omnilane 0.42.5 → 0.42.7

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "One routing table, native-first or CLI delegation, supervised completion workflows.",
-    "version": "0.42.5"
+    "version": "0.42.7"
   },
   "plugins": [
     {
       "name": "omnilane",
       "source": "./",
       "description": "Route each subtask to the model that fits, then delegate through a compatible caller-owned native agent or vendor CLI.",
-      "version": "0.42.5",
+      "version": "0.42.7",
       "category": "development",
       "keywords": [
         "routing",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.5",
+  "version": "0.42.7",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs.",
   "author": {
     "name": "Seraphim0916"

package/CHANGELOG.md

@@ -6,6 +6,101 @@ semantic version tags.
 
 ## [Unreleased]
 
+## [0.42.7] - 2026-09-10
+
+### Added
+
+- `omnilane whoami` prints a caller-context file for the CLI it runs under. It
+  walks up the process tree to the nearest vendor CLI, reads the model and
+  effort that CLI was launched with, and maps them onto the one scored
+  configuration they select, or exits 3 with the reason: a missing `--effort`,
+  a model alias, or a Claude effort whose only scored row is non-reasoning. It
+  never guesses.
+
+### Changed
+
+- A dispatch that carries no `--caller-context` and no human assertion reads
+  the caller's identity from its launching CLI. Model sessions outside the
+  omnilane checkout used to stop on `missing-caller-context` and hand the
+  question back to the operator — three did on 2026-09-08 and 2026-09-10 —
+  because the refusal offered a model two options it could not take, and the
+  instructions for a third lived where those sessions never looked.
+- Launch flags are set by the harness rather than the model, so an identity
+  read from them is harder to overstate than a hand-written file, which the
+  gate checks for shape but not against what is running. Each session is held
+  to its own flags: the same model at `high` and at `max` gets 52 and 54.
+- An explicit `--caller-context`, the context a worker inherits, and
+  `--operator-asserted-human` all take precedence.
+  `OMNILANE_AA_CALLER_FROM_PROCESS=0` restores the file-only contract.
+- The `missing-caller-context` and retry refusals name `omnilane whoami`.
+  Retries still require an explicit current identity; they are not read
+  automatically.
+
+### Fixed
+
+- `omnilane --version` reported 0.42.5 in the 0.42.6 release, whose `VERSION`
+  file was not bumped with the package manifests.
+
+## [0.42.6] - 2026-09-10
+
+### Added
+
+- Every transport overlay mapping now records an `evidence_tier` saying how
+  strongly its probe identified the responder. `billed-model` is the provider
+  naming the model it charged for (Claude's `modelUsage`, grok's under
+  `--output-format json`); `client-echo` is the CLI recording the model it asked
+  for (codex's session rollout, agy's `cli.log` resolver line); `selector-only`
+  is a CLI accepting the selector and reporting nothing further. A verified
+  mapping previously flattened these into one word, which overstated two of the
+  four vendors in the same way the gate itself did before 0.42.5.
+- `omnilane doctor` reports the tier alongside each vendor's verified count and
+  names the vendors worth re-probing.
+
+### Changed
+
+- The tier is derived from what a run produced rather than assigned per vendor,
+  so evidence written before this release re-judges as `selector-only` and a CLI
+  that begins reporting a billed model is promoted with no code change.
+- `probe.py` gathers each CLI's own on-disk record of the request — codex through
+  the `thread.started` id that names its rollout, agy through the app data
+  directory prepared the way `run-gemini.sh` prepares it — and stores a digest of
+  the model-bearing lines beside the streams, so the judgement stays a pure
+  function that can re-judge an old sweep offline.
+- Grok probes accept the billed model only as an exact match or with the single
+  `-build` suffix the provider adds; a prefix test would let `grok-4.6-anything`
+  pass as `grok-4.6`.
+
+### Fixed
+
+- The overlay anchored vendor executables by paths written into
+  `build_overlay.py`, which drift out of use without failing: the live overlay
+  hashed claude `2.1.263` while every dispatch ran `2.1.266`, so eleven mappings
+  were verified against a binary that had not run in a day. Core evidence now
+  anchors the executable the runners resolve.
+- The last two mappings carrying `PRIOR:` references instead of probe evidence
+  were re-probed, so every signed mapping now has a descriptor a reader can open.
+- A failing codex probe recorded `exit-code: 1` and nothing else. Under
+  `exec --json` the refusal that ends a run is an stdout event, so the reason
+  never reached `unproven[]`.
+
+### Removed
+
+- The three `gpt-5.4-mini` mappings. The model passed its probe on 2026-09-07
+  and now returns HTTP 400 — "not supported when using Codex with a ChatGPT
+  account" — so those configurations move to `unproven[]` carrying that reason.
+  A signed overlay does not notice a lane dying upstream; only a re-probe does.
+  The overlay now holds 46 mappings and 9 unproven configurations.
+
+### Notes
+
+- The tier is reported and never enforced. Dispatch continues to turn on
+  `runtime_verified` alone, covered by a test asserting every decision is
+  byte-identical under all three tiers.
+- agy and grok update themselves in the background when invoked; agy's `cli.log`
+  records `auto_updater.go: Spawned background update process`. Overlay evidence
+  drift is a routine consequence of using a vendor rather than an operator
+  action, and per-vendor degradation is what keeps that from stopping work.
+
 ## [0.42.5] - 2026-09-09
 
 ### Fixed
@@ -921,7 +1016,9 @@ work to the wrong model, and records the evidence behind the shipped defaults.
 - Initial shared routing table, cross-vendor dispatcher, runners, installer,
   and baseline lint fixes.
 
-[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.5...HEAD
+[Unreleased]: https://github.com/Seraphim0916/omnilane/compare/v0.42.7...HEAD
+[0.42.7]: https://github.com/Seraphim0916/omnilane/compare/v0.42.6...v0.42.7
+[0.42.6]: https://github.com/Seraphim0916/omnilane/compare/v0.42.5...v0.42.6
 [0.42.5]: https://github.com/Seraphim0916/omnilane/compare/v0.42.4...v0.42.5
 [0.42.4]: https://github.com/Seraphim0916/omnilane/compare/v0.42.3...v0.42.4
 [0.42.3]: https://github.com/Seraphim0916/omnilane/compare/v0.42.2...v0.42.3

package/README.ja.md

@@ -71,8 +71,10 @@ omnilane route hardest-coding "auth トークン更新テストの不安定さ
 > ゲートするため、「誰が依頼しているか」を必ず示す必要があります。端末の前にいる人間は
 > `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` を一度設定するか、呼び出しごとに
 > `--operator-asserted-human` を付けます。omnilane を動かすモデルは**自分でこれを主張
-> できません**。代わりに正確なベンダー・モデル・effort を持つ `--caller-context FILE` を
-> 渡します。どちらも無い場合、ジョブ生成前に `missing-caller-context` で拒否されます。
+> できません**。モデルの識別情報は、それを起動した CLI のモデル・effort フラグから自動で
+> 読み取られるため、通常のセッションは何も渡す必要がありません。`omnilane whoami` はその
+> 識別情報を `--caller-context FILE` として出力します。主張も読み取れる識別情報も無い場合、
+> ジョブ生成前に `missing-caller-context` で拒否されます。
 
 > はじめての方は、まず `omnilane doctor` を実行してください。omnilane が今どのモデル CLI と
 > API キーに接続できるかがわかり、実際に何が動くか把握できます。
@@ -530,10 +532,12 @@ work の別名ではありません。サービス管理など、work の境界
 ください。その `transport-overlay` チェックが、問題はこのマシンの設定なのか
 リクエストなのかをすぐに示します。
 
-`missing-caller-context` — 呼び出し元の識別情報がありません。人間は
+`missing-caller-context` — 識別情報がゲートに届いていません。人間は
 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` または `--operator-asserted-human` を
-使います。omnilane を動かすモデルは、正確なベンダー・モデル・effort を含む
-`--caller-context FILE` を渡し、人間向けの免除を自称してはいけません。
+使います。モデルは通常何もしなくてよく、dispatch が起動元の CLI から識別情報を
+読み取ります。読み取れない場合は `omnilane whoami` を実行してください。渡すべき
+`--caller-context FILE` を出力するか、読み取れない理由（`--effort` 未指定、モデル
+エイリアス、スコア行なし）を示します。モデルは人間向けの免除を自称してはいけません。
 
 `runtime-mapping-unverified` — 識別情報は正しく、**ターゲット**にホストローカルの
 リクエストセレクタの証明がありません。未プローブか、プローブが失敗しています。
@@ -573,6 +577,26 @@ work の別名ではありません。サービス管理など、work の境界
 
 ## 📜 リリース履歴
 
+## v0.42.7 の新機能
+
+- **モデルのセッションは識別ファイルなしでディスパッチできます。** `--caller-context` が無い場合、dispatch はプロセスツリーを遡って最も近いベンダー CLI を見つけ、その起動時のモデルと effort を読み取ります。これまで omnilane のチェックアウト外のセッションは `missing-caller-context` で止まり、判断をオペレーターに差し戻していました（2026-09-08 と 2026-09-10 に 3 件）。
+- **`omnilane whoami`** はその識別情報を caller-context ファイルとして出力し、読み取れない場合は理由（`--effort` 未指定、モデルエイリアス、Claude のその effort に non-reasoning 行しか無い）を示します。推測はしません。
+- **手書きファイルより偽りにくい。** ゲートは caller-context ファイルの形式しか確認せず、実際に動いているモデルと一致するかは見ていません。起動フラグはモデルではなくハーネスが設定し、セッションごとに判定されます。同じモデルでも `high` と `max` なら上限は 52 と 54 です。
+- **明示指定が優先。** `--caller-context` ファイル、ワーカーが継承する環境、`--operator-asserted-human` はいずれも自動読み取りより優先します。`OMNILANE_AA_CALLER_FROM_PROCESS=0` でファイルのみの契約に戻せます。
+- **拒否メッセージが出口を示します。** `missing-caller-context` と再試行の拒否は `omnilane whoami` を案内します。
+- **`omnilane --version` が正しくなりました。** 0.42.6 では `VERSION` が 0.42.5 のままでした。
+- **アップグレード。** npm 公開後は `npm i -g omnilane@0.42.7` を実行してください。
+
+## v0.42.6 の新機能
+
+- **「検証済み」が、どう検証されたかを示すようになりました。** 各 overlay マッピングは `evidence_tier` を持ちます。`billed-model` はプロバイダー自身が課金対象のモデル名を返した場合（claude、grok）、`client-echo` は CLI が自ら送信したモデルを記録した場合（codex、agy）、`selector-only` は CLI がセレクターを受け付けただけの場合です。`client-echo` は CLI が控えた注文書、`billed-model` はプロバイダーが発行した領収書です。
+- **報告するだけで、拒否はしません。** ディスパッチは従来どおり `runtime_verified` のみで判断するため、ティアが低くても動いていたレーンが拒否されることはありません。3 つのティアすべてで判定が変わらないことをテストで保証しています。
+- **ティアはベンダーではなく証拠に従います。** 本リリース以前のプローブは `selector-only` として再判定され、課金モデルを返すようになった CLI はコード変更なしに昇格します。
+- **`omnilane doctor` が内訳を表示**し、再プローブすべきベンダーを名指しします。
+- **overlay は実際に実行されるバイナリを固定します。** 従来はパスが `build_overlay.py` に直書きされ、使われていないバージョンを黙って指していました。実際には claude `2.1.266` が実行されているのに、overlay は `2.1.263` をハッシュしていました。
+- **失われた 3 レーンを検出。** `gpt-5.4-mini` は 2026-09-07 のプローブでは通っていましたが、現在は HTTP 400（ChatGPT アカウントの Codex では非対応）を返します。署名済みの overlay はレーンが上流で失われても気付きません。該当の 3 構成は理由付きで `unproven[]` に移り、マッピングは 46 件になりました。
+- **アップグレード。** npm 公開後は `npm i -g omnilane@0.42.6` を実行してください。
+
 ## v0.42.5 の新機能
 
 - **1 つの CLI 更新が全ベンダーを止めることはなくなりました。** overlay の evidence に `vendor` タグを付与でき、タグ付きエントリのハッシュ差異やファイル消失は当該ベンダーのみを `unknown-target-runtime` に降格させます。タグなしの evidence は従来どおり全体を fail-closed にします。

package/README.ko.md

@@ -70,8 +70,10 @@ omnilane route hardest-coding "간헐적으로 실패하는 auth 토큰 갱신
 > 게이트하므로, 디스패치는 «누가 요청하는지»를 반드시 밝혀야 합니다. 터미널 앞의 사람은
 > `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 을 한 번 설정하거나 호출마다
 > `--operator-asserted-human` 을 붙입니다. omnilane 을 구동하는 모델은 **스스로 이를 주장할
-> 수 없으며**, 대신 정확한 벤더·모델·effort 를 담은 `--caller-context FILE` 을 전달합니다.
-> 둘 다 없으면 잡 생성 전에 `missing-caller-context` 로 거부됩니다.
+> 수 없습니다**. 모델의 신원은 그것을 실행한 CLI 의 모델·effort 플래그에서 자동으로 읽히므로,
+> 일반 세션은 아무것도 전달할 필요가 없습니다. `omnilane whoami` 는 그 신원을
+> `--caller-context FILE` 로 출력합니다. 주장도 읽을 수 있는 신원도 없으면 잡 생성 전에
+> `missing-caller-context` 로 거부됩니다.
 
 > 처음이신가요? 먼저 `omnilane doctor` 를 실행하세요. omnilane 이 지금 어떤 모델 CLI 와
 > API 키에 접근할 수 있는지 알려 주어, 실제로 무엇이 실행될지 파악할 수 있습니다.
@@ -516,10 +518,12 @@ work 는 지정한 디렉터리 안의 변경만 허용하며 모델 연결은
 `transport-overlay` 검사가 문제의 원인이 이 머신의 설정인지 요청인지 바로
 알려줍니다.
 
-`missing-caller-context` — 호출자 신원을 전달하지 않았습니다. 사람은
+`missing-caller-context` — 게이트에 신원이 전달되지 않았습니다. 사람은
 `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 또는 `--operator-asserted-human`을
-사용합니다. omnilane을 구동하는 모델은 정확한 벤더·모델·effort가 담긴
-`--caller-context FILE`을 전달해야 하며, 사람용 면제를 스스로 주장해서는 안 됩니다.
+사용합니다. 모델은 보통 아무것도 할 필요가 없으며, dispatch 가 실행한 CLI 에서 신원을
+읽습니다. 읽지 못하면 `omnilane whoami` 를 실행하세요. 전달할 `--caller-context FILE`
+을 출력하거나, 읽지 못한 정확한 이유(`--effort` 누락, 모델 별칭, 점수 행 없음)를 알려줍니다.
+모델은 사람용 면제를 스스로 주장해서는 안 됩니다.
 
 `runtime-mapping-unverified` — 신원은 정상이지만 **대상**에 검증된 호스트 로컬
 요청 셀렉터가 없습니다. 프로브를 한 적이 없거나 프로브가 실패한 경우입니다.
@@ -558,6 +562,26 @@ doctor가 파일과 벤더를 지목하며, 재서명 절차는 디스패치 스
 
 ## 📜 릴리스 기록
 
+## v0.42.7 새 기능
+
+- **모델 세션은 신원 파일 없이 디스패치할 수 있습니다.** `--caller-context` 가 없으면 dispatch 가 프로세스 트리를 거슬러 올라가 가장 가까운 벤더 CLI 를 찾고, 그 CLI 가 실행될 때의 모델과 effort 를 읽습니다. 지금까지 omnilane 체크아웃 밖의 세션은 `missing-caller-context` 에서 멈추고 판단을 운영자에게 되돌렸습니다(2026-09-08, 2026-09-10 에 3건).
+- **`omnilane whoami`** 는 그 신원을 caller-context 파일로 출력하고, 읽지 못하면 정확한 이유(`--effort` 누락, 모델 별칭, 해당 effort 에 Claude 의 non-reasoning 행만 있음)를 알려줍니다. 추측하지 않습니다.
+- **손으로 쓴 파일보다 속이기 어렵습니다.** 게이트는 caller-context 파일의 형식만 확인하고 실제로 실행 중인 모델과 일치하는지는 보지 않습니다. 실행 플래그는 모델이 아니라 하네스가 설정하며, 세션마다 따로 판정됩니다. 같은 모델이라도 `high` 와 `max` 면 상한은 52 와 54 입니다.
+- **명시 지정이 우선합니다.** `--caller-context` 파일, 워커가 물려받는 환경, `--operator-asserted-human` 은 모두 자동 읽기보다 우선합니다. `OMNILANE_AA_CALLER_FROM_PROCESS=0` 으로 파일 전용 계약으로 되돌릴 수 있습니다.
+- **거부 메시지가 해결책을 알려줍니다.** `missing-caller-context` 와 재시도 거부는 `omnilane whoami` 를 안내합니다.
+- **`omnilane --version` 이 다시 정확해졌습니다.** 0.42.6 에서는 `VERSION` 이 0.42.5 로 남아 있었습니다.
+- **업그레이드.** npm 게시 후 `npm i -g omnilane@0.42.7`를 실행하세요.
+
+## v0.42.6 새 기능
+
+- **"검증됨"이 어떻게 검증했는지도 알려줍니다.** 각 overlay 매핑은 `evidence_tier`를 가집니다. `billed-model`은 공급자가 과금한 모델을 직접 밝힌 경우(claude, grok), `client-echo`는 CLI가 자신이 보낸 모델을 기록한 경우(codex, agy), `selector-only`는 CLI가 셀렉터를 받아들이기만 한 경우입니다. `client-echo`는 CLI가 적어 둔 주문서이고, `billed-model`은 공급자가 발행한 영수증입니다.
+- **보고만 하고 막지 않습니다.** 디스패치는 여전히 `runtime_verified`만으로 결정되므로, 낮은 등급이 기존에 동작하던 레인을 거부하는 일은 없습니다. 세 등급 모두에서 판정이 동일함을 테스트로 보장합니다.
+- **등급은 공급업체가 아니라 증거를 따릅니다.** 이번 릴리스 이전의 프로브는 `selector-only`로 재판정되며, 과금 모델을 보고하기 시작한 CLI는 코드 변경 없이 승격됩니다.
+- **`omnilane doctor`가 분포를 표시**하고 다시 프로브할 공급업체를 지목합니다.
+- **overlay는 실제로 실행되는 바이너리를 고정합니다.** 기존에는 경로가 `build_overlay.py`에 하드코딩되어 사용되지 않는 버전을 조용히 가리켰습니다. 모든 디스패치가 claude `2.1.266`을 실행하는 동안 overlay는 `2.1.263`을 해시하고 있었습니다.
+- **죽은 레인 3개를 찾았습니다.** `gpt-5.4-mini`는 2026-09-07 프로브에서는 통과했지만 지금은 HTTP 400(ChatGPT 계정의 Codex에서는 미지원)을 반환합니다. 서명된 overlay는 레인이 상류에서 사라져도 알아차리지 못합니다. 해당 3개 구성은 이유와 함께 `unproven[]`으로 이동했고, 매핑은 46개가 되었습니다.
+- **업그레이드.** npm 게시 후 `npm i -g omnilane@0.42.6`를 실행하세요.
+
 ## v0.42.5 새 기능
 
 - **CLI 하나를 업그레이드해도 모든 벤더가 막히지 않습니다.** overlay evidence 항목에 `vendor` 태그를 붙일 수 있으며, 태그가 있는 항목의 해시가 바뀌거나 파일이 사라지면 해당 벤더만 `unknown-target-runtime`으로 강등됩니다. 태그가 없는 evidence는 기존처럼 전체 fail-closed입니다.

package/README.md

@@ -71,8 +71,10 @@ omnilane route hardest-coding "fix the flaky auth token refresh"
 > capability score, so a dispatch has to say who is asking. A human at a terminal
 > asserts that once with `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1`, or per call with
 > `--operator-asserted-human`. A model driving omnilane cannot assert it for
-> itself — it passes `--caller-context FILE` carrying its exact vendor, model and
-> effort instead. With neither, the dispatch is refused with
+> itself. Its identity is read from the CLI that launched it — the model and
+> effort flags that CLI was started with — so an ordinary session passes nothing,
+> and `omnilane whoami` prints that identity as a `--caller-context FILE`. With
+> neither an assertion nor a readable identity, the dispatch is refused with
 > `missing-caller-context` before any job is created.
 
 > New to this? Run `omnilane doctor` first — it tells you which model CLIs and
@@ -625,10 +627,13 @@ Three codes, three different fixes. Run `omnilane doctor` first — its
 `transport-overlay` check tells you immediately whether the problem is your
 machine's configuration or your request.
 
-`missing-caller-context` — you passed no identity. A human adds
-`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` or `--operator-asserted-human`; a model
-driving omnilane writes a `--caller-context FILE` with its exact vendor, model,
-and effort, and must not assert the human exemption for itself.
+`missing-caller-context` — no identity reached the gate. A human adds
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` or `--operator-asserted-human`. A model
+normally needs nothing: dispatch reads its identity from the CLI that launched
+it. When that fails, run `omnilane whoami` — it either prints a
+`--caller-context FILE` to pass, or says exactly why it cannot (a missing
+`--effort`, a model alias, no scored row). A model must not assert the human
+exemption for itself.
 
 `runtime-mapping-unverified` — your identity is fine, but the *target* has no
 proven host-local request selector. Either it was never probed, or its probe
@@ -647,6 +652,35 @@ vendor; the dispatch skill carries the re-signing runbook.
 
 </details>
 
+<details>
+<summary><b>What does my mapping's evidence tier mean?</b></summary>
+
+<br/>
+
+It says how strongly the probe pinned down who answered. It does not affect
+whether you can dispatch.
+
+`billed-model` — the provider named the model it charged for. Claude reports it
+in `modelUsage`; grok reports it the same way under `--output-format json`. This
+is the provider's receipt.
+
+`client-echo` — the CLI wrote down the model it asked for, and that record
+matches your request. Codex keeps it in the session rollout; agy writes it to
+`cli.log`. This is the CLI's copy of your order, not the provider's receipt: it
+proves the request left as intended, not who served it.
+
+`selector-only` — the CLI accepted the selector and reported nothing further.
+Every mapping probed before v0.42.6 reads this way. It still dispatches; it is
+simply the weakest of the three, and `omnilane doctor` names the vendors worth
+re-probing.
+
+None of the three certifies upstream provider identity, and none of them can
+refuse a lane. The tier is derived from what a probe produced rather than from
+the vendor, so a CLI that starts reporting a billed model is promoted on its
+next sweep with no change to omnilane.
+
+</details>
+
 ## 📊 Defaults and provenance
 
 Default lane assignments follow Artificial Analysis coding/intelligence data
@@ -670,6 +704,26 @@ working notes, including per-benchmark caveats, live in
 
 ## 📜 Release history
 
+## What's new in v0.42.7
+
+- **A model session no longer needs an identity file to dispatch.** When no `--caller-context` is given, dispatch walks up the process tree to the nearest vendor CLI and reads the model and effort it was launched with. Sessions outside the omnilane checkout used to stop on `missing-caller-context` and hand the question back to the operator; three did so on 2026-09-08 and 2026-09-10.
+- **`omnilane whoami`** prints that identity as a caller-context file, or says exactly why it cannot — a missing `--effort`, a model alias, or a Claude effort whose only scored row is non-reasoning. It never guesses.
+- **Harder to overstate than a hand-written file.** The gate checks a caller-context file's shape, not whether it matches the model actually running. Launch flags are set by the harness, not the model, and each session is held to its own: the same model at `high` and at `max` gets ceilings 52 and 54.
+- **Explicit still wins.** A `--caller-context` file, the context a worker inherits, and `--operator-asserted-human` all take precedence. `OMNILANE_AA_CALLER_FROM_PROCESS=0` restores the file-only contract.
+- **The refusal names the way out.** `missing-caller-context` and the retry refusal now point to `omnilane whoami` instead of offering a model two options it cannot take.
+- **`omnilane --version` is right again.** The 0.42.6 release left `VERSION` at 0.42.5.
+- **Upgrade.** After npm publication, run `npm i -g omnilane@0.42.7`. Existing repo-symlink installations can update their checkout and verify `omnilane --version` without rerunning installation.
+
+## What's new in v0.42.6
+
+- **A verified mapping now says how it was verified.** Each overlay mapping carries an `evidence_tier`: `billed-model` when the provider named the model it charged for (Claude, grok), `client-echo` when the CLI recorded the model it asked for (codex, agy), `selector-only` when the CLI accepted the selector and said nothing more. `client-echo` is the CLI's copy of your order; `billed-model` is the provider's receipt.
+- **Reported, never enforced.** Dispatch still turns on `runtime_verified` alone, so a weaker tier never refuses a lane that used to run. A test asserts every decision is unchanged under all three tiers.
+- **The tier follows the evidence, not the vendor.** A sweep predating this release re-judges as `selector-only`, and a CLI that begins reporting a billed model is promoted with no code change.
+- **`omnilane doctor` shows the spread** and names the vendors worth re-probing.
+- **Overlay evidence anchors the binary that runs.** Paths were written into `build_overlay.py` and drifted out of use silently — the live overlay hashed claude `2.1.263` while every dispatch ran `2.1.266`. Core evidence now resolves the executable the runners resolve.
+- **Three dead lanes found.** `gpt-5.4-mini` passed its probe on 2026-09-07 and now returns HTTP 400 — "not supported when using Codex with a ChatGPT account". A signed overlay never notices a lane dying upstream; the re-probe did. Those three configurations move to `unproven[]` with that reason attached, leaving 46 mappings.
+- **Upgrade.** After npm publication, run `npm i -g omnilane@0.42.6`. Existing repo-symlink installations can update their checkout and verify `omnilane --version` without rerunning installation.
+
 ## What's new in v0.42.5
 
 - **One CLI upgrade no longer refuses every vendor.** Overlay evidence entries take a `vendor` tag; a tagged entry whose hash drifts or whose file has disappeared degrades only that vendor to `unknown-target-runtime`. Untagged evidence stays globally fail-closed.

package/README.zh-CN.md

@@ -65,8 +65,9 @@ omnilane route hardest-coding "修掉会间歇失败的 auth token 更新测试"
 > **那个 export 是做什么的?** omnilane 会用调用者自己的能力分数来把关每一次派工,
 > 所以派工必须表明「是谁在问」。人类在终端前只要设一次
 > `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1`,或每次带 `--operator-asserted-human`。
-> 模型驱动 omnilane 时**不能替自己主张**这个标志,它要改用 `--caller-context FILE`
-> 提供确切的厂商、模型与强度。两者都没有的话,派工会在创建作业前就被
+> 模型驱动 omnilane 时**不能替自己主张**这个标志。它的身份会从启动它的 CLI 标志
+> (模型与强度)自动读取,一般 session 什么都不用带;`omnilane whoami` 会把这个身份
+> 打印成 `--caller-context FILE`。既没主张、又读不到身份的话,派工会在创建作业前就被
 > `missing-caller-context` 拒绝。
 
 > 第一次用?先跑 `omnilane doctor`——它会告诉你 omnilane 现在能接到哪些模型 CLI 与
@@ -489,10 +490,11 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析后的计划,
 三个代码，三种不同的修法。先运行 `omnilane doctor`——它的 `transport-overlay`
 检查会直接告诉你问题出在本机配置还是你的请求。
 
-`missing-caller-context`——你没带身份。真人加上
-`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`；
-模型驱动 omnilane 时要写一份 `--caller-context FILE`，包含它精确的厂商、模型与
-强度，且不得替自己主张真人豁免。
+`missing-caller-context`——没有身份送到闸门。真人加上
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`。
+模型通常什么都不用做：dispatch 会从启动它的 CLI 读取身份。读不到时运行
+`omnilane whoami`，它会打印可以带的 `--caller-context FILE`，或说明读不到的确切原因
+（缺 `--effort`、模型别名、查无评分行）。模型不得替自己主张真人豁免。
 
 `runtime-mapping-unverified`——你的身份没问题，但**目标**没有已验证的本机请求
 选择器。可能从未探测过，也可能探测失败；`omnilane doctor` 会报告这类配置的数量，
@@ -508,6 +510,30 @@ overlay 钉住每家的可执行文件与 runner 脚本哈希，而 Codex 与 Cl
 
 </details>
 
+<details>
+<summary><b>映射上的证据等级是什么意思？</b></summary>
+
+<br/>
+
+它说明这次探测把「谁回答的」钉到多紧。它**不影响**你能不能派工。
+
+`billed-model`——供应商自己说出它计费的模型。claude 放在 `modelUsage`；
+grok 在 `--output-format json` 下也一样。这是供应商开的收据。
+
+`client-echo`——CLI 记下自己送出的模型，而且那笔记录与你的请求相符。
+codex 记在 session rollout，agy 写进 `cli.log`。这是 CLI 自己抄的订单，
+不是收据：它证明请求照原样送出去了，不能证明是谁接的。
+
+`selector-only`——CLI 收下选择器，其余不表态。v0.42.6 之前探测的每一条映射
+都是这一级。它照样能派工，只是三级里最弱的一级；`omnilane doctor` 会点名
+哪几家值得重探。
+
+三者都不能证明上游供应商身分，也都不会让任何车道被拒。等级是从探测产出的
+东西推导出来的，不是按厂商指定，所以哪支 CLI 开始汇报计费模型，下一次重探
+就会自动升级，omnilane 不用改。
+
+</details>
+
 ## 📊 默认值与数据来源
 
 默认通道配置依据 Artificial Analysis 2026-07 快照(已对 AA 站上原始记录与
@@ -530,6 +556,26 @@ overlay 钉住每家的可执行文件与 runner 脚本哈希，而 Codex 与 Cl
 
 ## 📜 版本历程
 
+## v0.42.7 新功能
+
+- **模型 session 派工不再需要身份文件。** 没给 `--caller-context` 时，dispatch 会沿进程树往上找到最近的厂商 CLI，读取它启动时带的模型与强度。以前不在 omnilane 目录下的 session 会卡在 `missing-caller-context`，把问题丢回给操作者——2026-09-08 与 2026-09-10 就有三个 session 这样停下来。
+- **`omnilane whoami`** 会把这个身份打印成 caller-context 文件，读不到时说明确切原因（缺 `--effort`、模型别名、claude 该强度只剩 non-reasoning 行），绝不猜测。
+- **比手写的文件更难作假。** 闸门只检查身份文件的格式，不核对它与实际运行的模型是否一致。启动标志由 harness 设置，模型改不了，而且每个 session 各算各的：同一模型分别开 `high` 和 `max`，上限就是 52 和 54。
+- **明确指定仍然优先。** `--caller-context` 文件、worker 继承的环境、`--operator-asserted-human` 都优先于自动读取。`OMNILANE_AA_CALLER_FROM_PROCESS=0` 可恢复「只认文件」的规则。
+- **被拒时会告诉你出路。** `missing-caller-context` 和重试被拒的消息都改为指向 `omnilane whoami`。
+- **`omnilane --version` 恢复正确。** 0.42.6 发版时漏改了 `VERSION`，会报告 0.42.5。
+- **升级。** npm 发布后运行 `npm i -g omnilane@0.42.7`。既有的 repo symlink 安装更新检出后确认 `omnilane --version` 即可。
+
+## v0.42.6 新功能
+
+- **「已验证」现在会说明是怎么验的。** 每条 overlay 映射带一个 `evidence_tier`：`billed-model` 是供应商自己说出计费的模型（claude、grok），`client-echo` 是 CLI 记下自己送出的模型（codex、agy），`selector-only` 是 CLI 收下选择器、其余不表态。`client-echo` 是 CLI 自己抄的订单，`billed-model` 是供应商开的收据。
+- **只汇报，不拦截。** 派工照旧只看 `runtime_verified`，等级低不会让原本跑得动的车道被拒。已有测试确认三种等级下每个判定都不变。
+- **等级跟着证据走，不跟着厂商走。** 本次发布之前的探测会重判为 `selector-only`；哪天某支 CLI 开始汇报计费模型，不改代码就自动升级。
+- **`omnilane doctor` 显示分布**，并点名哪几家值得重探。
+- **overlay 锚定的是真正在跑的可执行文件。** 过去路径写死在 `build_overlay.py` 里，会无声地锚到没在用的版本——线上 overlay 哈希的是 claude `2.1.263`，但每次派工跑的都是 `2.1.266`。
+- **抓到三条已死的车道。** `gpt-5.4-mini` 在 2026-09-07 探测还会过，现在回 HTTP 400——「ChatGPT 账号使用 Codex 时不支持此模型」。签好的 overlay 永远不会发现某条车道在上游死掉，重探才会。那三条移进 `unproven[]` 并附上原因，映射剩 46 条。
+- **升级。** npm 发布后运行 `npm i -g omnilane@0.42.6`。既有的 repo symlink 安装更新检出后确认 `omnilane --version` 即可。
+
 ## v0.42.5 新功能
 
 - **升级一支 CLI 不再阻断所有厂商。** overlay 的证据项目可带 `vendor` 标签；带标签的项目哈希漂移或文件消失时，只让该厂商降级为 `unknown-target-runtime`。未标签的证据维持全局 fail-closed。

package/README.zh-TW.md

@@ -65,8 +65,9 @@ omnilane route hardest-coding "修掉會間歇失敗的 auth token 更新測試"
 > **那個 export 是做什麼的?** omnilane 會用呼叫者自己的能力分數來把關每一次派工,
 > 所以派工必須表明「是誰在問」。人類在終端機前只要設一次
 > `OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1`,或每次帶 `--operator-asserted-human`。
-> 模型驅動 omnilane 時**不能替自己主張**這個旗標,它要改用 `--caller-context FILE`
-> 提供確切的廠商、模型與強度。兩者都沒有的話,派工會在建立工作前就被
+> 模型驅動 omnilane 時**不能替自己主張**這個旗標。它的身分會從啟動它的 CLI 旗標
+> (模型與強度)自動讀取,一般 session 什麼都不用帶;`omnilane whoami` 會把這個身分
+> 印成 `--caller-context FILE`。既沒主張、又讀不到身分的話,派工會在建立工作前就被
 > `missing-caller-context` 拒絕。
 
 > 第一次用?先跑 `omnilane doctor`——它會告訴你 omnilane 現在能接到哪些模型 CLI 與
@@ -533,10 +534,11 @@ scripts/dispatch.sh --dry-run hardest-coding "…"   # 完整解析後的計畫,
 三個代碼，三種不同的修法。先跑 `omnilane doctor`——它的 `transport-overlay`
 檢查會直接告訴你問題出在本機設定還是你的請求。
 
-`missing-caller-context`——你沒帶身分。真人加上
-`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`；
-模型驅動 omnilane 時要寫一份 `--caller-context FILE`，內含它精確的廠商、模型與
-強度，且不得替自己主張真人豁免。
+`missing-caller-context`——沒有身分送到閘門。真人加上
+`OMNILANE_AA_OPERATOR_ASSERTED_HUMAN=1` 或 `--operator-asserted-human`。
+模型通常什麼都不用做：dispatch 會從啟動它的 CLI 讀取身分。讀不到時跑
+`omnilane whoami`，它會印出可以帶的 `--caller-context FILE`，或說明讀不到的確切原因
+（缺 `--effort`、模型別名、查無評分列）。模型不得替自己主張真人豁免。
 
 `runtime-mapping-unverified`——你的身分沒問題，但**目標**沒有已驗證的本機請求
 選擇器。可能從未探測過，也可能探測失敗；`omnilane doctor` 會回報這類設定的數量，
@@ -552,6 +554,30 @@ overlay 釘住每家的執行檔與 runner 腳本雜湊，而 Codex 與 Claude
 
 </details>
 
+<details>
+<summary><b>映射上的證據等級是什麼意思？</b></summary>
+
+<br/>
+
+它說明這次探測把「誰回答的」釘到多緊。它**不影響**你能不能派工。
+
+`billed-model`——供應商自己說出它計費的模型。claude 放在 `modelUsage`；
+grok 在 `--output-format json` 下也一樣。這是供應商開的收據。
+
+`client-echo`——CLI 記下自己送出的模型，而且那筆紀錄與你的請求相符。
+codex 記在 session rollout，agy 寫進 `cli.log`。這是 CLI 自己抄的訂單，
+不是收據：它證明請求照原樣送出去了，不能證明是誰接的。
+
+`selector-only`——CLI 收下選擇器，其餘不表態。v0.42.6 之前探測的每一條映射
+都是這一級。它照樣能派工，只是三級裡最弱的一級；`omnilane doctor` 會點名
+哪幾家值得重探。
+
+三者都不能證明上游供應商身分，也都不會讓任何車道被拒。等級是從探測產出的
+東西推導出來的，不是按廠商指定，所以哪支 CLI 開始回報計費模型，下一次重探
+就會自動升級，omnilane 不用改。
+
+</details>
+
 ## 📊 預設值與資料來源
 
 預設通道配置依據 Artificial Analysis 2026-07 快照(已對 AA 站上原始紀錄與
@@ -571,6 +597,26 @@ overlay 釘住每家的執行檔與 runner 腳本雜湊，而 Codex 與 Claude
 
 ## 📜 版本歷程
 
+## v0.42.7 新功能
+
+- **模型 session 派工不再需要身分檔。** 沒給 `--caller-context` 時，dispatch 會沿行程樹往上找到最近的廠商 CLI，讀它啟動時帶的模型與強度。以前不在 omnilane 目錄下的 session 會卡在 `missing-caller-context`，把問題丟回給操作者——2026-09-08 與 2026-09-10 就有三個 session 這樣停下來。
+- **`omnilane whoami`** 會把這個身分印成 caller-context 檔，讀不到時說明確切原因（缺 `--effort`、模型別名、claude 那個強度只剩 non-reasoning 列），絕不猜。
+- **比手寫的檔案更難作假。** 閘門只檢查身分檔的格式，不核對它和實際在跑的模型是否一致。啟動旗標是 harness 設的，模型改不了，而且每個 session 各算各的：同一個模型分別開 `high` 和 `max`，上限就是 52 和 54。
+- **明確指定仍然優先。** `--caller-context` 檔、worker 繼承的環境、`--operator-asserted-human` 都優先於自動讀取。`OMNILANE_AA_CALLER_FROM_PROCESS=0` 可以恢復「只認檔案」的規則。
+- **被拒時會告訴你出路。** `missing-caller-context` 和重試被拒的訊息都改成指向 `omnilane whoami`，不再只給模型兩條走不通的路。
+- **`omnilane --version` 恢復正確。** 0.42.6 發版時漏改了 `VERSION`，會回報 0.42.5。
+- **升級。** npm 發布後執行 `npm i -g omnilane@0.42.7`。既有的 repo symlink 安裝更新檢出後確認 `omnilane --version` 即可，不需重跑安裝。
+
+## v0.42.6 新功能
+
+- **「已驗證」現在會說明是怎麼驗的。** 每條 overlay 映射帶一個 `evidence_tier`：`billed-model` 是供應商自己說出計費的模型（claude、grok），`client-echo` 是 CLI 記下自己送出的模型（codex、agy），`selector-only` 是 CLI 收下選擇器、其餘不表態。白話說：`client-echo` 是 CLI 自己抄的訂單，`billed-model` 是供應商開的收據。
+- **只回報，不擋人。** 派工照舊只看 `runtime_verified`，等級低不會讓原本跑得動的車道被拒。已有測試確認三種等級下每個判定都不變。
+- **等級跟著證據走，不跟著廠商走。** 本次發布之前的探測會重判為 `selector-only`；哪天某支 CLI 開始回報計費模型，不改程式就自動升級。
+- **`omnilane doctor` 顯示分佈**，並點名哪幾家值得重探。
+- **overlay 錨定的是真正在跑的執行檔。** 過去路徑寫死在 `build_overlay.py` 裡，會無聲地錨到沒在用的版本——線上 overlay 雜湊的是 claude `2.1.263`，但每次派工跑的都是 `2.1.266`。現在改用 runner 實際解析到的執行檔。
+- **抓到三條已死的車道。** `gpt-5.4-mini` 在 2026-09-07 探測還會過，現在回 HTTP 400——「ChatGPT 帳號使用 Codex 時不支援此模型」。簽好的 overlay 永遠不會發現某條車道在上游死掉，重探才會。那三條移進 `unproven[]` 並附上原因，映射剩 46 條。
+- **升級。** npm 發布後執行 `npm i -g omnilane@0.42.6`。既有的 repo symlink 安裝更新檢出後確認 `omnilane --version` 即可，不需重跑安裝。
+
 ## v0.42.5 新功能
 
 - **升級一支 CLI 不再擋掉所有廠商。** overlay 的證據項目可帶 `vendor` 標籤；帶標籤的項目雜湊漂移或檔案消失時，只讓該廠商降級為 `unknown-target-runtime`。未標籤的證據維持全域 fail-closed。

package/VERSION

@@ -1 +1 @@
-0.42.5
+0.42.7

package/bin/omnilane

@@ -53,6 +53,13 @@ case "$cmd" in
     ;;
   release-audit) exec bash "$REPO/scripts/release-audit.sh" "$@" ;;
   doctor)    exec bash "$REPO/scripts/doctor.sh" "$@" ;;
+  whoami)
+    command -v python3 >/dev/null 2>&1 || {
+      echo "omnilane: whoami requires Python 3.9 or newer" >&2
+      exit 1
+    }
+    exec python3 "$REPO/scripts/lib/caller_identity.py" "$@"
+    ;;
   benchmark)
     command -v python3 >/dev/null 2>&1 || {
       echo "omnilane: benchmark requires Python 3.9 or newer" >&2
@@ -89,6 +96,7 @@ omnilane — one routing table, every harness
   omnilane completion bash|zsh|fish      print a shell completion script
   omnilane release-audit [flags]          offline, read-only release gate
   omnilane doctor [--json] [--strict] [--probe V]  local health / opt-in live probe
+  omnilane whoami                       caller-context file for the CLI this runs under
   omnilane benchmark [--json] [--run] [--vendor V] fixed quality/cost comparison
   omnilane ui    start|status|url|stop
   omnilane configure                    interactive lane menu

package/completions/_omnilane

@@ -53,7 +53,7 @@ _omnilane() {
   local command="${words[2]:-}" sub sub_index=3
   local -a lanes ids
   if (( CURRENT == 2 )); then
-    _values 'command' version list route dispatch jobs doctor benchmark release-audit ui configure completion help
+    _values 'command' version list route dispatch jobs doctor whoami benchmark release-audit ui configure completion help
     return
   fi
   case "$command" in

package/completions/omnilane.bash

@@ -58,7 +58,7 @@ _omnilane() {
   prev="${COMP_WORDS[COMP_CWORD-1]:-}"
   command="${COMP_WORDS[1]:-}"
   if [[ "$COMP_CWORD" -eq 1 ]]; then
-      words="version list route dispatch jobs doctor benchmark release-audit ui configure completion help"
+      words="version list route dispatch jobs doctor whoami benchmark release-audit ui configure completion help"
   else
     case "$command" in
       route|dispatch)

package/completions/omnilane.fish

@@ -10,6 +10,7 @@ complete -c omnilane -f -n __fish_use_subcommand -a dispatch      -d 'dispatch o
 complete -c omnilane -f -n __fish_use_subcommand -a jobs          -d 'inspect background jobs'
 complete -c omnilane -f -n __fish_use_subcommand -a mcp           -d 'MCP stdio server'
 complete -c omnilane -f -n __fish_use_subcommand -a doctor        -d 'read-only health report'
+complete -c omnilane -f -n __fish_use_subcommand -a whoami        -d 'caller-context file for the launching CLI'
 complete -c omnilane -f -n __fish_use_subcommand -a benchmark     -d 'fixed quality/cost comparison'
 complete -c omnilane -f -n __fish_use_subcommand -a release-audit -d 'offline release gate'
 complete -c omnilane -f -n __fish_use_subcommand -a ui            -d 'Live Board server'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnilane",
-  "version": "0.42.5",
+  "version": "0.42.7",
   "description": "One routing table, every harness — classify subtasks into lanes and delegate each lane through a compatible caller-owned native agent or vendor CLI.",
   "bin": {
     "omnilane": "bin/omnilane"

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.42.5",
+  "version": "0.42.7",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/scripts/dispatch.sh

@@ -796,6 +796,17 @@ if [[ -n "${OMNILANE_AA_TRANSPORT_OVERLAY:-}" ]]; then
   OMNILANE_AA_OVERLAY_SHA256="$(file_sha256 "$OMNILANE_AA_TRANSPORT_OVERLAY")"
   export OMNILANE_AA_OVERLAY_SHA256
 fi
+# A model caller that passed no identity is read from the CLI that launched it:
+# the harness sets those flags and the model cannot. An explicit file or the
+# human assertion still wins; OMNILANE_AA_CALLER_FROM_PROCESS=0 keeps the
+# file-only contract.
+if [[ "$AA_OPERATOR_ASSERTED_HUMAN" == "0" && -z "$AA_CALLER_CONTEXT" \
+      && "${OMNILANE_AA_CALLER_FROM_PROCESS:-1}" != "0" ]]; then
+  if derived_caller="$(python3 "$OMNILANE_REPO/scripts/lib/caller_identity.py" \
+      --registry "$AA_POLICY_FILE")"; then
+    AA_CALLER_CONTEXT="$derived_caller"
+  fi
+fi
 AA_POLICY_ACTIVE=1
 if [[ -n "$OVERRIDE_VENDOR" || -n "$OVERRIDE_MODEL" || -n "$OVERRIDE_EFFORT" || -n "$AA_TARGET_CONFIG" ]]; then
   AA_EXPLICIT_TARGET=1