omnilane 0.34.0 → 0.41.1

package/README.md

@@ -115,24 +115,24 @@ actually resolves.
 
 | Lane | First choice | Backup | When |
 |---|---|---|---|
-| 🔥 hardest-coding | Claude Fable 5.1 (xhigh) | GPT-5.6 Sol (xhigh) → Grok 4.6 → Gemini 3.7 Flash (High) | Hardest implementation, deep root-cause debug, correctness-critical edits |
-| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | Refactors, migrations, tests, review sweeps — mechanical endurance |
-| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.7 Flash (Low) → Claude Haiku 4.5 | High-volume scans, first-pass filtering |
-| ⚖️ hard-judgment | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) → Grok 4.6 | Architecture arbitration, deep reasoning, second opinions |
-| ✒️ taste-final | Claude Fable 5.1 (high) | GPT-5.6 Sol (max) → Grok 4.6 → Gemini 3.7 Flash (High) | User-facing prose, prompt/doc polish, style arbitration |
-| 💬 consult | GPT-5.6 Sol (max) | Claude Fable 5.1 (high) → Grok 4.6 → Gemini 3.7 Flash (High) | Direct named-model consultation; keep `--vendor` to prevent fallback |
-| 🎨 ui-draft | GPT-5.6 Sol (xhigh) | Claude Fable 5.1 (high) → Gemini 3.7 Flash (High) | UI drafts only WITH a design system / reference images |
-| 📚 long-context | Gemini 3.7 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | Long-document retrieval and synthesis, ordered on AA-LCR, cost, and throughput |
-| ⚡ fast-agentic | Gemini 3.7 Flash (Medium) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | Fast multi-step agentic loops, multimodal checks |
-| 📡 live-search | Grok 4.6 | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | Realtime X/web search and social context |
-| 🚰 coding-overflow | Grok 4.6 | Gemini 3.7 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex-quota relief valve for mid-tier coding |
+| 🔥 hardest-coding | Claude Fable 5.1 (max) | GPT-6 Astra (max) → Grok 4.6 → Gemini 3.8 Flash (High) | Hardest implementation, deep root-cause debug, correctness-critical edits |
+| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | Refactors, migrations, tests, review sweeps — mechanical endurance |
+| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.8 Flash (Low) → Claude Haiku 4.5 | High-volume scans, first-pass filtering |
+| ⚖️ hard-judgment | Claude Fable 5.1 (xhigh) | GPT-6 Astra (max) → Grok 4.6 | Architecture arbitration, deep reasoning, second opinions |
+| ✒️ taste-final | Claude Fable 5.1 (xhigh) | GPT-6 Astra (xhigh) → Grok 4.6 → Gemini 3.8 Flash (High) | User-facing prose and style arbitration; benchmarks do not prove visual or editorial taste |
+| 💬 consult | GPT-6 Astra (xhigh) | Claude Fable 5.1 (xhigh) → Grok 4.6 → Gemini 3.8 Flash (Medium) | Direct named-model consultation; keep `--vendor` to prevent fallback |
+| 🎨 ui-draft | GPT-5.6 Sol (high) | Claude Fable 5.1 (xhigh) → Gemini 3.8 Flash (High) | UI drafts only with a design system or reference images; no aesthetic benchmark claim |
+| 📚 long-context | Gemini 3.8 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | Long-document synthesis; context size alone does not prove task quality |
+| ⚡ fast-agentic | Gemini 3.8 Flash (Low) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | Fast multi-step tool loops and multimodal checks |
+| 📡 live-search | Grok 4.6 | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | Realtime X/web search; backups provide generic web search, not equivalent X context |
+| 🚰 coding-overflow | Grok 4.6 | Gemini 3.8 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Explicit Codex-quota relief; provider failure does not auto-retry another vendor |
 | 🗳️ arbitrate | off (opt-in vote panel) | — | Built-in opinion panel for big calls — disabled by default; enable it in `routing.local.yaml`, one call per voter per round |
 
 The **backup** is the next candidate in the lane's `routing.yaml` chain — what
 dispatch falls back to when the first-choice vendor CLI is not installed. Every
 lane is such a chain; when nothing in it is installed the lane degrades to `off`.
 
-> **Fable 5.1 is in the defaults — and where Opus 5 still fits.** See the current three-way evidence and Opus override in the [FAQ](#-faq).
+> **Fable 5.1 and Astra now lead hard work.** See the current same-condition evidence in [FAQ](#-faq).
 
 ### Natural-language consultation
 
@@ -157,12 +157,13 @@ with who is driving. What changes is which lanes you **self-execute** (you
 already are that model, so no second call) versus **dispatch**. Your harness's
 `omnilane` skill applies the right row automatically; this is the human view.
 
-- **Claude Code · Fable 5.1** — self-execute: taste-final, hardest-coding. Dispatch hard-judgment → Opus 5; bulk → Codex Sol high; long-context and fast loops → Gemini 3.7 Flash; live-search → Grok.
-- **Claude Code · Opus 5** — self-execute: hard-judgment, its default lane. Use a local override for taste-final when its lower hallucination rate or price is preferred. Dispatch hardest coding → Fable 5.1 or Sol, bulk → Sol high, long-context and fast loops → Gemini 3.7 Flash, live-search → Grok.
-- **Codex · Sol** — self-execute: hardest-coding, bulk-mechanical, hard-judgment, ui-draft. Dispatch taste-final → Claude, long-context and fast loops → Gemini 3.7 Flash, live-search → Grok.
-- **Codex · Terra** — self-execute: long-context as the Codex fallback. Bulk-mechanical now defaults to Sol high; escalate hardest pieces to Sol xhigh, taste → Claude, fast loops → Gemini 3.7 Flash, live-search → Grok.
+- **Claude Code · Fable 5.1** — recommended prompt-level controller for quality-sensitive work; this is a role, not a lane or automatic selector. Self-execute hardest-coding at max and judgment/taste at xhigh; use Astra for an independent Codex review, Sol for bulk, Gemini 3.8 Flash for long/fast work, and Grok for live search.
+- **Claude Code · Opus 5** — balanced prompt-level controller and independent reviewer when explicitly selected (`high`, or `xhigh` for deeper review), plus long-context fallback. This is an opt-in role, not a new lane or the default hard-judgment route.
+- **Codex · Sol** — self-execute bulk-mechanical and constrained ui-draft at high. Escalate hardest coding and judgment to Fable/Astra; route long/fast work to Gemini 3.8 Flash and live search to Grok.
+- **Codex · Astra** — prompt-level controller backup and independent reviewer. Use max for hardest coding/judgment and xhigh for consult/taste; explicit model/effort always win.
+- **Codex · Terra** — self-execute the Codex long-context fallback at max. Bulk stays on Sol high; escalate hard work to Fable/Astra.
 - **Grok Build · Grok 4.6** — self-execute: live-search and coding-overflow, plus fallback duty in hardest-coding, hard-judgment, and taste-final. Dispatch primary hard coding/judgment/taste work to Codex/Claude/Gemini when available; verify API signatures and cited facts.
-- **Antigravity · Gemini 3.7 Flash** — self-execute: long-context and fast loops at Medium, bulk/overflow at High, triage at Low, plus fallback duty (High) in hardest-coding, taste-final, ui-draft, and live-search. Dispatch primary hardest coding/judgment/taste to Codex/Claude when available.
+- **Antigravity · Gemini 3.8 Flash** — self-execute long-context Medium, fast-agentic/triage Low, and bulk/overflow/web fallbacks High. Do not infer visual taste or controller authority from agent/coding benchmarks.
 
 </details>
 
@@ -379,20 +380,13 @@ code passes through.
 
 ## 🎭 Modes
 
-- **advise** (default) — read-only worker. Codex runs in a read-only sandbox;
-  Claude gets only Read/Glob/Grep; Grok runs in plan mode; Kimi and OpenCode
-  pin their read-only plan modes; OpenRouter is advise-only by design (pure
-  inference). Use for reviews, questions, second opinions.
-- **work** — the worker may edit files, only inside the `--workdir` you name.
-  Codex gets a workspace-write sandbox; Claude auto-accepts edits; Gemini runs
-  in accept-edits mode. The `openrouter` vendor refuses work mode with a clear
-  error — route edits to an agentic CLI vendor instead.
-- **sysops** — `work` minus the vendor sandbox, for service operations the
-  sandbox denies (`launchctl` and friends). Codex runs it with
-  `-s danger-full-access`; every other vendor treats it as plain `work`. This
-  hands the worker full access to the machine, so it is an explicit
-  per-dispatch opt-in and can never be a lane default. Reach for it only when
-  you have watched `work` fail on a sandbox denial.
+- **advise** (default): read-only local analysis with native web/search tools where the vendor supports them. Model/provider traffic stays available; agent mutation tools are restricted. This is not a promise of identical X/web capabilities across vendors.
+- **work**: local file and command work confined to the explicit `--workdir`, with agent-tool network access disabled. This does not disable the model/provider connection. Unsupported enforcement fails before provider startup rather than silently becoming sysops.
+- **sysops**: explicit per-dispatch opt-in to unrestricted agent tools and filesystem/network access. It is never a lane default; the task must state the allowed operations.
+
+The CLI defaults `--workdir` to the caller’s current directory when omitted; task briefs should still specify it explicitly. The MCP `route`/`dry_run` work interface separately requires an explicit `workdir`.
+
+Codex and Claude have distinct policies for all three modes. Agy advise/sysops use isolated per-session native app settings without replacing subscription authentication; Agy 1.1.27 work has bounded new/resume acceptance using four validated tools and the native terminal sandbox: workspace read/write/edit/build and policy-denied outside writes passed. External temp/cache reads are also restricted; settings are explicitly regenerated at each start rather than claimed immutable. A separate real two-turn work live/FIFO check passed readback, outside-write denial and normal close with unchanged sources. Grok advise uses native tool allow/deny rules; its complete single-shot `plain` path has verified native keyword search, page fetching, and a denied write on Grok 1.0.13. It uses internal web-tool IDs and job-local MCP readiness without disabling hooks. An existing nonempty `CONTEXT_MODE_MCP_SENTINEL_DIR` conflicts with this advise scope and stops before provider startup rather than being overwritten. Grok work remains gated on macOS because native child-network isolation is Linux-only, and Grok live requires explicit sysops; the advise result does not validate these other paths. OpenRouter remains advise-only; other vendors are not implicitly covered by this four-vendor contract. See the [dated runtime gate](docs/model-capabilities-2026-09.md#f-mode-runtime-gate-2026-09-06) for evidence boundaries.
 
 ## 🔒 Safety rails
 
@@ -430,7 +424,7 @@ code passes through.
 
 ## 📬 Live mailbox
 
-A live mailbox is a resident Claude or Gemini background dispatch, not a one-shot dispatch. The foreman opens it with `--background`, can send another instruction while it is still running, and is responsible for closing it with `jobs.sh close ID`. Leaving it unattended does not make it permanent: the idle cap and configured whole-job timeout (`--job-timeout`) can still end it.
+A live mailbox is a resident background dispatch, not a one-shot dispatch. Claude and Gemini retain their existing automatic live behavior with `--background`. Codex and Grok default to single-shot; opt in with `--background --live` (Grok additionally requires `--mode sysops --workdir DIR`). The foreman can send another instruction while it is running and is responsible for closing it with `jobs.sh close ID`. The idle cap and configured whole-job timeout (`--job-timeout`) can still end it.
 
 ```bash
 scripts/dispatch.sh --background --vendor claude hard-judgment "Review the timeout failure"
@@ -442,7 +436,7 @@ scripts/jobs.sh close "$ID"
 scripts/jobs.sh retry "$ID" --background
 ```
 
-`watch` follows `$JOB_DIR/events.jsonl`; `tail` reads the public `out.txt`. Live mailbox support covers Claude and Gemini; other vendors run as normal one-shot dispatches, with a notice sent to stderr and stored in `$JOB_DIR/mode-notice.txt`. `--live` requires a resident session and fails fast when the resolved vendor is not capable. `--single-shot` forces one-shot execution even for Claude or Gemini. `--idle-timeout SECONDS` sets the inactivity cap (default 900; `0` disables it).
+`watch` follows `$JOB_DIR/events.jsonl`; `tail` reads the public `out.txt`. Live mailbox support covers Claude, Gemini, Codex, and Grok. Automatic selection remains single-shot for Codex/Grok; only explicit `--live` opts them in. Grok advise rejects `--live` because ACP does not enforce its read-only boundary; normal advise uses single-shot native tool allow/deny rules. `--live` fails fast for unsupported vendors. `--single-shot` forces one-shot execution for every vendor. `--idle-timeout SECONDS` sets the inactivity cap (default 900; `0` disables it).
 
 An idle mailbox makes no API calls and incurs no API spend. By default it closes after 900 seconds without a new inbox message or result event, while the whole-job timeout remains the outer cap. Close it sooner when its exchange is finished. `jobs.sh send` to a finished job or a job that is not live fails with a clear error. Do not use this for fire-and-forget work, vendors without live support, or a clean-slate rerun; start a fresh dispatch (or retry a completed job) instead.
 
@@ -496,53 +490,36 @@ with the key you set — those are advise-only and never edit files.
 </details>
 
 <details>
-<summary><b>Fable 5.1 is in the defaults — and where Opus 5 still fits</b></summary>
+<summary><b>Why do Fable 5.1 and Astra now lead hard work?</b></summary>
 
 <br/>
 
-Fable 5.1 now leads `hardest-coding` and `taste-final`. At matched xhigh
-effort it leads Opus 5 on intelligence, agentic work, and coding. Sol max
-remains the far cheaper cross-vendor judgment fallback. `hard-judgment`
-itself now defaults to Opus 5 xhigh: it returns 97.7% of Fable's agentic
-score at 68% of the cost and a lower hallucination rate, so on that lane's
-own per-cost criterion the cheaper configuration wins.
-
-| Benchmark (AA, retrieved 2026-09-02) | Claude Fable 5.1 (xhigh) | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) |
-|---|---:|---:|---:|
-| Intelligence | 64.8 | 62.5 | 60.9 |
-| Agentic | 59.8 | 58.4 | 57.8 |
-| Coding | 80.7 | 77.0 | 77.4 |
-| Hallucination rate (lower is better) | .71 | **.60** | .92 |
-| AA $/task | $2.65 | $1.80 | **$0.95** |
-
-Fable 5.1 is not a bulk or triage default: it costs twice Opus 5 per token and
-consumes the most Claude Code subscription quota per turn. Opus 5 now leads
-`hard-judgment` by default, stays in `long-context` at medium, and remains
-selectable everywhere through `~/.omnilane/routing.local.yaml` — for example,
-to bring Fable back:
-
-```yaml
-hard-judgment: claude claude-fable-5-1 xhigh
-```
+The 2026-09-05 refresh compares the two on AA v4.2 under matching effort:
+Fable/Astra score 57/55 at max and 54/54 at xhigh; AA Briefcase is
+1666/1566 at max and 1657/1540 at xhigh. In the native coding-agent comparison,
+Fable max completes 70 at $9.18/task in 24 minutes and Astra max completes 67
+at $4.72/task in 26.8 minutes. That supports Fable max for
+`hardest-coding`, Fable xhigh for `hard-judgment`/`taste-final`, and Astra as
+the Codex-family fallback or independent reviewer.
+
+Fable max is the quality-first prompt-level controller. Opus high/xhigh is
+the balanced controller and independent-review option; Astra is the existing-
+Codex-quota backup/reviewer. These are role recommendations, not a new lane or
+automatic controller selector. Opus also remains the Claude `long-context`
+fallback.
 
 </details>
 
 <details>
-<summary><b>Why do the Claude lanes use <code>xhigh</code> instead of <code>max</code>?</b></summary>
+<summary><b>Why does hardest coding use <code>max</code> while other Claude lanes use <code>xhigh</code>?</b></summary>
 
 <br/>
 
-Because more effort is not monotonically better. Anthropic documents `xhigh` as
-the starting point for coding and agentic work, `high` as the floor for other
-intelligence-sensitive work, and `max` as the setting for cases where
-correctness outweighs cost. Independent testing agrees: on Vals.ai's Vibe Code
-Bench, Opus 5 scores 89.8% at `high` but only 88.3% at `xhigh` and 88.4% at
-`max` — the top tiers produce more elaborate solutions that fail more often.
-Raise any lane locally if your workload disagrees:
-
-```bash
-omnilane configure set hard-judgment "claude claude-opus-5 max"
-```
+Effort is selected per task, not assumed to improve monotonically. The current
+same-condition and native coding evidence justifies max for correctness-first
+`hardest-coding`; xhigh remains the quality/cost default for
+`hard-judgment`, `taste-final`, and named Fable consultation. Explicit
+`--model` and `--effort` always override these route defaults.
 
 </details>
 
@@ -567,13 +544,13 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # fully resolved plan, no p
 
 <br/>
 
-Only if you ask for it. Dispatch defaults to `advise`, a read-only mode enforced
-per vendor (read-only sandbox, plan mode, or read-only tool set depending on the
-CLI). Editing requires both `--mode work` and an explicit `--workdir`. A third
-mode, `--mode sysops`, is `work` minus the vendor sandbox — for service
-operations the sandbox denies (e.g. `launchctl`); codex runs it with
-`-s danger-full-access`, other vendors treat it as `work`, and it is an
-explicit per-dispatch opt-in, never a lane default. Workers
+Only if you ask for it. Dispatch defaults to `advise`, with per-vendor read-only
+sandbox or native tool permissions and supported web search. For bounded edits,
+use `--mode work` with an explicit `--workdir`; agent-tool networking is disabled
+while the model connection remains available. `--mode sysops` is a separate,
+explicit full-access policy for Codex, Claude, Grok, and Agy, not an alias for
+work. Use it only when the task explicitly permits operations outside work's
+boundary, such as service management. It is never a lane default. Workers
 also cannot dispatch again — the depth guard refuses nested fan-out with exit 86,
 so one command can never spiral into a chain of agents spending your quota.
 
@@ -602,6 +579,21 @@ working notes, including per-benchmark caveats, live in
 
 ## 📜 Release history
 
+## What's new in v0.41.1
+
+- **Python 3.9 compatibility.** Agy workspace-policy staging and cleanup now use `Path.lstat()` without weakening symlink, inode, or concurrent-replacement protections.
+- **Isolated CI fixture.** Strict doctor acceptance now supplies explicit plugin-enabled and directory-marketplace settings; missing, disabled, or mismatched settings still fail.
+- **Upgrade after npm publication.** Run `npm i -g omnilane@0.41.1`, or update your checkout and rerun `./install.sh`. npm publication is handled separately; a GitHub release does not establish npm availability.
+
+## What's new in v0.40.0
+
+- **Distinct modes and repaired Grok web access.** Advise is read-only with supported native search, work confines edits to explicit `--workdir` with agent-tool networking off, and sysops explicitly opts into full access. Grok's full single-shot `plain` advise path now has real search/fetch and denied-write evidence; macOS work and restricted live remain gated.
+- **Explicit Codex and Grok live sessions.** `--background --live` enables follow-up prompts and explicit close for Codex work jobs and Grok sysops jobs; automatic Codex/Grok dispatch stays single-shot, while Claude/Gemini keep their existing auto-live behavior. Grok advise rejects `--live` because its ACP surface does not enforce a read-only boundary.
+- **Bounded, observable shutdown.** EOF-aware capability probes, immutable per-job worker snapshots, interpreter/SHA provenance, close deadlines, and process-group cleanup keep stalled or killed live jobs bounded without claiming OS sandbox isolation.
+- **Completion and idle fixes.** Completion delivery tolerates truncated UTF-8 tails, terminal state comes from durable exit records, and idle tracking advances on completed result events rather than arbitrary stream traffic.
+- **AA-informed model coverage.** The 12-lane defaults now cover Fable 5.1, GPT-6 Astra, and Gemini 3.8 Flash while retaining existing vendors and explicit model overrides. A dated AA v4.2 coverage snapshot documents 643 leaderboard configurations; catalog presence is not a runtime capability guarantee.
+- **Upgrade.** Run `npm i -g omnilane@0.40.0`, or update your checkout and rerun `./install.sh`.
+
 ## What's new in v0.33.0
 
 - **Four-vendor threaded dispatch.** `--thread NAME` continues pinned Claude,
@@ -707,6 +699,8 @@ working notes, including per-benchmark caveats, live in
 
 ## What's new in v0.12.0
 
+These are historical release notes. The current three-mode contract is defined in [Modes](#-modes), including the separate full-access sysops policy in 0.40.0.
+
 - **`hardest-coding` drops Sol from `max` to `xhigh`** — on AA's per-effort
   Coding Index, Sol at xhigh outscores Sol at max and every Claude tier while
   costing about a third less. Past xhigh, effort buys overthinking rather than

package/README.zh-CN.md

@@ -103,18 +103,18 @@ flowchart LR
 
 | 通道 | 首选模型 | 备选模型 | 用途 |
 |---|---|---|---|
-| 🔥 hardest-coding | Claude Fable 5.1 (xhigh) | GPT-5.6 Sol (xhigh) → Grok 4.6 → Gemini 3.7 Flash (High) | 最难的实现、深度调试、正确性关键的修改 |
-| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | 重构、迁移、测试、大范围扫描——机械耐力活 |
-| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.7 Flash (Low) → Claude Haiku 4.5 | 大量扫描、第一轮筛选 |
-| ⚖️ hard-judgment | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) → Grok 4.6 | 架构裁决、深度推理、第二意见 |
-| ✒️ taste-final | Claude Fable 5.1 (high) | GPT-5.6 Sol (max) → Grok 4.6 → Gemini 3.7 Flash (High) | 对外文字、提示词／文档润色、风格裁决 |
-| 💬 consult | GPT-5.6 Sol (max) | Claude Fable 5.1 (high) → Grok 4.6 → Gemini 3.7 Flash (High) | 直接指定模型咨询；保留 `--vendor` 避免降级 |
-| 🎨 ui-draft | GPT-5.6 Sol (xhigh) | Claude Fable 5.1 (high) → Gemini 3.7 Flash (High) | 仅在提供设计系统／参考图时生成 UI 草稿 |
-| 📚 long-context | Gemini 3.7 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | 长文档提取与综合，按 AA-LCR、成本和吞吐排序 |
-| ⚡ fast-agentic | Gemini 3.7 Flash (Medium) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | 高速多步骤工具循环、多模态检查 |
-| 📡 live-search | Grok 4.6 | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | 实时 X／网页搜索与社交上下文 |
-| 🚰 coding-overflow | Grok 4.6 | Gemini 3.7 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex 配额耗尽时的中量级编码安全阀 |
-| 🗳️ arbitrate | `off`（可选模型评审团） | — | 重大决定的内置意见评审团；默认禁用，在 `routing.local.yaml` 启用，每位评审每轮调用一次 |
+| 🔥 hardest-coding | Claude Fable 5.1 (max) | GPT-6 Astra (max) → Grok 4.6 → Gemini 3.8 Flash (High) | 最难的实现、深度调试、正确性关键的修改 |
+| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | 重构、迁移、测试、大范围扫描——机械耐力活 |
+| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.8 Flash (Low) → Claude Haiku 4.5 | 大量扫描、第一轮筛选 |
+| ⚖️ hard-judgment | Claude Fable 5.1 (xhigh) | GPT-6 Astra (max) → Grok 4.6 | 架构裁决、深度推理、第二意见 |
+| ✒️ taste-final | Claude Fable 5.1 (xhigh) | GPT-6 Astra (xhigh) → Grok 4.6 → Gemini 3.8 Flash (High) | 对外文字、提示词／文档润色、风格裁决 |
+| 💬 consult | GPT-6 Astra (xhigh) | Claude Fable 5.1 (xhigh) → Grok 4.6 → Gemini 3.8 Flash (Medium) | 直接指定模型咨询；保留 `--vendor` 避免降级 |
+| 🎨 ui-draft | GPT-5.6 Sol (high) | Claude Fable 5.1 (xhigh) → Gemini 3.8 Flash (High) | 仅在提供设计系统／参考图时生成 UI 草稿 |
+| 📚 long-context | Gemini 3.8 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | 长文档提取与综合，按 AA-LCR、成本和吞吐排序 |
+| ⚡ fast-agentic | Gemini 3.8 Flash (Low) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | 高速多步骤工具循环、多模态检查 |
+| 📡 live-search | Grok 4.6 | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | 实时 X／网页搜索与社交上下文 |
+| 🚰 coding-overflow | Grok 4.6 | Gemini 3.8 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex 配额耗尽时的中量级编码安全阀 |
+| 🗳️ arbitrate | off (opt-in vote panel) | — | 重大决定的内置意见评审团；默认禁用，在 `routing.local.yaml` 启用，每位评审每轮调用一次 |
 
 **备选模型**是候选链的下一位——首选那家的厂商 CLI 没装时,派发就降到它。每条
 通道都是这样一条链;整条都没装时,通道自动降为 `off`。
@@ -296,17 +296,13 @@ configure.sh set|get|unset|list|diff LANE [SPEC]    # 非交互编辑/查看 rou
 
 ## 🎭 模式
 
-- **advise(默认)** — 只读工作端。Codex 跑只读沙箱;Claude 只给
-  Read/Glob/Grep;Grok 跑 plan 模式;Kimi 与 OpenCode 锁各自的只读
-  plan 模式;OpenRouter 天生只做 advise(纯推理)。适合审查、提问、第二意见。
-- **work** — 允许改文件,仅限你指定的 `--workdir`。Codex 给
-  workspace-write 沙箱;Claude 自动接受编辑;Gemini 跑 accept-edits 模式。
-  `openrouter` vendor 会明确拒绝 work 模式——改文件请走代理式 CLI vendor。
-- **sysops** — 等于 `work` 拿掉 vendor 沙箱,用于沙箱会挡掉的服务操作
-  (`launchctl` 之类)。Codex 以 `-s danger-full-access` 执行;其他 vendor
-  一律当成普通 `work`。这等于把整台机器的访问权交给工作端,因此只能逐次
-  明确指定,永远不能设成 lane 默认值。只有在你亲眼看到 `work` 因沙箱拒绝而
-  失败时才动用它。
+- **advise（默认）**：本地只读分析；供应商支持时可用原生网页／搜索工具。保留模型连接，限制修改工具；不同供应商的 X／网页搜索能力并不等同。
+- **work**：文件与命令操作限于显式 `--workdir`，关闭代理工具网络访问，保留模型连接。不支持的强制边界在调用模型前停止，不会静默切换为 sysops。
+- **sysops**：每次派工显式选择，开放代理工具、文件和网络访问；不作为通道默认值，任务必须列明允许的操作。
+
+CLI 省略 `--workdir` 时默认使用调用端当前目录；任务说明仍应明确工作目录。MCP `route`／`dry_run` 的 work 接口则单独要求明确的 `workdir`。
+
+Codex 和 Claude 的三种模式使用不同策略。Agy advise／sysops 使用独立的原生会话设置，不替换订阅认证；Agy 1.1.27 work 已使用四个经过验证的工具及原生终端沙箱完成限定的新建／续接验收：工作目录内读写、修改、编译及越界写入拒绝通过。外部临时文件／缓存读取也受限；每次启动重写明确设置，不宣称设置全程不可变。另一次正式 work 实时／FIFO 两轮验收已通过前轮读回、越界写入拒绝及正常关闭，源文件保持不变。Grok advise 使用原生工具允许／拒绝规则；Grok 1.0.13 的完整单次 `plain` 路径已验证原生关键词搜索、抓取网页及写入拒绝，采用内部网页工具 ID 和每项作业独立的 MCP 就绪状态，不关闭钩子。`CONTEXT_MODE_MCP_SENTINEL_DIR` 已设置为非空值时，会在调用模型前报告冲突，不覆盖原设置。原生子进程网络隔离仅支持 Linux，因此 macOS Grok work 仍保留前置检查；Grok 实时模式仍要求显式 sysops，这次 advise 结果不扩展到其他路径。OpenRouter 仍仅支持 advise；其他供应商不自动纳入这份四供应商契约。证据范围见[日期化运行验收表](docs/model-capabilities-2026-09.md#f-mode-runtime-gate-2026-09-06)。
 
 ## 🔒 内置安全机制
 
@@ -339,7 +335,7 @@ configure.sh set|get|unset|list|diff LANE [SPEC]    # 非交互编辑/查看 rou
 
 ## 📬 实时邮箱
 
-实时邮箱是 Claude 和 Gemini 可用的常驻后台派发，不是一次性派发。派发方以 `--background` 打开后，运行中仍可追加指令，并负责用 `jobs.sh close ID` 收尾。即使无人处理，它也不会永久存在：空闲上限或已配置的整个作业超时（`--job-timeout`）到期后都会终止它。
+实时邮箱是受支持模式的常驻后台派发，不是一次性派发。派发方以 `--background` 打开后，运行中仍可追加指令，并负责用 `jobs.sh close ID` 收尾。即使无人处理，它也不会永久存在：空闲上限或已配置的整个作业超时（`--job-timeout`）到期后都会终止它。
 
 ```bash
 scripts/dispatch.sh --background --vendor claude hard-judgment "检查超时测试失败的原因"
@@ -351,7 +347,7 @@ scripts/jobs.sh close "$ID"
 scripts/jobs.sh retry "$ID" --background
 ```
 
-`watch` 会跟随 `$JOB_DIR/events.jsonl`；`tail` 读取公开的 `out.txt`。目前 Claude 和 Gemini 支持实时邮箱；其他供应商会执行普通的一次性派发，并在 stderr 和 `$JOB_DIR/mode-notice.txt` 留下提示。`--live` 明确要求常驻会话，解析出的供应商不支持时立即失败。`--single-shot` 即使遇到 Claude 或 Gemini 也强制一次性派发。`--idle-timeout SECONDS` 设置空闲上限，默认 900 秒，设为 `0` 可禁用。
+`watch` 跟随 `$JOB_DIR/events.jsonl`；`tail` 读取 `out.txt`。Claude 和 Gemini 保留受支持模式的后台自动实时行为。Codex／Grok 默认一次性，必须显式 `--background --live`；Grok 还要求 `--mode sysops --workdir DIR`，advise／work 的实时请求在启动前停止，因为 ACP 不强制这些模式的边界。不支持实时模式的供应商立即失败。`--single-shot` 强制一次性执行。`--idle-timeout SECONDS` 默认 900 秒，`0` 禁用空闲上限。
 
 空闲时不会发出 API 调用，也不会产生 API 费用。默认若 900 秒内没有新邮箱消息或新结果事件，worker 会自动收尾；整个作业超时仍是外层上限。处理结束可提前执行 `close`。向已结束或不是实时邮箱的作业执行 `jobs.sh send` 会明确报错并失败。即发即忘的工作、没有实时支持的供应商，或需要从干净状态重新运行的情况都不适用；请新建一次派发，或在作业完成后使用 `retry`。
 
@@ -465,11 +461,11 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 
 <br/>
 
-除非你明说要它改。派工默认是 `advise` 只读模式,而且是逐厂商实现的(只读沙箱、
-plan 模式,或只给只读工具集)。要改文件必须同时给 `--mode work` 和明确的
-`--workdir`。第三种模式 `--mode sysops` 等于 `work` 拿掉 vendor 沙箱,用于沙箱会
-挡掉的服务操作(例如 `launchctl`);codex 以 `-s danger-full-access` 执行,其他
-vendor 一律当成 `work`,而且它只能逐次明确指定,永远不是 lane 默认值。
+除非你明确要求修改。派工默认是 `advise`，通过各厂商的只读沙箱或原生工具权限
+保持只读，并保留支持的网页搜索。一般修改使用 `--mode work` 和明确的 `--workdir`，
+关闭代理工具网络，但保留模型连接。`--mode sysops` 是 Codex、Claude、Grok、Agy
+各自独立的完整权限策略，不是 work 的别名；只有任务明确允许超出 work 边界的
+操作，例如服务管理，才逐次选择，永远不作为通道默认值。
 工作端也不能再往外派——深度守卫会用退出码 86 拒绝嵌套派工,一道
 命令不可能失控变成一整串 AI 烧你的额度。
 
@@ -497,6 +493,20 @@ vendor 一律当成 `work`,而且它只能逐次明确指定,永远不是 lane
 
 ## 📜 版本历程
 
+## v0.41.1 新功能
+
+- **Python 3.9 兼容性。** Agy 工作目录策略的建立与清理改用 `Path.lstat()`，保留符号链接、inode 和并发替换保护。
+- **隔离 CI 测试数据。** 严格 doctor 验收补齐明确启用插件与目录来源设置；设置缺失、停用或路径不匹配时仍会失败。
+- **npm 上架后升级。** 运行 `npm i -g omnilane@0.41.1`，或更新 checkout 后再次运行 `./install.sh`。npm 单独发布，GitHub 发布不代表 npm 已上架。
+
+## v0.40.0 新功能
+
+- **区分模式并修复 Grok 网页工具。** advise 只读并保留支持的原生搜索；work 限于明确的 `--workdir` 且关闭代理工具网络；sysops 每次显式启用完整权限。Grok 完整单次 `plain` advise 已取得真实搜索、抓页和写入拒绝证据；macOS work 与受限实时模式仍保留前置检查。
+- **Codex 与 Grok 显式实时会话。** Codex work 与 Grok sysops 作业可用 `--background --live` 继续发送消息并显式关闭；Codex／Grok 自动派发仍保持单次执行，Claude／Gemini 保留原有自动实时行为。Grok advise 因 ACP 没有可强制执行的只读边界而拒绝 `--live`。
+- **有界且可观测的关闭流程。** 能识别 EOF 的能力探测、每项作业的不可变 worker 快照、解释器／SHA 来源、关闭期限与进程组清理，可限制卡住或被终止的实时作业，但不宣称操作系统沙箱隔离。
+- **AA 驱动的模型覆盖。** 12 条通道默认值已纳入 Fable 5.1、GPT-6 Astra 与 Gemini 3.8 Flash，同时保留现有供应商和显式模型覆盖。日期化 AA v4.2 覆盖快照记录 643 个榜单配置；模型出现在目录中不代表运行环境已验证支持。
+- **升级。** 运行 `npm i -g omnilane@0.40.0`，或更新 checkout 后再次运行 `./install.sh`。
+
 ## v0.33.0 新功能
 
 - **四厂商线程派发。** `--thread NAME` 可让固定厂商、模型、effort 与工作
@@ -579,6 +589,8 @@ vendor 一律当成 `work`,而且它只能逐次明确指定,永远不是 lane
 
 ## v0.12.0 新功能
 
+以下保留当时版本的历史说明。当前三种模式的契约以[模式](#-模式)为准，包括 0.40.0 独立的完整权限 sysops 策略。
+
 - **`hardest-coding` 的 Sol 从 `max` 降到 `xhigh`**——在 AA 分档位的 Coding Index
   上,Sol 的 xhigh 不但胜过自己的 max,也胜过所有 Claude 档位,成本还少约三分之一。
   这类工作超过 xhigh 之后,多加的 effort 买到的是过度思考,不是正确率。