omnilane 0.34.0 → 0.42.1

package/docs/native-executor.md

@@ -0,0 +1,264 @@
+# Native executor protocol (v1)
+
+`native` means a **caller-owned agent tool**, not a shell executable. Omnilane
+resolves a lane, checks explicitly supplied capabilities, and emits a pending
+handoff. The host executes the declared new/reuse strategy and ingests its actual result separately.
+Creating a handoff is not task success. Native delegation still counts as
+delegation when commander and worker use the same exact model.
+
+## Selection and terminal compatibility
+
+```sh
+# Standalone terminal: no native capability context, legacy CLI selection.
+omnilane route --dry-run hardest-coding "Review the change"
+omnilane route --executor cli --dry-run hardest-coding "Review the change"
+
+# Host-generated capability file: native when ALL requirements match.
+omnilane route --executor auto --native-context /absolute/capability.json \
+  --workdir /absolute/repo --dry-run hardest-coding "Review the change"
+
+# Fail closed instead of falling back. JSON on stdout; no provider is called.
+omnilane route --executor native --native-context /absolute/capability.json \
+  --workdir /absolute/repo hardest-coding "Review the change"
+```
+
+Native-aware selection fixes the first configured lane candidate (or the
+explicit `--vendor` row) **before** checking native or CLI availability.
+`--model` and `--effort` override that row without renaming either value. No
+model aliases/family inference or vendor substitution are performed. A native
+rejection in `auto` may use only that same resolved target's CLI; if it is
+missing, exit 4 rather than walk another vendor's fallback chain. Without a
+context, `auto` and forced `cli` preserve the historical available-CLI chain.
+`--executor cli` ignores the native context. CLI plans and metadata include
+`executor=cli` and a reason; native plans are JSON.
+
+`--executor native` returns exit 2 for missing/incompatible capability context.
+Malformed contexts are errors even in `auto`, not invitations to call a CLI.
+Native protocol support requires Python 3.9+ on the local host; the unchanged
+terminal path does not acquire that dependency. `--list` / `--explain` retain
+their legacy CLI-availability meaning and do not advertise native readiness.
+
+## Capability context
+
+The caller constructs this object from the **currently exposed tool contract**
+and its known runtime, not credentials, installed binaries, environment sniffing,
+or model family guesses. These example model/harness values are slots, not a
+catalog. Paths must be existing absolute directories (canonicalized for exact
+comparison; a parent directory does not grant child workdirs).
+
+```json
+{
+  "schema_version": 1,
+  "harness": "HARNESS_FROM_RUNTIME",
+  "vendor": "codex",
+  "current_model": "MODEL_FROM_RUNTIME",
+  "requirements": {
+    "tools": [],
+    "isolation": "shared-inherited",
+    "lifecycle": "single-shot"
+  },
+  "capabilities": [{
+    "model": "EXACT_SUPPORTED_MODEL",
+    "efforts": ["EXACT_SUPPORTED_EFFORT"],
+    "modes": ["advise"],
+    "workdirs": ["/absolute/repo"],
+    "tools": [],
+    "isolations": ["shared-inherited"],
+    "lifecycles": ["single-shot"]
+  }]
+}
+```
+
+Every field shown except `current_model` is required. Capability rows describe
+joint constraints; permission from separate rows is never combined. All arrays
+except `tools` must be nonempty. `current_model` is only needed when the routed
+model is absent or `-`; when the route explicitly selects an exact supported
+model, the caller may omit an unknown current model. The effort string is
+matched exactly; an absent effort or `-` is unknown, so native rejects it until
+the caller supplies a known explicit `--effort`. Model names are never
+hardcoded in the engine.
+
+Codex `collaboration.spawn_agent` exposes no sandbox, tool allowlist, or
+workdir restriction parameter and inherits the parent's tool/filesystem access.
+Its honest native capability uses `shared-inherited` in both the request and the
+same matching capability row. `tools: []` means no tool restriction is
+requested or advertised. `advise` and `work` remain task intent; the matched
+workdir is task context, not an OS boundary. Requests for hard `read-only`,
+`workspace-write`, or any other unsupported isolation never become shared
+native jobs: `auto` stays on the same resolved model through CLI, while forced
+native fails closed.
+
+Native supports only a caller-supervised single task. `--background`, explicit
+`--live` / `--single-shot`, `--thread`, `sysops`, explicit/environment whole-job
+or idle watchdogs, vote/multi-round and `exec` arbitration paths stay CLI or
+reject forced native. The handoff's `timeout` is a caller-enforced deadline,
+not a shell watchdog. Native has no durable worker, FIFO, implicit follow-up,
+CLI lock, scheduling, or inherited named session. Supplying a context does not
+change `routing.yaml`, `routing.local.yaml`, or host configuration.
+
+## Handoff, completion and cancellation
+
+Native route stdout is one JSON object: `schema_version`, `executor`,
+`executor_reason`, `vendor`, `model`, `effort`, `harness`, `lane`, `task`,
+`mode`, `workdir`, `requirements`, `timeout`, `worker_contract`, `job_id`,
+`task_id`, `agent_id`, `state`, `provider_invoked`, `job_state_created`.
+Normal routing returns `state=pending`, equal task/job IDs and null agent ID.
+Dry run returns `state=planned`, null IDs and creates neither job store nor job.
+Dry run does not read task stdin. It never spawns or calls a provider.
+
+`worker_contract` records `no_nested_dispatch`, the matched
+`shared-inherited` isolation, that mode is task intent, and that the caller owns
+deadline enforcement. It does not claim tool or filesystem restriction.
+
+The host invokes its real agent tool with the resolved model and effort, then
+passes the workdir, mode, task, and deadline as task intent rather than claimed
+tool or filesystem enforcement. With an explicit model override, Codex must use
+`fork_turns: "none"` (or a bounded positive history count), never
+`fork_turns: "all"`:
+
+```javascript
+collaboration.spawn_agent({
+  task_name: "native_shared_smoke",
+  fork_turns: "none",
+  model: handoff.model,
+  reasoning_effort: handoff.effort,
+  message: "Shared/inherited access. Do not delegate. Intended workdir: " +
+           handoff.workdir + ". Deadline: " + handoff.timeout +
+           " seconds. Task: " + handoff.task
+})
+```
+
+The call does not establish a filesystem boundary. The parent keeps the actual
+agent ID, waits for the real outcome, independently verifies the public result,
+and only then writes **public, sanitized** completion input:
+
+```json
+{
+  "schema_version": 1,
+  "job_id": "JOB_ID_FROM_HANDOFF",
+  "agent_id": "ACTUAL_AGENT_ID",
+  "runtime": {
+    "vendor": "codex",
+    "model": "ACTUAL_EXACT_MODEL",
+    "effort": "ACTUAL_EFFORT",
+    "harness": "ACTUAL_HARNESS",
+    "backend": "ACTUAL_AGENT_TOOL_BACKEND"
+  },
+  "outcome": "success",
+  "result": "Public result summary, not raw logs",
+  "evidence": ["Public command/result or artifact reference"]
+}
+```
+
+```sh
+omnilane jobs --json status JOB_ID
+omnilane jobs --json complete-native JOB_ID /absolute/completion.json
+omnilane jobs --json result JOB_ID
+omnilane jobs --json list --status pending
+omnilane jobs --json cancel JOB_ID
+```
+
+The reusable `jobs complete-native` interface checks the actual runtime's
+vendor/model/effort/harness against the resolved request, requires agent ID,
+backend, outcome (`success` or `failure`), result and nonempty evidence, and
+rejects malformed/extra fields, symlinks, oversized inputs and duplicate JSON
+keys. Missing/invalid/duplicate completions leave state unchanged. Completion
+and cancellation share a per-job lock and an atomic state replacement.
+
+`pending -> completed` exposes `state=done`, `native_state=completed`, exit 0
+for success or 1 for failure. Ingestion itself returns 0 for a valid failure
+record; `jobs result` returns the recorded exit code. `pending -> cancelled`
+records exit 143 and permanently rejects later completion. Neither transition
+signals a PID. If an agent was already spawned, **the caller must cancel it
+using that agent tool separately**; cancelling the record cannot stop it.
+
+Data lives under `$OMNILANE_HOME/jobs/ID/`: `task.txt`, `meta.json`,
+`native.json` and `native.lock`. Creation writes all four 0600 files inside a
+0700 hidden same-filesystem staging directory, then atomically renames it to the
+final ID under a private publication lock. Listing only accepts final ID names,
+so it never observes construction or an interrupted hidden stage. Normal
+failures clean only the creator's own stage; collisions leave the existing
+final directory untouched. The context itself and raw provider logs are not
+stored. Completion is a
+caller attestation, not independent backend authentication or proof that the
+model honored the task; the parent still verifies evidence. Do not submit
+tokens, cookies, credential/session/cache values or raw logs in any public field.
+
+Only `list`, `status`, `result`, `cancel`, `complete-native` integrate native
+jobs. Native `send`, `watch`, `close`, `wait`, `retry`, `tail`, and `rm` reject;
+inspect status while the host owns execution. Native records do not have CLI
+exit markers and are not included in completed-CLI stats/recommend/prune.
+Do not use CLI-only UI/audit/goal-loop summaries as native acceptance evidence.
+
+## Explicit existing-agent reuse（明示重用）
+
+協定版本：2026-09-07。
+Default `agent_strategy` is `new`; exhausted creation capacity never silently becomes reuse.
+Explicit `reuse` keeps the existing context and uses caller-owned `collaboration.followup_task`,
+not `collaboration.spawn_agent`. This remains one supervised task, not an automatic loop.
+
+Reuse extends the v1 capability object (values must be caller-observed, not inferred):
+
+```json
+{
+  "schema_version": 1,
+  "harness": "codex",
+  "vendor": "codex",
+  "current_model": "gpt-6-astra",
+  "current_effort": "medium",
+  "agent_strategy": "reuse",
+  "preserve_existing_context": true,
+  "new_agent_capacity": "exhausted",
+  "existing_agent": {
+    "agent_id": "/root/EXISTING_AGENT",
+    "vendor": "codex",
+    "model": "gpt-6-astra",
+    "effort": "medium",
+    "harness": "codex",
+    "state": "idle",
+    "observed_by": "caller",
+    "evidence": ["Caller-observed creation configuration and current idle state"]
+  },
+  "requirements": {"tools": [], "isolation": "shared-inherited", "lifecycle": "single-shot"},
+  "capabilities": [{
+    "model": "gpt-6-astra", "efforts": ["medium"], "modes": ["advise"],
+    "workdirs": ["/absolute/repo"], "tools": [],
+    "isolations": ["shared-inherited"], "lifecycles": ["single-shot"],
+    "agent_strategy": "reuse", "existing_agent_id": "/root/EXISTING_AGENT"
+  }]
+}
+```
+
+Reuse requires routed vendor/model/effort/harness and existing runtime to match exactly.
+`current_model` and `current_effort` must match too; capability rows/agent IDs are never combined.
+The idle declaration is caller evidence, not provider authentication or a reservation. Recheck idle
+immediately before followup; the tool may still fail. Model self-description is not creation evidence.
+Retained context may contain old instructions, so supply the new task boundary and existing AA child contract.
+
+Missing evidence is malformed context. Busy/unknown state, missing preservation, identity/strategy mismatch,
+hard isolation or unsupported lifecycle yield no reuse handoff. Forced native rejects; auto may choose
+only the original exact target's CLI for a well-formed but incompatible context.
+`new_agent_capacity` accepts available/exhausted/unknown; exhausted rejects new native selection.
+Unknown retains the old pending-handoff behavior, never asserts that an agent successfully started.
+
+Plans/status/results preserve `agent_strategy`, `existing_agent_id`, `preserve_existing_context`.
+Pending reuse `agent_id` identifies the existing target, not proof followup ran.
+`worker_contract.backend` is `collaboration.followup_task`; `reuse_observation` records the caller's evidence.
+
+```javascript
+collaboration.followup_task({
+  target: handoff.existing_agent_id,
+  message: "Keep existing context. Shared/inherited access; do not delegate. " +
+           "Apply the handoff's AA child context and task boundary. " + handoff.task
+})
+```
+
+After real response and independent verification, ingest the normal completion object with
+`agent_strategy: "reuse"`, exact existing `agent_id`, and runtime backend `collaboration.followup_task`.
+Different strategy/ID/backend is rejected without completing the job; duplicate completion is rejected.
+New completions may omit strategy or supply `new`, but must not claim the followup backend.
+Both strategies retain AA preflight, approved original registry bytes, child context, atomic publication,
+and per-job completion/cancellation locking. Reuse adds no automatic creation, permission upgrade or service.
+
+Offline coverage: `TMPDIR="$PWD/.native-test-artifacts/tmp" python3
+tests/test_native_executor.py`. Those fixtures are not a live native smoke.

package/docs/release-notes-0.42.1.md

@@ -0,0 +1,32 @@
+# Omnilane 0.42.1
+
+Omnilane 0.42.1 is a test-fixture and packaging patch for the already-published 0.42.0 exact-AA release. It does not rewrite the `v0.42.0` tag or weaken production routing policy.
+
+## Fixes
+
+- Legacy routing and Grok-readiness tests now explicitly declare a synthetic-human caller. The fixtures no longer depend on ambient caller metadata, while real model calls without exact identity continue to fail closed.
+- The cross-vendor encoded-effort lineage spy uses portable `#!/usr/bin/env python3` and explicit `--background --single-shot` followed by bounded job completion waiting. This isolates the one-shot provider fixture from Gemini's default live/FIFO lifecycle while retaining the exact `--model gemini-3.8-flash-high` selector, model caller/child ceiling, and no-human-exemption assertions.
+- The npm package points at these 0.42.1 notes and retains all five README translations, the AA policy, and the native/completion-wakeup protocol documents.
+
+## Policy boundary
+
+The approved exact-AA registry SHA pin, missing-identity denial, downward score ceiling, child caller context, retry-lineage intersection, and model-retry human-exemption rules are unchanged. Registry accounting remains:
+
+- 78 scored eligible configurations;
+- 1 scored reference-only comparison entry;
+- 10 unknown configurations.
+
+## Upgrade
+
+After npm publication:
+
+```sh
+npm i -g omnilane@0.42.1
+omnilane --version
+```
+
+For an existing repo-symlink installation, update the checkout and run `omnilane --version`. Do not rerun `./install.sh` unless intentionally reviewing and changing integration wiring. A GitHub release does not by itself prove npm publication.
+
+## Verification target
+
+The patch release gate is the complete CI Python discovery command, the full shell suite, package/release policy checks, and a smoke test of the CLI extracted from the built npm tarball. Local preparation records are not packaged release evidence. Published-platform verification must come from the release's GitHub Actions run; local checks alone do not establish a Linux CI pass.

package/hooks/routing-instruction.md

@@ -1,42 +1,103 @@
 <!-- omnilane-routing:start -->
-## omnilane — model routing (persistent reminder)
-
-Every task — not only implementation — is dispatched by default, even when
-the lane's first available model is the one you are running as: code edits,
-search, investigation, file reads, verification, tests, builds, deploys.
-Consult the routing table with `omnilane list` (or `scripts/dispatch.sh --list`
-inside the omnilane repo), classify the subtask into a lane, then dispatch it
-headlessly:
-
-    omnilane route [--vendor V] [--mode work] [--workdir DIR] <lane> "<task>"
-
-Advise mode is the default; pass `--mode work` only with an explicit
-`--workdir`. The commander self-executes only the reserved list: planning and
-decomposition, writing task briefs, reading worker output (`out.txt`,
-`events.jsonl`, inbox records), acceptance judgment, replies to the operator,
-git commit/push, and governance-file edits. The commander never runs commands
-itself: re-verify a worker's claim by reading its attached evidence or by
-dispatching a second worker with a different `--vendor`. Read-only work goes
-out in advise mode through named lanes — `triage` for high-volume scans,
-`long-context` for large documents, `live-search` for web or X,
-`hard-judgment` for second opinions. Invalid reasons to skip dispatch: "this
-lane is mine", "I am not dispatching so the rule does not apply", "it is only
-a file read", "dispatch is slower", "it is one line".
-
-Implementation dispatches carry `--mode work --workdir DIR --timeout 3600` or
-more; the advise default is read-only under a 600 s watchdog and yields no
-output there. Add `--background` for long tasks: on Claude Code the completion
-inbox delivers the result into your next prompt, elsewhere use `jobs.sh wait
-<id>`. Follow up a live Claude or Gemini worker with `jobs.sh send <id> "<text>"`
-/ `jobs.sh close <id>`. Wrap multi-dispatch exploratory objectives in
-`omnilane goal open`; dispatch a single obvious task directly.
-
-If the user explicitly names Claude, Codex, Grok, Gemini, or a canonical model
-alias, use the omnilane skill's consult rules and keep `--vendor` in the
-dispatch; an explicit target must not silently fall back.
-
-Lane definitions, modes, per-model rows, and safety rules live in the
-`omnilane` skill — load it and apply the row for the model you are running
-as; legacy model-routing skill variants are retired. Workers must never
-dispatch again (nested dispatch is refused, exit 86).
+<!-- source: codex-s / MacStudio; repo omnilane; approved AA v4.2 snapshot 2026-09-07 -->
+## omnilane — model routing and executor selection
+
+Delegate tasks by default, including when the resolved model is the commander's
+exact model. Native agents count as delegation; a model match is not permission
+to self-execute. Consult `omnilane list` and classify the lane, then resolve
+vendor/model/effort separately from executor choice:
+
+    omnilane route [--executor auto|native|cli] [--native-context FILE] [--vendor V] [--mode work] [--workdir DIR] <lane> "<task>"
+
+Terminal `auto` without capability context preserves legacy CLI. Build native
+capabilities only from the active agent-tool contract. Codex
+`collaboration.spawn_agent` has no sandbox/tool/workdir restriction parameters
+and inherits the parent's tools/filesystem. Its request and matching capability
+row must explicitly use `shared-inherited` with empty tool arrays;
+`advise`/`work` and workdir remain task intent, not OS isolation. Hard isolation
+stays same-model CLI in auto and rejects forced native. Supply the active
+harness/vendor, exact supported model/effort, optional known current model,
+mode/workdir, isolation, and lifecycle. Same vendor is not the same model.
+Unknown capabilities do not match. Do not infer capability from credentials,
+installed binaries, or model families. Explicit vendor/model/effort must survive
+fallback unchanged.
+
+Native is a host-callable tool, not a shell executable. A native route emits a
+machine-readable PENDING handoff JSON with task/job ID and resolved requirements.
+The caller executes the declared native strategy, passes intent plus a
+no-nested-delegation instruction, waits for the actual result, and records it with:
+
+    omnilane jobs --json complete-native JOB_ID /absolute/completion.json
+    omnilane jobs --json status JOB_ID
+    omnilane jobs --json result JOB_ID
+
+Completion includes actual agent ID, runtime vendor/model/effort/harness/backend,
+outcome, public result and evidence. A handoff alone is not success. Duplicate or
+invalid completion is rejected. Native cancellation records cancellation without
+signaling PIDs; the caller must separately stop an already-spawned agent.
+
+When the caller supplies an explicit model override, use `fork_turns: "none"` or
+a bounded positive history count; never combine it with `fork_turns: "all"`.
+Unknown caller current model may be omitted only when an exact requested model is
+explicitly selected and declared in the matching capability row.
+
+Forced CLI preserves external execution; forced native rejects missing or
+incompatible capability. Auto emits an explicit CLI reason, never a different
+vendor/model on native fallback. Background/durable/live/named CLI sessions,
+sysops, unsupported isolation and vote/arbitration/multi-round paths remain CLI.
+
+The commander owns planning, decomposition, task briefs, routing/handoff/result
+orchestration, acceptance, operator replies, git commit/push and governance edits.
+Workers execute assigned tasks and never delegate again (shell depth guard:
+exit 86; native callers must enforce the same rule). Read-only work defaults to
+advise. Implementation uses explicit `--mode work --workdir DIR --timeout 3600`
+or longer; native timeouts are caller-enforced. External long jobs can use
+`--background`, CLI `jobs wait`, live send/close and CLI goal-loop as before.
+
+If a vendor/model is explicitly named, retain `--vendor` and apply the
+omnilane skill's consultation rules. The repository skill and
+`docs/native-executor.md` define schemas, examples and limits. Only the parent
+backs up and syncs the host's managed AGENTS block after review.
+Exact-AA downward policy applies before every native/CLI candidate, fallback, retry,
+and vote constituent. Supply an exact model `--caller-context FILE`; unknown identity
+fails closed, and target score must be <= min(caller score, inherited ceiling).
+Explicit targets do not override the gate. Use `--transport-overlay FILE` only for
+host-local hashed request-selector evidence, never as a score or identity upgrade.
+Pass the job-owned child caller context to native workers; CLI propagates it itself.
+Retries intersect the current caller with the original authorizer ceiling, retain
+the target config, and revalidate integrity. Missing current caller fails closed;
+a model retry does not inherit a previous human exemption.
+Human exemption is an explicit cooperative operator assertion, never inferred for a
+model. Preserve OMNILANE_DEPTH. Failed work returns to the operator rather than an
+unapproved upward route. Observe terminal result and acceptance before ending a
+controller task; a background job/PENDING handoff is not success, and wakeup delivery
+requires its own evidence.
+
+For Codex background CLI jobs, actively bind completion to this controller before
+ending the turn: use the repository's `scripts/completion-wakeup.py prepare` with
+the actual app thread ID, local host ID, a unique run ID and exact job allowlist.
+Use its handoff with the app `automation_update` heartbeat tool; update an existing
+controller monitor instead of duplicating it. Record the successful tool receipt
+with `record-registration`. Never write scheduler files directly or label an
+unregistered handoff as active. Current caller metadata must come from this
+controller's verified runtime, not another task's context or a default model.
+
+On the scheduled callback, `poll`; stay quiet when nothing changed. For a terminal
+event, record `ack-delivered`, inspect the public result and required verification,
+then `ack-accepted` with PASS/FAIL/PARTIAL evidence. Exit zero is not acceptance.
+After all tracked events are handled, pause the actual automation with the app
+tool and record `closed` using its receipt. New runs get fresh, never-reused IDs.
+See `docs/completion-wakeup.md` for binding, leases, replay and expiry rules.
+Heartbeat is scheduled polling, not instant push. A next-prompt inbox is not wakeup.
+Without a supported callback tool, keep the controller active using `jobs wait`
+and continue acceptance on return; do not end with an unobserved background job.
+Native completion uses the host's agent callback and the same actual-result gate.
+
+Native reuse is explicit, never a silent substitute for new-agent creation. It
+requires a proven exact existing agent, caller-observed idle state and preserved
+context consent in the capability. Recheck idle before `collaboration.followup_task`;
+the completion must match strategy, agent and backend. Unknown identity or busy
+agents do not qualify. See `docs/native-executor.md`; a thread quota failure is
+not a successful run, and a cancelled pending job stays cancelled.
+
 <!-- omnilane-routing:end -->

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "omnilane",
-  "version": "0.34.0",
-  "description": "One routing table, every harness — classify subtasks into lanes and dispatch each lane to the best vendor's agentic CLI (Codex, Claude, Gemini, Grok) using your existing subscription logins.",
+  "version": "0.42.1",
+  "description": "One routing table, every harness — classify subtasks into lanes and delegate each lane through a compatible caller-owned native agent or vendor CLI.",
   "bin": {
     "omnilane": "bin/omnilane"
   },
@@ -24,6 +24,12 @@
     "README.ja.md",
     "README.ko.md",
     "SECURITY.md",
+    "config/aa-model-policy.json",
+    "docs/aa-model-coverage-2026-09-05.json",
+    "docs/model-capabilities-2026-09.md",
+    "docs/native-executor.md",
+    "docs/completion-wakeup.md",
+    "docs/release-notes-0.42.1.md",
     "hooks/",
     "skills/",
     ".claude-plugin/",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.34.0",
-  "description": "One routing table, every harness: classify subtasks into lanes and auto-dispatch each lane to the best vendor CLI (Codex, Claude Code, Grok Build, Antigravity) with background jobs, depth guard, and serialized codex dispatch."
+  "version": "0.42.1",
+  "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/routing.local.yaml.example

@@ -8,7 +8,7 @@
 # consult is a multi-vendor direct-target chain. configure.sh intentionally
 # skips it because that menu writes one candidate per lane. If overriding it,
 # retain every vendor you want to address by name:
-# consult: codex gpt-5.6-sol max | claude claude-fable-5-1 high | grok grok-4.6 - | gemini "Gemini 3.7 Flash (High)" -
+# consult: codex gpt-6-astra xhigh | claude claude-fable-5-1 xhigh | grok grok-4.6 - | gemini gemini-3.8-flash-medium -
 
 # ── Starter profiles ─────────────────────────────────────────────
 # Uncomment ONE block that matches what you actually subscribe to.
@@ -28,8 +28,13 @@
 
 # Profile: Claude Code (Fable 5.1) as the main loop — let Fable keep judgment/taste,
 # push only coding volume out to Codex.
-# hard-judgment:   claude claude-fable-5-1 high
-# taste-final:     claude claude-fable-5-1 high
+# hard-judgment: claude claude-fable-5-1 xhigh
+# taste-final: claude claude-fable-5-1 xhigh
+
+# Profile: Opus 5 balanced controller / independent review (opt-in).
+# Keep cross-vendor fallbacks explicit; this does not create a controller lane.
+# hard-judgment: claude claude-opus-5 xhigh | codex gpt-6-astra max | grok grok-4.6 -
+# taste-final: claude claude-opus-5 high | codex gpt-6-astra xhigh | grok grok-4.6 - | gemini gemini-3.8-flash-high -
 
 # Profile: Codex-heavy (Sol main) — keep the hard lanes on Codex, Claude for taste.
 # taste-final:     claude claude-opus-5 high

package/routing.yaml

@@ -12,7 +12,7 @@
 # deliberately carry no numbers: they state WHY a lane is ordered the way it is, which
 # stays true for months, while the numbers move every few weeks. Change an ordering and
 # you update the doc; a figure going stale should never need a routing-table edit.
-# (Audited 2026-07-12; re-audited 2026-07-25, 2026-08-02, 2026-08-03, and 2026-09-02.)
+# (Audited 2026-07-12; re-audited 2026-07-25, 2026-08-02, 2026-08-03, 2026-09-02, and 2026-09-05.)
 # defaults follow Artificial Analysis data, 2026-09
 # snapshot. Verified against AA site records + vendor pricing pages: Intelligence &
 # Coding indexes and 7:2:1 blended prices all match (AA field price1mBlended7To2To1);
@@ -20,17 +20,17 @@
 # standard short-context API tier — on subscription CLIs treat $ as relative ranking.
 # Your own job outcomes (~/.omnilane/jobs/) outrank these priors; edit lanes to match.
 
-hardest-coding: claude claude-fable-5-1 xhigh | codex gpt-5.6-sol xhigh | grok grok-4.6 - | gemini "Gemini 3.7 Flash (High)" - # ordered on coding capability: the leading Claude tier wins both coding components; Sol remains the established Codex-harness value fallback; Grok and Flash High keep the lane alive when neither subscription is reachable
-bulk-mechanical: codex gpt-5.6-sol high | gemini "Gemini 3.7 Flash (High)" - | claude claude-sonnet-5 high # ordered on endurance per dollar: Sol dominates Terra within Codex; current Flash is the faster, cheaper middle fallback; Sonnet preserves subscription quota
-triage: codex gpt-5.6-luna high | gemini "Gemini 3.7 Flash (Low)" - | claude claude-haiku-4-5 - # ordered on cost per task at usable intelligence: Luna high buys a meaningful quality lift cheaply; Flash and Haiku are low-cost cross-vendor fallbacks
-hard-judgment: claude claude-opus-5 xhigh | codex gpt-5.6-sol max | grok grok-4.6 - # ordered on agentic knowledge work per cost: Opus nearly matches Fable's agentic score at meaningfully lower cost and a lower hallucination rate; Sol stays ahead of Grok because Grok effort is ignored and its reproduced row is unknown
-taste-final: claude claude-fable-5-1 high | codex gpt-5.6-sol max | grok grok-4.6 - | gemini "Gemini 3.7 Flash (High)" - # ordered on prose and polish: Fable leads Opus on intelligence and factual breadth; Sol is the cross-vendor fallback; Grok matches Sol on intelligence with a far better factual score and lower hallucination rate; Flash High closes out the lane
-consult: codex gpt-5.6-sol max | claude claude-fable-5-1 high | grok grok-4.6 - | gemini "Gemini 3.7 Flash (High)" - # direct named-model chain uses the strongest current Claude and Flash slots; keep --vendor to prevent fallback
-ui-draft: codex gpt-5.6-sol xhigh | claude claude-fable-5-1 high | gemini "Gemini 3.7 Flash (High)" - # ordered for drafts with a design system or reference images: Sol leads measured multimodal and coding evidence; Fable follows for polish; Flash High holds the highest measured multimodal score among the cheapest three and keeps the lane alive
-long-context: gemini "Gemini 3.7 Flash (Medium)" - | codex gpt-5.6-terra max | claude claude-opus-5 medium # ordered on long-context reasoning, then cost and throughput: Flash leads; Terra matches its long-context result; Opus is the cheaper Claude fallback
-fast-agentic: gemini "Gemini 3.7 Flash (Medium)" - | codex gpt-5.6-luna high | claude claude-haiku-4-5 - # ordered on interactive tool-loop latency: Flash gives up little agentic quality for far faster first output; Luna high is the low-latency Codex fallback; Haiku adds a low-latency Claude fallback
-live-search: grok grok-4.6 - | gemini "Gemini 3.7 Flash (High)" - | claude claude-sonnet-5 high | off # native X and web search lane; Grok is the only candidate with real live search — Flash and Sonnet fall back to their own web-search tools so a missing Grok CLI does not strand the lane entirely
-coding-overflow: grok grok-4.6 - | gemini "Gemini 3.7 Flash (High)" - | kimi kimi-k3 - | qwen qwen3-coder-plus - | opencode - - | off # coding relief ordered by capability and value: Grok has the lowest frontier hallucination rate; Flash is the cheapest strong coder here; revisit the best-value Qwen tier when its CLI alias can be verified
+hardest-coding: claude claude-fable-5-1 max | codex gpt-6-astra xhigh | grok grok-4.6 - | gemini gemini-3.8-flash-high - # correctness-first coding: Fable max leads the same-condition comparison; Astra xhigh is the default Codex quality/cost tradeoff; explicit --effort max remains available; Grok and Flash keep cross-vendor depth
+bulk-mechanical: codex gpt-5.6-sol high | gemini gemini-3.8-flash-high - | claude claude-sonnet-5 high # endurance and migration work stays on proven Sol high; Flash 3.8 refreshes the fast middle fallback; Sonnet preserves cross-vendor depth
+triage: codex gpt-5.6-luna high | gemini gemini-3.8-flash-low - | claude claude-haiku-4-5 - # first-pass filtering favors the low-cost Luna row; Flash low and Haiku remain cheap cross-vendor fallbacks
+hard-judgment: claude claude-fable-5-1 xhigh | codex gpt-6-astra xhigh | grok grok-4.6 - # strongest same-condition judgment row first, then an independently verified Codex family and Grok; this lane is not a controller selector
+taste-final: claude claude-fable-5-1 xhigh | codex gpt-6-astra xhigh | grok grok-4.6 - | gemini gemini-3.8-flash-high - # final prose and style still require human taste review; general quality evidence orders the candidates without claiming an aesthetic benchmark
+consult: codex gpt-6-astra xhigh | claude claude-fable-5-1 xhigh | grok grok-4.6 - | gemini gemini-3.8-flash-medium - # direct named-model consultation chain; keep --vendor to pin the requested family and prevent fallback
+ui-draft: codex gpt-5.6-sol high | claude claude-fable-5-1 xhigh | gemini gemini-3.8-flash-high - # UI drafts require a design system or references; measured coding/agent evidence supports the order but does not prove visual taste
+long-context: gemini gemini-3.8-flash-medium - | codex gpt-5.6-terra max | claude claude-opus-5 medium # Flash medium leads long-document synthesis; Terra and Opus stay because context capacity alone does not prove task quality
+fast-agentic: gemini gemini-3.8-flash-low - | codex gpt-5.6-luna high | claude claude-haiku-4-5 - # low-latency tool loops favor Flash low; Luna and Haiku retain cross-vendor fallback depth
+live-search: grok grok-4.6 - | gemini gemini-3.8-flash-high - | claude claude-sonnet-5 high | off # Grok remains the native X/web choice; Flash and Sonnet provide generic web-search fallback, not equivalent social context
+coding-overflow: grok grok-4.6 - | gemini gemini-3.8-flash-high - | kimi kimi-k3 - | qwen qwen3-coder-plus - | opencode - - | off # explicit quota-relief lane; keep all existing non-Codex fallbacks and do not infer unverified Qwen aliases from another harness
 arbitrate: off - - # opinion panel remains opt-in because each voter and round consumes quota
                                                 # Enable: `arbitrate: vote codex,claude,grok -` (any 1-4 of codex/claude/grok/gemini)
                                                 # Debate round (each voter rebuts the others): set the effort field to 2.
@@ -38,7 +38,7 @@ arbitrate: off - - # opinion panel remains opt-in because each voter and round c
 # Claude Fable 5.1 is in the taste and hardest-coding defaults because it leads
 # Opus 5 on every Artificial Analysis axis at the same effort. It is not in
 # bulk or triage: it prices at twice Opus 5 per token and consumes the most
-# subscription quota per turn. Opus 5 now leads hard-judgment on a per-cost,
-# lower-hallucination basis and remains selectable everywhere via
-# ~/.omnilane/routing.local.yaml, for example, to bring Fable back:
-# hard-judgment: claude claude-fable-5-1 xhigh
+# subscription quota per turn. Fable leads hard-judgment; Opus remains
+# explicitly selectable via --vendor claude --model claude-opus-5.
+# Astra defaults to xhigh; use --vendor codex --effort max when explicitly needed.
+# No automatic risk escalation or failure-triggered effort upgrade is added.