devlyn-cli 2.10.0 → 3.0.0

package/AGENTS.md

@@ -4,7 +4,7 @@ devlyn-cli installs `/devlyn:ideate` (optional) and `/devlyn:resolve` (required)
 
 ## North Star
 
-This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. The harness must measurably out-earn bare prompting, and every added layer (pair mode, probes, gates) must out-earn the layer below it. When rules below conflict or feel ambiguous in context, resolve toward this goal.
+This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. When rules below conflict or feel ambiguous in context, resolve toward this goal.
 
 ## Core principles
 
@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
-6. **Optimized** — efficient on the resource that matters (wall-time, tokens, attention, cognitive load on the next reader). "Slower but more thoughtful" is not free.
+6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
 
 Three discipline rules govern HOW the principles are applied:
@@ -36,9 +36,9 @@ ideate (optional)  ->  resolve  ->  ship
 
 Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not duplicate.
 
-Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md; measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when this AGENTS.md was present in the project (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4). If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); executor (PLAN/IMPLEMENT/CLEANUP) defaults to `claude`, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine — instead of editing as `claude`; no pin / no file → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
+Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md. If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); legacy executor (with optional separate worker/primary/pair profiles) uses the canonical skill's orchestrator-supported default, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine; no pin / no file → use the canonical skill's orchestrator-supported default. The pair-judge pin stays pipeline-scoped. `/devlyn:engines role` configures explicit engine/model/effort for supported worker and judge routes; `/devlyn:resolve --role-config <path>` overrides roles for one run. Canonical skills define precedence, evidence and unsupported-route errors; absent profiles preserve existing defaults.
 
-Conversational handoff + loop engineering (default entry): the orchestrating model — not the user — invokes the skills. `/devlyn:queue` fronts the intent queue (`docs/specs/queue.md`): no args = status, `add <intent>`, `drain` = serial unattended drain per the contract below. Large agreed work is written to `docs/specs/<id>/spec.md` (always a spec file — the user's reviewed contract; free-form large assumes-and-logs instead of halting, zero-scope-signal goals still halt to ideate), summarized once for user review, then run hands-free via `--spec`. Outer loop per task: findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) get spec amendment + re-run, max 3 iterations; infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts surface immediately. Unattended queue drain (`docs/specs/queue.md`, strictly serial): assumptions may only take scope-narrowing, reversible, non-user-visible defaults — material ambiguity marks the item `[F] needs-review` and the drain continues.
+Conversational handoff + loop engineering (default entry): the orchestrating model — not the user — invokes the skills. `/devlyn:queue` fronts the intent queue (`docs/specs/queue.md`): no args = status, `add <intent>`, `drain` = serial unattended drain per the contract below. Large agreed work is written to `docs/specs/<id>/spec.md` (always a spec file — the user's reviewed contract; free-form large assumes-and-logs instead of halting, zero-scope-signal goals still halt to ideate), summarized once for user review, then run hands-free via `--spec`. Outer loop per task: before the first full run, commit the scoped queue-item delta (when applicable) and linked spec bundle; findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) get a committed spec amendment before re-run, max 3 iterations; infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts surface immediately. Unattended queue drain (`docs/specs/queue.md`, strictly serial): assumptions may only take scope-narrowing, reversible, non-user-visible defaults — material ambiguity marks the item `[F] needs-review`; commit every terminal `[x]` / `[F]` transition before advancing. The canonical commit order is `config/skills/devlyn:resolve/references/outer-loop.md`.
 
 ## Subtractive-First Editing
 
@@ -103,13 +103,8 @@ Exclude vague claims. They produce vague fixes.
 - Never revert user changes unless explicitly asked.
 - Use `rg` / `rg --files` for search.
 - Keep changes scoped to the task; stop when the core request is answered or the change is verified.
-- For installer or skill edits inside the devlyn-cli source repo, run `bash scripts/lint-skills.sh`.
 - Treat the project's own `docs/VISION.md`, `docs/ROADMAP.md`, `docs/roadmap/**`, and any local `AGENTS.md` / `CLAUDE.md` overrides as authoritative when present.
 
-### Evolution loop — orchestrator-neutral continuation
-
-Any orchestrating engine (Claude, Codex, or future) continuing harness / loop-engineering work cold-starts from `autoresearch/HANDOFF.md` (read order inside), then `autoresearch/NORTH-STAR.md` (goal + floor/ceiling contracts + ops-test gates) and `autoresearch/PRINCIPLES.md`. Instruments and gates are scripts + files, never model memory. The pair partner is the strongest available OTHER engine — the protocol is direction-symmetric (iter-0060). On any model/version change, re-certify engine seats with the seat-fitness instrument before re-pinning `.devlyn/engines.json` (NORTH-STAR ceiling contract; iter-0064).
-
 ## Communication
 
 - Lead with objective evidence before opinion.

package/CLAUDE.md

@@ -4,7 +4,7 @@ devlyn-cli installs `/devlyn:ideate` (optional) and `/devlyn:resolve` (required)
 
 ## North Star
 
-This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. The harness must measurably out-earn bare prompting, and every added layer (pair mode, probes, gates) must out-earn the layer below it. When rules below conflict or feel ambiguous in context, resolve toward this goal.
+This contract serves one goal: any capable engine — Claude, GPT/Codex, or a future adapter-equipped model — takes a user's intent (prompt, spec, or queue entry) end-to-end to shipped, engineer-quality software, hands-free, with consistent quality across engines. When rules below conflict or feel ambiguous in context, resolve toward this goal.
 
 ## Core principles
 
@@ -15,7 +15,7 @@ Seven rules govern every change. Cite them by name when a decision touches one.
 3. **No guesswork** — verify with the actual files, logs, diffs, and run output before forming conclusions. State the falsifiable prediction BEFORE the experiment; record raw results AFTER. Retroactive prediction edits are dishonest.
 4. **Worldclass** — code that survives review at a non-trivial codebase. Zero CRITICAL, zero HIGH security/design findings on the shippable path.
 5. **Best practice** — idiomatic for the language and framework. Use standard primitives; do not hand-roll what the library already provides.
-6. **Optimized** — efficient on the resource that matters (wall-time, tokens, attention, cognitive load on the next reader). "Slower but more thoughtful" is not free. Each layer of composition or process must beat the simpler baseline.
+6. **Optimized** — use efficient code and avoid unnecessary work without sacrificing correctness or the user's requirements.
 7. **Production ready** — error states are explicit and visible; behavior under failure is what the user expects, not silent corruption.
 
 Three discipline rules govern HOW the principles are applied:
@@ -39,15 +39,15 @@ Each skill's `SKILL.md` is the source of truth for its flags and workflow — do
 
 | Role | Default | Manual override |
 |---|---|---|
-| Orchestrator — conversation, handoff, loop driving | whichever CLI you open (contract is symmetric: CLAUDE.md ↔ AGENTS.md). Measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when the project carried the devlyn AGENTS.md (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4) | switch CLIs; the file artifacts (spec/queue/state) carry over |
-| Executor — PLAN/IMPLEMENT/CLEANUP + primary VERIFY judge | `claude` | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
+| Orchestrator — conversation, handoff, loop driving | whichever CLI you open (contract is symmetric: CLAUDE.md ↔ AGENTS.md) | switch CLIs; the file artifacts (spec/queue/state) carry over |
+| Legacy executor — worker/primary unless separately profiled; PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin | canonical skill's orchestrator-supported default | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
 | Pair judge — default for VERIFY; conditional for risk probes | first available OTHER engine (claude↔codex) | `/devlyn:engines pair <name>,...`; `--no-pair` opts out |
 
 `/devlyn:engines` with no args shows the current role table, detected engines, and how to pin or clear — the pins live in `.devlyn/engines.json`.
 
-`.devlyn/engines.json` is machine-local — not committed, not archived. Pins are promises: a pinned unavailable engine stops with `BLOCKED:<engine>-unavailable`; a name without a `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines (GLM, pi-agent backends) plug in by shipping an adapter file — no skill changes. Codex BUILD/IMPLEMENT and PLAN-pair remain research-only paths behind explicit `--engine codex`.
+`.devlyn/engines.json` is machine-local — not committed, not archived. Pins are promises: a pinned unavailable engine stops with `BLOCKED:<engine>-unavailable`; a name without a `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines (GLM, pi-agent backends) plug in by shipping an adapter file — no skill changes.
 
-**The executor pin binds the orchestrator in plain conversation too, not only inside a skill run.** When you would do implementation work directly and executor is pinned to a non-default engine, route that work through the pin — run it via `/devlyn:resolve` (which reads the pin at PHASE 0), or delegate to that engine — instead of editing as `claude`. No pin / no `.devlyn/engines.json` → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
+**The executor pin binds the orchestrator in plain conversation too, not only inside a skill run.** When you would do implementation work directly and executor is pinned to a non-default engine, route that work through the pin — run it via `/devlyn:resolve` (which reads the pin at PHASE 0), or delegate to that engine. No pin / no `.devlyn/engines.json` → use the canonical skill's orchestrator-supported default. The pair-judge pin stays pipeline-scoped. `/devlyn:engines role` configures explicit engine/model/effort for supported worker and judge routes; `/devlyn:resolve --role-config <path>` overrides roles for one run. Canonical skills define precedence, evidence and unsupported-route errors; absent profiles preserve existing defaults.
 
 ### Conversational handoff + loop engineering — the default entry for all work
 
@@ -55,10 +55,10 @@ The user does not invoke skills manually; the orchestrating model does. Small ta
 
 1. Write the agreed contract to `docs/specs/<id>/spec.md` (+ `spec.expected.json` when mechanical verifications exist). Always a spec file for large work — a written spec is the user's reviewed contract; free-form large now assumes-and-logs instead of halting (zero-scope-signal goals still halt to ideate).
 2. Present a one-screen plan-contract summary — the user's single review checkpoint, BEFORE the pipeline starts.
-3. On go-ahead, invoke `/devlyn:resolve --spec <path>` hands-free to completion.
-4. **Per-task outer loop**: read the terminal verdict. PASS → done. Verdicts backed by spec/verification findings (NEEDS_WORK, verify/build-gate exhaustion) → adjudicate the findings, amend the spec (recorded in the spec file; spec stays read-only inside a run), re-invoke — at most 3 outer iterations, then surface with the findings trail. Infrastructure, invalid-input, engine-availability, and implement-empty BLOCKED verdicts are not spec-amendable: surface immediately. Every iteration re-enters through durable artifacts (spec, findings, run archive), never conversation memory.
+3. On go-ahead, commit the scoped queue-item delta (when applicable) and linked spec bundle, then invoke `/devlyn:resolve --spec <path>` hands-free to completion.
+4. **Per-task outer loop**: read the terminal verdict. PASS → done. Verdicts backed by spec/verification findings (NEEDS_WORK, verify/build-gate exhaustion) → adjudicate the findings, amend the spec (recorded in the spec file; spec stays read-only inside a run), commit that scoped amendment, then re-invoke — at most 3 outer iterations, then surface with the findings trail. Infrastructure, invalid-input, engine-availability, and implement-empty BLOCKED verdicts are not spec-amendable: surface immediately. Every iteration re-enters through committed durable artifacts (spec, findings, run archive), never conversation memory.
 
-**Intent queue (unattended drain)**: the user stacks intents in `docs/specs/queue.md` (ordered checklist; `/devlyn:queue` is the front-end — no args shows status, `add <intent>` appends, `drain` starts the serial drain). Drain strictly serially — per item: spec it, run the outer loop, mark `[x]` done or `[F]` blocked with reason, continue; a blocked item never halts the queue. The queue entry is the user's go-ahead, so assume-and-log replaces the interactive checkpoint — but unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults. Material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review` and move on. End the drain with a per-item verdict + assumptions report.
+**Intent queue (unattended drain)**: the user stacks intents in `docs/specs/queue.md` (ordered checklist; `/devlyn:queue` is the front-end — no args shows status, `add <intent>` appends, `drain` starts the serial drain). Drain strictly serially — per item: spec it, commit the scoped owner baseline, run the outer loop, mark `[x]` done or `[F]` blocked with reason, commit that terminal transition, then continue; a blocked item never halts the queue. The queue entry is the user's go-ahead, so assume-and-log replaces the interactive checkpoint — but unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults. Material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review`, commit it, and move on. End the drain with a per-item verdict + assumptions report. The canonical commit order is `config/skills/devlyn:resolve/references/outer-loop.md`.
 
 ## Subtractive-first editing — perfection = nothing left to remove
 <!-- runtime-principles:section=subtractive-first:begin -->
@@ -127,10 +127,6 @@ This rule exists because LLMs (including you) are trained to be helpful, compreh
 **Stopping rule.** A task is done when the user's stated goal is closed AND no off-path work was added. If you find yourself hesitating because "I should also do Z" — Z is drift. Note it for follow-up, do not execute.
 <!-- runtime-principles:section=goal-locked:end -->
 
-## Evolution loop — orchestrator-neutral continuation
-
-Any orchestrating engine (Claude, Codex, or future) continuing harness / loop-engineering work cold-starts from `autoresearch/HANDOFF.md` (read order inside), then `autoresearch/NORTH-STAR.md` (goal + floor/ceiling contracts + ops-test gates) and `autoresearch/PRINCIPLES.md`. Instruments and gates are scripts + files, never model memory. The pair partner is the strongest available OTHER engine — the protocol is direction-symmetric (iter-0060). On any model/version change, re-certify engine seats with the seat-fitness instrument before re-pinning `.devlyn/engines.json` (NORTH-STAR ceiling contract; iter-0064).
-
 ## Error Handling Philosophy
 
 **No silent fallbacks.** Handle errors explicitly and show the user what happened.
@@ -158,7 +154,7 @@ A finding without one of these forms is excluded. Vague findings produce vague f
 
 ## Codex invocation
 
-When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine codex`, default VERIFY pair, or conditional risk-probe routing), the wrapper-form contract lives in `config/skills/_shared/codex-config.md` (or `.claude/skills/_shared/codex-config.md` once installed). Omit `-m <model>` — the CLI's current flagship is used automatically. MCP is not in the loop. If Codex is required and unavailable, stop with `BLOCKED:codex-unavailable` and setup guidance.
+For Codex model selection, receipts, isolation and availability, follow the invoked skill's sibling `_shared/codex-config.md` and `_shared/engine-preflight.md` (`config/skills/_shared/` in this repository).
 
 ## Working Mode
 
@@ -169,7 +165,7 @@ When `/devlyn:resolve` or `/devlyn:ideate` route a phase to Codex (`--engine cod
 
 ## Skill Boundary Policy
 
-The runtime pipeline surface is two skills — `/devlyn:resolve` and `/devlyn:ideate` — plus `/devlyn:design-ui` for creative UI exploration and two utilities added on explicit user direction: `/devlyn:engines` (engine-role config, iter-0038) and `/devlyn:queue` (intent-queue status/add/drain, iter-0039). `/devlyn:resolve` runs PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY inline; verification, cleanup, and security review (delegated to the native `security-review` Claude Code skill from BUILD_GATE) all live inside the pipeline. There are no standalone `/devlyn:review`, `/devlyn:evaluate`, or `/devlyn:team-resolve` surfaces. `/devlyn:design-ui` spawns a 5-specialist design team (Creative Director, Product Designer, Visual Designer, Interaction Designer, Accessibility Designer). `/devlyn:reap` is an optional user-invoked skill in `optional-skills/`; resolve never delegates to it.
+The runtime pipeline surface is two skills — `/devlyn:resolve` and `/devlyn:ideate` — plus `/devlyn:design-ui` for creative UI exploration and two utilities: `/devlyn:engines` (engine-role config) and `/devlyn:queue` (intent-queue status/add/drain). `/devlyn:resolve` runs PLAN → IMPLEMENT → BUILD_GATE → CLEANUP → VERIFY inline; verification, cleanup, and security review (delegated to the native `security-review` Claude Code skill from BUILD_GATE) all live inside the pipeline. There are no standalone `/devlyn:review`, `/devlyn:evaluate`, or `/devlyn:team-resolve` surfaces. `/devlyn:design-ui` spawns a 5-specialist design team (Creative Director, Product Designer, Visual Designer, Interaction Designer, Accessibility Designer). `/devlyn:reap` is an optional user-invoked skill in `optional-skills/`; resolve never delegates to it.
 
 Browser validation runs directly from BUILD_GATE using whichever toolchain is available (Chrome MCP, Playwright, or curl-tier fallback) — there is no separate `/devlyn:browser-validate` skill.
 

package/README.md

@@ -81,7 +81,7 @@ PLAN  →  IMPLEMENT  →  BUILD_GATE  →  CLEANUP  →  VERIFY (fresh subagent
 - **VERIFY** runs in a fresh subagent context with no code-mutation tools — findings only, structurally independent.
 - Git checkpoints at every phase for safe rollback. Fix-loop budget shared across BUILD_GATE and VERIFY (`--max-rounds N`, default 4).
 
-Common flags: `--engine claude|codex|auto` (default `claude`), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--no-pair` (intentional solo VERIFY), `--risk-probes` / `--no-risk-probes`, `--perf` (per-phase timing).
+Common flags: `--engine claude|codex|omp` (default: the orchestrator-supported default), `--role-config <path>` (one-run worker/judge profiles, see below), `--bypass build-gate,cleanup`, `--pair-verify` (force pair-mode JUDGE in VERIFY), `--no-pair` (intentional solo VERIFY), `--risk-probes` / `--no-risk-probes`, `--perf` (per-phase timing).
 `--pair-verify` and `--no-pair` are mutually exclusive; using both stops with `BLOCKED:invalid-flags`.
 
 Free-form goals that ask for benchmark evidence, pair-evidence, risk-probe
@@ -106,20 +106,44 @@ Stack tasks to run back-to-back without supervision. `/devlyn:queue add "<intent
 devlyn separates three engine roles:
 
 - **Orchestrator** — the CLI you opened (Claude Code, Codex, or omp) that drives the conversation and loop. The contract is symmetric (`CLAUDE.md` ↔ `AGENTS.md`), so the same phase-gated pipeline runs whichever you launch; the file artifacts (spec, queue, state) carry over if you switch.
-- **Executor** — PLAN / IMPLEMENT / CLEANUP plus the primary VERIFY judge. Defaults to `claude`.
+- **Executor** (legacy) — the worker for IMPLEMENT / CLEANUP and their repair rounds, and the primary VERIFY judge, unless either is separately profiled (below). Defaults to the orchestrator-supported default. PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin. An absent primary profile follows the legacy executor, not an opt-in worker profile.
 - **Pair judge** — the first available *other* engine, default for VERIFY and conditional for risk probes.
 
-`--engine claude` (default) is the canonical implementation surface for PLAN, IMPLEMENT, BUILD_GATE, and CLEANUP. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
+`--engine <name>` sets the legacy executor for one run as an engine-only entry (it clears any lower-precedence profile's model/effort). BUILD_GATE and risk-probe derivation keep their existing routes; PLAN always runs on the orchestrator's native worker. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
 
-Pin roles durably with `/devlyn:engines` (no args shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins, stored machine-local in `.devlyn/engines.json`). Pins fail closed: an unavailable pinned engine stops with `BLOCKED:<engine>-unavailable`, and a name with no `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines plug in by shipping an adapter file — no skill changes.
+Pin roles durably with `/devlyn:engines` (no args shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `role <worker|primary_judge|pair_judge> <JSON object>` / `role <name> clear` manage the pins, stored machine-local in `.devlyn/engines.json`; `clear` removes all legacy and role pins, preserves unrelated keys, and deletes an empty file). Pins fail closed: an unavailable pinned engine stops with `BLOCKED:<engine>-unavailable`, and a name with no `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines plug in by shipping an adapter file — no skill changes.
 
-`--engine codex` routes IMPLEMENT to Codex — research-only at HEAD: iter-0020 closed Codex BUILD/IMPLEMENT below the quality floor on the 9-fixture suite (L2 vs L1 = −3.6, 3/8 gated fixtures cleared the +5 margin floor — release-readiness FAIL); iter-0033g + iter-0034 closed PLAN-pair as research-only with explicit unblock conditions (container/sandbox infra OR production telemetry capturing positive evidence of subagent introspection). Install the Codex CLI (https://platform.openai.com/docs/codex) and pass the flag explicitly to opt in:
+#### Explicit worker and judge profiles
+
+`.devlyn/engines.json` may add a `roles` object with `worker`, `primary_judge`, and `pair_judge` entries. Each entry requires `engine` and accepts an optional exact `model` ID and `effort`; unknown fields, aliases (`default`, `auto`, `opus`, `sonnet`, `fable`, `codex` as a model), null/empty values, and duplicate keys stop with `BLOCKED:invalid-engine-config`. Only the project's own `.devlyn/engines.json` is read — no parent or global lookup. Example (an example, not a default or ranking):
+
+```json
+{
+  "executor": "codex",
+  "pair_judge_priority": ["claude"],
+  "roles": {
+    "worker": {"engine": "codex", "model": "gpt-6-astra", "effort": "xhigh"},
+    "primary_judge": {"engine": "codex", "model": "gpt-6-astra", "effort": "high"},
+    "pair_judge": {"engine": "claude", "model": "claude-fable-5-1", "effort": "medium"}
+  }
+}
+```
+
+`--role-config <path>` supplies the same `{"roles": {...}}` object for one run only, with no other top-level keys; the flag may appear once.
+
+- **Precedence** — an entry replaces the lower one as a whole; model/effort never merge across engines. Worker and primary judge: run `--role-config` entry > `--engine` (engine-only) > project role entry > legacy executor/default. Pair judge: run entry > project entry > `pair_judge_priority` / the OTHER-engine complement. A missing `model`/`effort` keeps that route's current default and is shown as inherited/unresolved.
+- **Boundaries** — `worker` covers IMPLEMENT / CLEANUP and their repair rounds; `primary_judge` and `pair_judge` cover VERIFY only. PLAN stays orchestrator-fixed, BUILD_GATE keeps its existing route, and risk-probe derivation stays outside these controls. OTHER must differ from the primary by engine: an explicit same-engine pair is `BLOCKED:invalid-engine-config`. `--no-pair` is unchanged — explicit solo VERIFY; an unused pair entry is neither dispatched nor availability-checked.
+- **Initial explicit routes** — Codex worker/primary/pair accept exact `model` + `effort` (dispatched as `-m` / `-c model_reasoning_effort=`, validated against the installed Codex CLI's native model metadata for its version). Claude primary/pair judges pass an exact `model` as `--model` and validate native result identity; model-only selection needs no source update for a new ID. Explicit `effort` separately requires the adapter's version/model support declaration. The Claude worker stays the native `Agent` route and is engine-only: explicit `model`/`effort` on a Claude worker is `BLOCKED:unsupported-role-option` — a supported-route boundary, not a claim that Claude cannot implement. Other adapters (omp, grok) are engine-only for their eligible roles.
+- **Errors** — `BLOCKED:unsupported-role-option` names the role, engine and field with guidance; there is no clamp, fallback, substituted model, or weaker retry. An explicitly selected engine (flag, pin, or profile) that is unavailable stops with `BLOCKED:<engine>-unavailable`. A native warning that a requested option was ignored is a failed promise even at exit 0.
+- **Requested vs observed** — `/devlyn:engines` status prints each role's requested engine/model/effort, source and dispatch channel before dispatch; it describes a request and does not prove a native invocation happened. Effective model is reported only with native evidence; a Codex worker receipt binds requested dispatch and leaves effective model unknown. A reported worker model reroute blocks completion even at exit 0. SURFACE_CLOSE inherits native Claude model settings and records the model from its required JSON result. Effective effort stays unknown unless native evidence establishes it — invocation arguments prove dispatch, not provider-internal reasoning.
+
+`--engine codex` routes IMPLEMENT / CLEANUP to Codex as a supported engine-only route (exact model/effort via the profiles above). Historical record: iter-0020 closed Codex BUILD/IMPLEMENT below the quality floor on the 9-fixture suite (L2 vs L1 = −3.6, 3/8 gated fixtures cleared the +5 margin floor — release-readiness FAIL). Separately, PLAN-pair remains research-only: iter-0033g + iter-0034 closed it with explicit unblock conditions (container/sandbox infra OR production telemetry capturing positive evidence of subagent introspection). Install the Codex CLI (https://platform.openai.com/docs/codex) and pass the flag explicitly to opt in:
 
 ```
-/devlyn:resolve "fix the auth bug" --engine codex   # research-only
+/devlyn:resolve "fix the auth bug" --engine codex
 ```
 
-If Codex or Claude is absent when explicitly selected, or OTHER engine is absent under `--pair-verify`, the harness stops with `BLOCKED:<engine>-unavailable` and prints setup guidance. Automatic VERIFY absence is a reported solo route. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
+If an engine is absent when explicitly selected by flag, pin, or role profile, or OTHER engine is absent under `--pair-verify`, the harness stops with `BLOCKED:<engine>-unavailable` and prints setup guidance. Automatic VERIFY absence is a reported solo route. Use `--no-pair` only when intentionally accepting solo VERIFY; use `--no-risk-probes` only when intentionally disabling automatic high-risk probes.
 
 ### Benchmark score runs
 

package/benchmark/auto-resolve/results/20260507-f10-f11-tier1-full-pipeline/headroom-gate.json

@@ -0,0 +1,25 @@
+{
+  "run_id": "20260507-f10-f11-tier1-full-pipeline",
+  "rule": "at least 2 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "FAIL",
+  "fixtures_total": 2,
+  "fixtures_passed": 0,
+  "min_fixtures": 2,
+  "fixture_count_ok": true,
+  "rows": [
+    {
+      "fixture": "F10-persist-write-collision",
+      "status": "FAIL",
+      "bare_score": 75,
+      "solo_score": 94,
+      "reason": "bare score 75 > 60; solo_claude score 94 > 80"
+    },
+    {
+      "fixture": "F11-batch-import-all-or-nothing",
+      "status": "FAIL",
+      "bare_score": 98,
+      "solo_score": 97,
+      "reason": "bare score 98 > 60; solo_claude score 97 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260507-f10-f11-tier1-full-pipeline/headroom-gate.md

@@ -0,0 +1,10 @@
+# Headroom Gate — 20260507-f10-f11-tier1-full-pipeline
+
+Verdict: **FAIL**
+
+Rule: at least 2 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F10-persist-write-collision | 75 | 94 | FAIL | bare score 75 > 60; solo_claude score 94 > 80 |
+| F11-batch-import-all-or-nothing | 98 | 97 | FAIL | bare score 98 > 60; solo_claude score 97 > 80 |

package/benchmark/auto-resolve/results/20260508-f22-exact-error-headroom/headroom-gate.json

@@ -0,0 +1,18 @@
+{
+  "run_id": "20260508-f22-exact-error-headroom",
+  "rule": "at least 2 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 2,
+  "fixture_count_ok": false,
+  "rows": [
+    {
+      "fixture": "F22-cli-ledger-close",
+      "status": "FAIL",
+      "bare_score": 94,
+      "solo_score": 98,
+      "reason": "bare score 94 > 60; solo_claude score 98 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260508-f22-exact-error-headroom/headroom-gate.md

@@ -0,0 +1,9 @@
+# Headroom Gate — 20260508-f22-exact-error-headroom
+
+Verdict: **FAIL**
+
+Rule: at least 2 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F22-cli-ledger-close | 94 | 98 | FAIL | bare score 94 > 60; solo_claude score 98 > 80 |

package/benchmark/auto-resolve/results/20260508-f26-headroom/headroom-gate.json

@@ -0,0 +1,18 @@
+{
+  "run_id": "20260508-f26-headroom",
+  "rule": "at least 2 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 2,
+  "fixture_count_ok": false,
+  "rows": [
+    {
+      "fixture": "F26-cli-payout-ledger-rules",
+      "status": "FAIL",
+      "bare_score": 25,
+      "solo_score": 98,
+      "reason": "solo_claude score 98 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260508-f26-headroom/headroom-gate.md

@@ -0,0 +1,9 @@
+# Headroom Gate — 20260508-f26-headroom
+
+Verdict: **FAIL**
+
+Rule: at least 2 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F26-cli-payout-ledger-rules | 25 | 98 | FAIL | solo_claude score 98 > 80 |

package/benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F16-cli-quote-tax-rules/l2_risk_probes/result.json

@@ -0,0 +1,28 @@
+{
+  "fixture": "F16-cli-quote-tax-rules",
+  "arm": "l2_risk_probes",
+  "run_id": "20260507-f16-riskprobes-v15-pricing-diagnostic",
+  "disqualifier": false,
+  "verify_score": 1.0,
+  "commands_passed": 4,
+  "commands_total": 4,
+  "diff_bytes": 8961,
+  "files_changed": 2,
+  "elapsed_seconds": 1164,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS",
+  "verify_verdict": "PASS",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F23-cli-fulfillment-wave/l2_risk_probes/result.json

@@ -0,0 +1,28 @@
+{
+  "fixture": "F23-cli-fulfillment-wave",
+  "arm": "l2_risk_probes",
+  "run_id": "20260508-f23-riskprobes-v17-rollback-probe",
+  "disqualifier": false,
+  "verify_score": 1.0,
+  "commands_passed": 3,
+  "commands_total": 3,
+  "diff_bytes": 13562,
+  "files_changed": 2,
+  "elapsed_seconds": 1805,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS_WITH_ISSUES",
+  "verify_verdict": "PASS_WITH_ISSUES",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260510-f16-f23-f25-combined-proof/F25-cli-cart-promotion-rules/l2_risk_probes/result.json

@@ -0,0 +1,30 @@
+{
+  "fixture": "F25-cli-cart-promotion-rules",
+  "arm": "l2_risk_probes",
+  "run_id": "20260509-f25-cartprobe-v2",
+  "disqualifier": false,
+  "oracle_disqualifier": false,
+  "oracle_findings_count": 0,
+  "verify_score": 1.0,
+  "commands_passed": 4,
+  "commands_total": 4,
+  "diff_bytes": 12108,
+  "files_changed": 2,
+  "elapsed_seconds": 1177,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS",
+  "verify_verdict": "PASS",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260511-f12-webhook-headroom/headroom-gate.json

@@ -0,0 +1,28 @@
+{
+  "run_id": "20260511-f12-webhook-headroom",
+  "rule": "at least 1 candidate fixtures; each must satisfy bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, with both baseline arms evidence-complete",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 1,
+  "bare_max": 60,
+  "solo_max": 80,
+  "min_bare_headroom_required": 5,
+  "min_solo_headroom_required": 5,
+  "fixture_count_ok": true,
+  "avg_bare_headroom": -25.0,
+  "min_bare_headroom": -25,
+  "avg_solo_headroom": -19.0,
+  "min_solo_headroom": -19,
+  "rows": [
+    {
+      "fixture": "F12-webhook-raw-body-signature",
+      "status": "FAIL",
+      "bare_score": 85,
+      "solo_score": 99,
+      "bare_headroom": -25,
+      "solo_headroom": -19,
+      "reason": "bare score 85 > 60; solo_claude score 99 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260511-f12-webhook-headroom/headroom-gate.md

@@ -0,0 +1,15 @@
+# Headroom Gate — 20260511-f12-webhook-headroom
+
+Verdict: **FAIL**
+
+Fixtures passed: 0/1 (minimum required: 1)
+
+Rule: at least 1 fixtures; bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, both baseline arms evidence-complete.
+Average bare headroom: -25.0
+Minimum bare headroom: -25
+Average solo headroom: -19.0
+Minimum solo headroom: -19
+
+| Fixture | Bare | Bare headroom | Solo | Solo headroom | Status | Reason |
+|---|---:|---:|---:|---:|---|---|
+| F12-webhook-raw-body-signature | 85 | -25 | 99 | -19 | FAIL | bare score 85 > 60; solo_claude score 99 > 80 |

package/benchmark/auto-resolve/results/20260511-f15-concurrency-headroom/headroom-gate.json

@@ -0,0 +1,28 @@
+{
+  "run_id": "20260511-f15-concurrency-headroom",
+  "rule": "at least 1 candidate fixtures; each must satisfy bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, with both baseline arms evidence-complete",
+  "verdict": "FAIL",
+  "fixtures_total": 1,
+  "fixtures_passed": 0,
+  "min_fixtures": 1,
+  "bare_max": 60,
+  "solo_max": 80,
+  "min_bare_headroom_required": 5,
+  "min_solo_headroom_required": 5,
+  "fixture_count_ok": true,
+  "avg_bare_headroom": -39.0,
+  "min_bare_headroom": -39,
+  "avg_solo_headroom": -14.0,
+  "min_solo_headroom": -14,
+  "rows": [
+    {
+      "fixture": "F15-frozen-diff-race-review",
+      "status": "FAIL",
+      "bare_score": 99,
+      "solo_score": 94,
+      "bare_headroom": -39,
+      "solo_headroom": -14,
+      "reason": "bare score 99 > 60; solo_claude score 94 > 80"
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260511-f15-concurrency-headroom/headroom-gate.md

@@ -0,0 +1,15 @@
+# Headroom Gate — 20260511-f15-concurrency-headroom
+
+Verdict: **FAIL**
+
+Fixtures passed: 0/1 (minimum required: 1)
+
+Rule: at least 1 fixtures; bare <= 60 with headroom >= 5, solo_claude <= 80 with headroom >= 5, both baseline arms evidence-complete.
+Average bare headroom: -39.0
+Minimum bare headroom: -39
+Average solo headroom: -14.0
+Minimum solo headroom: -14
+
+| Fixture | Bare | Bare headroom | Solo | Solo headroom | Status | Reason |
+|---|---:|---:|---:|---:|---|---|
+| F15-frozen-diff-race-review | 99 | -39 | 94 | -14 | FAIL | bare score 99 > 60; solo_claude score 94 > 80 |

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/F21-cli-scheduler-priority/l2_risk_probes/result.json

@@ -0,0 +1,32 @@
+{
+  "fixture": "F21-cli-scheduler-priority",
+  "arm": "l2_risk_probes",
+  "run_id": "20260511-f21-current-riskprobes-v1",
+  "disqualifier": false,
+  "oracle_disqualifier": false,
+  "oracle_findings_count": 0,
+  "verify_score": 1.0,
+  "commands_passed": 3,
+  "commands_total": 3,
+  "diff_bytes": 14846,
+  "files_changed": 2,
+  "elapsed_seconds": 1112,
+  "timed_out": false,
+  "environment_contamination": false,
+  "environment_contamination_reason": null,
+  "invoke_exit": 0,
+  "invoke_failure": false,
+  "invoke_failure_reason": null,
+  "terminal_verdict": "PASS",
+  "verify_verdict": "PASS",
+  "pair_trigger": {
+    "eligible": true,
+    "reasons": [
+      "complexity.high",
+      "risk_profile.high_risk",
+      "risk_probes_enabled"
+    ],
+    "skipped_reason": null
+  },
+  "pair_mode": true
+}

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/full-pipeline-pair-gate.json

@@ -0,0 +1,44 @@
+{
+  "run_id": "20260511-f21-current-riskprobes-v1",
+  "rule": "headroom candidates only; bare headroom >= 5; solo_claude headroom >= 5; l2_risk_probes must be evidence-clean, pair_mode true, pair_trigger eligible with a canonical reason, and beat solo_claude by the configured margin",
+  "verdict": "PASS",
+  "fixtures_total": 1,
+  "fixtures_passed": 1,
+  "min_fixtures": 1,
+  "fixture_count_ok": true,
+  "bare_max": 60,
+  "solo_max": 80,
+  "min_bare_headroom_required": 5,
+  "min_solo_headroom_required": 5,
+  "min_pair_margin": 5,
+  "pair_arm": "l2_risk_probes",
+  "max_pair_solo_wall_ratio": 3.0,
+  "require_hypothesis_trigger": false,
+  "max_observed_pair_solo_wall_ratio": 1.4728476821192054,
+  "avg_pair_margin": 33.0,
+  "avg_pair_solo_wall_ratio": 1.4728476821192054,
+  "rows": [
+    {
+      "fixture": "F21-cli-scheduler-priority",
+      "status": "PASS",
+      "bare_score": 33,
+      "bare_headroom": 27,
+      "solo_score": 66,
+      "solo_headroom": 14,
+      "pair_score": 99,
+      "pair_margin": 33,
+      "pair_mode": true,
+      "pair_trigger_eligible": true,
+      "pair_trigger_reasons": [
+        "complexity.high",
+        "risk.high",
+        "risk_probes.enabled",
+        "spec.solo_headroom_hypothesis"
+      ],
+      "pair_trigger_has_canonical_reason": true,
+      "pair_trigger_has_hypothesis_reason": true,
+      "pair_solo_wall_ratio": 1.4728476821192054,
+      "reason": ""
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/full-pipeline-pair-gate.md

@@ -0,0 +1,16 @@
+# Full-Pipeline Pair Gate - 20260511-f21-current-riskprobes-v1
+
+Verdict: **PASS**
+
+Fixtures passed: 1/1 (minimum required: 1)
+
+Rule: at least 1 fixtures; bare <= 60; bare headroom >= 5; solo_claude <= 80; solo_claude headroom >= 5; l2_risk_probes evidence-clean; pair_mode true; pair_trigger eligible with canonical reason; l2_risk_probes - solo_claude >= 5.
+Average pair margin: +33.0
+Allowed pair/solo wall ratio: 3.00x
+Maximum observed pair/solo wall ratio: 1.47x
+Average pair/solo wall ratio: 1.47x
+Hypothesis trigger required: false
+
+| Fixture | Bare | Bare headroom | Solo_claude | Solo_claude headroom | Pair | Margin | Pair mode | Hypothesis trigger | Triggers | Wall ratio | Status | Reason |
+|---|---:|---:|---:|---:|---:|---:|---|---|---|---:|---|---|
+| F21-cli-scheduler-priority | 33 | 27 | 66 | 14 | 99 | +33 | true | true | complexity.high,risk.high,risk_probes.enabled,spec.solo_headroom_hypothesis | 1.47x | PASS |  |

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/headroom-gate.json

@@ -0,0 +1,18 @@
+{
+  "run_id": "20260511-f21-current-riskprobes-v1",
+  "rule": "at least 1 candidate fixtures; each must satisfy bare <= 60 and solo_claude <= 80, with both arms clean",
+  "verdict": "PASS",
+  "fixtures_total": 1,
+  "fixtures_passed": 1,
+  "min_fixtures": 1,
+  "fixture_count_ok": true,
+  "rows": [
+    {
+      "fixture": "F21-cli-scheduler-priority",
+      "status": "PASS",
+      "bare_score": 33,
+      "solo_score": 66,
+      "reason": ""
+    }
+  ]
+}

package/benchmark/auto-resolve/results/20260511-f21-current-riskprobes-v1/headroom-gate.md

@@ -0,0 +1,9 @@
+# Headroom Gate — 20260511-f21-current-riskprobes-v1
+
+Verdict: **PASS**
+
+Rule: at least 1 fixtures; bare <= 60, solo_claude <= 80, both arms clean.
+
+| Fixture | Bare | Solo | Status | Reason |
+|---|---:|---:|---|---|
+| F21-cli-scheduler-priority | 33 | 66 | PASS |  |