opencode-thrum-pro 0.1.5 → 0.1.6

package/assets/commands/thrum-sleep-extended.md

@@ -30,12 +30,16 @@ to sleep until the operator wakes it later. Same termination semantics as
 ```bash
 # Resolve identity + your worktree (needed before reading the partial).
 # $REPO must be YOUR worktree — the directory `thrum prime` reads the restart
-# snapshot back from. Resolve it from the daemon's authoritative identity, NOT
-# `git rev-parse` (which keys off the current shell CWD and would write to the
-# wrong .thrum/restart/ if a bash step left your worktree). Fall back to git
-# only if whoami can't answer.
-REPO=$(thrum whoami --field worktree 2>/dev/null)
-[ -n "$REPO" ] || REPO=$(git rev-parse --show-toplevel) || { echo "ERROR: cannot resolve your worktree"; exit 1; }
+# snapshot back from. Resolve it ONLY via the daemon's authoritative,
+# peercred-resolved identity (`thrum agent worktree --authoritative`) — NEVER
+# via `thrum whoami --field worktree` or `git rev-parse --show-toplevel`
+# (both cwd-resolved). A cwd-derived pattern could silently
+# resolve to a DIFFERENT agent's worktree, or the main repo. There is NO git
+# fallback — if the daemon can't answer, refuse and stop rather than guess.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
 AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
 [ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
 mkdir -p "${REPO}/.thrum/restart"
@@ -76,44 +80,43 @@ Per Step 3 of the partial, use the Write tool to save your composed continuation
 to `${REPO}/.thrum/restart/${AGENT}.md`. On next boot, `thrum prime`
 auto-injects this file — same mechanism as restart wake.
 
-### 4. Back up important files to your durable agents folder (survives worktree teardown)
+### 4. Back up OTHER important artifacts to your durable agents folder (survives worktree teardown)
 
-**Your worktree may be torn down while you sleep — and if it is, YOUR SNAPSHOT
-GOES WITH IT unless you do this step.**
+**Your restart snapshot itself no longer needs this step.** Step 6
+(`thrum agent sleep`) now relocates `<worktree>/.thrum/restart/<agent-id>.md`
+to the canonical `<main-repo>/.thrum/agents/<agent-id>/sessions/<ts>-restart.md`
+synchronously, BEFORE it kills your pane — that is the fix for the bug this
+step used to exist to work around (the snapshot previously was archived only
+at your NEXT WAKE, so a worktree reap between sleep and wake destroyed it
+permanently with no warning).
 
 🔴 **READ THIS CAREFULLY.** A worktree's `.thrum/` is a REAL LOCAL DIRECTORY. The
 `redirect` inside it is just a plain text FILE containing a path — a pointer
 thrum's code consults. The filesystem redirects nothing. Your worktree keeps its
 own local `agents/`, `context/`, `identities/`, and `restart/`.
 
-**THE ACTUAL MECHANISM:** your snapshot at `<worktree>/.thrum/restart/<agent-id>.md`
-is **worktree-local**. It is copied into the main repo **only when you WAKE** —
-`thrum prime` reads it from the worktree and archives it to
-`<main-repo>/.thrum/agents/<agent-id>/sessions/`. **Then and only then.** So a
-teardown that happens BEFORE your wake destroys the snapshot, permanently, and
-nothing warns you. This matters more for an extended snapshot: you are parking
-wire contracts, a capability matrix, and design rationale that are expensive to
-reconstruct and exist nowhere else.
-
-**Leave the snapshot where it is** — `thrum prime` reads it from the worktree on
-wake, so that path is correct and required. **Additionally**, copy anything you
-need to survive teardown to the MAIN REPO PATH, resolved explicitly:
+**What THIS step is still for:** anything OTHER than the restart snapshot that
+you need to survive a worktree teardown while parked — reports / findings you
+authored, important uncommitted artifacts, and anything your resume plan
+references. This matters more for an extended snapshot: you are parking wire
+contracts, a capability matrix, and design rationale that are expensive to
+reconstruct and exist nowhere else — but that content lives IN the snapshot
+itself, which Step 6 already relocates; use this step for anything ELSE.
+Copy those to the MAIN REPO PATH, resolved explicitly:
 
 ```bash
 # Resolve the main repo's .thrum from the redirect FILE (do not assume a path).
-MAIN_THRUM=$(cat "${REPO}/.thrum/redirect" 2>/dev/null) || MAIN_THRUM="${REPO}/.thrum"
+MAIN_THRUM=$(
+  cat "${REPO}/.thrum/redirect" 2>/dev/null
+) || MAIN_THRUM="${REPO}/.thrum"
 mkdir -p "${MAIN_THRUM}/agents/${AGENT}"
-cp "${REPO}/.thrum/restart/${AGENT}.md" "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"
-# ...and any other artifact you need on wake.
-ls -la "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"   # VERIFY IT LANDED
+cp <artifact> "${MAIN_THRUM}/agents/${AGENT}/<name>"
+ls -la "${MAIN_THRUM}/agents/${AGENT}/<name>"   # VERIFY IT LANDED
 ```
 
-Copy there: reports / findings you authored, important uncommitted artifacts, and
-anything your resume plan references.
-
-**VERIFY THE COPY EXISTS AT THE MAIN PATH before ending your session.** Do not
-trust `cp`'s exit code — list the destination file. This step is your ONLY
-recoverability guarantee against teardown-while-asleep; the redirect is not one.
+If you have nothing beyond the restart snapshot to preserve, this step is a
+no-op — proceed to Step 5. Do not trust `cp`'s exit code for anything you do
+copy — list the destination file to confirm it landed.
 
 ### 5. Mark agent operational status idle
 
@@ -121,29 +124,47 @@ recoverability guarantee against teardown-while-asleep; the redirect is not one.
 thrum agent set-status idle
 ```
 
-`idle` is the signal that this agent has parked. NO new "sleeping" state was
-added — `idle` covers both "no active work" and "parked for operator wake."
+`idle` is the operational/presence-status signal, separate from the durable
+`agents.phase` field. Step 6 (`thrum agent sleep`) is what transitions phase
+to `sleeping` — a real, distinct phase, not folded into `idle`. This step
+only covers the lighter-weight status field.
 
 If `thrum agent set-status` returns an error, continue to Step 6 — the snapshot
 on disk is the load-bearing artifact.
 
-### 6. End session cleanly
-
-```bash
-thrum session end
-```
-
-This emits `agent.session.end` cleanly so the dead-agent sweeper does NOT treat
-the disconnect as a crash.
-
-### 7. Kill own tmux session
+### 6. Sleep the agent (relocate snapshot, teardown, phase transition)
 
 ```bash
-thrum tmux kill "$SESSION"
+thrum agent sleep --agent "$AGENT"
 ```
 
-Tmux pane terminates → runtime process exits → no further activity until
-operator wakes the agent.
+This calls the daemon's `agent.sleep` RPC (CLI alias `park`), which runs the
+full park ceremony in the correct order: it relocates your snapshot from the
+worktree-local `.thrum/restart/` into the canonical
+`agents/<id>/sessions/` directory, *then* kills your own tmux session, *then*
+writes the `agent.phase.transition {to: "sleeping"}` event. This is the fix
+for the bug a raw `thrum session end` + `thrum tmux kill` sequence had: it
+killed the pane before the snapshot was ever relocated (permanent data-loss
+risk if the worktree was reaped first) and left the roster row reading
+`active` after the pane was already gone — a "ghost-active" agent.
+
+**Critical: the daemon kills YOUR OWN pane mid-call, as part of this same
+RPC's teardown stage.** A successful self-park is therefore observed, from
+inside this pane, as the CLI call's transport dying — connection reset, EOF,
+or broken pipe — NOT a clean JSON response; the pane is gone before a
+response can reach it. **Do not retry** `thrum agent sleep` on transport
+loss after dispatch, and **do not treat transport loss as a failure.** It is
+the expected signal that self-park succeeded. A real failure (a gate,
+relocation, or teardown error) is signaled by the RPC returning an explicit
+error message BEFORE the pane dies — that is the only failure signal
+observable from inside this pane. If independent confirmation is needed, it
+must come from a DIFFERENT caller (this pane will be gone) checking
+`thrum agent list` / `thrum team list` afterward.
+
+**Do not fall back to a raw `tmux kill-session`.** A raw kill bypasses
+`agent.sleep`'s relocate-before-kill ordering and daemon bookkeeping
+entirely — reintroducing the exact data-loss and ghost-active bug this
+ceremony exists to close.
 
 ## How wake works
 

package/assets/commands/thrum-sleep.md

@@ -34,12 +34,16 @@ should bring you back in-place, use `/thrum:restart` instead.
 ```bash
 # Resolve identity + your worktree (needed before reading the partial).
 # $REPO must be YOUR worktree — the directory `thrum prime` reads the restart
-# snapshot back from. Resolve it from the daemon's authoritative identity, NOT
-# `git rev-parse` (which keys off the current shell CWD and would write to the
-# wrong .thrum/restart/ if a bash step left your worktree). Fall back to git
-# only if whoami can't answer.
-REPO=$(thrum whoami --field worktree 2>/dev/null)
-[ -n "$REPO" ] || REPO=$(git rev-parse --show-toplevel) || { echo "ERROR: cannot resolve your worktree"; exit 1; }
+# snapshot back from. Resolve it ONLY via the daemon's authoritative,
+# peercred-resolved identity (`thrum agent worktree --authoritative`) — NEVER
+# via `thrum whoami --field worktree` or `git rev-parse --show-toplevel`
+# (both cwd-resolved). A cwd-derived pattern could silently
+# resolve to a DIFFERENT agent's worktree, or the main repo. There is NO git
+# fallback — if the daemon can't answer, refuse and stop rather than guess.
+REPO=$(
+  thrum agent worktree --authoritative 2>/dev/null
+) || { echo "ERROR: cannot authoritatively resolve your worktree via the daemon. Refusing to fall back to cwd/git-toplevel — that would risk silently saving this snapshot to the wrong repo. Check daemon connectivity and retry."; exit 1; }
+[ -n "$REPO" ] || { echo "ERROR: thrum agent worktree --authoritative returned empty"; exit 1; }
 AGENT=$(thrum whoami --field agent_id) || { echo "ERROR: agent not registered"; exit 1; }
 [ -n "$AGENT" ] || { echo "ERROR: empty agent_id"; exit 1; }
 mkdir -p "${REPO}/.thrum/restart"
@@ -80,42 +84,39 @@ Per Step 3 of the partial, use the Write tool to save your composed continuation
 to `${REPO}/.thrum/restart/${AGENT}.md`. On next boot, `thrum prime`
 auto-injects this file — same mechanism as restart wake.
 
-### 4. Back up important files to your durable agents folder (survives worktree teardown)
+### 4. Back up OTHER important artifacts to your durable agents folder (survives worktree teardown)
 
-**Your worktree may be torn down while you sleep — and if it is, YOUR SNAPSHOT
-GOES WITH IT unless you do this step.**
+**Your restart snapshot itself no longer needs this step.** Step 6
+(`thrum agent sleep`) now relocates `<worktree>/.thrum/restart/<agent-id>.md`
+to the canonical `<main-repo>/.thrum/agents/<agent-id>/sessions/<ts>-restart.md`
+synchronously, BEFORE it kills your pane — that is the fix for the bug this
+step used to exist to work around (the snapshot previously was archived only
+at your NEXT WAKE, so a worktree reap between sleep and wake destroyed it
+permanently with no warning).
 
 🔴 **READ THIS CAREFULLY.** A worktree's `.thrum/` is a REAL LOCAL DIRECTORY. The
 `redirect` inside it is just a plain text FILE containing a path — a pointer
 thrum's code consults. The filesystem redirects nothing. Your worktree keeps its
 own local `agents/`, `context/`, `identities/`, and `restart/`.
 
-**THE ACTUAL MECHANISM:** your snapshot at `<worktree>/.thrum/restart/<agent-id>.md`
-is **worktree-local**. It is copied into the main repo **only when you WAKE** —
-`thrum prime` reads it from the worktree and archives it to
-`<main-repo>/.thrum/agents/<agent-id>/sessions/`. **Then and only then.** So a
-teardown that happens BEFORE your wake destroys the snapshot, permanently, and
-nothing warns you.
-
-**Leave the snapshot where it is** — `thrum prime` reads it from the worktree on
-wake, so that path is correct and required. **Additionally**, copy anything you
-need to survive teardown to the MAIN REPO PATH, resolved explicitly:
+**What THIS step is still for:** anything OTHER than the restart snapshot that
+you need to survive a worktree teardown while parked — reports / findings you
+authored, important uncommitted artifacts, and anything your resume plan
+references. Copy those to the MAIN REPO PATH, resolved explicitly:
 
 ```bash
 # Resolve the main repo's .thrum from the redirect FILE (do not assume a path).
-MAIN_THRUM=$(cat "${REPO}/.thrum/redirect" 2>/dev/null) || MAIN_THRUM="${REPO}/.thrum"
+MAIN_THRUM=$(
+  cat "${REPO}/.thrum/redirect" 2>/dev/null
+) || MAIN_THRUM="${REPO}/.thrum"
 mkdir -p "${MAIN_THRUM}/agents/${AGENT}"
-cp "${REPO}/.thrum/restart/${AGENT}.md" "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"
-# ...and any other artifact you need on wake.
-ls -la "${MAIN_THRUM}/agents/${AGENT}/last-sleep-snapshot.md"   # VERIFY IT LANDED
+cp <artifact> "${MAIN_THRUM}/agents/${AGENT}/<name>"
+ls -la "${MAIN_THRUM}/agents/${AGENT}/<name>"   # VERIFY IT LANDED
 ```
 
-Copy there: reports / findings you authored, important uncommitted artifacts, and
-anything your resume plan references.
-
-**VERIFY THE COPY EXISTS AT THE MAIN PATH before ending your session.** Do not
-trust `cp`'s exit code — list the destination file. This step is your ONLY
-recoverability guarantee against teardown-while-asleep; the redirect is not one.
+If you have nothing beyond the restart snapshot to preserve, this step is a
+no-op — proceed to Step 5. Do not trust `cp`'s exit code for anything you do
+copy — list the destination file to confirm it landed.
 
 ### 5. Mark agent operational status idle
 
@@ -123,41 +124,48 @@ recoverability guarantee against teardown-while-asleep; the redirect is not one.
 thrum agent set-status idle
 ```
 
-`idle` is the signal that this agent has parked. NO new "sleeping" state was
-added — `idle` covers both "no active work" and "parked for operator wake."
+`idle` is the operational/presence-status signal, separate from the durable
+`agents.phase` field. Step 6 (`thrum agent sleep`) is what transitions phase
+to `sleeping` — a real, distinct phase, not folded into `idle`. This step
+only covers the lighter-weight status field.
 
 If `thrum agent set-status` returns an error (e.g. rate-limited), continue to
 Step 6 — the snapshot on disk is the load-bearing artifact, not the status
 field. The operator can set status post-wake.
 
-### 6. End session cleanly
+### 6. Sleep the agent (relocate snapshot, teardown, phase transition)
 
 ```bash
-thrum session end
+thrum agent sleep --agent "$AGENT"
 ```
 
-This emits an `agent.session.end` event cleanly so the dead-agent sweeper does
-NOT later treat the disconnect as a crash. If `thrum session end` fails,
-continue to Step 7.
-
-### 7. Kill own tmux session
-
-```bash
-thrum tmux kill "$SESSION"
-```
-
-Tmux pane terminates → runtime process exits → no further activity until
-operator wakes the agent via `thrum tmux create <session-name>`.
-
-**If Step 7 fails with "anonymous caller cannot invoke":** `thrum session end`
-(Step 6) severs the daemon binding, so `thrum tmux kill` may be rejected if the
-daemon hasn't yet processed the CallerWorktree self-kill path. Use the raw tmux
-fallback — the lifecycle safeguards (snapshot, status idle, session end) were
-already discharged by Steps 1-6, so nothing is lost:
-
-```bash
-tmux kill-session -t "$SESSION"
-```
+This calls the daemon's `agent.sleep` RPC (CLI alias `park`), which runs the
+full park ceremony in the correct order: it relocates your snapshot from the
+worktree-local `.thrum/restart/` into the canonical
+`agents/<id>/sessions/` directory, *then* kills your own tmux session, *then*
+writes the `agent.phase.transition {to: "sleeping"}` event. This is the fix
+for the bug a raw `thrum session end` + `thrum tmux kill` sequence had: it
+killed the pane before the snapshot was ever relocated (permanent data-loss
+risk if the worktree was reaped first) and left the roster row reading
+`active` after the pane was already gone — a "ghost-active" agent.
+
+**Critical: the daemon kills YOUR OWN pane mid-call, as part of this same
+RPC's teardown stage.** A successful self-park is therefore observed, from
+inside this pane, as the CLI call's transport dying — connection reset, EOF,
+or broken pipe — NOT a clean JSON response; the pane is gone before a
+response can reach it. **Do not retry** `thrum agent sleep` on transport
+loss after dispatch, and **do not treat transport loss as a failure.** It is
+the expected signal that self-park succeeded. A real failure (a gate,
+relocation, or teardown error) is signaled by the RPC returning an explicit
+error message BEFORE the pane dies — that is the only failure signal
+observable from inside this pane. If independent confirmation is needed, it
+must come from a DIFFERENT caller (this pane will be gone) checking
+`thrum agent list` / `thrum team list` afterward.
+
+**Do not fall back to a raw `tmux kill-session`.** A raw kill bypasses
+`agent.sleep`'s relocate-before-kill ordering and daemon bookkeeping
+entirely — reintroducing the exact data-loss and ghost-active bug this
+ceremony exists to close.
 
 ## How wake works
 
@@ -207,6 +215,7 @@ resumable via Claude Code's native session-continuation mechanism.
 
 ## Programmatic use (operator shutdown scripts)
 
-The underlying mechanic — write snapshot + set status idle + session end + tmux
-kill — can be invoked from an operator's shutdown script directly via the bash
-commands above (without going through the skill).
+The underlying mechanic — write snapshot + set status idle + `thrum agent sleep`
+(relocate + teardown + phase transition) — can be invoked from an operator's
+shutdown script directly via the bash commands above (without going through
+the skill).

package/assets/skills/adversarial-critique/SKILL.md

@@ -54,14 +54,11 @@ Pre-assembled context is the difference between a real debate and a shallow one.
 
 ## The three rounds
 
-> **Model tiers:** pass an explicit `model:` on every dispatch — `sonnet`
-> (low effort) mechanical, `sonnet` (medium effort) judgment, Opus only on
-> operator-ask or a skill step that names it. See the
-> `choosing-subagent-models` skill for the full policy.
+> **Model tiers:** pass an explicit `model:` on every dispatch; choose model and effort per the `choosing-subagent-models` skill (read `runtime.role_models` at the moment of use). Never let a sub-agent inherit your own model.
 
 Dispatch one sub-agent per option, in parallel (single message, multiple Agent
-tool calls). `model: "sonnet"` for all dispatches — quality matches Opus on
-structured critique at a fraction of the cost.
+tool calls). `model: <per choosing-subagent-models>` for all dispatches — a cheaper tier
+matches a costly one on structured critique at a fraction of the cost.
 
 ### Round 1 — opening positions
 
@@ -221,9 +218,9 @@ the working plan/context in an actionable shape:
 
 ## Model and cost
 
-Sonnet for all dispatches. See `~/.claude/CLAUDE.md § Sub-Agent Model Selection`
+Model per `choosing-subagent-models` for all dispatches. See `~/.claude/CLAUDE.md § Sub-Agent Model Selection`
 — the project-wide rule that every `Agent` dispatch must pass `model` explicitly
-(never inherit parent Opus by default). Roughly ~100k tokens for 2 options,
+(never inherit your own model by default). Roughly ~100k tokens for 2 options,
 ~150k for 3 options. This is an investment that buys a reviewer-ready decision
 an implementer can execute in a fresh session without re-hashing the design.
 

package/assets/skills/brainstorm-steward/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: brainstorm-steward
-description: "Use when running as the Brainstorm Steward — a persistent watcher on the coordinator's home box that manages a roster of remote brainstormers, multiplexes their NEED questions into one pane queue for the owner, routes ANSWERs back, and delegates launch and dual-review/project-setup to coordinators. Never decides content."
+description: "Use when running as the Brainstorm Steward — a persistent watcher on the coordinator's home box that manages a roster of remote brainstormers, multiplexes their NEED questions into one pane queue for the owner, routes ANSWERs back, and delegates launch and dual-review approval to coordinators (the brainstormer runs its own project-setup after approval). Never decides content."
 ---
 
 # Brainstorm Steward
@@ -10,8 +10,9 @@ set of remote brainstormer agents rather than implementers or coordinators.
 Your job is to keep the owner from having to hold N brainstorm threads open
 at once: you multiplex every brainstormer's pending question into a single
 queue in your own pane, relay the owner's answer back to the right
-brainstormer, and hand off the mechanical parts (launch, review, project
-setup) to coordinators. **You never decide content.** You route.
+brainstormer, and hand off the mechanical parts (launch, dual-review
+approval) to coordinators. The brainstormer then runs its own project
+setup. **You never decide content.** You route.
 
 ## You are a persistent watcher
 
@@ -27,9 +28,29 @@ to that coordinator). Everything below is additive — the brainstorm-specific
 duties layered on top of that base.
 
 Your roster is entirely remote (other boxes), so the base skill's remote
-modal-unblock note applies to every roster member by default — use
-`thrum tmux send` (peer-routed, works fleet-wide); the local-only
-tmux-key primitive it replaces is retired.
+modal-unblock note applies to every roster member by default — cross-peer
+send-keys is refused by design, so you cannot `thrum tmux send` into a
+roster member's pane yourself; route the unblock to that box's local
+coordinator instead.
+
+## Available skills (situational — you MUST invoke when triggered)
+
+These skills deepen role discipline for specific situations. They do NOT
+auto-load — when a trigger condition below applies, you MUST invoke the
+matching skill via the Skill tool BEFORE taking action.
+
+- `agent-messaging-protocol` — forwarding or relaying information between
+  parties, routing an owner answer, carrying a decision or request through an
+  intermediary, summarizing another author's message, or adding
+  interpretation to someone else's words
+- `brainstormer-staying-current` — the safe way to merge forward: a
+  long-lived worktree may be behind its configured merge target, before
+  review or handoff, or when asked to merge-forward and leave the worktree
+  clean
+- `conversation-only-context` — at the START of any long-lived session, when
+  told you'll have a long conversation or get a lot done, when context is
+  climbing, when several investigations are in flight, or before reading code
+  or a multi-file doc set to investigate
 
 ## Roster = brainstormers
 
@@ -77,7 +98,7 @@ thread:
   that skill's "Driving your cycle" section for the setup-copy step and the
   exact `thrum monitor start` registration — **`--notify-on-success` is
   mandatory there too**, for the identical reason: a `--schedule`d job
-  delivers nothing on `--match` alone (thrum-ruz1z §5c).
+  delivers nothing on `--match` alone.
 
 ## The queue (your pane console)
 
@@ -98,6 +119,23 @@ convention doc) via `thrum reply <need-message-id> --stdin` addressed to the
 original NEED message, in the owner's own words. Once relayed, drop the item
 from your queue and surface the next.
 
+## Dashboard board (rehearsal-only today — see gate below)
+
+<!-- DASHBOARD-SHIP-GATE: the paragraph below is AWARENESS-safe now, but the
+     USE-mandate (publish the NEED queue as a dashboard board) activates only
+     when the web UI Dashboard tab (E3) AND the answer round-trip (E4) are
+     actually DEPLOYED, not merely landed on trunk — per `using-the-dashboard`'s
+     honesty table, publishing today is still a no-op for the human on any box
+     running a pre-E3/pre-E4 binary. Re-check that table before flipping this
+     to a mandate. -->
+Your pane console above is the mechanism today. `using-the-dashboard`
+documents an owner-facing board surface for the SAME NEED-multiplexing this
+skill already does — invoke it (with `coordinator-dashboard-human-loop`,
+since a steward is launched coordinator-shaped and inherits that skill too)
+to check what is actually usable before treating a board as a second channel
+for your queue. Until the honesty table's E3+E4 rows read DEPLOYED, keep
+routing owner Q&A through the pane console, not a board.
+
 ## Idle nudge
 
 If items sit in the queue past a threshold (default keyed off your
@@ -128,11 +166,15 @@ while brainstormers run on other boxes. To start a new brainstorm on topic X:
 ## Finish handoff
 
 When a brainstormer reports its design locked and ready to move forward,
-**message a coordinator** to run the dual-review → project-setup flow —
-you do not run either of those yourself; the brainstormer's own
+**message a coordinator to APPROVE it**: the coordinator runs its dual
+review and approves or returns findings. The brainstormer's own
 NEED/ANSWER-driven design-lock process is not a substitute for that
-coordinator-run review. Once the handoff is confirmed and the brainstormer
-is torn down, drop it from your roster.
+coordinator-run review. **On approval, the brainstormer runs its own
+project-setup.** Never ask the coordinator to run project-setup for a
+brainstormer, and do not run either step yourself. Phrase the handoff as
+"approve, then the brainstormer runs project-setup." Once project-setup has
+produced its beads and the brainstormer is torn down, drop it from your
+roster.
 
 ## Context economy (load-bearing)
 
@@ -153,6 +195,18 @@ your entire durable resume state (watcher/parent/model/roster/cadence);
 nothing else needs to survive a restart, because nothing else is
 authoritative.
 
+## Persist state + queue before compacting
+
+Before running `/thrum:compact` or `/thrum:compact-extended`, first persist
+your load-bearing context to the durable store — it survives compaction;
+your conversation context does not. Update your personal state
+(`thrum state set --kind personal_state ...` — see the `using-thrum-state`
+skill) and your committed work (`thrum queue` — see the `using-the-queue`
+skill) BEFORE composing your snapshot. This is distinct from the restart
+recovery above (compaction keeps your daemon binding and live session
+intact, unlike a restart) but the same durable stores are what a
+post-compact render reads back.
+
 ## Keep the pipeline flowing (stalled-handoff detection)
 
 Beyond the owner-facing queue, track when a roster brainstormer is

package/assets/skills/brainstormer-staying-current/SKILL.md

@@ -21,10 +21,7 @@ Locate the canonical config from the current worktree:
 
 ```bash
 CONFIG=.thrum/config.json
-if [ ! -f "$CONFIG" ]; then
-  COMMON_DIR=$(git rev-parse --path-format=absolute --git-common-dir)
-  CONFIG="${COMMON_DIR%/.git}/.thrum/config.json"
-fi
+[ -f .thrum/redirect ] && CONFIG="$(cat .thrum/redirect)/config.json"
 test -f "$CONFIG"
 TARGET=$(jq -er '.orchestration.merge_target | select(type == "string" and length > 0)' "$CONFIG")
 MERGE_KING=$(jq -r --arg target "$TARGET" '.orchestration.merge_kings[$target] // "unset"' "$CONFIG")

package/assets/skills/choosing-subagent-models/SKILL.md

@@ -22,6 +22,20 @@ mechanical-task carve-out anymore — lint runs, grep-and-collect, file maps,
 config edits, and all other "simple" work now dispatch at sonnet-low, not Haiku.
 Never select Haiku on own judgment — use sonnet-low instead.
 
+### Read the tiers at the moment of use
+
+**Role templates and launch examples do not name models or effort levels; this
+skill and the live config do.** Read the tier when you are about to spawn or
+launch, never from memory or from a copied example:
+
+```bash
+jq -r '.runtime.role_models' .thrum/config.json
+```
+
+Launching with `--role` and no `--model` resolves the role default
+automatically. A `--model` / `--effort` flag in a launch command takes its value
+from `runtime.role_models` for the target role, per this skill.
+
 ### Agent tiers
 
 Effort tier governs whether an agent does the hard thing or the expedient thing.

package/assets/skills/conversation-only-context/SKILL.md

@@ -62,7 +62,7 @@ Workflow `agent()` opts, agent-definition frontmatter, `thrum tmux launch
 ```python
 Agent(subagent_type="general-purpose",
       name="<prefix>_<slug>",
-      model="sonnet",
+      model="<per choosing-subagent-models>",
       description="<3-5 words>",
       prompt="""<task>
 
@@ -92,14 +92,14 @@ to fire-and-forget monitors, not to a named agent you re-message.
 
 | Subagent role | Name prefix | Model / effort (effort only where exposed) | Result file |
 |---|---|---|---|
-| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | `sonnet` / low | `<scratch>/<name>.md` |
-| Root-cause | `<bead>_rc` | `sonnet` / low | `<scratch>/<bead>-rc.md` |
-| Verifier, reviewer, design-verify | `<bead>_verify` | `sonnet` / medium | `<scratch>/<bead>-verify.md` |
-| Implementer | `impl_<slug>` | `sonnet` / medium | `<scratch>/<slug>-impl.md` |
-| VM driver | `vmdriver_<slug>` | `sonnet` / medium | `<scratch>/<slug>-vm.md` |
-| Prose or deep review | any | `opus` — **only when the operator asks** | as above |
+| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | per `choosing-subagent-models` | `<scratch>/<name>.md` |
+| Root-cause | `<bead>_rc` | per `choosing-subagent-models` | `<scratch>/<bead>-rc.md` |
+| Verifier, reviewer, design-verify | `<bead>_verify` | per `choosing-subagent-models` | `<scratch>/<bead>-verify.md` |
+| Implementer | `impl_<slug>` | per `choosing-subagent-models` | `<scratch>/<slug>-impl.md` |
+| VM driver | `vmdriver_<slug>` | per `choosing-subagent-models` | `<scratch>/<slug>-vm.md` |
+| Prose or deep review | any | per `choosing-subagent-models` — **only when the operator asks** | as above |
 
-Haiku is banned. Opus is never yours to grant onward.
+The model ban list lives in `choosing-subagent-models`. A costly tier is never yours to grant onward.
 
 ### CONSTRAINTS block — paste verbatim into every dispatch
 
@@ -111,8 +111,8 @@ Haiku is banned. Opus is never yours to grant onward.
   tool's own guidance suggests it. It trips a permission modal, and A FROZEN
   PANE EMITS NOTHING, so nobody can tell you are blocked. If you must background
   work, wait for the completion notification.
-- Every sub-agent YOU spawn gets an explicit `model:` — sonnet (low mechanical,
-  medium judgment). HAIKU IS BANNED. Opus is never yours.
+- Every sub-agent YOU spawn gets an explicit `model:` chosen per `choosing-subagent-models`
+  (read `runtime.role_models`). The model ban list lives there. A costly tier is never yours.
 - READ-ONLY git outside your own worktree. NEVER `checkout`/`reset`/`restore`/
   `stash`/`clean` in ANY directory — `stash` is one shared stack across all
   worktrees and the shared tree holds live agents' uncommitted state.
@@ -186,7 +186,7 @@ Restart on a number read from the pane footer, never on a felt sense.
 - The parent reading code or docs "to just check quickly" — message the subagent that already read them and ask for the one field.
 - One subagent handed ten tasks — partition it and dispatch the parts in parallel.
 - A spawn with no `name:` — it cannot be re-messaged. Name every spawn.
-- A spawn with no `model:` — it silently inherits Opus. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
+- A spawn with no `model:` — it silently inherits your own model. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
 - Holding a design-gating answer behind the rest of the pass while an implementer builds on the old premise — that one goes immediately; the rest ships as one consolidated message.
 - Acting on the resume plan alone and skipping the middle of the prime — the falsified premise sits in the part you skipped.
 - Trusting an older "not started" message over a newer "already running" one — verify, do not recall; that cuts both directions.

package/assets/skills/conversation-only-context/resources/driver-subagent-pattern.md

@@ -21,7 +21,7 @@ findings, and its troubleshooting state across rounds.
 
 Do this:
 
-1. `Agent(name: "vmdriver_<slug>", model: "sonnet", prompt: <round-1 GO>)`.
+1. `Agent(name: "vmdriver_<slug>", model: <per choosing-subagent-models>, prompt: <round-1 GO>)`.
 2. Wait for its report.
 3. `SendMessage(to: "vmdriver_<slug>", message: <round-2 GO>)`.
 

package/assets/skills/conversation-only-context/resources/remote-environment-scenarios.md

@@ -10,7 +10,7 @@ sanctions for reaching it.
 
 You want a multi-hour load or soak run and a verdict, not a log.
 
-1. Spawn `vmdriver_<slug>` with `model: "sonnet"`. The GO names the run, the
+1. Spawn `vmdriver_<slug>` with `model: <per choosing-subagent-models>`. The GO names the run, the
    revision under test, and the exact metrics to report.
 2. The driver opens a persistent session with `<your-ssh-wrapper> <remote-host>`,
    starts the run detached, and writes the exit code to its own file.