kenaz 0.3.17 → 0.3.19

package/core/.failure/INDEX.yaml

@@ -41,11 +41,6 @@ categories:
     description: "架構決策失敗（設計缺陷、技術選型錯誤）"
     icon: "🏗️"
 
-  pipeline:
-    path: "pipeline/"
-    description: "Pipeline 系統失敗（任務管理、佇列、統計）"
-    icon: "⚙️"
-
   data_integrity:
     path: "data-integrity/"
     description: "數據完整性問題（JSON 損壞、編碼錯誤）"
@@ -83,7 +78,7 @@ failure_template: |
 
   _meta:
     id: "FAIL-XXX"
-    category: "agent_execution | code_quality | architecture | pipeline | data_integrity"
+    category: "agent_execution | code_quality | architecture | data_integrity"
     severity: "critical | high | medium | low"
     date: "YYYY-MM-DD"
     related_tasks: ["TASK_XXX"]
@@ -118,7 +113,7 @@ failure_template: |
   - [ ] 檢查項目 1
   - [ ] 檢查項目 2
 
-  ### 三級預防（由 Ansuz Phase 9 prevention_analysis 自動填入）
+  ### 三級預防
   prevention:
     primary: "防止再發 — 架構加固、測試覆蓋、代碼重構"
     secondary: "早期偵測 — 監控指標、日誌告警、健康檢查"
@@ -137,18 +132,10 @@ failure_template: |
 # 載入順序（按嚴重程度）
 # ============================================================
 load_order:
-  - path: "agent-execution/FAIL-001-agent-no-output.yaml"
-    title: "Agent 執行無輸出問題"
-    severity: "critical"
-
   - path: "data-integrity/FAIL-002-json-bom.yaml"
     title: "JSON BOM 編碼問題"
     severity: "high"
 
-  - path: "pipeline/FAIL-003-queue-pollution.yaml"
-    title: "TASK_QUEUE 污染問題"
-    severity: "high"
-
   - path: "agent-execution/FAIL-004_agent_platform_specific_commands.md"
     title: "Agent 使用平台特定命令導致失敗"
     severity: "high"
@@ -157,18 +144,10 @@ load_order:
     title: "背景 Agent 無寫入權限"
     severity: "critical"
 
-  - path: "architecture/FAIL-006-python-version-compatibility.yaml"
-    title: "Python 3.14 依賴兼容性問題"
-    severity: "high"
-
   - path: "agent-execution/FAIL-008-bypass-api-direct-yaml-write.yaml"
     title: "Agent 繞過 API 直接寫 YAML 任務檔案"
     severity: "high"
 
-  - path: "agent-execution/FAIL-010-phase0-poem-format-skipped.yaml"
-    title: "Phase 0 記憶之烏鴉歸巢段落持續缺失"
-    severity: "medium"
-
   - path: "agent-execution/FAIL-014-shared-worktree-premature-death-verdict.yaml"
     title: "並發 Agent worktree 共用路徑被提前清理 + 沉默誤判死亡 → 重複派工"
     severity: "high"
@@ -178,19 +157,11 @@ load_order:
 # 統計數據
 # ============================================================
 statistics:
-  total_failures: 10
+  total_failures: 5
   by_category:
-    agent_execution: 6
+    agent_execution: 4
     data_integrity: 1
-    pipeline: 1
-    architecture: 1
-  by_severity:
-    critical: 2
-    high: 5
-    medium: 1
-    low: 0
-  resolved: 7
-  converted_to_rules: 2  # 已轉化為 .rule/ 規則
+  resolved: 5
 
 # ============================================================
 # Agent 使用指南
@@ -220,12 +191,7 @@ system_integration:
   priority_order: |
     1. .rule/ (最高優先級 - 必須遵守的規則)
     2. .failure/ (失敗經驗 - 應避免的模式)
-    3. .memory/ (經驗記錄 - 一般性筆記)
-    4. CLAUDE.md (專案指導)
+    3. CLAUDE.md (專案指導)
 
   workflow: |
     失敗 → 記錄到 .failure/ → 分析根因 → 如重複發生 → 提升為 .rule/
-
-  example:
-    failure: "FAIL-003: TASK_QUEUE 被 completed 任務污染"
-    rule: "PPL-002: 已完成任務必須封存到 .memory/"

package/core/.failure/agent-execution/FAIL-013-search-cwd-drift-and-case-mismatch.yaml

@@ -72,7 +72,7 @@ prevention:
       → Grep -i pattern path=ABSOLUTE_PATH   （找內容）
 
     「我想理解一個概念的拓撲」
-      → synapse_search / synapse_pulse   （理解關係）
+      → kenaz_lsp_callers / kenaz_lsp_references   （理解關係）
 
     「我搜了但什麼都沒找到」
       → 檢查 cwd（Bash pwd）

package/core/.failure/tools/README.md

@@ -1,230 +1,12 @@
-# 🔧 Failure Learning Tools
+# .failure/tools
 
-## 目錄說明
+Small Node helpers for the JSON/BOM failure pattern (`data-integrity/FAIL-002-json-bom.yaml`). All take a file or directory path.
 
-此目錄包含自動化工具腳本，幫助 Agent 和開發者快速記錄和檢查失敗經驗。
+| Tool | Use |
+|---|---|
+| `check_bom.js <file\|dir> [--recursive]` | Report files that start with a UTF-8 BOM |
+| `remove_bom.js <file>` | Strip the BOM |
+| `fix_json.js <file>` | Strip the BOM, validate, and reformat a JSON file |
+| `validate_json.js <file>` | Exit non-zero if the file is not valid JSON |
 
-## 工具列表
-
-### 1. log_failure.ps1
-自動化建立失敗記錄文件的 PowerShell 腳本。
-
-#### 使用方式
-```powershell
-# 互動式建立失敗記錄
-.\.failure\tools\log_failure.ps1
-
-# 指定參數建立
-.\.failure\tools\log_failure.ps1 `
-  -Category "pipeline" `
-  -Title "TASK_QUEUE 污染問題" `
-  -Severity "high" `
-  -TaskID "TASK_088"
-```
-
-#### 功能
-- 自動生成 FAIL-XXX ID（根據 INDEX.yaml 中的最大 ID）
-- 根據分類選擇正確的目錄
-- 使用標準模板建立 YAML 文件
-- 自動更新 INDEX.yaml 的 load_order 和統計數據
-- 支援互動式和參數化兩種模式
-
-### 2. check_failures.ps1
-檢查當前任務是否匹配已知失敗模式的腳本。
-
-#### 使用方式
-```powershell
-# 檢查特定任務的失敗模式
-.\.failure\tools\check_failures.ps1 -TaskID "TASK_077"
-
-# 檢查特定類型的任務
-.\.failure\tools\check_failures.ps1 -AgentType "developer"
-
-# 檢查特定路徑的失敗模式
-.\.failure\tools\check_failures.ps1 -ScopePath "dev/pipeline/"
-
-# 使用關鍵詞搜尋
-.\.failure\tools\check_failures.ps1 -Keywords "JSON,BOM,encoding"
-
-# 過濾特定分類和嚴重程度
-.\.failure\tools\check_failures.ps1 -Category "pipeline" -Severity "critical"
-```
-
-#### 功能
-- 根據任務 ID 自動載入 TASK_QUEUE.json 詳情
-- 根據 agent_type 匹配相關失敗記錄
-- 根據 scope_paths 匹配相關失敗記錄
-- 支援關鍵詞模糊搜尋
-- 輸出預防檢查清單和解決方案參考
-- 按嚴重程度排序顯示結果
-
-### 3. validate_json.js
-驗證 JSON 文件完整性的 Node.js 腳本。
-
-#### 使用方式
-```bash
-# 驗證單個文件
-node .failure/tools/validate_json.js dev/pipeline/TASK_QUEUE.json
-```
-
-#### 功能
-- 驗證 JSON 語法正確性
-- 檢測 BOM (Byte Order Mark)
-- 提供錯誤診斷提示
-
-### 3.1 remove_bom.js
-移除 UTF-8 文件開頭的 BOM (Byte Order Mark)。
-
-#### 使用方式
-```bash
-# 移除 BOM
-node .failure/tools/remove_bom.js dev/pipeline/TASK_QUEUE.json
-```
-
-#### 功能
-- 檢測並移除 BOM (0xFEFF)
-- 不修改其他內容
-- 無 BOM 時不做任何操作
-
-### 3.2 fix_json.js
-一鍵修復 JSON 文件（移除 BOM + 驗證 + 重新格式化）。
-
-#### 使用方式
-```bash
-# 修復 JSON 文件
-node .failure/tools/fix_json.js dev/pipeline/TASK_QUEUE.json
-```
-
-#### 功能
-- 自動移除 BOM
-- 驗證 JSON 語法
-- 重新格式化（統一縮排 2 空格）
-- 寫回無 BOM 的 UTF-8 文件
-
-### 3.3 check_bom.js
-批量檢查 JSON 文件是否有 BOM（用於 CI/CD 或 pre-commit hook）。
-
-#### 使用方式
-```bash
-# 檢查單個文件
-node .failure/tools/check_bom.js dev/pipeline/TASK_QUEUE.json
-
-# 遞迴檢查目錄中所有 JSON 文件
-node .failure/tools/check_bom.js dev/pipeline --recursive
-```
-
-#### 功能
-- 批量檢查 JSON 文件
-- 遞迴掃描目錄（使用 --recursive）
-- 列出所有有 BOM 的文件
-- 退出碼：0（無 BOM）或 1（檢測到 BOM）
-
-#### Pre-commit Hook 整合
-```bash
-#!/bin/bash
-# .git/hooks/pre-commit
-node .failure/tools/check_bom.js dev/pipeline --recursive || exit 1
-```
-
-### 4. failure-report.ps1 （計劃中）
-生成失敗經驗報告的腳本。
-
-#### 使用方式
-```powershell
-# 生成完整報告
-.\.failure\tools\failure-report.ps1
-
-# 只生成特定分類的報告
-.\.failure\tools\failure-report.ps1 -Category "pipeline"
-
-# 只生成特定嚴重程度的報告
-.\.failure\tools\failure-report.ps1 -Severity "critical,high"
-
-# 輸出為 Markdown 格式
-.\.failure\tools\failure-report.ps1 -Format "markdown" -Output "failure-report.md"
-```
-
-#### 功能（計劃中）
-- 統計失敗記錄數量
-- 按分類和嚴重程度分組
-- 列出已轉化為規則的失敗
-- 生成 Markdown 報告
-
-### 5. failure-to-rule.ps1 （計劃中）
-將重複發生的失敗轉化為規則的輔助工具。
-
-#### 使用方式
-```powershell
-# 檢查哪些失敗應該轉化為規則
-.\.failure\tools\failure-to-rule.ps1 -Analyze
-
-# 將特定失敗轉化為規則
-.\.failure\tools\failure-to-rule.ps1 -FailureID "FAIL-003" -RuleID "PPL-002"
-```
-
-#### 功能（計劃中）
-- 分析失敗記錄，建議哪些應該轉化為規則
-- 自動生成規則文件草稿
-- 更新失敗記錄的 `converted_to_rules` 狀態
-- 更新 INDEX.yaml 統計數據
-
-## 開發新工具
-
-如果需要開發新的失敗學習工具，請遵循以下指南：
-
-### 1. 工具命名規範
-- PowerShell 腳本：`action-noun.ps1`（如 `check-failure-patterns.ps1`）
-- Node.js 腳本：`action-noun.js`（如 `validate-json.js`）
-- Python 腳本：`action_noun.py`（如 `analyze_failures.py`）
-
-### 2. 必須包含的功能
-- **幫助訊息**：`-Help` 或 `--help` 參數
-- **錯誤處理**：優雅處理錯誤，提供清晰的錯誤訊息
-- **日誌輸出**：使用一致的日誌格式
-- **返回碼**：成功返回 0，失敗返回非 0
-
-### 3. 文檔要求
-- 在此 README.md 中添加工具說明
-- 在腳本開頭添加註解說明用途和使用方式
-- 提供使用範例
-
-### 4. 測試要求
-- 提供測試用例
-- 在 `.failure/tools/tests/` 目錄中
-
-## 工具使用最佳實踐
-
-### Agent 使用場景
-
-#### 任務開始前
-```powershell
-# 檢查相關失敗模式
-.\.failure\tools\check_failures.ps1 -TaskID $TASK_ID
-```
-
-#### 任務執行中
-```bash
-# 驗證 JSON 文件
-node .failure/tools/validate_json.js dev/pipeline/TASK_QUEUE.json
-```
-
-#### 任務失敗後
-```powershell
-# 建立失敗記錄
-.\.failure\tools\log_failure.ps1 -Interactive
-```
-
-### 定期維護
-```powershell
-# 每週生成失敗報告
-.\failure\tools\failure-report.ps1 -Output "weekly-failure-report.md"
-
-# 分析哪些失敗應該轉化為規則
-.\failure\tools\failure-to-rule.ps1 -Analyze
-```
-
-## 相關資源
-
-- **失敗記錄索引**：`.failure/INDEX.yaml`
-- **規則系統**：`.rule/INDEX.yaml`
-- **Agent 工作流程**：`.rule/general/agent-workflow.yaml`
+Looking up known failures: read `.failure/INDEX.yaml`, then Grep `.failure/` for the task's scope or error text. Record a new failure by adding a YAML file from the template in INDEX.yaml and listing it in `load_order`; lessons that are not reproducible failure patterns go to `kenaz learn add`.

package/core/.formation/bifrost/exec.js

@@ -19,7 +19,7 @@ const { spawn, spawnSync } = require('child_process');
 
 // First = default. From GET https://api.deepseek.com/models on 2026-10-11 (V4 ids, 1M context); the V3 ids still
 // answer but are no longer listed. `kenaz launch` re-reads the context window from that endpoint at start.
-const DEEPSEEK_MODELS = ['deepseek-v4-pro', 'deepseek-flash', 'deepseek-chat', 'deepseek-reasoner'];
+const DEEPSEEK_MODELS = ['deepseek-flash', 'deepseek-v4-pro', 'deepseek-chat', 'deepseek-reasoner']; // flash = default (user decision 2026-10-12)
 const DEEPSEEK_BASE_URL = 'https://api.deepseek.com/anthropic';
 const DEEPSEEK_CONTEXT_TOKENS = { 'deepseek-v4-pro': 1048576, 'deepseek-flash': 1048576, 'deepseek-chat': 128000, 'deepseek-reasoner': 128000 };
 const DEEPSEEK_FAST = 'deepseek-flash'; // Claude Code's small/fast slot (titles, summaries): the cheap model
@@ -38,12 +38,37 @@ function parseExecutorModel(raw) {
     return { adapter, id };
   }
   if (adapter === 'deepseek') {
-    if (!DEEPSEEK_MODELS.includes(id)) throw new Error(`unknown deepseek model '${id}'; valid: ${DEEPSEEK_MODELS.map((i) => 'deepseek:' + i).join(', ')}`);
-    return { adapter, id };
+    // Any id the vendor may add later is accepted (no release needed); `deepseek:` alone = the user's saved default.
+    const model = id || providerDefault('deepseek') || DEEPSEEK_MODELS[0];
+    if (!MODEL_ID.test(model)) throw new Error(`invalid deepseek model id '${id}' (letters, digits, . _ - only); known: ${DEEPSEEK_MODELS.map((i) => 'deepseek:' + i).join(', ')}`);
+    return { adapter, id: model };
   }
   throw new Error(`unknown executor prefix '${m[1]}:'; valid prefixes: codex:<id>, deepseek:<model>`);
 }
 
+const MODEL_ID = /^[A-Za-z0-9][\w.-]{0,63}$/;
+const configFile = (home) => path.join(home, '.kenaz', 'config.json');
+
+/** The user's own default model for a provider: KENAZ_<PROVIDER>_MODEL, else ~/.kenaz/config.json
+ *  providers.<provider>.model (written by `kenaz launch --provider p --model m --save-default`); null when unset. */
+function providerDefault(provider, env = process.env, home = os.homedir()) {
+  const e = env['KENAZ_' + provider.toUpperCase() + '_MODEL'];
+  if (e && e.trim()) return e.trim();
+  try { const m = JSON.parse(fs.readFileSync(configFile(home), 'utf8')).providers[provider].model; return typeof m === 'string' && m.trim() ? m.trim() : null; } catch { return null; }
+}
+
+/** Save the default (other keys in config.json are kept; atomic write). */
+function saveProviderDefault(provider, model, home = os.homedir()) {
+  let cfg = {};
+  try { cfg = JSON.parse(fs.readFileSync(configFile(home), 'utf8')) || {}; } catch { /* new file */ }
+  cfg.providers = { ...(cfg.providers || {}), [provider]: { ...((cfg.providers || {})[provider] || {}), model } };
+  fs.mkdirSync(path.dirname(configFile(home)), { recursive: true });
+  const tmp = configFile(home) + '.tmp';
+  fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2) + '\n');
+  fs.renameSync(tmp, configFile(home));
+  return configFile(home);
+}
+
 /** DEEPSEEK_API_KEY, else deepseek_api_key in ~/.kenaz/credentials.yaml; null when neither. */
 function deepseekKey(env = process.env, home = os.homedir()) {
   if (env.DEEPSEEK_API_KEY && env.DEEPSEEK_API_KEY.trim()) return env.DEEPSEEK_API_KEY.trim();
@@ -175,4 +200,4 @@ async function main(argv) {
 }
 
 if (require.main === module) main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
-module.exports = { otherVendorSession, parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };
+module.exports = { otherVendorSession, providerDefault, saveProviderDefault, MODEL_ID, parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };

package/core/.formation/bifrost/launch.js

@@ -286,12 +286,7 @@ function renderOverride(prompt, bootContext, { policy = BOOT_POLICY, projectPath
   const content = `${projectInstruction}${bootContext}${memoryStartupDoc}${codexDdxInjection}You have been activated as ${policy.specialist} via Bifröst.
 
 IMPORTANT — Shell compatibility (you are running under Codex which uses PowerShell on Windows):
-- When calling phase-gate.js exit with --data, do NOT pass JSON inline. PowerShell mangles JSON quotes.
-- Instead: write JSON to a temp file, then use --data-file=path. Example:
-  1. Write: Set-Content -Path _phase_data.json -Value '{"ash_loaded":true,"poem_displayed":true,"session_handoff_loaded":false}'
-  2. Run: node .specialist/tools/phase-gate.js exit --phase=0 --data-file=_phase_data.json
-  3. Cleanup: Remove-Item _phase_data.json
-- This applies to ALL phase-gate.js exit calls, not just Phase 0.
+- Do not pass inline JSON on the command line; PowerShell mangles JSON quotes. Write it to a temp file and pass the path instead.
 
 ${prompt}
 

package/core/.formation/bifrost/launch.test.js

@@ -104,7 +104,7 @@ test('override ends with fast precedence and retains full project pin', () => {
   assert.equal((fast.match(/## Codex Bootstrap Policy/g) || []).length, 1);
   assert.ok(fast.includes(`projectPath="${projectPath}"`));
   const full = api.renderOverride('fixture', '', { projectPath, policy: resolveBootPolicy({ depth: 'kernel' }) });
-  assert.ok(full.includes(`--project-path="${projectPath}"`));
+  assert.ok(full.includes(`projectPath="${projectPath}"`));
   assert.match(full, /HALT and emit recovery/);
   assert.doesNotMatch(full, /Ansuz fast boot/);
 });

package/core/.formation/bifrost/provider-launch.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * `kenaz launch --provider deepseek [--model deepseek-v4-pro|deepseek-flash|...] [claude args...]`
+ * `kenaz launch --provider deepseek [--model deepseek-flash (default)|deepseek-v4-pro|...] [claude args...]`
  * Starts Claude Code with every model request sent to another vendor's Anthropic-compatible endpoint, so
  * Ansuz (/kenaz:Ansuz), its subagents and background requests run on that vendor and use no Claude quota.
  * The key is read from the env or ~/.kenaz/credentials.yaml and set only in the claude child's env: never in
@@ -9,7 +9,7 @@
  */
 const os = require('os');
 const { spawn } = require('child_process');
-const { deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, DEEPSEEK_MODELS, winQuote } = require('./exec');
+const { deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, DEEPSEEK_MODELS, winQuote, providerDefault, saveProviderDefault, MODEL_ID } = require('./exec');
 
 const PROVIDERS = {
   deepseek: {
@@ -17,29 +17,31 @@ const PROVIDERS = {
     keyHelp: 'set DEEPSEEK_API_KEY, or add `deepseek_api_key: <key>` to ~/.kenaz/credentials.yaml',
   },
 };
-const USAGE = 'usage: kenaz launch --provider <' + Object.keys(PROVIDERS).join('|') + '> [--model <id>] [claude args...]';
+const USAGE = 'usage: kenaz launch --provider <' + Object.keys(PROVIDERS).join('|') + '> [--model <id> [--save-default]] [claude args...]';
 
 function parse(argv) {
-  const rest = []; let provider = null; let model = null;
+  const rest = []; let provider = null; let model = null; let save = false;
   for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--save-default') { save = true; continue; }
     const m = /^--(provider|model)(?:=(.*))?$/.exec(argv[i]);
     if (!m) { rest.push(argv[i]); continue; }
     const v = m[2] !== undefined ? m[2] : argv[++i];
     if (m[1] === 'provider') provider = v; else model = v;
   }
-  return { rest, provider, model };
+  return { rest, provider, model, save };
 }
 
-/** Child process plan: { bin, args, env }. live = {id: context_window} from the vendor's model list (or null):
- *  a listed id is valid even if it is newer than the built-in list, and its window drives auto-compact.
- *  Throws with a user-facing message. */
+/** Child process plan: { bin, args, env }. Model = --model, else the user's own default (KENAZ_<P>_MODEL or
+ *  ~/.kenaz/config.json, see providerDefault), else the built-in default. live = {id: context_window} from the
+ *  vendor's model list (or null): when known it is the only validation (new vendor models work without a Kenaz
+ *  release); when unreachable any well-formed id is accepted. Throws with a user-facing message. */
 function plan(argv, env = process.env, home = os.homedir(), live = null) {
   const { rest, provider, model } = parse(argv);
   const p = PROVIDERS[provider];
   if (!p) throw new Error((provider ? `unknown provider '${provider}'. ` : '') + USAGE);
-  const id = model || p.models[0];
-  const valid = [...new Set([...p.models, ...Object.keys(live || {})])];
-  if (!valid.includes(id)) throw new Error(`unknown ${provider} model '${id}'; valid: ${valid.join(', ')}`);
+  const id = model || providerDefault(provider, env, home) || p.models[0];
+  if (!MODEL_ID.test(id)) throw new Error(`invalid ${provider} model id '${id}'`);
+  if (live && !(id in live)) throw new Error(`unknown ${provider} model '${id}'; the vendor currently lists: ${Object.keys(live).join(', ')}`);
   const key = p.key(env, home);
   if (!key) throw new Error(`${provider}: no API key (${p.keyHelp})`);
   const childEnv = { ...env, ...p.env(id, key, live && live[id]), CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
@@ -56,6 +58,11 @@ async function main(argv, out = console.log, deps = {}) {
   const live = key ? await (deps.live || p.live)(key) : null;
   let pl;
   try { pl = plan(argv, env, home, live); } catch (e) { out(e.message); return 2; }
+  const { model: asked, save } = parse(argv);
+  if (save) {
+    if (!asked) { out('--save-default needs --model <id>'); return 2; }
+    out(`kenaz launch: ${pl.provider} default model saved: ${pl.model} (${saveProviderDefault(pl.provider, pl.model, home)})`);
+  }
   out(`kenaz launch: Claude Code on ${pl.provider} (${pl.model}, context ${pl.context} tokens); no Claude quota is used in this session`);
   const win = (deps.platform || process.platform) === 'win32'; // claude is a .cmd shim on npm installs
   const child = (deps.spawn || spawn)(win ? [pl.bin, ...pl.args].map(winQuote).join(' ') : pl.bin, win ? [] : pl.args,

package/core/.formation/bifrost/provider-launch.test.js

@@ -25,7 +25,7 @@ test('deepseek: every model slot points at DeepSeek, key only in the child env,
   assert.strictEqual(e.ANTHROPIC_BASE_URL, 'https://api.deepseek.com/anthropic');
   assert.strictEqual(e.ANTHROPIC_AUTH_TOKEN, KEY);
   for (const k of ['ANTHROPIC_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_OPUS_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL']) {
-    assert.strictEqual(e[k], 'deepseek-v4-pro', k);
+    assert.strictEqual(e[k], 'deepseek-flash', k);
   }
   assert.strictEqual(e.ANTHROPIC_SMALL_FAST_MODEL, 'deepseek-flash'); assert.strictEqual(e.ANTHROPIC_DEFAULT_HAIKU_MODEL, 'deepseek-flash');
   assert.strictEqual(e.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '1048576', 'V4 window from the built-in table when the live list is unavailable');
@@ -54,7 +54,7 @@ test('control: no key, unknown provider or model -> exit 2 and claude is never s
     [['--provider', 'deepseek'], {}, /no API key/],
     [['--provider', 'nope'], { DEEPSEEK_API_KEY: KEY }, /unknown provider 'nope'/],
     [[], { DEEPSEEK_API_KEY: KEY }, /usage: kenaz launch --provider <deepseek>/],
-    [['--provider', 'deepseek', '--model', 'gpt-x'], { DEEPSEEK_API_KEY: KEY }, /valid: deepseek-v4-pro, deepseek-flash, deepseek-chat, deepseek-reasoner/],
+    [['--provider', 'deepseek', '--model', 'bad id'], { DEEPSEEK_API_KEY: KEY }, /invalid deepseek model id/],
   ]) {
     const calls = [], lines = [];
     const rc = await main(argv, (l) => lines.push(l), { spawn: fakeSpawn(calls), live: async () => null, env, home: home(), platform: 'linux' });
@@ -74,3 +74,27 @@ test('live model list: a newer listed id is accepted and its context window driv
   assert.strictEqual(calls[0].opts.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '2097152');
   assert.match(lines[0], /context 2097152 tokens/);
 });
+
+test('model not in the vendor list is refused only when the list is known; unknown list = accepted (no release needed)', async () => {
+  const calls = [], lines = [];
+  const rc = await main(['--provider', 'deepseek', '--model', 'gpt-x'], (l) => lines.push(l), { spawn: fakeSpawn(calls), live: async () => ({ 'deepseek-flash': 1048576 }), env: { DEEPSEEK_API_KEY: KEY }, home: home(), platform: 'linux' });
+  assert.strictEqual(rc, 2); assert.strictEqual(calls.length, 0); assert.match(lines.join(String.fromCharCode(10)), /the vendor currently lists: deepseek-flash/);
+  const calls2 = [];
+  assert.strictEqual(await main(['--provider', 'deepseek', '--model', 'deepseek-v9'], () => {}, { spawn: fakeSpawn(calls2), live: async () => null, env: { DEEPSEEK_API_KEY: KEY }, home: home(), platform: 'linux' }), 0);
+  assert.strictEqual(calls2[0].opts.env.ANTHROPIC_MODEL, 'deepseek-v9');
+});
+
+test('the user picks the default: --save-default writes ~/.kenaz/config.json (other keys kept), env overrides it, --model overrides both', async () => {
+  const h = home(); fs.mkdirSync(path.join(h, '.kenaz'));
+  fs.writeFileSync(path.join(h, '.kenaz', 'config.json'), JSON.stringify({ setupCompleted: true }));
+  const run = async (argv, env = {}) => { const calls = [], lines = []; const rc = await main(argv, (l) => lines.push(l), { spawn: fakeSpawn(calls), live: async () => null, env: { DEEPSEEK_API_KEY: KEY, ...env }, home: h, platform: 'linux' }); return { rc, model: calls[0] && calls[0].opts.env.ANTHROPIC_MODEL, lines }; };
+  assert.strictEqual((await run(['--provider', 'deepseek'])).model, 'deepseek-flash', 'built-in default');
+  const saved = await run(['--provider', 'deepseek', '--model', 'deepseek-v4-pro', '--save-default']);
+  assert.strictEqual(saved.model, 'deepseek-v4-pro'); assert.match(saved.lines.join(String.fromCharCode(10)), /default model saved: deepseek-v4-pro/);
+  const cfg = JSON.parse(fs.readFileSync(path.join(h, '.kenaz', 'config.json'), 'utf8'));
+  assert.strictEqual(cfg.setupCompleted, true); assert.strictEqual(cfg.providers.deepseek.model, 'deepseek-v4-pro');
+  assert.strictEqual((await run(['--provider', 'deepseek'])).model, 'deepseek-v4-pro', 'saved default used');
+  assert.strictEqual((await run(['--provider', 'deepseek'], { KENAZ_DEEPSEEK_MODEL: 'deepseek-chat' })).model, 'deepseek-chat', 'env overrides saved');
+  assert.strictEqual((await run(['--provider', 'deepseek', '--model', 'deepseek-flash'])).model, 'deepseek-flash', '--model overrides');
+  assert.strictEqual((await run(['--provider', 'deepseek', '--save-default'])).rc, 2, '--save-default without --model');
+});

package/core/.formation/bifrost/shared/ansuz-boot-policy.js

@@ -19,11 +19,11 @@ function renderBootstrap({ policy, projectPath, port = '18080', contextual = fal
   const fast = [
     'Ansuz fast boot (elixir) is the default. This bootstrap policy supersedes any older instruction to run Phase 0, including the Phase 0 sentence inside elixir.',
     'Check kenaz_ping with the active projectPath when available. If unavailable, report that the Kenaz server is unavailable and continue only read-only inspection and analysis using local evidence.',
-    'Lightweight Phase 0 uses the supplied boot context and local project evidence; do not run phase-gate Phase 0 or its boot rituals in fast mode. This also supersedes legacy handoff instructions that promise Phase 0 archival. When offline, defer state-changing execution and memory-dependent work until the required service is restored.',
+    'Lightweight Phase 0 uses the supplied boot context and local project evidence; do not run Phase 0 boot rituals in fast mode. This also supersedes legacy handoff instructions that promise Phase 0 archival. When offline, defer state-changing execution and memory-dependent work until the required service is restored.',
     'Existing authorization, scope, verification, task tracking, and merge restrictions remain in force.',
   ].join('\n');
-  const command = `node .specialist/tools/phase-gate.js enter --phase=0 --specialist=${(policy?.specialist || 'Ansuz').toLowerCase()}${projectPath ? ` --project-path="${projectPath}"` : ''}`;
-  const full = `Before running phase-gate enter, call kenaz_ping with the active projectPath. If it errors or times out, HALT and emit recovery: confirm Kenaz Dashboard on port ${port}, re-run setup-codex, and restart the Codex session.\nExecute Phase 0 initialization now: run \`${command}\` and follow its checklist.`;
+  const full = `Before starting Phase 0, call kenaz_ping with the active projectPath${projectPath ? ` ("${projectPath}")` : ''}. If it errors or times out, HALT and emit recovery: confirm the Kenaz server on port ${port}, re-run setup-codex, and restart the Codex session.
+Execute Phase 0 initialization now using the supplied boot context and local project evidence.`;
   if (contextual) return `## Codex Bootstrap Policy\n\nFor Ansuz without an explicit full boot or legacy depth:\n${fast}\n\nFor explicit --full / --boot-mode full or kernel depth, and for other specialists: retain the full bootstrap guard; call kenaz_ping before Phase 0 and HALT with recovery instructions if it is unavailable. Use the active specialist and project-path for Phase 0.\n`;
   return `## Codex Bootstrap Policy (${policy.mode})\n\n${policy.mode === 'fast' ? fast : full}\n`;
 }

package/core/.formation/bifrost/shared/ansuz-boot-policy.test.js

@@ -28,8 +28,7 @@ test('renderer preserves full project pin and limits fast offline work without r
   const projectPath = 'C:\\example project\\quotation';
   const full = renderBootstrap({ policy: resolveBootPolicy({ full: true }), projectPath });
   assert.match(full, /HALT/);
-  assert.ok(full.includes(`--project-path="${projectPath}"`));
-  assert.match(full, /--specialist=ansuz/);
+  assert.ok(full.includes(`"${projectPath}"`));
   const fast = renderBootstrap({ policy: resolveBootPolicy() });
   assert.match(fast, /Lightweight Phase 0/);
   assert.match(fast, /supersedes any older instruction/);

package/core/.formation/tools/__tests__/dispatch-cwd-project.test.js

@@ -0,0 +1,42 @@
+// dispatch.js without --project-path, run from a user's project through the plugin (cwd = that project, ROOT = core):
+// the card and the worktree belong to the cwd project, not the core (repro 2026-10-12: '任務不存在' and a worktree
+// created inside the core repo, leaving Ansuz waiting on a subagent that had no card).
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..', '..');
+const DISPATCH = path.join(ROOT, '.formation', 'tools', 'dispatch.js');
+const git = (cwd, args) => spawnSync('git', ['-c', 'user.name=t', '-c', 'user.email=t@t', ...args], { cwd, encoding: 'utf8' });
+
+function project() {
+  const p = fs.mkdtempSync(path.join(os.tmpdir(), 'dcp-'));
+  git(p, ['init', '-q']); fs.writeFileSync(path.join(p, 'README.md'), 'x'); git(p, ['add', '-A']); git(p, ['commit', '-q', '-m', 'init']);
+  for (const d of ['backlog', 'active', 'done', 'blocked', 'cancel']) fs.mkdirSync(path.join(p, '.kenaz', 'tasks', d), { recursive: true });
+  fs.writeFileSync(path.join(p, '.kenaz', 'project.yaml'), 'name: dcp\n');
+  fs.writeFileSync(path.join(p, '.kenaz', 'tasks', 'backlog', 'TASK_7201_x.yaml'),
+    'id: TASK_7201\ntitle: "Unique card title 7201"\nstatus: backlog\npriority: low\nrigor: low\nrequirements: ["r"]\nacceptance_criteria: ["a"]\nscope_paths: [x.txt]\n');
+  return p;
+}
+
+const env = () => { const e = { ...process.env }; for (const k of ['CLAUDE_PROJECT_DIR', 'KENAZ_PROVIDER', 'ANTHROPIC_BASE_URL', 'CODEX_SESSION_ID', 'CODEX_THREAD_ID']) delete e[k]; return e; };
+
+test('from a user project without --project-path: the card is found and isolation targets that project', () => {
+  const p = project();
+  const r = spawnSync(process.execPath, [DISPATCH, '--skill=do', '--task=TASK_7201', '--dispatch-mode=subagent', '--dry-run'], { cwd: p, env: env(), encoding: 'utf8' });
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.doesNotMatch(r.stderr, /任務不存在/);
+  const j = JSON.parse(r.stdout);
+  assert.match(j.promptText, /Unique card title 7201/);
+  assert.match(r.stderr, new RegExp('cross-project detected .*' + path.basename(p)));
+});
+
+test('control: in the core repo itself nothing changes (same-project Agent worktree)', () => {
+  const r = spawnSync(process.execPath, [DISPATCH, '--skill=do', '--task=TASK_2376', '--dispatch-mode=subagent', '--dry-run'], { cwd: ROOT, env: env(), encoding: 'utf8' });
+  assert.strictEqual(r.status, 0, r.stderr);
+  const j = JSON.parse(r.stdout);
+  assert.strictEqual(j.isolation.mode, 'agent_tool_worktree');
+});