model-orchestrator 1.0.5 → 1.0.7

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project are documented here. The format follows [Kee
 
 ## [Unreleased]
 
+## [1.0.7] - 2026-09-30
+
+### Fixed
+
+- Prefer an already-connected Claude worker MCP service in host routing, with the native CLI retained as a standalone fallback. Route suggestions and generated instructions describe the session, result, permission and environment boundaries; no MCP installation or automatic transport retry is added.
+- Enable the native `claude` CLI worker with print-mode JSON completion checks, existing permission rules, model and effort overrides, failure classification and shared timeout/cancellation handling. Codex-primary stacks can assign independent review to Claude Code; Claude-primary stacks retain Codex review. Generated lanes use executable names while manifest AI identities retain installer IDs. Claude fixtures record native success and authentication failures.
+- Keep supported lanes usable when an edited or unverifiable older runner is kept during an upgrade. Withhold unsupported lanes and their defaults from `lanes.json`, and report how to enable them with `--upgrade-runtime`.
+- Classify Claude's expired OAuth session and `Failed to authenticate` errors as auth (exit 14).
+- Match Claude HTTP codes only in API status fields or `API Error:` prefixes, so a 400 error mentioning 429 tokens stays rejected (exit 16).
+
+### Changed
+
+- Check and pin the Claude lane at 2.1.285, and replace its hand-written success fixture with a captured restricted live success at that version.
+
+## [1.0.6] - 2026-09-29
+
+### Added
+
+- The hermes lane takes `--provider` and `"provider"` in `bin/lanes.json` defaults, so a pinned model goes to a provider that serves it. A provider needs a model with it (a flag, a default or `HERMES_INFERENCE_MODEL`); otherwise cli-run refuses before the lane starts. Runs log `provider_requested` and `provider_source`.
+- `--doctor` notes a hermes model pinned without a provider, and a provider pinned without a model. The terminal route line shows the provider.
+
+### Fixed
+
+- A hermes model/provider mismatch (an upstream "model is not supported" or `model_not_found`, for example `grok-4.6` sent to `openai-codex`) is now class `rejected`, exit 16, with a problem line naming the mismatch and a fix pointing at `hermes model`. It was reported as a vague nonzero exit.
+- A pinned hermes route (`--model` or `--effort`, by flag or `lanes.json` default) no longer fails every run. cli-run placed those flags between `-z` and the prompt, and `-z` takes the prompt as its value, so Hermes refused the arguments ("argument -z/--oneshot: expected one argument"). Route flags now come before `-z`, and a Hermes argument error is reported as such rather than as a toolsets error.
+
+### Changed
+
+- The product website generates public Markdown mirrors, llms discovery files and agent navigation guidance from its existing documentation allowlist on each Git build.
+
 ## [1.0.5] - 2026-09-28
 
 ### Changed
@@ -557,7 +587,9 @@ First release.
 - Tests: a case per fix, judges proven to go red, mutation checks; `npm test` prints the current count.
 - Adversarial audit: two Codex rounds plus a two-engine review (Codex, Antigravity); findings and fixes in `docs/audit-brief.md`. After the review: subagents go to the project root (`--project`), snippet paths computed from `--dir`, lane sections rendered from the selection, a primary agent required, level 3 asks for API keys separately from CLIs, images and CLI installs pinned, an activation summary at the end of every install.
 
-[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.5...HEAD
+[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.7...HEAD
+[1.0.7]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.6...v1.0.7
+[1.0.6]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.5...v1.0.6
 [1.0.5]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.4...v1.0.5
 [1.0.4]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.2...v1.0.3

package/README.md

@@ -175,6 +175,8 @@ It helps an agent match a task to a model, effort level and toolset. Run `npx mo
 
 Run `npx model-orchestrator --yes --level 2 --ais claude-code,codex --primary claude-code --project . --dir ./ai-orchestrator`, then follow the activation summary. Claude Code can dispatch scoped work through `aunx cli-run codex --brief TASK_BRIEF.md` and use a different model family for review.
 
+For Codex as the main agent, set `--primary codex`. Independent review goes to Claude Code through a connected Claude worker MCP service when the host has one, or through `aunx cli-run claude --brief TASK_BRIEF.md`. The `claude` lane runs in `dontAsk` mode, so calls needing approval are denied; `--audit` stays Codex-only.
+
 ### How do I reduce Claude Code token usage?
 
 Install routing rules with `npx model-orchestrator`, so your agent has guidance for sending routine work to cheaper models and keeping reads scoped. Use `aunx route-metrics --summary` to measure where your work goes; savings depend on your tasks and model choices.
@@ -233,7 +235,7 @@ The lane wiring and the output judges were written against these versions, which
 
 | Lane | Vendor | Version this release was built against | Where that number is proved |
 |---|---|---|---|
-| `claude` | Anthropic | 2.1.226 | the npm pin the installer writes, `@anthropic-ai/claude-code@2.1.226` |
+| `claude` | Anthropic | 2.1.285 | `test/fixtures/claude-2.1.285-success.json`, a recorded run |
 | `codex` | OpenAI | 0.153.4 | `test/fixtures/codex-0.153.4.jsonl`, a recorded run |
 | `agy` | Google | 1.1.27 | `test/fixtures/agy-1.1.27.jsonl`, a recorded run |
 | `grok` | xAI | 1.0.5 | `test/fixtures/grok-1.0.5.json`, a recorded run |
@@ -241,12 +243,14 @@ The lane wiring and the output judges were written against these versions, which
 | `qwen` | Alibaba | 0.22.3 | `test/fixtures/qwen-0.22.3-nokey.json`, a recorded run |
 | `ollama` | Ollama | 0.34.4 | the pinned image the level 3 box runs, `ollama/ollama:0.34.4` |
 
-Generated from `src/catalog.js` by `npm run gen:catalog`; `npm test` fails if this table and the catalog disagree. Fixtures were captured 2026-09-06.
+Generated from `src/catalog.js` by `npm run gen:catalog`; `npm test` fails if this table and the catalog disagree. Original vendor fixtures were captured 2026-09-06; [fixture provenance](test/fixtures/README.md) records later captures and remaining gaps.
 
 <!-- vendor-table:end -->
 
 For npm-installed lanes, `builtAgainst` in the catalog supplies both the compatibility table and the install pin. Newer vendor versions may work or may change a flag the generated wiring uses. When a lane starts failing after a vendor upgrade, compare against this table first.
 
+The `claude` lane is checked against recorded Claude Code 2.1.285 runs: a restricted success, a sign-in failure and an expired-session failure.
+
 **The live canary runs on your machine, with your credentials.** That is what `aunx cli-run --doctor --run` (direct form: `node bin/cli-run.mjs --doctor --run`) is: it sends every enabled lane one tiny prompt through your own sign-ins and reports `canary ok` or `canary FAILED rc=` per lane. Choose this optional live check after setup or a vendor upgrade when you want to verify actual responses.
 
 CI runs the full suite against stub lanes on Ubuntu, macOS and Windows, Node 18/20/22, plus a packaged install into a clean consumer. Run the live check locally to verify your own sign-ins, quota and vendor versions.
@@ -267,6 +271,7 @@ Run `npm test` with your change. Keep templates free of logic and credential val
 ## Credits
 
 - [@shawnwows](https://x.com/shawnwows) reviewed the router and made the case for separating role, complexity and stakes instead of compressing them into one scale, for recording the model and effort a lane was actually asked for, and for verifying findings before they trigger repairs. All three shipped in 0.1.14.
+- [@shawnbissell](https://github.com/shawnbissell) added the native Claude Code worker lane (print-mode JSON judge, failure classes, dontAsk permissions) and the connected-MCP preference for Claude workers.
 
 ## License
 

package/bin/cli-run.mjs

@@ -15,6 +15,7 @@
 // NATIVE terminal event and refuses to call an empty run a success.
 //
 //   grok    --output-format json        -> stopReason == "end_turn" and text non-empty
+//   claude  -p --output-format json     -> result subtype success, is_error false, result non-empty
 //   codex   exec --json --color never -o F -> terminal {"type":"turn.completed"} and F non-empty
 //   agy     --output-format stream-json -> terminal {"event":"result"} status SUCCESS, response non-empty
 //   hermes  -z                          -> its exit code is already honest (0 ok / 1 none / 2 bad args)
@@ -53,15 +54,14 @@
 // problem/fix lines go to your terminal only, redacted.
 //
 // ROUTE: which model and reasoning effort a lane ran with.
+// Hermes also accepts --provider to select the provider serving that model.
 // A lane with no --model and no lanes.json default inherits whatever its own
 // config file says, which is invisible from here and is how a documented route
 // silently stops being the route that runs. --model / --effort pin it per call,
 // `defaults` in lanes.json pins it per lane, and every run logs the value that
 // was REQUESTED plus where the request came from (flag, lanes.json, or nothing
-// at all). It does not log an "actual". One lane of five (grok) does report a
-// model id in its own output; the other four report none, and a field present
-// for one lane, and absent for four, is worse than no field. It would also be a
-// provider-supplied string, which this log deliberately never holds.
+// at all). It does not log an "actual": model reporting varies by CLI and is
+// provider-supplied text, which this log deliberately never holds.
 
 import { spawn, spawnSync } from 'node:child_process';
 import { StringDecoder } from 'node:string_decoder';
@@ -71,7 +71,7 @@ import { join, dirname, delimiter, resolve, relative, isAbsolute, sep } from 'no
 import { tmpdir, homedir } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-export const LANES = ['grok', 'codex', 'agy', 'hermes', 'qwen'];
+export const LANES = ['grok', 'codex', 'agy', 'hermes', 'qwen', 'claude'];
 export const OK = 0, NO_DELIVERABLE = 10, NO_OUTPUT = 11, TIMEOUT = 12, UNAVAILABLE = 13, USAGE = 2;
 export const AUTH = 14, QUOTA = 15, REJECTED = 16, REFUSED = 17, CUT_SHORT = 18;
 
@@ -160,6 +160,31 @@ function lastJsonLine(out, needle, want) {
 const fail = (reason, detail) => ({ text: null, reason, detail });
 const pass = (text, detail) => ({ text, reason: 'ok', detail });
 
+// Print-mode JSON is one result object, not the stream-json event sequence.
+// Source: https://code.claude.com/docs/en/headless and /en/agent-sdk/agent-loop.
+function claudeResultObject(out) {
+  try {
+    const o = JSON.parse(out);
+    return isObj(o) && o.type === 'result' ? o : null;
+  } catch { return null; }
+}
+
+export function judgeClaude(rc, out) {
+  let o;
+  try { o = JSON.parse(out); } catch { return fail('not_json', 'stdout was not JSON'); }
+  if (!isObj(o) || o.type !== 'result') return fail('not_result', 'JSON was not a result object');
+  if (o.subtype !== 'success') return fail('bad_subtype', 'result did not report successful completion');
+  if (o.is_error !== false) return fail('is_error', 'result did not report is_error=false');
+  if (o.errors !== undefined) {
+    if (!Array.isArray(o.errors) || !o.errors.every(e => typeof e === 'string')) return fail('error_message_not_string', 'errors was not an array of strings');
+    if (o.errors.length) return fail('is_error', 'result carried execution errors');
+  }
+  if (o.stop_reason != null && !['end_turn', 'stop_sequence', 'refusal'].includes(o.stop_reason)) return fail('bad_stop_reason', 'result stopped before completing a response');
+  if (typeof o.result !== 'string') return fail('result_not_string', 'result was not a string');
+  const text = o.result.trim();
+  return text ? pass(text, 'subtype=success, is_error=false') : fail('empty_result', 'success but empty result');
+}
+
 export function judgeGrok(rc, out) {
   let o;
   try {
@@ -199,7 +224,11 @@ export function judgeHermes(rc, out, err) {
     // hermes collapses every upstream failure into one exit code; its stderr
     // is the only place the cause is named.
     const blob = String(err || '').toLowerCase(); // stderr only: stdout is the agent's own prose
-    if (hermesQuotaText(blob)) why += ': upstream free tier degraded or limited, a retry is reasonable';
+    // A mismatch is checked first: a retry cannot fix it, and an unrelated
+    // "limit" warning on stderr must not turn it into a quota report.
+    if (hermesMismatchLine(err) || hermesMismatchLine(out, { vendorShape: true })) why += ': model/provider mismatch, the provider does not serve this model';
+    else if (hermesQuotaText(blob)) why += ': upstream free tier degraded or limited, a retry is reasonable';
+    else if (hermesArgError(blob)) why += ': hermes rejected its arguments, a caller bug and not a lane fault';
     else if (blob.includes('toolset')) why += ': invalid --toolsets value, a caller bug and not a lane fault';
     return fail('exit_nonzero', `hermes exit ${rc}: ${why}`);
   }
@@ -251,21 +280,28 @@ export function judgeQwen(rc, out) {
 // CLI's own --help, not remembered. A lane with `effort: null` has no reasoning
 // flag at all; asking for one there is a usage error, never a silent drop.
 //   grok    -m MODEL   --reasoning-effort EFFORT
+//   claude  --model M  --effort EFFORT
 //   codex   -m MODEL   -c model_reasoning_effort="EFFORT"   (a TOML override, hence the quotes)
 //   agy     --model M  --effort EFFORT                      (low|medium|high)
-//   hermes  -m MODEL   --reasoning LEVEL                    (none|minimal|...)
+//   hermes  -m MODEL   --reasoning LEVEL   --provider ID    (none|minimal|...)
 //   qwen    -m MODEL   no reasoning flag
+// Only hermes takes a provider: one hermes install signs in to many providers,
+// and a model id sent to a provider that does not serve it is an HTTP 400
+// (grok-4.6 on openai-codex). `hermes -z --provider` without a model exits 2,
+// so cli-run refuses that pairing before the lane starts.
 export const LANE_FLAGS = {
-  grok: { model: (v) => ['-m', v], effort: (v) => ['--reasoning-effort', v] },
-  codex: { model: (v) => ['-m', v], effort: (v) => ['-c', `model_reasoning_effort="${v}"`] },
-  agy: { model: (v) => ['--model', v], effort: (v) => ['--effort', v] },
-  hermes: { model: (v) => ['-m', v], effort: (v) => ['--reasoning', v] },
-  qwen: { model: (v) => ['-m', v], effort: null }
+  claude: { model: (v) => ['--model', v], effort: (v) => ['--effort', v], provider: null },
+  grok: { model: (v) => ['-m', v], effort: (v) => ['--reasoning-effort', v], provider: null },
+  codex: { model: (v) => ['-m', v], effort: (v) => ['-c', `model_reasoning_effort="${v}"`], provider: null },
+  agy: { model: (v) => ['--model', v], effort: (v) => ['--effort', v], provider: null },
+  hermes: { model: (v) => ['-m', v], effort: (v) => ['--reasoning', v], provider: (v) => ['--provider', v] },
+  qwen: { model: (v) => ['-m', v], effort: null, provider: null }
 };
 
 // Auto is deliberately a small, static ladder. It is not a vendor capability
 // probe and it never chooses the top of a vendor's effort range.
 export const AUTO_EFFORT = {
+  claude: { small: 'medium', large: 'high' },
   codex: { small: 'medium', large: 'high' },
   grok: { small: 'medium', large: 'high' },
   agy: { small: 'medium', large: 'high' },
@@ -353,13 +389,16 @@ export function badRouteValue(kind, v) {
 }
 
 // --- adapters: build argv for a lane -------------------------------------
-// Route flags go in front of the prompt for every lane, because two lanes
-// (hermes, codex) take the prompt as a positional argument and a flag after it
-// is either ignored or read as part of it.
+// Route flags go in front of the prompt for every lane, because codex takes the
+// prompt as a positional argument and a flag after it is either ignored or read
+// as part of it. hermes needs them in front of -z itself: -z takes the prompt as
+// its own value, so `-z -m X prompt` is an argparse error ("argument -z/--oneshot:
+// expected one argument") and every pinned hermes route failed that way.
 function routeFlags(lane, opts) {
   const spec = LANE_FLAGS[lane];
   const out = [];
   if (!spec) return out;
+  if (opts.provider && spec.provider) out.push(...spec.provider(opts.provider));
   if (opts.model) out.push(...spec.model(opts.model));
   if (opts.effort && spec.effort) out.push(...spec.effort(opts.effort));
   return out;
@@ -369,6 +408,11 @@ export function buildArgv(lane, binary, prompt, opts, tmp) {
   const timeout = opts.timeout;
   const route = routeFlags(lane, opts);
   switch (lane) {
+    case 'claude':
+      // dontAsk denies calls needing approval and retains configured allow/deny
+      // rules. It grants no new permissions and is not a filesystem sandbox.
+      // -- ends option parsing so even a brief starting with a dash is data.
+      return { argv: [binary, '-p', '--output-format', 'json', '--permission-mode', 'dontAsk', ...route, '--', prompt] };
     case 'grok':
       return { argv: [binary, '--output-format', 'json', ...route, '-p', prompt] };
     case 'codex': {
@@ -384,7 +428,7 @@ export function buildArgv(lane, binary, prompt, opts, tmp) {
       return { argv: [binary, '--print-timeout', `${mins}m`, '--output-format', 'stream-json', ...route, '-p', prompt] };
     }
     case 'hermes':
-      return { argv: [binary, '-z', ...route, prompt, '--usage-file', join(tmp, 'usage.json')] };
+      return { argv: [binary, ...route, '-z', prompt, '--usage-file', join(tmp, 'usage.json')] };
     case 'qwen': {
       const argv = [binary, '-o', 'json', ...route];
       if (opts.safeMode) argv.push('--safe-mode');
@@ -398,6 +442,8 @@ export function buildArgv(lane, binary, prompt, opts, tmp) {
 
 export function judge(lane, rc, out, err, outFile) {
   switch (lane) {
+    case 'claude':
+      return judgeClaude(rc, out);
     case 'grok':
       return judgeGrok(rc, out);
     case 'codex':
@@ -527,6 +573,30 @@ function hermesQuotaText(lower) {
   return lower.includes('no usable content') || lower.includes('limit') || lower.includes('degraded');
 }
 
+// argparse's own refusal. Its usage dump always lists `-t TOOLSETS`, so this is
+// checked before the toolset match or every bad argument reads as a toolset error.
+function hermesArgError(lower) {
+  return lower.includes('hermes: error:');
+}
+
+// A model id the chosen provider does not serve. `hermes -z` prints a failed
+// turn's provider error on stdout and exits 2, so this reads both streams, but
+// returns only the matching line: the rest of stdout is the agent's own prose.
+// The wording is the upstream's own ("The 'grok-4.6' model is not supported
+// when using Codex with a ChatGPT account"; OpenAI's model_not_found code).
+export function hermesMismatchLine(text, { vendorShape = false } = {}) {
+  for (const line of String(text || '').split('\n')) {
+    const l = line.toLowerCase();
+    if (!(l.includes('model is not supported') || l.includes('model_not_found'))) continue;
+    // stdout is agent prose, so there only the vendor's own shape counts: an HTTP
+    // status, an error prefix, the Codex wording, or the OpenAI error code.
+    if (vendorShape && !(/^\s*(http [45]\d\d|error)\b/.test(l) || l.includes('model is not supported when using') || l.includes('model_not_found'))) continue;
+    // Terminal-safe: stdout can carry web-derived text, so no control characters.
+    return line.replace(/[\x00-\x08\x0b-\x1f\x7f]/g, '').trim().slice(0, 300);
+  }
+  return null;
+}
+
 // qwen: the terminal event's full error text, and a result that is an API error.
 // Never the display detail, which is clipped and can carry a model name.
 export function qwenErrorText(out) {
@@ -545,16 +615,29 @@ export function qwenErrorText(out) {
   return parts.join('\n');
 }
 
+// Only native failure fields are authoritative. A successful model answer
+// mentioning login, quota or permissions must never become an error signal.
+export function claudeErrorText(out) {
+  const o = claudeResultObject(out);
+  if (!o) return '';
+  const parts = Array.isArray(o.errors) ? o.errors.filter(e => typeof e === 'string') : [];
+  if (o.is_error === true && typeof o.result === 'string') parts.push(o.result);
+  if (Number.isInteger(o.api_error_status)) parts.push(`api_error_status=${o.api_error_status}`);
+  return parts.join('\n');
+}
+
 function authoritativeBlob(lane, out, err, detail, rc) {
+  if (lane === 'claude') return `${claudeErrorText(out)}\n${err || ''}`;
   if (lane === 'codex') return `${codexErrorEventsText(out)}\n${err || ''}`;
   if (lane === 'agy') return `${agyResultFieldsText(out)}\n${err || ''}`;
-  if (lane === 'hermes') return rc !== 0 ? String(err || '') : '';
+  if (lane === 'hermes') return rc !== 0 ? `${err || ''}\n${hermesMismatchLine(out, { vendorShape: true }) || ''}` : '';
   if (lane === 'qwen') return `${qwenErrorText(out)}\n${err || ''}`;
   return `${detail || ''}\n${err || ''}`; // grok: no auth, quota or rejected signal is defined
 }
 
 export function sigAuth(lane, blob) {
   const b = blob.toLowerCase();
+  if (lane === 'claude') return /authentication_error|permission_error|invalid api key|not logged in|please run \/login|failed to authenticate|oauth (?:token|session).*expired|api_error_status=(?:401|403)|api error: (?:401|403)\b/.test(b);
   if (lane === 'qwen') return b.includes('missing api key');
   if (lane === 'agy') return b.includes('you are not logged into antigravity') || b.includes('not authenticated');
   return false; // codex, grok, hermes: no documented native auth signal
@@ -562,6 +645,7 @@ export function sigAuth(lane, blob) {
 
 export function sigQuota(lane, blob) {
   const b = blob.toLowerCase();
+  if (lane === 'claude') return /rate_limit_error|rate limit|insufficient credits|credit balance|you['’]ve hit your limit|api_error_status=429|api error: 429\b/.test(b);
   if (lane === 'qwen') return b.includes('[api error: 402') || b.includes('requires more credits') || blob.includes(' 429') || b.includes('rate limit');
   if (lane === 'codex') return blob.includes('usage_limit_exceeded') || b.includes("you've hit your usage limit");
   if (lane === 'hermes') return hermesQuotaText(b);
@@ -570,15 +654,17 @@ export function sigQuota(lane, blob) {
 
 export function sigRejected(lane, blob) {
   const b = blob.toLowerCase();
+  if (lane === 'claude') return /invalid_request_error|unknown option|invalid (?:model|effort)|api_error_status=400|api error: 400\b/.test(b);
   if (lane === 'qwen') return b.includes('[api error: 400') || b.includes('no endpoints found') || b.includes('failed to parse grammar');
   if (lane === 'codex') return blob.includes('invalid_request_error');
-  if (lane === 'hermes') return b.includes('toolset');
+  if (lane === 'hermes') return hermesArgError(b) || b.includes('toolset') || hermesMismatchLine(blob) !== null;
   return false;
 }
 
 // Which judge reasons mean the lane never reached a trustworthy finish, as
 // opposed to finishing cleanly with nothing in it (class empty).
 const CUT_SHORT_REASONS = {
+  claude: new Set(['not_json', 'not_result', 'bad_subtype', 'is_error', 'bad_stop_reason', 'result_not_string', 'error_message_not_string']),
   grok: new Set(['not_json', 'bad_stop_reason']),
   codex: new Set(['no_terminal_event']),
   agy: new Set(['no_terminal_event', 'bad_last_event']),
@@ -704,6 +790,10 @@ export function refusedGrok(out, { root = process.env.CLI_RUN_GROK_SESSIONS_ROOT
 
 export function countRefused(lane, out, err, opts) {
   try {
+    if (lane === 'claude') {
+      const pd = claudeResultObject(out)?.permission_denials;
+      return Array.isArray(pd) ? pd.length : null;
+    }
     if (lane === 'qwen') return refusedQwen(out);
     if (lane === 'agy') return refusedAgy(out);
     if (lane === 'codex') return refusedCodex(out, err);
@@ -752,6 +842,7 @@ const FIX = {
   auth: 'set the credential the message above names (its environment variable, or the lane\'s own login command), then rerun',
   quota: 'switch to another lane, or wait for the reset time if the message gave one',
   rejected: 'correct the model id, flag or request the upstream message names',
+  mismatch: 'pair the model with a provider that serves it: run `hermes model`, or pin both with --provider and --model (or "defaults": {"hermes": {"provider": ..., "model": ...}} in bin/lanes.json)',
   refused: 'adjust the hook or deny rule named above, or give this lane the tool it needs',
   cut_short: 'rerun once; if it recurs, run without --quiet and read the lane\'s stderr on the terminal',
   empty: 'rerun once, or use another lane',
@@ -769,7 +860,11 @@ export function problemAndFix(lane, cls, { out = '', err = '', detail = '', refu
   switch (cls) {
     case 'auth': return { problem: `${tag} auth: ${cause || d || 'missing or invalid credentials'}`, fix: FIX.auth };
     case 'quota': return { problem: `${tag} quota: ${cause || d || 'rate limit or credits exhausted'}`, fix: FIX.quota };
-    case 'rejected': return { problem: `${tag} rejected: ${cause || d || 'the upstream rejected the request'}`, fix: FIX.rejected };
+    case 'rejected': {
+      const mismatch = lane === 'hermes' ? hermesMismatchLine(err) || hermesMismatchLine(out, { vendorShape: true }) : null;
+      if (mismatch) return { problem: `${tag} rejected: model/provider mismatch: ${redact(mismatch)}`, fix: FIX.mismatch };
+      return { problem: `${tag} rejected: ${cause || d || 'the upstream rejected the request'}`, fix: FIX.rejected };
+    }
     case 'refused': return { problem: `${tag} refused: ${denial() || 'a hook or deny rule blocked the call'}`, fix: FIX.refused };
     case 'cut_short': return { problem: `${tag} cut short: ${d || 'no terminal success event, cause not identifiable'}`, fix: FIX.cut_short };
     case 'empty': return { problem: `${tag} empty: ${d || 'completed but delivered nothing'}`, fix: FIX.empty };
@@ -801,6 +896,7 @@ export function classifyRun(lane, { rc = 0, out = '', err = '', reason = '', det
     else {
       const blob = authoritativeBlob(lane, out, err, detail, rc);
       if (sigAuth(lane, blob)) cls = 'auth';
+      else if (lane === 'hermes' && hermesMismatchLine(blob) !== null) cls = 'rejected'; // before quota: see judgeHermes
       else if (sigQuota(lane, blob)) cls = 'quota';
       else if (sigRejected(lane, blob)) cls = 'rejected';
       else if (Number.isInteger(refused) && refused > 0) cls = 'refused';
@@ -1080,15 +1176,19 @@ export function laneConfig(here = dirname(fileURLToPath(import.meta.url))) {
       for (const [lane, d] of Object.entries(j.defaults)) {
         if (!LANES.includes(lane)) return null;
         if (!d || typeof d !== 'object' || Array.isArray(d)) return null;
-        const { model, effort, ...rest } = d;
+        const { model, effort, provider, ...rest } = d;
         if (Object.keys(rest).length) return null;
         if (model !== undefined && badRouteValue('model', model)) return null;
+        if (provider !== undefined) {
+          if (badRouteValue('provider', provider)) return null;
+          if (!LANE_FLAGS[lane] || !LANE_FLAGS[lane].provider) return null; // only hermes routes by provider
+        }
         if (effort !== undefined) {
           if (badRouteValue('effort', effort)) return null;
           if (effort.startsWith('auto') && effort !== 'auto') return null;
           if (!LANE_FLAGS[lane] || !LANE_FLAGS[lane].effort) return null; // a lane with no reasoning flag cannot have one pinned
         }
-        defaults[lane] = { model: model ?? null, effort: effort ?? null };
+        defaults[lane] = { model: model ?? null, effort: effort ?? null, provider: provider ?? null };
       }
     }
     return { enabled: j.enabled, defaults };
@@ -1109,20 +1209,22 @@ export function resolveRoute(lane, opts, defaults) {
   const d = (defaults && defaults[lane]) || {};
   const model = opts.model ?? d.model ?? null;
   const effort = opts.effort ?? d.effort ?? null;
+  const provider = opts.provider ?? d.provider ?? null;
   const src = (flag, def) => (flag != null ? 'flag' : def != null ? 'lanes.json' : 'lane_default');
-  return { model, effort, model_source: src(opts.model, d.model), effort_source: src(opts.effort, d.effort) };
+  return { model, effort, provider, model_source: src(opts.model, d.model), effort_source: src(opts.effort, d.effort), provider_source: src(opts.provider, d.provider) };
 }
 
 function usage(msg) {
   if (msg) console.error('cli-run: ' + msg);
   console.error(`usage: cli-run <${LANES.join('|')}> "<prompt>" [--brief FILE] [--timeout SECS] [--quiet]
-                [--model ID] [--effort LEVEL] [--expect-file PATH] [--expect-json]
+                [--model ID] [--effort LEVEL] [--provider ID] [--expect-file PATH] [--expect-json]
        cli-run codex --audit "<prompt>"          read-only sandbox (audit shape)
        cli-run qwen [--safe-mode] "<prompt>"     qwen-only flag
        cli-run --doctor [--run]                  enabled lanes, binaries, and the route each one is pinned to
 
   --model / --effort pin what a lane runs with, instead of letting it inherit its
   own config. Every lane takes --model; every lane except qwen takes --effort.
+  Hermes also takes --provider; it needs --model, a defaults model, or HERMES_INFERENCE_MODEL.
   Levels are the vendor's own (agy low|medium|high, hermes none|minimal|...): an
   unknown level is rejected by the lane, and reported by class (codex: rejected, 16).
   Exit codes: 0 ok, 10 empty, 11 no output, 12 timeout, 13 unavailable, 14 auth,
@@ -1163,7 +1265,8 @@ export async function doctor(run, { here = dirname(fileURLToPath(import.meta.url
   const { enabled, defaults } = cfg;
   let bad = 0;
   if (!compact) console.log(`doctor: ${enabled.length} enabled lane(s): ${enabled.join(', ') || 'none'}`);
-  if (!compact && primary && !enabled.includes(primary)) console.log(`  note: ${primary} is the main agent and is not an executable lane`);
+  const primaryLane = primary === 'claude-code' ? 'claude' : primary;
+  if (!compact && primary && !enabled.includes(primaryLane)) console.log(`  note: ${primary} is the main agent and is not an executable lane`);
   if (!enabled.length) {
     if (compact) {
       console.log('doctor: no executable lanes enabled.');
@@ -1179,7 +1282,8 @@ export async function doctor(run, { here = dirname(fileURLToPath(import.meta.url
     const d = defaults[lane] || {};
     // A disabled lane has no route worth reporting; saying "not pinned" there
     // reads as a finding about a lane that is not going to run.
-    const route = !on ? '' : d.effort === 'auto' ? `route ${d.model || 'lane default'}/auto (sized per call)` : d.model || d.effort ? `route ${d.model || 'lane default'}/${d.effort || 'lane default'}` : 'route not pinned (inherits the lane\'s own config)';
+    const model = `${d.provider ? d.provider + ':' : ''}${d.model || 'lane default'}`;
+    const route = !on ? '' : d.effort === 'auto' ? `route ${model}/auto (sized per call)` : d.model || d.effort || d.provider ? `route ${model}/${d.effort || 'lane default'}` : 'route not pinned (inherits the lane\'s own config)';
     let line = `  ${lane.padEnd(7)} ${on ? 'enabled ' : 'disabled'} ${bin ? 'binary ok' : 'binary MISSING'}${route ? '  ' + route : ''}`;
     if (on && !bin) bad++;
     if (on && bin && run) {
@@ -1188,6 +1292,8 @@ export async function doctor(run, { here = dirname(fileURLToPath(import.meta.url
       if (rc !== OK) bad++;
     }
     console.log(compact ? `  ${lane}: ${bin ? 'present' : 'MISSING'}` : line);
+    if (on && lane === 'hermes' && d.model && !d.provider) console.log('    note: model pinned with no provider: Hermes sends it to its default provider. A model that provider does not serve fails with HTTP 400; pin "provider" beside "model".');
+    if (on && lane === 'hermes' && d.provider && !d.model) console.log('    note: provider pinned with no model: every run without --model will be refused unless HERMES_INFERENCE_MODEL supplies a model; pin "model" beside "provider".');
   }
   console.log(bad ? `doctor: ${bad} problem(s)` : 'doctor: all enabled lanes ' + (run ? 'answered' : 'present'));
   if (!compact) {
@@ -1236,10 +1342,10 @@ export function checkContracts(opts, text, before) {
 }
 
 export async function main(argv) {
-  const VALUE = new Set(['--brief', '--timeout', '--model', '--effort', '--expect-file']);
+  const VALUE = new Set(['--brief', '--timeout', '--model', '--effort', '--provider', '--expect-file']);
   const BOOL = new Set(['--quiet', '--audit', '--safe-mode', '--doctor', '--run', '--expect-json']);
   const args = [...argv];
-  const opts = { timeout: 900, quiet: false, audit: false, model: null, effort: null, safeMode: false, brief: null, doctor: false, run: false, expectFile: null, expectJson: false };
+  const opts = { timeout: 900, quiet: false, audit: false, model: null, effort: null, provider: null, safeMode: false, brief: null, doctor: false, run: false, expectFile: null, expectJson: false };
   const positional = [];
   while (args.length) {
     const a = args.shift();
@@ -1250,6 +1356,7 @@ export async function main(argv) {
       else if (a === '--timeout') opts.timeout = Number(v);
       else if (a === '--expect-file') opts.expectFile = v;
       else if (a === '--effort') opts.effort = v;
+      else if (a === '--provider') opts.provider = v;
       else opts.model = v;
     } else if (BOOL.has(a)) {
       if (a === '--quiet') opts.quiet = true;
@@ -1283,7 +1390,7 @@ export async function main(argv) {
   if (!Number.isFinite(opts.timeout) || opts.timeout <= 0) return usage('--timeout must be a positive number of seconds');
   if (opts.audit && lane !== 'codex') return usage('--audit is codex-only');
   if (opts.safeMode && lane !== 'qwen') return usage('--safe-mode is qwen-only');
-  for (const [kind, v] of [['model', opts.model], ['effort', opts.effort]]) {
+  for (const [kind, v] of [['model', opts.model], ['effort', opts.effort], ['provider', opts.provider]]) {
     if (v == null) continue;
     const bad = badRouteValue(kind, v);
     if (bad) return usage(bad);
@@ -1292,6 +1399,7 @@ export async function main(argv) {
   // qwen has no reasoning flag. Dropping --effort silently would leave the caller
   // believing a route that never happened, which is the defect this feature fixes.
   if (opts.effort && !(LANE_FLAGS[lane] && LANE_FLAGS[lane].effort)) return usage(`${lane} has no reasoning-effort flag; --effort is not available on this lane`);
+  if (opts.provider && !LANE_FLAGS[lane].provider) return usage(`${lane} has no provider flag; --provider is hermes-only`);
 
   const digest = createHash('sha256').update(prompt).digest('hex').slice(0, 12);
   const base = { lane, prompt_sha256_12: digest, prompt_chars: prompt.length };
@@ -1301,11 +1409,15 @@ export async function main(argv) {
   // gap this feature exists to close. A malformed lanes.json has no usable
   // defaults, so the flags stand alone and say so.
   const route = resolveRoute(lane, opts, cfg === null ? {} : cfg.defaults);
+  if (route.provider && !route.model && !(process.env.HERMES_INFERENCE_MODEL || '').trim()) return usage('--provider <p> needs a model: pass --model, or set "model" beside "provider" in lanes.json "defaults"');
   const sizing = resolveAutoEffort(lane, route.effort, prompt, opts.audit);
   opts.model = route.model;
   opts.effort = sizing.resolved;
+  opts.provider = route.provider;
   Object.assign(base, {
     model_requested: route.model,
+    provider_requested: route.provider,
+    provider_source: route.provider_source,
     effort_requested: route.effort,
     model_source: route.model_source,
     effort_source: route.effort_source,
@@ -1384,10 +1496,11 @@ export async function main(argv) {
     }
     const code = cls === 'interrupted' ? 128 + (r.interrupted === 'SIGINT' ? 2 : 15) : CLASS_CODES[cls];
     if (text && code === OK) process.stdout.write(text + '\n');
-    const routeNote = route.model || route.effort ? `${route.model || 'lane default'}/${route.effort || 'lane default'}` : 'lane default';
+    const routeNote = (route.provider ? `${route.provider}:` : '') + (route.model || route.effort ? `${route.model || 'lane default'}/${route.effort || 'lane default'}` : 'lane default');
     if (!opts.quiet) {
       console.error(`cli-run[${lane}] ${verdict} rc=${code} class=${cls} refused=${refused === null ? 'null' : refused} ${r.seconds.toFixed(1)}s raw=${r.outBytes || 0}B route=${routeNote} :: ${redact(detail)}`);
       let authoritative = null;
+      if (lane === 'claude' && ['auth', 'quota', 'rejected'].includes(cls)) authoritative = stderrHead(claudeErrorText(out) || err);
       if (lane === 'codex' && (cls === 'quota' || cls === 'rejected')) authoritative = codexPrimaryError(out);
       const pf = problemAndFix(lane, cls, { out, err, detail, refused, authoritative });
       if (pf.problem) console.error('cli-run problem: ' + redact(pf.problem).slice(0, 600));

package/bin/cli.js

@@ -498,6 +498,7 @@ async function main() {
         for (const path of preview.written) console.log('  would write ' + path);
         for (const path of [...preview.skipped, ...preview.conflicts, ...preview.unverifiable, ...preview.docsConflict, ...preview.docsUnverifiable]) console.log('  would keep ' + path);
         for (const path of preview.backups) console.log('  would back up ' + path);
+        if (preview.lanesWithheld.length) console.log(`  lanes withheld: ${preview.lanesWithheld.join(', ')} (the kept bin/cli-run.mjs predates them; re-run with --upgrade-runtime to enable)`);
       }
       console.log('\n--dry: nothing written.');
       rl && rl.close();
@@ -548,9 +549,9 @@ async function main() {
         .concat(JSON.stringify(prev.roles || {}) !== JSON.stringify(plannedManifest.roles || {}) ? ['roles'] : [])
     : [];
 
-  let written, skipped, upgraded, conflicts, unverifiable, docsUpdated, docsConflict, docsUnverifiable, docsRenamed;
+  let written, skipped, upgraded, conflicts, unverifiable, lanesWithheld, docsUpdated, docsConflict, docsUnverifiable, docsRenamed;
   try {
-    ({ written, skipped, upgraded, conflicts, unverifiable, docsUpdated, docsConflict, docsUnverifiable, docsRenamed } = writeFiles(files, { dir, project, force: flag('force'), upgradeRuntime: flag('upgrade-runtime'), updateDocs: flag('update-docs'), prevManifest: prev, backupExisting: applySnippets, onBackup: (path) => console.log('  backup ' + path) }));
+    ({ written, skipped, upgraded, conflicts, unverifiable, lanesWithheld, docsUpdated, docsConflict, docsUnverifiable, docsRenamed } = writeFiles(files, { dir, project, force: flag('force'), upgradeRuntime: flag('upgrade-runtime'), updateDocs: flag('update-docs'), prevManifest: prev, backupExisting: applySnippets, onBackup: (path) => console.log('  backup ' + path) }));
   } catch (e) {
     if (e && e.code === 'PREFLIGHT') bad(e.message);
     throw e;
@@ -564,10 +565,11 @@ async function main() {
     if (prev) {
       if (changed.length) {
         console.log(`  selection changed: ${changed.join(', ')}`);
-        console.log(`  applied: ${ownedWritten.join(', ') || 'nothing'} (machine-owned files are always rewritten, so the new lanes are live)`);
+        console.log(`  applied: ${ownedWritten.join(', ') || 'nothing'} (machine-owned files are always rewritten)`);
         if (changed.includes('roles')) console.log('  the role assignment changed; MANIFEST.json and aunx route are current. Any kept documents may still carry the previous assignment.');
       } else console.log('  selection identical.');
     }
+    if (lanesWithheld.length) console.log(`  lanes withheld: ${lanesWithheld.join(', ')} (the kept bin/cli-run.mjs predates them; re-run with --upgrade-runtime to enable)`);
     if (upgraded.length) console.log(`  runtime upgraded: ${upgraded.join(', ')} ${flag('upgrade-runtime') ? '(--upgrade-runtime: replaced whether or not you had edited them)' : '(each installed copy matched the hash of a previous run, so nobody had edited it)'}`);
     if (conflicts.length) {
       console.log(`  runtime CONFLICT, kept: ${conflicts.join(', ')}`);

package/docs/catalog.md

@@ -16,14 +16,15 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 
 - **Kind:** agent-cli · **Billing:** subscription · **Level:** 1+
 - **What it is:** Anthropic's terminal coding agent; its subagents load the project rules file
-- **Install:** `npm install -g @anthropic-ai/claude-code@2.1.226`
+- **Install:** `npm install -g @anthropic-ai/claude-code@2.1.285`
 - **Sign in:** run `claude` once and sign in with your Anthropic account
 - **Reads rules from:** `CLAUDE.md` · subagents in `.claude/agents/`
+- **cli-run lane:** yes
 - **Plans:**
   - Claude Pro (base headroom, checked 2026-09-12; tier models: unverified): https://claude.com/pricing
   - Claude Max 5x (high headroom, checked 2026-09-12; tier models: unverified): https://claude.com/pricing
   - Claude Max 20x (max headroom, checked 2026-09-12; tier models: unverified): https://claude.com/pricing
-- **Built against:** 2.1.226 (the same number the npm pin uses)
+- **Built against:** 2.1.285 (the same number the npm pin uses)
 
 **Capability facts.** An unverified value needs a current capability check before use. Role assignments come from the selected stack, using these facts.
 
@@ -34,7 +35,7 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 | `billing` | subscription |
 | `pricing` | unverified |
 | `headless` | yes |
-| `cliRun` | no |
+| `cliRun` | yes |
 | `writesFiles` | yes |
 | `readOnlyMode` | no |
 | `liveWeb` | yes |

package/docs/how-it-routes.md

@@ -60,6 +60,8 @@ aunx cli-run --doctor
 # Direct form: node bin/cli-run.mjs --doctor
 ```
 
+Hermes also takes `--provider '<provider-id>'` (or `"provider"` in its `lanes.json` defaults), always together with a model, because one Hermes install can reach several providers and a model sent to the wrong one fails with HTTP 400. `--doctor` notes a Hermes model pinned without a provider.
+
 Explicit flags override defaults in `bin/lanes.json`. Without either, the vendor CLI uses its own configuration. The runner records what was requested and the source of each request: `flag`, `lanes.json` or `lane_default`. These fields describe requested settings; the vendor's own reporting is the place to verify the actual model used.
 
 ## Share facts once, then scope each worker

package/docs/security-review-history.md

@@ -6,6 +6,8 @@ This page summarizes completed reviews recorded in the [changelog](../CHANGELOG.
 
 | Release | Review recorded | What the review found | What changed and where it is checked |
 |---|---|---|---|
+| 1.0.7 | Review of external PR 48 (native Claude Code lane) by a second model family, then one audit of the fix diff | An upgrade that kept an edited older runner could disable every lane; an expired Claude sign-in read as cut short; a bare HTTP number in an error could pick the wrong class | Kept runners withhold lanes they do not list; expired-session and status-anchored Claude signals; captured 2.1.285 fixtures; `test/install.test.js`, `test/classify.test.js`, `test/cli.test.js` |
+| 1.0.6 | Pre-release review of the hermes provider route by a second model family, one round | Hermes stdout could print raw terminal control characters in a failure line; agent prose on stdout and an unrelated quota word could be misclassified; one provider test could not fail; route flags placed after `-z` broke every pinned hermes run | Control characters stripped, stdout matched only in the vendor's error shape, the mismatch checked before quota, route flags moved before `-z`; `test/classify.test.js`, `test/judges.test.js`, `test/cli.test.js` |
 | 1.0.2 | Independent review of 1.0.1 by a second model family, then an audit of its fix | A detached check descendant outlived the timeout while the notes said descendants stop; a symlinked-manifest refusal named no file or fix; refusal paths could carry terminal escapes; a directory got symlink advice | The protocol states the process-group limit; refusals name the path, escape control characters and give advice by file type; `test/security-messages.test.js` |
 | 1.0.1 | Codex Security scan and regression-backed remediation | A metrics summary executed project code; manifest reads and check descendants needed bounds; weekly jobs inherited gateway credentials | Packaged metrics dispatch, bounded file readers, check process-tree cleanup, stdin-only gateway probe and separate audit environment; `test/security-cli.test.js`, `test/security-vm.test.js`, `test/security-pins.test.js` |
 | 0.1.0 | Initial review and follow-up round, with a second model-family review | Paths could escape the write roots, partial writes could remain, malformed arguments could proceed, and empty results could appear successful | Containment preflight, exclusive writes with rollback, strict flag parsing and vendor-specific result checks; `test/install.test.js`, `test/cli.test.js`, `test/judges.test.js` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-orchestrator",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Model router for AI coding agents: installs routing rules, 8 subagents, hooks and a CLI runner so your AI picks model and effort per task and saves tokens",
   "type": "module",
   "bin": {

package/proof/README.md

@@ -2,14 +2,14 @@
 
 Generated from [results.json](results.json). Each figure has a method, sample size, measurement date and expiry. Run the scripts on your own machine to compare.
 
-Environment: Node v22.22.3, darwin arm64. Timing varies with startup caches and other work on the machine. Synthetic cases show what those fixtures exercise.
+Environment: Node v22.23.2, linux x64. Timing varies with startup caches and other work on the machine. Synthetic cases show what those fixtures exercise.
 
 | Measurement | Result | Sample size | Measured | Expires | Reproduce |
 |---|---|---|---|---|---|
-| Dry install wall time | 42.22 ms median | 7 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/install-time.js) |
-| Lane runner overhead | 63.74 ms median difference | 7 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/runner-overhead.js) |
-| Empty results flagged | 10 fixtures rejected | 10 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/missing-results.js) |
-| Acceptance failures blocked | 4 fixtures rejected | 4 | 2026-09-27 | 2026-10-11 | [script](../proof/scripts/check-gate.js) |
+| Dry install wall time | 61.59 ms median | 7 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/install-time.js) |
+| Lane runner overhead | 60.27 ms median difference | 7 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/runner-overhead.js) |
+| Empty results flagged | 10 fixtures rejected | 10 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/missing-results.js) |
+| Acceptance failures blocked | 4 fixtures rejected | 4 | 2026-09-28 | 2026-10-12 | [script](../proof/scripts/check-gate.js) |
 
 ## Run the proof scripts
 
@@ -40,7 +40,7 @@ The [recording script](scripts/record-gate.js) captures real command output into
 
 Spawn a fresh Node installer process per sample; level 2, Claude Code + Codex, no companions, --dry. Includes Node startup and planning; writes no install files. Isolated home and PATH, no real vendors.
 
-Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/install-time.js](../proof/scripts/install-time.js).
 
@@ -48,7 +48,7 @@ Source: [proof/scripts/install-time.js](../proof/scripts/install-time.js).
 
 Paired fresh processes: direct Node stub versus cli-run hermes with the same stub. Alternates pair order. Includes wrapper startup, validation and local log writes; excludes vendor/network/model time.
 
-Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 7. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/runner-overhead.js](../proof/scripts/runner-overhead.js).
 
@@ -56,7 +56,7 @@ Source: [proof/scripts/runner-overhead.js](../proof/scripts/runner-overhead.js).
 
 Run cli-run against an exit-0 stub for every supported lane, once with empty stdout and once with an empty native final result. Count exit 10/11 only. A successful Hermes response is the positive control. Synthetic fixtures measure these shapes only.
 
-Kind: reproducible local measurement. Sample size: 10. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 10. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/missing-results.js](../proof/scripts/missing-results.js).
 
@@ -64,7 +64,7 @@ Source: [proof/scripts/missing-results.js](../proof/scripts/missing-results.js).
 
 Run aunx checks run against nonzero, manual, missing-program and timeout fixtures. Each must exit 1; a passing command must exit 0. This is a local command gate, activated by the user in their release sequence.
 
-Kind: reproducible local measurement. Sample size: 4. Measured: 2026-09-27. Expires: 2026-10-11.
+Kind: reproducible local measurement. Sample size: 4. Measured: 2026-09-28. Expires: 2026-10-12.
 
 Source: [proof/scripts/check-gate.js](../proof/scripts/check-gate.js).
 

package/proof/results.json

@@ -1,78 +1,78 @@
 {
   "schemaVersion": 1,
   "environment": {
-    "node": "v22.22.3",
-    "platform": "darwin",
-    "arch": "arm64"
+    "node": "v22.23.2",
+    "platform": "linux",
+    "arch": "x64"
   },
   "entries": [
     {
       "id": "install-dry-ms",
       "label": "Dry install wall time",
       "kind": "reproducible",
-      "value": 42.220875,
+      "value": 61.594306,
       "unit": "ms median",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Spawn a fresh Node installer process per sample; level 2, Claude Code + Codex, no companions, --dry. Includes Node startup and planning; writes no install files. Isolated home and PATH, no real vendors.",
       "sampleSize": 7,
       "script": "proof/scripts/install-time.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "samples": [
-        51.577042,
-        48.655542,
-        46.568834,
-        42.220875,
-        41.573667,
-        39.881333,
-        40.983417
+        72.998866,
+        61.594306,
+        63.307248,
+        60.59507,
+        61.218156,
+        66.993599,
+        61.070192
       ]
     },
     {
       "id": "runner-overhead-ms",
       "label": "Lane runner overhead",
       "kind": "reproducible",
-      "value": 63.742250999999996,
+      "value": 60.27329300000001,
       "unit": "ms median difference",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Paired fresh processes: direct Node stub versus cli-run hermes with the same stub. Alternates pair order. Includes wrapper startup, validation and local log writes; excludes vendor/network/model time.",
       "sampleSize": 7,
       "script": "proof/scripts/runner-overhead.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "pairs": [
         {
-          "directMs": 26.925375,
-          "wrappedMs": 409.562,
-          "overheadMs": 382.63662500000004
+          "directMs": 27.602021,
+          "wrappedMs": 89.562129,
+          "overheadMs": 61.960108
         },
         {
-          "directMs": 28.554875,
-          "wrappedMs": 95.06725,
-          "overheadMs": 66.512375
+          "directMs": 26.453384,
+          "wrappedMs": 85.145791,
+          "overheadMs": 58.692407
         },
         {
-          "directMs": 28.981666,
-          "wrappedMs": 94.610209,
-          "overheadMs": 65.628543
+          "directMs": 26.104555,
+          "wrappedMs": 91.019659,
+          "overheadMs": 64.915104
         },
         {
-          "directMs": 26.295583,
-          "wrappedMs": 86.161958,
-          "overheadMs": 59.866375
+          "directMs": 24.351936,
+          "wrappedMs": 84.625229,
+          "overheadMs": 60.27329300000001
         },
         {
-          "directMs": 28.71575,
-          "wrappedMs": 82.585583,
-          "overheadMs": 53.869833
+          "directMs": 27.307321,
+          "wrappedMs": 86.025276,
+          "overheadMs": 58.717955
         },
         {
-          "directMs": 26.668791,
-          "wrappedMs": 90.411042,
-          "overheadMs": 63.742250999999996
+          "directMs": 26.203506,
+          "wrappedMs": 84.365333,
+          "overheadMs": 58.161827
         },
         {
-          "directMs": 34.081333,
-          "wrappedMs": 82.568041,
-          "overheadMs": 48.48670799999999
+          "directMs": 26.328261,
+          "wrappedMs": 86.629325,
+          "overheadMs": 60.301064
         }
       ]
     },
@@ -82,11 +82,11 @@
       "kind": "reproducible",
       "value": 10,
       "unit": "fixtures rejected",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Run cli-run against an exit-0 stub for every supported lane, once with empty stdout and once with an empty native final result. Count exit 10/11 only. A successful Hermes response is the positive control. Synthetic fixtures measure these shapes only.",
       "sampleSize": 10,
       "script": "proof/scripts/missing-results.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "outcomes": [
         {
           "lane": "grok",
@@ -146,11 +146,11 @@
       "kind": "reproducible",
       "value": 4,
       "unit": "fixtures rejected",
-      "measuredAt": "2026-09-27",
+      "measuredAt": "2026-09-28",
       "method": "Run aunx checks run against nonzero, manual, missing-program and timeout fixtures. Each must exit 1; a passing command must exit 0. This is a local command gate, activated by the user in their release sequence.",
       "sampleSize": 4,
       "script": "proof/scripts/check-gate.js",
-      "expiresAt": "2026-10-11",
+      "expiresAt": "2026-10-12",
       "outcomes": [
         {
           "fixture": "nonzero",

package/src/aunx.js

@@ -205,6 +205,9 @@ function stackSuggestion(assignment) {
   if (assignment.command) via = '`' + clean(assignment.command.startsWith('cli-run ') ? `aunx ${assignment.command}` : assignment.command) + '`';
   else if (assignment.agent) via = '`' + clean(assignment.agent) + '` on your main agent';
   else via = { 'main-agent': 'your main agent', local: 'your local runtime', manual: 'manual handoff', subagent: 'a subagent', 'cli-run': 'cli-run' }[assignment.via];
+  if (assignment.ai === 'claude-code' && assignment.via === 'cli-run' && assignment.command === 'cli-run claude' && assignment.preferredTransport === 'mcp') {
+    via = `connected Claude worker MCP when available; fallback ${via}`;
+  }
   return `Your stack: ${name}, via ${via || 'your selected tool'}${reason ? ` (${clean(reason)})` : ''}.`;
 }
 

package/src/catalog.js

@@ -71,7 +71,7 @@ export const AIS = [
       billing: 'subscription',
       pricing: null, // UNVERIFIED: check your provider's current rate.
       headless: true,
-      cliRun: false,
+      cliRun: true,
       writesFiles: true,
       readOnlyMode: false,
       liveWeb: true, // Source: templates/agents/claude-code/live-researcher.md grants WebSearch and WebFetch.
@@ -93,8 +93,8 @@ export const AIS = [
     bin: 'claude',
     summary: 'Anthropic\'s terminal coding agent; its subagents load the project rules file',
     minLevel: 1,
-    install: { npm: '@anthropic-ai/claude-code', url: 'https://code.claude.com/docs/en/setup', pin: '2.1.226' },
-    builtAgainst: '2.1.226',
+    install: { npm: '@anthropic-ai/claude-code', url: 'https://code.claude.com/docs/en/setup', pin: '2.1.285' },
+    builtAgainst: '2.1.285',
     auth: 'run `claude` once and sign in with your Anthropic account',
     // Positive-only (Q1): an author-machine probe of a working, authenticated
     // session (2026-09-27) still returned {"loggedIn":false} with exit 1, so a

package/src/install.js

@@ -70,7 +70,7 @@ export function lanesTable(selected, plans = {}, primary = inferPrimary(selected
     a.facts.billing,
     summaryWithEvidence(a),
     Object.entries(roles).filter(([, role]) => role.ai === a.id).map(([id]) => id).join(', ') || 'none',
-    a.facts.cliRun ? '`cli-run ' + a.id + '`' : a.bin ? '`' + a.bin + '`' : 'the app',
+    a.facts.cliRun ? '`cli-run ' + a.bin + '`' : a.bin ? '`' + a.bin + '`' : 'the app',
     plans[a.id] ? `${plans[a.id].name} (${plans[a.id].headroom} headroom)` : 'not stated'
   ]);
   return table(rows, ['AI', 'Lane', 'What it is', 'Assigned roles', 'Call it with', 'Plan']);
@@ -180,7 +180,7 @@ export function dirProblems(dir) {
 export function auditLane(selected, primary = selected[0]) {
   const { roles } = assignRoles({ selected, primary });
   const id = roles.review.ai ?? roles.bulk.ai ?? null;
-  return selected.some(a => a.id === id && a.facts.cliRun) ? id : null;
+  return selected.find(a => a.id === id && a.facts.cliRun)?.bin || null;
 }
 
 function stackContext(selected, primary, detected = new Set()) {
@@ -558,7 +558,7 @@ function vars(opts) {
   const assignment = assignRoles({ selected, primary, detected: opts.detected, plans });
   const stack = stackContext(selected, primary, opts.detected);
   const enabled = selected.filter(a => a.facts.cliRun);
-  const exampleLane = enabled[0]?.id || '<lane>';
+  const exampleLane = enabled[0]?.bin || '<lane>';
   const exampleDefaults = { model: '<model-id>', ...(LANE_FLAGS[exampleLane]?.effort ? { effort: 'high' } : {}) };
   const auditExample = enabled.find(a => a.facts.readOnlyMode);
   const fallbackNote = 'When no separate lane qualifies, your main agent carries the job at its stated tier. Independent review and local-only work require an eligible lane.';
@@ -634,8 +634,8 @@ function vars(opts) {
     EXAMPLE_LANE: exampleLane,
     EXAMPLE_EFFORT_FLAGS: LANE_FLAGS[exampleLane]?.effort ? ' --effort high' : '',
     EXAMPLE_AUDIT_LANE: auditExample?.id || '',
-    EXAMPLE_AUDIT_BLOCK: auditExample ? `When reviewing with an available read-only mode, select its audit shape:\n\n\x60\x60\x60bash\naunx cli-run ${auditExample.id} --audit --brief REVIEW.md\nnode bin/cli-run.mjs ${auditExample.id} --audit --brief REVIEW.md\n\x60\x60\x60` : 'When reviewing, verify the chosen lane permissions and request review-only work.',
-    EXAMPLE_LANES_JSON: JSON.stringify({ enabled: enabled.map(a => a.id), defaults: { [exampleLane]: exampleDefaults } }, null, 2),
+    EXAMPLE_AUDIT_BLOCK: auditExample ? `When reviewing with an available read-only mode, select its audit shape:\n\n\x60\x60\x60bash\naunx cli-run ${auditExample.bin} --audit --brief REVIEW.md\nnode bin/cli-run.mjs ${auditExample.bin} --audit --brief REVIEW.md\n\x60\x60\x60` : 'When reviewing, verify the chosen lane permissions and request review-only work.',
+    EXAMPLE_LANES_JSON: JSON.stringify({ enabled: enabled.map(a => a.bin), defaults: { [exampleLane]: exampleDefaults } }, null, 2),
     // Renders only when Qwen is actually selected: the sentence names a flag
     // that is a usage error on every other lane (C1).
     QWEN_SAFE_MODE_NOTE: selected.some(a => a.id === 'qwen') ? "When Qwen's safe mode is required, pass `--safe-mode` to that lane. " : '',
@@ -686,8 +686,8 @@ function vars(opts) {
     AUDIT_LANE: lane || 'none',
     // Enforced boundary per lane: codex has a read-only sandbox flag; the others
     // run with whatever their own config allows, and the script says so.
-    AUDIT_LANE_FLAGS: selected.find(a => a.id === lane)?.facts.readOnlyMode ? '--audit' : '',
-    AUDIT_LANE_BOUNDARY_NOTE: selected.find(a => a.id === lane)?.facts.readOnlyMode
+    AUDIT_LANE_FLAGS: selected.find(a => a.bin === lane)?.facts.readOnlyMode ? '--audit' : '',
+    AUDIT_LANE_BOUNDARY_NOTE: selected.find(a => a.bin === lane)?.facts.readOnlyMode
       ? `${lane} --audit, a read-only filesystem sandbox; commands and network follow the ${lane} config`
       : lane
         ? `${lane} offers no sandbox flag cli-run can pass, so the denied-actions list is instruction-level only and enforcement is whatever ${lane}'s own permission config allows`
@@ -714,7 +714,10 @@ function vars(opts) {
     LANES_TABLE: lanesTable(selected, plans, primary),
     PLAN_GUIDANCE: planGuidance(selected, plans),
     INSTALL_TABLE: installTable(selected),
-    CLI_RUN_LANES: selected.filter((a) => a.facts.cliRun).map((a) => a.id).join(', ') || 'none selected',
+    CLI_RUN_LANES: selected.filter((a) => a.facts.cliRun).map((a) => a.bin).join(', ') || 'none selected',
+    CLAUDE_WORKER_TRANSPORT: Object.values(assignment.roles).some(role => role.ai === 'claude-code' && role.via === 'cli-run')
+      ? '- When assigning a Claude Code worker, prefer a connected Claude worker MCP service exposed in the host tool catalog. Call its tools directly from the host, follow its session and permission workflow, and preserve the task scope. See `CLI-RUN.md` for dispatch and fallback boundaries.\n'
+      : '',
     GATEWAY_MODELS: gatewayModels(selected, apis),
     ENV_NAMES: envNames(selected, apis).map((n) => '- `' + n + '`').join('\n'),
     ENV_EXPORTS: envNames(selected, apis).map((n) => n + '=').join('\n'),
@@ -820,10 +823,10 @@ export function planFiles(opts) {
       join('bin', 'lanes.json'),
       JSON.stringify(
         {
-          enabled: selected.filter((a) => a.facts.cliRun).map((a) => a.id),
-          defaults: Object.fromEntries((opts.effortAuto || []).map((lane) => [lane, { effort: 'auto' }])),
+          enabled: selected.filter((a) => a.facts.cliRun).map((a) => a.bin),
+          defaults: Object.fromEntries((opts.effortAuto || []).map((id) => [selected.find(a => a.id === id)?.bin || id, { effort: 'auto' }])),
           note: 'Lanes cli-run may call. Edit to enable or disable a lane. A lane not listed here exits 13 (unavailable).',
-          defaultsNote: 'Pin what a lane runs with, so the route in your docs is the route that runs: "defaults": {"' + (selected.find(a => a.facts.cliRun)?.id || '<lane>') + '": ' + JSON.stringify({ model: '<model-id>', ...(LANE_FLAGS[selected.find(a => a.facts.cliRun)?.id]?.effort ? { effort: 'high' } : {}) }) + '}. Left empty, a lane inherits its own config file, which cli-run cannot see and does not guess. `--model` and `--effort` override this per call, and `--doctor` prints what each lane is pinned to. Every enabled lane takes a model; the runner reports which lanes support an effort flag.'
+          defaultsNote: 'Pin what a lane runs with, so the route in your docs is the route that runs: "defaults": {"' + (selected.find(a => a.facts.cliRun)?.bin || '<lane>') + '": ' + JSON.stringify({ model: '<model-id>', ...(LANE_FLAGS[selected.find(a => a.facts.cliRun)?.bin]?.effort ? { effort: 'high' } : {}) }) + '}. Left empty, a lane inherits its own config file, which cli-run cannot see and does not guess. `--model` and `--effort` override this per call, and `--doctor` prints what each lane is pinned to. Every enabled lane takes a model; the runner reports which lanes support an effort flag. Hermes also takes "provider" beside "model", so the model goes to a provider that serves it.'
         },
         null,
         2
@@ -1117,6 +1120,8 @@ export function writeFiles(files, opts) {
   const upgraded = [];      // runtime files replaced because the installed copy was an untouched generated one
   const conflicts = [];     // runtime files kept because the installed copy differs from what we generated
   const unverifiable = [];  // runtime files kept because there is no manifest to compare against
+  const lanesWithheld = []; // selected lanes the kept runner does not support
+  let lanesHash;
   const docsUpdated = [];   // --update-docs: documents regenerated because the installed copy was an untouched generated one
   const docsConflict = [];  // --update-docs: documents kept because you edited them
   const docsUnverifiable = []; // --update-docs: documents kept because there is no manifest to compare against
@@ -1206,6 +1211,24 @@ export function writeFiles(files, opts) {
           }
         }
         let content = f.content;
+        if (k === 'dir' && key === 'bin/lanes.json' && keptKeys.has('bin/cli-run.mjs')) {
+          // planFiles puts the runner first, so its keep decision is known here.
+          let supported;
+          try {
+            const match = readFileSync(join(root, 'bin', 'cli-run.mjs'), 'utf8').match(/^\s*export const LANES = \[([\s\S]*?)\];/m);
+            if (match && /^\s*(?:(?:'[^'\\]*'|"[^"\\]*")\s*(?:,\s*(?:'[^'\\]*'|"[^"\\]*")\s*)*,?\s*)?$/.test(match[1])) {
+              supported = [...match[1].matchAll(/'([^'\\]*)'|"([^"\\]*)"/g)].map(m => m[1] ?? m[2]);
+            }
+          } catch { /* unknown runner contents are not evidence of unsupported lanes */ }
+          if (supported) {
+            const lanes = JSON.parse(content);
+            lanesWithheld.push(...new Set([...lanes.enabled, ...Object.keys(lanes.defaults || {})].filter(lane => !supported.includes(lane))));
+            lanes.enabled = lanes.enabled.filter(lane => supported.includes(lane));
+            if (lanes.defaults) lanes.defaults = Object.fromEntries(Object.entries(lanes.defaults).filter(([lane]) => supported.includes(lane)));
+            content = JSON.stringify(lanes, null, 2) + '\n';
+            lanesHash = sha256(content);
+          }
+        }
         if (f.rel === 'MANIFEST.json') {
           if (hasLegacy) {
             const previousHash = prevHashes?.[LEGACY_BRIEF];
@@ -1239,6 +1262,7 @@ export function writeFiles(files, opts) {
           // formerly selected files, so uninstall still checks their original
           // installed hashes. New defaults do not erase a previous selection.
           m.files = { ...prevHashes, ...m.files };
+          if (lanesHash) m.files['bin/lanes.json'] = lanesHash;
           if (Object.keys(activation).length) m.activation = activation;
           for (const removed of removedKeys) delete m.files[removed];
           for (const kk of Object.keys(m.files || {})) {
@@ -1304,7 +1328,7 @@ export function writeFiles(files, opts) {
     }
     throw e;
   }
-  return { written, skipped, upgraded, conflicts, unverifiable, docsUpdated, docsConflict, docsUnverifiable, docsRenamed, backups };
+  return { written, skipped, upgraded, conflicts, unverifiable, lanesWithheld, docsUpdated, docsConflict, docsUnverifiable, docsRenamed, backups };
 }
 
 export function resolveSelection(ids) {

package/src/postinstall.js

@@ -50,7 +50,7 @@ export async function installHealthCheck({ level, selected, primary, dir }) {
   // runner in the target directory. Only its data configuration is read.
   const rc = await doctor(false, {
     here: join(dir, 'bin'), primary: primary?.id, compact: true,
-    ...(level < 2 ? { config: { enabled: selected.filter(ai => ai.facts.cliRun).map(ai => ai.id), defaults: {} } } : {})
+    ...(level < 2 ? { config: { enabled: selected.filter(ai => ai.facts.cliRun).map(ai => ai.bin), defaults: {} } } : {})
   });
   if (rc && rc !== 10 && rc !== 13) console.log(`  doctor could not read the installed lane configuration (exit ${rc}).`);
   return rc;

package/src/roles.js

@@ -136,7 +136,10 @@ export function roleRoute(roleId, assignment, { selected = [], primary = null, a
   if (role.ai === null) {
     out.reason = role.why;
   } else if (role.via === 'cli-run' && ai?.facts.cliRun === true) {
-    out.command = `cli-run ${ai.id}${['review', 'verify'].includes(roleId) && ai.facts.readOnlyMode === true ? ' --audit' : ''}`;
+    out.command = `cli-run ${ai.bin}${['review', 'verify'].includes(roleId) && ai.facts.readOnlyMode === true ? ' --audit' : ''}`;
+    // The host knows its connected tools. The standalone CLI command remains
+    // usable without an MCP installation; it cannot call host-owned tools.
+    if (ai.id === 'claude-code') out.preferredTransport = 'mcp';
   } else if (role.ai === primary?.id && primary.facts.agentDefinitions && agents[roleId]) {
     out.agent = agents[roleId];
   }
@@ -151,6 +154,7 @@ export function roleHow(role, { selected = [], primary = null } = {}) {
   if (role.ai === null) return role.reason?.startsWith('Nothing in your stack') ? 'keep it off every lane here' : 'fresh-context self-check on your main agent';
   const ai = selected.find((item) => item.id === role.ai);
   const tier = `${role.tier} tier`;
+  if (role.preferredTransport === 'mcp') return `connected Claude worker MCP when available; fallback \`aunx ${role.command}\`, ${tier}`;
   if (role.command) return `\`aunx ${role.command}\`, ${tier}`;
   if (role.via === 'local') return `${ai?.bin ? `\`${ai.bin}\`` : 'local runtime'} on your machine, ${tier}`;
   if (ai?.facts.kind === 'chat') return `paste the work into your ${role.ai === primary?.id ? 'main agent' : 'chat app'}, ${tier}`;

package/templates/advanced/vm/ENVIRONMENT.md

@@ -18,7 +18,7 @@ The audit script builds an explicit allowed environment with shell builtins befo
 
 The allowed runtime names are `HOME`, `PATH`, `USER`, `LOGNAME`, `SHELL`; `LANG`, `LANGUAGE`, `TZ`; `LC_ALL`, `LC_CTYPE`, `LC_COLLATE`, `LC_MESSAGES`, `LC_MONETARY`, `LC_NUMERIC`, `LC_TIME`, `LC_ADDRESS`, `LC_IDENTIFICATION`, `LC_MEASUREMENT`, `LC_NAME`, `LC_PAPER`, `LC_TELEPHONE`; `TMPDIR`, `TMP`, `TEMP`; `XDG_CONFIG_HOME`, `XDG_DATA_HOME`, `XDG_STATE_HOME`, `XDG_CACHE_HOME`, `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS`; and the Windows shell runtime names `SystemRoot`, `SYSTEMROOT`, `WINDIR`. User-service access and stored sign-ins use those same locations.
 
-Only the selected report worker additionally receives its location override: `CODEX_HOME` for `codex`, `HERMES_HOME` for `hermes`. These names are removed from collection/version probes. `agy`, `grok` and `qwen` use stored sign-ins in the common user/configuration locations, with no additional exported authentication name. Configure the selected vendor's sign-in in the systemd user's account, such as `hermes auth add <provider>` for Hermes. API-only setups that depend on exported provider keys need vendor-supported stored authentication before this job can run. Claude Code is not a cli-run worker in this catalog, so its session-token export is removed as well.
+Only the selected report worker additionally receives its location override: `CODEX_HOME` for `codex`, `HERMES_HOME` for `hermes`. These names are removed from collection/version probes. `claude`, `agy`, `grok` and `qwen` must use stored sign-ins in the common user/configuration locations, with no additional exported authentication name. Configure the selected vendor's sign-in in the systemd user's account, such as `hermes auth add <provider>` for Hermes. Setups that depend on exported provider keys or session tokens need vendor-supported stored authentication before this job can run. `CLAUDE_CODE_OAUTH_TOKEN` remains excluded by the same boundary as other token variables.
 
 `PROBE_SECS` and `RUNNER_SECS` remain shell-only deadline overrides. Set documented runtime and location overrides in the service's `Environment=` settings or audit-only environment file. The key and any selected worker settings stay out of command arguments and logs. There is no arbitrary variable pass-through option.
 

package/templates/advanced/vm/jobs/README.md

@@ -34,7 +34,7 @@ Sign the selected vendor CLI in under the same user before enabling the timer. B
 | User service and keyring session | `XDG_RUNTIME_DIR`, `DBUS_SESSION_BUS_ADDRESS` |
 | Windows shell runtime compatibility | `SystemRoot`, `SYSTEMROOT`, `WINDIR` |
 
-The report worker additionally receives `CODEX_HOME` when the selected worker is `codex`, or `HERMES_HOME` when it is `hermes`, if that name was set. These location overrides are absent from collection and version probes. The `agy`, `grok` and `qwen` workers use their stored sign-ins under the common user/configuration directories. No token or provider-key variable is allowed for any current worker; `CLAUDE_CODE_OAUTH_TOKEN` is also removed because Claude Code is not a supported cli-run worker in this catalog. Configure authentication with the selected vendor's sign-in flow, such as `codex login`, `grok login`, `hermes auth add <provider>`, `agy`, or Qwen's `/auth`.
+The report worker additionally receives `CODEX_HOME` when the selected worker is `codex`, or `HERMES_HOME` when it is `hermes`, if that name was set. These location overrides are absent from collection and version probes. The `claude`, `agy`, `grok` and `qwen` workers must use stored sign-ins under the common user/configuration directories. No token or provider-key variable is allowed for any current worker, including `CLAUDE_CODE_OAUTH_TOKEN`. Configure authentication with the selected vendor's sign-in flow, such as `claude`, `codex login`, `grok login`, `hermes auth add <provider>`, `agy`, or Qwen's `/auth`.
 
 `GATEWAY_MASTER_KEY` stays in a private shell variable until the stdin probe finishes and is then removed. `PROBE_SECS` and `RUNNER_SECS` override the shell's deadlines without becoming child exports. Configure the allowed names and worker location overrides through the service's `Environment=` settings or its audit-only environment file. Keep that file limited to the gateway key and the documented runtime/location settings; keep provider credentials in the gateway launch environment. The script provides no arbitrary extra-variable override.
 

package/templates/intermediate/CLI-RUN.md

@@ -6,6 +6,14 @@ Enabled lanes (edit `bin/lanes.json`): {{CLI_RUN_LANES}}.
 
 ## Call a lane with a task brief
 
+- When Claude Code is assigned and a Claude worker MCP service is connected, prefer it. Inspect its schema and instructions, then call its tools from the host. Runner subprocesses cannot access the host's connected tools. The manifest's `preferredTransport: "mcp"` records the preference and `command` gives the CLI fallback; `aunx route` reports it without discovering or invoking servers.
+- When starting an MCP session, send the scoped brief and project directory, keep the session ID and cursor, and poll as the service directs until the final result. Verify acceptance checks, handle errors and cancel on the task deadline or user cancellation. A start response or idle session alone is not proof of success.
+- For either transport, preserve the caller's permissions and project scope. Do not auto-approve tools, broaden paths, add credentials or change authentication. Answer permission requests within existing authorization and deny requests outside it; keep review requests review-only. Check the MCP server's environment against the task's access limits, even when it differs from the command sandbox.
+- When selecting MCP options, leave the model unset unless the task or lane defaults select it; translate effort and other defaults only when the service supports them.
+- When a compatible service is absent, use the native CLI in an authorized environment with its existing sign-in. After either transport fails, report the cause before switching; do not retry automatically through the other transport. Use CLI doctor for CLI presence and optional canaries only; check MCP availability and authentication through the host.
+
+Anthropic's built-in [`claude mcp serve`](https://code.claude.com/docs/en/mcp#use-claude-code-as-an-mcp-server) exposes tools; it does not by itself establish a Claude agent-review service.
+
 ```bash
 aunx cli-run {{EXAMPLE_LANE}} --brief TASK_BRIEF.md --timeout 900
 node bin/cli-run.mjs {{EXAMPLE_LANE}} --brief TASK_BRIEF.md --timeout 900
@@ -56,6 +64,7 @@ The runner supports these lanes whether or not you selected them.
 
 | Lane | Invocation built | Accepted response |
 |---|---|---|
+| claude | `-p --output-format json --permission-mode dontAsk` | result object, `subtype == "success"`, `is_error == false`, non-empty `result`, no execution errors or truncated stop reason |
 | grok | `--output-format json -p` | `stopReason == "end_turn"` and non-empty `text` |
 | codex | `exec --json --color never --skip-git-repo-check -o FILE` | terminal `turn.completed` event and non-empty output file |
 | agy | `--print-timeout Nm --output-format stream-json -p` | terminal `result` event, `status == "SUCCESS"`, non-empty `response` |
@@ -64,6 +73,10 @@ The runner supports these lanes whether or not you selected them.
 
 When Qwen's error telemetry is absent, the runner refuses the response. These checks distinguish response structure from successful task execution.
 
+Select Claude Code with installer ID `claude-code`; use `aunx cli-run claude` for its executable fallback. The native adapter needs the Claude CLI and its existing authentication, independently of optional MCP companions. It uses [Anthropic's print-mode JSON result](https://code.claude.com/docs/en/headless) and [result completion states](https://code.claude.com/docs/en/agent-sdk/agent-loop).
+
+Claude runs with [the `dontAsk` permission mode](https://code.claude.com/docs/en/permissions): calls needing approval are denied, while existing allow rules and actions needing no approval still apply. The runner grants no additional tools or permissions. This is not a read-only filesystem sandbox; `--audit` remains Codex-only. Claude's `permission_denials` counts blocked tools; a non-empty completed answer with denials is accepted with a warning, while no answer with denials exits 17. Authentication or account-access errors exit 14. Error subtypes, malformed JSON and truncated responses exit 18 unless a more specific native error identifies the cause.
+
 ## Respond to the exit class
 
 | Code | Class | Action |
@@ -97,19 +110,22 @@ Replace the placeholder with a current vendor model ID before using this example
 
 The runner supports these lanes whether or not you selected them.
 
-| Lane | Model flag | Effort flag |
-|---|---|---|
-| grok | `-m` | `--reasoning-effort` |
-| codex | `-m` | `-c model_reasoning_effort="LEVEL"` |
-| agy | `--model` | `--effort` |
-| hermes | `-m` | `--reasoning` |
-| qwen | `-m` | Unsupported; an effort request is a usage error |
+| Lane | Model flag | Effort flag | Provider flag |
+|---|---|---|---|
+| claude | `--model` | `--effort` | Unsupported |
+| grok | `-m` | `--reasoning-effort` | Unsupported |
+| codex | `-m` | `-c model_reasoning_effort="LEVEL"` | Unsupported |
+| agy | `--model` | `--effort` | Unsupported |
+| hermes | `-m` | `--reasoning` | `--provider` |
+| qwen | `-m` | Unsupported; an effort request is a usage error | Unsupported |
+
+Hermes signs in to many providers, and a model sent to a provider that does not serve it fails with HTTP 400. Pin both with `--provider` and `--model`, or with `"provider"` beside `"model"` under `"hermes"` in `bin/lanes.json` defaults. A provider with no model is a usage error. That failure is reported as `rejected` (exit 16) with a model/provider mismatch line; `hermes model` repairs the pairing in Hermes itself.
 
 When using `--effort auto`, treat its medium/high selection as a bounded heuristic; an audit has a high floor. Use explicit high for builds and xhigh where supported for security-critical or irreversible work. The vendor validates its own effort names and reports unsupported values through the failure class.
 
 ## Preserve permissions and secrets
 
-The runner never adds permission flags. Keep each vendor's permissions in its own configuration and route work within the task's granted scope. A denied write becomes a handoff to an authorized writer.
+The runner grants no additional permissions. Claude uses `dontAsk` to deny calls needing approval; Codex `--audit` requests a read-only filesystem sandbox. Keep each vendor's permissions in its own configuration and route work within the task's granted scope. A denied write becomes a handoff to an authorized writer.
 
 Prompts travel in argv, which other processes may inspect. Never put secrets in a prompt. For large task inputs, give the worker a brief with authorized source paths instead of exceeding the operating system's argument-size limit.
 

package/templates/intermediate/ROUTING.md

@@ -58,6 +58,7 @@ When work runs in the background, check liveness and output growth every five mi
 
 ## Tools and fallbacks
 
+{{CLAUDE_WORKER_TRANSPORT}}
 - When reporting consequential arithmetic or code equivalence, use a computing tool (`protocols/numbers-and-logic.md`). codecalc: {{CODECALC_STATUS}}. When absent, use the local runtime, test suite or spreadsheet.{{METERED_CITATION_NOTE}}
 - When writing durable records, search first, update the index and keep one writer (`protocols/memory-and-record.md`). obsidian-tc: {{OBSIDIAN_TC_STATUS}}. When absent, use project files, search and version control.
 - When using a changing library or API, read current documentation and verify behavior (`protocols/docs-then-prove.md`). Context7: {{CONTEXT7_STATUS}}. When absent, read official docs or installed source; use the local runtime when codecalc is absent.