omnilane 0.42.4 → 0.42.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.4",
+  "version": "0.42.6",
   "description": "One routing table, every harness — classify subtasks into lanes and delegate each lane through a compatible caller-owned native agent or vendor CLI.",
   "bin": {
     "omnilane": "bin/omnilane"
@@ -29,7 +29,7 @@
     "docs/model-capabilities-2026-09.md",
     "docs/native-executor.md",
     "docs/completion-wakeup.md",
-    "docs/release-notes-0.42.4.md",
+    "docs/release-notes-0.42.5.md",
     "hooks/",
     "skills/",
     ".claude-plugin/",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.42.4",
+  "version": "0.42.6",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/scripts/doctor.sh

@@ -33,6 +33,7 @@ REPO="${OMNILANE_DOCTOR_REPO:-$SCRIPT_ROOT}"
 OMNILANE_HOME="${OMNILANE_HOME:-$HOME/.omnilane}"
 PROBE_SCRIPT="${OMNILANE_PROVIDER_PROBE_SCRIPT:-$REPO/scripts/provider-probe.sh}"
 GOAL_LOOP="${OMNILANE_DOCTOR_GOAL_LOOP:-$REPO/scripts/lib/goal-loop.sh}"
+OVERLAY_HEALTH="${OMNILANE_DOCTOR_OVERLAY_HEALTH:-$REPO/scripts/lib/overlay_health.py}"
 # shellcheck disable=SC1091
 source "$SCRIPT_ROOT/scripts/lib/live-protocol.sh"
 PASS_COUNT=0
@@ -409,6 +410,31 @@ else
   report PASS live-unavailable "none"
 fi
 
+# live-capable above answers "does this CLI support a live session", which stays
+# true while the AA gate refuses every dispatch. Nothing else loads the overlay,
+# so one drifted evidence hash used to go unreported by an all-green doctor.
+overlay_path="$(
+  set +u
+  [[ -f "$OMNILANE_HOME/local.sh" ]] && . "$OMNILANE_HOME/local.sh" 2>/dev/null
+  printf '%s' "${OMNILANE_AA_TRANSPORT_OVERLAY:-}"
+)"
+if [[ -z "$overlay_path" ]]; then
+  report PASS transport-overlay "no overlay configured; every runtime mapping stays unverified"
+elif ! command -v python3 >/dev/null 2>&1; then
+  report WARN transport-overlay "python3 is absent; cannot load the AA transport overlay"
+elif [[ ! -r "$OVERLAY_HEALTH" ]]; then
+  report WARN transport-overlay "$OVERLAY_HEALTH is missing"
+else
+  overlay_line="$(OMNILANE_AA_TRANSPORT_OVERLAY="$overlay_path" \
+    python3 "$OVERLAY_HEALTH" "$REPO" 2>&1)"
+  overlay_level="${overlay_line%%	*}"
+  overlay_message="${overlay_line#*	}"
+  case "$overlay_level" in
+    PASS|WARN|FAIL) report "$overlay_level" transport-overlay "$overlay_message" ;;
+    *) report WARN transport-overlay "unreadable overlay health output: $overlay_line" ;;
+  esac
+fi
+
 if [[ -n "$PROBE_VENDOR" ]]; then
   if [[ ! -x "$PROBE_SCRIPT" ]]; then
     report FAIL provider-probe "probe runner is unavailable"

package/scripts/lib/aa_policy.py

@@ -28,6 +28,11 @@ MAX_BYTES = 1_048_576
 APPROVED_REGISTRY_SHA256 = "0782c87de123c02738c3ff60e4bc3c1cc10d110113e872b8f8627212861cdaab"
 
 IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
+TRANSPORT_EVIDENCE_VENDORS = frozenset(("codex", "claude", "grok", "gemini"))
+# How strongly a mapping's probe identified the responder. Reported, never
+# enforced: dispatch turns on runtime_verified alone, as it did before the field
+# existed, so a weaker tier can never refuse a lane that used to run.
+TRANSPORT_EVIDENCE_TIERS = frozenset(("billed-model", "client-echo", "selector-only"))
 IDENTIFIER = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}\Z")
 
 
@@ -147,15 +152,37 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
     _check(overlay.get("schema_version") == 1, "unsupported transport overlay")
     _check(overlay.get("snapshot_id") == registry["snapshot"]["id"], "transport overlay snapshot mismatch")
     _check(overlay.get("host") == socket.gethostname(), "transport overlay host mismatch")
+    stale_vendors: set[str] = set()
     for evidence in overlay.get("evidence", []):
-        fd = os.open(evidence["path"], os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        _check(isinstance(evidence, dict), "invalid transport evidence")
+        vendor = evidence.get("vendor")
+        _check(
+            "vendor" not in evidence
+            or type(vendor) is str and vendor in TRANSPORT_EVIDENCE_VENDORS,
+            "invalid transport evidence vendor",
+        )
+        evidence_path = evidence["path"]
+        evidence_sha256 = evidence["sha256"]
+        _check(type(evidence_path) is str, "invalid transport evidence path")
+        _check(type(evidence_sha256) is str, "invalid transport evidence digest")
+        try:
+            fd = os.open(evidence_path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+        except FileNotFoundError:
+            if vendor is None:
+                raise
+            stale_vendors.add(vendor)
+            continue
         with os.fdopen(fd, "rb") as stream:
             _check(stat.S_ISREG(os.fstat(stream.fileno()).st_mode), "invalid transport evidence file")
             digest_file = hashlib.sha256()
             for block in iter(lambda: stream.read(1024 * 1024), b""):
                 digest_file.update(block)
-        _check(digest_file.hexdigest() == evidence["sha256"], "transport contract evidence changed")
+        if digest_file.hexdigest() != evidence_sha256:
+            if vendor is None:
+                _check(False, "transport contract evidence changed")
+            stale_vendors.add(vendor)
     _check(bool(overlay.get("evidence")), "transport overlay requires local evidence")
+    tiers: dict[str, str] = {}
     for mapping in overlay.get("mappings", []):
         rows = [row for row in registry["scored_configs"] if row["id"] == mapping.get("config_id")]
         _check(len(rows) == 1, "unknown overlay config")
@@ -175,6 +202,11 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             _check(mapping["runtime_model"].endswith("-" + row["effort"]), "encoded effort does not match exact tuple")
         else:
             _check(mapping.get("runtime_model") == row["model"], "overlay model mismatch")
+        tier = mapping.get("evidence_tier", "selector-only")
+        _check(tier in TRANSPORT_EVIDENCE_TIERS, "unknown transport evidence tier")
+        if row["vendor"] in stale_vendors:
+            continue
+        tiers[row["id"]] = tier
         row["transport_mapping"].update(
             status="verified", runtime_verified=True,
             runtime_model=mapping["runtime_model"], runtime_effort=mapping["runtime_effort"],
@@ -183,6 +215,8 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             verification="request-selector-contract", upstream_identity_verified=False,
             overlay_sha256=digest, overlay_host=overlay["host"],
         )
+    registry["_stale_transport_vendors"] = sorted(stale_vendors)
+    registry["_transport_evidence_tiers"] = tiers
 
 
 def load_registry(path: str | Path, expected_sha256: str | None = None) -> tuple[dict[str, Any], str]:
@@ -233,6 +267,8 @@ def _runtime_target(registry: dict[str, Any], vendor: str, model: str,
     exact_id = [row for row in registry["scored_configs"] if row["id"] == target_config] if target_config else registry["scored_configs"]
     if target_config and not exact_id:
         return None, "unknown-target-config", {"target_config": target_config}
+    if vendor in registry.get("_stale_transport_vendors", []):
+        return None, "unknown-target-runtime", {"vendor": vendor, "model": model, "effort": effort}
     vendor_rows = [row for row in exact_id if row["vendor"] == vendor]
     candidates: list[dict[str, Any]] = []
     unresolved: list[str] = []

package/scripts/lib/build_overlay.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Build the merged omnilane AA transport overlay from verified probe evidence.
+
+Only (config_id, selector) pairs listed in PROVEN are written. Every entry here
+corresponds to a probe run under the selected evidence root whose raw
+stdout/stderr is hashed into the manifest, so the overlay's evidence[] anchors
+the whole set.
+"""
+import argparse
+import hashlib
+import json
+import os
+import shutil
+import socket
+from collections import Counter
+from datetime import datetime, timezone
+from pathlib import Path
+
+REPO = Path(os.environ.get("OMNILANE_REPO", "/Users/vincentw/dev/omnilane"))
+HOME = Path.home()
+SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
+DEFAULT_ROOT = HOME / ".omnilane" / "transport-evidence" / SWEEP_ID
+REGISTRY = json.loads((REPO / "config/aa-model-policy.json").read_text())
+ROWS = {r["id"]: r for r in REGISTRY["scored_configs"]}
+IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
+
+# config_id -> (selector_type, runtime_model, probe evidence basename)
+PROVEN: dict[str, tuple[str, str, str]] = {}
+
+for model, slug in [("gpt-6-astra", "gpt-6-astra"), ("gpt-5.6-sol", "gpt-5_6-sol"),
+                    ("gpt-5.6-luna", "gpt-5_6-luna"), ("gpt-5.6-terra", "gpt-5_6-terra")]:
+    base = model.replace(".", "-").replace("gpt-", "gpt-")
+    for effort in ["max", "xhigh", "high", "medium", "low"]:
+        cid = f"codex/{model.replace('.', '-')}" + ("" if effort == "max" else f"-{effort}")
+        ev = f"cx-avail-{model.replace('.', '_')}" if effort == "high" else f"cx-{model.replace('.', '_')}-{effort}"
+        PROVEN[cid] = ("model_and_effort", model, ev)
+
+for effort in ["xhigh", "medium"]:
+    PROVEN[f"codex/gpt-5-4-mini" + ("" if effort == "xhigh" else f"-{effort}")] = (
+        "model_and_effort", "gpt-5.4-mini", f"cx-gpt-5_4-mini-{effort}")
+
+PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "gk-grok-4_6-high")
+for effort in ["xhigh", "medium", "low"]:
+    PROVEN[f"grok/grok-4-6-{effort}"] = ("cli_reasoning_effort", "grok-4.6", f"gk-grok-4_6-{effort}")
+PROVEN["grok/grok-4-5"] = ("cli_reasoning_effort", "grok-4.5", "gk-grok-4_5-high")
+
+for cid, rid, ev in [
+    ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "agy-gemini-3_8-flash-high"),
+    ("gemini/gemini-3-8-flash-medium", "gemini-3.8-flash-medium", "agy-gemini-3_8-flash-medium"),
+    ("gemini/gemini-3-8-flash-low", "gemini-3.8-flash-low", "agy-gemini-3_8-flash-low"),
+    ("gemini/gemini-3-7-flash", "gemini-3.7-flash-high", "agy-gemini-3_7-flash-high"),
+    ("gemini/gemini-3-7-flash-medium", "gemini-3.7-flash-medium", "agy-gemini-3_7-flash-medium"),
+    ("gemini/gemini-3-7-flash-low", "gemini-3.7-flash-low", "agy-gemini-3_7-flash-low"),
+    ("gemini/gemini-3-6-flash", "gemini-3.6-flash-high", "agy-gemini-3_6-flash-high"),
+]:
+    PROVEN[cid] = ("model_id_encoded_effort", rid, ev)
+
+for effort in ["max", "xhigh", "high", "medium", "low"]:
+    cid = "claude/claude-opus-5" + ("" if effort == "max" else f"-{effort}")
+    PROVEN[cid] = ("model_and_effort", "claude-opus-5", f"cl-claude-opus-5-{effort}")
+# gpt-6-astra rejects effort "none" upstream ("Unsupported value: 'none' is not
+# supported with the 'gpt-6-astra' model"), so it has no non-reasoning selector.
+for model in ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.4-mini"]:
+    PROVEN[f"codex/{model.replace('.', '-')}-non-reasoning"] = (
+        "model_and_effort", model, f"cx-{model.replace('.', '_')}-none")
+
+# Default (no --effort) Haiku 4.5 spent 124 thinking tokens, so the selector
+# lands on the reasoning row rather than its non-reasoning sibling.
+PROVEN["claude/claude-4-5-haiku-reasoning"] = (
+    "model_and_effort", "claude-haiku-4-5", "cl-rmode-claude-haiku-4-5-noeffort")
+
+for cid, model in [("claude/claude-sonnet-5", "claude-sonnet-5"),
+                   ("claude/claude-opus-4-8", "claude-opus-4-8"),
+                   ("claude/claude-opus-4-7", "claude-opus-4-7"),
+                   ("claude/claude-opus-4-6-adaptive", "claude-opus-4-6"),
+                   ("claude/claude-sonnet-4-6-adaptive", "claude-sonnet-4-6")]:
+    PROVEN[cid] = ("model_and_effort", model, f"cl-{model}-max")
+
+# Fable is listed so its failures reach unproven[] rather than vanishing. Its
+# probes were refused for quota on 2026-09-07 and again on 2026-09-09; the
+# verdict decides whether these rows become mappings or stay visible failures.
+for effort in ["max", "xhigh", "high", "medium", "low"]:
+    cid = "claude/claude-fable-5-1" + ("" if effort == "max" else f"-{effort}")
+    PROVEN[cid] = ("model_and_effort", "claude-fable-5-1", f"cl-claude-fable-5-1-{effort}")
+PROVEN["claude/claude-fable-5"] = (
+    "model_and_effort", "claude-fable-5", "cl-claude-fable-5-max")
+
+def cli_path(name: str) -> Path:
+    """Anchor the executable the runners resolve, not a version pinned here.
+
+    The runners invoke bare names, so a pinned path can name a binary that has
+    not run since the last self-update; the overlay must hash what answers.
+    aa_policy opens evidence with O_NOFOLLOW, so this resolves past the symlink.
+    """
+    found = shutil.which(name)
+    if not found:
+        raise SystemExit(f"cannot resolve the {name} CLI to anchor its evidence")
+    return Path(found).resolve()
+
+
+def core_evidence() -> list[tuple[Path, str]]:
+    """Resolved when a build runs, not at import: a host missing one CLI can
+    still load this module to read PROVEN."""
+    return [
+        (cli_path("grok"), "grok"),
+        (REPO / "scripts/runners/run-grok.sh", "grok"),
+        (cli_path("codex"), "codex"),
+        (REPO / "scripts/runners/run-codex.sh", "codex"),
+        (cli_path("claude"), "claude"),
+        (REPO / "scripts/runners/run-claude.sh", "claude"),
+        (cli_path("agy"), "gemini"),
+        (REPO / "scripts/runners/run-gemini.sh", "gemini"),
+    ]
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1 << 20), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--root",
+        type=Path,
+        default=DEFAULT_ROOT,
+        help=f"probe sweep root (default: {DEFAULT_ROOT})",
+    )
+    args = parser.parse_args(argv)
+    root = args.root.expanduser()
+
+    manifest = {"probe_runs": {}}
+    unproven = []
+    # Evidence written before 0.42.6 carries no tier; it proved the selector and
+    # nothing about who answered, which is exactly what selector-only records.
+    tiers: dict[str, str] = {}
+    for cid, (_, _, ev) in sorted(PROVEN.items()):
+        entry = {}
+        for suffix in ("json", "stdout", "stderr", "rollout", "cli_log"):
+            path = root / "evidence" / f"{ev}.{suffix}"
+            if path.exists():
+                entry[suffix] = {"path": str(path), "sha256": sha256(path)}
+        if "json" not in entry:
+            raise SystemExit(f"missing probe evidence for {cid}: {ev}")
+        descriptor_path = Path(entry["json"]["path"])
+        descriptor = json.loads(descriptor_path.read_text())
+        if not isinstance(descriptor, dict):
+            raise SystemExit(f"invalid probe descriptor for {cid}: {ev}")
+        if "verdict" not in descriptor:
+            print(f"warning: legacy evidence (verdict=unknown): {cid}: {ev}")
+        elif descriptor["verdict"] != "pass":
+            unproven.append({
+                "config_id": cid,
+                "verdict_reason": descriptor.get("verdict_reason") or f"verdict: {descriptor['verdict']}",
+                "observed_model": descriptor.get("observed_model"),
+                "probed_at": descriptor.get("probed_at") or datetime.fromtimestamp(
+                    descriptor_path.stat().st_mtime, timezone.utc).isoformat(),
+            })
+            # Visibility only: failed evidence must not enter the signed manifest.
+            continue
+        tier = descriptor.get("evidence_tier", "selector-only")
+        if tier not in ("billed-model", "client-echo", "selector-only"):
+            raise SystemExit(f"unknown evidence tier for {cid}: {tier}")
+        tiers[cid] = tier
+        manifest["probe_runs"][cid] = entry
+    manifest_path = root / "probe-manifest.json"
+    manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
+
+    mappings = []
+    for cid, (selector, runtime_model, _) in sorted(PROVEN.items()):
+        if cid not in manifest["probe_runs"]:
+            continue
+        row = ROWS[cid]
+        mapping = {
+            "config_id": cid,
+            "identity": {key: row[key] for key in IDENTITY_FIELDS},
+            "runtime_model": runtime_model,
+            "runtime_effort": row["effort"],
+            "selector_type": selector,
+            "verification": "request-selector-contract",
+            "evidence_tier": tiers.get(cid, "selector-only"),
+        }
+        if selector == "cli_reasoning_effort":
+            mapping["cli_flag"] = "--reasoning-effort"
+        mappings.append(mapping)
+
+    evidence = [
+        {"path": str(path), "sha256": sha256(path), "vendor": vendor}
+        for path, vendor in core_evidence()
+    ]
+    evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
+
+    overlay = {
+        "schema_version": 1,
+        "snapshot_id": REGISTRY["snapshot"]["id"],
+        "host": socket.gethostname(),
+        "source": ("claude-code / MacStudio / operator-directed full sweep 2026-09-07; "
+                   "gemini selectors re-probed 2026-09-09 after agy 1.1.27 -> 1.1.28"),
+        "evidence": evidence,
+        "mappings": mappings,
+        "unproven": unproven,
+    }
+    out = root / "transport-contracts.local.json"
+    out.write_text(json.dumps(overlay, indent=2, ensure_ascii=False) + "\n")
+    spread = Counter(m["evidence_tier"] for m in mappings)
+    print(f"wrote {out} with {len(mappings)} mappings and {len(evidence)} evidence anchors")
+    print("  evidence tiers: " + ", ".join(f"{tier} {count}" for tier, count in sorted(spread.items())))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/lib/overlay_health.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Report whether the configured AA transport overlay still loads.
+
+Prints one `LEVEL<TAB>message` line for `omnilane doctor`. Always exits 0; the
+caller decides how to grade the level. Nothing here contacts a provider.
+
+Exists because no other doctor check observes the AA gate: every vendor CLI can
+be reachable and every lane resolvable while `load_registry` refuses the whole
+registry over one drifted evidence hash.
+"""
+import hashlib
+import os
+import sys
+from collections import Counter
+from pathlib import Path
+
+REPO = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "scripts" / "lib"))
+
+
+def emit(level: str, message: str) -> None:
+    print(f"{level}\t{message}")
+    raise SystemExit(0)
+
+
+def digest(path: Path) -> str:
+    value = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            value.update(block)
+    return value.hexdigest()
+
+
+def offenders(overlay_path: Path) -> list[str]:
+    """Name the evidence entries that no longer match, for an actionable report."""
+    import json
+
+    try:
+        overlay = json.loads(overlay_path.read_text())
+    except (OSError, ValueError):
+        return []
+    found = []
+    for entry in overlay.get("evidence", []):
+        path = Path(entry.get("path", ""))
+        tag = entry.get("vendor") or "untagged"
+        if not path.exists():
+            found.append(f"{tag}:missing {path}")
+        elif digest(path) != entry.get("sha256"):
+            found.append(f"{tag}:hash drift {path}")
+    return found
+
+
+def main() -> None:
+    overlay_path = os.environ.get("OMNILANE_AA_TRANSPORT_OVERLAY", "")
+    if not overlay_path:
+        emit("PASS", "no overlay configured; every runtime mapping stays unverified")
+    if not Path(overlay_path).exists():
+        emit("FAIL", f"configured overlay is missing: {overlay_path}")
+
+    try:
+        import aa_policy
+    except ImportError as error:
+        emit("WARN", f"cannot import aa_policy: {error}")
+
+    try:
+        registry, _ = aa_policy.load_registry(str(REPO / "config" / "aa-model-policy.json"))
+    except Exception as error:  # PolicyError, OSError, and anything else fails the gate
+        detail = "; ".join(offenders(Path(overlay_path))) or str(error)
+        emit("FAIL", f"overlay rejected, every dispatch is refused: {error} ({detail})")
+
+    tiers = registry.get("_transport_evidence_tiers", {})
+    verified = Counter()
+    for row in registry["scored_configs"]:
+        if row["transport_mapping"].get("runtime_verified") is True:
+            verified[row["vendor"], tiers.get(row["id"], "selector-only")] += 1
+    summary = ", ".join(f"{vendor} {count} {tier}"
+                        for (vendor, tier), count in sorted(verified.items())) or "none"
+
+    import json
+
+    overlay = json.loads(Path(overlay_path).read_text())
+    unproven = overlay.get("unproven", [])
+    extra = f"; {len(unproven)} config(s) recorded unproven" if unproven else ""
+    weak = sorted({vendor for (vendor, tier) in verified if tier == "selector-only"})
+    if weak:
+        extra += (f"; {', '.join(weak)} prove only the request selector, re-probe to "
+                  "record who answered")
+
+    stale = registry.get("_stale_transport_vendors", [])
+    if stale:
+        detail = "; ".join(o for o in offenders(Path(overlay_path))) or "unknown cause"
+        emit("WARN", f"stale vendor(s) {', '.join(stale)} degraded to unverified "
+                     f"({detail}); still verified: {summary}{extra}")
+    emit("PASS", f"verified mappings: {summary}{extra}")
+
+
+main()