omnilane 0.44.0 → 0.45.0

package/scripts/aa_rebaseline.py

@@ -0,0 +1,409 @@
+#!/usr/bin/env python3
+"""Re-baseline config/aa-model-policy.json onto a newer AA Intelligence Index.
+
+    fetch   download one AA model page and save the per-model records as an extract
+    build   regenerate the registry from a saved extract (never from the network)
+    report  write per-vendor evidence tables and the old-vs-new score diff
+    matrix  show, per controller, the first reachable target of every lane
+    lanes   print, per lane, each candidate with the measurements the lane is ordered on
+
+The registry is an approval artifact: build only rewrites the file. Pinning its
+sha256 in scripts/lib/aa_policy.py and re-signing the host overlay stay manual.
+"""
+from __future__ import annotations
+
+import argparse
+import copy
+import hashlib
+import json
+import re
+import subprocess
+import sys
+from datetime import datetime
+from decimal import ROUND_HALF_UP, Decimal
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[1]
+REGISTRY = REPO / "config/aa-model-policy.json"
+PAGE = "https://artificialanalysis.ai/models/{slug}"
+UA = ("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
+      "(KHTML, like Gecko) Chrome/140.0 Safari/537.36")
+VENDOR_SLUG = re.compile(r"^(gpt|claude|gemini|grok)-")
+KEEP = (
+    "name", "intelligenceIndex", "intelligenceIndexIsEstimated", "releaseDate", "deprecated",
+    "contextWindowTokens", "terminalBench21", "terminalbenchHard", "scicode", "hle", "gpqa",
+    "omniscience", "tau2", "lcr", "ifbench", "critpt", "gdpvalNormalized", "itBenchSre",
+    "apexAgents", "price1mInputTokens", "price1mOutputTokens", "price1mBlended7To2To1",
+    "intelligenceIndexOutputTokensPerTask", "timeToFirstAnswerToken",
+    # what routing.yaml orders its lanes on
+    "terminalBench40", "automationBenchPartialScore", "tauBanking", "mlcrOverall", "mmmuPro",
+    "omniscienceBreakdown", "briefcaseBreakdown", "intelligenceIndexCost", "intelligenceIndexTimePerTask",
+)
+
+# Rows this snapshot adds. identity mirrors the sibling rows of the same model.
+NEW_ROWS = [
+    # (id, vendor, model, effort, reasoning, aa_slug, copy transport/shape from)
+    ("grok/grok-4-7", "grok", "grok-4.7", "xhigh", "reasoning", "grok-4-7", "grok/grok-4-6-xhigh"),
+    ("grok/grok-4-7-high", "grok", "grok-4.7", "high", "reasoning", "grok-4-7-high", "grok/grok-4-6"),
+    ("claude/claude-sonnet-5-xhigh", "claude", "claude-sonnet-5", "xhigh", "adaptive",
+     "claude-sonnet-5-xhigh", "claude/claude-sonnet-5"),
+    ("claude/claude-sonnet-5-high", "claude", "claude-sonnet-5", "high", "adaptive",
+     "claude-sonnet-5-high", "claude/claude-sonnet-5"),
+    ("claude/claude-sonnet-5-medium", "claude", "claude-sonnet-5", "medium", "adaptive",
+     "claude-sonnet-5-medium", "claude/claude-sonnet-5"),
+    ("claude/claude-sonnet-5-low", "claude", "claude-sonnet-5", "low", "adaptive",
+     "claude-sonnet-5-low", "claude/claude-sonnet-5"),
+]
+NEW_ALIASES = {"grok-4.7": "grok-4.6"}  # new catalog model -> alias entry to clone
+
+
+def half_up(value: float) -> int:
+    # round() is banker's rounding; a registry score must not depend on parity.
+    return int(Decimal(str(value)).quantize(Decimal("1"), rounding=ROUND_HALF_UP))
+
+
+def dump(value: dict) -> bytes:
+    return (json.dumps(value, indent=2, ensure_ascii=False) + "\n").encode()
+
+
+def parse_records(body: str) -> dict[str, dict]:
+    """The page embeds every model as escaped JSON; take each object that carries a score."""
+    text = body.replace('\\"', '"').replace("\\\\", "\\")
+    records: dict[str, dict] = {}
+    for match in re.finditer(r'"intelligenceIndex":', text):
+        start, depth = match.start(), 0
+        while start > 0:
+            char = text[start]
+            if char == "}":
+                depth += 1
+            elif char == "{":
+                if depth == 0:
+                    break
+                depth -= 1
+            start -= 1
+        end, depth = match.start(), 0
+        while end < len(text):
+            char = text[end]
+            if char == "{":
+                depth += 1
+            elif char == "}":
+                if depth == 0:
+                    break
+                depth -= 1
+            end += 1
+        try:
+            obj = json.loads(text[start:end + 1])
+        except ValueError:
+            continue
+        slug = obj.get("slug")
+        if not isinstance(slug, str):
+            continue
+        # A model appears several times, each copy carrying a different subset of
+        # fields; which copy comes first varies between fetches.
+        merged = records.setdefault(slug, {})
+        for key, value in obj.items():
+            if merged.get(key) is None:
+                merged[key] = value
+    return records
+
+
+def cmd_fetch(args) -> int:
+    url = PAGE.format(slug=args.slug)
+    body = subprocess.run(["curl", "-sSL", "--fail", "-A", UA, "--max-time", "120", url],
+                          check=True, capture_output=True, text=True).stdout
+    version = re.search(r"Intelligence Index v([0-9.]+)", body)
+    if not version:
+        sys.exit("fetch: the page names no Intelligence Index version")
+    records = parse_records(body)
+    kept = {}
+    for slug, obj in sorted(records.items()):
+        if not VENDOR_SLUG.match(slug) or obj.get("intelligenceIndex") is None:
+            continue
+        row = {key: obj.get(key) for key in KEEP}
+        effort = obj.get("effort")
+        row["effort_label"] = effort.get("slug") if isinstance(effort, dict) else effort
+        kept[slug] = row
+    extract = {
+        "source_url": url,
+        "fetched_at": datetime.now().astimezone().isoformat(timespec="seconds"),
+        "page_sha256": hashlib.sha256(body.encode()).hexdigest(),
+        "benchmark_version": version.group(1),
+        "records_on_page": len(records),
+        "records": kept,
+    }
+    Path(args.out).write_bytes(dump(extract))
+    print(f"fetch: AA v{extract['benchmark_version']}, {len(records)} records on page, "
+          f"{len(kept)} vendor records kept -> {args.out}")
+    return 0
+
+
+def rescore(row: dict, record: dict, version: str, as_of: str, report: str) -> None:
+    row["score"] = half_up(record["intelligenceIndex"])
+    row["score_raw"] = round(record["intelligenceIndex"], 2)
+    row["estimated"] = bool(record["intelligenceIndexIsEstimated"])
+    row["evidence_marker"] = "estimated" if row["estimated"] else "unmarked"
+    row["benchmark_version"], row["as_of"], row["evidence_report"] = version, as_of, report
+
+
+def cmd_build(args) -> int:
+    extract = json.loads(Path(args.extract).read_text())
+    records, version, as_of = extract["records"], extract["benchmark_version"], args.as_of
+    old = json.loads(Path(args.base).read_text())
+    new = copy.deepcopy(old)
+    report = lambda vendor: f"docs/reports/aa-{vendor}-evidence-{as_of}.md"  # noqa: E731
+
+    scored, dropped = [], []
+    for row in new["scored_configs"]:
+        record = records.get(row["aa_slug"])
+        if record is None:
+            dropped.append(row)
+            continue
+        rescore(row, record, version, as_of, report(row["vendor"]))
+        scored.append(row)
+    by_id = {row["id"]: row for row in old["scored_configs"]}
+    for cid, vendor, model, effort, reasoning, slug, shape in NEW_ROWS:
+        if cid in {row["id"] for row in scored}:
+            continue
+        if slug not in records:
+            sys.exit(f"build: {slug} is not in the extract")
+        row = copy.deepcopy(by_id[shape])
+        row.update(id=cid, vendor=vendor, model=model, effort=effort, reasoning=reasoning,
+                   fallback=None, aa_slug=slug, source_urls=[PAGE.format(slug=slug)])
+        row["transport_mapping"]["candidate_model_ids"] = [model]
+        rescore(row, records[slug], version, as_of, report(vendor))
+        scored.append(row)
+    scored.sort(key=lambda row: (-row["score"], -row["score_raw"], row["id"]))
+    new["scored_configs"] = scored
+
+    added = {(v, m, e, r) for _, v, m, e, r, _, _ in NEW_ROWS}
+    unknown = [row for row in new["unknown_configs"]
+               if (row["vendor"], row["model"], row["effort"], row["reasoning"]) not in added]
+    for row in unknown:
+        row["benchmark_version"], row["as_of"] = version, as_of
+        row["evidence_report"] = report(row["vendor"])
+    for row in dropped:
+        unknown.append({
+            "id": "/".join(str(row[key]) for key in ("vendor", "model", "effort", "reasoning")).replace("None", "none"),
+            **{key: row[key] for key in ("vendor", "model", "effort", "reasoning", "fallback")},
+            "score": None, "estimated": None, "benchmark_version": version, "as_of": as_of,
+            "status": "unknown", "authority_eligible": False,
+            "reason": f"AA v{version} no longer lists {row['aa_slug']}; the earlier score is not carried over",
+            "source_urls": [], "evidence_report": report(row["vendor"]), "mapping_status": "unknown",
+            "transport_mapping": {"status": "unknown", "runtime_verified": False, "resolved_config_id": None},
+        })
+    new["unknown_configs"] = unknown
+
+    for row in new["reference_configs"]:
+        if row["aa_slug"] in records:
+            rescore(row, records[row["aa_slug"]], version, as_of, report(row["vendor"]))
+
+    live_ids = {row["id"] for row in scored}
+    for alias in new["aliases"]:
+        alias["candidate_config_ids"] = [cid for cid in alias["candidate_config_ids"] if cid in live_ids]
+        for cid, vendor, model, *_ in NEW_ROWS:
+            if (alias["catalog_vendor"], alias["catalog_model"]) == (vendor, model) \
+                    and cid not in alias["candidate_config_ids"]:
+                alias["candidate_config_ids"].append(cid)
+    # aliases mirror scripts/configure.sh's catalog, so a new alias needs the model there too.
+    have = {(alias["catalog_vendor"], alias["catalog_model"]) for alias in new["aliases"]}
+    for model, source in NEW_ALIASES.items():
+        template = next(a for a in new["aliases"] if a["catalog_model"] == source)
+        if (template["catalog_vendor"], model) not in have:
+            clone = copy.deepcopy(template)
+            clone["catalog_model"] = model
+            clone["candidate_config_ids"] = [cid for cid, _, m, *_ in NEW_ROWS if m == model]
+            new["aliases"].insert(new["aliases"].index(template), clone)
+
+    vendors: dict[str, int] = {}
+    for row in scored:
+        vendors[row["vendor"]] = vendors.get(row["vendor"], 0) + 1
+    new["coverage"] = {"scored_configs": len(scored), "reference_configs": len(new["reference_configs"]),
+                       "unknown_configs": len(unknown), "aliases": len(new["aliases"]),
+                       "by_vendor": {v: vendors[v] for v in old["coverage"]["by_vendor"]}}
+    new["snapshot"].update(
+        id=f"aa-v{version}-{as_of}-v1", benchmark_version=version, as_of=as_of,
+        source={"extract": str(Path(args.extract).resolve().relative_to(REPO)),
+                "page_url": extract["source_url"], "page_sha256": extract["page_sha256"],
+                "fetched_at": extract["fetched_at"]},
+        approval={"status": args.approval, "scope": f"aa-v{version}-rebaseline",
+                  "source": f"docs/reports/aa-rebaseline-{as_of}.md",
+                  "estimated_scores": "approved_provisional" if args.approval == "approved"
+                  else "provisional_pending_review"})
+    new.setdefault("schema_notes", {})["score_rounding"] = (
+        "score is score_raw rounded half-up to an integer; score_raw is the AA index to two decimals")
+    REGISTRY.write_bytes(dump(new))
+    print(f"build: {len(scored)} scored ({sum(r['estimated'] for r in scored)} estimated), "
+          f"{len(unknown)} unknown, dropped {[r['id'] for r in dropped]}")
+    print(f"build: sha256 {hashlib.sha256(REGISTRY.read_bytes()).hexdigest()}")
+    return 0
+
+
+def cmd_report(args) -> int:
+    old = {row["id"]: row for row in json.loads(Path(args.old).read_text())["scored_configs"]}
+    new = json.loads(REGISTRY.read_text())
+    as_of, version = new["snapshot"]["as_of"], new["snapshot"]["benchmark_version"]
+    out = REPO / "docs/reports"
+    out.mkdir(parents=True, exist_ok=True)
+    for vendor in new["coverage"]["by_vendor"]:
+        lines = [f"# AA v{version} evidence: {vendor} ({as_of})", "",
+                 f"Generated by `scripts/aa_rebaseline.py report` from `{new['snapshot']['source']['extract']}` "
+                 f"(page sha256 `{new['snapshot']['source']['page_sha256'][:16]}…`).", "",
+                 "| config | effort | raw | score | estimated | previous | source |", "|---|---|---|---|---|---|---|"]
+        for row in new["scored_configs"]:
+            if row["vendor"] != vendor:
+                continue
+            before = old.get(row["id"])
+            lines.append(f"| {row['id']} | {row['effort']} | {row['score_raw']} | {row['score']} | "
+                         f"{'yes' if row['estimated'] else 'no'} | "
+                         f"{before['score'] if before else 'new'} | {row['source_urls'][0]} |")
+        gone = [cid for cid, row in old.items() if row["vendor"] == vendor
+                and cid not in {r["id"] for r in new["scored_configs"]}]
+        if gone:
+            lines += ["", "No longer listed by AA, moved to unknown_configs: " + ", ".join(gone)]
+        (out / f"aa-{vendor}-evidence-{as_of}.md").write_text("\n".join(lines) + "\n")
+    print(f"report: wrote {len(new['coverage']['by_vendor'])} vendor reports under {out}")
+    return 0
+
+
+def lane_table(path: Path) -> dict[str, list[tuple[str, str, str | None]]]:
+    table = {}
+    for line in path.read_text().splitlines():
+        match = re.match(r"^([a-z][a-z-]*):\s*(.+)$", line.split("#")[0].rstrip())
+        if not match or match.group(2).split()[0] in ("off", "vote"):
+            continue
+        chain = []
+        for segment in match.group(2).split("|"):
+            parts = segment.split()
+            if len(parts) >= 2:
+                chain.append((parts[0], parts[1], parts[2] if len(parts) > 2 and parts[2] != "-" else None))
+        table[match.group(1)] = chain
+    return table
+
+
+def target_row(rows: list[dict], vendor: str, model: str, effort: str | None) -> dict | None:
+    hits = [row for row in rows if row["vendor"] == vendor and row["reasoning"] != "non-reasoning"
+            and (f"{row['model']}-{row['effort']}" == model if vendor == "gemini"
+                 else row["model"] == model and row["effort"] == effort)]
+    return hits[0] if len(hits) == 1 else None
+
+
+def cmd_matrix(args) -> int:
+    """Score-only view: it ignores transport verification, which is per host."""
+    rows = json.loads(Path(args.registry).read_text())["scored_configs"]
+    by_id = {row["id"]: row for row in rows}
+    table = lane_table(Path(args.routing))
+    print("| controller (ceiling) | " + " | ".join(table) + " |")
+    print("|---|" + "---|" * len(table))
+    for cid in args.controller:
+        ceiling = by_id[cid]["score"]
+        cells = []
+        for chain in table.values():
+            cell = "none"
+            for index, (vendor, model, effort) in enumerate(chain):
+                row = target_row(rows, vendor, model, effort)
+                if row and row["score"] <= ceiling:
+                    cell = f"{row['id'].split('/')[1]} {row['score']}" + (f" (#{index + 1})" if index else "")
+                    break
+            cells.append(cell)
+        print(f"| {cid.split('/')[1]} ({ceiling}) | " + " | ".join(cells) + " |")
+    return 0
+
+
+def _nested(*path):
+    def read(record):
+        for key in path:
+            record = (record or {}).get(key)
+        return record
+    return read
+
+
+MEASURES = {  # column title -> (reader, decimals, scale)
+    "index": (_nested("intelligenceIndex"), 1, 1),
+    "Terminal-Bench 4.0": (_nested("terminalBench40"), 3, 1),
+    "Terminal-Bench 2.1": (_nested("terminalBench21"), 3, 1),
+    "SciCode": (_nested("scicode"), 3, 1),
+    "hallucination rate": (_nested("omniscienceBreakdown", "hallucinationRate"), 3, 1),
+    "knowledge (omniscience)": (_nested("omniscience"), 1, 1),
+    "HLE": (_nested("hle"), 3, 1),
+    "GPQA": (_nested("gpqa"), 3, 1),
+    "CritPt": (_nested("critpt"), 3, 1),
+    "Briefcase analytical Elo": (_nested("briefcaseBreakdown", "analyticalQuality", "elo"), 0, 1),
+    "Briefcase overall Elo": (_nested("briefcaseBreakdown", "overall", "elo"), 0, 1),
+    "Briefcase presentation Elo": (_nested("briefcaseBreakdown", "presentation", "elo"), 0, 1),
+    "GDPval": (_nested("gdpvalNormalized"), 3, 1),
+    "AutomationBench": (_nested("automationBenchPartialScore"), 3, 1),
+    "MMMU-Pro": (_nested("mmmuPro"), 3, 1),
+    "mlcrOverall": (_nested("mlcrOverall"), 3, 1),
+    "AA-LCR": (_nested("lcr"), 3, 1),
+    "minutes / task": (_nested("intelligenceIndexTimePerTask"), 1, 1 / 60),
+    "first answer token (s)": (_nested("timeToFirstAnswerToken", "total"), 0, 1),
+    "index run cost ($)": (_nested("intelligenceIndexCost", "total"), 0, 1),
+}
+LANE_MEASURES = {
+    "hardest-coding": ("Terminal-Bench 4.0", "Terminal-Bench 2.1", "SciCode", "hallucination rate"),
+    "bulk-mechanical": ("Terminal-Bench 4.0", "Terminal-Bench 2.1", "hallucination rate", "minutes / task",
+                        "index run cost ($)"),
+    "triage": ("index", "index run cost ($)", "minutes / task"),
+    "hard-judgment": ("HLE", "GPQA", "CritPt", "Briefcase analytical Elo", "hallucination rate"),
+    "taste-final": ("Briefcase overall Elo", "Briefcase presentation Elo", "GDPval"),
+    "consult": ("index",),
+    "ui-draft": ("MMMU-Pro", "Terminal-Bench 4.0"),
+    "long-context": ("mlcrOverall", "AA-LCR", "index run cost ($)"),
+    "fast-agentic": ("AutomationBench", "minutes / task", "first answer token (s)"),
+    "live-search": ("hallucination rate", "knowledge (omniscience)"),
+    "coding-overflow": ("Terminal-Bench 4.0", "SciCode"),
+}
+
+
+def cmd_lanes(args) -> int:
+    """Per lane, every candidate with the measurements that lane is ordered on."""
+    records = json.loads(Path(args.extract).read_text())["records"]
+    rows = json.loads(Path(args.registry).read_text())["scored_configs"]
+    for lane, chain in lane_table(Path(args.routing)).items():
+        titles = LANE_MEASURES.get(lane, ("index",))
+        print(f"\n**{lane}**\n\n| # | candidate | score | " + " | ".join(titles) + " |")
+        print("|---|---|---|" + "---|" * len(titles))
+        for index, (vendor, model, effort) in enumerate(chain, 1):
+            row = target_row(rows, vendor, model, effort)
+            name = f"{vendor} {model}" + (f" {effort}" if effort else "")
+            if row is None:
+                print(f"| {index} | {name} | not scored | " + " | ".join("—" for _ in titles) + " |")
+                continue
+            cells = []
+            for title in titles:
+                reader, places, scale = MEASURES[title]
+                value = reader(records.get(row["aa_slug"]))
+                cells.append("not published" if value is None else f"{value * scale:.{places}f}")
+            print(f"| {index} | {name} | {row['score']} | " + " | ".join(cells) + " |")
+    return 0
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    sub = parser.add_subparsers(dest="command", required=True)
+    fetch = sub.add_parser("fetch")
+    fetch.add_argument("--slug", default="grok-4-7")
+    fetch.add_argument("--out", required=True)
+    build = sub.add_parser("build")
+    build.add_argument("--extract", required=True)
+    build.add_argument("--as-of", required=True)
+    build.add_argument("--base", default=str(REGISTRY),
+                       help="the registry to re-score; pass the previous snapshot to rebuild from scratch")
+    build.add_argument("--approval", default="proposed", choices=("proposed", "approved"))
+    report = sub.add_parser("report")
+    report.add_argument("--old", required=True, help="the previous registry file")
+    matrix = sub.add_parser("matrix")
+    matrix.add_argument("--registry", default=str(REGISTRY))
+    matrix.add_argument("--routing", default=str(REPO / "routing.yaml"))
+    matrix.add_argument("--controller", nargs="+", required=True, help="registry config ids")
+    lanes = sub.add_parser("lanes")
+    lanes.add_argument("--extract", required=True)
+    lanes.add_argument("--registry", default=str(REGISTRY))
+    lanes.add_argument("--routing", default=str(REPO / "routing.yaml"))
+    args = parser.parse_args()
+    return {"fetch": cmd_fetch, "build": cmd_build, "report": cmd_report, "matrix": cmd_matrix,
+            "lanes": cmd_lanes}[args.command](args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/configure.sh

@@ -154,7 +154,7 @@ CODEX_EFFORTS=("xhigh" "max" "ultra" "high" "medium" "low" "minimal" "none")
 CLAUDE_MODELS=("default" "best" "fable" "opus" "sonnet" "haiku" "opus[1m]" "sonnet[1m]" "opusplan" "claude-fable-5" "claude-fable-5-1" "claude-opus-5" "claude-sonnet-5" "claude-opus-4-8" "claude-opus-4-7" "claude-opus-4-6" "claude-opus-4-5-20251101" "claude-sonnet-4-6" "claude-sonnet-4-5-20250929" "claude-haiku-4-5" "claude-haiku-4-5-20251001")
 CLAUDE_EFFORTS=("max" "xhigh" "high" "medium" "low" "-")
 GEMINI_MODELS=("gemini-3.8-flash-high" "gemini-3.8-flash-medium" "gemini-3.8-flash-low" "gemini-3.7-flash-high" "gemini-3.7-flash-medium" "gemini-3.7-flash-low" "gemini-3.6-flash-high" "gemini-3.6-flash-medium" "gemini-3.6-flash-low" "gemini-3.1-pro-high" "gemini-3.1-pro-low" "claude-sonnet-4-6" "claude-opus-4-6-thinking" "gpt-oss-120b-medium")
-GROK_MODELS=("grok-4.6" "headroom-grok-build" "grok-4.3-official")
+GROK_MODELS=("grok-4.7" "grok-4.6" "headroom-grok-build" "grok-4.3-official")
 KIMI_MODELS=("kimi-k3" "kimi-k2.7-code" "kimi-k2.5")
 QWEN_MODELS=("qwen3.7-max" "qwen3.7-plus" "qwen3.6-plus" "qwen3.5-plus" "qwen3-max-2026-01-23" "qwen3-coder-next" "qwen3-coder-plus" "qwen3-coder-flash")
 # OpenCode models use provider/model form; OpenRouter models use catalog slugs.

package/scripts/lib/aa_policy.py

@@ -23,9 +23,12 @@ from typing import Any
 
 
 MAX_BYTES = 1_048_576
-# Approval anchor for the frozen AA v4.2 2026-09-07 source bytes. Updating this
-# constant is a governance change, never a caller argument/environment override.
-APPROVED_REGISTRY_SHA256 = "0782c87de123c02738c3ff60e4bc3c1cc10d110113e872b8f8627212861cdaab"
+# Approval anchor for the frozen AA source bytes. Updating these constants is a
+# governance change, never a caller argument/environment override.
+# scripts/aa_rebaseline.py regenerates the registry; it never touches this pin.
+APPROVED_BENCHMARK_VERSION = "4.3.2"
+APPROVED_AS_OF = "2026-09-22"
+APPROVED_REGISTRY_SHA256 = "a1109913b9928d943bc440787d26caaf7818e40abdaae32899750d65e5eb5fdd"
 
 IDENTITY_FIELDS = ("vendor", "model", "effort", "reasoning", "fallback")
 TRANSPORT_EVIDENCE_VENDORS = frozenset(("codex", "claude", "grok", "gemini"))
@@ -109,10 +112,10 @@ def _validate_registry(value: dict[str, Any]) -> dict[str, Any]:
     _check(isinstance(snapshot, dict), "invalid AA registry snapshot")
     for key in ("id", "benchmark_version", "as_of", "frozen"):
         _check(key in snapshot, "incomplete AA registry snapshot")
-    _check(snapshot["benchmark_version"] == "4.2"
-           and snapshot["as_of"] == "2026-09-07"
+    _check(snapshot["benchmark_version"] == APPROVED_BENCHMARK_VERSION
+           and snapshot["as_of"] == APPROVED_AS_OF
            and snapshot["frozen"] is True,
-           "AA registry is not frozen v4.2 dated 2026-09-07")
+           f"AA registry is not frozen v{APPROVED_BENCHMARK_VERSION} dated {APPROVED_AS_OF}")
     policy = value["policy"]
     _check(isinstance(policy, dict)
            and policy.get("decision") == "target_score <= min(caller_score, inherited_ceiling)"
@@ -135,7 +138,8 @@ def _validate_registry(value: dict[str, Any]) -> dict[str, Any]:
         _check(type(row["score"]) is int and 0 <= row["score"] <= 100,
                "invalid AA score")
         _check(type(row["estimated"]) is bool, "invalid AA estimated flag")
-        _check(row["benchmark_version"] == "4.2" and row["as_of"] == "2026-09-07",
+        _check(row["benchmark_version"] == APPROVED_BENCHMARK_VERSION
+               and row["as_of"] == APPROVED_AS_OF,
                "mixed AA registry snapshot")
         _check(isinstance(row["transport_mapping"], dict), "invalid transport mapping")
     return value

package/scripts/lib/build_overlay.py

@@ -49,6 +49,9 @@ PROVEN["grok/grok-4-6"] = ("cli_reasoning_effort", "grok-4.6", "gk-grok-4_6-high
 for effort in ["xhigh", "medium", "low"]:
     PROVEN[f"grok/grok-4-6-{effort}"] = ("cli_reasoning_effort", "grok-4.6", f"gk-grok-4_6-{effort}")
 PROVEN["grok/grok-4-5"] = ("cli_reasoning_effort", "grok-4.5", "gk-grok-4_5-high")
+# AA scores grok-4.7 at xhigh and high only; its base row is the xhigh one.
+PROVEN["grok/grok-4-7"] = ("cli_reasoning_effort", "grok-4.7", "gk-grok-4_7-xhigh")
+PROVEN["grok/grok-4-7-high"] = ("cli_reasoning_effort", "grok-4.7", "gk-grok-4_7-high")
 
 for cid, rid, ev in [
     ("gemini/gemini-3-8-flash", "gemini-3.8-flash-high", "agy-gemini-3_8-flash-high"),
@@ -81,6 +84,12 @@ for cid, model in [("claude/claude-sonnet-5", "claude-sonnet-5"),
                    ("claude/claude-opus-4-6-adaptive", "claude-opus-4-6"),
                    ("claude/claude-sonnet-4-6-adaptive", "claude-sonnet-4-6")]:
     PROVEN[cid] = ("model_and_effort", model, f"cl-{model}-max")
+# Targets resolve on vendor/model/effort alone, so claude-sonnet-5-non-reasoning
+# (also effort high) must never be listed here: two verified rows at one
+# selector make every sonnet-5 high dispatch ambiguous-runtime-mapping.
+for effort in ["xhigh", "high", "medium", "low"]:
+    PROVEN[f"claude/claude-sonnet-5-{effort}"] = (
+        "model_and_effort", "claude-sonnet-5", f"cl-claude-sonnet-5-{effort}")
 
 # Fable is listed so its failures reach unproven[] rather than vanishing. Its
 # probes were refused for quota on 2026-09-07 and again on 2026-09-09; the

package/scripts/lib/probe_sweep.py

@@ -92,11 +92,22 @@ def _text(record: dict) -> str:
 
 
 def sweep(vendor: str, root: Path, *, repo: Path = build_overlay.REPO, home: Path | None = None,
-          run_probe=probe_module.probe, manager=session_manager, log=print) -> dict:
-    """Probe one vendor into root/evidence. Never raises for a probe that merely failed."""
+          run_probe=probe_module.probe, manager=session_manager, log=print,
+          only_missing: bool = False) -> dict:
+    """Probe one vendor into root/evidence. Never raises for a probe that merely failed.
+
+    only_missing probes just the rows root/evidence has no record for: the
+    executable is unchanged, so what it already answered still stands.
+    """
     home = home or Path.home()
     entries = plan(vendor)
     report = {"vendor": vendor, "outcome": "done", "passed": [], "failed": [], "detail": ""}
+    if only_missing:
+        entries = [entry for entry in entries
+                   if not (root / "evidence" / f"{entry['name']}.json").is_file()]
+        if not entries:
+            report["detail"] = "every row already has probe evidence"
+            return report
     if (vendor in KEYCHAIN_VENDORS and sys.platform == "darwin"
             and os.environ.get("OMNILANE_PROBE_ANY_SESSION") != "1"):
         name = manager()
@@ -148,7 +159,9 @@ def sweep(vendor: str, root: Path, *, repo: Path = build_overlay.REPO, home: Pat
             return report
         report["failed"].append(entry["config_id"])
         log(f"{entry['name']} fail {str(record.get('verdict_reason'))[:120]}")
-    if not report["passed"]:
+    # With only_missing the rows not re-probed still hold, so a new row that
+    # fails is a finding about that row, not about the vendor.
+    if not report["passed"] and not only_missing:
         report.update(outcome="failed", detail="no selector of this vendor passed")
     return report
 

package/scripts/lib/resign.py

@@ -61,6 +61,7 @@ def current_anchors() -> dict[str, dict[str, Path]]:
 def detect(overlay: dict, anchors: dict[str, dict[str, Path]]) -> dict[str, dict]:
     """Per vendor: what no longer matches the live overlay, and the signer it recorded."""
     report = {}
+    registry_snapshot = build_overlay.REGISTRY["snapshot"]["id"]
     for vendor in VENDORS:
         recorded = [entry for entry in overlay.get("evidence", []) if entry.get("vendor") == vendor]
         runner_name = build_overlay.RUNNERS[vendor]
@@ -81,11 +82,19 @@ def detect(overlay: dict, anchors: dict[str, dict[str, Path]]) -> dict[str, dict
             reasons.append(f"{runner_name} is not pinned")
         elif sha256(runner) != recorded_runner["sha256"]:
             reasons.append(f"{runner_name} changed")
+        cli_changed = any(runner_name not in reason for reason in reasons)
+        # The overlay is bound to one registry snapshot and dispatch refuses any
+        # other, so a re-scored registry strands a host whose CLIs never moved.
+        snapshot_only = not reasons and overlay.get("snapshot_id") != registry_snapshot
+        if overlay.get("snapshot_id") != registry_snapshot:
+            reasons.append(f"the score registry moved from {overlay.get('snapshot_id')} "
+                           f"to {registry_snapshot}")
         report[vendor] = {
             "drifted": bool(reasons),
             "reasons": reasons,
+            "snapshot_only": snapshot_only,
             "cli": str(cli) if cli else None,
-            "cli_changed": any(runner_name not in reason for reason in reasons),
+            "cli_changed": cli_changed,
             "recorded_cli_path": recorded_cli["path"] if recorded_cli else None,
             "recorded_codesign": recorded_signer(recorded_cli),
         }
@@ -105,6 +114,8 @@ def recorded_signer(entry: dict | None) -> dict | None:
 def gate(vendor_report: dict, approved: bool) -> tuple[bool, str]:
     if not vendor_report["cli"]:
         return False, "the CLI is not installed"
+    if vendor_report.get("snapshot_only"):
+        return True, "only the score registry changed; existing probe evidence is reused"
     if not vendor_report["cli_changed"]:
         return True, "only omnilane's own runner script changed"
     current = cli_provenance.facts(vendor_report["cli"])
@@ -339,7 +350,9 @@ def resign(args, log=print) -> int:
         root.mkdir(parents=True)
         shutil.copytree(source / "evidence", root / "evidence")
         shutil.copy2(live, root / "live-overlay.BEFORE.json")
-        sweeps = {vendor: probe_sweep.sweep(vendor, root, log=log) for vendor in proceed}
+        sweeps = {vendor: probe_sweep.sweep(vendor, root, log=log,
+                                            only_missing=report[vendor]["snapshot_only"])
+                  for vendor in proceed}
         summary["sweeps"] = sweeps
         unfinished = [vendor for vendor, result in sweeps.items() if result["outcome"] != "done"]
         for vendor in unfinished:
@@ -393,7 +406,12 @@ def resign(args, log=print) -> int:
                     staged["evidence"][index] = old
         staged_path.write_text(json.dumps(staged, indent=2, ensure_ascii=False) + "\n")
         try:
-            before, after = verified(live), verified(staged_path)
+            if overlay.get("snapshot_id") == staged["snapshot_id"]:
+                before = verified(live)
+            else:
+                # Bound to another registry snapshot, the live overlay does not load at all.
+                before = {vendor: 0 for vendor in VENDORS}
+            after = verified(staged_path)
         except (aa_policy.PolicyError, OSError, ValueError) as error:
             log(f"omnilane: the staged overlay does not load ({error}); live overlay untouched")
             return EXIT_ROLLED_BACK