omnilane 0.42.9 → 0.44.0

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "omnilane",
-  "version": "0.42.9",
+  "version": "0.44.0",
   "description": "One routing table, every harness: classify subtasks into lanes and delegate through compatible caller-owned native agents or vendor CLIs with exact-AA downward policy and supervised jobs."
 }

package/scripts/dispatch.sh

@@ -35,7 +35,7 @@ MODE="advise"; WORKDIR="$PWD"; BACKGROUND=0; DRY_RUN=0
 OVERRIDE_VENDOR=""; OVERRIDE_MODEL=""; OVERRIDE_EFFORT=""; OVERRIDE_TIMEOUT=""
 OVERRIDE_JOB_TIMEOUT=""; OVERRIDE_IDLE_TIMEOUT=""; SESSION_REQUEST="auto"
 THREAD_NAME=""; THREAD_MODE=""; THREAD_ID=""; THREAD_TURN=""; THREAD_CREATED=""
-EXECUTOR="auto"; NATIVE_CONTEXT=""; RESOLVE_WITH_CONTEXT=0
+EXECUTOR="auto"; NATIVE_CONTEXT=""; RESOLVE_WITH_CONTEXT=0; INHERIT=0
 SELECTED_EXECUTOR="cli"; EXECUTOR_REASON="no-native-context"
 AA_POLICY_FILE="${OMNILANE_AA_POLICY_FILE:-$OMNILANE_REPO/config/aa-model-policy.json}"
 AA_CALLER_CONTEXT="${OMNILANE_AA_CALLER_CONTEXT:-}"
@@ -67,6 +67,8 @@ flags:
                          before any provider call or job state
   --executor auto|native|cli  caller-owned native handoff or legacy CLI
   --native-context FILE      explicit JSON capabilities; native is not a binary
+  --inherit                  native worker on the caller's own model and effort; resolves no
+                             lane target, needs --native-context with inherits_caller_runtime
   --caller-context FILE      exact model caller identity plus inherited ceiling
   --operator-asserted-human  explicit AA model-ceiling exemption; assertion only
   --aa-policy FILE           frozen AA policy registry (default: repo config)
@@ -368,6 +370,18 @@ routing_candidate_available() {
   fi
 }
 
+aa_print_refusal() {
+  # Refusal JSON on stderr, with the lanes this caller can still reach appended.
+  local helper="$OMNILANE_REPO/scripts/lib/aa_lanes.py"
+  if [[ -n "$AA_LAST_DECISION" && -r "$helper" ]] && command -v python3 >/dev/null 2>&1; then
+    printf '%s\n' "$AA_LAST_DECISION" | python3 "$helper" --registry "$AA_POLICY_FILE" --lane "${LANE:-}" \
+      --routing "$OMNILANE_HOME/routing.local.yaml" --routing "$OMNILANE_REPO/routing.yaml" >&2 \
+      || printf '%s\n' "$AA_LAST_DECISION" >&2
+  else
+    printf '%s\n' "$AA_LAST_DECISION" >&2
+  fi
+}
+
 aa_policy_decide() {
   # vendor model effort [target-config] -> structured JSON in AA_LAST_DECISION
   local vendor="$1" model="$2" effort="$3" target_config="${4:-}" rc=0
@@ -712,6 +726,7 @@ while [[ $# -gt 0 ]]; do
       }
       SESSION_REQUEST="single-shot"; shift ;;
     --dry-run) DRY_RUN=1; shift ;;
+    --inherit) INHERIT=1; shift ;;
     --operator-asserted-human)
       AA_OPERATOR_ASSERTED_HUMAN=1; shift ;;
     --mode|--workdir|--vendor|--model|--effort|--timeout|--job-timeout|--idle-timeout|--thread|--executor|--native-context|--caller-context|--aa-policy|--target-config|--transport-overlay)
@@ -823,6 +838,34 @@ case "$EXECUTOR" in
 esac
 
 CHAIN="$(raw_lane_line "$LANE")" || { echo "omnilane: unknown lane '$LANE' (try --list)" >&2; exit 2; }
+if [[ "$INHERIT" -eq 1 ]]; then
+  # A worker that inherits this caller's own model and effort runs inside the
+  # harness: no lane target is resolved, no vendor CLI or transport overlay is
+  # involved, and the lane is only a label for what the work is.
+  [[ -z "$OVERRIDE_VENDOR$OVERRIDE_MODEL$OVERRIDE_EFFORT$AA_TARGET_CONFIG" ]] || {
+    echo "omnilane: --inherit takes no --vendor, --model, --effort or --target-config; it overrides nothing" >&2
+    exit 2
+  }
+  [[ "$EXECUTOR" != "cli" ]] || { echo "omnilane: --inherit is native only" >&2; exit 2; }
+  command -v python3 >/dev/null 2>&1 || { echo "omnilane: native protocol requires Python 3" >&2; exit 2; }
+  INHERIT_TIMEOUT="${OVERRIDE_TIMEOUT:-${OMNILANE_TIMEOUT:-600}}"
+  [[ "$INHERIT_TIMEOUT" =~ ^[1-9][0-9]*$ ]] || {
+    echo "omnilane: invalid timeout (want a positive integer of seconds)" >&2; exit 2
+  }
+  INHERIT_ARGS=(route --inherit --home "$OMNILANE_HOME" --executor native --lane "$LANE"
+    --workdir "$WORKDIR" --mode "$MODE" --task="$TASK" --session "$SESSION_REQUEST"
+    --thread "$THREAD_NAME" --policy "$AA_POLICY_FILE" --timeout "$INHERIT_TIMEOUT"
+    --job-timeout "${OVERRIDE_JOB_TIMEOUT:-}" --idle-timeout "${OVERRIDE_IDLE_TIMEOUT:-}")
+  [[ -z "$NATIVE_CONTEXT" ]] || INHERIT_ARGS+=(--context "$NATIVE_CONTEXT")
+  if [[ "$AA_OPERATOR_ASSERTED_HUMAN" == "1" ]]; then
+    INHERIT_ARGS+=(--operator-asserted-human)
+  elif [[ -n "$AA_CALLER_CONTEXT" ]]; then
+    INHERIT_ARGS+=(--caller-context "$AA_CALLER_CONTEXT")
+  fi
+  [[ "$BACKGROUND" -eq 0 ]] || INHERIT_ARGS+=(--background)
+  [[ "$DRY_RUN" -eq 0 ]] || INHERIT_ARGS+=(--dry-run)
+  exec python3 "$OMNILANE_REPO/scripts/lib/native.py" "${INHERIT_ARGS[@]}"
+fi
 if [[ -n "$OVERRIDE_VENDOR" ]]; then
   if resolve_chain "$CHAIN" "$OVERRIDE_VENDOR"; then
     :
@@ -835,7 +878,7 @@ if [[ -n "$OVERRIDE_VENDOR" ]]; then
         exit 4
         ;;
     6)
-      printf '%s\n' "$AA_LAST_DECISION" >&2
+      aa_print_refusal
       exit 3
       ;;
     5)
@@ -852,11 +895,11 @@ else
   resolve_rc=0
   resolve_chain "$CHAIN" || resolve_rc=$?
   if [[ "$resolve_rc" -eq 6 ]]; then
-    printf '%s\n' "$AA_LAST_DECISION" >&2
+    aa_print_refusal
     exit 3
   elif [[ "$resolve_rc" -ne 0 ]]; then
     echo "omnilane: no eligible available target for lane '$LANE' (chain:$CHAIN)." >&2
-    [[ -z "$AA_LAST_DECISION" ]] || printf '%s\n' "$AA_LAST_DECISION" >&2
+    [[ -z "$AA_LAST_DECISION" ]] || aa_print_refusal
     exit 4
   fi
 fi
@@ -1110,6 +1153,13 @@ if [[ "$DRY_RUN" -eq 1 ]]; then
 fi
 
 printf 'omnilane: executor=cli reason=%s\n' "$EXECUTOR_REASON" >&2
+if [[ "$EXECUTOR_REASON" == "no-native-context" && -n "$AA_CALLER_CONTEXT" && -r "$AA_CALLER_CONTEXT" ]]; then
+  CALLER_VENDOR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["caller"]["vendor"])' "$AA_CALLER_CONTEXT" 2>/dev/null || true)"
+  if [[ -n "$CALLER_VENDOR" && "$CALLER_VENDOR" == "$VENDOR" ]]; then
+    # Same vendor is not same model, so this is an offer, never a silent switch.
+    echo "omnilane: the target is this harness's own vendor, yet it goes out through an external CLI because no capability file was given. To use your own sub-agent tool: omnilane native-context --workdir \"$WORKDIR\", then pass --native-context FILE (or --inherit for a worker on your own model and effort)" >&2
+  fi
+fi
 mkdir -p "$OMNILANE_HOME"
 if [[ ! -d "$JOBS_ROOT" ]]; then
   mkdir -m 700 "$JOBS_ROOT"

package/scripts/doctor.sh

@@ -419,7 +419,13 @@ overlay_path="$(
   printf '%s' "${OMNILANE_AA_TRANSPORT_OVERLAY:-}"
 )"
 if [[ -z "$overlay_path" ]]; then
-  report PASS transport-overlay "no overlay configured; every runtime mapping stays unverified"
+  # Only a model caller needs the overlay; a host whose operator asserts the human
+  # exemption is complete without one, and --strict must not fail it.
+  if [[ "${OMNILANE_AA_OPERATOR_ASSERTED_HUMAN:-0}" == "1" ]]; then
+    report PASS transport-overlay "no overlay configured; fine for a human operator, but a model caller would be refused on every lane (README, 'Let your AI assistant drive omnilane')"
+  else
+    report WARN transport-overlay "no overlay configured, so a model caller is refused on every lane (runtime-mapping-unverified). First install: probe_sweep.py --root ROOT, build_overlay.py --root ROOT, then export OMNILANE_AA_TRANSPORT_OVERLAY in local.sh; see the README, 'Let your AI assistant drive omnilane'"
+  fi
 elif ! command -v python3 >/dev/null 2>&1; then
   report WARN transport-overlay "python3 is absent; cannot load the AA transport overlay"
 elif [[ ! -r "$OVERLAY_HEALTH" ]]; then

package/scripts/lib/aa_lanes.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""Add eligible_lanes to a refused AA decision.
+
+A refusal that only says no leaves a model caller guessing. This reads the
+decision on stdin and appends the lanes whose chain still holds a target at or
+below the caller's effective ceiling, by registry score alone: no CLI is probed
+and nothing is dispatched. Output is one JSON line, the decision plus the list.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import shlex
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import aa_policy  # noqa: E402
+import caller_identity  # noqa: E402
+
+
+def lanes(paths: list[Path]) -> dict[str, list[list[str]]]:
+    """Lane -> chain segments; the first file naming a lane wins, as in dispatch."""
+    table: dict[str, list[list[str]]] = {}
+    for path in paths:
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        for line in text.splitlines():
+            line = line.split("#", 1)[0]
+            if not line.strip() or line[0] in " \t" or ":" not in line:
+                continue
+            name, chain = line.split(":", 1)
+            name = name.strip()
+            if not name or name in table or not chain.strip():
+                continue
+            segments = []
+            for segment in chain.split("|"):
+                try:
+                    fields = shlex.split(segment)
+                except ValueError:
+                    fields = []
+                if fields:
+                    segments.append(fields)
+            table[name] = segments
+    return table
+
+
+def eligible(registry: dict, table: dict[str, list[list[str]]], ceiling: int) -> list[dict]:
+    found = []
+    for lane, segments in table.items():
+        for fields in segments:
+            vendor = fields[0]
+            if vendor in ("off", "vote") or len(fields) < 2:
+                continue
+            effort = fields[2] if len(fields) > 2 and fields[2] != "-" else None
+            row, _ = caller_identity.resolve(registry, vendor, fields[1], effort)
+            if row is None or row["score"] > ceiling:
+                continue
+            found.append({
+                "lane": lane,
+                "target": row["id"],
+                "score": row["score"],
+                "transport_verified": row["transport_mapping"].get("runtime_verified") is True,
+            })
+            break
+    return found
+
+
+def lane_requirement(registry: dict, segments: list[list[str]], caller: dict | None) -> dict | None:
+    """The cheapest target in one lane, and the caller effort that would reach it."""
+    rows = []
+    for fields in segments:
+        if fields[0] in ("off", "vote") or len(fields) < 2:
+            continue
+        effort = fields[2] if len(fields) > 2 and fields[2] != "-" else None
+        row, _ = caller_identity.resolve(registry, fields[0], fields[1], effort)
+        if row is not None:
+            rows.append(row)
+    if not rows:
+        return None
+    cheapest = min(rows, key=lambda row: (row["score"], row["id"]))
+    required = None
+    if isinstance(caller, dict):
+        reaching = sorted((row for row in registry["scored_configs"]
+                           if row["vendor"] == caller.get("vendor") and row["model"] == caller.get("model")
+                           and row["score"] >= cheapest["score"]),
+                          key=lambda row: (row["score"], row["id"]))
+        if reaching:
+            required = reaching[0]["effort"] or "none"
+    return {"target": cheapest["id"], "score": cheapest["score"], "required_caller_effort": required}
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--registry", required=True)
+    parser.add_argument("--routing", action="append", default=[], type=Path,
+                        help="routing file, highest precedence first; may repeat")
+    parser.add_argument("--lane", help="the lane that was refused")
+    args = parser.parse_args(argv)
+    raw = sys.stdin.read()
+    try:
+        decision = json.loads(raw)
+        ceiling = decision.get("effective_ceiling")
+        if decision.get("allowed") is False and type(ceiling) is int:
+            registry, _ = aa_policy.load_registry(args.registry)
+            table = lanes(args.routing)
+            decision["eligible_lanes"] = eligible(registry, table, ceiling)
+            if args.lane in table and decision.get("code") == "target-above-effective-ceiling":
+                # The decision describes the last candidate tried; the lane may hold a cheaper one.
+                need = lane_requirement(registry, table[args.lane], decision.get("caller"))
+                if need is not None:
+                    decision["lane_requirement"] = dict(need, lane=args.lane)
+                    if decision.get("inherited_ceiling") == decision.get("caller_score"):
+                        decision["required_caller_effort"] = need["required_caller_effort"]
+                        effort = need["required_caller_effort"]
+                        held = (" The harness recorded no effort, so this caller is held to its "
+                                "model's floor." if decision.get("caller_degraded") else "")
+                        decision["reason"] = (
+                            f"lane {args.lane}'s cheapest target {need['target']} scores "
+                            f"{need['score']}, above this caller's ceiling of {ceiling}.{held} "
+                            + (f"Relaunch the calling session at effort {effort} or higher, or have "
+                               "a human operator dispatch it." if effort else
+                               "No effort of the caller's model reaches it; a stronger caller model "
+                               "or a human operator has to dispatch it."))
+        sys.stdout.write(json.dumps(decision, ensure_ascii=False, separators=(",", ":")) + "\n")
+    except (ValueError, OSError, aa_policy.PolicyError, KeyError, TypeError):
+        # Guidance is best effort; the refusal itself must always get through.
+        sys.stdout.write(raw if raw.endswith("\n") else raw + "\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lib/aa_policy.py

@@ -239,7 +239,13 @@ def load_caller(path: str | Path, registry: dict[str, Any],
     _check(value.get("snapshot_id") == registry["snapshot"]["id"],
            "caller-context snapshot does not match frozen registry")
     _check(value.get("kind") == "model", "unsupported caller-context kind")
+    # effort_unverified marks a caller degraded to its model's lowest-scored row
+    # because the launching harness recorded no effort; it may only be true.
+    unverified = value.pop("effort_unverified", None)
+    _check(unverified is None or unverified is True, "invalid caller-context effort_unverified")
     _exact_fields(value, {"schema_version", "snapshot_id", "kind", "caller", "inherited_ceiling"})
+    if unverified:
+        value["effort_unverified"] = True
     value["caller"] = _identity(value["caller"], "caller")
     ceiling = value["inherited_ceiling"]
     _check(type(ceiling) is int and 0 <= ceiling <= 100,
@@ -345,10 +351,15 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
                      "file it prints as --caller-context, which dispatch does itself when the "
                      "launching CLI names its model and effort; a human operator passes "
                      "--operator-asserted-human"),
+            failed_gate="caller-identity",
+            reason="no caller identity reached the gate",
+            next_command="omnilane whoami",
         )
         return base
     base["caller_context_sha256"] = caller_sha256
     caller_identity = caller["caller"]
+    degraded = caller.get("effort_unverified") is True
+    base["caller_degraded"] = degraded
     caller_rows = _matching_rows(registry, caller_identity)
     if len(caller_rows) != 1:
         detail = _unknown_reason(registry, caller_identity)
@@ -356,9 +367,24 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
             code="unknown-caller-config" if not caller_rows else "ambiguous-caller-config",
             message=detail or "caller exact vendor/model/effort/reasoning/fallback is not uniquely scored",
             caller=caller_identity,
+            failed_gate="caller-identity",
+            reason="the caller context names a configuration the frozen registry does not score exactly once",
+            next_command="omnilane whoami",
         )
         return base
     caller_row = caller_rows[0]
+    model_rows = [row for row in registry["scored_configs"]
+                  if row["vendor"] == caller_row["vendor"] and row["model"] == caller_row["model"]]
+    if degraded and caller_row["score"] != min(row["score"] for row in model_rows):
+        base.update(
+            code="invalid-degraded-caller",
+            message="an effort-unverified caller must name its model's lowest-scored row",
+            caller=caller_identity,
+            failed_gate="caller-identity",
+            reason="effort_unverified was set on a row above the model's floor",
+            next_command="omnilane whoami",
+        )
+        return base
     effective = min(caller_row["score"], caller["inherited_ceiling"])
     base.update(
         caller=caller_identity,
@@ -370,7 +396,14 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
         registry, vendor, model, effort, target_config
     )
     if target_row is None:
-        base.update(code=mapping_code, message="target runtime cannot be mapped to one verified exact AA configuration", **detail)
+        base.update(
+            code=mapping_code,
+            message="target runtime cannot be mapped to one verified exact AA configuration",
+            failed_gate="target-transport",
+            reason=("the caller is identified; this host's transport overlay does not currently "
+                    f"verify {vendor} {model} at effort {effort}"),
+            next_command="omnilane resign --check",
+            **detail)
         return base
     target_score = target_row["score"]
     target_identity = _row_identity(target_row)
@@ -381,9 +414,30 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
         target_estimated=target_row["estimated"],
     )
     if target_score > effective:
+        reaching = sorted((row for row in model_rows if row["score"] >= target_score),
+                          key=lambda row: (row["score"], row["id"]))
+        required = reaching[0]["effort"] or "none" if reaching else None
+        if caller["inherited_ceiling"] < caller_row["score"]:
+            reason = ("this worker inherited a ceiling below the target; only the session that "
+                      "dispatched it, or a human operator, can reach this target")
+            required = None
+        elif required is None:
+            reason = (f"no scored effort of {caller_row['model']} reaches {target_score}; a "
+                      "stronger caller model or a human operator has to dispatch this target")
+        elif degraded:
+            reason = (f"the launching harness recorded no effort, so the caller was held to "
+                      f"{caller_row['model']}'s floor of {effective}; relaunch the session with an "
+                      f"explicit effort of {required} or higher")
+        else:
+            reason = (f"relaunch the calling session at effort {required} or higher, or have a "
+                      "human operator dispatch this target")
         base.update(
             code="target-above-effective-ceiling",
             message=f"target score {target_score} exceeds effective caller ceiling {effective}",
+            failed_gate="downward-ceiling",
+            reason=reason,
+            required_caller_effort=required,
+            next_command="omnilane list",
         )
         return base
     child_context = {
@@ -402,6 +456,105 @@ def decide(registry: dict[str, Any], registry_sha256: str, *,
     return base
 
 
+def decide_inherited(registry: dict[str, Any], registry_sha256: str, *,
+                     caller: dict[str, Any] | None, caller_sha256: str | None,
+                     operator_asserted_human: bool = False,
+                     host_asserted: dict[str, str] | None = None) -> dict[str, Any]:
+    """A native worker that inherits the caller's own model and effort unchanged.
+
+    It runs what the caller runs, so it scores what the caller scores and cannot
+    be an upward dispatch, whether or not the caller's effort is known. There is
+    no external CLI, so no transport mapping is involved. It is nobody's lane
+    target: the decision names no target configuration and must not be reported
+    as satisfying one.
+
+    None of that rests on knowing who the caller is, so a caller whose identity
+    cannot be read still gets an inherited worker, on the host's word for its
+    vendor and model. That decision is marked unverified, carries no ceiling and
+    publishes no child context: a worker that tried to dispatch would have no
+    identity to dispatch with.
+    """
+    base: dict[str, Any] = {
+        "schema_version": 1,
+        "snapshot_id": registry["snapshot"]["id"],
+        "registry_sha256": registry_sha256,
+        "allowed": False,
+        "code": "deny",
+        "message": "AA policy denied dispatch",
+        "caller_kind": "operator-asserted-human" if operator_asserted_human else "model",
+        "target_request": {"vendor": None, "model": None, "effort": None, "inherit": True},
+        "target_config_id": None,
+        "caller_score": None,
+        "inherited_ceiling": None,
+        "effective_ceiling": None,
+        "target_score": None,
+        "target_estimated": None,
+        "child_context": None,
+        "evidence_limit": ("the host asserts that a sub-agent spawned without a model override "
+                           "inherits the caller's runtime; omnilane cannot observe it"),
+    }
+    if operator_asserted_human:
+        base.update(code="inherit-requires-model-caller",
+                    message="only a model running inside a harness has a runtime to inherit",
+                    failed_gate="caller-identity",
+                    reason="a human operator has no sub-agent tool; dispatch a lane instead",
+                    next_command="omnilane list")
+        return base
+    if caller is None and host_asserted is not None:
+        base.update(allowed=True, code="native-inherited-unverified-caller",
+                    message="the worker inherits the caller's own runtime, so it cannot score above it; "
+                            "the caller's vendor and model are the host's statement, not a verified identity",
+                    caller_kind="model-unverified", caller_identity_verified=False,
+                    caller_identity_source="host-asserted",
+                    target={"inherit": True, "vendor": host_asserted["vendor"],
+                            "model": host_asserted["model"]})
+        return base
+    if caller is None:
+        base.update(code="missing-caller-context",
+                    message="no caller identity: an inherited worker still has to know whose runtime it inherits",
+                    failed_gate="caller-identity",
+                    reason="no caller identity reached the gate and the capability file names no current_model",
+                    next_command="omnilane whoami  # if that cannot read this harness: omnilane "
+                                 "native-context --vendor VENDOR --model MODEL --inherits-caller-runtime")
+        return base
+    base["caller_context_sha256"] = caller_sha256
+    base["caller_identity_verified"] = True
+    base["caller_identity_source"] = "caller-context"
+    identity = caller["caller"]
+    degraded = caller.get("effort_unverified") is True
+    rows = _matching_rows(registry, identity)
+    if len(rows) != 1:
+        base.update(code="unknown-caller-config" if not rows else "ambiguous-caller-config",
+                    message=_unknown_reason(registry, identity)
+                    or "caller exact vendor/model/effort/reasoning/fallback is not uniquely scored",
+                    caller=identity, failed_gate="caller-identity",
+                    reason="the caller context names a configuration the frozen registry does not score exactly once",
+                    next_command="omnilane whoami")
+        return base
+    row = rows[0]
+    floor = min(r["score"] for r in registry["scored_configs"]
+                if r["vendor"] == row["vendor"] and r["model"] == row["model"])
+    if degraded and row["score"] != floor:
+        base.update(code="invalid-degraded-caller",
+                    message="an effort-unverified caller must name its model's lowest-scored row",
+                    caller=identity, failed_gate="caller-identity",
+                    reason="effort_unverified was set on a row above the model's floor",
+                    next_command="omnilane whoami")
+        return base
+    effective = min(row["score"], caller["inherited_ceiling"])
+    child = {"schema_version": 1, "snapshot_id": registry["snapshot"]["id"], "kind": "model",
+             "caller": identity, "inherited_ceiling": effective}
+    if degraded:
+        child["effort_unverified"] = True
+    base.update(allowed=True, code="native-inherited-allowed",
+                message="the worker inherits the caller's own runtime, so it cannot score above it",
+                caller=identity, caller_degraded=degraded, caller_score=row["score"],
+                inherited_ceiling=caller["inherited_ceiling"], effective_ceiling=effective,
+                target={"inherit": True, "vendor": row["vendor"], "model": row["model"]},
+                child_context=child)
+    return base
+
+
 def _normalized_effort(value: str) -> str | None:
     return None if value in ("", "-") else value
 

package/scripts/lib/build_overlay.py

@@ -6,6 +6,8 @@ corresponds to a probe run under the selected evidence root whose raw
 stdout/stderr is hashed into the manifest, so the overlay's evidence[] anchors
 the whole set.
 """
+from __future__ import annotations
+
 import argparse
 import hashlib
 import json
@@ -14,9 +16,13 @@ import shutil
 import socket
 from collections import Counter
 from datetime import datetime, timezone
+import sys
 from pathlib import Path
 
-REPO = Path(os.environ.get("OMNILANE_REPO", "/Users/vincentw/dev/omnilane"))
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import cli_provenance  # noqa: E402
+
+REPO = Path(os.environ.get("OMNILANE_REPO") or Path(__file__).resolve().parents[2])
 HOME = Path.home()
 SWEEP_ID = os.environ.get("OMNILANE_TRANSPORT_SWEEP_ID", "overlay-reprobe-20260909")
 DEFAULT_ROOT = HOME / ".omnilane" / "transport-evidence" / SWEEP_ID
@@ -98,19 +104,21 @@ def cli_path(name: str) -> Path:
     return Path(found).resolve()
 
 
+RUNNERS = {"grok": "run-grok.sh", "codex": "run-codex.sh", "claude": "run-claude.sh",
+           "gemini": "run-gemini.sh"}
+CLI_NAMES = {"grok": "grok", "codex": "codex", "claude": "claude", "gemini": "agy"}
+
+
 def core_evidence() -> list[tuple[Path, str]]:
     """Resolved when a build runs, not at import: a host missing one CLI can
     still load this module to read PROVEN."""
-    return [
-        (cli_path("grok"), "grok"),
-        (REPO / "scripts/runners/run-grok.sh", "grok"),
-        (cli_path("codex"), "codex"),
-        (REPO / "scripts/runners/run-codex.sh", "codex"),
-        (cli_path("claude"), "claude"),
-        (REPO / "scripts/runners/run-claude.sh", "claude"),
-        (cli_path("agy"), "gemini"),
-        (REPO / "scripts/runners/run-gemini.sh", "gemini"),
-    ]
+    anchors = []
+    for vendor in ("grok", "codex", "claude", "gemini"):
+        if shutil.which(CLI_NAMES[vendor]) is None:
+            continue  # not installed here: main() signs nothing for it
+        anchors += [(cli_path(CLI_NAMES[vendor]), vendor),
+                    (REPO / "scripts/runners" / RUNNERS[vendor], vendor)]
+    return anchors
 
 
 def sha256(path: Path) -> str:
@@ -129,6 +137,12 @@ def main(argv: list[str] | None = None) -> None:
         default=DEFAULT_ROOT,
         help=f"probe sweep root (default: {DEFAULT_ROOT})",
     )
+    parser.add_argument(
+        "--source",
+        default=os.environ.get("OMNILANE_TRANSPORT_SOURCE")
+        or f"{socket.gethostname()} / build_overlay {datetime.now(timezone.utc).date().isoformat()}",
+        help="free-text provenance recorded in the overlay",
+    )
     args = parser.parse_args(argv)
     root = args.root.expanduser()
 
@@ -144,7 +158,11 @@ def main(argv: list[str] | None = None) -> None:
             if path.exists():
                 entry[suffix] = {"path": str(path), "sha256": sha256(path)}
         if "json" not in entry:
-            raise SystemExit(f"missing probe evidence for {cid}: {ev}")
+            # A vendor nobody is logged in to was never probed; that is a gap in this
+            # host's overlay, not a reason to refuse to sign the vendors that were.
+            unproven.append({"config_id": cid, "verdict_reason": "not probed on this host",
+                             "observed_model": None, "probed_at": None})
+            continue
         descriptor_path = Path(entry["json"]["path"])
         descriptor = json.loads(descriptor_path.read_text())
         if not isinstance(descriptor, dict):
@@ -169,11 +187,18 @@ def main(argv: list[str] | None = None) -> None:
     manifest_path = root / "probe-manifest.json"
     manifest_path.write_text(json.dumps(manifest, indent=2, sort_keys=True) + "\n")
 
+    anchors = core_evidence()
+    anchored = {vendor for _, vendor in anchors}
     mappings = []
     for cid, (selector, runtime_model, _) in sorted(PROVEN.items()):
         if cid not in manifest["probe_runs"]:
             continue
         row = ROWS[cid]
+        if row["vendor"] not in anchored:
+            # Evidence with no executable to pin it to verifies nothing.
+            unproven.append({"config_id": cid, "verdict_reason": "vendor CLI is not installed",
+                             "observed_model": None, "probed_at": None})
+            continue
         mapping = {
             "config_id": cid,
             "identity": {key: row[key] for key in IDENTITY_FIELDS},
@@ -187,18 +212,20 @@ def main(argv: list[str] | None = None) -> None:
             mapping["cli_flag"] = "--reasoning-effort"
         mappings.append(mapping)
 
-    evidence = [
-        {"path": str(path), "sha256": sha256(path), "vendor": vendor}
-        for path, vendor in core_evidence()
-    ]
+    evidence = []
+    for path, vendor in anchors:
+        anchor = {"path": str(path), "sha256": sha256(path), "vendor": vendor}
+        if path.name != RUNNERS[vendor]:
+            # The signer an unattended re-sign is later held to; see cli_provenance.
+            anchor["codesign"] = cli_provenance.facts(path)
+        evidence.append(anchor)
     evidence.append({"path": str(manifest_path), "sha256": sha256(manifest_path)})
 
     overlay = {
         "schema_version": 1,
         "snapshot_id": REGISTRY["snapshot"]["id"],
         "host": socket.gethostname(),
-        "source": ("claude-code / MacStudio / operator-directed full sweep 2026-09-07; "
-                   "gemini selectors re-probed 2026-09-09 after agy 1.1.27 -> 1.1.28"),
+        "source": args.source,
         "evidence": evidence,
         "mappings": mappings,
         "unproven": unproven,