model-orchestrator 0.1.15 → 0.1.17

package/templates/common/protocols/deep-research.md

@@ -31,11 +31,11 @@ Agreement is weak evidence. Disagreement is the signal.
 
 ## Level 1: one agent
 
-You still get the shape. Run PLAN as its own turn and inspect it before spending anything. Run the sweep. Then run a **fresh-context adversarial turn** with a brief that says "attack the premise; list what this report would get wrong if its sources were stale". Plant one deliberately wrong figure in the brief and see whether it corrects it: if it does not, its confirmations are worth less than they look. Mark every claim.
+You still get the shape. Run PLAN as its own turn and inspect it before spending anything. Run the sweep. Then run a **fresh-context second-opinion turn** with a brief that says "question the premise; list what this report would get wrong if its sources were stale". Plant one deliberately wrong figure in the brief and see whether it corrects it: if it does not, its confirmations are worth less than they look. Mark every claim.
 
 ## Level 2 and up: three engines, one triager
 
-Fan out the same PLAN to three different model families through their CLIs (a web-sweep lane, an adversarial-read lane, a live-data lane). Run them through `cli-run` so a run that produced nothing is caught as `rc=10` rather than read as an empty finding. The orchestrator triages: it opens the primary sources itself, marks each claim, and writes the brief. Only the orchestrator writes the durable record; every other engine proposes.
+Fan out the same PLAN to three different model families through their CLIs (a web-sweep lane, a second-opinion-read lane, a live-data lane). Run them through `cli-run` so a run that produced nothing is caught as `rc=10` rather than read as an empty finding. The orchestrator triages: it opens the primary sources itself, marks each claim, and writes the brief. Only the orchestrator writes the durable record; every other engine proposes.
 
 Known failure shape: one engine will return confident unsourced numerics and claim full coverage. Downgrade those to hypothesis. The engines that report their own gaps honestly are the ones to weight.
 

package/templates/common/protocols/gap-analysis.md

@@ -14,7 +14,7 @@ Verification asks "is what I did correct?". Gap analysis asks "what did I not do
 ## Who runs it
 
 - **Level 1 (one agent):** the same agent, in a fresh turn, with a brief that says "you are looking for what is missing; do not re-verify what is present". Fresh context matters more than a different model.
-- **Level 2 and up:** a **different model family** reading the same artifact. Disagreement between two families is the cheapest available signal that something is soft. The adversarial coder lane (a second-opinion CLI in read-only mode) is the natural fit.
+- **Level 2 and up:** a **different model family** reading the same artifact. Disagreement between two families is the cheapest available signal that something is soft. The second-opinion coder lane (read-only mode) is the natural fit.
 - **Level 3:** make it recurring. A weekly audit job enumerates live state (lanes, jobs, services, model lists), diffs it against the plan, and files a report. It catches the dead lane and the silently renamed model nobody noticed.
 
 ## The second half: analyze, compare, suggest

package/templates/common/protocols/propagate.md

@@ -1,10 +1,10 @@
 # Propagate: change completeness
 
-**A rename is a refactor, not a single-file edit.** Any change to a name, term, path, slug, schema field, routing rule or shared convention has a blast radius, and the goal is zero silent strays.
+**A rename is a refactor, not a single-file edit.** Any change to a name, term, path, slug, schema field, routing rule or shared convention reaches everything that uses it, and the goal is zero silent strays.
 
 This is retrieval work. It stays with the orchestrator (or a cheap worker for the grep sweep). It never goes to the deep tier: a judgment model re-deriving a file list is the most expensive routing mistake there is.
 
-## 1. Map the blast radius (before editing anything)
+## 1. Map everything it touches (before editing anything)
 
 - **Docs and notes:** backlinks to the thing being renamed; literal search for the old term and its link forms. With obsidian-tc: `get_backlinks`, `search_text`, then `find_unresolved_links` after the change (`protocols/memory-and-record.md`).
 - **Memory / instructions:** grep every instructions file your agents read (`CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `QWEN.md`, custom instructions) and any memory store.

package/templates/intermediate/CLI-RUN.md

@@ -68,7 +68,7 @@ qwen is the lane whose own success flags lie: an upstream 400 comes back as exit
 
 ## The route: which model, and how hard it thinks
 
-A lane you do not pin runs on **its own config file**, which this tool cannot see. That is the quiet failure this section exists for: a CLI configured months ago at `reasoning_effort = "low"` keeps auditing at low effort while your routing docs describe an adversarial pass, and nothing anywhere says so.
+A lane you do not pin runs on **its own config file**, which this tool cannot see. That is the quiet failure this section exists for: a CLI configured months ago at `reasoning_effort = "low"` keeps auditing at low effort while your routing docs describe a second-opinion pass, and nothing anywhere says so.
 
 Pin it per call, or per lane:
 
@@ -114,9 +114,9 @@ The log records what was **requested**, on every record including a run refused
 
 That is each vendor's documented headless shape (`-p`, `exec`). Two consequences: argv is visible to other processes on the machine, so a prompt is never the place for a key; and argv is bounded by the OS (`ARG_MAX`), so a very large brief should be referenced by path inside the prompt rather than pasted whole.
 
-## lanes.json fails closed
+## lanes.json refuses by default
 
-Absent: every lane enabled, nothing pinned. Present but malformed or unreadable: every lane refused (exit 13) until it is fixed. A half-written config never re-enables a lane the installer disabled. `defaults` is optional and held to the same standard: a malformed entry, an unknown lane, an unknown key, a value outside the charset, or an effort pinned on a lane that has no reasoning flag all fail the whole file closed rather than being skipped quietly.
+Absent: every lane enabled, nothing pinned. Present but malformed or unreadable: every lane refused (exit 13) until it is fixed. A half-written config never re-enables a lane the installer disabled. `defaults` is optional and held to the same standard: a malformed entry, an unknown lane, an unknown key, a value outside the charset, or an effort pinned on a lane that has no reasoning flag all make the whole file refuse by default rather than being skipped quietly.
 
 ## A killed lane is not a deliverable
 

package/templates/intermediate/DELEGATION_MATRIX.md

@@ -15,7 +15,7 @@ Generated {{DATE}} from the AIs you said you have: `{{AI_IDS}}`.
 | Many independent items each needing its own agent turn | a concurrent fan-out lane | one call, N children, on a subscription |
 | Live web or social reads | the live-data CLI | subscription-covered; the same search on the API bills per call |
 | Code review, no changes | standard tier, or the second-coder CLI | a different model family catches what one misses |
-| Adversarial audit of a security-shaped diff | the second-coder CLI in read-only audit mode | Claude writes, a second family attacks, the orchestrator reproduces |
+| Second-opinion audit of a security-shaped diff | the second-coder CLI in read-only audit mode | Claude writes, a second family challenges, the orchestrator reproduces |
 | Deep architecture / planning | deep tier | expensive to get wrong |
 | Well-specified execution | the orchestrator | execution does not need the top tier |
 | Long-document analysis | the largest-context lane, or caching on the primary | window size vs re-query cost |

package/templates/intermediate/ROUTING.md

@@ -31,10 +31,10 @@ Rule of thumb: never spend a frontier token on a task a cheap tier finishes corr
 |---|---|
 | 0 Route | live probe for access; `cli-run` lanes are $0 and uncapped |
 | 1 Map | the orchestrator sweeps{{STAGE1_LANES}} |
-| 2 Judge | deep tier, on the finished map: a named risk and a named flaw |
+| 2 Judge | deep tier, on the finished map: one named weak spot and one gap in the request |
 | 3 Build | the orchestrator, against the installed dependency's source |
-| 4 Scan | secret + static + dependency scanners, diff-scoped, fail closed |
-| 5 Attack | security-shaped diff → {{ATTACK_LANE}}. Architecture-shaped → deep tier, build against plan. Never both |
+| 4 Scan | secret + static + dependency scanners, diff-scoped, refuses by default |
+| 5 Challenge | security-shaped diff → {{ATTACK_LANE}}. Architecture-shaped → deep tier, build against plan. Never both |
 | 5a Verify findings | finding-verifier, a different model family where you have one: CONFIRMED, NOT_REPRODUCED or INCONCLUSIVE per finding. Only CONFIRMED earns a repair |
 | 5b Ship | rollback id recorded, explicit human yes |
 | 6 Verify | real test, negative test seen red, old identifier re-grepped to zero |
@@ -58,7 +58,7 @@ One writer per run; every other lane proposes. Search before writing, index in t
 - **Long context:** mechanical digestion → fast tier in chunks; judgment over a long input → standard tier.
 - **Token discipline on every delegation:** pass only the context the delegate needs, never the conversation.
 - **Effort per agent:** deep xhigh, review, verification and build high, live research medium, bulk low.
-- **Three inputs, not one:** role picks the agent, complexity moves the effort, risk moves the tier and who reads it. A one-line auth change is simple and high-risk at once, and the risk decides. See `TIERS.md`.
+- **Three inputs, not one:** role picks the agent, complexity moves the effort, stakes move the tier and who reads it. A one-line auth change is simple and high-stakes at once, and the stakes decide. See `TIERS.md`.
 - **Pin the route when it matters:** a lane with no `--model`/`--effort` and no `defaults` entry in `bin/lanes.json` runs on its own config, which may be nothing like what this file describes. `cli-run --doctor` prints what each lane is pinned to, and every run logs the value requested and where it came from.
 
 ## Example routings

package/templates/intermediate/TIERS.md

@@ -47,21 +47,25 @@ reasoning than the reviewer judging its output.** When the plan is airtight the
 spec is carrying the thinking, so builder drops to medium. When the plan is
 vague, fix the plan; do not buy reasoning to paper over it.
 
-**Risk moves the tier and the reader, never just the effort.** These four are
+**Stakes move the tier and the reader, never just the effort.** These four are
 the ones worth naming, because their failures are not recoverable by editing the
 code afterwards.
 
-| Risk | Present when the change touches | What it buys |
+Stakes means what a mistake would cost: a security hole, leaked personal data,
+lost data, or something you can't undo. Most tasks are low-stakes and route
+normally.
+
+| Stakes | Present when the change touches | What it buys |
 |---|---|---|
-| security | auth, tokens, sessions, routes, untrusted input | the attack pass, ideally a different model family |
+| security | auth, tokens, sessions, routes, untrusted input | the challenge pass, ideally a different model family |
 | privacy | personal data, anything leaving the machine | the local lane, and a named check on what is sent |
 | data loss | deletion, bulk mutation, migrations, overwrites | a reviewed rollback path before the change is written |
 | irreversible | publishing, sending, rotating, anything with an audience | a human yes at Stage 5b, never an agent's |
 
-A risk raises code-reviewer to xhigh, and a security-shaped diff goes to the
-attack lane rather than to a second read by the same family. Risk is not a
-synonym for difficulty: a one-line change to an auth check is simple and
-high-risk at the same time, and it is the risk that decides the route.
+High stakes raise code-reviewer to xhigh, and a security-shaped diff goes to
+the challenge lane rather than to a second read by the same family. Stakes are
+not a synonym for difficulty: a one-line change to an auth check is simple and
+high-stakes at the same time, and it is the stakes that decide the route.
 
 **Reserve the top of the ladder for evidence.** xhigh and the escalation tier are
 bought with a named reason: a reproduced failure, a checkpoint that came back
@@ -70,7 +74,7 @@ task, not an escalation.
 
 ## Why split tiers: robustness first, cost second
 
-The split produces better work. The deep tier steers every build twice, and what it steers is **judgment, never retrieval**: the orchestrator sweeps the blast radius itself and hands the deep tier a finished map. Paying deep-tier rates for a file list is the most expensive routing mistake available.
+The split produces better work. The deep tier steers every build twice, and what it steers is **judgment, never retrieval**: the orchestrator sweeps everything it touches itself and hands the deep tier a finished map. Paying deep-tier rates for a file list is the most expensive routing mistake available.
 
 Against a baseline of "standard tier with no consults", default checkpoints are a spend increase. That is the accepted trade, not a saving to claim.
 

package/templates/tools/codecalc/CODECALC.md

@@ -36,7 +36,7 @@ The tools cannot help a model that never reaches for them. codecalc ships `SKILL
 
 ## What it is not
 
-Not a cloud sandbox for multi-tenant loads, not a replacement for a vendor's built-in interpreter when zero setup matters more than measurement. Its threat model is single-operator, local, stdio. It earns its keep when the correctness of a claim, not "it ran", is the point.
+Not a cloud sandbox for multi-tenant loads, not a replacement for a vendor's built-in interpreter when zero setup matters more than measurement. It assumes a single-operator, local, stdio setup. It earns its keep when the correctness of a claim, not "it ran", is the point.
 
 ## On a box (level 3)
 

package/templates/tools/obsidian-tc/OBSIDIAN-TC.md

@@ -11,7 +11,7 @@ A durable, searchable, governed store that the protocols can call by name:
 | Need in the protocols | obsidian-tc tool |
 |---|---|
 | find what exists before writing (deep research dedupe, gap analysis) | `semantic_search`, `search_text`, `search_regex` |
-| map a rename's blast radius (propagate) | `get_backlinks`, `find_unresolved_links`, `rewrite_link` |
+| map everything a rename touches (propagate) | `get_backlinks`, `find_unresolved_links`, `rewrite_link` |
 | record the end-to-end doc (build Stage 7) | `write_note` (compare-and-swap, confirmation on overwrite), `patch_note`, `append_note` |
 | keep inferred content honest | `write_note` with `provenance: "agent_synthesis"` runs a poison scan before the write lands |
 | keep a shared vault safe for several agents | JWT scopes, per-vault folder ACLs, a read-only kill switch, human-in-the-loop tokens |
@@ -56,9 +56,9 @@ Merge the block; do not replace the file.
 
 ## Security posture, read before a second agent touches it
 
-Zero-config mode boots with **auth off and no folder ACL**: anything that can reach the server has the same authority as raw filesystem access to the vault. That is acceptable only because the surface is local-only (the config fail-closes if you enable HTTP on a non-loopback host with auth off, and a DNS-rebinding guard protects loopback). Before exposing it to partially-trusted, remote or multi-agent callers, turn on `auth.mode: "jwt"` and set `acl.readPaths` / `writePaths` / `deletePaths` in the config file. Upstream `SECURITY.md` has the threat model and a private disclosure path.
+Zero-config mode boots with **auth off and no folder ACL**: anything that can reach the server has the same authority as raw filesystem access to the vault. That is acceptable only because the surface is local-only (the config refuses by default if you enable HTTP on a non-loopback host with auth off, and a DNS-rebinding guard protects loopback). Before exposing it to partially-trusted, remote or multi-agent callers, turn on `auth.mode: "jwt"` and set `acl.readPaths` / `writePaths` / `deletePaths` in the config file. Upstream `SECURITY.md` has the security notes and a private disclosure path.
 
-Track record worth knowing: an independent code audit of v1.8.1 (July 2026) found three security-relevant gaps (an ACL fail-closed bypass in enumeration tools, a compare-and-swap bypass through `upsert`, a poison-eligibility gap in preference extraction). All three were fixed upstream before they were filed; verified against the v1.25.0 source on 2026-09-03.
+Track record worth knowing: an independent code audit of v1.8.1 (July 2026) found three security-relevant gaps (an ACL bypass that let enumeration tools skip its refuse-by-default rule, a compare-and-swap bypass through `upsert`, a poison-eligibility gap in preference extraction). All three were fixed upstream before they were filed; verified against the v1.25.0 source on 2026-09-03.
 
 ## Level 3