omnilane 0.42.5 → 0.42.7

package/scripts/lib/aa_policy.py

@@ -29,6 +29,10 @@ APPROVED_REGISTRY_SHA256 = "0782c87de123c02738c3ff60e4bc3c1cc10d110113e872b8f862
 
 IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
 TRANSPORT_EVIDENCE_VENDORS = frozenset(("codex", "claude", "grok", "gemini"))
+# How strongly a mapping's probe identified the responder. Reported, never
+# enforced: dispatch turns on runtime_verified alone, as it did before the field
+# existed, so a weaker tier can never refuse a lane that used to run.
+TRANSPORT_EVIDENCE_TIERS = frozenset(("billed-model", "client-echo", "selector-only"))
 IDENTIFIER = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}\Z")
 
 
@@ -178,6 +182,7 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
                 _check(False, "transport contract evidence changed")
             stale_vendors.add(vendor)
     _check(bool(overlay.get("evidence")), "transport overlay requires local evidence")
+    tiers: dict[str, str] = {}
     for mapping in overlay.get("mappings", []):
         rows = [row for row in registry["scored_configs"] if row["id"] == mapping.get("config_id")]
         _check(len(rows) == 1, "unknown overlay config")
@@ -197,8 +202,11 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             _check(mapping["runtime_model"].endswith("-" + row["effort"]), "encoded effort does not match exact tuple")
         else:
             _check(mapping.get("runtime_model") == row["model"], "overlay model mismatch")
+        tier = mapping.get("evidence_tier", "selector-only")
+        _check(tier in TRANSPORT_EVIDENCE_TIERS, "unknown transport evidence tier")
         if row["vendor"] in stale_vendors:
             continue
+        tiers[row["id"]] = tier
         row["transport_mapping"].update(
             status="verified", runtime_verified=True,
             runtime_model=mapping["runtime_model"], runtime_effort=mapping["runtime_effort"],
@@ -208,6 +216,7 @@ def apply_transport_overlay(registry: dict[str, Any]) -> None:
             overlay_sha256=digest, overlay_host=overlay["host"],
         )
     registry["_stale_transport_vendors"] = sorted(stale_vendors)
+    registry["_transport_evidence_tiers"] = tiers
 
 
 def load_registry(path: str | Path, expected_sha256: str | None = None) -> tuple[dict[str, Any], str]:
@@ -332,7 +341,10 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
     if caller is None:
         base.update(
             code="missing-caller-context",
-            message="provide --caller-context FILE or explicitly assert --operator-asserted-human",
+            message=("no caller identity: a model caller runs `omnilane whoami` and passes the "
+                     "file it prints as --caller-context, which dispatch does itself when the "
+                     "launching CLI names its model and effort; a human operator passes "
+                     "--operator-asserted-human"),
         )
         return base
     base["caller_context_sha256"] = caller_sha256

package/scripts/lib/aa_retry.py

@@ -27,7 +27,9 @@ def retry_args(directory):
         original_limit = min(rows[0]["score"], original["inherited_ceiling"])
     current_path = os.environ.get("OMNILANE_AA_CALLER_CONTEXT")
     current_human = os.environ.get("OMNILANE_AA_OPERATOR_ASSERTED_HUMAN") == "1"
-    aa_policy._check(bool(current_path) != current_human, "retry requires one current caller context or explicit current human assertion")
+    aa_policy._check(bool(current_path) != current_human,
+                     "retry requires one current caller context or explicit current human "
+                     "assertion; a model caller gets one from `omnilane whoami`")
     if current_path:
         current, _ = aa_policy.load_caller(current_path, registry)
         rows = aa_policy._matching_rows(registry, current["caller"])

package/scripts/lib/build_overlay.py

@@ -10,7 +10,9 @@ import argparse
 import hashlib
 import json
 import os
+import shutil
 import socket
+from collections import Counter
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -37,13 +39,13 @@ for effort in ["xhigh", "medium"]:
     PROVEN[f"codex/gpt-5-4-mini" + ("" if effort == "xhigh" else f"-{effort}")] = (
         "model_and_effort", "gpt-5.4-mini", f"cx-gpt-5_4-mini-{effort}")
 
-PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "PRIOR:grok-effort-2026-09-07")
+PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "gk-grok-4_6-high")
 for effort in ["xhigh", "medium", "low"]:
     PROVEN[f"grok/grok-4-6-{effort}"] = ("cli_reasoning_effort", "grok-4.6", f"gk-grok-4_6-{effort}")
 PROVEN["grok/grok-4-5"] = ("cli_reasoning_effort", "grok-4.5", "gk-grok-4_5-high")
 
 for cid, rid, ev in [
-    ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "PRIOR:gemini-flash-high"),
+    ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "agy-gemini-3_8-flash-high"),
     ("gemini/gemini-3-8-flash-medium", "gemini-3.8-flash-medium", "agy-gemini-3_8-flash-medium"),
     ("gemini/gemini-3-8-flash-low", "gemini-3.8-flash-low", "agy-gemini-3_8-flash-low"),
     ("gemini/gemini-3-7-flash", "gemini-3.7-flash-high", "agy-gemini-3_7-flash-high"),
@@ -83,16 +85,32 @@ for effort in ["max", "xhigh", "high", "medium", "low"]:
 PROVEN["claude/claude-fable-5"] = (
     "model_and_effort", "claude-fable-5", "cl-claude-fable-5-max")
 
-CORE_EVIDENCE = [
-    (HOME / ".grok/downloads/grok-1.0.13-macos-aarch64", "grok"),
-    (REPO / "scripts/runners/run-grok.sh", "grok"),
-    (HOME / ".codex/packages/standalone/releases/0.153.4-aarch64-apple-darwin/bin/codex", "codex"),
-    (REPO / "scripts/runners/run-codex.sh", "codex"),
-    (HOME / ".local/share/claude/versions/2.1.263", "claude"),
-    (REPO / "scripts/runners/run-claude.sh", "claude"),
-    (HOME / ".local/bin/agy", "gemini"),
-    (REPO / "scripts/runners/run-gemini.sh", "gemini"),
-]
+def cli_path(name: str) -> Path:
+    """Anchor the executable the runners resolve, not a version pinned here.
+
+    The runners invoke bare names, so a pinned path can name a binary that has
+    not run since the last self-update; the overlay must hash what answers.
+    aa_policy opens evidence with O_NOFOLLOW, so this resolves past the symlink.
+    """
+    found = shutil.which(name)
+    if not found:
+        raise SystemExit(f"cannot resolve the {name} CLI to anchor its evidence")
+    return Path(found).resolve()
+
+
+def core_evidence() -> list[tuple[Path, str]]:
+    """Resolved when a build runs, not at import: a host missing one CLI can
+    still load this module to read PROVEN."""
+    return [
+        (cli_path("grok"), "grok"),
+        (REPO / "scripts/runners/run-grok.sh", "grok"),
+        (cli_path("codex"), "codex"),
+        (REPO / "scripts/runners/run-codex.sh", "codex"),
+        (cli_path("claude"), "claude"),
+        (REPO / "scripts/runners/run-claude.sh", "claude"),
+        (cli_path("agy"), "gemini"),
+        (REPO / "scripts/runners/run-gemini.sh", "gemini"),
+    ]
 
 
 def sha256(path: Path) -> str:
@@ -116,12 +134,12 @@ def main(argv: list[str] | None = None) -> None:
 
     manifest = {"probe_runs": {}}
     unproven = []
+    # Evidence written before 0.42.6 carries no tier; it proved the selector and
+    # nothing about who answered, which is exactly what selector-only records.
+    tiers: dict[str, str] = {}
     for cid, (_, _, ev) in sorted(PROVEN.items()):
-        if ev.startswith("PRIOR:"):
-            manifest["probe_runs"][cid] = {"source": ev, "note": "verified in the 2026-09-07 Codex run"}
-            continue
         entry = {}
-        for suffix in ("json", "stdout", "stderr"):
+        for suffix in ("json", "stdout", "stderr", "rollout", "cli_log"):
             path = root / "evidence" / f"{ev}.{suffix}"
             if path.exists():
                 entry[suffix] = {"path": str(path), "sha256": sha256(path)}
@@ -143,6 +161,10 @@ def main(argv: list[str] | None = None) -> None:
             })
             # Visibility only: failed evidence must not enter the signed manifest.
             continue
+        tier = descriptor.get("evidence_tier", "selector-only")
+        if tier not in ("billed-model", "client-echo", "selector-only"):
+            raise SystemExit(f"unknown evidence tier for {cid}: {tier}")
+        tiers[cid] = tier
         manifest["probe_runs"][cid] = entry
     manifest_path = root / "probe-manifest.json"
     manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
@@ -159,6 +181,7 @@ def main(argv: list[str] | None = None) -> None:
             "runtime_effort": row["effort"],
             "selector_type": selector,
             "verification": "request-selector-contract",
+            "evidence_tier": tiers.get(cid, "selector-only"),
         }
         if selector == "cli_reasoning_effort":
             mapping["cli_flag"] = "--reasoning-effort"
@@ -166,7 +189,7 @@ def main(argv: list[str] | None = None) -> None:
 
     evidence = [
         {"path": str(path), "sha256": sha256(path), "vendor": vendor}
-        for path, vendor in CORE_EVIDENCE
+        for path, vendor in core_evidence()
     ]
     evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
 
@@ -182,7 +205,9 @@ def main(argv: list[str] | None = None) -> None:
     }
     out = root / "transport-contracts.local.json"
     out.write_text(json.dumps(overlay, indent=2, ensure_ascii=False) + "\n")
+    spread = Counter(m["evidence_tier"] for m in mappings)
     print(f"wrote {out} with {len(mappings)} mappings and {len(evidence)} evidence anchors")
+    print("  evidence tiers: " + ", ".join(f"{tier} {count}" for tier, count in sorted(spread.items())))
 
 
 if __name__ == "__main__":

package/scripts/lib/caller_identity.py

@@ -0,0 +1,238 @@
+#!/usr/bin/env python3
+"""Read the exact AA caller identity of the CLI this process runs under.
+
+Walks up the process tree to the nearest vendor CLI, reads the model and effort
+it was launched with, and maps them onto the one scored configuration they
+select. Launch flags are the harness's request selector: the same class of
+evidence the transport overlay carries, and unlike a hand-written caller-context
+file, not something the model can edit.
+
+Prints the path of a caller-context file for that identity. Exits 3 with the
+reason on stderr when it cannot decide. It never guesses: a missing flag, an
+alias, or an identity the frozen registry does not score exactly once is a
+refusal, not a fallback.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+from typing import Callable, Optional
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import aa_policy  # noqa: E402
+
+REPO = Path(__file__).resolve().parents[2]
+MAX_DEPTH = 64
+ENCODED_EFFORTS = ("xhigh", "high", "medium", "low")
+Selector = tuple[str, Optional[str], Optional[str]]
+Lookup = Callable[[int], Optional[tuple[int, list[str]]]]
+
+
+def _vendor(executable: str) -> str | None:
+    path = Path(executable)
+    name = path.name
+    if name == "claude" or (path.parent.name == "versions" and path.parent.parent.name == "claude"):
+        return "claude"
+    if name == "codex":
+        return "codex"
+    if name == "grok" or (name.startswith("grok-") and path.parent.name == "downloads"):
+        return "grok"
+    if name == "agy":
+        return "gemini"
+    return None
+
+
+def _flag(argv: list[str], *names: str) -> str | None:
+    """The last value given for any of names, as `--name value` or `--name=value`."""
+    value = None
+    for index, token in enumerate(argv):
+        for name in names:
+            if token == name and index + 1 < len(argv):
+                value = argv[index + 1]
+            elif token.startswith(name + "="):
+                value = token.split("=", 1)[1]
+    return value
+
+
+def _codex_effort(argv: list[str]) -> str | None:
+    effort = None
+    for index, token in enumerate(argv[:-1]):
+        if token in ("-c", "--config"):
+            key, _, value = argv[index + 1].partition("=")
+            if key.strip() == "model_reasoning_effort":
+                effort = value.strip().strip("'\"")
+    return effort
+
+
+def read_selector(argv: list[str]) -> Selector | None:
+    """(vendor, model, effort) when argv launches a vendor CLI, otherwise None."""
+    if not argv:
+        return None
+    vendor = _vendor(argv[0])
+    rest = argv[1:]
+    if vendor == "claude":
+        return vendor, _flag(rest, "--model"), _flag(rest, "--effort")
+    if vendor == "codex":
+        return vendor, _flag(rest, "-m", "--model"), _codex_effort(rest)
+    if vendor == "grok":
+        return vendor, _flag(rest, "-m", "--model"), _flag(rest, "--reasoning-effort")
+    if vendor == "gemini":
+        return vendor, _flag(rest, "--model", "-m"), None
+    return None
+
+
+def resolve(registry: dict, vendor: str, model: str | None,
+            effort: str | None) -> tuple[dict | None, str]:
+    """The one scored row a launch selector lands on, or None and the reason."""
+    if not model:
+        return None, f"{vendor} was launched without a model flag"
+    if vendor == "gemini" and effort is None:
+        base, _, suffix = model.rpartition("-")
+        if suffix in ENCODED_EFFORTS:
+            model, effort = base, suffix
+    if vendor == "codex":
+        if effort is None:
+            return None, (f"codex was launched without model_reasoning_effort; its configured "
+                          f"default is not read, so the effort of {model} is unknown")
+        if effort == "none":
+            effort = None
+    rows = [row for row in registry["scored_configs"]
+            if row["vendor"] == vendor and row["model"] == model and row["effort"] == effort]
+    excluded = []
+    if vendor == "claude":
+        # ADR-0046: --effort has no reasoning-off value, so a non-reasoning row
+        # can never be what a Claude launch selected.
+        excluded = [row for row in rows if row["reasoning"] == "non-reasoning"]
+        rows = [row for row in rows if row["reasoning"] != "non-reasoning"]
+    if len(rows) == 1:
+        return rows[0], ""
+    if rows:
+        return None, f"{vendor} {model} at effort {effort} matches {len(rows)} scored configurations"
+    if excluded:
+        return None, (f"the only scored {model} row at effort {effort} is non-reasoning, which a "
+                      f"Claude launch cannot select")
+    if vendor == "claude" and effort is None:
+        return None, f"{model} was launched without --effort and no default is scored for it"
+    return None, f"no scored configuration for {vendor} {model} at effort {effort}"
+
+
+def _process(pid: int) -> tuple[int, list[str]] | None:
+    """(ppid, argv) for pid. /proc keeps argv exact; ps joins it with spaces, so
+    argv[0] comes from `comm`, which keeps a path like `Application Support` whole."""
+    proc = Path(f"/proc/{pid}")
+    if proc.is_dir():
+        try:
+            argv = [part.decode(errors="replace")
+                    for part in (proc / "cmdline").read_bytes().split(b"\0") if part]
+            ppid = int((proc / "stat").read_text().rsplit(")", 1)[1].split()[1])
+        except (OSError, ValueError, IndexError):
+            return None
+        return ppid, argv
+    try:
+        head = subprocess.run(["ps", "-o", "ppid=", "-o", "comm=", "-p", str(pid)],
+                              capture_output=True, text=True, timeout=5).stdout.strip()
+        args = subprocess.run(["ps", "-o", "args=", "-p", str(pid)],
+                              capture_output=True, text=True, timeout=5).stdout.strip()
+    except (OSError, subprocess.SubprocessError):
+        return None
+    parts = head.split(None, 1)
+    if len(parts) != 2 or not parts[0].isdigit():
+        return None
+    comm = parts[1].strip()
+    rest = args[len(comm):] if args.startswith(comm) else args.partition(" ")[2]
+    return int(parts[0]), [comm, *rest.split()]
+
+
+def find_launcher(pid: int, lookup: Lookup = _process) -> tuple[int, Selector] | None:
+    """The nearest process at or above pid that is a vendor CLI, with its selector.
+
+    Nearest wins: a codex worker started by a Claude session is a codex caller.
+    """
+    seen: set[int] = set()
+    for _ in range(MAX_DEPTH):
+        if pid <= 0 or pid in seen:
+            return None
+        seen.add(pid)
+        entry = lookup(pid)
+        if entry is None:
+            return None
+        ppid, argv = entry
+        selector = read_selector(argv)
+        if selector is not None:
+            return pid, selector
+        pid = ppid
+    return None
+
+
+def load_registry(path: str | Path) -> tuple[dict, str]:
+    """The approved registry without the transport overlay, which says nothing
+    about the caller and must not stop one from learning who it is."""
+    saved = {key: os.environ.pop(key)
+             for key in ("OMNILANE_AA_TRANSPORT_OVERLAY", "OMNILANE_AA_OVERLAY_SHA256")
+             if key in os.environ}
+    try:
+        return aa_policy.load_registry(path)
+    finally:
+        os.environ.update(saved)
+
+
+def write_context(row: dict, registry: dict, home: Path) -> Path:
+    """One file per identity: every session launched the same way is the same caller."""
+    directory = Path(home) / "caller-context"
+    directory.mkdir(parents=True, exist_ok=True)
+    path = directory / (row["id"].replace("/", "--") + ".json")
+    text = json.dumps({
+        "schema_version": 1,
+        "snapshot_id": registry["snapshot"]["id"],
+        "kind": "model",
+        "caller": {key: row[key] for key in aa_policy.IDENTITY_FIELDS},
+        "inherited_ceiling": row["score"],
+    }, indent=2, sort_keys=True) + "\n"
+    try:
+        if path.read_text() == text:
+            return path
+    except OSError:
+        pass
+    staging = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    staging.write_text(text)
+    os.replace(staging, path)
+    return path
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--registry",
+                        default=os.environ.get("OMNILANE_AA_POLICY_FILE")
+                        or str(REPO / "config" / "aa-model-policy.json"),
+                        help="frozen AA registry (default: the repository copy)")
+    args = parser.parse_args(argv)
+    try:
+        registry, _ = load_registry(args.registry)
+    except (aa_policy.PolicyError, OSError, ValueError) as error:
+        print(f"omnilane: cannot read the AA registry: {error}", file=sys.stderr)
+        return 3
+    found = find_launcher(os.getpid())
+    if found is None:
+        print("omnilane: no vendor CLI among this process's ancestors; a model caller passes "
+              "--caller-context FILE and a human operator --operator-asserted-human",
+              file=sys.stderr)
+        return 3
+    pid, (vendor, model, effort) = found
+    row, reason = resolve(registry, vendor, model, effort)
+    if row is None:
+        print(f"omnilane: cannot read the caller identity from pid {pid}: {reason}", file=sys.stderr)
+        return 3
+    home = Path(os.environ.get("OMNILANE_HOME") or Path.home() / ".omnilane")
+    path = write_context(row, registry, home)
+    print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}",
+          file=sys.stderr)
+    print(path)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lib/overlay_health.py

@@ -68,17 +68,23 @@ def main() -> None:
         detail = "; ".join(offenders(Path(overlay_path))) or str(error)
         emit("FAIL", f"overlay rejected, every dispatch is refused: {error} ({detail})")
 
+    tiers = registry.get("_transport_evidence_tiers", {})
     verified = Counter()
     for row in registry["scored_configs"]:
         if row["transport_mapping"].get("runtime_verified") is True:
-            verified[row["vendor"]] += 1
-    summary = ", ".join(f"{v} {n}" for v, n in sorted(verified.items())) or "none"
+            verified[row["vendor"], tiers.get(row["id"], "selector-only")] += 1
+    summary = ", ".join(f"{vendor} {count} {tier}"
+                        for (vendor, tier), count in sorted(verified.items())) or "none"
 
     import json
 
     overlay = json.loads(Path(overlay_path).read_text())
     unproven = overlay.get("unproven", [])
     extra = f"; {len(unproven)} config(s) recorded unproven" if unproven else ""
+    weak = sorted({vendor for (vendor, tier) in verified if tier == "selector-only"})
+    if weak:
+        extra += (f"; {', '.join(weak)} prove only the request selector, re-probe to "
+                  "record who answered")
 
     stale = registry.get("_stale_transport_vendors", [])
     if stale: