omnilane 0.42.4 → 0.42.5

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "One routing table, native-first or CLI delegation, supervised completion workflows.",
-    "version": "0.42.4"
+    "version": "0.42.5"
   },
   "plugins": [
     {
       "name": "omnilane",
       "source": "./",
       "description": "Route each subtask to the model that fits, then delegate through a compatible caller-owned native agent or vendor CLI.",
-      "version": "0.42.4",
+      "version": "0.42.5",
       "category": "development",
       "keywords": [
         "routing",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.4",
+  "version": "0.42.5",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs.",
   "author": {
     "name": "Seraphim0916"

package/CHANGELOG.md

@@ -6,6 +6,41 @@ semantic version tags.
 
 ## [Unreleased]
 
+## [0.42.5] - 2026-09-09
+
+### Fixed
+
+- One vendor's CLI upgrade refused every vendor's dispatch. Overlay evidence
+  compared in a single loop raised on the first mismatch, so an `agy`
+  1.1.27 -> 1.1.28 upgrade failed `load_registry` and returned
+  `invalid-policy-input` for codex, claude, and grok as well, although only the
+  seven gemini mappings depended on that binary. Evidence entries now take a
+  `vendor` tag; a tagged entry that drifts or disappears degrades only its own
+  vendor to `unknown-target-runtime`. Untagged evidence stays globally
+  fail-closed, and structural overlay checks stay hard failures.
+- `omnilane doctor` reported 19 passed, 0 failed while every dispatch was
+  refused. A new `transport-overlay` check loads the configured overlay, names
+  the offending file and vendor on failure, reports per-vendor verified counts,
+  and warns when a vendor has degraded.
+- `build_overlay.py` signed probes it never read. Six `claude-fable-5-1`
+  configurations had been unusable since 2026-09-07 because their probes hit a
+  quota refusal and were silently omitted. Probes now carry a per-vendor
+  `verdict`, non-passing probes are refused and recorded in the overlay's
+  `unproven[]`, and evidence predating the field is signed with a warning. The
+  six Fable configurations are listed in the probe table so their failures are
+  reported; a 2026-09-09 re-probe returned the same quota refusal, so they stay
+  unusable and `omnilane doctor` now says so.
+- A Claude CLI probe that requested an unknown `--effort` returned exit 0, no
+  error, the right `modelUsage`, and the expected token while silently using the
+  default effort. The verdict now fails that case, so a mapping cannot be
+  certified at the wrong effort tier.
+
+### Changed
+
+- `build_overlay.py` and `probe.py` moved from an untracked `.rollback` sweep
+  directory into `scripts/lib/` and take `--root`, so overlay rebuilds survive a
+  cleanup of that directory.
+
 ## [0.42.4] - 2026-09-07
 
 ### Fixed
@@ -886,7 +921,8 @@ work to the wrong model, and records the evidence behind the shipped defaults.
 - Initial shared routing table, cross-vendor dispatcher, runners, installer,
   and baseline lint fixes.
 
-[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.4...HEAD
+[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.5...HEAD
+[0.42.5]: https://github.com/Seraphim0916/omnilane/compare/v0.42.4...v0.42.5
 [0.42.4]: https://github.com/Seraphim0916/omnilane/compare/v0.42.3...v0.42.4
 [0.42.3]: https://github.com/Seraphim0916/omnilane/compare/v0.42.2...v0.42.3
 [0.42.2]: https://github.com/Seraphim0916/omnilane/compare/v0.42.1...v0.42.2

package/README.ja.md

@@ -521,6 +521,36 @@ work の別名ではありません。サービス管理など、work の境界
 
 </details>
 
+<details>
+<summary><b>ディスパッチが拒否されました。どの拒否ですか？</b></summary>
+
+<br/>
+
+3 つのコードには 3 つの異なる対処があります。まず `omnilane doctor` を実行して
+ください。その `transport-overlay` チェックが、問題はこのマシンの設定なのか
+リクエストなのかをすぐに示します。
+
+`missing-caller-context` — 呼び出し元の識別情報がありません。人間は
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` または `--operator-asserted-human` を
+使います。omnilane を動かすモデルは、正確なベンダー・モデル・effort を含む
+`--caller-context FILE` を渡し、人間向けの免除を自称してはいけません。
+
+`runtime-mapping-unverified` — 識別情報は正しく、**ターゲット**にホストローカルの
+リクエストセレクタの証明がありません。未プローブか、プローブが失敗しています。
+`omnilane doctor` がその件数を報告し、overlay の `unproven[]` に各失敗の理由が
+残ります。プロバイダーの利用上限による拒否は、その上限が解消するまで続きます。
+
+`invalid-policy-input` と "transport contract evidence changed" — 上記のいずれ
+でもありません。overlay 自体が読み込めないため、**すべてのベンダー**が拒否され
+ます。よくある原因はベンダー CLI の更新です。overlay は各ベンダーの実行ファイルと
+ランナースクリプトのハッシュを固定しており、Codex と Claude の証拠パスは
+バージョンディレクトリを含むため、更新ではダイジェストが変わるのではなく
+ファイルが消えます。タグ付きの証拠は自分のベンダーだけを降格させ、プローブ
+マニフェストのようなタグなしの証拠はゲート全体を閉じます。doctor がファイルと
+ベンダーを示し、再署名の手順はディスパッチスキルにあります。
+
+</details>
+
 ## 📊 デフォルト値と出典
 
 デフォルトのレーン割当は Artificial Analysis の 2026-07 スナップショット
@@ -543,6 +573,14 @@ work の別名ではありません。サービス管理など、work の境界
 
 ## 📜 リリース履歴
 
+## v0.42.5 の新機能
+
+- **1 つの CLI 更新が全ベンダーを止めることはなくなりました。** overlay の evidence に `vendor` タグを付与でき、タグ付きエントリのハッシュ差異やファイル消失は当該ベンダーのみを `unknown-target-runtime` に降格させます。タグなしの evidence は従来どおり全体を fail-closed にします。
+- **`omnilane doctor` が overlay を読み込みます。** 新しい `transport-overlay` チェックは失敗時に該当ファイルとベンダーを示し、成功時はベンダーごとの検証済みマッピング数を報告します。
+- **プローブが判定を記録します。** `probe.py` は課金された `modelUsage` で Claude の応答を判定し、CLI が不明な `--effort` を既定値へ黙って置き換えた場合を失敗とします。`build_overlay.py` は不合格のプローブに署名せず、overlay の `unproven[]` に記録します。
+- **再構築ツールをバージョン管理下へ。** `build_overlay.py` と `probe.py` は `scripts/lib/` に移り、`--root` を受け取ります。
+- **アップグレード。** npm 公開後は `npm i -g omnilane@0.42.5` を実行してください。
+
 ## v0.42.4 の新機能
 
 - **クイックスタートが実際に動くようになりました。** `omnilane route` は「誰が依頼しているか」を必要としますが、60 秒クイックスタートにその記載が無く、新規インストールでは案内無しに `missing-caller-context` で拒否されていました。今は `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` で人間の操作者を一度宣言し、モデル呼び出し元が代わりに渡すものも説明します。

package/README.ko.md

@@ -507,6 +507,36 @@ work 는 지정한 디렉터리 안의 변경만 허용하며 모델 연결은
 
 </details>
 
+<details>
+<summary><b>디스패치가 거부되었습니다. 어떤 거부인가요?</b></summary>
+
+<br/>
+
+세 가지 코드에는 각각 다른 해결책이 있습니다. 먼저 `omnilane doctor`를 실행하세요.
+`transport-overlay` 검사가 문제의 원인이 이 머신의 설정인지 요청인지 바로
+알려줍니다.
+
+`missing-caller-context` — 호출자 신원을 전달하지 않았습니다. 사람은
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 또는 `--operator-asserted-human`을
+사용합니다. omnilane을 구동하는 모델은 정확한 벤더·모델·effort가 담긴
+`--caller-context FILE`을 전달해야 하며, 사람용 면제를 스스로 주장해서는 안 됩니다.
+
+`runtime-mapping-unverified` — 신원은 정상이지만 **대상**에 검증된 호스트 로컬
+요청 셀렉터가 없습니다. 프로브를 한 적이 없거나 프로브가 실패한 경우입니다.
+`omnilane doctor`가 해당 구성의 개수를 보고하고, overlay의 `unproven[]`에 각
+실패 사유가 기록됩니다. 공급자 할당량 제한으로 인한 거부는 그 할당량이 회복될
+때까지 해소되지 않습니다.
+
+`invalid-policy-input`과 "transport contract evidence changed" — 위 둘 다
+아닙니다. overlay 자체가 로드되지 않아 **모든 벤더**가 거부됩니다. 흔한 원인은
+벤더 CLI 업그레이드입니다. overlay는 각 벤더의 실행 파일과 러너 스크립트 해시를
+고정하며, Codex와 Claude의 증거 경로에는 버전 디렉터리가 포함되어 업그레이드 시
+다이제스트가 바뀌는 대신 파일이 사라집니다. 태그가 있는 증거는 해당 벤더만
+강등시키고, 프로브 매니페스트처럼 태그가 없는 증거는 게이트 전체를 닫습니다.
+doctor가 파일과 벤더를 지목하며, 재서명 절차는 디스패치 스킬에 있습니다.
+
+</details>
+
 ## 📊 기본값과 출처
 
 기본 레인 배치는 Artificial Analysis 2026-07 스냅샷(AA 사이트 원본 레코드와
@@ -528,6 +558,14 @@ work 는 지정한 디렉터리 안의 변경만 허용하며 모델 연결은
 
 ## 📜 릴리스 기록
 
+## v0.42.5 새 기능
+
+- **CLI 하나를 업그레이드해도 모든 벤더가 막히지 않습니다.** overlay evidence 항목에 `vendor` 태그를 붙일 수 있으며, 태그가 있는 항목의 해시가 바뀌거나 파일이 사라지면 해당 벤더만 `unknown-target-runtime`으로 강등됩니다. 태그가 없는 evidence는 기존처럼 전체 fail-closed입니다.
+- **`omnilane doctor`가 overlay를 로드합니다.** 새 `transport-overlay` 검사는 실패 시 문제가 된 파일과 벤더를 지목하고, 성공 시 벤더별 검증된 매핑 수를 보고합니다.
+- **프로브가 판정을 기록합니다.** `probe.py`는 청구된 `modelUsage`로 Claude 응답을 판정하며, CLI가 알 수 없는 `--effort`를 기본값으로 조용히 대체한 경우를 실패로 처리합니다. `build_overlay.py`는 통과하지 못한 프로브에 서명하지 않고 overlay의 `unproven[]`에 기록합니다.
+- **재빌드 도구를 버전 관리로.** `build_overlay.py`와 `probe.py`는 `scripts/lib/`로 옮겼고 `--root`를 받습니다.
+- **업그레이드.** npm 게시 후 `npm i -g omnilane@0.42.5`를 실행하세요.
+
 ## v0.42.4 새 기능
 
 - **퀵스타트가 실제로 동작합니다.** `omnilane route` 는 «누가 요청하는지»를 알아야 하지만 60초 시작에 그 내용이 없어, 새 설치에서는 안내 없이 `missing-caller-context` 로 거부되었습니다. 이제 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 로 사람 운영자를 한 번 선언하며, 모델 호출자가 대신 전달할 것도 설명합니다.

package/README.md

@@ -379,6 +379,7 @@ omnilane ui status                             # report whether the Live UI is r
 omnilane ui url                                # print the current authenticated local URL
 omnilane ui stop                               # stop the Live UI
 omnilane doctor [--json] [--strict] [--probe V] [--probe-timeout SEC]  # live probe is opt-in
+                                               # transport-overlay check names a stale vendor
 omnilane benchmark [--json] [--run] [--vendor V] [--cost-per-call V=USD] # dry-run by default
 dispatch.sh [--background] [--dry-run] [--thread NAME] [--mode advise|work|sysops] [--workdir DIR]
             [--vendor V] [--model M] [--effort E] [--timeout SEC] [--job-timeout SEC]
@@ -615,6 +616,37 @@ so one command can never spiral into a chain of agents spending your quota.
 
 </details>
 
+<details>
+<summary><b>My dispatch was refused. Which refusal is it?</b></summary>
+
+<br/>
+
+Three codes, three different fixes. Run `omnilane doctor` first — its
+`transport-overlay` check tells you immediately whether the problem is your
+machine's configuration or your request.
+
+`missing-caller-context` — you passed no identity. A human adds
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` or `--operator-asserted-human`; a model
+driving omnilane writes a `--caller-context FILE` with its exact vendor, model,
+and effort, and must not assert the human exemption for itself.
+
+`runtime-mapping-unverified` — your identity is fine, but the *target* has no
+proven host-local request selector. Either it was never probed, or its probe
+failed; `omnilane doctor` reports the count of such configurations and the
+overlay's `unproven[]` records why each one failed. A refusal caused by a
+provider quota limit will not clear until that quota does.
+
+`invalid-policy-input` with "transport contract evidence changed" — neither of
+the above. The overlay itself will not load, so *every* vendor is refused. The
+usual cause is a vendor CLI upgrade: the overlay pins each vendor's executable
+and runner-script hash, and Codex and Claude evidence paths embed version
+directories, so an upgrade removes the file rather than changing its digest.
+Tagged evidence degrades only its own vendor; untagged evidence, such as the
+probe manifest, still closes the whole gate. Doctor names the file and the
+vendor; the dispatch skill carries the re-signing runbook.
+
+</details>
+
 ## 📊 Defaults and provenance
 
 Default lane assignments follow Artificial Analysis coding/intelligence data
@@ -638,6 +670,14 @@ working notes, including per-benchmark caveats, live in
 
 ## 📜 Release history
 
+## What's new in v0.42.5
+
+- **One CLI upgrade no longer refuses every vendor.** Overlay evidence entries take a `vendor` tag; a tagged entry whose hash drifts or whose file has disappeared degrades only that vendor to `unknown-target-runtime`. Untagged evidence stays globally fail-closed.
+- **`omnilane doctor` loads the overlay.** A new `transport-overlay` check names the offending file and vendor on failure and reports per-vendor verified counts on success — an all-green doctor could previously coexist with a gate refusing every dispatch.
+- **Probes record a verdict.** `probe.py` judges Claude responses on the billed `modelUsage` and fails a run where the CLI silently substituted the default effort for an unknown `--effort`. `build_overlay.py` refuses to sign a non-passing probe and records it in the overlay's `unproven[]` instead of dropping it silently.
+- **Rebuild tooling is versioned.** `build_overlay.py` and `probe.py` live in `scripts/lib/` and take `--root`.
+- **Upgrade.** After npm publication, run `npm i -g omnilane@0.42.5`. Existing repo-symlink installations can update their checkout and verify `omnilane --version` without rerunning installation.
+
 ## What's new in v0.42.4
 
 - **The quickstart actually runs now.** `omnilane route` needs to know who is asking; the 60-second start omitted that, so a fresh install hit `missing-caller-context` with no guidance. It now asserts the human operator once with `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1`, and explains what a model caller passes instead.

package/README.zh-CN.md

@@ -481,6 +481,33 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 
 </details>
 
+<details>
+<summary><b>派工被拒了，是哪一种拒绝？</b></summary>
+
+<br/>
+
+三个代码，三种不同的修法。先运行 `omnilane doctor`——它的 `transport-overlay`
+检查会直接告诉你问题出在本机配置还是你的请求。
+
+`missing-caller-context`——你没带身份。真人加上
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`；
+模型驱动 omnilane 时要写一份 `--caller-context FILE`，包含它精确的厂商、模型与
+强度，且不得替自己主张真人豁免。
+
+`runtime-mapping-unverified`——你的身份没问题，但**目标**没有已验证的本机请求
+选择器。可能从未探测过，也可能探测失败；`omnilane doctor` 会报告这类配置的数量，
+overlay 的 `unproven[]` 记录每一条失败的原因。因供应商额度上限造成的拒绝，
+在额度恢复前不会自行解除。
+
+`invalid-policy-input` 搭配 "transport contract evidence changed"——以上皆非。
+是 overlay 本身加载失败，因此**所有厂商**都会被拒。常见成因是厂商 CLI 升级：
+overlay 钉住每家的可执行文件与 runner 脚本哈希，而 Codex 与 Claude 的证据路径
+内嵌版本目录，升级后是文件消失而非哈希改变。带标签的证据只降级自己那一家；
+未标签的证据（例如探测清单）仍会关闭整个闸门。doctor 会指出文件与厂商，
+重签流程写在派工技能里。
+
+</details>
+
 ## 📊 默认值与数据来源
 
 默认通道配置依据 Artificial Analysis 2026-07 快照(已对 AA 站上原始记录与
@@ -503,6 +530,14 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 
 ## 📜 版本历程
 
+## v0.42.5 新功能
+
+- **升级一支 CLI 不再阻断所有厂商。** overlay 的证据项目可带 `vendor` 标签；带标签的项目哈希漂移或文件消失时，只让该厂商降级为 `unknown-target-runtime`。未标签的证据维持全局 fail-closed。
+- **`omnilane doctor` 会加载 overlay。** 新增 `transport-overlay` 检查，失败时指出是哪个文件、哪一家厂商，成功时报告各厂商的已验证映射数。
+- **探测会记录判定。** `probe.py` 以计费的 `modelUsage` 判断 Claude 响应，并在 CLI 静默改用默认强度时判为失败。`build_overlay.py` 拒签未通过的探测，改记入 overlay 的 `unproven[]`。
+- **重建工具纳入版本控制。** `build_overlay.py` 与 `probe.py` 移入 `scripts/lib/`，并接受 `--root`。
+- **升级。** npm 发布后运行 `npm i -g omnilane@0.42.5`。既有的 repo symlink 安装更新检出后确认 `omnilane --version` 即可。
+
 ## v0.42.4 新功能
 
 - **快速上手现在真的跑得起来。** `omnilane route` 必须知道「是谁在问」,但 60 秒上手漏了这件事,新安装照抄会直接吃到 `missing-caller-context` 且没有任何指引。现在会先用 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 表明操作者身分,并说明模型主控该改用什么。

package/README.zh-TW.md

@@ -525,6 +525,33 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析後的計畫,
 
 </details>
 
+<details>
+<summary><b>派工被拒了，是哪一種拒絕？</b></summary>
+
+<br/>
+
+三個代碼，三種不同的修法。先跑 `omnilane doctor`——它的 `transport-overlay`
+檢查會直接告訴你問題出在本機設定還是你的請求。
+
+`missing-caller-context`——你沒帶身分。真人加上
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`；
+模型驅動 omnilane 時要寫一份 `--caller-context FILE`，內含它精確的廠商、模型與
+強度，且不得替自己主張真人豁免。
+
+`runtime-mapping-unverified`——你的身分沒問題，但**目標**沒有已驗證的本機請求
+選擇器。可能從未探測過，也可能探測失敗；`omnilane doctor` 會回報這類設定的數量，
+overlay 的 `unproven[]` 記錄每一條失敗的原因。因供應商額度上限造成的拒絕，
+在額度恢復前不會自行解除。
+
+`invalid-policy-input` 搭配 "transport contract evidence changed"——以上皆非。
+是 overlay 本身載不起來，因此**所有廠商**都會被拒。常見成因是廠商 CLI 升級：
+overlay 釘住每家的執行檔與 runner 腳本雜湊，而 Codex 與 Claude 的證據路徑內嵌
+版本目錄，升級後是檔案消失而非雜湊改變。帶標籤的證據只降級自己那一家；
+未標籤的證據（例如探測清單）仍會關閉整個閘門。doctor 會指名檔案與廠商，
+重簽流程寫在派工技能裡。
+
+</details>
+
 ## 📊 預設值與資料來源
 
 預設通道配置依據 Artificial Analysis 2026-07 快照(已對 AA 站上原始紀錄與
@@ -544,6 +571,14 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析後的計畫,
 
 ## 📜 版本歷程
 
+## v0.42.5 新功能
+
+- **升級一支 CLI 不再擋掉所有廠商。** overlay 的證據項目可帶 `vendor` 標籤；帶標籤的項目雜湊漂移或檔案消失時，只讓該廠商降級為 `unknown-target-runtime`。未標籤的證據維持全域 fail-closed。
+- **`omnilane doctor` 會載入 overlay。** 新增 `transport-overlay` 檢查，失敗時指名是哪個檔案、哪一家廠商，成功時回報各廠商的已驗證映射數——先前 doctor 全綠可以和「閘門拒絕所有派工」同時成立。
+- **探測會記錄判定。** `probe.py` 以計費的 `modelUsage` 判斷 Claude 回應，並在 CLI 靜默改用預設強度時判為失敗。`build_overlay.py` 拒簽未通過的探測，改記進 overlay 的 `unproven[]`，不再無聲丟棄。
+- **重建工具納入版控。** `build_overlay.py` 與 `probe.py` 移入 `scripts/lib/`，並接受 `--root`。
+- **升級。** npm 發布後執行 `npm i -g omnilane@0.42.5`。既有的 repo symlink 安裝更新檢出後確認 `omnilane --version` 即可，不需重跑安裝。
+
 ## v0.42.4 新功能
 
 - **快速上手現在真的跑得起來。** `omnilane route` 必須知道「是誰在問」,但 60 秒上手漏了這件事,新安裝照抄會直接吃到 `missing-caller-context` 且沒有任何指引。現在會先用 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 表明操作者身分,並說明模型主控該改用什麼。

package/VERSION

@@ -1 +1 @@
-0.42.4
+0.42.5

package/docs/release-notes-0.42.5.md

@@ -0,0 +1,99 @@
+# Omnilane 0.42.5
+
+This release stops one vendor's CLI upgrade from refusing every vendor's dispatch,
+makes that failure visible in `omnilane doctor`, and stops the probe harness from
+signing evidence it never read. Routing, scores, and the frozen AA registry are
+unchanged.
+
+## Why
+
+On 2026-09-09 `agy` was upgraded from 1.1.27 to 1.1.28. That changed its sha256,
+and `apply_transport_overlay` compared every evidence hash in one loop and raised
+on the first mismatch, so `load_registry` failed and **every** dispatch was
+refused:
+
+```json
+{"allowed":false,"code":"invalid-policy-input","message":"transport contract evidence changed"}
+```
+
+Only the seven gemini mappings depended on that binary; the other forty-two were
+collateral. `omnilane doctor` reported 19 passed, 0 failed throughout, because no
+check ever loaded the overlay.
+
+Re-probing showed the upgrade had changed nothing observable: all six agy
+selectors still answered correctly. The outage was entirely the blast radius of a
+config linter that had been given the authority of a security gate.
+
+The same investigation found six `claude-fable-5-1` configurations that had been
+unusable since 2026-09-07. Their probes had failed with a quota refusal, and
+`build_overlay.py` simply omitted them — no record, no warning, nothing for an
+operator to notice.
+
+## Changes
+
+### Evidence staleness is per vendor
+
+- Overlay `evidence[]` entries take an optional `vendor` tag. A tagged entry whose
+  hash drifts, or whose file no longer exists, marks that vendor stale and skips
+  the `verified` upgrade for its mappings; `decide()` then returns
+  `unknown-target-runtime` for that vendor alone.
+- Untagged entries keep the previous global fail-closed behaviour, so overlays
+  built before the tags exist are unaffected.
+- Missing files are treated as staleness, not corruption: the codex and claude
+  evidence paths embed version directories, so their upgrades delete the file
+  rather than change its digest.
+- Structural overlay checks — schema, snapshot, host, exact identity, selector
+  type, effort alignment — remain hard failures.
+
+### Doctor loads the overlay
+
+- A new `transport-overlay` check loads the configured overlay through
+  `aa_policy.load_registry` and names the offending file and vendor on failure.
+  It reports per-vendor verified counts on success and warns when a vendor has
+  degraded. `live-capable` is unchanged: it answers whether a CLI supports a live
+  session, which stays true while the gate refuses the vendor.
+
+### Probes record a verdict
+
+- `probe.py` now derives a `verdict`, `verdict_reason`, `observed_model`, and
+  `probed_at` from the raw evidence through a pure function, per vendor:
+  - Claude responses are judged on `modelUsage` — the billed model the CLI
+    reports — plus `is_error`, and are failed when stderr shows the CLI silently
+    substituted the default effort for an unknown `--effort`. Effort is half of a
+    scored identity, so that path would otherwise certify a mapping at the wrong
+    tier while exit status, `is_error`, `modelUsage`, and the expected token all
+    look correct.
+  - grok and agy reject invalid input outright, so exit status and a clean stderr
+    are sufficient.
+  - codex prints a banner to stderr on every run, so stderr is recorded for review
+    rather than treated as failure.
+- `build_overlay.py` refuses to sign a non-passing probe and records it in a new
+  `unproven[]` block with its reason, so a quota refusal is visible instead of
+  silently dropping configurations. Evidence predating the verdict field is
+  still signed, with a warning naming each legacy entry.
+- The six `claude-fable-5-1` and `claude-fable-5` configurations are listed in
+  the probe table so their failures reach `unproven[]`. Re-probing them on
+  2026-09-09 returned the same quota refusal as on 09-07, so they remain
+  unusable — but `omnilane doctor` now says so rather than leaving an operator
+  to discover it from a refused dispatch.
+- `build_overlay.py` and `probe.py` moved from an untracked `.rollback` sweep
+  directory into `scripts/lib/`, and take `--root`; overlay rebuilds no longer
+  depend on a directory that a cleanup can delete.
+
+## Verification boundary
+
+A passing probe proves the CLI accepted the selector and, for Claude, that the
+billed model matches the request. It still does not certify upstream provider
+identity, and `upstream_identity_verified` remains `false`. grok, agy, and codex
+expose no equivalent of `modelUsage` in the evidence captured so far.
+
+The frozen AA registry and its approved SHA are unchanged. Coverage remains 78
+scored targets, and the host overlay still verifies 49 mappings — codex 26,
+claude 11, gemini 7, grok 5.
+
+## Upgrade
+
+Existing overlays keep working untouched. To gain per-vendor degradation, rebuild
+the overlay with the new `build_overlay.py` so its evidence carries vendor tags.
+Run `omnilane doctor` afterwards and confirm the `transport-overlay` check reports
+the vendor counts you expect.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.4",
+  "version": "0.42.5",
   "description": "One routing table, every harness — classify subtasks into lanes and delegate each lane through a compatible caller-owned native agent or vendor CLI.",
   "bin": {
     "omnilane": "bin/omnilane"
@@ -29,7 +29,7 @@
     "docs/model-capabilities-2026-09.md",
     "docs/native-executor.md",
     "docs/completion-wakeup.md",
-    "docs/release-notes-0.42.4.md",
+    "docs/release-notes-0.42.5.md",
     "hooks/",
     "skills/",
     ".claude-plugin/",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.42.4",
+  "version": "0.42.5",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/scripts/doctor.sh

@@ -33,6 +33,7 @@ REPO="${OMNILANE_DOCTOR_REPO:-$SCRIPT_ROOT}"
 OMNILANE_HOME="${OMNILANE_HOME:-$HOME/.omnilane}"
 PROBE_SCRIPT="${OMNILANE_PROVIDER_PROBE_SCRIPT:-$REPO/scripts/provider-probe.sh}"
 GOAL_LOOP="${OMNILANE_DOCTOR_GOAL_LOOP:-$REPO/scripts/lib/goal-loop.sh}"
+OVERLAY_HEALTH="${OMNILANE_DOCTOR_OVERLAY_HEALTH:-$REPO/scripts/lib/overlay_health.py}"
 # shellcheck disable=SC1091
 source "$SCRIPT_ROOT/scripts/lib/live-protocol.sh"
 PASS_COUNT=0
@@ -409,6 +410,31 @@ else
   report PASS live-unavailable "none"
 fi
 
+# live-capable above answers "does this CLI support a live session", which stays
+# true while the AA gate refuses every dispatch. Nothing else loads the overlay,
+# so one drifted evidence hash used to go unreported by an all-green doctor.
+overlay_path="$(
+  set +u
+  [[ -f "$OMNILANE_HOME/local.sh" ]] && . "$OMNILANE_HOME/local.sh" 2>/dev/null
+  printf '%s' "${OMNILANE_AA_TRANSPORT_OVERLAY:-}"
+)"
+if [[ -z "$overlay_path" ]]; then
+  report PASS transport-overlay "no overlay configured; every runtime mapping stays unverified"
+elif ! command -v python3 >/dev/null 2>&1; then
+  report WARN transport-overlay "python3 is absent; cannot load the AA transport overlay"
+elif [[ ! -r "$OVERLAY_HEALTH" ]]; then
+  report WARN transport-overlay "$OVERLAY_HEALTH is missing"
+else
+  overlay_line="$(OMNILANE_AA_TRANSPORT_OVERLAY="$overlay_path" \
+    python3 "$OVERLAY_HEALTH" "$REPO" 2>&1)"
+  overlay_level="${overlay_line%%	*}"
+  overlay_message="${overlay_line#*	}"
+  case "$overlay_level" in
+    PASS|WARN|FAIL) report "$overlay_level" transport-overlay "$overlay_message" ;;
+    *) report WARN transport-overlay "unreadable overlay health output: $overlay_line" ;;
+  esac
+fi
+
 if [[ -n "$PROBE_VENDOR" ]]; then
   if [[ ! -x "$PROBE_SCRIPT" ]]; then
     report FAIL provider-probe "probe runner is unavailable"

package/scripts/lib/aa_policy.py

@@ -28,6 +28,7 @@ MAX_BYTES = 1_048_576
 APPROVED_REGISTRY_SHA256 = "0782c87de123c02738c3ff60e4bc3c1cc10d110113e872b8f8627212861cdaab"
 
 IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
+TRANSPORT_EVIDENCE_VENDORS = frozenset(("codex", "claude", "grok", "gemini"))
 IDENTIFIER = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}\Z")
 
 
@@ -147,14 +148,35 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
     _check(overlay.get("schema_version") == 1, "unsupported transport overlay")
     _check(overlay.get("snapshot_id") == registry["snapshot"]["id"], "transport overlay snapshot mismatch")
     _check(overlay.get("host") == socket.gethostname(), "transport overlay host mismatch")
+    stale_vendors: set[str] = set()
     for evidence in overlay.get("evidence", []):
-        fd = os.open(evidence["path"], os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        _check(isinstance(evidence, dict), "invalid transport evidence")
+        vendor = evidence.get("vendor")
+        _check(
+            "vendor" not in evidence
+            or type(vendor) is str and vendor in TRANSPORT_EVIDENCE_VENDORS,
+            "invalid transport evidence vendor",
+        )
+        evidence_path = evidence["path"]
+        evidence_sha256 = evidence["sha256"]
+        _check(type(evidence_path) is str, "invalid transport evidence path")
+        _check(type(evidence_sha256) is str, "invalid transport evidence digest")
+        try:
+            fd = os.open(evidence_path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        except FileNotFoundError:
+            if vendor is None:
+                raise
+            stale_vendors.add(vendor)
+            continue
         with os.fdopen(fd, "rb") as stream:
             _check(stat.S_ISREG(os.fstat(stream.fileno()).st_mode), "invalid transport evidence file")
             digest_file = hashlib.sha256()
             for block in iter(lambda: stream.read(1024 * 1024), b""):
                 digest_file.update(block)
-        _check(digest_file.hexdigest() == evidence["sha256"], "transport contract evidence changed")
+        if digest_file.hexdigest() != evidence_sha256:
+            if vendor is None:
+                _check(False, "transport contract evidence changed")
+            stale_vendors.add(vendor)
     _check(bool(overlay.get("evidence")), "transport overlay requires local evidence")
     for mapping in overlay.get("mappings", []):
         rows = [row for row in registry["scored_configs"] if row["id"] == mapping.get("config_id")]
@@ -175,6 +197,8 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             _check(mapping["runtime_model"].endswith("-" + row["effort"]), "encoded effort does not match exact tuple")
         else:
             _check(mapping.get("runtime_model") == row["model"], "overlay model mismatch")
+        if row["vendor"] in stale_vendors:
+            continue
         row["transport_mapping"].update(
             status="verified", runtime_verified=True,
             runtime_model=mapping["runtime_model"], runtime_effort=mapping["runtime_effort"],
@@ -183,6 +207,7 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             verification="request-selector-contract", upstream_identity_verified=False,
             overlay_sha256=digest, overlay_host=overlay["host"],
         )
+    registry["_stale_transport_vendors"] = sorted(stale_vendors)
 
 
 def load_registry(path: str | Path, expected_sha256: str | None = None) -> tuple[dict[str, Any], str]:
@@ -233,6 +258,8 @@ def _runtime_target(registry: dict[str, Any], vendor: str, model: str,
     exact_id = [row for row in registry["scored_configs"] if row["id"] == target_config] if target_config else registry["scored_configs"]
     if target_config and not exact_id:
         return None, "unknown-target-config", {"target_config": target_config}
+    if vendor in registry.get("_stale_transport_vendors", []):
+        return None, "unknown-target-runtime", {"vendor": vendor, "model": model, "effort": effort}
     vendor_rows = [row for row in exact_id if row["vendor"] == vendor]
     candidates: list[dict[str, Any]] = []
     unresolved: list[str] = []

package/scripts/lib/build_overlay.py

@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""Build the merged omnilane AA transport overlay from verified probe evidence.
+
+Only (config_id, selector) pairs listed in PROVEN are written. Every entry here
+corresponds to a probe run under the selected evidence root whose raw
+stdout/stderr is hashed into the manifest, so the overlay's evidence[] anchors
+the whole set.
+"""
+import argparse
+import hashlib
+import json
+import os
+import socket
+from datetime import datetime, timezone
+from pathlib import Path
+
+REPO = Path(os.environ.get("OMNILANE_REPO", "/Users/vincentw/dev/omnilane"))
+HOME = Path.home()
+SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
+DEFAULT_ROOT = HOME / ".omnilane" / "transport-evidence" / SWEEP_ID
+REGISTRY = json.loads((REPO / "config/aa-model-policy.json").read_text())
+ROWS = {r["id"]: r for r in REGISTRY["scored_configs"]}
+IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
+
+# config_id -> (selector_type, runtime_model, probe evidence basename)
+PROVEN: dict[str, tuple[str, str, str]] = {}
+
+for model, slug in [("gpt-6-astra", "gpt-6-astra"), ("gpt-5.6-sol", "gpt-5_6-sol"),
+                    ("gpt-5.6-luna", "gpt-5_6-luna"), ("gpt-5.6-terra", "gpt-5_6-terra")]:
+    base = model.replace(".", "-").replace("gpt-", "gpt-")
+    for effort in ["max", "xhigh", "high", "medium", "low"]:
+        cid = f"codex/{model.replace('.', '-')}" + ("" if effort == "max" else f"-{effort}")
+        ev = f"cx-avail-{model.replace('.', '_')}" if effort == "high" else f"cx-{model.replace('.', '_')}-{effort}"
+        PROVEN[cid] = ("model_and_effort", model, ev)
+
+for effort in ["xhigh", "medium"]:
+    PROVEN[f"codex/gpt-5-4-mini" + ("" if effort == "xhigh" else f"-{effort}")] = (
+        "model_and_effort", "gpt-5.4-mini", f"cx-gpt-5_4-mini-{effort}")
+
+PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "PRIOR:grok-effort-2026-09-07")
+for effort in ["xhigh", "medium", "low"]:
+    PROVEN[f"grok/grok-4-6-{effort}"] = ("cli_reasoning_effort", "grok-4.6", f"gk-grok-4_6-{effort}")
+PROVEN["grok/grok-4-5"] = ("cli_reasoning_effort", "grok-4.5", "gk-grok-4_5-high")
+
+for cid, rid, ev in [
+    ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "PRIOR:gemini-flash-high"),
+    ("gemini/gemini-3-8-flash-medium", "gemini-3.8-flash-medium", "agy-gemini-3_8-flash-medium"),
+    ("gemini/gemini-3-8-flash-low", "gemini-3.8-flash-low", "agy-gemini-3_8-flash-low"),
+    ("gemini/gemini-3-7-flash", "gemini-3.7-flash-high", "agy-gemini-3_7-flash-high"),
+    ("gemini/gemini-3-7-flash-medium", "gemini-3.7-flash-medium", "agy-gemini-3_7-flash-medium"),
+    ("gemini/gemini-3-7-flash-low", "gemini-3.7-flash-low", "agy-gemini-3_7-flash-low"),
+    ("gemini/gemini-3-6-flash", "gemini-3.6-flash-high", "agy-gemini-3_6-flash-high"),
+]:
+    PROVEN[cid] = ("model_id_encoded_effort", rid, ev)
+
+for effort in ["max", "xhigh", "high", "medium", "low"]:
+    cid = "claude/claude-opus-5" + ("" if effort == "max" else f"-{effort}")
+    PROVEN[cid] = ("model_and_effort", "claude-opus-5", f"cl-claude-opus-5-{effort}")
+# gpt-6-astra rejects effort "none" upstream ("Unsupported value: 'none' is not
+# supported with the 'gpt-6-astra' model"), so it has no non-reasoning selector.
+for model in ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.4-mini"]:
+    PROVEN[f"codex/{model.replace('.', '-')}-non-reasoning"] = (
+        "model_and_effort", model, f"cx-{model.replace('.', '_')}-none")
+
+# Default (no --effort) Haiku 4.5 spent 124 thinking tokens, so the selector
+# lands on the reasoning row rather than its non-reasoning sibling.
+PROVEN["claude/claude-4-5-haiku-reasoning"] = (
+    "model_and_effort", "claude-haiku-4-5", "cl-rmode-claude-haiku-4-5-noeffort")
+
+for cid, model in [("claude/claude-sonnet-5", "claude-sonnet-5"),
+                   ("claude/claude-opus-4-8", "claude-opus-4-8"),
+                   ("claude/claude-opus-4-7", "claude-opus-4-7"),
+                   ("claude/claude-opus-4-6-adaptive", "claude-opus-4-6"),
+                   ("claude/claude-sonnet-4-6-adaptive", "claude-sonnet-4-6")]:
+    PROVEN[cid] = ("model_and_effort", model, f"cl-{model}-max")
+
+# Fable is listed so its failures reach unproven[] rather than vanishing. Its
+# probes were refused for quota on 2026-09-07 and again on 2026-09-09; the
+# verdict decides whether these rows become mappings or stay visible failures.
+for effort in ["max", "xhigh", "high", "medium", "low"]:
+    cid = "claude/claude-fable-5-1" + ("" if effort == "max" else f"-{effort}")
+    PROVEN[cid] = ("model_and_effort", "claude-fable-5-1", f"cl-claude-fable-5-1-{effort}")
+PROVEN["claude/claude-fable-5"] = (
+    "model_and_effort", "claude-fable-5", "cl-claude-fable-5-max")
+
+CORE_EVIDENCE = [
+    (HOME / ".grok/downloads/grok-1.0.13-macos-aarch64", "grok"),
+    (REPO / "scripts/runners/run-grok.sh", "grok"),
+    (HOME / ".codex/packages/standalone/releases/0.153.4-aarch64-apple-darwin/bin/codex", "codex"),
+    (REPO / "scripts/runners/run-codex.sh", "codex"),
+    (HOME / ".local/share/claude/versions/2.1.263", "claude"),
+    (REPO / "scripts/runners/run-claude.sh", "claude"),
+    (HOME / ".local/bin/agy", "gemini"),
+    (REPO / "scripts/runners/run-gemini.sh", "gemini"),
+]
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1 << 20), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--root",
+        type=Path,
+        default=DEFAULT_ROOT,
+        help=f"probe sweep root (default: {DEFAULT_ROOT})",
+    )
+    args = parser.parse_args(argv)
+    root = args.root.expanduser()
+
+    manifest = {"probe_runs": {}}
+    unproven = []
+    for cid, (_, _, ev) in sorted(PROVEN.items()):
+        if ev.startswith("PRIOR:"):
+            manifest["probe_runs"][cid] = {"source": ev, "note": "verified in the 2026-09-07 Codex run"}
+            continue
+        entry = {}
+        for suffix in ("json", "stdout", "stderr"):
+            path = root / "evidence" / f"{ev}.{suffix}"
+            if path.exists():
+                entry[suffix] = {"path": str(path), "sha256": sha256(path)}
+        if "json" not in entry:
+            raise SystemExit(f"missing probe evidence for {cid}: {ev}")
+        descriptor_path = Path(entry["json"]["path"])
+        descriptor = json.loads(descriptor_path.read_text())
+        if not isinstance(descriptor, dict):
+            raise SystemExit(f"invalid probe descriptor for {cid}: {ev}")
+        if "verdict" not in descriptor:
+            print(f"warning: legacy evidence (verdict=unknown): {cid}: {ev}")
+        elif descriptor["verdict"] != "pass":
+            unproven.append({
+                "config_id": cid,
+                "verdict_reason": descriptor.get("verdict_reason") or f"verdict: {descriptor['verdict']}",
+                "observed_model": descriptor.get("observed_model"),
+                "probed_at": descriptor.get("probed_at") or datetime.fromtimestamp(
+                    descriptor_path.stat().st_mtime, timezone.utc).isoformat(),
+            })
+            # Visibility only: failed evidence must not enter the signed manifest.
+            continue
+        manifest["probe_runs"][cid] = entry
+    manifest_path = root / "probe-manifest.json"
+    manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
+
+    mappings = []
+    for cid, (selector, runtime_model, _) in sorted(PROVEN.items()):
+        if cid not in manifest["probe_runs"]:
+            continue
+        row = ROWS[cid]
+        mapping = {
+            "config_id": cid,
+            "identity": {key: row[key] for key in IDENTITY_FIELDS},
+            "runtime_model": runtime_model,
+            "runtime_effort": row["effort"],
+            "selector_type": selector,
+            "verification": "request-selector-contract",
+        }
+        if selector == "cli_reasoning_effort":
+            mapping["cli_flag"] = "--reasoning-effort"
+        mappings.append(mapping)
+
+    evidence = [
+        {"path": str(path), "sha256": sha256(path), "vendor": vendor}
+        for path, vendor in CORE_EVIDENCE
+    ]
+    evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
+
+    overlay = {
+        "schema_version": 1,
+        "snapshot_id": REGISTRY["snapshot"]["id"],
+        "host": socket.gethostname(),
+        "source": ("claude-code / MacStudio / operator-directed full sweep 2026-09-07; "
+                   "gemini selectors re-probed 2026-09-09 after agy 1.1.27 -> 1.1.28"),
+        "evidence": evidence,
+        "mappings": mappings,
+        "unproven": unproven,
+    }
+    out = root / "transport-contracts.local.json"
+    out.write_text(json.dumps(overlay, indent=2, ensure_ascii=False) + "\n")
+    print(f"wrote {out} with {len(mappings)} mappings and {len(evidence)} evidence anchors")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/lib/overlay_health.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""Report whether the configured AA transport overlay still loads.
+
+Prints one `LEVEL<TAB>message` line for `omnilane doctor`. Always exits 0; the
+caller decides how to grade the level. Nothing here contacts a provider.
+
+Exists because no other doctor check observes the AA gate: every vendor CLI can
+be reachable and every lane resolvable while `load_registry` refuses the whole
+registry over one drifted evidence hash.
+"""
+import hashlib
+import os
+import sys
+from collections import Counter
+from pathlib import Path
+
+REPO = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "scripts" / "lib"))
+
+
+def emit(level: str, message: str) -> None:
+    print(f"{level}\t{message}")
+    raise SystemExit(0)
+
+
+def digest(path: Path) -> str:
+    value = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            value.update(block)
+    return value.hexdigest()
+
+
+def offenders(overlay_path: Path) -> list[str]:
+    """Name the evidence entries that no longer match, for an actionable report."""
+    import json
+
+    try:
+        overlay = json.loads(overlay_path.read_text())
+    except (OSError, ValueError):
+        return []
+    found = []
+    for entry in overlay.get("evidence", []):
+        path = Path(entry.get("path", ""))
+        tag = entry.get("vendor") or "untagged"
+        if not path.exists():
+            found.append(f"{tag}:missing {path}")
+        elif digest(path) != entry.get("sha256"):
+            found.append(f"{tag}:hash drift {path}")
+    return found
+
+
+def main() -> None:
+    overlay_path = os.environ.get("OMNILANE_AA_TRANSPORT_OVERLAY", "")
+    if not overlay_path:
+        emit("PASS", "no overlay configured; every runtime mapping stays unverified")
+    if not Path(overlay_path).exists():
+        emit("FAIL", f"configured overlay is missing: {overlay_path}")
+
+    try:
+        import aa_policy
+    except ImportError as error:
+        emit("WARN", f"cannot import aa_policy: {error}")
+
+    try:
+        registry, _ = aa_policy.load_registry(str(REPO / "config" / "aa-model-policy.json"))
+    except Exception as error:  # PolicyError, OSError, and anything else fails the gate
+        detail = "; ".join(offenders(Path(overlay_path))) or str(error)
+        emit("FAIL", f"overlay rejected, every dispatch is refused: {error} ({detail})")
+
+    verified = Counter()
+    for row in registry["scored_configs"]:
+        if row["transport_mapping"].get("runtime_verified") is True:
+            verified[row["vendor"]] += 1
+    summary = ", ".join(f"{v} {n}" for v, n in sorted(verified.items())) or "none"
+
+    import json
+
+    overlay = json.loads(Path(overlay_path).read_text())
+    unproven = overlay.get("unproven", [])
+    extra = f"; {len(unproven)} config(s) recorded unproven" if unproven else ""
+
+    stale = registry.get("_stale_transport_vendors", [])
+    if stale:
+        detail = "; ".join(o for o in offenders(Path(overlay_path))) or "unknown cause"
+        emit("WARN", f"stale vendor(s) {', '.join(stale)} degraded to unverified "
+                     f"({detail}); still verified: {summary}{extra}")
+    emit("PASS", f"verified mappings: {summary}{extra}")
+
+
+main()

package/scripts/lib/probe.py

@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Request-selector probe harness for the omnilane AA transport overlay.
+
+Runs one CLI invocation, captures raw stdout/stderr to files, and writes a
+descriptor with the original command/stream fields plus a vendor-specific
+verdict, its reason, and the observed model when the response proves it.
+"""
+import argparse
+import json
+import os
+import subprocess
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
+DEFAULT_ROOT = Path.home() / ".omnilane" / "transport-evidence" / SWEEP_ID
+
+
+def verdict(
+    evidence_json: dict,
+    stdout_text: str,
+    stderr_text: str,
+    vendor: str,
+    expected_token: str | None,
+) -> tuple[str, str, str | None]:
+    """Judge raw evidence without reading files, running commands or mutating it.
+
+    Only Claude's billed modelUsage keys currently prove the responding model.
+    A requested selector (including the Codex banner) is not observed identity.
+    """
+    if evidence_json.get("timed_out"):
+        return "fail", "timeout", None
+    if not expected_token:
+        return "fail", "missing-expected-token", None
+
+    exit_code = evidence_json.get("exit_code")
+    if vendor == "claude":
+        try:
+            response = json.loads(stdout_text)
+        except (json.JSONDecodeError, TypeError):
+            return "fail", "invalid-json", None
+        if not isinstance(response, dict):
+            return "fail", "invalid-json-result", None
+        usage = response.get("modelUsage")
+        models = sorted(usage) if isinstance(usage, dict) else []
+        observed_model = ", ".join(models) or None
+        result = response.get("result", "")
+        if not isinstance(result, str):
+            result = str(result)
+        if response.get("is_error"):
+            lower_result = result.lower()
+            if "limit" in lower_result or "quota" in lower_result:
+                reason = "quota-exhausted"
+            elif "api error" in lower_result:
+                reason = "api-error"
+            else:
+                reason = "result-error"
+            return "fail", f"{reason}: {result[:120]}", observed_model
+        if not models:
+            return "fail", "missing-model-usage", None
+        command = evidence_json.get("command", [])
+        requested_model = None
+        for index, argument in enumerate(command):
+            if argument == "--model" and index + 1 < len(command):
+                requested_model = command[index + 1]
+            elif isinstance(argument, str) and argument.startswith("--model="):
+                requested_model = argument.split("=", 1)[1]
+        if not requested_model:
+            return "fail", "missing-requested-model", observed_model
+        if models != [requested_model]:
+            return "fail", "model-mismatch", observed_model
+        if "unknown --effort" in stderr_text.lower():
+            return "fail", "effort-silently-defaulted", observed_model
+        if exit_code != 0:
+            return "fail", f"exit-code: {exit_code}", observed_model
+        if expected_token not in result:
+            return "fail", "missing-expected-token", observed_model
+        return "pass", "expected-token-and-model-matched", observed_model
+
+    if vendor in ("grok", "agy"):
+        if exit_code != 0:
+            return "fail", f"exit-code: {exit_code}: {stderr_text[:120]}", None
+        if stderr_text:
+            return "fail", f"unexpected-stderr: {stderr_text[:120]}", None
+        if expected_token not in stdout_text:
+            return "fail", "missing-expected-token", None
+        return "pass", "expected-token-and-clean-stderr", None
+
+    if vendor == "codex":
+        diagnostics = [line[:120] for line in stderr_text.splitlines()
+                       if "error" in line.lower() or "warning" in line.lower()]
+        review = "; stderr-review: " + " | ".join(diagnostics) if diagnostics else ""
+        if exit_code != 0:
+            return "fail", f"exit-code: {exit_code}{review}", None
+        if expected_token not in stdout_text:
+            return "fail", f"missing-expected-token{review}", None
+        return "pass", f"expected-token-matched{review}", None
+
+    return "fail", f"unsupported-vendor: {vendor}", None
+
+
+def probe(
+    name: str,
+    argv: list[str],
+    timeout: int = 180,
+    cwd: Path | None = None,
+    root: Path | None = None,
+    *,
+    vendor: str | None = None,
+    expected_token: str | None = None,
+) -> dict:
+    if not expected_token:
+        raise ValueError("expected_token is required before running a probe")
+    if not argv:
+        raise ValueError("command is required")
+    vendor = vendor or Path(argv[0]).name
+    if vendor not in ("claude", "grok", "agy", "codex"):
+        raise ValueError(f"unsupported vendor: {vendor}; pass vendor explicitly")
+    root = (root or DEFAULT_ROOT).expanduser()
+    evidence = root / "evidence"
+    work = root / "work"
+    evidence.mkdir(parents=True, exist_ok=True)
+    work.mkdir(parents=True, exist_ok=True)
+    out_path = evidence / f"{name}.stdout"
+    err_path = evidence / f"{name}.stderr"
+    started = time.time()
+    timed_out = False
+    env = dict(os.environ)
+    # The runners drop the API key so the subscription OAuth path is used.
+    env.pop("XAI_API_KEY", None)
+    with open(out_path, "wb") as out, open(err_path, "wb") as err:
+        proc = subprocess.Popen(argv, stdout=out, stderr=err, stdin=subprocess.DEVNULL,
+                                cwd=str(cwd or work), env=env)
+        try:
+            rc = proc.wait(timeout=timeout)
+        except subprocess.TimeoutExpired:
+            timed_out = True
+            proc.kill()
+            rc = proc.wait()
+    record = {
+        "command": argv,
+        "cwd": str(cwd or work),
+        "exit_code": rc,
+        "timed_out": timed_out,
+        "elapsed_seconds": round(time.time() - started, 3),
+        "probed_at": datetime.fromtimestamp(started, timezone.utc).isoformat(),
+        "stdout": str(out_path),
+        "stderr": str(err_path),
+    }
+    record["verdict"], record["verdict_reason"], record["observed_model"] = verdict(
+        record, out_path.read_text(errors="replace"), err_path.read_text(errors="replace"),
+        vendor, expected_token,
+    )
+    (evidence / f"{name}.json").write_text(json.dumps(record, indent=2) + "\n")
+    return record
+
+
+def read(
+    name: str,
+    stream: str = "stdout",
+    limit: int = 4000,
+    root: Path | None = None,
+) -> str:
+    path = (root or DEFAULT_ROOT).expanduser() / "evidence" / f"{name}.{stream}"
+    if not path.exists():
+        return ""
+    return path.read_text(errors="replace")[:limit]
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=DEFAULT_ROOT)
+    parser.add_argument("--expect", required=True, help="expected response token")
+    parser.add_argument("--vendor", choices=("claude", "grok", "agy", "codex"),
+                        help="defaults to the command executable's basename")
+    parser.add_argument("name")
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args()
+    if not args.command:
+        parser.error("command is required")
+    rec = probe(args.name, args.command, root=args.root,
+                vendor=args.vendor, expected_token=args.expect)
+    print(json.dumps(rec, ensure_ascii=False))

package/skills/omnilane/SKILL.md

@@ -371,12 +371,55 @@ closes lanes and pushes the question back onto the operator. Never raise the
 declared effort to unblock a refused target, and never assert
 `--operator-asserted-human` on your own behalf.
 
-Two refusal codes mean different things and need different fixes.
+Three refusal codes mean different things and need different fixes.
 `missing-caller-context` means you passed no file — write one.
 `runtime-mapping-unverified` means the file is fine but the *target* has no proven
 host-local request selector; that is fixed by a `--transport-overlay` entry backed
 by real evidence, never by editing the frozen registry (its sha256 is pinned in
 `scripts/lib/aa_policy.py`, so any edit fails the whole gate closed).
+`invalid-policy-input` with "transport contract evidence changed" is neither: the
+overlay itself will not load, so nothing about your caller or your target is wrong.
+Run `omnilane doctor` first — its `transport-overlay` check names the offending
+file and the vendor it belongs to. Do not go hunting by hand.
+
+Upgrading a vendor CLI is the usual cause. The overlay pins the sha256 of each
+vendor's executable and runner script, so a new release invalidates that vendor's
+selector evidence. Evidence entries carry a `vendor` tag: a tagged entry that
+drifts marks only its own vendor stale, and the other three keep dispatching.
+Untagged evidence — `probe-manifest.json`, and any overlay built before the tags
+existed — still fails the whole gate closed, which is what an unpatched host
+looks like. Codex and Claude evidence paths embed version directories
+(`releases/0.153.4-…`, `versions/2.1.263`), so their upgrades remove the file
+rather than change its digest; both are treated as staleness, not corruption.
+
+Re-signing is a probe, a rebuild, and an install, in that order. Back up
+`~/.omnilane/transport-contracts.local.json` first; restoring it is the rollback.
+`scripts/lib/probe.py --expect TOKEN [--vendor V] NAME COMMAND…` invokes the CLI
+directly through `subprocess`, so it works while the gate is refusing everything —
+this is what breaks the deadlock. `scripts/provider-probe.sh` goes through
+`dispatch.sh` and therefore through the gate, so it is useless in this state.
+Then `scripts/lib/build_overlay.py` rebuilds, and you copy the result over the
+live overlay. Verify with a real dispatch on a lane belonging to the vendor you
+re-probed; loading the registry in Python is not the runtime surface.
+
+Keep the sweep where its default `--root` puts it,
+`~/.omnilane/transport-evidence/<sweep-id>/`. The rebuilt overlay anchors
+`probe-manifest.json` by absolute path as untagged evidence, so a sweep parked
+inside a repository is one `git clean -fdx` away from taking every vendor down
+at once — the same global refusal a re-signing session is usually trying to end.
+
+Never sign a probe you did not read. `probe.py` records a `verdict` because exit
+status alone is not evidence: the Claude CLI answers a quota refusal with a JSON
+body carrying `is_error`, and it accepts an unknown `--effort` by silently using
+the default, returning exit 0, the right `modelUsage`, and the expected token
+with only a stderr warning to show for it. Effort is half of a scored identity,
+so that path would certify a mapping at the wrong tier. Configurations whose
+probes failed are recorded in the overlay's `unproven[]` and surfaced by doctor
+instead of vanishing — six Fable rows sat unusable for two days in September
+2026 because a 429 quota refusal left no trace anywhere. A refused probe is not
+always transient: re-probing those six two days later returned the same 429, so
+an `unproven[]` entry can mean the account, not the moment. Read the reason
+before assuming a retry will clear it.
 
 A `--transport-overlay /absolute/overlay.json` may prove a small set of host-local
 request selectors using exact identities and hashed local contract evidence. It does

package/docs/release-notes-0.42.4.md

@@ -1,47 +0,0 @@
-# Omnilane 0.42.4
-
-This patch fixes the user-facing quickstart. It changes no routing, scoring, gate,
-runner, or CLI behaviour.
-
-## Why
-
-0.42.3 documented `--caller-context` inside the dispatch skill, which is what a
-model driving omnilane reads. It left the READMEs' 60-second start untouched —
-and that is the path a new install actually takes. A user who ran
-
-```bash
-npm i -g omnilane
-omnilane route hardest-coding "fix the flaky auth token refresh"
-```
-
-was refused with `missing-caller-context`, and no README section explained the
-flag that resolves it. The gate was working as designed; the documentation simply
-never told a first-time user how to satisfy it.
-
-## Changes
-
-- The 60-second start in all five READMEs asserts the human operator once with
-  `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` before the first `omnilane route`.
-- A note after the quickstart explains why a dispatch must say who is asking:
-  a human at a terminal asserts it with that variable or `--operator-asserted-human`
-  per call; a model driving omnilane cannot assert it for itself and passes
-  `--caller-context FILE` with its exact vendor, model, and effort instead; with
-  neither, the dispatch is refused before any job is created.
-- The `dispatch.sh` synopsis in the command reference now shows
-  `[--caller-context FILE | --operator-asserted-human]`.
-
-## Verification boundary
-
-`--operator-asserted-human` is cooperative operator metadata. It is not automatic
-model detection and not OS authentication, and this release does not change that.
-A model caller still must not assert it on its own behalf.
-
-The frozen AA registry and its approved SHA are unchanged. Coverage remains 78
-scored targets, one scored reference-only entry, and 10 unknown configurations.
-
-## Upgrade
-
-After npm publication, run `npm i -g omnilane@0.42.4`. An existing repo-symlink
-installation can update its checkout and verify `omnilane --version` without
-rerunning installation. GitHub release and npm publication remain separate
-verification surfaces from Linux CI.