', 'navigation', 'doc'],
+            description: 'exploration=lire/scanner ; analyse=juger/concevoir ; implementation=ecrire du code/contenu ; verification=controler ; shell/deploiement/navigation=execution systeme ; doc=documentation',
+          },
+          complexite: { type: 'number', minimum: 0, maximum: 100 },
+          consigne: { type: 'string', description: 'L instruction complete et autonome pour executer cette etape.' },
+        },
+      },
+    },
+  },
+};
+const decoupe = await agent(
+  'Tu decoupes une tache en etapes executables, chacune typee et notee en complexite.\n' +
+  'Regles : chaque etape est autonome (sa consigne suffit pour l executer) ; ordonne-les ;\n' +
+  'la complexite est 0-100 (0=trivial, 100=extreme) ; ne cree pas d etape superflue (rasoir d Ockham) ;\n' +
+  'inclus une etape de verification finale seulement si la tache produit du code ou un livrable testable.\n' +
+  'Aucun absolu non source dans les consignes (pas de "jamais/toujours" nus).\n\n' +
+  'Tache a decouper :\n' + tache,
+  { label: 'analyse-decoupage', phase: 'Decoupage', model: 'sonnet', schema: PLAN_SCHEMA }
+);
+// Le schema est une consigne forte, pas un contrat absolu : un retour nul ou
+// difforme (agent saute, erreur terminale) doit finir en verdict propre, pas en
+// TypeError qui avorte le workflow.
+if (!decoupe || !Array.isArray(decoupe.etapes) || decoupe.etapes.length === 0) {
+  return { ok: false, erreur: 'decoupage vide ou difforme : aucune etape exploitable', tache };
+}
+log(`Decoupage : ${decoupe.etapes.length} etape(s) — ${decoupe.resume}`);
+
+// --- Phase 2 : ROUTAGE (pur code, zero agent)
+phase('Routage');
+const NATURES_CODEX = ['shell', 'deploiement', 'navigation'];
+function moteurPour(nature) {
+  if (nature === 'verification') return 'claude'; // ligne rouge : jamais delegue
+  return NATURES_CODEX.includes(nature) ? 'codex' : 'claude';
+}
+// Echelle v3 par complexite (miroir de dispatch-router.claudeModelForComplexity).
+function modeleClaudePour(cx) {
+  if (cx < 34) return 'haiku';
+  if (cx < 67) return 'sonnet';
+  if (cx < 90) return 'opus';
+  return 'fable'; // extreme : dernier recours (~2x le prix d Opus)
+}
+const table = decoupe.etapes.map((e) => {
+  const moteur = moteurPour(e.nature);
+  // Une etape de verification herite du modele de session (opts.model omis) ;
+  // toute autre etape porte le modele de l echelle. Une etape routee Codex est
+  // pilotee par un agent Claude (au modele de l echelle) qui tente `codex exec`
+  // et replie sur Claude si Codex n est pas disponible.
+  const modele = e.nature === 'verification' ? null : modeleClaudePour(e.complexite);
+  return { ...e, moteur, modele };
+});
+for (const l of table) {
+  log(`Routage ${l.id} "${l.titre}" : nature=${l.nature} complexite=${l.complexite} -> moteur=${l.moteur} modele=${l.modele || 'session'}`);
+}
+
+// --- Phase 3 : PLAN (contenu construit en pur code, ecrit par un agent mecanique)
+phase('Plan');
+const lignesTable = table.map((l) =>
+  `| ${l.id} | ${l.titre} | ${l.nature} | ${l.complexite} | ${l.moteur} | ${l.modele || 'modele de session'} |`
+);
+const planMd = [
+  '# Plan de dispatch — ' + decoupe.resume,
+  '',
+  `- Tache d origine : ${tache.replace(/\n/g, ' ').slice(0, 300)}`,
+  `- Genere par : workflow natif byan-auto-dispatch (${stamp})`,
+  '- Echelle de routage : haiku < 34, sonnet < 67, opus < 90, fable >= 90 (par complexite) ;',
+  '  moteur Codex pour shell/deploiement/navigation (repli Claude si indisponible) ;',
+  '  la verification reste sur le modele de session, non deleguee.',
+  '',
+  '| Etape | Titre | Nature | Complexite | Moteur | Modele |',
+  '|-------|-------|--------|------------|--------|--------|',
+  ...lignesTable,
+  '',
+  '## Consignes par etape',
+  '',
+  ...table.map((l) => `### ${l.id} — ${l.titre}\n\n${l.consigne}\n`),
+].join('\n');
+await agent(
+  'Ecris EXACTEMENT le contenu ci-dessous dans le fichier _byan-output/plan.md ' +
+  '(cree le dossier _byan-output s il n existe pas ; remplace le fichier s il existe). ' +
+  'N ajoute rien, ne corrige rien, ne commente rien. Reponds "ecrit" quand c est fait.\n\n' +
+  '--- CONTENU A ECRIRE TEL QUEL ---\n' + planMd,
+  { label: 'mech-ecrire-plan', phase: 'Plan', model: 'sonnet' }
+);
+log('Plan ecrit : _byan-output/plan.md');
+
+// --- Phase 4 : EXECUTION (sequentielle : les etapes d une meme tache partagent
+// souvent des fichiers ; le contexte des etapes precedentes est transmis borne)
+phase('Execution');
+const resultats = [];
+for (const l of table) {
+  const contexte = resultats.length
+    ? '\n\nResultats des etapes precedentes (contexte) :\n' +
+      resultats.map((r) => `- ${r.id} (${r.titre}) : ${String(r.resultat).slice(0, 1200)}`).join('\n')
+    : '';
+  const consigneCodex =
+    l.moteur === 'codex'
+      ? '\n\nCette etape est routee vers CODEX : lance `codex exec` en lecture seule pour obtenir un diff unifie, ' +
+        'puis applique le diff toi-meme (`git apply`). Si la commande `codex` n est pas disponible ou echoue, ' +
+        'dis-le en une phrase et fais l etape toi-meme sur Claude (repli prevu).'
+      : '';
+  // Un echec dur d une etape (agent saute, erreur terminale) ne doit pas avorter
+  // le workflow : il est enregistre comme resultat KO et la verification finale
+  // le jugera — jamais de coupe silencieuse, jamais d abandon muet.
+  let res;
+  try {
+    res = await agent(
+      `Etape ${l.id} — ${l.titre} (nature ${l.nature}, complexite ${l.complexite}).\n` +
+      'Execute la consigne ci-dessous, completement. Rapporte ce qui a ete fait, les fichiers touches, ' +
+      'et toute impossibilite REELLE rencontree (dis le fait exact, pas une image).\n\n' +
+      'Consigne :\n' + l.consigne + consigneCodex + contexte,
+      {
+        label: `etape-${l.id}`,
+        phase: 'Execution',
+        ...(l.modele ? { model: l.modele } : {}),
+      }
+    );
+  } catch (e) {
+    res = null;
+  }
+  if (res == null) res = `ECHEC : l etape ${l.id} n a pas rendu de resultat (agent interrompu ou en erreur).`;
+  resultats.push({ id: l.id, titre: l.titre, moteur: l.moteur, modele: l.modele || 'session', resultat: res });
+  log(`Execution ${l.id} terminee (modele=${l.modele || 'session'})`);
+}
+
+// --- Phase 5 : VERIFICATION (modele de session, jamais delegue)
+phase('Verification');
+const verdict = await agent(
+  'Tu es le controleur (tu n as PAS fait le travail). Verifie le resultat de chaque etape ' +
+  'contre la tache d origine : livre reellement ? teste quand testable ? rien coupe en silence ?\n' +
+  'Rends : VERDICT: OK ou VERDICT: KO en premiere ligne, puis une ligne par etape (id, tenu/manque, le fait exact).\n\n' +
+  `Tache d origine :\n${tache}\n\n` +
+  'Resultats :\n' +
+  resultats.map((r) => `--- ${r.id} ${r.titre} ---\n${String(r.resultat).slice(0, 2000)}`).join('\n\n'),
+  { label: 'verifie-livrable', phase: 'Verification' }
+);
+
+const ok = /^\s*VERDICT:\s*OK/i.test(String(verdict));
+log(`Verification : ${ok ? 'OK' : 'KO'}`);
+return {
+  ok,
+  tache: decoupe.resume,
+  plan: '_byan-output/plan.md',
+  table: table.map(({ consigne, ...reste }) => reste),
+  resultats: resultats.map((r) => ({ ...r, resultat: String(r.resultat).slice(0, 2000) })),
+  verdict: String(verdict),
+};

package/install/templates/_byan/agent/byan/byan-tao.md

@@ -167,6 +167,14 @@ Exemple : "Attends. Ca touche au noyau. On est jamais assez parano. Qu'est-ce qu
 **Pourquoi :** Mantra IA-26. On forge une ame, pas un token.
 **Au lieu de ca :** le verbe reel ("generer un token", "creer un token")
 
+**Interdit :** dire qu'un outil, un MCP ou un serveur est "vivant" ou "mort"
+**Pourquoi :** Mantra IA-26. L'anthropomorphisme cache le fait ; l'utilisateur veut la mesure, pas l'image.
+**Au lieu de ca :** le fait observe, outil nomme : "byan_ping a repondu en 0.3s", "le serveur ne repond pas (timeout 8s)"
+
+**Interdit :** le vocabulaire Claude interne en prose ("nudge", "up-tier", "ladder", "rung", "runtime")
+**Pourquoi :** Mantra IA-26. C'est le dialecte de l'outillage, pas une langue.
+**Au lieu de ca :** rappel injecte, monter en gamme, echelle, palier, moteur d'execution
+
 ---
 
 ### Section 5 — Non-dits

package/install/templates/_byan/mcp/byan-mcp-server/lib/dispatch-router.js

@@ -2,26 +2,27 @@
 // given a task's NATURE and COMPLEXITY, decide which RUNTIME runs it (Codex or
 // Claude), which MODEL, and (Codex only) which reasoning EFFORT.
 //
-// It composes with, does not duplicate, native-tiers.js: the Claude-side model
-// tier is delegated to that module's TIER_MODEL vocabulary (which, by design,
-// only ever yields haiku / sonnet / null — so Fable can never leak in from the
-// Claude side either). This module adds the two NEW axes the intelligent dispatch
-// needs — runtime selection and Codex reasoning effort — on top of it.
+// The Claude-side model is a FOUR-rung complexity ladder (v3):
+// haiku -> sonnet -> opus -> fable, fable being the last-resort top-reasoning
+// model reserved for EXTREME complexity (~2x Opus price). See
+// claudeModelForComplexity. This module adds the two NEW axes the intelligent
+// dispatch needs — runtime selection and Codex reasoning effort — on top of it.
 //
 // Routing table is the cross-checked result (5 independent sources, see
 // docs / CHANGELOG): Codex wins autonomous execution, shell/CI/DevOps, deploy,
 // browser/computer use ; Claude wins architecture, refactor-at-repo-scale,
 // quality, planning, and ALL verification. Two hard red lines are enforced here,
 // not left to the caller:
-//   1. Fable is NEVER emitted (long-term product decision).
+//   1. Fable is NEVER routed to CODEX (Codex runs the ChatGPT-subscription model,
+//      it cannot run a Claude model at all). On the CLAUDE side Fable IS allowed,
+//      but only at the extreme rung (v3 product reversal — the old blanket ban is
+//      lifted). assertNoFable therefore guards the Codex path only.
 //   2. Verification is NEVER routed to Codex (a runtime must not grade its own
 //      work ; the reviewer stays on Claude).
 //
 // Pure: no I/O, no clock, deterministic. The Codex transport (F2) and the
 // orchestrating loop (F4) consume this; they never re-decide routing.
 
-import { TIER_MODEL } from './native-tiers.js';
-
 export const RUNTIMES = Object.freeze({ CODEX: 'codex', CLAUDE: 'claude' });
 
 // Codex runs on the ChatGPT-subscription entitled model. Kept as a named constant
@@ -30,8 +31,10 @@ export const CODEX_MODEL = 'gpt-5.4';
 
 export const EFFORTS = Object.freeze({ LOW: 'low', MEDIUM: 'medium', HIGH: 'high' });
 
-// Models we refuse to emit, ever. Fable is excluded by explicit long-term
-// decision; the guard makes that refusal mechanical rather than a convention.
+// Models we refuse to emit on the CODEX path. Codex runs the ChatGPT-subscription
+// model and cannot run a Claude model — Fable on Codex is a category error, so the
+// guard makes that refusal mechanical. (On the CLAUDE path Fable is allowed at the
+// extreme rung — see claudeModelForComplexity ; this list does not gate it.)
 export const FORBIDDEN_MODELS = Object.freeze(['fable', 'claude-fable-5']);
 
 // Task natures that route to Codex. Everything NOT here (and not a verification
@@ -58,12 +61,14 @@ function matchesAny(text, list) {
   return list.some((kw) => text.includes(kw));
 }
 
-// assertNoFable(model) — mechanical enforcement of red line #1. Throws rather
-// than silently substituting, so a Fable request is a loud failure at the source.
+// assertNoFable(model) — mechanical enforcement of red line #1 on the CODEX path.
+// Throws rather than silently substituting, so a Fable-on-Codex request is a loud
+// failure at the source (Codex cannot run a Claude model). It does NOT gate the
+// Claude path, which may legitimately emit Fable at the extreme rung.
 export function assertNoFable(model) {
   const m = normalize(model);
   if (FORBIDDEN_MODELS.some((f) => m.includes(f))) {
-    throw new Error(`dispatch-router: forbidden model "${model}" (Fable is excluded by long-term policy)`);
+    throw new Error(`dispatch-router: forbidden model "${model}" on the Codex path (Codex cannot run a Claude model)`);
   }
   return model;
 }
@@ -106,28 +111,41 @@ export function effortForComplexity(complexity) {
   return complexityBucket(complexity);
 }
 
-// claudeModelForComplexity(complexity) -> 'haiku' | 'sonnet' | null(omit=inherit).
-// Delegates to native-tiers' TIER_MODEL so the Claude vocabulary stays in one
-// place: low -> cheap(haiku), medium -> balanced(sonnet), high -> deep(null =
-// inherit the session model, i.e. Opus on an Opus session). Fable is structurally
-// impossible here (TIER_MODEL has no Fable entry), but we still assert to make the
-// guarantee explicit and catch a future TIER_MODEL drift.
+// claudeModelForComplexity(complexity) -> the Claude-side model RECOMMENDATION on
+// a FOUR-rung complexity ladder (v3): haiku -> sonnet -> opus -> fable.
+//   - < 34  : haiku   (trivial / low)
+//   - < 67  : sonnet  (medium)
+//   - < 90  : opus    (high — the default frontier)
+//   - >= 90 : fable   (extreme complexity, LAST RESORT)
+// Fable is the top-reasoning model : strongest on the intelligence index but
+// ~2x the price of Opus, so it is reserved for the extreme rung only. This is a
+// per-task RECOMMENDATION consumed by the dispatch orchestrator / skill — NOT a
+// live switch of the running session model (Claude Code exposes no such switch).
+// Labels map too (trivial/low/medium/high/extreme). The old blanket "never Fable"
+// red line is lifted on the CLAUDE side (deliberate v3 product reversal); it still
+// holds on the CODEX side (see dispatch() + assertNoFable + codex-bridge).
 export function claudeModelForComplexity(complexity) {
-  const bucket = complexityBucket(complexity);
-  const model = bucket === EFFORTS.LOW
-    ? TIER_MODEL.cheap
-    : bucket === EFFORTS.MEDIUM
-      ? TIER_MODEL.balanced
-      : TIER_MODEL.deep; // null = inherit (never pinned to Fable)
-  return model == null ? null : assertNoFable(model);
+  if (typeof complexity === 'number' && Number.isFinite(complexity)) {
+    if (complexity < 34) return 'haiku';
+    if (complexity < 67) return 'sonnet';
+    if (complexity < 90) return 'opus';
+    return 'fable';
+  }
+  const c = normalize(complexity);
+  if (['trivial', 'low', 'simple', 'easy'].includes(c)) return 'haiku';
+  if (['medium', 'moderate'].includes(c)) return 'sonnet';
+  if (['extreme', 'frontier', 'max'].includes(c)) return 'fable';
+  if (['high', 'hard', 'complex'].includes(c)) return 'opus';
+  return 'sonnet'; // unknown -> a safe middle
 }
 
 // dispatch({ nature, complexity }) -> the full routing decision:
 //   { runtime, model, effort, reasoning }
 // - Codex: model = CODEX_MODEL, effort = complexity bucket (the real knob).
-// - Claude: model = haiku/sonnet/null(inherit), effort = null (Claude has no
-//   effort knob — its "effort" IS the model tier).
-// Both red lines are enforced here regardless of caller input.
+// - Claude: model = haiku/sonnet/opus/fable on the complexity ladder, effort =
+//   null (Claude has no effort knob — its "effort" IS the model tier).
+// The red lines are enforced here regardless of caller input: Codex keeps its
+// no-Fable guard ; verification stays on Claude.
 export function dispatch({ nature, complexity } = {}) {
   const runtime = routeRuntime(nature);
   if (runtime === RUNTIMES.CODEX) {
@@ -140,7 +158,7 @@ export function dispatch({ nature, complexity } = {}) {
   }
   return {
     runtime,
-    model: claudeModelForComplexity(complexity), // null = inherit session model
+    model: claudeModelForComplexity(complexity), // haiku/sonnet/opus/fable by complexity
     effort: null, // Claude effort = model tier, no separate knob
     reasoning: isVerification(nature)
       ? 'verification stays on Claude (red line: a runtime never grades its own work)'

package/install/templates/_byan/mcp/byan-mcp-server/lib/native-tiers.js

@@ -40,6 +40,17 @@ export const TIERS = Object.freeze({ CHEAP: 'cheap', BALANCED: 'balanced', DEEP:
 // flags every script literal that drifts from it, so the fan-out stays bounded.
 export const TIER_MODEL = Object.freeze({ cheap: 'haiku', balanced: 'sonnet', deep: null });
 
+// UP-TIER models (v3). The auto-routing above never pins UP (the default stays
+// cost-safe: deep = inherit the session model). But an author MAY deliberately
+// raise a genuinely complex leaf ABOVE the inherited tier — 'opus' for a hard
+// leaf, 'fable' as the last-resort top-reasoning model for extreme complexity
+// (~2x Opus price). This is the workflow-leaf mirror of the dispatch-router
+// complexity ladder (haiku -> sonnet -> opus -> fable). Up-tier pins are an
+// explicit authoring choice: the anti-DOWNGRADE floor does not apply upward, so
+// the linter ALLOWS them (they cost more, they never regress quality). The old
+// blanket "never pin up / never Fable" ban on leaves is lifted here.
+export const UP_TIER_MODELS = Object.freeze(['opus', 'fable']);
+
 // Leaf task-type taxonomy. EXPLORATION (cheap) and MECHANICAL + ANALYSIS
 // (balanced) are the downgrade classes; VERIFICATION and IMPLEMENTATION stay
 // protected (deep, inherit the session model). MECHANICAL is verification whose
@@ -130,18 +141,26 @@ export function modelForLeaf(leaf) {
   return TIER_MODEL[tierFor(classifyLeaf(leaf))];
 }
 
-// isKnownTierModel(modelId) -> true if modelId is one of the concrete downgrade
-// models (cheap/balanced). Used by the linter to reject an opts.model literal
-// that is not a recognised tier. null/'' are not "known" (deep = omission, not a
-// literal). 'opus' is intentionally NOT known — we never pin up.
+// isUpTierModel(modelId) -> true if modelId pins a leaf ABOVE the inherited tier
+// (opus or fable). An explicit, allowed authoring choice for a genuinely complex
+// leaf (v3): the anti-downgrade floor does not apply upward.
+export function isUpTierModel(modelId) {
+  return !!modelId && UP_TIER_MODELS.includes(modelId);
+}
+
+// isKnownTierModel(modelId) -> true if modelId is a recognised tier literal:
+// a downgrade model (cheap/balanced = haiku/sonnet) OR an up-tier model
+// (opus/fable). Used by the linter to reject an opts.model literal that is not in
+// the vocabulary at all. null/'' are not "known" (deep = omission, not a literal).
 export function isKnownTierModel(modelId) {
   if (!modelId) return false;
-  return Object.values(TIER_MODEL).filter(Boolean).includes(modelId);
+  return Object.values(TIER_MODEL).filter(Boolean).includes(modelId) || isUpTierModel(modelId);
 }
 
 // isDowngradeModel(modelId) -> true if modelId pins a leaf BELOW the inherited
 // tier (cheap or balanced). The linter's anti-downgrade rule uses this: a
-// protected leaf must never carry a downgrade model.
+// protected leaf must never carry a downgrade model. Up-tier models return false
+// (they are not downgrades — see isUpTierModel).
 export function isDowngradeModel(modelId) {
   return modelId === TIER_MODEL.cheap || modelId === TIER_MODEL.balanced;
 }

package/install/templates/_byan/mcp/byan-mcp-server/lib/tier-script.js

@@ -15,7 +15,7 @@
 // passes — the gate forces a decision, it does not trap the turn.
 
 import crypto from 'node:crypto';
-import { classifyLeaf, tierFor, TIER_MODEL, TIERS, LEAF_TYPES } from './native-tiers.js';
+import { classifyLeaf, tierFor, TIER_MODEL, TIERS, LEAF_TYPES, isUpTierModel } from './native-tiers.js';
 import { stripComments, extractLabelledLeaves } from './workflows-lint.js';
 
 // Acknowledgment marker, raw-text (comment form survives comment-stripping
@@ -26,15 +26,19 @@ export const ACK_RE = /BYAN-TIER:\s*reviewed\b/;
 
 function verdictFor(cls, model) {
   const expected = TIER_MODEL[tierFor(cls)]; // 'haiku' | 'sonnet' | null (inherit)
+  // Up-tier pins (opus/fable) are always allowed (v3): the author deliberately
+  // raises a complex leaf ABOVE the inherited tier. The anti-DOWNGRADE floor does
+  // not apply upward — it costs more but never regresses quality.
+  if (isUpTierModel(model)) return 'ok';
   if (expected === null) {
-    // Protected class: any pinned model is a downgrade or a pin-up — both wrong.
+    // Protected class: a downgrade pin is still wrong (up-tier handled above).
     return model === null ? 'ok' : 'violation';
   }
   if (model === null) return 'missing-tier';
   if (model === expected) return 'ok';
   // Exploration may ride ABOVE its floor (sonnet on a cheap leaf wastes a
-  // little, breaks nothing). Anything else — haiku on mech-, opus anywhere —
-  // is below a declared tier or an unknown pin.
+  // little, breaks nothing). Anything else — haiku on mech- — is below a
+  // declared tier.
   if (cls === LEAF_TYPES.EXPLORATION && model === TIER_MODEL[TIERS.BALANCED]) return 'ok';
   return 'violation';
 }

package/install/templates/_byan/mcp/byan-mcp-server/lib/workflows-lint.js

@@ -153,10 +153,15 @@ export function modelRoutingViolations(src) {
     if (!isKnownTierModel(model)) {
       out.push({
         id: 'unknown-tier-model',
-        msg: `opts.model '${model}' is not a known downgrade tier (cheap/balanced); never pin up — omit opts.model to inherit the session model on deep leaves`,
+        msg: `opts.model '${model}' is not a recognised tier (downgrade: haiku/sonnet ; up-tier: opus/fable); omit opts.model to inherit the session model on deep leaves`,
       });
       continue;
     }
+    // Up-tier pins (opus/fable) are an allowed explicit authoring choice: they
+    // raise a complex leaf ABOVE the inherited tier. The anti-downgrade floor does
+    // not apply upward, and no label is required (v3). Only DOWNGRADES are gated
+    // below.
+    if (!isDowngradeModel(model)) continue;
     const label = nearestLabelBefore(code, m.index);
     if (!label) {
       out.push({
@@ -165,7 +170,6 @@ export function modelRoutingViolations(src) {
       });
       continue;
     }
-    if (!isDowngradeModel(model)) continue;
     // Per-class floor: exploration accepts any downgrade tier (haiku or sonnet,
     // both at-or-above its cheap floor); a mech- leaf accepts exactly the
     // balanced tier (haiku would sit BELOW the tier its label declares); every

package/install/templates/_byan/mcp/byan-mcp-server/skill-bundles-manifest.json

@@ -94,7 +94,7 @@
       "name": "byan-byan",
       "module": "core",
       "tier": "connector-bound",
-      "sourceHash": "84fa718d638f1ddb37796c9b80c702fca48350decb40979bd1adea1452224abc"
+      "sourceHash": "65c1034479457298f89c25405d4be7e840ef18d9df3102f1f224b59e3094b20c"
     },
     "byan-byan-v2": {
       "name": "byan-byan-v2",

package/install/templates/docs/codex-auto-delegation.md

@@ -10,11 +10,23 @@ work crosses the line.
 ## What it does
 
 Every turn, a `UserPromptSubmit` hook estimates how much of the Claude 5h window
-you have burned and looks at the task you just asked for. If the task is
-delegable (code / mechanical) — or if you are over the pressure threshold — BYAN
-injects a one-line note directing you to hand it to Codex via
+you have burned. When you are over the pressure threshold (default **75%**), BYAN
+injects a one-line note directing you to hand the delegable work to Codex via
 `codex:codex-rescue --model gpt-5.4`. You still verify Codex's output before commit.
 
+**v3 — pressure-only, and the router decides Codex vs Claude.** Two deliberate
+changes from v2:
+
+- **Pressure is the only auto-trigger (F1).** A delegable-looking task no longer
+  proposes Codex on its own. Delegating to the subscription Codex (which trails
+  Claude on quality — see below) is worth it to SPARE the Claude budget, not per
+  coding task. So off-pressure, code runs on Claude with no nag.
+- **The guard obeys the router (F2).** WHERE a task runs (Codex vs Claude) is the
+  `dispatch-router`'s call, by task nature: execution / shell / deploy / devops /
+  browser -> Codex ; architecture / refactor / quality / planning + all
+  verification -> Claude. The delegation guard only bites for a task the router
+  itself routes to Codex.
+
 **Both engines must be present.** The lane only arms — and the note only fires —
 when TWO conditions hold together: the yanstaller option wrote
 `_byan/_config/autodelegate.json` with `enabled:true`, AND Codex is actually
@@ -23,25 +35,38 @@ linked on this machine (`~/.codex/auth.json` from `codex login`, or
 This is the runtime `codexLinked()` gate in `codex-autodelegate.js`, the mirror of
 the installer's arm-time `codexAuthState` check.
 
-**Armed = directive, not advice.** Because the note only appears when the lane is
-armed (both engines present), it reads as a directive: delegate the delegable
-part, fall back to Claude only if Codex is unavailable. When the lane is not
-armed, no note is injected and everything runs on Claude — there is nothing to
-decide. Honest ceiling: Claude Code has no control point before a response is
-shown, so this stays model-driven doctrine (BYAN delegates because the skill's
-entry chain and this note say so), not a mechanism enforced before display.
-
-Three triggers, in priority order:
-
-1. **Pressure** — estimated Claude 5h usage `>= threshold` (default **80%**) ->
-   propose offloading **everything** delegable this session.
-2. **Nature** — the request looks like delegable coding work -> propose handing
-   **that** task over. Works with no gauge at all.
-3. **Perf** (opt-in, off by default) — a configurable forces table says Codex is
+**Armed = directive, enforced by a guard (option B + v3).** Because the note only
+appears when the lane is armed (both engines present), it reads as a directive:
+delegate the delegable part. And it is not just prose — the `codex-delegate-guard`
+PreToolUse hook DENIES a **code** Write/Edit that skipped Codex, but ONLY when all
+of these hold together (v3): the lane is armed, the ROUTER routes this task to
+Codex, you are under budget PRESSURE, and Codex is available. Miss any one and it
+allows. The two per-turn ways to stay on Claude are (1) Codex unavailable
+(auto-detected via `codex --version`), or (2) the USER opted out — the
+`.byan-codex-autodelegate/off` switch, or a phrase like "reste sur Claude" /
+"sans codex" in the request. The "small script / latency / I verify anyway"
+excuse is explicitly NOT valid: that was the self-dodge (a
+`// BYAN-DELEGATE: reviewed` marker BYAN wrote itself) that option B removed. BYAN
+can no longer self-grant a bypass; only the human can.
+
+The deny is a wall against BYAN's silent self-dodge, not a trap for the user: the
+human keeps the escape switch and the opt-out phrase, a doc/config write (not
+code) does not trip it, and off-pressure OR router-to-Claude nothing bites at all.
+Honest ceiling: Claude Code has no control point before a response is shown, so
+the *choice* to delegate stays model-driven; the guard acts one step later, at the
+Write, denying the skip.
+
+The auto-trigger, plus one opt-in:
+
+1. **Pressure (F1, the only auto-trigger)** — estimated Claude 5h usage
+   `>= threshold` (default **75%**) -> propose offloading **everything** delegable
+   this session. Needs a `budget` gauge; without one, pressure stays uncomputed
+   and nothing is proposed (documented, non-blocking).
+2. **Perf** (opt-in, off by default) — a configurable forces table says Codex is
    reputed stronger for this kind of task. See "Perf routing" below.
 
 **The red line** (held): only delegable natures are proposed. Judgment,
-analysis, soul and verification stay on Claude.
+analysis, soul and verification stay on Claude — and the router keeps them there.
 
 ## Enable it
 
@@ -97,8 +122,8 @@ pins `--model gpt-5.4`. See `src/loadbalancer/providers/codex-provider.js`
 | Key | Default | Meaning |
 |-----|---------|---------|
 | `enabled` | `true` (once written) | Master switch. Delete the file or set `false` to disarm. |
-| `threshold` | `80` | Pressure percentage that flips to "offload everything delegable". |
-| `budget` | `null` | Your plan's rough token ceiling for the 5h window. Without it, `pct` is null and only the nature trigger fires (see caveat). |
+| `threshold` | `75` | Pressure percentage that flips to "offload everything delegable" (v3: aligned with the guard's pressure floor). |
+| `budget` | `null` | Your plan's rough token ceiling for the 5h window. Without it, `pct` is null, pressure stays uncomputed, and nothing is auto-proposed (v3 pressure-only; see caveat). |
 | `invocation` | `codex:codex-rescue --model gpt-5.4` | What the nudge tells BYAN to run. |
 | `perfRouting` | `false` | Enable the perf trigger. |
 | `perfForces` | `[]` | The forces table (see below). |
@@ -114,11 +139,12 @@ without editing the config; remove it to re-enable.
   your local transcripts (`~/.claude/projects/*/*.jsonl`) over the rolling 5h
   window, weighting cache reads at 0.1 (they are billed roughly a tenth and
   repeat every turn). It is proportional, not exact — and `pct` is only computed
-  when you set a `budget`. Without a budget, delegation runs on the nature
-  trigger alone.
+  when you set a `budget`. Without a budget, pressure stays uncomputed and the
+  auto-trigger stays silent (v3 pressure-only).
 - **`~/.claude` is a native accelerator, not a source of truth** (PORTABLE-3).
-  If it is absent the estimator degrades to `pct: null` and the feature falls
-  back to nature-based delegation. The feature keeps working.
+  If it is absent the estimator degrades to `pct: null`, so pressure cannot be
+  computed and the auto-trigger stays silent. Code still runs on Claude normally;
+  the feature keeps working, it just does not auto-propose Codex.
 - **Perf routing is a heuristic below the L2 floor.** "Model X is better at task
   Y" is a performance claim; BYAN's fact-check floor for performance is L2 (a
   reproducible benchmark). A community arena such as designarena.ai is weaker

package/install/templates/docs/intelligent-dispatch.md

@@ -22,17 +22,21 @@ task-type signal is used, which is stable across sources.
 
 ## Model and effort by complexity
 
-- **Claude side**: complexity picks the model tier via `native-tiers` —
-  low -> haiku, medium -> sonnet, high -> inherit the session model (Opus). There
-  is no separate effort knob on Claude: the model tier IS the effort. Fable is
-  excluded (the router does not emit it).
+- **Claude side**: complexity picks the model on a four-rung ladder (v3) —
+  low -> haiku, medium -> sonnet, high -> opus, extreme -> fable (last resort,
+  ~2x Opus price). There is no separate effort knob on Claude: the model tier IS
+  the effort. This is a per-task RECOMMENDATION, not a live switch of the running
+  session model (Claude Code exposes no such switch).
 - **Codex side**: fixed model (`gpt-5.4`, the entitled subscription model) with a
   real reasoning-effort knob — low / medium / high — scaled to complexity via
   `codex exec -c model_reasoning_effort=...`.
 
 ## The three red lines (enforced in code, not left to the caller)
 
-1. **No Fable.** `assertNoFable` throws rather than emit a Fable model.
+1. **No Fable on Codex.** `assertNoFable` throws rather than emit a Fable model on
+   the Codex path (Codex runs the ChatGPT-subscription model and cannot run a
+   Claude model). On the Claude path Fable IS allowed, but only at the extreme
+   complexity rung (v3 product reversal — the old blanket ban is lifted).
 2. **Verification stays on Claude.** The router forces a verification nature to
    Claude ; the orchestrator re-asserts it and throws if it ever regresses.
 3. **Codex does not write.** Codex runs read-only and returns a unified diff ;