jorgex-stack 1.9.25 → 1.9.27

package/README.md

@@ -106,9 +106,9 @@ Programmatic mode does **not** provide:
 
 ### Pi runtime
 
-El canon de Stack de este checkout contiene 14 agentes; el pin Pi vigente conserva temporalmente la snapshot empaquetada anterior de 15 agentes. Este checkpoint no cambia ese pin ni anticipa una nueva publicación.
+El canon de Stack y el paquete Pi fijado comparten ya el inventario de 14 agentes (primary y 13 subagentes). La identidad exacta del pin y su procedencia se mantienen en `src/lib/pi-runtime-pin.json`; esta adopción no implica una nueva publicación de Stack ni una instalación personal.
 
-Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The following version references describe a historical Stack/Pi transition, not the current pin: Stack `1.9.7` recognized **`jorgex-pi@0.8.4`**, while Pi `0.8.5` was a separately published candidate. The current pin, package integrity and lifecycle are maintained in [docs/references/pi-runtime.md](docs/references/pi-runtime.md); this README does not predict a future release.
+Pi combines the frozen **snapshot v2** package with a Stack-owned shared projection. The version references that follow describe historical Stack/Pi transitions, not the current pin. The current pin, package integrity and lifecycle are maintained in [docs/references/pi-runtime.md](docs/references/pi-runtime.md) and `src/lib/pi-runtime-pin.json`; this README does not imply a future release.
 
 The following command block is retained as historical reference for that transition:
 
@@ -120,9 +120,9 @@ pnpm dlx jorgex-stack@1.9.7 sync --agents pi
 pnpm dlx jorgex-stack@1.9.7 uninstall --agents pi
 ```
 
-Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. The historical `0.8.0` tarball was `89128340` bytes; the exact current artifact and integrity values are authoritative in `src/lib/pi-runtime.ts`. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The published `1.9.7` entry is `{ "source": "npm:jorgex-pi@0.8.4", "skills": [], "prompts": [] }`; the checkout's `0.8.5` entry is a candidate only. Filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
+Stack downloads the frozen registry tarball, verifies its exact size plus SHA-256/SHA-512, backs up Pi's `settings.json`, and only then asks Pi to install that local file. The historical `0.8.0` tarball was `89128340` bytes; the exact adopted artifact and integrity values are authoritative in `src/lib/pi-runtime-pin.json`, while the lifecycle remains authoritative in `src/lib/pi-runtime.ts`. Pi's own package-manager invocation is the narrow runtime exception to the repository's pnpm-only rule; the Stack lifecycle never launches npm directly. After the package is healthy, Stack projects the shared resources into Pi: marked `jorgex:system-prompt` and `jorgex:engram-protocol` sections in `~/.pi/agent/AGENTS.md`, canonical skills under `~/.agents/skills`, and `~/.pi/agent/prompts/lean-audit.md`. When the managed Playwright preference is active, the projection also adds or removes the marked `jorgex:browser` section dynamically. The Pi-only `install --agents pi --playwright` flow installs and persists that Playwright capability just like the other harnesses. Chrome DevTools MCP and Context7 remain outside the Pi scope. The published `1.9.7` entry `{ "source": "npm:jorgex-pi@0.8.4", "skills": [], "prompts": [] }` and the `0.8.5` snapshot reference are historical; they do not describe the adopted pin. Filters are applied only after this projection exists, so the package does not duplicate shared resources. Package ownership is recorded separately in `~/.jorgex-stack/pi-receipt.json`; projection ownership is recorded in `~/.jorgex-stack/pi-projection-receipt.json`. Both receipts are scope-bound and fail closed for manual, duplicate, divergent, partial, corrupt, copied-to-another-scope, or unknown-history state.
 
-Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. The Pi 0.8.5 candidate records 18 skill trees and 98 files; reference F2-A is included while the private F1 skills remain preserved. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
+Historically, the published Pi 0.8.0 direct-package snapshot added `work-audit`: the snapshot grew from **17 to 18 skill trees** (96 to 97 files), and the active runtime allowlist grew from **16 to 17 skills**. The historical Pi 0.8.5 snapshot reference records 18 skill trees and 98 files; it does not describe the adopted pin. Reference F2-A is included while the private F1 skills remain preserved. `playwright-cli` remains in the snapshot but inactive because browser automation is a separate opt-in integration.
 
 The historical published artifact has two separate provenance anchors. The local size/SHA-256/SHA-512 checks bind the downloaded bytes to Stack's accepted artifact; they are checks within that checkout, not independent trust roots. npm's external provenance/attestation is outside Stack runtime verification, and `provenance.commit` is informative unless that external attestation is independently verified.
 

package/dist/cli.js

@@ -181,14 +181,9 @@ var DEFAULT_MODEL_MAP = {
   // la skill de la app heredan el modelo elegido por el usuario. Estos defaults
   // son solo para subagentes; variant → model_reasoning_effort.
   codex: {
-    strong: { model: "gpt-6-astra", variant: "max" },
-    standard: { model: "gpt-5.6-sol", variant: "medium" },
-    cheap: { model: "gpt-5.6-luna", variant: "medium" },
-    overrides: {
-      implementer: { model: "gpt-5.6-luna", variant: "max" },
-      tester: { model: "gpt-5.6-luna", variant: "max" },
-      "silent-failure-hunter": { model: "gpt-5.6-sol", variant: "medium" }
-    }
+    strong: { model: "gpt-6-astra", variant: "low" },
+    standard: { model: "gpt-5.6-luna", variant: "max" },
+    cheap: { model: "gpt-5.6-luna", variant: "medium" }
   }
 };
 function modelMapFile() {
@@ -5160,16 +5155,16 @@ import { createHash } from "crypto";
 var pi_runtime_pin_default = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.9",
-    source: "npm:jorgex-pi@0.8.9"
+    version: "0.8.11",
+    source: "npm:jorgex-pi@0.8.11"
   },
   provenance: {
-    commit: "7bf86025b5aeb2280b3bc504b46d6b0ee18b118f"
+    commit: "8690d0cab6e4149c95e299b2ef3d7277b8b06263"
   },
   tarball: {
-    bytes: 89143538,
-    sha256: "90085e5ea9f333de20c0aa3244bb6b1b67435298461433e2086df0155db231c0",
-    sha512: "9d7e99e008c0d61138759073ae03dee39be1f30c7af9a592fd8bd2f347154ef98cad0e813d60995d29da9d13b9b45d370c2ac0065684ebdbb8f22fa319610a98"
+    bytes: 89141979,
+    sha256: "f0b34be384e5c761043348e7eb561fe56d475ef61479a0a93cd563d28dd28d8b",
+    sha512: "ad76a61dc7388b3b077f89a77dc211596f3d82b8f44a503552ba0eff655cbfdc3ee99b395d647806a637e87ed731483e71e6cfef9c21f3945ce3b4b8f3bd7c57"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.25",
+  "version": "1.9.27",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",

package/stack/agents/code-reviewer.md

@@ -2,7 +2,7 @@
 name: code-reviewer
 description: Read-only code reviewer. Use it AFTER writing or changing code to review against the project guidelines, catch real bugs and flag quality issues. Reviews git diff by default and reports issues with confidence scores. Returns review feedback only — never writes or fixes code. Not for implementing features or refactors, and not for readability/style simplifications (that's code-simplifier).
 mode: subagent
-tier: strong
+tier: standard
 readonly: true
 bash: git-read
 ---