omnilane 0.42.4 → 0.42.6

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "One routing table, native-first or CLI delegation, supervised completion workflows.",
-    "version": "0.42.4"
+    "version": "0.42.6"
   },
   "plugins": [
     {
       "name": "omnilane",
       "source": "./",
       "description": "Route each subtask to the model that fits, then delegate through a compatible caller-owned native agent or vendor CLI.",
-      "version": "0.42.4",
+      "version": "0.42.6",
       "category": "development",
       "keywords": [
         "routing",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.4",
+  "version": "0.42.6",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs.",
   "author": {
     "name": "Seraphim0916"

package/CHANGELOG.md

@@ -6,6 +6,101 @@ semantic version tags.
 
 ## [Unreleased]
 
+## [0.42.6] - 2026-09-10
+
+### Added
+
+- Every transport overlay mapping now records an `evidence_tier` saying how
+  strongly its probe identified the responder. `billed-model` is the provider
+  naming the model it charged for (Claude's `modelUsage`, grok's under
+  `--output-format json`); `client-echo` is the CLI recording the model it asked
+  for (codex's session rollout, agy's `cli.log` resolver line); `selector-only`
+  is a CLI accepting the selector and reporting nothing further. A verified
+  mapping previously flattened these into one word, which overstated two of the
+  four vendors in the same way the gate itself did before 0.42.5.
+- `omnilane doctor` reports the tier alongside each vendor's verified count and
+  names the vendors worth re-probing.
+
+### Changed
+
+- The tier is derived from what a run produced rather than assigned per vendor,
+  so evidence written before this release re-judges as `selector-only` and a CLI
+  that begins reporting a billed model is promoted with no code change.
+- `probe.py` gathers each CLI's own on-disk record of the request — codex through
+  the `thread.started` id that names its rollout, agy through the app data
+  directory prepared the way `run-gemini.sh` prepares it — and stores a digest of
+  the model-bearing lines beside the streams, so the judgement stays a pure
+  function that can re-judge an old sweep offline.
+- Grok probes accept the billed model only as an exact match or with the single
+  `-build` suffix the provider adds; a prefix test would let `grok-4.6-anything`
+  pass as `grok-4.6`.
+
+### Fixed
+
+- The overlay anchored vendor executables by paths written into
+  `build_overlay.py`, which drift out of use without failing: the live overlay
+  hashed claude `2.1.263` while every dispatch ran `2.1.266`, so eleven mappings
+  were verified against a binary that had not run in a day. Core evidence now
+  anchors the executable the runners resolve.
+- The last two mappings carrying `PRIOR:` references instead of probe evidence
+  were re-probed, so every signed mapping now has a descriptor a reader can open.
+- A failing codex probe recorded `exit-code: 1` and nothing else. Under
+  `exec --json` the refusal that ends a run is an stdout event, so the reason
+  never reached `unproven[]`.
+
+### Removed
+
+- The three `gpt-5.4-mini` mappings. The model passed its probe on 2026-09-07
+  and now returns HTTP 400 — "not supported when using Codex with a ChatGPT
+  account" — so those configurations move to `unproven[]` carrying that reason.
+  A signed overlay does not notice a lane dying upstream; only a re-probe does.
+  The overlay now holds 46 mappings and 9 unproven configurations.
+
+### Notes
+
+- The tier is reported and never enforced. Dispatch continues to turn on
+  `runtime_verified` alone, covered by a test asserting every decision is
+  byte-identical under all three tiers.
+- agy and grok update themselves in the background when invoked; agy's `cli.log`
+  records `auto_updater.go: Spawned background update process`. Overlay evidence
+  drift is a routine consequence of using a vendor rather than an operator
+  action, and per-vendor degradation is what keeps that from stopping work.
+
+## [0.42.5] - 2026-09-09
+
+### Fixed
+
+- One vendor's CLI upgrade refused every vendor's dispatch. Overlay evidence
+  compared in a single loop raised on the first mismatch, so an `agy`
+  1.1.27 -> 1.1.28 upgrade failed `load_registry` and returned
+  `invalid-policy-input` for codex, claude, and grok as well, although only the
+  seven gemini mappings depended on that binary. Evidence entries now take a
+  `vendor` tag; a tagged entry that drifts or disappears degrades only its own
+  vendor to `unknown-target-runtime`. Untagged evidence stays globally
+  fail-closed, and structural overlay checks stay hard failures.
+- `omnilane doctor` reported 19 passed, 0 failed while every dispatch was
+  refused. A new `transport-overlay` check loads the configured overlay, names
+  the offending file and vendor on failure, reports per-vendor verified counts,
+  and warns when a vendor has degraded.
+- `build_overlay.py` signed probes it never read. Six `claude-fable-5-1`
+  configurations had been unusable since 2026-09-07 because their probes hit a
+  quota refusal and were silently omitted. Probes now carry a per-vendor
+  `verdict`, non-passing probes are refused and recorded in the overlay's
+  `unproven[]`, and evidence predating the field is signed with a warning. The
+  six Fable configurations are listed in the probe table so their failures are
+  reported; a 2026-09-09 re-probe returned the same quota refusal, so they stay
+  unusable and `omnilane doctor` now says so.
+- A Claude CLI probe that requested an unknown `--effort` returned exit 0, no
+  error, the right `modelUsage`, and the expected token while silently using the
+  default effort. The verdict now fails that case, so a mapping cannot be
+  certified at the wrong effort tier.
+
+### Changed
+
+- `build_overlay.py` and `probe.py` moved from an untracked `.rollback` sweep
+  directory into `scripts/lib/` and take `--root`, so overlay rebuilds survive a
+  cleanup of that directory.
+
 ## [0.42.4] - 2026-09-07
 
 ### Fixed
@@ -886,7 +981,8 @@ work to the wrong model, and records the evidence behind the shipped defaults.
 - Initial shared routing table, cross-vendor dispatcher, runners, installer,
   and baseline lint fixes.
 
-[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.4...HEAD
+[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.5...HEAD
+[0.42.5]: https://github.com/Seraphim0916/omnilane/compare/v0.42.4...v0.42.5
 [0.42.4]: https://github.com/Seraphim0916/omnilane/compare/v0.42.3...v0.42.4
 [0.42.3]: https://github.com/Seraphim0916/omnilane/compare/v0.42.2...v0.42.3
 [0.42.2]: https://github.com/Seraphim0916/omnilane/compare/v0.42.1...v0.42.2

package/README.ja.md

@@ -521,6 +521,36 @@ work の別名ではありません。サービス管理など、work の境界
 
 </details>
 
+<details>
+<summary><b>ディスパッチが拒否されました。どの拒否ですか？</b></summary>
+
+<br/>
+
+3 つのコードには 3 つの異なる対処があります。まず `omnilane doctor` を実行して
+ください。その `transport-overlay` チェックが、問題はこのマシンの設定なのか
+リクエストなのかをすぐに示します。
+
+`missing-caller-context` — 呼び出し元の識別情報がありません。人間は
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` または `--operator-asserted-human` を
+使います。omnilane を動かすモデルは、正確なベンダー・モデル・effort を含む
+`--caller-context FILE` を渡し、人間向けの免除を自称してはいけません。
+
+`runtime-mapping-unverified` — 識別情報は正しく、**ターゲット**にホストローカルの
+リクエストセレクタの証明がありません。未プローブか、プローブが失敗しています。
+`omnilane doctor` がその件数を報告し、overlay の `unproven[]` に各失敗の理由が
+残ります。プロバイダーの利用上限による拒否は、その上限が解消するまで続きます。
+
+`invalid-policy-input` と "transport contract evidence changed" — 上記のいずれ
+でもありません。overlay 自体が読み込めないため、**すべてのベンダー**が拒否され
+ます。よくある原因はベンダー CLI の更新です。overlay は各ベンダーの実行ファイルと
+ランナースクリプトのハッシュを固定しており、Codex と Claude の証拠パスは
+バージョンディレクトリを含むため、更新ではダイジェストが変わるのではなく
+ファイルが消えます。タグ付きの証拠は自分のベンダーだけを降格させ、プローブ
+マニフェストのようなタグなしの証拠はゲート全体を閉じます。doctor がファイルと
+ベンダーを示し、再署名の手順はディスパッチスキルにあります。
+
+</details>
+
 ## 📊 デフォルト値と出典
 
 デフォルトのレーン割当は Artificial Analysis の 2026-07 スナップショット
@@ -543,6 +573,24 @@ work の別名ではありません。サービス管理など、work の境界
 
 ## 📜 リリース履歴
 
+## v0.42.6 の新機能
+
+- **「検証済み」が、どう検証されたかを示すようになりました。** 各 overlay マッピングは `evidence_tier` を持ちます。`billed-model` はプロバイダー自身が課金対象のモデル名を返した場合（claude、grok）、`client-echo` は CLI が自ら送信したモデルを記録した場合（codex、agy）、`selector-only` は CLI がセレクターを受け付けただけの場合です。`client-echo` は CLI が控えた注文書、`billed-model` はプロバイダーが発行した領収書です。
+- **報告するだけで、拒否はしません。** ディスパッチは従来どおり `runtime_verified` のみで判断するため、ティアが低くても動いていたレーンが拒否されることはありません。3 つのティアすべてで判定が変わらないことをテストで保証しています。
+- **ティアはベンダーではなく証拠に従います。** 本リリース以前のプローブは `selector-only` として再判定され、課金モデルを返すようになった CLI はコード変更なしに昇格します。
+- **`omnilane doctor` が内訳を表示**し、再プローブすべきベンダーを名指しします。
+- **overlay は実際に実行されるバイナリを固定します。** 従来はパスが `build_overlay.py` に直書きされ、使われていないバージョンを黙って指していました。実際には claude `2.1.266` が実行されているのに、overlay は `2.1.263` をハッシュしていました。
+- **失われた 3 レーンを検出。** `gpt-5.4-mini` は 2026-09-07 のプローブでは通っていましたが、現在は HTTP 400（ChatGPT アカウントの Codex では非対応）を返します。署名済みの overlay はレーンが上流で失われても気付きません。該当の 3 構成は理由付きで `unproven[]` に移り、マッピングは 46 件になりました。
+- **アップグレード。** npm 公開後は `npm i -g omnilane@0.42.6` を実行してください。
+
+## v0.42.5 の新機能
+
+- **1 つの CLI 更新が全ベンダーを止めることはなくなりました。** overlay の evidence に `vendor` タグを付与でき、タグ付きエントリのハッシュ差異やファイル消失は当該ベンダーのみを `unknown-target-runtime` に降格させます。タグなしの evidence は従来どおり全体を fail-closed にします。
+- **`omnilane doctor` が overlay を読み込みます。** 新しい `transport-overlay` チェックは失敗時に該当ファイルとベンダーを示し、成功時はベンダーごとの検証済みマッピング数を報告します。
+- **プローブが判定を記録します。** `probe.py` は課金された `modelUsage` で Claude の応答を判定し、CLI が不明な `--effort` を既定値へ黙って置き換えた場合を失敗とします。`build_overlay.py` は不合格のプローブに署名せず、overlay の `unproven[]` に記録します。
+- **再構築ツールをバージョン管理下へ。** `build_overlay.py` と `probe.py` は `scripts/lib/` に移り、`--root` を受け取ります。
+- **アップグレード。** npm 公開後は `npm i -g omnilane@0.42.5` を実行してください。
+
 ## v0.42.4 の新機能
 
 - **クイックスタートが実際に動くようになりました。** `omnilane route` は「誰が依頼しているか」を必要としますが、60 秒クイックスタートにその記載が無く、新規インストールでは案内無しに `missing-caller-context` で拒否されていました。今は `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` で人間の操作者を一度宣言し、モデル呼び出し元が代わりに渡すものも説明します。

package/README.ko.md

@@ -507,6 +507,36 @@ work 는 지정한 디렉터리 안의 변경만 허용하며 모델 연결은
 
 </details>
 
+<details>
+<summary><b>디스패치가 거부되었습니다. 어떤 거부인가요?</b></summary>
+
+<br/>
+
+세 가지 코드에는 각각 다른 해결책이 있습니다. 먼저 `omnilane doctor`를 실행하세요.
+`transport-overlay` 검사가 문제의 원인이 이 머신의 설정인지 요청인지 바로
+알려줍니다.
+
+`missing-caller-context` — 호출자 신원을 전달하지 않았습니다. 사람은
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 또는 `--operator-asserted-human`을
+사용합니다. omnilane을 구동하는 모델은 정확한 벤더·모델·effort가 담긴
+`--caller-context FILE`을 전달해야 하며, 사람용 면제를 스스로 주장해서는 안 됩니다.
+
+`runtime-mapping-unverified` — 신원은 정상이지만 **대상**에 검증된 호스트 로컬
+요청 셀렉터가 없습니다. 프로브를 한 적이 없거나 프로브가 실패한 경우입니다.
+`omnilane doctor`가 해당 구성의 개수를 보고하고, overlay의 `unproven[]`에 각
+실패 사유가 기록됩니다. 공급자 할당량 제한으로 인한 거부는 그 할당량이 회복될
+때까지 해소되지 않습니다.
+
+`invalid-policy-input`과 "transport contract evidence changed" — 위 둘 다
+아닙니다. overlay 자체가 로드되지 않아 **모든 벤더**가 거부됩니다. 흔한 원인은
+벤더 CLI 업그레이드입니다. overlay는 각 벤더의 실행 파일과 러너 스크립트 해시를
+고정하며, Codex와 Claude의 증거 경로에는 버전 디렉터리가 포함되어 업그레이드 시
+다이제스트가 바뀌는 대신 파일이 사라집니다. 태그가 있는 증거는 해당 벤더만
+강등시키고, 프로브 매니페스트처럼 태그가 없는 증거는 게이트 전체를 닫습니다.
+doctor가 파일과 벤더를 지목하며, 재서명 절차는 디스패치 스킬에 있습니다.
+
+</details>
+
 ## 📊 기본값과 출처
 
 기본 레인 배치는 Artificial Analysis 2026-07 스냅샷(AA 사이트 원본 레코드와
@@ -528,6 +558,24 @@ work 는 지정한 디렉터리 안의 변경만 허용하며 모델 연결은
 
 ## 📜 릴리스 기록
 
+## v0.42.6 새 기능
+
+- **"검증됨"이 어떻게 검증했는지도 알려줍니다.** 각 overlay 매핑은 `evidence_tier`를 가집니다. `billed-model`은 공급자가 과금한 모델을 직접 밝힌 경우(claude, grok), `client-echo`는 CLI가 자신이 보낸 모델을 기록한 경우(codex, agy), `selector-only`는 CLI가 셀렉터를 받아들이기만 한 경우입니다. `client-echo`는 CLI가 적어 둔 주문서이고, `billed-model`은 공급자가 발행한 영수증입니다.
+- **보고만 하고 막지 않습니다.** 디스패치는 여전히 `runtime_verified`만으로 결정되므로, 낮은 등급이 기존에 동작하던 레인을 거부하는 일은 없습니다. 세 등급 모두에서 판정이 동일함을 테스트로 보장합니다.
+- **등급은 공급업체가 아니라 증거를 따릅니다.** 이번 릴리스 이전의 프로브는 `selector-only`로 재판정되며, 과금 모델을 보고하기 시작한 CLI는 코드 변경 없이 승격됩니다.
+- **`omnilane doctor`가 분포를 표시**하고 다시 프로브할 공급업체를 지목합니다.
+- **overlay는 실제로 실행되는 바이너리를 고정합니다.** 기존에는 경로가 `build_overlay.py`에 하드코딩되어 사용되지 않는 버전을 조용히 가리켰습니다. 모든 디스패치가 claude `2.1.266`을 실행하는 동안 overlay는 `2.1.263`을 해시하고 있었습니다.
+- **죽은 레인 3개를 찾았습니다.** `gpt-5.4-mini`는 2026-09-07 프로브에서는 통과했지만 지금은 HTTP 400(ChatGPT 계정의 Codex에서는 미지원)을 반환합니다. 서명된 overlay는 레인이 상류에서 사라져도 알아차리지 못합니다. 해당 3개 구성은 이유와 함께 `unproven[]`으로 이동했고, 매핑은 46개가 되었습니다.
+- **업그레이드.** npm 게시 후 `npm i -g omnilane@0.42.6`를 실행하세요.
+
+## v0.42.5 새 기능
+
+- **CLI 하나를 업그레이드해도 모든 벤더가 막히지 않습니다.** overlay evidence 항목에 `vendor` 태그를 붙일 수 있으며, 태그가 있는 항목의 해시가 바뀌거나 파일이 사라지면 해당 벤더만 `unknown-target-runtime`으로 강등됩니다. 태그가 없는 evidence는 기존처럼 전체 fail-closed입니다.
+- **`omnilane doctor`가 overlay를 로드합니다.** 새 `transport-overlay` 검사는 실패 시 문제가 된 파일과 벤더를 지목하고, 성공 시 벤더별 검증된 매핑 수를 보고합니다.
+- **프로브가 판정을 기록합니다.** `probe.py`는 청구된 `modelUsage`로 Claude 응답을 판정하며, CLI가 알 수 없는 `--effort`를 기본값으로 조용히 대체한 경우를 실패로 처리합니다. `build_overlay.py`는 통과하지 못한 프로브에 서명하지 않고 overlay의 `unproven[]`에 기록합니다.
+- **재빌드 도구를 버전 관리로.** `build_overlay.py`와 `probe.py`는 `scripts/lib/`로 옮겼고 `--root`를 받습니다.
+- **업그레이드.** npm 게시 후 `npm i -g omnilane@0.42.5`를 실행하세요.
+
 ## v0.42.4 새 기능
 
 - **퀵스타트가 실제로 동작합니다.** `omnilane route` 는 «누가 요청하는지»를 알아야 하지만 60초 시작에 그 내용이 없어, 새 설치에서는 안내 없이 `missing-caller-context` 로 거부되었습니다. 이제 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 로 사람 운영자를 한 번 선언하며, 모델 호출자가 대신 전달할 것도 설명합니다.

package/README.md

@@ -379,6 +379,7 @@ omnilane ui status                             # report whether the Live UI is r
 omnilane ui url                                # print the current authenticated local URL
 omnilane ui stop                               # stop the Live UI
 omnilane doctor [--json] [--strict] [--probe V] [--probe-timeout SEC]  # live probe is opt-in
+                                               # transport-overlay check names a stale vendor
 omnilane benchmark [--json] [--run] [--vendor V] [--cost-per-call V=USD] # dry-run by default
 dispatch.sh [--background] [--dry-run] [--thread NAME] [--mode advise|work|sysops] [--workdir DIR]
             [--vendor V] [--model M] [--effort E] [--timeout SEC] [--job-timeout SEC]
@@ -615,6 +616,66 @@ so one command can never spiral into a chain of agents spending your quota.
 
 </details>
 
+<details>
+<summary><b>My dispatch was refused. Which refusal is it?</b></summary>
+
+<br/>
+
+Three codes, three different fixes. Run `omnilane doctor` first — its
+`transport-overlay` check tells you immediately whether the problem is your
+machine's configuration or your request.
+
+`missing-caller-context` — you passed no identity. A human adds
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` or `--operator-asserted-human`; a model
+driving omnilane writes a `--caller-context FILE` with its exact vendor, model,
+and effort, and must not assert the human exemption for itself.
+
+`runtime-mapping-unverified` — your identity is fine, but the *target* has no
+proven host-local request selector. Either it was never probed, or its probe
+failed; `omnilane doctor` reports the count of such configurations and the
+overlay's `unproven[]` records why each one failed. A refusal caused by a
+provider quota limit will not clear until that quota does.
+
+`invalid-policy-input` with "transport contract evidence changed" — neither of
+the above. The overlay itself will not load, so *every* vendor is refused. The
+usual cause is a vendor CLI upgrade: the overlay pins each vendor's executable
+and runner-script hash, and Codex and Claude evidence paths embed version
+directories, so an upgrade removes the file rather than changing its digest.
+Tagged evidence degrades only its own vendor; untagged evidence, such as the
+probe manifest, still closes the whole gate. Doctor names the file and the
+vendor; the dispatch skill carries the re-signing runbook.
+
+</details>
+
+<details>
+<summary><b>What does my mapping's evidence tier mean?</b></summary>
+
+<br/>
+
+It says how strongly the probe pinned down who answered. It does not affect
+whether you can dispatch.
+
+`billed-model` — the provider named the model it charged for. Claude reports it
+in `modelUsage`; grok reports it the same way under `--output-format json`. This
+is the provider's receipt.
+
+`client-echo` — the CLI wrote down the model it asked for, and that record
+matches your request. Codex keeps it in the session rollout; agy writes it to
+`cli.log`. This is the CLI's copy of your order, not the provider's receipt: it
+proves the request left as intended, not who served it.
+
+`selector-only` — the CLI accepted the selector and reported nothing further.
+Every mapping probed before v0.42.6 reads this way. It still dispatches; it is
+simply the weakest of the three, and `omnilane doctor` names the vendors worth
+re-probing.
+
+None of the three certifies upstream provider identity, and none of them can
+refuse a lane. The tier is derived from what a probe produced rather than from
+the vendor, so a CLI that starts reporting a billed model is promoted on its
+next sweep with no change to omnilane.
+
+</details>
+
 ## 📊 Defaults and provenance
 
 Default lane assignments follow Artificial Analysis coding/intelligence data
@@ -638,6 +699,24 @@ working notes, including per-benchmark caveats, live in
 
 ## 📜 Release history
 
+## What's new in v0.42.6
+
+- **A verified mapping now says how it was verified.** Each overlay mapping carries an `evidence_tier`: `billed-model` when the provider named the model it charged for (Claude, grok), `client-echo` when the CLI recorded the model it asked for (codex, agy), `selector-only` when the CLI accepted the selector and said nothing more. `client-echo` is the CLI's copy of your order; `billed-model` is the provider's receipt.
+- **Reported, never enforced.** Dispatch still turns on `runtime_verified` alone, so a weaker tier never refuses a lane that used to run. A test asserts every decision is unchanged under all three tiers.
+- **The tier follows the evidence, not the vendor.** A sweep predating this release re-judges as `selector-only`, and a CLI that begins reporting a billed model is promoted with no code change.
+- **`omnilane doctor` shows the spread** and names the vendors worth re-probing.
+- **Overlay evidence anchors the binary that runs.** Paths were written into `build_overlay.py` and drifted out of use silently — the live overlay hashed claude `2.1.263` while every dispatch ran `2.1.266`. Core evidence now resolves the executable the runners resolve.
+- **Three dead lanes found.** `gpt-5.4-mini` passed its probe on 2026-09-07 and now returns HTTP 400 — "not supported when using Codex with a ChatGPT account". A signed overlay never notices a lane dying upstream; the re-probe did. Those three configurations move to `unproven[]` with that reason attached, leaving 46 mappings.
+- **Upgrade.** After npm publication, run `npm i -g omnilane@0.42.6`. Existing repo-symlink installations can update their checkout and verify `omnilane --version` without rerunning installation.
+
+## What's new in v0.42.5
+
+- **One CLI upgrade no longer refuses every vendor.** Overlay evidence entries take a `vendor` tag; a tagged entry whose hash drifts or whose file has disappeared degrades only that vendor to `unknown-target-runtime`. Untagged evidence stays globally fail-closed.
+- **`omnilane doctor` loads the overlay.** A new `transport-overlay` check names the offending file and vendor on failure and reports per-vendor verified counts on success — an all-green doctor could previously coexist with a gate refusing every dispatch.
+- **Probes record a verdict.** `probe.py` judges Claude responses on the billed `modelUsage` and fails a run where the CLI silently substituted the default effort for an unknown `--effort`. `build_overlay.py` refuses to sign a non-passing probe and records it in the overlay's `unproven[]` instead of dropping it silently.
+- **Rebuild tooling is versioned.** `build_overlay.py` and `probe.py` live in `scripts/lib/` and take `--root`.
+- **Upgrade.** After npm publication, run `npm i -g omnilane@0.42.5`. Existing repo-symlink installations can update their checkout and verify `omnilane --version` without rerunning installation.
+
 ## What's new in v0.42.4
 
 - **The quickstart actually runs now.** `omnilane route` needs to know who is asking; the 60-second start omitted that, so a fresh install hit `missing-caller-context` with no guidance. It now asserts the human operator once with `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1`, and explains what a model caller passes instead.

package/README.zh-CN.md

@@ -481,6 +481,57 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 
 </details>
 
+<details>
+<summary><b>派工被拒了，是哪一种拒绝？</b></summary>
+
+<br/>
+
+三个代码，三种不同的修法。先运行 `omnilane doctor`——它的 `transport-overlay`
+检查会直接告诉你问题出在本机配置还是你的请求。
+
+`missing-caller-context`——你没带身份。真人加上
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`；
+模型驱动 omnilane 时要写一份 `--caller-context FILE`，包含它精确的厂商、模型与
+强度，且不得替自己主张真人豁免。
+
+`runtime-mapping-unverified`——你的身份没问题，但**目标**没有已验证的本机请求
+选择器。可能从未探测过，也可能探测失败；`omnilane doctor` 会报告这类配置的数量，
+overlay 的 `unproven[]` 记录每一条失败的原因。因供应商额度上限造成的拒绝，
+在额度恢复前不会自行解除。
+
+`invalid-policy-input` 搭配 "transport contract evidence changed"——以上皆非。
+是 overlay 本身加载失败，因此**所有厂商**都会被拒。常见成因是厂商 CLI 升级：
+overlay 钉住每家的可执行文件与 runner 脚本哈希，而 Codex 与 Claude 的证据路径
+内嵌版本目录，升级后是文件消失而非哈希改变。带标签的证据只降级自己那一家；
+未标签的证据（例如探测清单）仍会关闭整个闸门。doctor 会指出文件与厂商，
+重签流程写在派工技能里。
+
+</details>
+
+<details>
+<summary><b>映射上的证据等级是什么意思？</b></summary>
+
+<br/>
+
+它说明这次探测把「谁回答的」钉到多紧。它**不影响**你能不能派工。
+
+`billed-model`——供应商自己说出它计费的模型。claude 放在 `modelUsage`；
+grok 在 `--output-format json` 下也一样。这是供应商开的收据。
+
+`client-echo`——CLI 记下自己送出的模型，而且那笔记录与你的请求相符。
+codex 记在 session rollout，agy 写进 `cli.log`。这是 CLI 自己抄的订单，
+不是收据：它证明请求照原样送出去了，不能证明是谁接的。
+
+`selector-only`——CLI 收下选择器，其余不表态。v0.42.6 之前探测的每一条映射
+都是这一级。它照样能派工，只是三级里最弱的一级；`omnilane doctor` 会点名
+哪几家值得重探。
+
+三者都不能证明上游供应商身分，也都不会让任何车道被拒。等级是从探测产出的
+东西推导出来的，不是按厂商指定，所以哪支 CLI 开始汇报计费模型，下一次重探
+就会自动升级，omnilane 不用改。
+
+</details>
+
 ## 📊 默认值与数据来源
 
 默认通道配置依据 Artificial Analysis 2026-07 快照(已对 AA 站上原始记录与
@@ -503,6 +554,24 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 
 ## 📜 版本历程
 
+## v0.42.6 新功能
+
+- **「已验证」现在会说明是怎么验的。** 每条 overlay 映射带一个 `evidence_tier`：`billed-model` 是供应商自己说出计费的模型（claude、grok），`client-echo` 是 CLI 记下自己送出的模型（codex、agy），`selector-only` 是 CLI 收下选择器、其余不表态。`client-echo` 是 CLI 自己抄的订单，`billed-model` 是供应商开的收据。
+- **只汇报，不拦截。** 派工照旧只看 `runtime_verified`，等级低不会让原本跑得动的车道被拒。已有测试确认三种等级下每个判定都不变。
+- **等级跟着证据走，不跟着厂商走。** 本次发布之前的探测会重判为 `selector-only`；哪天某支 CLI 开始汇报计费模型，不改代码就自动升级。
+- **`omnilane doctor` 显示分布**，并点名哪几家值得重探。
+- **overlay 锚定的是真正在跑的可执行文件。** 过去路径写死在 `build_overlay.py` 里，会无声地锚到没在用的版本——线上 overlay 哈希的是 claude `2.1.263`，但每次派工跑的都是 `2.1.266`。
+- **抓到三条已死的车道。** `gpt-5.4-mini` 在 2026-09-07 探测还会过，现在回 HTTP 400——「ChatGPT 账号使用 Codex 时不支持此模型」。签好的 overlay 永远不会发现某条车道在上游死掉，重探才会。那三条移进 `unproven[]` 并附上原因，映射剩 46 条。
+- **升级。** npm 发布后运行 `npm i -g omnilane@0.42.6`。既有的 repo symlink 安装更新检出后确认 `omnilane --version` 即可。
+
+## v0.42.5 新功能
+
+- **升级一支 CLI 不再阻断所有厂商。** overlay 的证据项目可带 `vendor` 标签；带标签的项目哈希漂移或文件消失时，只让该厂商降级为 `unknown-target-runtime`。未标签的证据维持全局 fail-closed。
+- **`omnilane doctor` 会加载 overlay。** 新增 `transport-overlay` 检查，失败时指出是哪个文件、哪一家厂商，成功时报告各厂商的已验证映射数。
+- **探测会记录判定。** `probe.py` 以计费的 `modelUsage` 判断 Claude 响应，并在 CLI 静默改用默认强度时判为失败。`build_overlay.py` 拒签未通过的探测，改记入 overlay 的 `unproven[]`。
+- **重建工具纳入版本控制。** `build_overlay.py` 与 `probe.py` 移入 `scripts/lib/`，并接受 `--root`。
+- **升级。** npm 发布后运行 `npm i -g omnilane@0.42.5`。既有的 repo symlink 安装更新检出后确认 `omnilane --version` 即可。
+
 ## v0.42.4 新功能
 
 - **快速上手现在真的跑得起来。** `omnilane route` 必须知道「是谁在问」,但 60 秒上手漏了这件事,新安装照抄会直接吃到 `missing-caller-context` 且没有任何指引。现在会先用 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 表明操作者身分,并说明模型主控该改用什么。

package/README.zh-TW.md

@@ -525,6 +525,57 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析後的計畫,
 
 </details>
 
+<details>
+<summary><b>派工被拒了，是哪一種拒絕？</b></summary>
+
+<br/>
+
+三個代碼，三種不同的修法。先跑 `omnilane doctor`——它的 `transport-overlay`
+檢查會直接告訴你問題出在本機設定還是你的請求。
+
+`missing-caller-context`——你沒帶身分。真人加上
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`；
+模型驅動 omnilane 時要寫一份 `--caller-context FILE`，內含它精確的廠商、模型與
+強度，且不得替自己主張真人豁免。
+
+`runtime-mapping-unverified`——你的身分沒問題，但**目標**沒有已驗證的本機請求
+選擇器。可能從未探測過，也可能探測失敗；`omnilane doctor` 會回報這類設定的數量，
+overlay 的 `unproven[]` 記錄每一條失敗的原因。因供應商額度上限造成的拒絕，
+在額度恢復前不會自行解除。
+
+`invalid-policy-input` 搭配 "transport contract evidence changed"——以上皆非。
+是 overlay 本身載不起來，因此**所有廠商**都會被拒。常見成因是廠商 CLI 升級：
+overlay 釘住每家的執行檔與 runner 腳本雜湊，而 Codex 與 Claude 的證據路徑內嵌
+版本目錄，升級後是檔案消失而非雜湊改變。帶標籤的證據只降級自己那一家；
+未標籤的證據（例如探測清單）仍會關閉整個閘門。doctor 會指名檔案與廠商，
+重簽流程寫在派工技能裡。
+
+</details>
+
+<details>
+<summary><b>映射上的證據等級是什麼意思？</b></summary>
+
+<br/>
+
+它說明這次探測把「誰回答的」釘到多緊。它**不影響**你能不能派工。
+
+`billed-model`——供應商自己說出它計費的模型。claude 放在 `modelUsage`；
+grok 在 `--output-format json` 下也一樣。這是供應商開的收據。
+
+`client-echo`——CLI 記下自己送出的模型，而且那筆紀錄與你的請求相符。
+codex 記在 session rollout，agy 寫進 `cli.log`。這是 CLI 自己抄的訂單，
+不是收據：它證明請求照原樣送出去了，不能證明是誰接的。
+
+`selector-only`——CLI 收下選擇器，其餘不表態。v0.42.6 之前探測的每一條映射
+都是這一級。它照樣能派工，只是三級裡最弱的一級；`omnilane doctor` 會點名
+哪幾家值得重探。
+
+三者都不能證明上游供應商身分，也都不會讓任何車道被拒。等級是從探測產出的
+東西推導出來的，不是按廠商指定，所以哪支 CLI 開始回報計費模型，下一次重探
+就會自動升級，omnilane 不用改。
+
+</details>
+
 ## 📊 預設值與資料來源
 
 預設通道配置依據 Artificial Analysis 2026-07 快照(已對 AA 站上原始紀錄與
@@ -544,6 +595,24 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析後的計畫,
 
 ## 📜 版本歷程
 
+## v0.42.6 新功能
+
+- **「已驗證」現在會說明是怎麼驗的。** 每條 overlay 映射帶一個 `evidence_tier`：`billed-model` 是供應商自己說出計費的模型（claude、grok），`client-echo` 是 CLI 記下自己送出的模型（codex、agy），`selector-only` 是 CLI 收下選擇器、其餘不表態。白話說：`client-echo` 是 CLI 自己抄的訂單，`billed-model` 是供應商開的收據。
+- **只回報，不擋人。** 派工照舊只看 `runtime_verified`，等級低不會讓原本跑得動的車道被拒。已有測試確認三種等級下每個判定都不變。
+- **等級跟著證據走，不跟著廠商走。** 本次發布之前的探測會重判為 `selector-only`；哪天某支 CLI 開始回報計費模型，不改程式就自動升級。
+- **`omnilane doctor` 顯示分佈**，並點名哪幾家值得重探。
+- **overlay 錨定的是真正在跑的執行檔。** 過去路徑寫死在 `build_overlay.py` 裡，會無聲地錨到沒在用的版本——線上 overlay 雜湊的是 claude `2.1.263`，但每次派工跑的都是 `2.1.266`。現在改用 runner 實際解析到的執行檔。
+- **抓到三條已死的車道。** `gpt-5.4-mini` 在 2026-09-07 探測還會過，現在回 HTTP 400——「ChatGPT 帳號使用 Codex 時不支援此模型」。簽好的 overlay 永遠不會發現某條車道在上游死掉，重探才會。那三條移進 `unproven[]` 並附上原因，映射剩 46 條。
+- **升級。** npm 發布後執行 `npm i -g omnilane@0.42.6`。既有的 repo symlink 安裝更新檢出後確認 `omnilane --version` 即可，不需重跑安裝。
+
+## v0.42.5 新功能
+
+- **升級一支 CLI 不再擋掉所有廠商。** overlay 的證據項目可帶 `vendor` 標籤；帶標籤的項目雜湊漂移或檔案消失時，只讓該廠商降級為 `unknown-target-runtime`。未標籤的證據維持全域 fail-closed。
+- **`omnilane doctor` 會載入 overlay。** 新增 `transport-overlay` 檢查，失敗時指名是哪個檔案、哪一家廠商，成功時回報各廠商的已驗證映射數——先前 doctor 全綠可以和「閘門拒絕所有派工」同時成立。
+- **探測會記錄判定。** `probe.py` 以計費的 `modelUsage` 判斷 Claude 回應，並在 CLI 靜默改用預設強度時判為失敗。`build_overlay.py` 拒簽未通過的探測，改記進 overlay 的 `unproven[]`，不再無聲丟棄。
+- **重建工具納入版控。** `build_overlay.py` 與 `probe.py` 移入 `scripts/lib/`，並接受 `--root`。
+- **升級。** npm 發布後執行 `npm i -g omnilane@0.42.5`。既有的 repo symlink 安裝更新檢出後確認 `omnilane --version` 即可，不需重跑安裝。
+
 ## v0.42.4 新功能
 
 - **快速上手現在真的跑得起來。** `omnilane route` 必須知道「是誰在問」,但 60 秒上手漏了這件事,新安裝照抄會直接吃到 `missing-caller-context` 且沒有任何指引。現在會先用 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 表明操作者身分,並說明模型主控該改用什麼。

package/VERSION

@@ -1 +1 @@
-0.42.4
+0.42.5

package/docs/release-notes-0.42.5.md

@@ -0,0 +1,99 @@
+# Omnilane 0.42.5
+
+This release stops one vendor's CLI upgrade from refusing every vendor's dispatch,
+makes that failure visible in `omnilane doctor`, and stops the probe harness from
+signing evidence it never read. Routing, scores, and the frozen AA registry are
+unchanged.
+
+## Why
+
+On 2026-09-09 `agy` was upgraded from 1.1.27 to 1.1.28. That changed its sha256,
+and `apply_transport_overlay` compared every evidence hash in one loop and raised
+on the first mismatch, so `load_registry` failed and **every** dispatch was
+refused:
+
+```json
+{"allowed":false,"code":"invalid-policy-input","message":"transport contract evidence changed"}
+```
+
+Only the seven gemini mappings depended on that binary; the other forty-two were
+collateral. `omnilane doctor` reported 19 passed, 0 failed throughout, because no
+check ever loaded the overlay.
+
+Re-probing showed the upgrade had changed nothing observable: all six agy
+selectors still answered correctly. The outage was entirely the blast radius of a
+config linter that had been given the authority of a security gate.
+
+The same investigation found six `claude-fable-5-1` configurations that had been
+unusable since 2026-09-07. Their probes had failed with a quota refusal, and
+`build_overlay.py` simply omitted them — no record, no warning, nothing for an
+operator to notice.
+
+## Changes
+
+### Evidence staleness is per vendor
+
+- Overlay `evidence[]` entries take an optional `vendor` tag. A tagged entry whose
+  hash drifts, or whose file no longer exists, marks that vendor stale and skips
+  the `verified` upgrade for its mappings; `decide()` then returns
+  `unknown-target-runtime` for that vendor alone.
+- Untagged entries keep the previous global fail-closed behaviour, so overlays
+  built before the tags exist are unaffected.
+- Missing files are treated as staleness, not corruption: the codex and claude
+  evidence paths embed version directories, so their upgrades delete the file
+  rather than change its digest.
+- Structural overlay checks — schema, snapshot, host, exact identity, selector
+  type, effort alignment — remain hard failures.
+
+### Doctor loads the overlay
+
+- A new `transport-overlay` check loads the configured overlay through
+  `aa_policy.load_registry` and names the offending file and vendor on failure.
+  It reports per-vendor verified counts on success and warns when a vendor has
+  degraded. `live-capable` is unchanged: it answers whether a CLI supports a live
+  session, which stays true while the gate refuses the vendor.
+
+### Probes record a verdict
+
+- `probe.py` now derives a `verdict`, `verdict_reason`, `observed_model`, and
+  `probed_at` from the raw evidence through a pure function, per vendor:
+  - Claude responses are judged on `modelUsage` — the billed model the CLI
+    reports — plus `is_error`, and are failed when stderr shows the CLI silently
+    substituted the default effort for an unknown `--effort`. Effort is half of a
+    scored identity, so that path would otherwise certify a mapping at the wrong
+    tier while exit status, `is_error`, `modelUsage`, and the expected token all
+    look correct.
+  - grok and agy reject invalid input outright, so exit status and a clean stderr
+    are sufficient.
+  - codex prints a banner to stderr on every run, so stderr is recorded for review
+    rather than treated as failure.
+- `build_overlay.py` refuses to sign a non-passing probe and records it in a new
+  `unproven[]` block with its reason, so a quota refusal is visible instead of
+  silently dropping configurations. Evidence predating the verdict field is
+  still signed, with a warning naming each legacy entry.
+- The six `claude-fable-5-1` and `claude-fable-5` configurations are listed in
+  the probe table so their failures reach `unproven[]`. Re-probing them on
+  2026-09-09 returned the same quota refusal as on 09-07, so they remain
+  unusable — but `omnilane doctor` now says so rather than leaving an operator
+  to discover it from a refused dispatch.
+- `build_overlay.py` and `probe.py` moved from an untracked `.rollback` sweep
+  directory into `scripts/lib/`, and take `--root`; overlay rebuilds no longer
+  depend on a directory that a cleanup can delete.
+
+## Verification boundary
+
+A passing probe proves the CLI accepted the selector and, for Claude, that the
+billed model matches the request. It still does not certify upstream provider
+identity, and `upstream_identity_verified` remains `false`. grok, agy, and codex
+expose no equivalent of `modelUsage` in the evidence captured so far.
+
+The frozen AA registry and its approved SHA are unchanged. Coverage remains 78
+scored targets, and the host overlay still verifies 49 mappings — codex 26,
+claude 11, gemini 7, grok 5.
+
+## Upgrade
+
+Existing overlays keep working untouched. To gain per-vendor degradation, rebuild
+the overlay with the new `build_overlay.py` so its evidence carries vendor tags.
+Run `omnilane doctor` afterwards and confirm the `transport-overlay` check reports
+the vendor counts you expect.