omnilane 0.42.9 → 0.44.0

package/scripts/lib/caller_identity.py

@@ -40,6 +40,8 @@ Selector = tuple[str, Optional[str], Optional[str]]
 Lookup = Callable[[int], Optional[tuple[int, list[str]]]]
 EnvironmentLookup = Callable[[int], dict[str, str]]
 UUID_PATTERN = re.compile(r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}\Z")
+CODEX_TOOL_HOSTS = frozenset(("codex-code-mode-host",))
+SHELLS = frozenset(("zsh", "bash", "sh", "dash", "fish"))
 TURN_END_EVENTS = frozenset(("task_complete", "turn_complete", "turn_aborted"))
 CODEX_SANDBOX_REFUSAL = (
     "Codex sandbox (CODEX_SANDBOX=seatbelt) blocked process inspection; omnilane also "
@@ -186,6 +188,17 @@ def resolve(registry: dict, vendor: str, model: str | None,
     return None, f"no scored configuration for {vendor} {model} at effort {effort}"
 
 
+def floor_row(registry: dict, vendor: str, model: str | None) -> dict | None:
+    """The lowest-scored row of a known model, for a caller whose effort is unrecorded.
+
+    Whatever effort actually ran scores at least this much, so the floor can only
+    narrow what the caller may dispatch; it never widens it.
+    """
+    rows = [row for row in registry["scored_configs"]
+            if row["vendor"] == vendor and row["model"] == model]
+    return min(rows, key=lambda row: (row["score"], row["id"])) if rows else None
+
+
 def _thread_environment(entries: list[bytes]) -> dict[str, str]:
     values = [entry.partition(b"=")[2] for entry in entries
               if entry.partition(b"=")[0] == b"CODEX_THREAD_ID"]
@@ -281,7 +294,7 @@ def _launcher(pid: int, lookup: Lookup) -> tuple[int, Selector, int | None] | No
     Nearest wins: a codex worker started by a Claude session is a codex caller.
     """
     seen: set[int] = set()
-    child = None
+    below: list[tuple[int, list[str]]] = []
     for _ in range(MAX_DEPTH):
         if pid <= 0 or pid in seen:
             return None
@@ -292,12 +305,25 @@ def _launcher(pid: int, lookup: Lookup) -> tuple[int, Selector, int | None] | No
         ppid, argv = entry
         selector = read_selector(argv)
         if selector is not None:
-            return pid, selector, child
-        child = pid
+            return pid, selector, _thread_anchor(below)
+        below.append((pid, argv))
         pid = ppid
     return None
 
 
+def _thread_anchor(below: list[tuple[int, list[str]]]) -> int | None:
+    """The process whose initial environment codex wrote for this conversation.
+
+    That is codex's direct child, unless codex runs commands through its own tool
+    host: one host serves every conversation of an app-server, so it carries no
+    thread id and the process it starts for the command does.
+    """
+    for pid, argv in reversed(below):
+        if not (argv and Path(argv[0]).name in CODEX_TOOL_HOSTS):
+            return pid
+    return None
+
+
 def find_launcher(pid: int, lookup: Lookup = _process) -> tuple[int, Selector] | None:
     try:
         found = _launcher(pid, lookup)
@@ -402,11 +428,20 @@ def _rollout_selector(thread: str,
         event, context_turn, event_turn = ended
         raise ValueError(f"latest turn_context turn {context_turn} has already ended "
                          f"({event}, turn {event_turn})" + _rollout_age_hint(last_timestamp, now))
-    for key, value in latest.items():
+    for key in ("turn_id", "model"):
+        value = latest[key]
         if not isinstance(value, str) or not value.strip():
             detail = " (turn unknown)" if key == "turn_id" else ""
             raise ValueError(f"latest turn_context {key} must be a non-empty string{detail}")
-    return ("codex", latest["model"], latest["effort"]), f"thread {thread}, turn {latest['turn_id']}"
+    effort = latest["effort"]
+    source = f"thread {thread}, turn {latest['turn_id']}"
+    if effort is None:
+        # Heartbeat automations wake a thread without recording an effort. The
+        # model is still known, so the caller degrades instead of going blind.
+        return ("codex", latest["model"], None), source + ", turn_context records no effort"
+    if not isinstance(effort, str) or not effort.strip():
+        raise ValueError("latest turn_context effort must be a non-empty string")
+    return ("codex", latest["model"], effort), source
 
 
 def read_caller(pid: int, lookup: Lookup = _process,
@@ -444,7 +479,17 @@ def read_caller(pid: int, lookup: Lookup = _process,
         detail = f"errno {error.errno}" if isinstance(error, OSError) else "invalid environment block"
         raise ValueError(f"cannot read codex direct child initial environment ({detail})") from None
     if not inherited or not UUID_PATTERN.fullmatch(inherited):
-        raise ValueError("codex direct child CODEX_THREAD_ID is missing or not a UUID")
+        entry = lookup(child)
+        name = Path(entry[1][0]).name if entry and entry[1] else "unknown"
+        hint = ""
+        if name.lstrip("-") in SHELLS:
+            # codex starts `zsh -lc '<command>'`; the shell sets the thread id and, for one
+            # simple command, execs into it, so that command is the direct child. With
+            # `;`, `&&`, `|` or a subshell the shell stays, and its own start had no id.
+            hint = ("; run the omnilane command as the only command of the tool call, "
+                    "with no `;`, `&&`, `|` or subshell around it")
+        raise ValueError(f"codex direct child CODEX_THREAD_ID is missing or not a UUID "
+                         f"(read from pid {child}, {name}){hint}")
     if inherited != thread:
         raise ValueError("CODEX_THREAD_ID mismatch between current process and codex direct child")
     selector, source = _rollout_selector(thread, current_environment, now)
@@ -463,18 +508,25 @@ def load_registry(path: str | Path) -> tuple[dict, str]:
         os.environ.update(saved)
 
 
-def write_context(row: dict, registry: dict, home: Path) -> Path:
+def write_context(row: dict, registry: dict, home: Path, effort_unverified: bool = False) -> Path:
     """One file per identity: every session launched the same way is the same caller."""
     directory = Path(home) / "caller-context"
     directory.mkdir(parents=True, exist_ok=True)
-    path = directory / (row["id"].replace("/", "--") + ".json")
-    text = json.dumps({
+    stem = row["id"].replace("/", "--")
+    if effort_unverified:
+        # Not the same caller as one that really launched at the floor effort.
+        stem = f"{row['vendor']}--{row['model'].replace('.', '-')}--effort-unverified"
+    path = directory / (stem + ".json")
+    value = {
         "schema_version": 1,
         "snapshot_id": registry["snapshot"]["id"],
         "kind": "model",
         "caller": {key: row[key] for key in aa_policy.IDENTITY_FIELDS},
         "inherited_ceiling": row["score"],
-    }, indent=2, sort_keys=True) + "\n"
+    }
+    if effort_unverified:
+        value["effort_unverified"] = True
+    text = json.dumps(value, indent=2, sort_keys=True) + "\n"
     try:
         if path.read_text() == text:
             return path
@@ -507,14 +559,24 @@ def main(argv: list[str] | None = None, environment: Mapping[str, str] = os.envi
         print(f"omnilane: cannot read the caller identity: {error}", file=sys.stderr)
         return 3
     row, reason = resolve(registry, vendor, model, effort)
+    degraded = False
+    if row is None and vendor == "codex" and model and effort is None:
+        row = floor_row(registry, vendor, model)
+        degraded = row is not None
     if row is None:
         print(f"omnilane: cannot read the caller identity from pid {pid}: {reason}", file=sys.stderr)
         return 3
     home = Path(os.environ.get("OMNILANE_HOME") or Path.home() / ".omnilane")
-    path = write_context(row, registry, home)
+    path = write_context(row, registry, home, effort_unverified=degraded)
     provenance = f", {source}" if source else ""
-    print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}{provenance}",
-          file=sys.stderr)
+    if degraded:
+        print(f"omnilane: caller is {vendor}/{model} at an unrecorded effort; degraded to its "
+              f"lowest-scored row {row['id']} (ceiling {row['score']}), read from pid {pid}"
+              f"{provenance}. Lanes above that ceiling need a session launched with an "
+              f"explicit effort.", file=sys.stderr)
+    else:
+        print(f"omnilane: caller is {row['id']} (score {row['score']}), read from pid {pid}"
+              f"{provenance}", file=sys.stderr)
     print(path)
     return 0
 

package/scripts/lib/cli_provenance.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Who signed a vendor CLI, and whether a changed one may be re-signed unattended.
+
+The transport overlay pins each vendor's executable by hash. Vendor CLIs update
+themselves, so that pin goes stale as routine traffic. Re-pinning on sight would
+turn the pin into a rubber stamp; this module is what stands in between. A
+changed executable may be re-probed without an operator only when it still
+carries the signer recorded when the overlay was last signed and still lives in
+the same install location. Anything else is a notification, not a re-sign.
+"""
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+ADHOC = "adhoc"
+UNSIGNED = "unsigned"
+# The operator's statement that this vendor's executable is expected to be adhoc
+# here (a local patch step re-signs it), so an adhoc update in the same install
+# location may be re-probed unattended. Nothing else is waived.
+TRUST_ADHOC = "adhoc-in-install-location"
+# 1.0.25 -> 1.0.30 inside a path is an update; a different directory is not.
+VERSION_SEGMENT = re.compile(r"\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.]+)*")
+
+
+def facts(path: Path | str, runner=subprocess.run) -> dict:
+    """codesign's view of one executable: the signing team, or why there is none."""
+    target = str(path)
+    try:
+        verified = runner(["codesign", "--verify", "--strict", target],
+                          capture_output=True, text=True, timeout=60)
+        described = runner(["codesign", "-dv", "--verbose=2", target],
+                           capture_output=True, text=True, timeout=60)
+    except (OSError, subprocess.SubprocessError) as error:
+        return {"signer": UNSIGNED, "identifier": None, "valid": False,
+                "detail": f"codesign unavailable: {error.__class__.__name__}"}
+    fields = {}
+    for line in described.stderr.splitlines():
+        key, separator, value = line.partition("=")
+        if separator and key not in fields:
+            fields[key] = value
+    valid = verified.returncode == 0
+    team = fields.get("TeamIdentifier")
+    if not valid:
+        signer = UNSIGNED
+    elif fields.get("Signature") == "adhoc" or team in (None, "not set"):
+        signer = ADHOC
+    else:
+        signer = team
+    return {"signer": signer, "identifier": fields.get("Identifier"), "valid": valid}
+
+
+def family(path: Path | str) -> str:
+    """An install location with its version numbers blanked out."""
+    return VERSION_SEGMENT.sub("<version>", str(path))
+
+
+def verdict(recorded: dict | None, recorded_path: str | None, current: dict,
+            current_path: Path | str) -> tuple[bool, str]:
+    """May this changed executable be re-probed unattended? And the reason either way."""
+    if current["signer"] == UNSIGNED:
+        return False, "the executable is unsigned, so nothing ties it to the vendor; an operator has to approve it"
+    if current["signer"] == ADHOC:
+        if (recorded or {}).get("operator_trust") == TRUST_ADHOC and recorded_path \
+                and family(recorded_path) == family(current_path):
+            return True, "adhoc, which the operator trusts in this install location"
+        if (recorded or {}).get("operator_trust") == TRUST_ADHOC:
+            return False, (f"adhoc and installed at {current_path}, outside the location the operator "
+                           f"trusts, {family(recorded_path)}")
+        return False, ("the executable is adhoc, so nothing ties it to the vendor; an operator has to "
+                       "approve it (or, for a local patch step, trust it here: omnilane resign --trust-adhoc VENDOR)")
+    if not recorded or not recorded.get("signer"):
+        return False, ("the live overlay recorded no signer for this vendor, so there is nothing "
+                       "to compare against; an operator approves the first signer")
+    if recorded["signer"] != current["signer"]:
+        return False, (f"signed by {current['signer']}, but the overlay was signed against "
+                       f"{recorded['signer']}")
+    if recorded_path and family(recorded_path) != family(current_path):
+        return False, (f"installed at {current_path}, outside the recorded location "
+                       f"{family(recorded_path)}")
+    return True, f"still signed by {current['signer']} in the recorded install location"

package/scripts/lib/native.py

@@ -91,7 +91,11 @@ def capability_context(path):
     ctx = read_json(path)
     fields(ctx, ("schema_version", "harness", "vendor", "capabilities", "requirements"),
            ("current_model", "current_effort", "agent_strategy", "existing_agent",
-            "preserve_existing_context", "new_agent_capacity"))
+            "preserve_existing_context", "new_agent_capacity", "inherits_caller_runtime",
+            "caller_identity_verified"))
+    for flag in ("inherits_caller_runtime", "caller_identity_verified"):
+        if flag in ctx:
+            check(type(ctx[flag]) is bool, "invalid " + flag)
     check(type(ctx["schema_version"]) is int and ctx["schema_version"] == 1, "unsupported context version")
     identifier(ctx["harness"], "harness")
     identifier(ctx["vendor"], "vendor")
@@ -210,6 +214,89 @@ def choose(args, ctx):
     return "native", "exact-idle-reuse-match" if strategy == "reuse" else "exact-capability-match", model
 
 
+def choose_inherited(args, ctx, identity):
+    """A worker spawned with no model override. There is no CLI to fall back to."""
+    if ctx is None:
+        return None, "no-native-context"
+    if ctx.get("inherits_caller_runtime") is not True:
+        return None, "host-does-not-assert-runtime-inheritance"
+    if args.background or args.session != "auto" or args.thread:
+        return None, "cli-session-lifecycle"
+    if args.job_timeout or args.idle_timeout:
+        return None, "cli-watchdog-required"
+    if args.mode == "sysops":
+        return None, "sysops-requires-cli"
+    if ctx["vendor"] != identity["vendor"]:
+        return None, "vendor-mismatch"
+    if ctx.get("current_model", identity["model"]) != identity["model"]:
+        return None, "current-model-mismatch"
+    if ctx.get("agent_strategy", "new") != "new" or "existing_agent" in ctx:
+        return None, "inherit-spawns-a-new-agent"
+    if ctx.get("new_agent_capacity") == "exhausted":
+        return None, "new-agent-capacity-exhausted"
+    req = ctx["requirements"]
+    if req["isolation"] != "shared-inherited" or req["lifecycle"] != "single-shot":
+        return None, "unsupported-isolation-or-lifecycle"
+    # Effort is deliberately not matched: inheriting it is the whole point.
+    caps = [cap for cap in ctx["capabilities"]
+            if cap["model"] == identity["model"] and cap.get("agent_strategy", "new") == "new"
+            and args.mode in cap["modes"] and args.workdir in cap["workdirs"]
+            and set(req["tools"]) <= set(cap["tools"])
+            and "shared-inherited" in cap["isolations"] and "single-shot" in cap["lifecycles"]]
+    if not caps:
+        return None, "no-capability-row-for-caller-model-mode-and-workdir"
+    return "native", "inherited-caller-runtime"
+
+
+def route_inherited(args, ctx, registry, registry_sha):
+    caller = caller_sha = None
+    if args.caller_context:
+        caller, caller_sha = aa_policy.load_caller(
+            args.caller_context, registry, args.expected_caller_sha256)
+    host = None
+    if caller is None and ctx is not None and "current_model" in ctx:
+        host = {"vendor": ctx["vendor"], "model": ctx["current_model"]}
+    decision = aa_policy.decide_inherited(
+        registry, registry_sha, caller=caller, caller_sha256=caller_sha,
+        operator_asserted_human=args.operator_asserted_human, host_asserted=host)
+    if not decision["allowed"]:
+        print(aa_policy._json_line(decision), end="", file=sys.stderr)
+        return 3
+    identity = caller["caller"] if caller is not None else host
+    executor, reason = choose_inherited(args, ctx, identity)
+    if executor is None:
+        # An inherited worker exists only inside the harness; the CLI is not a fallback for it.
+        decision.update(allowed=False, code="native-inherit-unavailable",
+                        message="this harness cannot take an inherited native worker: " + reason,
+                        failed_gate="native-capability", reason=reason, child_context=None,
+                        next_command="omnilane native-context --workdir " + args.workdir)
+        print(aa_policy._json_line(decision), end="", file=sys.stderr)
+        return 3
+    plan = {"schema_version": 1, "executor": executor, "executor_reason": reason, "inherit": True,
+            "caller_identity_verified": decision["caller_identity_verified"],
+            "caller_identity_source": decision["caller_identity_source"],
+            "vendor": identity["vendor"], "model": identity["model"], "effort": "inherited",
+            "harness": ctx["harness"], "lane": args.lane, "mode": args.mode,
+            "workdir": args.workdir, "task": args.task,
+            "requirements": ctx["requirements"], "timeout": args.timeout,
+            "worker_contract": {
+                "no_nested_dispatch": True,
+                "isolation": ctx["requirements"]["isolation"],
+                "mode_is_task_intent": True,
+                "caller_enforces_deadline": True,
+                "model_override": False,
+                "inherit_caller_runtime": True,
+                "satisfies_lane_target": False,
+            },
+            "aa_policy": decision,
+            "state": "planned" if args.dry_run else "pending",
+            "job_id": None, "task_id": None, "agent_id": None,
+            "provider_invoked": False, "job_state_created": False,
+            "agent_strategy": "new", "existing_agent_id": None, "preserve_existing_context": False,
+            "new_agent_capacity": ctx.get("new_agent_capacity", "unknown")}
+    return publish_plan(args, plan, decision, registry, caller)
+
+
 def stamp():
     return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
@@ -302,6 +389,8 @@ def route(args):
     registry, registry_sha = aa_policy.load_registry(
         args.policy, args.expected_registry_sha256
     )
+    if getattr(args, "inherit", False):
+        return route_inherited(args, ctx, registry, registry_sha)
     caller = None
     caller_sha = None
     if args.caller_context:
@@ -355,6 +444,10 @@ def route(args):
         plan["worker_contract"].update(backend="collaboration.followup_task",
                                        preserve_existing_context=True,
                                        caller_rechecks_idle_before_followup=True)
+    return publish_plan(args, plan, policy_decision, registry, caller)
+
+
+def publish_plan(args, plan, policy_decision, registry, caller):
     if args.dry_run:
         print(json_text(plan), end="")
         return 0
@@ -393,6 +486,8 @@ def validate_completion(value, state):
     for key in ("vendor", "model", "effort", "harness", "backend"):
         text_value(runtime[key], "runtime " + key, 256)
     for key in ("vendor", "model", "effort", "harness"):
+        if key == "effort" and state.get("inherit") is True:
+            continue  # the host reports what it observed; nothing was requested
         check(runtime[key] == state[key], "runtime " + key + " mismatch")
     strategy = state.get("agent_strategy", "new")
     if strategy == "reuse":
@@ -448,6 +543,10 @@ def job_command(args):
         summary.update(agent_strategy=state.get("agent_strategy", "new"),
                        existing_agent_id=state.get("existing_agent_id"),
                        preserve_existing_context=state.get("preserve_existing_context", False))
+        if state.get("inherit"):
+            summary.update(inherit=True,
+                           caller_identity_verified=state.get("caller_identity_verified", True),
+                           satisfies_lane_target=False)
         if args.action == "result":
             summary["completion"] = state.get("completion")
         if args.json:
@@ -463,8 +562,12 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__)
     sub = parser.add_subparsers(dest="command", required=True)
     p = sub.add_parser("route")
-    for key in ("home", "lane", "vendor", "model", "effort", "workdir", "task"):
+    for key in ("home", "lane", "workdir", "task"):
         p.add_argument("--" + key, required=True)
+    for key in ("vendor", "model", "effort"):
+        p.add_argument("--" + key, default="")
+    p.add_argument("--inherit", action="store_true",
+                   help="spawn a worker that inherits the caller's own model and effort")
     p.add_argument("--executor", choices=("auto", "native", "cli"), required=True)
     p.add_argument("--mode", choices=("advise", "work", "sysops"), required=True)
     p.add_argument("--context")
@@ -488,6 +591,8 @@ def main():
     p.add_argument("job_id")
     p.add_argument("input", nargs="?")
     args = parser.parse_args()
+    if args.command == "route" and not args.inherit and not args.vendor:
+        parser.error("--vendor is required unless --inherit is given")
     try:
         return route(args) if args.command == "route" else job_command(args)
     except (ValueError, OSError, RecursionError, TypeError, KeyError) as error:

package/scripts/lib/native_context.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""Write the native capability file for the harness this runs under.
+
+Dispatch only hands work to a harness's own sub-agent tool when the harness says
+what that tool can do; without such a file every same-harness target goes out
+through an external CLI. This writes the file from what is observable: the
+caller's vendor, model and effort are read exactly as `omnilane whoami` reads
+them. What cannot be observed from a shell is stated by the host that runs this,
+with flags: `--inherits-caller-runtime` says its sub-agent tool, given no model
+override, runs the caller's own model and effort. Where the identity cannot be
+read at all, `--vendor` and `--model` are the host's statement of what it is; the
+file then says so, and serves an inherited worker only. Prints the file's path.
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import caller_identity  # noqa: E402
+
+HARNESSES = {"codex": "codex", "claude": "claude-code", "grok": "grok-build", "gemini": "antigravity"}
+UNVERIFIED_EFFORT = "unverified"
+HOST_STATEMENT_HINT = ("omnilane: if this harness cannot be read, state what it is: omnilane native-context "
+                       "--vendor VENDOR --model MODEL --inherits-caller-runtime (serves --inherit only)")
+
+
+def build(vendor: str, model: str, effort: str | None, *, harness: str, workdirs: list[str],
+          modes: list[str], inherits: bool, verified: bool = True) -> dict:
+    value = {
+        "schema_version": 1,
+        "harness": harness,
+        "vendor": vendor,
+        "current_model": model,
+        "requirements": {"tools": [], "isolation": "shared-inherited", "lifecycle": "single-shot"},
+        "capabilities": [{
+            "model": model,
+            # An unrecorded effort matches no lane target; only --inherit can use this row.
+            "efforts": [effort or UNVERIFIED_EFFORT],
+            "modes": modes,
+            "workdirs": workdirs,
+            "tools": [],
+            "isolations": ["shared-inherited"],
+            "lifecycles": ["single-shot"],
+        }],
+    }
+    if effort:
+        value["current_effort"] = effort
+    if inherits:
+        value["inherits_caller_runtime"] = True
+    if not verified:
+        value["caller_identity_verified"] = False
+    return value
+
+
+def main(argv: list[str] | None = None, read_caller=caller_identity.read_caller) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--workdir", action="append", type=Path,
+                        help="directory a native worker may be given; may repeat (default: cwd)")
+    parser.add_argument("--mode", action="append", choices=("advise", "work"),
+                        help="task intent the host accepts; may repeat (default: advise)")
+    parser.add_argument("--harness", help="harness name (default: derived from the caller's vendor)")
+    parser.add_argument("--inherits-caller-runtime", action="store_true",
+                        help="the host states that a sub-agent spawned with no model override "
+                             "runs the caller's own model and effort")
+    parser.add_argument("--registry",
+                        default=os.environ.get("OMNILANE_AA_POLICY_FILE")
+                        or str(caller_identity.REPO / "config" / "aa-model-policy.json"))
+    parser.add_argument("--vendor", help="host-asserted vendor, used only when the identity cannot be read")
+    parser.add_argument("--model", help="host-asserted current model, used only when the identity cannot be read")
+    parser.add_argument("--out", type=Path, help="file to write (default: under ~/.omnilane)")
+    args = parser.parse_args(argv)
+    if bool(args.vendor) != bool(args.model):
+        print("omnilane: --vendor and --model go together", file=sys.stderr)
+        return 2
+    for name in (args.vendor, args.model):
+        if name and not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}", name):
+            print(f"omnilane: invalid name: {name}", file=sys.stderr)
+            return 2
+    verified, recorded = True, None
+    try:
+        registry, _ = caller_identity.load_registry(args.registry)
+        _, (vendor, model, effort), _ = read_caller(os.getpid())
+    except (ValueError, OSError) as error:
+        if not args.vendor:
+            print(f"omnilane: cannot read the caller identity: {error}\n{HOST_STATEMENT_HINT}", file=sys.stderr)
+            return 3
+        print(f"omnilane: caller identity not verified ({error}); using the host's statement",
+              file=sys.stderr)
+        verified, vendor, model = False, args.vendor, args.model
+    else:
+        if args.vendor and (args.vendor != vendor or (model is not None and args.model != model)):
+            print(f"omnilane: this harness reads as {vendor}/{model}, not {args.vendor}/{args.model}",
+                  file=sys.stderr)
+            return 2
+        row, reason = caller_identity.resolve(registry, vendor, model, effort)
+        if row is not None:
+            # Codex spells its reasoning-off effort "none"; the registry stores it as null.
+            recorded = row["effort"] or ("none" if vendor == "codex" else None)
+        elif not (vendor == "codex" and model and effort is None
+                  and caller_identity.floor_row(registry, vendor, model)):
+            if not args.vendor:
+                print(f"omnilane: cannot describe this harness: {reason}\n{HOST_STATEMENT_HINT}",
+                      file=sys.stderr)
+                return 3
+            print(f"omnilane: caller identity not verified ({reason}); using the host's statement",
+                  file=sys.stderr)
+            verified, model = False, args.model
+    workdirs = []
+    for path in args.workdir or [Path.cwd()]:
+        resolved = path.expanduser().resolve()
+        if not resolved.is_dir():
+            print(f"omnilane: not a directory: {path}", file=sys.stderr)
+            return 2
+        workdirs.append(str(resolved))
+    value = build(vendor, model, recorded,
+                  harness=args.harness or HARNESSES.get(vendor, vendor),
+                  workdirs=sorted(set(workdirs)), modes=sorted(set(args.mode or ["advise"])),
+                  inherits=args.inherits_caller_runtime, verified=verified)
+    text = json.dumps(value, indent=2, sort_keys=True) + "\n"
+    out = args.out
+    if out is None:
+        home = Path(os.environ.get("OMNILANE_HOME") or Path.home() / ".omnilane")
+        digest = hashlib.sha256(text.encode()).hexdigest()[:12]
+        out = home / "native-context" / f"{value['harness']}--{model.replace('.', '-')}--{digest}.json"
+    out.parent.mkdir(parents=True, exist_ok=True)
+    staging = out.with_name(f".{out.name}.{os.getpid()}.tmp")
+    staging.write_text(text)
+    os.replace(staging, out)
+    note = "" if args.inherits_caller_runtime else (
+        "; pass --inherits-caller-runtime if this harness's sub-agent tool inherits your runtime")
+    print(f"omnilane: native context for {value['harness']} {model} "
+          f"(effort {recorded or 'unrecorded'}{'' if verified else ', identity host-asserted'}){note}",
+          file=sys.stderr)
+    print(out)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lib/overlay_health.py

@@ -53,7 +53,10 @@ def offenders(overlay_path: Path) -> list[str]:
 def main() -> None:
     overlay_path = os.environ.get("OMNILANE_AA_TRANSPORT_OVERLAY", "")
     if not overlay_path:
-        emit("PASS", "no overlay configured; every runtime mapping stays unverified")
+        if os.environ.get("OMNILANE_AA_OPERATOR_ASSERTED_HUMAN") == "1":
+            emit("PASS", "no overlay configured; fine for a human operator, but a model caller "
+                         "would be refused on every lane (README, 'Let your AI assistant drive omnilane')")
+        emit("WARN", "no overlay configured, so a model caller is refused on every lane (runtime-mapping-unverified). First install: probe_sweep.py --root ROOT, build_overlay.py --root ROOT, then export OMNILANE_AA_TRANSPORT_OVERLAY in local.sh; see the README, 'Let your AI assistant drive omnilane'")
     if not Path(overlay_path).exists():
         emit("FAIL", f"configured overlay is missing: {overlay_path}")
 
@@ -87,10 +90,29 @@ def main() -> None:
                   "record who answered")
 
     stale = registry.get("_stale_transport_vendors", [])
+    # The gate hashes the path the overlay recorded. An update that installs beside
+    # the old executable leaves that path intact, so only this comparison sees it.
+    moved = []
+    try:
+        import resign
+        report = resign.detect(overlay, resign.current_anchors())
+        for vendor, entry in report.items():
+            # Only what the overlay actually pinned can have moved.
+            reasons = [reason for reason in entry["reasons"]
+                       if reason.startswith("runs ") or reason.endswith(" changed")]
+            if reasons and entry["recorded_cli_path"] and vendor not in stale:
+                moved.append(f"{vendor}: {'; '.join(reasons)}")
+    except Exception:  # noqa: BLE001 - a health line must never raise
+        moved = []
+    if moved and not stale:
+        emit("WARN", f"the runners no longer execute what the overlay pinned ({' | '.join(moved)}); "
+                     f"run `omnilane resign`; still loading: {summary}{extra}")
     if stale:
         detail = "; ".join(o for o in offenders(Path(overlay_path))) or "unknown cause"
+        if moved:
+            detail += "; also moved without going stale: " + " | ".join(moved)
         emit("WARN", f"stale vendor(s) {', '.join(stale)} degraded to unverified "
-                     f"({detail}); still verified: {summary}{extra}")
+                     f"({detail}); run `omnilane resign`; still verified: {summary}{extra}")
     emit("PASS", f"verified mappings: {summary}{extra}")
 
 

package/scripts/lib/probe.py

@@ -6,6 +6,8 @@ descriptor with the original command/stream fields plus a vendor-specific
 verdict, its reason, the observed model, and the tier of evidence that model
 rests on.
 """
+from __future__ import annotations
+
 import argparse
 import glob
 import json