omnilane 0.42.8 → 0.44.0

package/scripts/lib/aa_lanes.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""Add eligible_lanes to a refused AA decision.
+
+A refusal that only says no leaves a model caller guessing. This reads the
+decision on stdin and appends the lanes whose chain still holds a target at or
+below the caller's effective ceiling, by registry score alone: no CLI is probed
+and nothing is dispatched. Output is one JSON line, the decision plus the list.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import shlex
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import aa_policy  # noqa: E402
+import caller_identity  # noqa: E402
+
+
+def lanes(paths: list[Path]) -> dict[str, list[list[str]]]:
+    """Lane -> chain segments; the first file naming a lane wins, as in dispatch."""
+    table: dict[str, list[list[str]]] = {}
+    for path in paths:
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        for line in text.splitlines():
+            line = line.split("#", 1)[0]
+            if not line.strip() or line[0] in " \t" or ":" not in line:
+                continue
+            name, chain = line.split(":", 1)
+            name = name.strip()
+            if not name or name in table or not chain.strip():
+                continue
+            segments = []
+            for segment in chain.split("|"):
+                try:
+                    fields = shlex.split(segment)
+                except ValueError:
+                    fields = []
+                if fields:
+                    segments.append(fields)
+            table[name] = segments
+    return table
+
+
+def eligible(registry: dict, table: dict[str, list[list[str]]], ceiling: int) -> list[dict]:
+    found = []
+    for lane, segments in table.items():
+        for fields in segments:
+            vendor = fields[0]
+            if vendor in ("off", "vote") or len(fields) < 2:
+                continue
+            effort = fields[2] if len(fields) > 2 and fields[2] != "-" else None
+            row, _ = caller_identity.resolve(registry, vendor, fields[1], effort)
+            if row is None or row["score"] > ceiling:
+                continue
+            found.append({
+                "lane": lane,
+                "target": row["id"],
+                "score": row["score"],
+                "transport_verified": row["transport_mapping"].get("runtime_verified") is True,
+            })
+            break
+    return found
+
+
+def lane_requirement(registry: dict, segments: list[list[str]], caller: dict | None) -> dict | None:
+    """The cheapest target in one lane, and the caller effort that would reach it."""
+    rows = []
+    for fields in segments:
+        if fields[0] in ("off", "vote") or len(fields) < 2:
+            continue
+        effort = fields[2] if len(fields) > 2 and fields[2] != "-" else None
+        row, _ = caller_identity.resolve(registry, fields[0], fields[1], effort)
+        if row is not None:
+            rows.append(row)
+    if not rows:
+        return None
+    cheapest = min(rows, key=lambda row: (row["score"], row["id"]))
+    required = None
+    if isinstance(caller, dict):
+        reaching = sorted((row for row in registry["scored_configs"]
+                           if row["vendor"] == caller.get("vendor") and row["model"] == caller.get("model")
+                           and row["score"] >= cheapest["score"]),
+                          key=lambda row: (row["score"], row["id"]))
+        if reaching:
+            required = reaching[0]["effort"] or "none"
+    return {"target": cheapest["id"], "score": cheapest["score"], "required_caller_effort": required}
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--registry", required=True)
+    parser.add_argument("--routing", action="append", default=[], type=Path,
+                        help="routing file, highest precedence first; may repeat")
+    parser.add_argument("--lane", help="the lane that was refused")
+    args = parser.parse_args(argv)
+    raw = sys.stdin.read()
+    try:
+        decision = json.loads(raw)
+        ceiling = decision.get("effective_ceiling")
+        if decision.get("allowed") is False and type(ceiling) is int:
+            registry, _ = aa_policy.load_registry(args.registry)
+            table = lanes(args.routing)
+            decision["eligible_lanes"] = eligible(registry, table, ceiling)
+            if args.lane in table and decision.get("code") == "target-above-effective-ceiling":
+                # The decision describes the last candidate tried; the lane may hold a cheaper one.
+                need = lane_requirement(registry, table[args.lane], decision.get("caller"))
+                if need is not None:
+                    decision["lane_requirement"] = dict(need, lane=args.lane)
+                    if decision.get("inherited_ceiling") == decision.get("caller_score"):
+                        decision["required_caller_effort"] = need["required_caller_effort"]
+                        effort = need["required_caller_effort"]
+                        held = (" The harness recorded no effort, so this caller is held to its "
+                                "model's floor." if decision.get("caller_degraded") else "")
+                        decision["reason"] = (
+                            f"lane {args.lane}'s cheapest target {need['target']} scores "
+                            f"{need['score']}, above this caller's ceiling of {ceiling}.{held} "
+                            + (f"Relaunch the calling session at effort {effort} or higher, or have "
+                               "a human operator dispatch it." if effort else
+                               "No effort of the caller's model reaches it; a stronger caller model "
+                               "or a human operator has to dispatch it."))
+        sys.stdout.write(json.dumps(decision, ensure_ascii=False, separators=(",", ":")) + "\n")
+    except (ValueError, OSError, aa_policy.PolicyError, KeyError, TypeError):
+        # Guidance is best effort; the refusal itself must always get through.
+        sys.stdout.write(raw if raw.endswith("\n") else raw + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lib/aa_policy.py

@@ -239,7 +239,13 @@ def load_caller(path: str | Path, registry: dict[str, Any],
     _check(value.get("snapshot_id") == registry["snapshot"]["id"],
            "caller-context snapshot does not match frozen registry")
     _check(value.get("kind") == "model", "unsupported caller-context kind")
+    # effort_unverified marks a caller degraded to its model's lowest-scored row
+    # because the launching harness recorded no effort; it may only be true.
+    unverified = value.pop("effort_unverified", None)
+    _check(unverified is None or unverified is True, "invalid caller-context effort_unverified")
     _exact_fields(value, {"schema_version", "snapshot_id", "kind", "caller", "inherited_ceiling"})
+    if unverified:
+        value["effort_unverified"] = True
     value["caller"] = _identity(value["caller"], "caller")
     ceiling = value["inherited_ceiling"]
     _check(type(ceiling) is int and 0 <= ceiling <= 100,
@@ -345,10 +351,15 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
                      "file it prints as --caller-context, which dispatch does itself when the "
                      "launching CLI names its model and effort; a human operator passes "
                      "--operator-asserted-human"),
+            failed_gate="caller-identity",
+            reason="no caller identity reached the gate",
+            next_command="omnilane whoami",
         )
         return base
     base["caller_context_sha256"] = caller_sha256
     caller_identity = caller["caller"]
+    degraded = caller.get("effort_unverified") is True
+    base["caller_degraded"] = degraded
     caller_rows = _matching_rows(registry, caller_identity)
     if len(caller_rows) != 1:
         detail = _unknown_reason(registry, caller_identity)
@@ -356,9 +367,24 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
             code="unknown-caller-config" if not caller_rows else "ambiguous-caller-config",
             message=detail or "caller exact vendor/model/effort/reasoning/fallback is not uniquely scored",
             caller=caller_identity,
+            failed_gate="caller-identity",
+            reason="the caller context names a configuration the frozen registry does not score exactly once",
+            next_command="omnilane whoami",
         )
         return base
     caller_row = caller_rows[0]
+    model_rows = [row for row in registry["scored_configs"]
+                  if row["vendor"] == caller_row["vendor"] and row["model"] == caller_row["model"]]
+    if degraded and caller_row["score"] != min(row["score"] for row in model_rows):
+        base.update(
+            code="invalid-degraded-caller",
+            message="an effort-unverified caller must name its model's lowest-scored row",
+            caller=caller_identity,
+            failed_gate="caller-identity",
+            reason="effort_unverified was set on a row above the model's floor",
+            next_command="omnilane whoami",
+        )
+        return base
     effective = min(caller_row["score"], caller["inherited_ceiling"])
     base.update(
         caller=caller_identity,
@@ -370,7 +396,14 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
         registry, vendor, model, effort, target_config
     )
     if target_row is None:
-        base.update(code=mapping_code, message="target runtime cannot be mapped to one verified exact AA configuration", **detail)
+        base.update(
+            code=mapping_code,
+            message="target runtime cannot be mapped to one verified exact AA configuration",
+            failed_gate="target-transport",
+            reason=("the caller is identified; this host's transport overlay does not currently "
+                    f"verify {vendor} {model} at effort {effort}"),
+            next_command="omnilane resign --check",
+            **detail)
         return base
     target_score = target_row["score"]
     target_identity = _row_identity(target_row)
@@ -381,9 +414,30 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
         target_estimated=target_row["estimated"],
     )
     if target_score > effective:
+        reaching = sorted((row for row in model_rows if row["score"] >= target_score),
+                          key=lambda row: (row["score"], row["id"]))
+        required = reaching[0]["effort"] or "none" if reaching else None
+        if caller["inherited_ceiling"] < caller_row["score"]:
+            reason = ("this worker inherited a ceiling below the target; only the session that "
+                      "dispatched it, or a human operator, can reach this target")
+            required = None
+        elif required is None:
+            reason = (f"no scored effort of {caller_row['model']} reaches {target_score}; a "
+                      "stronger caller model or a human operator has to dispatch this target")
+        elif degraded:
+            reason = (f"the launching harness recorded no effort, so the caller was held to "
+                      f"{caller_row['model']}'s floor of {effective}; relaunch the session with an "
+                      f"explicit effort of {required} or higher")
+        else:
+            reason = (f"relaunch the calling session at effort {required} or higher, or have a "
+                      "human operator dispatch this target")
         base.update(
             code="target-above-effective-ceiling",
             message=f"target score {target_score} exceeds effective caller ceiling {effective}",
+            failed_gate="downward-ceiling",
+            reason=reason,
+            required_caller_effort=required,
+            next_command="omnilane list",
         )
         return base
     child_context = {
@@ -402,6 +456,105 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
     return base
 
 
+def decide_inherited(registry: dict[str, Any], registry_sha256: str, *,
+                     caller: dict[str, Any] | None, caller_sha256: str | None,
+                     operator_asserted_human: bool = False,
+                     host_asserted: dict[str, str] | None = None) -> dict[str, Any]:
+    """A native worker that inherits the caller's own model and effort unchanged.
+
+    It runs what the caller runs, so it scores what the caller scores and cannot
+    be an upward dispatch, whether or not the caller's effort is known. There is
+    no external CLI, so no transport mapping is involved. It is nobody's lane
+    target: the decision names no target configuration and must not be reported
+    as satisfying one.
+
+    None of that rests on knowing who the caller is, so a caller whose identity
+    cannot be read still gets an inherited worker, on the host's word for its
+    vendor and model. That decision is marked unverified, carries no ceiling and
+    publishes no child context: a worker that tried to dispatch would have no
+    identity to dispatch with.
+    """
+    base: dict[str, Any] = {
+        "schema_version": 1,
+        "snapshot_id": registry["snapshot"]["id"],
+        "registry_sha256": registry_sha256,
+        "allowed": False,
+        "code": "deny",
+        "message": "AA policy denied dispatch",
+        "caller_kind": "operator-asserted-human" if operator_asserted_human else "model",
+        "target_request": {"vendor": None, "model": None, "effort": None, "inherit": True},
+        "target_config_id": None,
+        "caller_score": None,
+        "inherited_ceiling": None,
+        "effective_ceiling": None,
+        "target_score": None,
+        "target_estimated": None,
+        "child_context": None,
+        "evidence_limit": ("the host asserts that a sub-agent spawned without a model override "
+                           "inherits the caller's runtime; omnilane cannot observe it"),
+    }
+    if operator_asserted_human:
+        base.update(code="inherit-requires-model-caller",
+                    message="only a model running inside a harness has a runtime to inherit",
+                    failed_gate="caller-identity",
+                    reason="a human operator has no sub-agent tool; dispatch a lane instead",
+                    next_command="omnilane list")
+        return base
+    if caller is None and host_asserted is not None:
+        base.update(allowed=True, code="native-inherited-unverified-caller",
+                    message="the worker inherits the caller's own runtime, so it cannot score above it; "
+                            "the caller's vendor and model are the host's statement, not a verified identity",
+                    caller_kind="model-unverified", caller_identity_verified=False,
+                    caller_identity_source="host-asserted",
+                    target={"inherit": True, "vendor": host_asserted["vendor"],
+                            "model": host_asserted["model"]})
+        return base
+    if caller is None:
+        base.update(code="missing-caller-context",
+                    message="no caller identity: an inherited worker still has to know whose runtime it inherits",
+                    failed_gate="caller-identity",
+                    reason="no caller identity reached the gate and the capability file names no current_model",
+                    next_command="omnilane whoami  # if that cannot read this harness: omnilane "
+                                 "native-context --vendor VENDOR --model MODEL --inherits-caller-runtime")
+        return base
+    base["caller_context_sha256"] = caller_sha256
+    base["caller_identity_verified"] = True
+    base["caller_identity_source"] = "caller-context"
+    identity = caller["caller"]
+    degraded = caller.get("effort_unverified") is True
+    rows = _matching_rows(registry, identity)
+    if len(rows) != 1:
+        base.update(code="unknown-caller-config" if not rows else "ambiguous-caller-config",
+                    message=_unknown_reason(registry, identity)
+                    or "caller exact vendor/model/effort/reasoning/fallback is not uniquely scored",
+                    caller=identity, failed_gate="caller-identity",
+                    reason="the caller context names a configuration the frozen registry does not score exactly once",
+                    next_command="omnilane whoami")
+        return base
+    row = rows[0]
+    floor = min(r["score"] for r in registry["scored_configs"]
+                if r["vendor"] == row["vendor"] and r["model"] == row["model"])
+    if degraded and row["score"] != floor:
+        base.update(code="invalid-degraded-caller",
+                    message="an effort-unverified caller must name its model's lowest-scored row",
+                    caller=identity, failed_gate="caller-identity",
+                    reason="effort_unverified was set on a row above the model's floor",
+                    next_command="omnilane whoami")
+        return base
+    effective = min(row["score"], caller["inherited_ceiling"])
+    child = {"schema_version": 1, "snapshot_id": registry["snapshot"]["id"], "kind": "model",
+             "caller": identity, "inherited_ceiling": effective}
+    if degraded:
+        child["effort_unverified"] = True
+    base.update(allowed=True, code="native-inherited-allowed",
+                message="the worker inherits the caller's own runtime, so it cannot score above it",
+                caller=identity, caller_degraded=degraded, caller_score=row["score"],
+                inherited_ceiling=caller["inherited_ceiling"], effective_ceiling=effective,
+                target={"inherit": True, "vendor": row["vendor"], "model": row["model"]},
+                child_context=child)
+    return base
+
+
 def _normalized_effort(value: str) -> str | None:
     return None if value in ("", "-") else value
 

package/scripts/lib/build_overlay.py

@@ -6,6 +6,8 @@ corresponds to a probe run under the selected evidence root whose raw
 stdout/stderr is hashed into the manifest, so the overlay's evidence[] anchors
 the whole set.
 """
+from __future__ import annotations
+
 import argparse
 import hashlib
 import json
@@ -14,9 +16,13 @@ import shutil
 import socket
 from collections import Counter
 from datetime import datetime, timezone
+import sys
 from pathlib import Path
 
-REPO = Path(os.environ.get("OMNILANE_REPO", "/Users/vincentw/dev/omnilane"))
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import cli_provenance  # noqa: E402
+
+REPO = Path(os.environ.get("OMNILANE_REPO") or Path(__file__).resolve().parents[2])
 HOME = Path.home()
 SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
 DEFAULT_ROOT = HOME / ".omnilane" / "transport-evidence" / SWEEP_ID
@@ -98,19 +104,21 @@ def cli_path(name: str) -> Path:
     return Path(found).resolve()
 
 
+RUNNERS = {"grok": "run-grok.sh", "codex": "run-codex.sh", "claude": "run-claude.sh",
+           "gemini": "run-gemini.sh"}
+CLI_NAMES = {"grok": "grok", "codex": "codex", "claude": "claude", "gemini": "agy"}
+
+
 def core_evidence() -> list[tuple[Path, str]]:
     """Resolved when a build runs, not at import: a host missing one CLI can
     still load this module to read PROVEN."""
-    return [
-        (cli_path("grok"), "grok"),
-        (REPO / "scripts/runners/run-grok.sh", "grok"),
-        (cli_path("codex"), "codex"),
-        (REPO / "scripts/runners/run-codex.sh", "codex"),
-        (cli_path("claude"), "claude"),
-        (REPO / "scripts/runners/run-claude.sh", "claude"),
-        (cli_path("agy"), "gemini"),
-        (REPO / "scripts/runners/run-gemini.sh", "gemini"),
-    ]
+    anchors = []
+    for vendor in ("grok", "codex", "claude", "gemini"):
+        if shutil.which(CLI_NAMES[vendor]) is None:
+            continue  # not installed here: main() signs nothing for it
+        anchors += [(cli_path(CLI_NAMES[vendor]), vendor),
+                    (REPO / "scripts/runners" / RUNNERS[vendor], vendor)]
+    return anchors
 
 
 def sha256(path: Path) -> str:
@@ -129,6 +137,12 @@ def main(argv: list[str] | None = None) -> None:
         default=DEFAULT_ROOT,
         help=f"probe sweep root (default: {DEFAULT_ROOT})",
     )
+    parser.add_argument(
+        "--source",
+        default=os.environ.get("OMNILANE_TRANSPORT_SOURCE")
+        or f"{socket.gethostname()} / build_overlay {datetime.now(timezone.utc).date().isoformat()}",
+        help="free-text provenance recorded in the overlay",
+    )
     args = parser.parse_args(argv)
     root = args.root.expanduser()
 
@@ -144,7 +158,11 @@ def main(argv: list[str] | None = None) -> None:
             if path.exists():
                 entry[suffix] = {"path": str(path), "sha256": sha256(path)}
         if "json" not in entry:
-            raise SystemExit(f"missing probe evidence for {cid}: {ev}")
+            # A vendor nobody is logged in to was never probed; that is a gap in this
+            # host's overlay, not a reason to refuse to sign the vendors that were.
+            unproven.append({"config_id": cid, "verdict_reason": "not probed on this host",
+                             "observed_model": None, "probed_at": None})
+            continue
         descriptor_path = Path(entry["json"]["path"])
         descriptor = json.loads(descriptor_path.read_text())
         if not isinstance(descriptor, dict):
@@ -169,11 +187,18 @@ def main(argv: list[str] | None = None) -> None:
     manifest_path = root / "probe-manifest.json"
     manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
 
+    anchors = core_evidence()
+    anchored = {vendor for _, vendor in anchors}
     mappings = []
     for cid, (selector, runtime_model, _) in sorted(PROVEN.items()):
         if cid not in manifest["probe_runs"]:
             continue
         row = ROWS[cid]
+        if row["vendor"] not in anchored:
+            # Evidence with no executable to pin it to verifies nothing.
+            unproven.append({"config_id": cid, "verdict_reason": "vendor CLI is not installed",
+                             "observed_model": None, "probed_at": None})
+            continue
         mapping = {
             "config_id": cid,
             "identity": {key: row[key] for key in IDENTITY_FIELDS},
@@ -187,18 +212,20 @@ def main(argv: list[str] | None = None) -> None:
             mapping["cli_flag"] = "--reasoning-effort"
         mappings.append(mapping)
 
-    evidence = [
-        {"path": str(path), "sha256": sha256(path), "vendor": vendor}
-        for path, vendor in core_evidence()
-    ]
+    evidence = []
+    for path, vendor in anchors:
+        anchor = {"path": str(path), "sha256": sha256(path), "vendor": vendor}
+        if path.name != RUNNERS[vendor]:
+            # The signer an unattended re-sign is later held to; see cli_provenance.
+            anchor["codesign"] = cli_provenance.facts(path)
+        evidence.append(anchor)
     evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
 
     overlay = {
         "schema_version": 1,
         "snapshot_id": REGISTRY["snapshot"]["id"],
         "host": socket.gethostname(),
-        "source": ("claude-code / MacStudio / operator-directed full sweep 2026-09-07; "
-                   "gemini selectors re-probed 2026-09-09 after agy 1.1.27 -> 1.1.28"),
+        "source": args.source,
         "evidence": evidence,
         "mappings": mappings,
         "unproven": unproven,

package/scripts/lib/caller_identity.py

@@ -40,6 +40,8 @@ Selector = tuple[str, Optional[str], Optional[str]]
 Lookup = Callable[[int], Optional[tuple[int, list[str]]]]
 EnvironmentLookup = Callable[[int], dict[str, str]]
 UUID_PATTERN = re.compile(r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}\Z")
+CODEX_TOOL_HOSTS = frozenset(("codex-code-mode-host",))
+SHELLS = frozenset(("zsh", "bash", "sh", "dash", "fish"))
 TURN_END_EVENTS = frozenset(("task_complete", "turn_complete", "turn_aborted"))
 CODEX_SANDBOX_REFUSAL = (
     "Codex sandbox (CODEX_SANDBOX=seatbelt) blocked process inspection; omnilane also "
@@ -58,7 +60,9 @@ def _vendor(executable: str) -> str | None:
     name = path.name
     if name == "claude" or (path.parent.name == "versions" and path.parent.parent.name == "claude"):
         return "claude"
-    if name == "codex":
+    # codex-profile-switch launches the desktop app-server as `codex-modified`; its sibling
+    # `codex-code-mode-host` is a tool host, not the CLI, so the match stays exact.
+    if name in ("codex", "codex-modified"):
         return "codex"
     if name == "grok" or (name.startswith("grok-") and path.parent.name == "downloads"):
         return "grok"
@@ -184,6 +188,17 @@ def resolve(registry: dict, vendor: str, model: str | None,
     return None, f"no scored configuration for {vendor} {model} at effort {effort}"
 
 
+def floor_row(registry: dict, vendor: str, model: str | None) -> dict | None:
+    """The lowest-scored row of a known model, for a caller whose effort is unrecorded.
+
+    Whatever effort actually ran scores at least this much, so the floor can only
+    narrow what the caller may dispatch; it never widens it.
+    """
+    rows = [row for row in registry["scored_configs"]
+            if row["vendor"] == vendor and row["model"] == model]
+    return min(rows, key=lambda row: (row["score"], row["id"])) if rows else None
+
+
 def _thread_environment(entries: list[bytes]) -> dict[str, str]:
     values = [entry.partition(b"=")[2] for entry in entries
               if entry.partition(b"=")[0] == b"CODEX_THREAD_ID"]
@@ -279,7 +294,7 @@ def _launcher(pid: int, lookup: Lookup) -> tuple[int, Selector, int | None] | No
     Nearest wins: a codex worker started by a Claude session is a codex caller.
     """
     seen: set[int] = set()
-    child = None
+    below: list[tuple[int, list[str]]] = []
     for _ in range(MAX_DEPTH):
         if pid <= 0 or pid in seen:
             return None
@@ -290,12 +305,25 @@ def _launcher(pid: int, lookup: Lookup) -> tuple[int, Selector, int | None] | No
         ppid, argv = entry
         selector = read_selector(argv)
         if selector is not None:
-            return pid, selector, child
-        child = pid
+            return pid, selector, _thread_anchor(below)
+        below.append((pid, argv))
         pid = ppid
     return None
 
 
+def _thread_anchor(below: list[tuple[int, list[str]]]) -> int | None:
+    """The process whose initial environment codex wrote for this conversation.
+
+    That is codex's direct child, unless codex runs commands through its own tool
+    host: one host serves every conversation of an app-server, so it carries no
+    thread id and the process it starts for the command does.
+    """
+    for pid, argv in reversed(below):
+        if not (argv and Path(argv[0]).name in CODEX_TOOL_HOSTS):
+            return pid
+    return None
+
+
 def find_launcher(pid: int, lookup: Lookup = _process) -> tuple[int, Selector] | None:
     try:
         found = _launcher(pid, lookup)
@@ -400,11 +428,20 @@ def _rollout_selector(thread: str,
         event, context_turn, event_turn = ended
         raise ValueError(f"latest turn_context turn {context_turn} has already ended "
                          f"({event}, turn {event_turn})" + _rollout_age_hint(last_timestamp, now))
-    for key, value in latest.items():
+    for key in ("turn_id", "model"):
+        value = latest[key]
         if not isinstance(value, str) or not value.strip():
             detail = " (turn unknown)" if key == "turn_id" else ""
             raise ValueError(f"latest turn_context {key} must be a non-empty string{detail}")
-    return ("codex", latest["model"], latest["effort"]), f"thread {thread}, turn {latest['turn_id']}"
+    effort = latest["effort"]
+    source = f"thread {thread}, turn {latest['turn_id']}"
+    if effort is None:
+        # Heartbeat automations wake a thread without recording an effort. The
+        # model is still known, so the caller degrades instead of going blind.
+        return ("codex", latest["model"], None), source + ", turn_context records no effort"
+    if not isinstance(effort, str) or not effort.strip():
+        raise ValueError("latest turn_context effort must be a non-empty string")
+    return ("codex", latest["model"], effort), source
 
 
 def read_caller(pid: int, lookup: Lookup = _process,
@@ -442,7 +479,17 @@ def read_caller(pid: int, lookup: Lookup = _process,
         detail = f"errno {error.errno}" if isinstance(error, OSError) else "invalid environment block"
         raise ValueError(f"cannot read codex direct child initial environment ({detail})") from None
     if not inherited or not UUID_PATTERN.fullmatch(inherited):
-        raise ValueError("codex direct child CODEX_THREAD_ID is missing or not a UUID")
+        entry = lookup(child)
+        name = Path(entry[1][0]).name if entry and entry[1] else "unknown"
+        hint = ""
+        if name.lstrip("-") in SHELLS:
+            # codex starts `zsh -lc '<command>'`; the shell sets the thread id and, for one
+            # simple command, execs into it, so that command is the direct child. With
+            # `;`, `&&`, `|` or a subshell the shell stays, and its own start had no id.
+            hint = ("; run the omnilane command as the only command of the tool call, "
+                    "with no `;`, `&&`, `|` or subshell around it")
+        raise ValueError(f"codex direct child CODEX_THREAD_ID is missing or not a UUID "
+                         f"(read from pid {child}, {name}){hint}")
     if inherited != thread:
         raise ValueError("CODEX_THREAD_ID mismatch between current process and codex direct child")
     selector, source = _rollout_selector(thread, current_environment, now)
@@ -461,18 +508,25 @@ def load_registry(path: str | Path) -> tuple[dict, str]:
         os.environ.update(saved)
 
 
-def write_context(row: dict, registry: dict, home: Path) -> Path:
+def write_context(row: dict, registry: dict, home: Path, effort_unverified: bool = False) -> Path:
     """One file per identity: every session launched the same way is the same caller."""
     directory = Path(home) / "caller-context"
     directory.mkdir(parents=True, exist_ok=True)
-    path = directory / (row["id"].replace("/", "--") + ".json")
-    text = json.dumps({
+    stem = row["id"].replace("/", "--")
+    if effort_unverified:
+        # Not the same caller as one that really launched at the floor effort.
+        stem = f"{row['vendor']}--{row['model'].replace('.', '-')}--effort-unverified"
+    path = directory / (stem + ".json")
+    value = {
         "schema_version": 1,
         "snapshot_id": registry["snapshot"]["id"],
         "kind": "model",
         "caller": {key: row[key] for key in aa_policy.IDENTITY_FIELDS},
         "inherited_ceiling": row["score"],
-    }, indent=2, sort_keys=True) + "\n"
+    }
+    if effort_unverified:
+        value["effort_unverified"] = True
+    text = json.dumps(value, indent=2, sort_keys=True) + "\n"
     try:
         if path.read_text() == text:
             return path
@@ -505,14 +559,24 @@ def main(argv: list[str] | None = None, environment: Mapping[str, str] = os.envi
         print(f"omnilane: cannot read the caller identity: {error}", file=sys.stderr)
         return 3
     row, reason = resolve(registry, vendor, model, effort)
+    degraded = False
+    if row is None and vendor == "codex" and model and effort is None:
+        row = floor_row(registry, vendor, model)
+        degraded = row is not None
     if row is None:
         print(f"omnilane: cannot read the caller identity from pid {pid}: {reason}", file=sys.stderr)
         return 3
     home = Path(os.environ.get("OMNILANE_HOME") or Path.home() / ".omnilane")
-    path = write_context(row, registry, home)
+    path = write_context(row, registry, home, effort_unverified=degraded)
     provenance = f", {source}" if source else ""
-    print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}{provenance}",
-          file=sys.stderr)
+    if degraded:
+        print(f"omnilane: caller is {vendor}/{model} at an unrecorded effort; degraded to its "
+              f"lowest-scored row {row['id']} (ceiling {row['score']}), read from pid {pid}"
+              f"{provenance}. Lanes above that ceiling need a session launched with an "
+              f"explicit effort.", file=sys.stderr)
+    else:
+        print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}"
+              f"{provenance}", file=sys.stderr)
     print(path)
     return 0