omnilane 0.42.2 → 0.42.5

package/scripts/lib/probe.py

@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Request-selector probe harness for the omnilane AA transport overlay.
+
+Runs one CLI invocation, captures raw stdout/stderr to files, and writes a
+descriptor with the original command/stream fields plus a vendor-specific
+verdict, its reason, and the observed model when the response proves it.
+"""
+import argparse
+import json
+import os
+import subprocess
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
+DEFAULT_ROOT = Path.home() / ".omnilane" / "transport-evidence" / SWEEP_ID
+
+
+def verdict(
+    evidence_json: dict,
+    stdout_text: str,
+    stderr_text: str,
+    vendor: str,
+    expected_token: str | None,
+) -> tuple[str, str, str | None]:
+    """Judge raw evidence without reading files, running commands or mutating it.
+
+    Only Claude's billed modelUsage keys currently prove the responding model.
+    A requested selector (including the Codex banner) is not observed identity.
+    """
+    if evidence_json.get("timed_out"):
+        return "fail", "timeout", None
+    if not expected_token:
+        return "fail", "missing-expected-token", None
+
+    exit_code = evidence_json.get("exit_code")
+    if vendor == "claude":
+        try:
+            response = json.loads(stdout_text)
+        except (json.JSONDecodeError, TypeError):
+            return "fail", "invalid-json", None
+        if not isinstance(response, dict):
+            return "fail", "invalid-json-result", None
+        usage = response.get("modelUsage")
+        models = sorted(usage) if isinstance(usage, dict) else []
+        observed_model = ", ".join(models) or None
+        result = response.get("result", "")
+        if not isinstance(result, str):
+            result = str(result)
+        if response.get("is_error"):
+            lower_result = result.lower()
+            if "limit" in lower_result or "quota" in lower_result:
+                reason = "quota-exhausted"
+            elif "api error" in lower_result:
+                reason = "api-error"
+            else:
+                reason = "result-error"
+            return "fail", f"{reason}: {result[:120]}", observed_model
+        if not models:
+            return "fail", "missing-model-usage", None
+        command = evidence_json.get("command", [])
+        requested_model = None
+        for index, argument in enumerate(command):
+            if argument == "--model" and index + 1 < len(command):
+                requested_model = command[index + 1]
+            elif isinstance(argument, str) and argument.startswith("--model="):
+                requested_model = argument.split("=", 1)[1]
+        if not requested_model:
+            return "fail", "missing-requested-model", observed_model
+        if models != [requested_model]:
+            return "fail", "model-mismatch", observed_model
+        if "unknown --effort" in stderr_text.lower():
+            return "fail", "effort-silently-defaulted", observed_model
+        if exit_code != 0:
+            return "fail", f"exit-code: {exit_code}", observed_model
+        if expected_token not in result:
+            return "fail", "missing-expected-token", observed_model
+        return "pass", "expected-token-and-model-matched", observed_model
+
+    if vendor in ("grok", "agy"):
+        if exit_code != 0:
+            return "fail", f"exit-code: {exit_code}: {stderr_text[:120]}", None
+        if stderr_text:
+            return "fail", f"unexpected-stderr: {stderr_text[:120]}", None
+        if expected_token not in stdout_text:
+            return "fail", "missing-expected-token", None
+        return "pass", "expected-token-and-clean-stderr", None
+
+    if vendor == "codex":
+        diagnostics = [line[:120] for line in stderr_text.splitlines()
+                       if "error" in line.lower() or "warning" in line.lower()]
+        review = "; stderr-review: " + " | ".join(diagnostics) if diagnostics else ""
+        if exit_code != 0:
+            return "fail", f"exit-code: {exit_code}{review}", None
+        if expected_token not in stdout_text:
+            return "fail", f"missing-expected-token{review}", None
+        return "pass", f"expected-token-matched{review}", None
+
+    return "fail", f"unsupported-vendor: {vendor}", None
+
+
+def probe(
+    name: str,
+    argv: list[str],
+    timeout: int = 180,
+    cwd: Path | None = None,
+    root: Path | None = None,
+    *,
+    vendor: str | None = None,
+    expected_token: str | None = None,
+) -> dict:
+    if not expected_token:
+        raise ValueError("expected_token is required before running a probe")
+    if not argv:
+        raise ValueError("command is required")
+    vendor = vendor or Path(argv[0]).name
+    if vendor not in ("claude", "grok", "agy", "codex"):
+        raise ValueError(f"unsupported vendor: {vendor}; pass vendor explicitly")
+    root = (root or DEFAULT_ROOT).expanduser()
+    evidence = root / "evidence"
+    work = root / "work"
+    evidence.mkdir(parents=True, exist_ok=True)
+    work.mkdir(parents=True, exist_ok=True)
+    out_path = evidence / f"{name}.stdout"
+    err_path = evidence / f"{name}.stderr"
+    started = time.time()
+    timed_out = False
+    env = dict(os.environ)
+    # The runners drop the API key so the subscription OAuth path is used.
+    env.pop("XAI_API_KEY", None)
+    with open(out_path, "wb") as out, open(err_path, "wb") as err:
+        proc = subprocess.Popen(argv, stdout=out, stderr=err, stdin=subprocess.DEVNULL,
+                                cwd=str(cwd or work), env=env)
+        try:
+            rc = proc.wait(timeout=timeout)
+        except subprocess.TimeoutExpired:
+            timed_out = True
+            proc.kill()
+            rc = proc.wait()
+    record = {
+        "command": argv,
+        "cwd": str(cwd or work),
+        "exit_code": rc,
+        "timed_out": timed_out,
+        "elapsed_seconds": round(time.time() - started, 3),
+        "probed_at": datetime.fromtimestamp(started, timezone.utc).isoformat(),
+        "stdout": str(out_path),
+        "stderr": str(err_path),
+    }
+    record["verdict"], record["verdict_reason"], record["observed_model"] = verdict(
+        record, out_path.read_text(errors="replace"), err_path.read_text(errors="replace"),
+        vendor, expected_token,
+    )
+    (evidence / f"{name}.json").write_text(json.dumps(record, indent=2) + "\n")
+    return record
+
+
+def read(
+    name: str,
+    stream: str = "stdout",
+    limit: int = 4000,
+    root: Path | None = None,
+) -> str:
+    path = (root or DEFAULT_ROOT).expanduser() / "evidence" / f"{name}.{stream}"
+    if not path.exists():
+        return ""
+    return path.read_text(errors="replace")[:limit]
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=DEFAULT_ROOT)
+    parser.add_argument("--expect", required=True, help="expected response token")
+    parser.add_argument("--vendor", choices=("claude", "grok", "agy", "codex"),
+                        help="defaults to the command executable's basename")
+    parser.add_argument("name")
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args()
+    if not args.command:
+        parser.error("command is required")
+    rec = probe(args.name, args.command, root=args.root,
+                vendor=args.vendor, expected_token=args.expect)
+    print(json.dumps(rec, ensure_ascii=False))

package/skills/omnilane/SKILL.md

@@ -17,7 +17,12 @@ You (the main loop) may be Claude, GPT, Grok, or Gemini. The procedure is identi
    reading public results, acceptance, operator replies, git commit/push and
    governance edits. Workers execute the assigned task and never delegate again.
    Read-only work uses advise; edits require `--mode work --workdir <repo>`.
-   `<repo>/scripts/dispatch.sh [--executor auto|native|cli] [--native-context FILE] [--vendor V] [--mode work] [--workdir DIR] <lane> "<task>"`
+   `<repo>/scripts/dispatch.sh --caller-context FILE [--executor auto|native|cli] [--native-context FILE] [--vendor V] [--mode work] [--workdir DIR] <lane> "<task>"`
+
+   A model caller MUST pass `--caller-context`; without it every dispatch is
+   refused with `missing-caller-context` before a job exists. Build that file
+   before the first dispatch — see **Frozen exact-AA downward gate** for the
+   schema, a worked example, and what to do when your own effort is unverifiable.
 
    Add `--background` for long tasks; poll with `scripts/jobs.sh status|result <id>`.
    Use `--thread NAME` when later claude, codex, grok or gemini dispatches
@@ -332,6 +337,90 @@ that exact frozen score and the inherited ceiling. Targets at or below it are al
 unknown identities and unresolved request-selector mappings fail closed. No family,
 displayed grade, highest-effort assumption, retry or fallback grants an uplift.
 
+Build the file before the first dispatch, not after a refusal. Every field is an
+exact identity: `caller` must reproduce one `scored_configs` row byte-for-byte,
+and `snapshot_id` must equal the registry's own `snapshot.id`.
+
+```json
+{
+  "schema_version": 1,
+  "snapshot_id": "<registry snapshot.id>",
+  "kind": "model",
+  "caller": {"vendor": "claude", "model": "claude-opus-5", "effort": "high",
+             "reasoning": "adaptive", "fallback": null},
+  "inherited_ceiling": 52
+}
+```
+
+Set `inherited_ceiling` to your own row's score when you are the root caller, or
+to the ceiling you were handed when you are a child.
+
+**When your harness names a model but no effort, look before you guess.** The
+launching process usually carries the exact flags. Walk your own ancestor chain
+(`ps -o ppid=,comm= -p <pid>` upward, then `ps -o args= -p <ancestor>`) and read
+its `--model` / `--effort`. Match the ancestor chain rather than the first
+matching process on the host — a second session of the same CLI is common and
+its flags are not yours. This is request-selector evidence, the same class the
+transport overlay carries, and it does not certify upstream identity.
+
+Only when that genuinely yields nothing: ask the operator, or declare the
+lowest-scoring row of your model and say so in your report. Understating only
+narrows what you may dispatch to, so it fails in the safe direction — but it is
+the fallback, not the first move, and an unnecessarily low ceiling silently
+closes lanes and pushes the question back onto the operator. Never raise the
+declared effort to unblock a refused target, and never assert
+`--operator-asserted-human` on your own behalf.
+
+Three refusal codes mean different things and need different fixes.
+`missing-caller-context` means you passed no file — write one.
+`runtime-mapping-unverified` means the file is fine but the *target* has no proven
+host-local request selector; that is fixed by a `--transport-overlay` entry backed
+by real evidence, never by editing the frozen registry (its sha256 is pinned in
+`scripts/lib/aa_policy.py`, so any edit fails the whole gate closed).
+`invalid-policy-input` with "transport contract evidence changed" is neither: the
+overlay itself will not load, so nothing about your caller or your target is wrong.
+Run `omnilane doctor` first — its `transport-overlay` check names the offending
+file and the vendor it belongs to. Do not go hunting by hand.
+
+Upgrading a vendor CLI is the usual cause. The overlay pins the sha256 of each
+vendor's executable and runner script, so a new release invalidates that vendor's
+selector evidence. Evidence entries carry a `vendor` tag: a tagged entry that
+drifts marks only its own vendor stale, and the other three keep dispatching.
+Untagged evidence — `probe-manifest.json`, and any overlay built before the tags
+existed — still fails the whole gate closed, which is what an unpatched host
+looks like. Codex and Claude evidence paths embed version directories
+(`releases/0.153.4-…`, `versions/2.1.263`), so their upgrades remove the file
+rather than change its digest; both are treated as staleness, not corruption.
+
+Re-signing is a probe, a rebuild, and an install, in that order. Back up
+`~/.omnilane/transport-contracts.local.json` first; restoring it is the rollback.
+`scripts/lib/probe.py --expect TOKEN [--vendor V] NAME COMMAND…` invokes the CLI
+directly through `subprocess`, so it works while the gate is refusing everything —
+this is what breaks the deadlock. `scripts/provider-probe.sh` goes through
+`dispatch.sh` and therefore through the gate, so it is useless in this state.
+Then `scripts/lib/build_overlay.py` rebuilds, and you copy the result over the
+live overlay. Verify with a real dispatch on a lane belonging to the vendor you
+re-probed; loading the registry in Python is not the runtime surface.
+
+Keep the sweep where its default `--root` puts it,
+`~/.omnilane/transport-evidence/<sweep-id>/`. The rebuilt overlay anchors
+`probe-manifest.json` by absolute path as untagged evidence, so a sweep parked
+inside a repository is one `git clean -fdx` away from taking every vendor down
+at once — the same global refusal a re-signing session is usually trying to end.
+
+Never sign a probe you did not read. `probe.py` records a `verdict` because exit
+status alone is not evidence: the Claude CLI answers a quota refusal with a JSON
+body carrying `is_error`, and it accepts an unknown `--effort` by silently using
+the default, returning exit 0, the right `modelUsage`, and the expected token
+with only a stderr warning to show for it. Effort is half of a scored identity,
+so that path would certify a mapping at the wrong tier. Configurations whose
+probes failed are recorded in the overlay's `unproven[]` and surfaced by doctor
+instead of vanishing — six Fable rows sat unusable for two days in September
+2026 because a 429 quota refusal left no trace anywhere. A refused probe is not
+always transient: re-probing those six two days later returned the same 429, so
+an `unproven[]` entry can mean the account, not the moment. Read the reason
+before assuming a retry will clear it.
+
 A `--transport-overlay /absolute/overlay.json` may prove a small set of host-local
 request selectors using exact identities and hashed local contract evidence. It does
 not change frozen AA scores or certify upstream provider identity. The explicit

package/docs/release-notes-0.42.2.md

@@ -1,31 +0,0 @@
-# Omnilane 0.42.2
-
-This patch repairs the Grok single-shot reasoning-effort transport. It does not raise caller scores or remove the exact-AA downward-delegation gate.
-
-## Changes
-
-- Explicit Grok effort is forwarded as `--reasoning-effort VALUE`. The supported selector spellings are `low`, `medium`, `high`, and `xhigh`; invalid values fail before provider startup.
-- Grok 4.6 entries in the default routing table explicitly select `high`.
-- A scored Grok target requires a verified `cli_reasoning_effort` mapping and the exact `--reasoning-effort` flag. The existing host-local transport overlay validates host, snapshot, exact identity, evidence hashes, vendor, flag, and effort.
-- Explicit effort on the live ACP path is rejected rather than discarded. This release does not add Grok work-mode network isolation on macOS.
-
-## Verification boundary
-
-The frozen AA registry and its approved SHA remain unchanged. Transport evidence belongs to the local host; the package does not ship a blanket assertion that every Grok model/effort combination is verified.
-
-`request-selector-contract` proves how Omnilane selects the model and effort. It does not independently authenticate the upstream model's internal identity: `upstream_identity_verified` remains false. A successful reply alone is not an identity attestation.
-
-For an existing local overlay, use `selector_type: cli_reasoning_effort`, `cli_flag: --reasoning-effort`, and matching model/effort identity only after checking the installed CLI and runner. Retain absolute evidence paths and SHA-256 hashes. Changed evidence requires re-verification; do not merely relabel an old mapping as verified. Select it with `--transport-overlay /absolute/overlay.json` or `OMNILANE_AA_TRANSPORT_OVERLAY`.
-
-## Upgrade
-
-After npm publication:
-
-```sh
-npm i -g omnilane@0.42.2
-omnilane --version
-```
-
-Repo-symlink installations use the updated checkout. Do not rerun `install.sh` just to update the version. Local routing overrides take precedence; review any Grok entries still using `-`.
-
-GitHub release, npm publication, local provider smoke, and Linux CI are separate verification surfaces. Release evidence must identify each result rather than equating one with the others.