omnilane 0.42.8 → 0.44.0

package/scripts/lib/cli_provenance.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Who signed a vendor CLI, and whether a changed one may be re-signed unattended.
+
+The transport overlay pins each vendor's executable by hash. Vendor CLIs update
+themselves, so that pin goes stale as routine traffic. Re-pinning on sight would
+turn the pin into a rubber stamp; this module is what stands in between. A
+changed executable may be re-probed without an operator only when it still
+carries the signer recorded when the overlay was last signed and still lives in
+the same install location. Anything else is a notification, not a re-sign.
+"""
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+ADHOC = "adhoc"
+UNSIGNED = "unsigned"
+# The operator's statement that this vendor's executable is expected to be adhoc
+# here (a local patch step re-signs it), so an adhoc update in the same install
+# location may be re-probed unattended. Nothing else is waived.
+TRUST_ADHOC = "adhoc-in-install-location"
+# 1.0.25 -> 1.0.30 inside a path is an update; a different directory is not.
+VERSION_SEGMENT = re.compile(r"\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.]+)*")
+
+
+def facts(path: Path | str, runner=subprocess.run) -> dict:
+    """codesign's view of one executable: the signing team, or why there is none."""
+    target = str(path)
+    try:
+        verified = runner(["codesign", "--verify", "--strict", target],
+                          capture_output=True, text=True, timeout=60)
+        described = runner(["codesign", "-dv", "--verbose=2", target],
+                           capture_output=True, text=True, timeout=60)
+    except (OSError, subprocess.SubprocessError) as error:
+        return {"signer": UNSIGNED, "identifier": None, "valid": False,
+                "detail": f"codesign unavailable: {error.__class__.__name__}"}
+    fields = {}
+    for line in described.stderr.splitlines():
+        key, separator, value = line.partition("=")
+        if separator and key not in fields:
+            fields[key] = value
+    valid = verified.returncode == 0
+    team = fields.get("TeamIdentifier")
+    if not valid:
+        signer = UNSIGNED
+    elif fields.get("Signature") == "adhoc" or team in (None, "not set"):
+        signer = ADHOC
+    else:
+        signer = team
+    return {"signer": signer, "identifier": fields.get("Identifier"), "valid": valid}
+
+
+def family(path: Path | str) -> str:
+    """An install location with its version numbers blanked out."""
+    return VERSION_SEGMENT.sub("<version>", str(path))
+
+
+def verdict(recorded: dict | None, recorded_path: str | None, current: dict,
+            current_path: Path | str) -> tuple[bool, str]:
+    """May this changed executable be re-probed unattended? And the reason either way."""
+    if current["signer"] == UNSIGNED:
+        return False, "the executable is unsigned, so nothing ties it to the vendor; an operator has to approve it"
+    if current["signer"] == ADHOC:
+        if (recorded or {}).get("operator_trust") == TRUST_ADHOC and recorded_path \
+                and family(recorded_path) == family(current_path):
+            return True, "adhoc, which the operator trusts in this install location"
+        if (recorded or {}).get("operator_trust") == TRUST_ADHOC:
+            return False, (f"adhoc and installed at {current_path}, outside the location the operator "
+                           f"trusts, {family(recorded_path)}")
+        return False, ("the executable is adhoc, so nothing ties it to the vendor; an operator has to "
+                       "approve it (or, for a local patch step, trust it here: omnilane resign --trust-adhoc VENDOR)")
+    if not recorded or not recorded.get("signer"):
+        return False, ("the live overlay recorded no signer for this vendor, so there is nothing "
+                       "to compare against; an operator approves the first signer")
+    if recorded["signer"] != current["signer"]:
+        return False, (f"signed by {current['signer']}, but the overlay was signed against "
+                       f"{recorded['signer']}")
+    if recorded_path and family(recorded_path) != family(current_path):
+        return False, (f"installed at {current_path}, outside the recorded location "
+                       f"{family(recorded_path)}")
+    return True, f"still signed by {current['signer']} in the recorded install location"

package/scripts/lib/native.py

@@ -91,7 +91,11 @@ def capability_context(path):
     ctx = read_json(path)
     fields(ctx, ("schema_version", "harness", "vendor", "capabilities", "requirements"),
            ("current_model", "current_effort", "agent_strategy", "existing_agent",
-            "preserve_existing_context", "new_agent_capacity"))
+            "preserve_existing_context", "new_agent_capacity", "inherits_caller_runtime",
+            "caller_identity_verified"))
+    for flag in ("inherits_caller_runtime", "caller_identity_verified"):
+        if flag in ctx:
+            check(type(ctx[flag]) is bool, "invalid " + flag)
     check(type(ctx["schema_version"]) is int and ctx["schema_version"] == 1, "unsupported context version")
     identifier(ctx["harness"], "harness")
     identifier(ctx["vendor"], "vendor")
@@ -210,6 +214,89 @@ def choose(args, ctx):
     return "native", "exact-idle-reuse-match" if strategy == "reuse" else "exact-capability-match", model
 
 
+def choose_inherited(args, ctx, identity):
+    """A worker spawned with no model override. There is no CLI to fall back to."""
+    if ctx is None:
+        return None, "no-native-context"
+    if ctx.get("inherits_caller_runtime") is not True:
+        return None, "host-does-not-assert-runtime-inheritance"
+    if args.background or args.session != "auto" or args.thread:
+        return None, "cli-session-lifecycle"
+    if args.job_timeout or args.idle_timeout:
+        return None, "cli-watchdog-required"
+    if args.mode == "sysops":
+        return None, "sysops-requires-cli"
+    if ctx["vendor"] != identity["vendor"]:
+        return None, "vendor-mismatch"
+    if ctx.get("current_model", identity["model"]) != identity["model"]:
+        return None, "current-model-mismatch"
+    if ctx.get("agent_strategy", "new") != "new" or "existing_agent" in ctx:
+        return None, "inherit-spawns-a-new-agent"
+    if ctx.get("new_agent_capacity") == "exhausted":
+        return None, "new-agent-capacity-exhausted"
+    req = ctx["requirements"]
+    if req["isolation"] != "shared-inherited" or req["lifecycle"] != "single-shot":
+        return None, "unsupported-isolation-or-lifecycle"
+    # Effort is deliberately not matched: inheriting it is the whole point.
+    caps = [cap for cap in ctx["capabilities"]
+            if cap["model"] == identity["model"] and cap.get("agent_strategy", "new") == "new"
+            and args.mode in cap["modes"] and args.workdir in cap["workdirs"]
+            and set(req["tools"]) <= set(cap["tools"])
+            and "shared-inherited" in cap["isolations"] and "single-shot" in cap["lifecycles"]]
+    if not caps:
+        return None, "no-capability-row-for-caller-model-mode-and-workdir"
+    return "native", "inherited-caller-runtime"
+
+
+def route_inherited(args, ctx, registry, registry_sha):
+    caller = caller_sha = None
+    if args.caller_context:
+        caller, caller_sha = aa_policy.load_caller(
+            args.caller_context, registry, args.expected_caller_sha256)
+    host = None
+    if caller is None and ctx is not None and "current_model" in ctx:
+        host = {"vendor": ctx["vendor"], "model": ctx["current_model"]}
+    decision = aa_policy.decide_inherited(
+        registry, registry_sha, caller=caller, caller_sha256=caller_sha,
+        operator_asserted_human=args.operator_asserted_human, host_asserted=host)
+    if not decision["allowed"]:
+        print(aa_policy._json_line(decision), end="", file=sys.stderr)
+        return 3
+    identity = caller["caller"] if caller is not None else host
+    executor, reason = choose_inherited(args, ctx, identity)
+    if executor is None:
+        # An inherited worker exists only inside the harness; the CLI is not a fallback for it.
+        decision.update(allowed=False, code="native-inherit-unavailable",
+                        message="this harness cannot take an inherited native worker: " + reason,
+                        failed_gate="native-capability", reason=reason, child_context=None,
+                        next_command="omnilane native-context --workdir " + args.workdir)
+        print(aa_policy._json_line(decision), end="", file=sys.stderr)
+        return 3
+    plan = {"schema_version": 1, "executor": executor, "executor_reason": reason, "inherit": True,
+            "caller_identity_verified": decision["caller_identity_verified"],
+            "caller_identity_source": decision["caller_identity_source"],
+            "vendor": identity["vendor"], "model": identity["model"], "effort": "inherited",
+            "harness": ctx["harness"], "lane": args.lane, "mode": args.mode,
+            "workdir": args.workdir, "task": args.task,
+            "requirements": ctx["requirements"], "timeout": args.timeout,
+            "worker_contract": {
+                "no_nested_dispatch": True,
+                "isolation": ctx["requirements"]["isolation"],
+                "mode_is_task_intent": True,
+                "caller_enforces_deadline": True,
+                "model_override": False,
+                "inherit_caller_runtime": True,
+                "satisfies_lane_target": False,
+            },
+            "aa_policy": decision,
+            "state": "planned" if args.dry_run else "pending",
+            "job_id": None, "task_id": None, "agent_id": None,
+            "provider_invoked": False, "job_state_created": False,
+            "agent_strategy": "new", "existing_agent_id": None, "preserve_existing_context": False,
+            "new_agent_capacity": ctx.get("new_agent_capacity", "unknown")}
+    return publish_plan(args, plan, decision, registry, caller)
+
+
 def stamp():
     return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
@@ -302,6 +389,8 @@ def route(args):
     registry, registry_sha = aa_policy.load_registry(
         args.policy, args.expected_registry_sha256
     )
+    if getattr(args, "inherit", False):
+        return route_inherited(args, ctx, registry, registry_sha)
     caller = None
     caller_sha = None
     if args.caller_context:
@@ -355,6 +444,10 @@ def route(args):
         plan["worker_contract"].update(backend="collaboration.followup_task",
                                        preserve_existing_context=True,
                                        caller_rechecks_idle_before_followup=True)
+    return publish_plan(args, plan, policy_decision, registry, caller)
+
+
+def publish_plan(args, plan, policy_decision, registry, caller):
     if args.dry_run:
         print(json_text(plan), end="")
         return 0
@@ -393,6 +486,8 @@ def validate_completion(value, state):
     for key in ("vendor", "model", "effort", "harness", "backend"):
         text_value(runtime[key], "runtime " + key, 256)
     for key in ("vendor", "model", "effort", "harness"):
+        if key == "effort" and state.get("inherit") is True:
+            continue  # the host reports what it observed; nothing was requested
         check(runtime[key] == state[key], "runtime " + key + " mismatch")
     strategy = state.get("agent_strategy", "new")
     if strategy == "reuse":
@@ -448,6 +543,10 @@ def job_command(args):
         summary.update(agent_strategy=state.get("agent_strategy", "new"),
                        existing_agent_id=state.get("existing_agent_id"),
                        preserve_existing_context=state.get("preserve_existing_context", False))
+        if state.get("inherit"):
+            summary.update(inherit=True,
+                           caller_identity_verified=state.get("caller_identity_verified", True),
+                           satisfies_lane_target=False)
         if args.action == "result":
             summary["completion"] = state.get("completion")
         if args.json:
@@ -463,8 +562,12 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__)
     sub = parser.add_subparsers(dest="command", required=True)
     p = sub.add_parser("route")
-    for key in ("home", "lane", "vendor", "model", "effort", "workdir", "task"):
+    for key in ("home", "lane", "workdir", "task"):
         p.add_argument("--" + key, required=True)
+    for key in ("vendor", "model", "effort"):
+        p.add_argument("--" + key, default="")
+    p.add_argument("--inherit", action="store_true",
+                   help="spawn a worker that inherits the caller's own model and effort")
     p.add_argument("--executor", choices=("auto", "native", "cli"), required=True)
     p.add_argument("--mode", choices=("advise", "work", "sysops"), required=True)
     p.add_argument("--context")
@@ -488,6 +591,8 @@ def main():
     p.add_argument("job_id")
     p.add_argument("input", nargs="?")
     args = parser.parse_args()
+    if args.command == "route" and not args.inherit and not args.vendor:
+        parser.error("--vendor is required unless --inherit is given")
     try:
         return route(args) if args.command == "route" else job_command(args)
     except (ValueError, OSError, RecursionError, TypeError, KeyError) as error:

package/scripts/lib/native_context.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""Write the native capability file for the harness this runs under.
+
+Dispatch only hands work to a harness's own sub-agent tool when the harness says
+what that tool can do; without such a file every same-harness target goes out
+through an external CLI. This writes the file from what is observable: the
+caller's vendor, model and effort are read exactly as `omnilane whoami` reads
+them. What cannot be observed from a shell is stated by the host that runs this,
+with flags: `--inherits-caller-runtime` says its sub-agent tool, given no model
+override, runs the caller's own model and effort. Where the identity cannot be
+read at all, `--vendor` and `--model` are the host's statement of what it is; the
+file then says so, and serves an inherited worker only. Prints the file's path.
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import caller_identity  # noqa: E402
+
+HARNESSES = {"codex": "codex", "claude": "claude-code", "grok": "grok-build", "gemini": "antigravity"}
+UNVERIFIED_EFFORT = "unverified"
+HOST_STATEMENT_HINT = ("omnilane: if this harness cannot be read, state what it is: omnilane native-context "
+                       "--vendor VENDOR --model MODEL --inherits-caller-runtime (serves --inherit only)")
+
+
+def build(vendor: str, model: str, effort: str | None, *, harness: str, workdirs: list[str],
+          modes: list[str], inherits: bool, verified: bool = True) -> dict:
+    value = {
+        "schema_version": 1,
+        "harness": harness,
+        "vendor": vendor,
+        "current_model": model,
+        "requirements": {"tools": [], "isolation": "shared-inherited", "lifecycle": "single-shot"},
+        "capabilities": [{
+            "model": model,
+            # An unrecorded effort matches no lane target; only --inherit can use this row.
+            "efforts": [effort or UNVERIFIED_EFFORT],
+            "modes": modes,
+            "workdirs": workdirs,
+            "tools": [],
+            "isolations": ["shared-inherited"],
+            "lifecycles": ["single-shot"],
+        }],
+    }
+    if effort:
+        value["current_effort"] = effort
+    if inherits:
+        value["inherits_caller_runtime"] = True
+    if not verified:
+        value["caller_identity_verified"] = False
+    return value
+
+
+def main(argv: list[str] | None = None, read_caller=caller_identity.read_caller) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--workdir", action="append", type=Path,
+                        help="directory a native worker may be given; may repeat (default: cwd)")
+    parser.add_argument("--mode", action="append", choices=("advise", "work"),
+                        help="task intent the host accepts; may repeat (default: advise)")
+    parser.add_argument("--harness", help="harness name (default: derived from the caller's vendor)")
+    parser.add_argument("--inherits-caller-runtime", action="store_true",
+                        help="the host states that a sub-agent spawned with no model override "
+                             "runs the caller's own model and effort")
+    parser.add_argument("--registry",
+                        default=os.environ.get("OMNILANE_AA_POLICY_FILE")
+                        or str(caller_identity.REPO / "config" / "aa-model-policy.json"))
+    parser.add_argument("--vendor", help="host-asserted vendor, used only when the identity cannot be read")
+    parser.add_argument("--model", help="host-asserted current model, used only when the identity cannot be read")
+    parser.add_argument("--out", type=Path, help="file to write (default: under ~/.omnilane)")
+    args = parser.parse_args(argv)
+    if bool(args.vendor) != bool(args.model):
+        print("omnilane: --vendor and --model go together", file=sys.stderr)
+        return 2
+    for name in (args.vendor, args.model):
+        if name and not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}", name):
+            print(f"omnilane: invalid name: {name}", file=sys.stderr)
+            return 2
+    verified, recorded = True, None
+    try:
+        registry, _ = caller_identity.load_registry(args.registry)
+        _, (vendor, model, effort), _ = read_caller(os.getpid())
+    except (ValueError, OSError) as error:
+        if not args.vendor:
+            print(f"omnilane: cannot read the caller identity: {error}\n{HOST_STATEMENT_HINT}", file=sys.stderr)
+            return 3
+        print(f"omnilane: caller identity not verified ({error}); using the host's statement",
+              file=sys.stderr)
+        verified, vendor, model = False, args.vendor, args.model
+    else:
+        if args.vendor and (args.vendor != vendor or (model is not None and args.model != model)):
+            print(f"omnilane: this harness reads as {vendor}/{model}, not {args.vendor}/{args.model}",
+                  file=sys.stderr)
+            return 2
+        row, reason = caller_identity.resolve(registry, vendor, model, effort)
+        if row is not None:
+            # Codex spells its reasoning-off effort "none"; the registry stores it as null.
+            recorded = row["effort"] or ("none" if vendor == "codex" else None)
+        elif not (vendor == "codex" and model and effort is None
+                  and caller_identity.floor_row(registry, vendor, model)):
+            if not args.vendor:
+                print(f"omnilane: cannot describe this harness: {reason}\n{HOST_STATEMENT_HINT}",
+                      file=sys.stderr)
+                return 3
+            print(f"omnilane: caller identity not verified ({reason}); using the host's statement",
+                  file=sys.stderr)
+            verified, model = False, args.model
+    workdirs = []
+    for path in args.workdir or [Path.cwd()]:
+        resolved = path.expanduser().resolve()
+        if not resolved.is_dir():
+            print(f"omnilane: not a directory: {path}", file=sys.stderr)
+            return 2
+        workdirs.append(str(resolved))
+    value = build(vendor, model, recorded,
+                  harness=args.harness or HARNESSES.get(vendor, vendor),
+                  workdirs=sorted(set(workdirs)), modes=sorted(set(args.mode or ["advise"])),
+                  inherits=args.inherits_caller_runtime, verified=verified)
+    text = json.dumps(value, indent=2, sort_keys=True) + "\n"
+    out = args.out
+    if out is None:
+        home = Path(os.environ.get("OMNILANE_HOME") or Path.home() / ".omnilane")
+        digest = hashlib.sha256(text.encode()).hexdigest()[:12]
+        out = home / "native-context" / f"{value['harness']}--{model.replace('.', '-')}--{digest}.json"
+    out.parent.mkdir(parents=True, exist_ok=True)
+    staging = out.with_name(f".{out.name}.{os.getpid()}.tmp")
+    staging.write_text(text)
+    os.replace(staging, out)
+    note = "" if args.inherits_caller_runtime else (
+        "; pass --inherits-caller-runtime if this harness's sub-agent tool inherits your runtime")
+    print(f"omnilane: native context for {value['harness']} {model} "
+          f"(effort {recorded or 'unrecorded'}{'' if verified else ', identity host-asserted'}){note}",
+          file=sys.stderr)
+    print(out)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lib/overlay_health.py

@@ -53,7 +53,10 @@ def offenders(overlay_path: Path) -> list[str]:
 def main() -> None:
     overlay_path = os.environ.get("OMNILANE_AA_TRANSPORT_OVERLAY", "")
     if not overlay_path:
-        emit("PASS", "no overlay configured; every runtime mapping stays unverified")
+        if os.environ.get("OMNILANE_AA_OPERATOR_ASSERTED_HUMAN") == "1":
+            emit("PASS", "no overlay configured; fine for a human operator, but a model caller "
+                         "would be refused on every lane (README, 'Let your AI assistant drive omnilane')")
+        emit("WARN", "no overlay configured, so a model caller is refused on every lane (runtime-mapping-unverified). First install: probe_sweep.py --root ROOT, build_overlay.py --root ROOT, then export OMNILANE_AA_TRANSPORT_OVERLAY in local.sh; see the README, 'Let your AI assistant drive omnilane'")
     if not Path(overlay_path).exists():
         emit("FAIL", f"configured overlay is missing: {overlay_path}")
 
@@ -87,10 +90,29 @@ def main() -> None:
                   "record who answered")
 
     stale = registry.get("_stale_transport_vendors", [])
+    # The gate hashes the path the overlay recorded. An update that installs beside
+    # the old executable leaves that path intact, so only this comparison sees it.
+    moved = []
+    try:
+        import resign
+        report = resign.detect(overlay, resign.current_anchors())
+        for vendor, entry in report.items():
+            # Only what the overlay actually pinned can have moved.
+            reasons = [reason for reason in entry["reasons"]
+                       if reason.startswith("runs ") or reason.endswith(" changed")]
+            if reasons and entry["recorded_cli_path"] and vendor not in stale:
+                moved.append(f"{vendor}: {'; '.join(reasons)}")
+    except Exception:  # noqa: BLE001 - a health line must never raise
+        moved = []
+    if moved and not stale:
+        emit("WARN", f"the runners no longer execute what the overlay pinned ({' | '.join(moved)}); "
+                     f"run `omnilane resign`; still loading: {summary}{extra}")
     if stale:
         detail = "; ".join(o for o in offenders(Path(overlay_path))) or "unknown cause"
+        if moved:
+            detail += "; also moved without going stale: " + " | ".join(moved)
         emit("WARN", f"stale vendor(s) {', '.join(stale)} degraded to unverified "
-                     f"({detail}); still verified: {summary}{extra}")
+                     f"({detail}); run `omnilane resign`; still verified: {summary}{extra}")
     emit("PASS", f"verified mappings: {summary}{extra}")
 
 

package/scripts/lib/probe.py

@@ -6,6 +6,8 @@ descriptor with the original command/stream fields plus a vendor-specific
 verdict, its reason, the observed model, and the tier of evidence that model
 rests on.
 """
+from __future__ import annotations
+
 import argparse
 import glob
 import json

package/scripts/lib/probe_sweep.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+"""Probe every selector build_overlay.py knows, one vendor at a time.
+
+probe.py runs a single command; this derives the whole set from PROVEN and the
+frozen registry, so a sweep is reproducible on any host without carrying a list
+of commands from the last one. Each vendor is probed independently and reports
+one of three outcomes: done, unprobeable (nobody is logged in, or the session
+cannot reach the keychain), or failed.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import build_overlay  # noqa: E402
+import probe as probe_module  # noqa: E402
+
+VENDORS = ("claude", "codex", "gemini", "grok")
+TOKENS = {"claude": "CLAUDE_SELECTOR_OK", "codex": "CODEX_SELECTOR_OK",
+          "gemini": "GEMINI_SELECTOR_OK", "grok": "GROK_SELECTOR_OK"}
+# The keychain-backed CLIs cannot authenticate from a launchd Background session
+# (an ssh login is one); probing there records "not logged in" as if it were a
+# finding about the selector.
+KEYCHAIN_VENDORS = ("claude", "gemini", "grok")
+NOT_AUTHENTICATED = re.compile(
+    r"not logged in|not signed in|authentication required|please run /login|grok login"
+    r"|failed to authenticate|oauth (session|token) (has )?expired|could not be refreshed"
+    r"|invalid api key|unauthorized|\b401\b",
+    re.IGNORECASE)
+TRANSIENT = re.compile(r"\b(403|429|500|502|503|529)\b|permission-denied|overloaded|timed? ?out",
+                       re.IGNORECASE)
+
+
+def prompt(vendor: str) -> str:
+    return f"Reply exactly {TOKENS[vendor]}. Do not use tools or delegate."
+
+
+def command(vendor: str, model: str, effort: str | None, app_data: str | None = None) -> list[str]:
+    text = prompt(vendor)
+    if vendor == "claude":
+        selector = ["--model", model] + (["--effort", effort] if effort else [])
+        return ["claude", "--disable-slash-commands", *selector, "--permission-mode", "dontAsk",
+                "--tools", "", "--output-format", "json", "-p", text]
+    if vendor == "codex":
+        return ["codex", "exec", "--json", "--skip-git-repo-check", "-m", model,
+                "-c", f'model_reasoning_effort="{effort or "none"}"',
+                "-c", 'approval_policy="never"', "-c", 'sandbox_mode="read-only"', text]
+    if vendor == "grok":
+        return ["grok", "--no-memory", "--no-subagents", "--no-plan", "--no-alt-screen",
+                "--output-format", "json", "--verbatim", "--permission-mode", "dontAsk",
+                "--tools", "Read", "--deny", "Bash", "--deny", "Edit", "--disable-web-search",
+                "-m", model, "--reasoning-effort", effort or "high", "-p", text]
+    if vendor == "gemini":
+        return ["agy", f"--app_data_dir={app_data}", "--model", model, "-p", text]
+    raise ValueError(f"unsupported vendor: {vendor}")
+
+
+def plan(vendor: str) -> list[dict]:
+    """One entry per evidence file this vendor's PROVEN rows point at."""
+    entries: dict[str, dict] = {}
+    for config_id, (_, runtime_model, evidence) in sorted(build_overlay.PROVEN.items()):
+        row = build_overlay.ROWS[config_id]
+        if row["vendor"] != vendor or evidence in entries:
+            continue
+        entries[evidence] = {"name": evidence, "config_id": config_id, "model": runtime_model,
+                             "effort": None if vendor == "gemini" else row["effort"]}
+    return list(entries.values())
+
+
+def session_manager(runner=subprocess.run) -> str:
+    try:
+        return runner(["launchctl", "managername"], capture_output=True, text=True,
+                      timeout=10).stdout.strip()
+    except (OSError, subprocess.SubprocessError):
+        return ""
+
+
+def _text(record: dict) -> str:
+    parts = [str(record.get("verdict_reason") or "")]
+    for key in ("stdout", "stderr"):
+        try:
+            parts.append(Path(record[key]).read_text(errors="replace")[:4000])
+        except (KeyError, OSError):
+            pass
+    return "\n".join(parts)
+
+
+def sweep(vendor: str, root: Path, *, repo: Path = build_overlay.REPO, home: Path | None = None,
+          run_probe=probe_module.probe, manager=session_manager, log=print) -> dict:
+    """Probe one vendor into root/evidence. Never raises for a probe that merely failed."""
+    home = home or Path.home()
+    entries = plan(vendor)
+    report = {"vendor": vendor, "outcome": "done", "passed": [], "failed": [], "detail": ""}
+    if (vendor in KEYCHAIN_VENDORS and sys.platform == "darwin"
+            and os.environ.get("OMNILANE_PROBE_ANY_SESSION") != "1"):
+        name = manager()
+        if name and name != "Aqua":
+            report.update(outcome="unprobeable",
+                          detail=(f"this is a launchd {name} session (an ssh login is one); "
+                                  f"{vendor}'s credentials are in the login keychain, which only an "
+                                  "Aqua (GUI) session can read"))
+            return report
+    work = root / "work"
+    work.mkdir(parents=True, exist_ok=True)
+    cli = "agy" if vendor == "gemini" else vendor
+    for index, entry in enumerate(entries):
+        app_root = None
+        app_data = None
+        if vendor == "gemini":
+            # prepare-agy-mode binds its private root to one workdir, so it is per sweep.
+            app_root = home / ".omnilane" / "agy-app" / f"probe-{root.name}-{entry['name']}"
+            prepared = subprocess.run(
+                [sys.executable, str(repo / "scripts/lib/prepare-agy-mode.py"), "--mode", "advise",
+                 "--workdir", str(work), "--app-root", str(app_root),
+                 "--gemini-dir", str(home / ".gemini")],
+                capture_output=True, text=True)
+            if prepared.returncode != 0:
+                report.update(outcome="failed",
+                              detail=f"prepare-agy-mode failed: {prepared.stderr.strip()[-200:]}")
+                return report
+            app_data = prepared.stdout.strip()
+        argv = command(vendor, entry["model"], entry["effort"], app_data)
+        record = {}
+        for attempt in (1, 2):
+            record = run_probe(entry["name"], argv, root=root, vendor=cli,
+                               expected_token=TOKENS[vendor], app_root=app_root)
+            if record.get("verdict") == "pass" or attempt == 2 or not TRANSIENT.search(_text(record)):
+                break
+            log(f"{entry['name']}: transient failure, retrying once")
+        if record.get("verdict") == "pass":
+            report["passed"].append(entry["config_id"])
+            log(f"{entry['name']} pass {record.get('evidence_tier')}")
+            continue
+        if NOT_AUTHENTICATED.search(_text(record)):
+            # Not a finding about the selector: keep it out of the evidence.
+            for suffix in ("json", "stdout", "stderr", "rollout", "cli_log"):
+                (root / "evidence" / f"{entry['name']}.{suffix}").unlink(missing_ok=True)
+            report.update(outcome="unprobeable",
+                          detail=f"{cli} is not logged in on this host; log in, then re-run")
+            if index:
+                report["detail"] += f" ({index} earlier probe(s) had already answered)"
+            return report
+        report["failed"].append(entry["config_id"])
+        log(f"{entry['name']} fail {str(record.get('verdict_reason'))[:120]}")
+    if not report["passed"]:
+        report.update(outcome="failed", detail="no selector of this vendor passed")
+    return report
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--root", type=Path, required=True, help="sweep root to write evidence into")
+    parser.add_argument("--vendor", action="append", choices=VENDORS,
+                        help="vendor to probe; may repeat (default: all four)")
+    parser.add_argument("--plan", action="store_true", help="print the commands and probe nothing")
+    args = parser.parse_args(argv)
+    vendors = args.vendor or list(VENDORS)
+    if args.plan:
+        for vendor in vendors:
+            for entry in plan(vendor):
+                print(json.dumps({"name": entry["name"], "argv": command(
+                    vendor, entry["model"], entry["effort"], "<app-data>")}, ensure_ascii=False))
+        return 0
+    reports = [sweep(vendor, args.root.expanduser()) for vendor in vendors]
+    print(json.dumps(reports, ensure_ascii=False, indent=2))
+    return 0 if all(report["outcome"] == "done" for report in reports) else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())