omnilane 0.34.0 → 0.42.1

package/README.md

@@ -32,8 +32,8 @@ architecture question runs on whatever you happened to open.
 **What omnilane does.** It gives your assistant a routing table. Work gets
 sorted into **lanes** — hardest coding, bulk mechanical, triage, hard judgment,
 final polish — and each lane names the model that is best (and cheapest) for
-it. Your assistant keeps the lanes it is already good at and hands the rest to
-another vendor's CLI in the background, using the logins you already have.
+it. The assistant delegates each lane through a compatible caller-owned native
+agent or the existing vendor CLI, even when the worker uses the same model.
 
 **What it is not.** Not a proxy, not a new subscription, not another service to
 keep alive. It is a table plus a dispatch script that runs behind the tool you
@@ -95,7 +95,7 @@ flowchart LR
   and shells out to the vendor's CLI headlessly. `--vendor` selects one named
   vendor without fallback.
 - **`skills/omnilane/SKILL.md`** — a single skill every harness can load:
-  identify your own model, self-execute your lane, dispatch the rest.
+  identify the lane's model and delegate through a compatible native agent or CLI.
 - **`omnilane mcp`** — the same routing surface as an MCP stdio server,
   for hosts that integrate via MCP instead of skills.
 
@@ -115,24 +115,24 @@ actually resolves.
 
 | Lane | First choice | Backup | When |
 |---|---|---|---|
-| 🔥 hardest-coding | Claude Fable 5.1 (xhigh) | GPT-5.6 Sol (xhigh) → Grok 4.6 → Gemini 3.7 Flash (High) | Hardest implementation, deep root-cause debug, correctness-critical edits |
-| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | Refactors, migrations, tests, review sweeps — mechanical endurance |
-| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.7 Flash (Low) → Claude Haiku 4.5 | High-volume scans, first-pass filtering |
-| ⚖️ hard-judgment | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) → Grok 4.6 | Architecture arbitration, deep reasoning, second opinions |
-| ✒️ taste-final | Claude Fable 5.1 (high) | GPT-5.6 Sol (max) → Grok 4.6 → Gemini 3.7 Flash (High) | User-facing prose, prompt/doc polish, style arbitration |
-| 💬 consult | GPT-5.6 Sol (max) | Claude Fable 5.1 (high) → Grok 4.6 → Gemini 3.7 Flash (High) | Direct named-model consultation; keep `--vendor` to prevent fallback |
-| 🎨 ui-draft | GPT-5.6 Sol (xhigh) | Claude Fable 5.1 (high) → Gemini 3.7 Flash (High) | UI drafts only WITH a design system / reference images |
-| 📚 long-context | Gemini 3.7 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | Long-document retrieval and synthesis, ordered on AA-LCR, cost, and throughput |
-| ⚡ fast-agentic | Gemini 3.7 Flash (Medium) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | Fast multi-step agentic loops, multimodal checks |
-| 📡 live-search | Grok 4.6 | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | Realtime X/web search and social context |
-| 🚰 coding-overflow | Grok 4.6 | Gemini 3.7 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex-quota relief valve for mid-tier coding |
+| 🔥 hardest-coding | Claude Fable 5.1 (max) | GPT-6 Astra (xhigh) → Grok 4.6 → Gemini 3.8 Flash (High) | Hardest implementation, deep root-cause debug, correctness-critical edits |
+| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | Refactors, migrations, tests, review sweeps — mechanical endurance |
+| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.8 Flash (Low) → Claude Haiku 4.5 | High-volume scans, first-pass filtering |
+| ⚖️ hard-judgment | Claude Fable 5.1 (xhigh) | GPT-6 Astra (xhigh) → Grok 4.6 | Architecture arbitration, deep reasoning, second opinions |
+| ✒️ taste-final | Claude Fable 5.1 (xhigh) | GPT-6 Astra (xhigh) → Grok 4.6 → Gemini 3.8 Flash (High) | User-facing prose and style arbitration; benchmarks do not prove visual or editorial taste |
+| 💬 consult | GPT-6 Astra (xhigh) | Claude Fable 5.1 (xhigh) → Grok 4.6 → Gemini 3.8 Flash (Medium) | Direct named-model consultation; keep `--vendor` to prevent fallback |
+| 🎨 ui-draft | GPT-5.6 Sol (high) | Claude Fable 5.1 (xhigh) → Gemini 3.8 Flash (High) | UI drafts only with a design system or reference images; no aesthetic benchmark claim |
+| 📚 long-context | Gemini 3.8 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | Long-document synthesis; context size alone does not prove task quality |
+| ⚡ fast-agentic | Gemini 3.8 Flash (Low) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | Fast multi-step tool loops and multimodal checks |
+| 📡 live-search | Grok 4.6 | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | Realtime X/web search; backups provide generic web search, not equivalent X context |
+| 🚰 coding-overflow | Grok 4.6 | Gemini 3.8 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Explicit Codex-quota relief; provider failure does not auto-retry another vendor |
 | 🗳️ arbitrate | off (opt-in vote panel) | — | Built-in opinion panel for big calls — disabled by default; enable it in `routing.local.yaml`, one call per voter per round |
 
 The **backup** is the next candidate in the lane's `routing.yaml` chain — what
 dispatch falls back to when the first-choice vendor CLI is not installed. Every
 lane is such a chain; when nothing in it is installed the lane degrades to `off`.
 
-> **Fable 5.1 is in the defaults — and where Opus 5 still fits.** See the current three-way evidence and Opus override in the [FAQ](#-faq).
+> **Fable 5.1 and Astra now lead hard work.** See the current same-condition evidence in [FAQ](#-faq).
 
 ### Natural-language consultation
 
@@ -147,22 +147,71 @@ request; this is not a free-form shell parser in `dispatch.sh`.
   table. If an explicit target is absent or unavailable, the command fails
   clearly instead of falling back to another vendor or family.
 
+## Native-first delegation, terminal-compatible
+
+Model routing and execution are separate. `--executor auto` (default) selects
+a caller-owned native tool only from explicit structured capabilities. Without
+that context a standalone terminal uses legacy CLI. `--executor cli` forces
+the old behavior; `--executor native` rejects missing/incompatible capability.
+Same vendor is not same model; explicit model/vendor/effort are preserved.
+On native rejection, auto reports a CLI reason and keeps the exact resolved
+target rather than substituting another vendor/model.
+
+```sh
+# Standalone terminal: CLI dry run, no jobs or provider calls.
+omnilane route --executor auto --dry-run hardest-coding "Review this change"
+
+# Host supplies honest shared/inherited capability JSON; inspect the linked schema.
+omnilane route --executor native --native-context /absolute/capability.json --workdir /absolute/repo hardest-coding "Review this change"
+# The host now spawns its native agent tool, waits and writes actual evidence.
+omnilane jobs --json complete-native JOB_ID /absolute/completion.json
+omnilane jobs --json status JOB_ID
+omnilane jobs --json result JOB_ID
+omnilane jobs --json list --status pending
+```
+
+Native route emits **pending handoff JSON**, not a shell-native invocation or
+completed job. Codex `collaboration.spawn_agent` has no sandbox/tool/workdir
+restriction parameters and inherits parent tools/filesystem. Its honest request
+and matching capability row explicitly use `shared-inherited` with empty tool
+arrays; `advise`/`work` and workdir are task intent, not an OS boundary. Hard
+isolation remains same-model CLI in auto and rejects forced native.
+
+The caller spawns the real agent with the exact resolved model/effort, then
+ingests the actual agent ID, runtime model/effort/vendor/harness/backend,
+outcome, public result, and evidence. An explicit model override uses
+`fork_turns: "none"` or bounded positive history, never `fork_turns: "all"`.
+Unknown caller current model may be omitted when the route explicitly selects
+an exact model declared by the matching capability row. Duplicate completion is
+rejected. Native cancellation never signals PIDs; the caller separately stops
+any spawned agent.
+
+Background/durable/live/named CLI sessions, sysops, unsupported isolation,
+vote/arbitration and multi-round paths remain CLI-only. Native integration is
+limited to list/status/result/cancel/completion, not CLI wait/retry/mailbox or
+goal-loop. Protocol handling needs Python 3.9+; legacy terminal CLI remains
+compatible. Tests are fixtures, not live native acceptance. The parent alone
+syncs the host AGENTS managed block after review.
+See [schemas, complete examples and limitations](docs/native-executor.md).
+
 <details>
-<summary><b>👉 Which lanes do you run yourself? Pick your main model</b></summary>
+<summary><b>Model-role guidance (delegation still required)</b></summary>
 
 <br/>
 
-The table above is vendor-neutral — the *best* model for a lane doesn't change
-with who is driving. What changes is which lanes you **self-execute** (you
-already are that model, so no second call) versus **dispatch**. Your harness's
-`omnilane` skill applies the right row automatically; this is the human view.
+The best model for a lane does not change with the commander. These are role
+hints, not self-execution exemptions: even a same-model task is delegated.
+A native agent is eligible only when the caller explicitly confirms the exact
+model, effort, mode, workdir, tools, isolation and lifecycle. Otherwise use CLI.
+The commander orchestrates and validates; workers do not delegate again.
 
-- **Claude Code · Fable 5.1** — self-execute: taste-final, hardest-coding. Dispatch hard-judgment → Opus 5; bulk → Codex Sol high; long-context and fast loops → Gemini 3.7 Flash; live-search → Grok.
-- **Claude Code · Opus 5** — self-execute: hard-judgment, its default lane. Use a local override for taste-final when its lower hallucination rate or price is preferred. Dispatch hardest coding → Fable 5.1 or Sol, bulk → Sol high, long-context and fast loops → Gemini 3.7 Flash, live-search → Grok.
-- **Codex · Sol** — self-execute: hardest-coding, bulk-mechanical, hard-judgment, ui-draft. Dispatch taste-final → Claude, long-context and fast loops → Gemini 3.7 Flash, live-search → Grok.
-- **Codex · Terra** — self-execute: long-context as the Codex fallback. Bulk-mechanical now defaults to Sol high; escalate hardest pieces to Sol xhigh, taste → Claude, fast loops → Gemini 3.7 Flash, live-search → Grok.
-- **Grok Build · Grok 4.6** — self-execute: live-search and coding-overflow, plus fallback duty in hardest-coding, hard-judgment, and taste-final. Dispatch primary hard coding/judgment/taste work to Codex/Claude/Gemini when available; verify API signatures and cited facts.
-- **Antigravity · Gemini 3.7 Flash** — self-execute: long-context and fast loops at Medium, bulk/overflow at High, triage at Low, plus fallback duty (High) in hardest-coding, taste-final, ui-draft, and live-search. Dispatch primary hardest coding/judgment/taste to Codex/Claude when available.
+- **Claude Code · Fable 5.1** — recommended prompt-level controller for quality-sensitive work; this is a role, not a lane or automatic selector. Delegate hardest-coding at max and judgment/taste at xhigh; use Astra for an independent Codex review, Sol for bulk, Gemini 3.8 Flash for long/fast work, and Grok for live search.
+- **Claude Code · Opus 5** — balanced prompt-level controller and independent reviewer when explicitly selected (`high`, or `xhigh` for deeper review), plus long-context fallback. This is an opt-in role, not a new lane or the default hard-judgment route.
+- **Codex · Sol** — delegate bulk-mechanical and constrained ui-draft at high. Escalate hardest coding and judgment to Fable/Astra; route long/fast work to Gemini 3.8 Flash and live search to Grok.
+- **Codex · Astra** — prompt-level controller backup and independent reviewer. Use xhigh by default for hardest coding/judgment and consult/taste; explicitly select `--vendor codex --effort max` when needed. Explicit model/effort always win.
+- **Codex · Terra** — delegate the Codex long-context fallback at max. Bulk stays on Sol high; escalate hard work to Fable/Astra.
+- **Grok Build · Grok 4.6** — delegate live-search and coding-overflow, plus fallback duty in hardest-coding, hard-judgment, and taste-final. Dispatch primary hard coding/judgment/taste work to Codex/Claude/Gemini when available; verify API signatures and cited facts.
+- **Antigravity · Gemini 3.8 Flash** — delegate long-context Medium, fast-agentic/triage Low, and bulk/overflow/web fallbacks High. Do not infer visual taste or controller authority from agent/coding benchmarks.
 
 </details>
 
@@ -379,20 +428,13 @@ code passes through.
 
 ## 🎭 Modes
 
-- **advise** (default) — read-only worker. Codex runs in a read-only sandbox;
-  Claude gets only Read/Glob/Grep; Grok runs in plan mode; Kimi and OpenCode
-  pin their read-only plan modes; OpenRouter is advise-only by design (pure
-  inference). Use for reviews, questions, second opinions.
-- **work** — the worker may edit files, only inside the `--workdir` you name.
-  Codex gets a workspace-write sandbox; Claude auto-accepts edits; Gemini runs
-  in accept-edits mode. The `openrouter` vendor refuses work mode with a clear
-  error — route edits to an agentic CLI vendor instead.
-- **sysops** — `work` minus the vendor sandbox, for service operations the
-  sandbox denies (`launchctl` and friends). Codex runs it with
-  `-s danger-full-access`; every other vendor treats it as plain `work`. This
-  hands the worker full access to the machine, so it is an explicit
-  per-dispatch opt-in and can never be a lane default. Reach for it only when
-  you have watched `work` fail on a sandbox denial.
+- **advise** (default): read-only local analysis with native web/search tools where the vendor supports them. Model/provider traffic stays available; agent mutation tools are restricted. This is not a promise of identical X/web capabilities across vendors.
+- **work**: local file and command work confined to the explicit `--workdir`, with agent-tool network access disabled. This does not disable the model/provider connection. Unsupported enforcement fails before provider startup rather than silently becoming sysops.
+- **sysops**: explicit per-dispatch opt-in to unrestricted agent tools and filesystem/network access. It is never a lane default; the task must state the allowed operations.
+
+The CLI defaults `--workdir` to the caller’s current directory when omitted; task briefs should still specify it explicitly. The MCP `route`/`dry_run` work interface separately requires an explicit `workdir`.
+
+Codex and Claude have distinct policies for all three modes. Agy advise/sysops use isolated per-session native app settings without replacing subscription authentication; Agy 1.1.27 work has bounded new/resume acceptance using four validated tools and the native terminal sandbox: workspace read/write/edit/build and policy-denied outside writes passed. External temp/cache reads are also restricted; settings are explicitly regenerated at each start rather than claimed immutable. A separate real two-turn work live/FIFO check passed readback, outside-write denial and normal close with unchanged sources. Grok advise uses native tool allow/deny rules; its complete single-shot `plain` path has verified native keyword search, page fetching, and a denied write on Grok 1.0.13. It uses internal web-tool IDs and job-local MCP readiness without disabling hooks. An existing nonempty `CONTEXT_MODE_MCP_SENTINEL_DIR` conflicts with this advise scope and stops before provider startup rather than being overwritten. Grok work remains gated on macOS because native child-network isolation is Linux-only, and Grok live requires explicit sysops; the advise result does not validate these other paths. OpenRouter remains advise-only; other vendors are not implicitly covered by this four-vendor contract. See the [dated runtime gate](docs/model-capabilities-2026-09.md#f-mode-runtime-gate-2026-09-06) for evidence boundaries.
 
 ## 🔒 Safety rails
 
@@ -430,7 +472,7 @@ code passes through.
 
 ## 📬 Live mailbox
 
-A live mailbox is a resident Claude or Gemini background dispatch, not a one-shot dispatch. The foreman opens it with `--background`, can send another instruction while it is still running, and is responsible for closing it with `jobs.sh close ID`. Leaving it unattended does not make it permanent: the idle cap and configured whole-job timeout (`--job-timeout`) can still end it.
+A live mailbox is a resident background dispatch, not a one-shot dispatch. Claude and Gemini retain their existing automatic live behavior with `--background`. Codex and Grok default to single-shot; opt in with `--background --live` (Grok additionally requires `--mode sysops --workdir DIR`). The foreman can send another instruction while it is running and is responsible for closing it with `jobs.sh close ID`. The idle cap and configured whole-job timeout (`--job-timeout`) can still end it.
 
 ```bash
 scripts/dispatch.sh --background --vendor claude hard-judgment "Review the timeout failure"
@@ -442,7 +484,7 @@ scripts/jobs.sh close "$ID"
 scripts/jobs.sh retry "$ID" --background
 ```
 
-`watch` follows `$JOB_DIR/events.jsonl`; `tail` reads the public `out.txt`. Live mailbox support covers Claude and Gemini; other vendors run as normal one-shot dispatches, with a notice sent to stderr and stored in `$JOB_DIR/mode-notice.txt`. `--live` requires a resident session and fails fast when the resolved vendor is not capable. `--single-shot` forces one-shot execution even for Claude or Gemini. `--idle-timeout SECONDS` sets the inactivity cap (default 900; `0` disables it).
+`watch` follows `$JOB_DIR/events.jsonl`; `tail` reads the public `out.txt`. Live mailbox support covers Claude, Gemini, Codex, and Grok. Automatic selection remains single-shot for Codex/Grok; only explicit `--live` opts them in. Grok advise rejects `--live` because ACP does not enforce its read-only boundary; normal advise uses single-shot native tool allow/deny rules. `--live` fails fast for unsupported vendors. `--single-shot` forces one-shot execution for every vendor. `--idle-timeout SECONDS` sets the inactivity cap (default 900; `0` disables it).
 
 An idle mailbox makes no API calls and incurs no API spend. By default it closes after 900 seconds without a new inbox message or result event, while the whole-job timeout remains the outer cap. Close it sooner when its exchange is finished. `jobs.sh send` to a finished job or a job that is not live fails with a clear error. Do not use this for fire-and-forget work, vendors without live support, or a clean-slate rerun; start a fresh dispatch (or retry a completed job) instead.
 
@@ -496,53 +538,36 @@ with the key you set — those are advise-only and never edit files.
 </details>
 
 <details>
-<summary><b>Fable 5.1 is in the defaults — and where Opus 5 still fits</b></summary>
+<summary><b>Why do Fable 5.1 and Astra now lead hard work?</b></summary>
 
 <br/>
 
-Fable 5.1 now leads `hardest-coding` and `taste-final`. At matched xhigh
-effort it leads Opus 5 on intelligence, agentic work, and coding. Sol max
-remains the far cheaper cross-vendor judgment fallback. `hard-judgment`
-itself now defaults to Opus 5 xhigh: it returns 97.7% of Fable's agentic
-score at 68% of the cost and a lower hallucination rate, so on that lane's
-own per-cost criterion the cheaper configuration wins.
-
-| Benchmark (AA, retrieved 2026-09-02) | Claude Fable 5.1 (xhigh) | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) |
-|---|---:|---:|---:|
-| Intelligence | 64.8 | 62.5 | 60.9 |
-| Agentic | 59.8 | 58.4 | 57.8 |
-| Coding | 80.7 | 77.0 | 77.4 |
-| Hallucination rate (lower is better) | .71 | **.60** | .92 |
-| AA $/task | $2.65 | $1.80 | **$0.95** |
-
-Fable 5.1 is not a bulk or triage default: it costs twice Opus 5 per token and
-consumes the most Claude Code subscription quota per turn. Opus 5 now leads
-`hard-judgment` by default, stays in `long-context` at medium, and remains
-selectable everywhere through `~/.omnilane/routing.local.yaml` — for example,
-to bring Fable back:
-
-```yaml
-hard-judgment: claude claude-fable-5-1 xhigh
-```
+The 2026-09-05 refresh compares the two on AA v4.2 under matching effort:
+Fable/Astra score 57/55 at max and 54/54 at xhigh; AA Briefcase is
+1666/1566 at max and 1657/1540 at xhigh. In the native coding-agent comparison,
+Fable max completes 70 at $9.18/task in 24 minutes and Astra max completes 67
+at $4.72/task in 26.8 minutes. That supports Fable max for
+`hardest-coding`, Fable xhigh for `hard-judgment`/`taste-final`, and Astra as
+the Codex-family fallback or independent reviewer.
+
+Fable max is the quality-first prompt-level controller. Opus high/xhigh is
+the balanced controller and independent-review option; Astra is the existing-
+Codex-quota backup/reviewer. These are role recommendations, not a new lane or
+automatic controller selector. Opus also remains the Claude `long-context`
+fallback.
 
 </details>
 
 <details>
-<summary><b>Why do the Claude lanes use <code>xhigh</code> instead of <code>max</code>?</b></summary>
+<summary><b>Why does hardest coding use <code>max</code> while other Claude lanes use <code>xhigh</code>?</b></summary>
 
 <br/>
 
-Because more effort is not monotonically better. Anthropic documents `xhigh` as
-the starting point for coding and agentic work, `high` as the floor for other
-intelligence-sensitive work, and `max` as the setting for cases where
-correctness outweighs cost. Independent testing agrees: on Vals.ai's Vibe Code
-Bench, Opus 5 scores 89.8% at `high` but only 88.3% at `xhigh` and 88.4% at
-`max` — the top tiers produce more elaborate solutions that fail more often.
-Raise any lane locally if your workload disagrees:
-
-```bash
-omnilane configure set hard-judgment "claude claude-opus-5 max"
-```
+Effort is selected per task, not assumed to improve monotonically. The current
+same-condition and native coding evidence justifies max for correctness-first
+`hardest-coding`; xhigh remains the quality/cost default for
+`hard-judgment`, `taste-final`, and named Fable consultation. Explicit
+`--model` and `--effort` always override these route defaults.
 
 </details>
 
@@ -567,13 +592,13 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # fully resolved plan, no p
 
 <br/>
 
-Only if you ask for it. Dispatch defaults to `advise`, a read-only mode enforced
-per vendor (read-only sandbox, plan mode, or read-only tool set depending on the
-CLI). Editing requires both `--mode work` and an explicit `--workdir`. A third
-mode, `--mode sysops`, is `work` minus the vendor sandbox — for service
-operations the sandbox denies (e.g. `launchctl`); codex runs it with
-`-s danger-full-access`, other vendors treat it as `work`, and it is an
-explicit per-dispatch opt-in, never a lane default. Workers
+Only if you ask for it. Dispatch defaults to `advise`, with per-vendor read-only
+sandbox or native tool permissions and supported web search. For bounded edits,
+use `--mode work` with an explicit `--workdir`; agent-tool networking is disabled
+while the model connection remains available. `--mode sysops` is a separate,
+explicit full-access policy for Codex, Claude, Grok, and Agy, not an alias for
+work. Use it only when the task explicitly permits operations outside work's
+boundary, such as service management. It is never a lane default. Workers
 also cannot dispatch again — the depth guard refuses nested fan-out with exit 86,
 so one command can never spiral into a chain of agents spending your quota.
 
@@ -602,6 +627,40 @@ working notes, including per-benchmark caveats, live in
 
 ## 📜 Release history
 
+## What's new in v0.42.1
+
+- **CI fixture repair.** Full Python discovery now gives legacy routing and Grok-readiness fixtures an explicit synthetic-human caller, while production missing-identity denial, the approved registry SHA, downward score checks, retry lineage, and skip assertions remain unchanged.
+- **Portable lineage evidence.** The encoded-effort Gemini spy uses a portable Python interpreter selector and verifies the exact `--model gemini-3.8-flash-high` pair. AA coverage remains 78 scored targets, one scored reference-only entry, and 10 unknown configurations.
+- **Patch upgrade.** After npm publication, run `npm i -g omnilane@0.42.1`. For an existing repo-symlink installation, update the checkout and run `omnilane --version`; do not rerun `./install.sh` unless deliberately rewiring integrations. GitHub release and npm publication remain separate.
+
+## What's new in v0.42.0
+
+- **Native-first execution.** Routing and execution are separate: `--executor auto` uses a caller-owned native agent only when the host supplies an exact compatible capability context, and otherwise keeps the same vendor/model/effort on the CLI path. A native handoff is pending work, not a completed job; the caller executes it and records verified completion separately.
+- **Frozen exact-AA downward delegation.** The checked-in AA v4.2 policy gates every provider attempt against the current caller and inherited ceiling, carries an exact child context, and revalidates retries without inheriting a model's earlier human exemption. Its 78 scored configurations are policy inputs, not a claim that all 78 are runnable.
+- **Explicit native reuse.** Reusing an existing Codex agent requires caller-observed idle state, preserved-context consent, and an exact runtime match; capacity exhaustion never silently changes a new-agent request into reuse. Completion is caller-attested evidence, not independent certification of upstream model identity or a cold-start guarantee.
+- **Codex completion wakeup.** `scripts/completion-wakeup.py` binds a run to a controller thread and job allowlist, records scheduler registration, polls terminal events, and separates delivery from acceptance before closing. This is scheduled heartbeat polling, not instant push; without a supported callback the controller keeps waiting directly.
+- **Package and upgrade.** The npm tarball now carries the AA policy, native/AA/wakeup helpers, and both public protocol documents. After npm publication, run `npm i -g omnilane@0.42.0`. Existing repo-symlink installations only need the checkout updated to the released revision and `omnilane --version` verified; review `./install.sh` only for first installation or required rewiring. A GitHub release alone does not establish npm availability.
+
+## What's new in v0.41.1
+
+- **Astra defaults to xhigh.** In `hardest-coding` and `hard-judgment`, Astra now defaults to `xhigh`; explicitly select `--vendor codex --effort max` when needed. Provider order and other model efforts are unchanged. This is not a claim of measured CLI subscription-quota savings.
+
+- **Python 3.9 compatibility.** Agy workspace-policy staging and cleanup now use `Path.lstat()` without weakening symlink, inode, or concurrent-replacement protections.
+- **Isolated CI fixture.** Strict doctor acceptance now supplies explicit plugin-enabled and directory-marketplace settings; missing, disabled, or mismatched settings still fail.
+- **Portable offline CI fixtures.** Tests no longer depend on the operator HOME, use portable permission-mode checks, and verify Linux/macOS live restrictions for the actual platform.
+- **Gemini threads on Bash 3.2.** Empty thread-argument expansion is guarded while preserving `set -u`, populated resume arguments, and existing mode and permission policies.
+- **Bounded Codex live close.** FIFO backpressure and partial writes preserve byte ordering and unsent suffixes for the bounded close drain. If the runner exits before forwarding accepted queued input, that input is retained and the failure is reported rather than silently discarded. Other providers keep their existing forwarding paths.
+- **Upgrade after npm publication.** Run `npm i -g omnilane@0.41.1`, or update your checkout and rerun `./install.sh`. npm publication is handled separately; a GitHub release does not establish npm availability.
+
+## What's new in v0.40.0
+
+- **Distinct modes and repaired Grok web access.** Advise is read-only with supported native search, work confines edits to explicit `--workdir` with agent-tool networking off, and sysops explicitly opts into full access. Grok's full single-shot `plain` advise path now has real search/fetch and denied-write evidence; macOS work and restricted live remain gated.
+- **Explicit Codex and Grok live sessions.** `--background --live` enables follow-up prompts and explicit close for Codex work jobs and Grok sysops jobs; automatic Codex/Grok dispatch stays single-shot, while Claude/Gemini keep their existing auto-live behavior. Grok advise rejects `--live` because its ACP surface does not enforce a read-only boundary.
+- **Bounded, observable shutdown.** EOF-aware capability probes, immutable per-job worker snapshots, interpreter/SHA provenance, close deadlines, and process-group cleanup keep stalled or killed live jobs bounded without claiming OS sandbox isolation.
+- **Completion and idle fixes.** Completion delivery tolerates truncated UTF-8 tails, terminal state comes from durable exit records, and idle tracking advances on completed result events rather than arbitrary stream traffic.
+- **AA-informed model coverage.** The 12-lane defaults now cover Fable 5.1, GPT-6 Astra, and Gemini 3.8 Flash while retaining existing vendors and explicit model overrides. A dated AA v4.2 coverage snapshot documents 643 leaderboard configurations; catalog presence is not a runtime capability guarantee.
+- **Upgrade.** Run `npm i -g omnilane@0.40.0`, or update your checkout and rerun `./install.sh`.
+
 ## What's new in v0.33.0
 
 - **Four-vendor threaded dispatch.** `--thread NAME` continues pinned Claude,
@@ -707,6 +766,8 @@ working notes, including per-benchmark caveats, live in
 
 ## What's new in v0.12.0
 
+These are historical release notes. The current three-mode contract is defined in [Modes](#-modes), including the separate full-access sysops policy in 0.40.0.
+
 - **`hardest-coding` drops Sol from `max` to `xhigh`** — on AA's per-effort
   Coding Index, Sol at xhigh outscores Sol at max and every Claude tier while
   costing about a third less. Past xhigh, effort buys overthinking rather than

package/README.zh-CN.md

@@ -103,18 +103,18 @@ flowchart LR
 
 | 通道 | 首选模型 | 备选模型 | 用途 |
 |---|---|---|---|
-| 🔥 hardest-coding | Claude Fable 5.1 (xhigh) | GPT-5.6 Sol (xhigh) → Grok 4.6 → Gemini 3.7 Flash (High) | 最难的实现、深度调试、正确性关键的修改 |
-| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | 重构、迁移、测试、大范围扫描——机械耐力活 |
-| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.7 Flash (Low) → Claude Haiku 4.5 | 大量扫描、第一轮筛选 |
-| ⚖️ hard-judgment | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) → Grok 4.6 | 架构裁决、深度推理、第二意见 |
-| ✒️ taste-final | Claude Fable 5.1 (high) | GPT-5.6 Sol (max) → Grok 4.6 → Gemini 3.7 Flash (High) | 对外文字、提示词／文档润色、风格裁决 |
-| 💬 consult | GPT-5.6 Sol (max) | Claude Fable 5.1 (high) → Grok 4.6 → Gemini 3.7 Flash (High) | 直接指定模型咨询；保留 `--vendor` 避免降级 |
-| 🎨 ui-draft | GPT-5.6 Sol (xhigh) | Claude Fable 5.1 (high) → Gemini 3.7 Flash (High) | 仅在提供设计系统／参考图时生成 UI 草稿 |
-| 📚 long-context | Gemini 3.7 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | 长文档提取与综合，按 AA-LCR、成本和吞吐排序 |
-| ⚡ fast-agentic | Gemini 3.7 Flash (Medium) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | 高速多步骤工具循环、多模态检查 |
-| 📡 live-search | Grok 4.6 | Gemini 3.7 Flash (High) → Claude Sonnet 5 (high) | 实时 X／网页搜索与社交上下文 |
-| 🚰 coding-overflow | Grok 4.6 | Gemini 3.7 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex 配额耗尽时的中量级编码安全阀 |
-| 🗳️ arbitrate | `off`（可选模型评审团） | — | 重大决定的内置意见评审团；默认禁用，在 `routing.local.yaml` 启用，每位评审每轮调用一次 |
+| 🔥 hardest-coding | Claude Fable 5.1 (max) | GPT-6 Astra (xhigh) → Grok 4.6 → Gemini 3.8 Flash (High) | 最难的实现、深度调试、正确性关键的修改 |
+| 🏗️ bulk-mechanical | GPT-5.6 Sol (high) | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | 重构、迁移、测试、大范围扫描——机械耐力活 |
+| 🧹 triage | GPT-5.6 Luna (high) | Gemini 3.8 Flash (Low) → Claude Haiku 4.5 | 大量扫描、第一轮筛选 |
+| ⚖️ hard-judgment | Claude Fable 5.1 (xhigh) | GPT-6 Astra (xhigh) → Grok 4.6 | 架构裁决、深度推理、第二意见 |
+| ✒️ taste-final | Claude Fable 5.1 (xhigh) | GPT-6 Astra (xhigh) → Grok 4.6 → Gemini 3.8 Flash (High) | 对外文字、提示词／文档润色、风格裁决 |
+| 💬 consult | GPT-6 Astra (xhigh) | Claude Fable 5.1 (xhigh) → Grok 4.6 → Gemini 3.8 Flash (Medium) | 直接指定模型咨询；保留 `--vendor` 避免降级 |
+| 🎨 ui-draft | GPT-5.6 Sol (high) | Claude Fable 5.1 (xhigh) → Gemini 3.8 Flash (High) | 仅在提供设计系统／参考图时生成 UI 草稿 |
+| 📚 long-context | Gemini 3.8 Flash (Medium) | GPT-5.6 Terra (max) → Claude Opus 5 (medium) | 长文档提取与综合，按 AA-LCR、成本和吞吐排序 |
+| ⚡ fast-agentic | Gemini 3.8 Flash (Low) | GPT-5.6 Luna (high) → Claude Haiku 4.5 | 高速多步骤工具循环、多模态检查 |
+| 📡 live-search | Grok 4.6 | Gemini 3.8 Flash (High) → Claude Sonnet 5 (high) | 实时 X／网页搜索与社交上下文 |
+| 🚰 coding-overflow | Grok 4.6 | Gemini 3.8 Flash (High) → Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex 配额耗尽时的中量级编码安全阀 |
+| 🗳️ arbitrate | off (opt-in vote panel) | — | 重大决定的内置意见评审团；默认禁用，在 `routing.local.yaml` 启用，每位评审每轮调用一次 |
 
 **备选模型**是候选链的下一位——首选那家的厂商 CLI 没装时,派发就降到它。每条
 通道都是这样一条链;整条都没装时,通道自动降为 `off`。
@@ -296,17 +296,13 @@ configure.sh set|get|unset|list|diff LANE [SPEC]    # 非交互编辑/查看 rou
 
 ## 🎭 模式
 
-- **advise(默认)** — 只读工作端。Codex 跑只读沙箱;Claude 只给
-  Read/Glob/Grep;Grok 跑 plan 模式;Kimi 与 OpenCode 锁各自的只读
-  plan 模式;OpenRouter 天生只做 advise(纯推理)。适合审查、提问、第二意见。
-- **work** — 允许改文件,仅限你指定的 `--workdir`。Codex 给
-  workspace-write 沙箱;Claude 自动接受编辑;Gemini 跑 accept-edits 模式。
-  `openrouter` vendor 会明确拒绝 work 模式——改文件请走代理式 CLI vendor。
-- **sysops** — 等于 `work` 拿掉 vendor 沙箱,用于沙箱会挡掉的服务操作
-  (`launchctl` 之类)。Codex 以 `-s danger-full-access` 执行;其他 vendor
-  一律当成普通 `work`。这等于把整台机器的访问权交给工作端,因此只能逐次
-  明确指定,永远不能设成 lane 默认值。只有在你亲眼看到 `work` 因沙箱拒绝而
-  失败时才动用它。
+- **advise（默认）**：本地只读分析；供应商支持时可用原生网页／搜索工具。保留模型连接，限制修改工具；不同供应商的 X／网页搜索能力并不等同。
+- **work**：文件与命令操作限于显式 `--workdir`，关闭代理工具网络访问，保留模型连接。不支持的强制边界在调用模型前停止，不会静默切换为 sysops。
+- **sysops**：每次派工显式选择，开放代理工具、文件和网络访问；不作为通道默认值，任务必须列明允许的操作。
+
+CLI 省略 `--workdir` 时默认使用调用端当前目录；任务说明仍应明确工作目录。MCP `route`／`dry_run` 的 work 接口则单独要求明确的 `workdir`。
+
+Codex 和 Claude 的三种模式使用不同策略。Agy advise／sysops 使用独立的原生会话设置，不替换订阅认证；Agy 1.1.27 work 已使用四个经过验证的工具及原生终端沙箱完成限定的新建／续接验收：工作目录内读写、修改、编译及越界写入拒绝通过。外部临时文件／缓存读取也受限；每次启动重写明确设置，不宣称设置全程不可变。另一次正式 work 实时／FIFO 两轮验收已通过前轮读回、越界写入拒绝及正常关闭，源文件保持不变。Grok advise 使用原生工具允许／拒绝规则；Grok 1.0.13 的完整单次 `plain` 路径已验证原生关键词搜索、抓取网页及写入拒绝，采用内部网页工具 ID 和每项作业独立的 MCP 就绪状态，不关闭钩子。`CONTEXT_MODE_MCP_SENTINEL_DIR` 已设置为非空值时，会在调用模型前报告冲突，不覆盖原设置。原生子进程网络隔离仅支持 Linux，因此 macOS Grok work 仍保留前置检查；Grok 实时模式仍要求显式 sysops，这次 advise 结果不扩展到其他路径。OpenRouter 仍仅支持 advise；其他供应商不自动纳入这份四供应商契约。证据范围见[日期化运行验收表](docs/model-capabilities-2026-09.md#f-mode-runtime-gate-2026-09-06)。
 
 ## 🔒 内置安全机制
 
@@ -339,7 +335,7 @@ configure.sh set|get|unset|list|diff LANE [SPEC]    # 非交互编辑/查看 rou
 
 ## 📬 实时邮箱
 
-实时邮箱是 Claude 和 Gemini 可用的常驻后台派发，不是一次性派发。派发方以 `--background` 打开后，运行中仍可追加指令，并负责用 `jobs.sh close ID` 收尾。即使无人处理，它也不会永久存在：空闲上限或已配置的整个作业超时（`--job-timeout`）到期后都会终止它。
+实时邮箱是受支持模式的常驻后台派发，不是一次性派发。派发方以 `--background` 打开后，运行中仍可追加指令，并负责用 `jobs.sh close ID` 收尾。即使无人处理，它也不会永久存在：空闲上限或已配置的整个作业超时（`--job-timeout`）到期后都会终止它。
 
 ```bash
 scripts/dispatch.sh --background --vendor claude hard-judgment "检查超时测试失败的原因"
@@ -351,7 +347,7 @@ scripts/jobs.sh close "$ID"
 scripts/jobs.sh retry "$ID" --background
 ```
 
-`watch` 会跟随 `$JOB_DIR/events.jsonl`；`tail` 读取公开的 `out.txt`。目前 Claude 和 Gemini 支持实时邮箱；其他供应商会执行普通的一次性派发，并在 stderr 和 `$JOB_DIR/mode-notice.txt` 留下提示。`--live` 明确要求常驻会话，解析出的供应商不支持时立即失败。`--single-shot` 即使遇到 Claude 或 Gemini 也强制一次性派发。`--idle-timeout SECONDS` 设置空闲上限，默认 900 秒，设为 `0` 可禁用。
+`watch` 跟随 `$JOB_DIR/events.jsonl`；`tail` 读取 `out.txt`。Claude 和 Gemini 保留受支持模式的后台自动实时行为。Codex／Grok 默认一次性，必须显式 `--background --live`；Grok 还要求 `--mode sysops --workdir DIR`，advise／work 的实时请求在启动前停止，因为 ACP 不强制这些模式的边界。不支持实时模式的供应商立即失败。`--single-shot` 强制一次性执行。`--idle-timeout SECONDS` 默认 900 秒，`0` 禁用空闲上限。
 
 空闲时不会发出 API 调用，也不会产生 API 费用。默认若 900 秒内没有新邮箱消息或新结果事件，worker 会自动收尾；整个作业超时仍是外层上限。处理结束可提前执行 `close`。向已结束或不是实时邮箱的作业执行 `jobs.sh send` 会明确报错并失败。即发即忘的工作、没有实时支持的供应商，或需要从干净状态重新运行的情况都不适用；请新建一次派发，或在作业完成后使用 `retry`。
 
@@ -465,11 +461,11 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 
 <br/>
 
-除非你明说要它改。派工默认是 `advise` 只读模式,而且是逐厂商实现的(只读沙箱、
-plan 模式,或只给只读工具集)。要改文件必须同时给 `--mode work` 和明确的
-`--workdir`。第三种模式 `--mode sysops` 等于 `work` 拿掉 vendor 沙箱,用于沙箱会
-挡掉的服务操作(例如 `launchctl`);codex 以 `-s danger-full-access` 执行,其他
-vendor 一律当成 `work`,而且它只能逐次明确指定,永远不是 lane 默认值。
+除非你明确要求修改。派工默认是 `advise`，通过各厂商的只读沙箱或原生工具权限
+保持只读，并保留支持的网页搜索。一般修改使用 `--mode work` 和明确的 `--workdir`，
+关闭代理工具网络，但保留模型连接。`--mode sysops` 是 Codex、Claude、Grok、Agy
+各自独立的完整权限策略，不是 work 的别名；只有任务明确允许超出 work 边界的
+操作，例如服务管理，才逐次选择，永远不作为通道默认值。
 工作端也不能再往外派——深度守卫会用退出码 86 拒绝嵌套派工,一道
 命令不可能失控变成一整串 AI 烧你的额度。
 
@@ -497,6 +493,39 @@ vendor 一律当成 `work`,而且它只能逐次明确指定,永远不是 lane
 
 ## 📜 版本历程
 
+## v0.42.1 新功能
+
+- **修复 CI 测试夹具。** 完整 Python discovery 现在会为旧 routing 与 Grok readiness 测试显式指定 synthetic-human caller；production 的缺失身份拒绝、获准 registry SHA、向下分数闸、重试 lineage 与 skip 断言均保持不变。
+- **可移植的 lineage 证据。** encoded-effort Gemini spy 改用可移植的 Python 解释器选择，并验证精确的 `--model gemini-3.8-flash-high` 参数对。AA 覆盖仍为 78 个 scored target、1 个 scored reference-only 项目和 10 个 unknown configuration。
+- **补丁版升级。** npm 发布后可运行 `npm i -g omnilane@0.42.1`。现有 repo-symlink 安装只需更新 checkout 并运行 `omnilane --version`；除非有意重新接线，否则不要再次运行 `./install.sh`。GitHub release 与 npm 发布仍相互独立。
+
+## v0.42.0 新功能
+
+- **原生优先执行。** `--executor auto` 只在主机提供精确兼容的能力上下文时使用调用方持有的原生代理；否则保持同一供应商、模型和推理强度走 CLI。原生 handoff 仍是待执行任务，并不代表已经完成。
+- **冻结的 exact-AA 向下委派。** 内置 AA v4.2 策略在每次供应商调用前检查当前 caller 与继承上限，生成精确子上下文，并在重试时重新验证。78 个评分配置是策略输入，不表示 78 个配置都可运行。
+- **明确的原生复用边界。** 复用现有 Codex 代理要求调用方已确认空闲、允许保留上下文且运行身份完全匹配；容量不足不会把新代理请求静默改成复用。完成记录也不是上游模型身份认证或冷启动容量保证。
+- **Codex 完成续验。** `scripts/completion-wakeup.py` 绑定控制线程与任务白名单，记录排程注册，并区分送达和验收。这是定时 heartbeat 轮询，而不是即时推送。
+- **封装与升级。** npm 包现在包含 AA 策略、原生／AA／wakeup 辅助脚本以及公开协议文档。npm 发布后可运行 `npm i -g omnilane@0.42.0`；GitHub release 本身不代表 npm 已上架。
+
+## v0.41.1 新功能
+
+- **Astra 默认 xhigh。** `hardest-coding` 与 `hard-judgment` 的 Astra 默认改用 `xhigh`；需要时可明确指定 `--vendor codex --effort max`。供应商顺序与其他模型的推理强度保持不变；这不代表已实测节省 CLI 订阅额度。
+
+- **Python 3.9 兼容性。** Agy 工作目录策略的建立与清理改用 `Path.lstat()`，保留符号链接、inode 和并发替换保护。
+- **隔离 CI 测试数据。** 严格 doctor 验收补齐明确启用插件与目录来源设置；设置缺失、停用或路径不匹配时仍会失败。
+- **可移植的离线 CI 测试数据。** 测试移除对操作者 HOME 的依赖，采用跨平台权限模式检查，并按实际平台验证 Linux／macOS 的实时任务限制。
+- **Bash 3.2 的 Gemini 任务。** 保护空任务参数展开，同时保留 `set -u`、非空续接参数以及现有模式与权限策略。
+- **有时间上限的 Codex 实时关闭。** FIFO 背压与部分写入会保留字节顺序及未发送尾段，供限时关闭排空处理；若执行器提前退出，已接受但尚未转发的排队输入仍会保留并报告失败，不会静默丢弃。其他供应商沿用原有转发路径。
+- **npm 上架后升级。** 运行 `npm i -g omnilane@0.41.1`，或更新 checkout 后再次运行 `./install.sh`。npm 单独发布，GitHub 发布不代表 npm 已上架。
+
+## v0.40.0 新功能
+
+- **区分模式并修复 Grok 网页工具。** advise 只读并保留支持的原生搜索；work 限于明确的 `--workdir` 且关闭代理工具网络；sysops 每次显式启用完整权限。Grok 完整单次 `plain` advise 已取得真实搜索、抓页和写入拒绝证据；macOS work 与受限实时模式仍保留前置检查。
+- **Codex 与 Grok 显式实时会话。** Codex work 与 Grok sysops 作业可用 `--background --live` 继续发送消息并显式关闭；Codex／Grok 自动派发仍保持单次执行，Claude／Gemini 保留原有自动实时行为。Grok advise 因 ACP 没有可强制执行的只读边界而拒绝 `--live`。
+- **有界且可观测的关闭流程。** 能识别 EOF 的能力探测、每项作业的不可变 worker 快照、解释器／SHA 来源、关闭期限与进程组清理，可限制卡住或被终止的实时作业，但不宣称操作系统沙箱隔离。
+- **AA 驱动的模型覆盖。** 12 条通道默认值已纳入 Fable 5.1、GPT-6 Astra 与 Gemini 3.8 Flash，同时保留现有供应商和显式模型覆盖。日期化 AA v4.2 覆盖快照记录 643 个榜单配置；模型出现在目录中不代表运行环境已验证支持。
+- **升级。** 运行 `npm i -g omnilane@0.40.0`，或更新 checkout 后再次运行 `./install.sh`。
+
 ## v0.33.0 新功能
 
 - **四厂商线程派发。** `--thread NAME` 可让固定厂商、模型、effort 与工作
@@ -579,6 +608,8 @@ vendor 一律当成 `work`,而且它只能逐次明确指定,永远不是 lane
 
 ## v0.12.0 新功能
 
+以下保留当时版本的历史说明。当前三种模式的契约以[模式](#-模式)为准，包括 0.40.0 独立的完整权限 sysops 策略。
+
 - **`hardest-coding` 的 Sol 从 `max` 降到 `xhigh`**——在 AA 分档位的 Coding Index
   上,Sol 的 xhigh 不但胜过自己的 max,也胜过所有 Claude 档位,成本还少约三分之一。
   这类工作超过 xhigh 之后,多加的 effort 买到的是过度思考,不是正确率。