opencode-thrum-pro 0.1.5 → 0.1.7

package/assets/skills/choosing-subagent-models/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: choosing-subagent-models
-description: "Use when about to launch, spawn, or dispatch a subagent, sub-agent, or parallel agent - including the Agent/Task tool, an Explore agent, fanning out research, or any time you choose a model for a subagent. ALSO fires on every REVIEW dispatch - dispatching a reviewer, a code review, a code-quality review, a spec-compliance review, a dual review, a verify-against-plan or verify-against-source pass, or a merge-gate sub-agent. Reviewer dispatch is the HIGHEST-STAKES judgment-tier spawn and is the one most often done from memory. Enforces the role-based model tiering (opus-low orchestrators, sonnet-medium implementers and reviewers, sonnet-low sub-agents) and cheap parallel fan-out."
+description: "Use when about to launch, spawn, or dispatch a subagent, sub-agent, or parallel agent - including the Agent/Task tool, an Explore agent, fanning out research, or any time you choose a model for a subagent. ALSO fires on every REVIEW dispatch - dispatching a reviewer, a code review, a code-quality review, a spec-compliance review, a dual review, a verify-against-plan or verify-against-source pass, or a merge-gate sub-agent. Reviewer dispatch is the HIGHEST-STAKES judgment-tier spawn and is the one most often done from memory. Enforces role-based model TIERING (mechanical, judgment, orchestration) resolved to a concrete model+effort for whichever runtime you are actually running under, and cheap parallel fan-out."
 ---
 
 # Choosing Subagent Models
@@ -11,50 +11,95 @@ description: "Use when about to launch, spawn, or dispatch a subagent, sub-agent
 (e.g. `/tmp/<task>.md`); its reply to you is only a summary. Put this
 in the prompt.**
 
-## Pin every spawn. The floor depends on the agent's ROLE.
+## Pick a TIER by role/task, then resolve it for YOUR runtime. Pin every spawn.
+
+Model selection here is two steps, always in this order:
+
+1. **Pick the semantic tier** by the spawned agent's role/task — one of three,
+   named identically everywhere in the fleet (Go constants, role templates,
+   this doc): **`mechanical`** (rote/find-replace/grep-and-collect/lint/file-maps —
+   the cheapest tier), **`judgment`** (the default tier for implementers,
+   reviewers, verifiers, researchers — real analysis, not busywork), and
+   **`orchestration`** (orchestrator/coordinator tier — never spawned for a
+   sub-agent, only ever the operator's own agent or a skill that explicitly
+   names it for one step).
+2. **Resolve that tier to a concrete `model:` + `effort:` for the runtime you
+   are actually running under** — via that runtime's own preset
+   (`RuntimePreset.TierModels`) or operator config (`runtime.role_models`);
+   see "Where the tier-model mapping lives" below. Never assume Claude's
+   model names (`sonnet`, `opus`, `haiku`) apply —
+   a Codex or OpenCode agent reading this same file has no such models, and
+   passing one either errors or silently falls back to the runtime's own
+   default (see "Never let an unresolved pin fall through" below).
+
+Every subagent you spawn MUST pass an explicit, resolved `model:` (plus effort
+where the runtime supports it). Omitting it runs the subagent on YOUR model —
+the single biggest avoidable cost leak in agent work.
+
+**The mechanical tier never resolves to a below-floor model, for any runtime.**
+On Claude specifically that means **Haiku is banned entirely** — there is no
+mechanical-task carve-out that reaches for it; lint runs, grep-and-collect,
+file maps, config edits, and all other "simple" work dispatch at the
+mechanical tier's Claude resolution (sonnet-low), not Haiku. Never select
+Haiku on own judgment on Claude — use the mechanical tier's resolved value
+instead. Other runtimes floor at their own mechanical-tier value
+(`RuntimePreset.TierModels`), not at a Claude name.
+
+### Read the tiers at the moment of use
+
+**Role templates and launch examples do not name models or effort levels; this
+skill and the live config do.** Read the tier when you are about to spawn or
+launch, never from memory or from a copied example:
 
-Every subagent you spawn MUST pass an explicit `model:` (plus effort where the
-runtime supports it). Omitting it runs the subagent on YOUR model (Opus) — the
-single biggest avoidable cost leak in agent work.
+```bash
+jq -r '.runtime.role_models' .thrum/config.json
+```
 
-**Haiku is banned entirely.** There is no
-mechanical-task carve-out anymore — lint runs, grep-and-collect, file maps,
-config edits, and all other "simple" work now dispatch at sonnet-low, not Haiku.
-Never select Haiku on own judgment — use sonnet-low instead.
+Launching with `--role` and no `--model` resolves the role default
+automatically. A `--model` / `--effort` flag in a launch command takes its value
+from `runtime.role_models` for the target role, per this skill.
 
 ### Agent tiers
 
 Effort tier governs whether an agent does the hard thing or the expedient thing.
-These are the tiers now:
-
-| Role | Model / Effort |
-| ---------------------------- | ------------------- |
-| **Orchestrator** | **`opus` / low** |
-| **Implementer** | **`sonnet` / medium** |
-| **Verifier / reviewer** | **`sonnet` / medium** |
-| **Sub-agent** (investigation, grep, mechanical) | **`sonnet` / low** |
-
-- **`model: "sonnet"` @ low effort — sub-agents ONLY.** Investigation,
-  grep-and-collect, file maps, lint runs, mechanical tasks. This is the floor for
-  a *sub-agent*, NOT for an implementer or a reviewer.
-- **`model: "sonnet"` @ MEDIUM effort — implementers, verifiers, reviewers.**
-  Not low. A reviewer on low effort is a rubber stamp with extra steps, and
-  rubber-stamped reviews are how a merge gate that ran zero tests survived six
-  sessions.
-- **`model: "opus"` @ low — orchestrators.** Not selectable for sub-agents —
-  set by the operator on the agent's runtime-config.
-- **`model: "opus"` — NOT your call.** Allowed only when (a) the operator
-  explicitly asked for a deep review or prose review in this task, or (b) a
-  skill you are running prescribes Opus for the specific step you are currently
-  executing — NOT for every spawn under that skill. "This research is hard /
-  important" is NOT a justification — hard investigation is exactly what Sonnet
-  is for.
+These are the three tiers, with their Claude-runtime resolution shown as a
+worked example — **if you are running under a different runtime, resolve the
+same tier from your own runtime's preset (`RuntimePreset.TierModels`) or
+`runtime.role_models`, not from the Claude column:**
+
+| Role | Tier | Resolved for Claude (example) |
+| ---------------------------- | ------------- | ------------------- |
+| **Orchestrator / coordinator** | `orchestration` | **`opus` / low** |
+| **Implementer** | `judgment` | **`sonnet` / medium** |
+| **Verifier / reviewer** | `judgment` | **`sonnet` / medium** |
+| **Sub-agent** (investigation, grep, mechanical) | `mechanical` | **`sonnet` / low** |
+
+- **`mechanical` tier (sub-agents ONLY)** — investigation, grep-and-collect,
+  file maps, lint runs, mechanical tasks. Resolves to `sonnet` @ low effort on
+  Claude. This is the floor for a *sub-agent*, NOT for an implementer or a
+  reviewer, and NOT the tier a non-Claude runtime should read as its default.
+- **`judgment` tier (implementers, verifiers, reviewers)** — resolves to
+  `sonnet` @ MEDIUM effort on Claude. Not low. A reviewer on low effort is a
+  rubber stamp with extra steps, and rubber-stamped reviews are how a merge
+  gate that ran zero tests survived six sessions.
+- **`orchestration` tier (orchestrators/coordinators)** — resolves to `opus` @
+  low on Claude. Not selectable for sub-agents — set by the operator on the
+  agent's runtime-config.
+- **`orchestration` tier is NOT your call to spawn.** Allowed only when (a) the
+  operator explicitly asked for a deep review or prose review in this task, or
+  (b) a skill you are running prescribes the orchestration tier for the
+  specific step you are currently executing — NOT for every spawn under that
+  skill. "This research is hard / important" is NOT a justification — hard
+  investigation is exactly what the `judgment` tier is for.
 
 ## Worked examples — LITERAL ARGUMENTS, AND EFFORT IS TOOL-DEPENDENT
 
-**Pin `model` on every spawn. Pass `effort` wherever the mechanism exposes it.**
-Syntax per mechanism — re-check the schema in front of you rather than restating
-from memory, because it can change:
+**Pin `model` on every spawn, using the value your runtime's own preset
+(`RuntimePreset.TierModels`) or `runtime.role_models` resolves the tier to.**
+**Pass
+`effort` wherever the mechanism exposes it** — some mechanisms don't. Syntax per
+mechanism — re-check the schema in front of you rather than restating from
+memory, because it can change:
 
 | Mechanism | `model` | `effort` |
 |---|---|---|
@@ -62,8 +107,14 @@ from memory, because it can change:
 | **Workflow `agent()`** (opts: label, phase, schema, model, effort, isolation, agentType) | ✅ settable | ✅ settable |
 | **Agent DEFINITION** (`.claude/agents/*.md` / plugin `agents/*.md` frontmatter) | ✅ | ✅ — sets the default for that agent type |
 | **`thrum tmux create` / `launch`** | ✅ `--model` | ✅ `--effort` — pass on BOTH |
+| **Other runtimes' own spawn mechanism** | ✅ settable | runtime-dependent — check its own schema |
 
-**Agent tool — `model` only. It takes no `effort` argument.**
+**Below is ONE fully concrete example — what a `judgment`-tier spawn looks
+like once resolved for Claude's own Agent tool (which takes no `effort`
+argument).** It is Claude-specific syntax with a Claude-specific model string;
+if you are running under a different runtime, use that runtime's own spawn
+mechanism and its own resolved model+effort from `RuntimePreset.TierModels` /
+`runtime.role_models` instead of copying this literal string.
 
 ```python
 Agent(subagent_type="general-purpose", model="sonnet",
@@ -71,12 +122,14 @@ Agent(subagent_type="general-purpose", model="sonnet",
       prompt="...")
 ```
 
-**The tier philosophy still governs even where the Agent tool cannot express it:**
-sonnet-low for investigation and mechanical work, sonnet-medium for reviewers,
-verifiers and implementers. Where effort is not settable, carry the intent through
-the agent definition, the Workflow opts, or the tmux launch flags.
+**The tier philosophy still governs even where a mechanism cannot express
+`effort`:** the `model` value alone still must be the tier's resolved value for
+YOUR runtime — never a bare Claude name assumed universal. Where effort is not
+settable, carry the intent through the agent definition, the Workflow opts, or
+the tmux launch flags instead.
 
-An agent definition can also carry a default:
+An agent definition can also carry a default (Claude example — resolve to
+your own runtime's `mechanical`-tier value if you are not Claude):
 
 ```yaml
 # claude-plugin/agents/message-listener.md
@@ -85,53 +138,88 @@ model: sonnet
 effort: low
 ```
 
-**Workflow `agent()` — effort IS a literal argument. Pass it.**
+**Workflow `agent()` — effort IS a literal argument. Pass it, resolved for
+your runtime's tier:**
 
 ```javascript
-agent(prompt, { model: "sonnet", effort: "medium" })          // reviewer / implementer
-agent(prompt, { model: "sonnet", effort: "low" })             // mechanical sub-agent
+agent(prompt, { model, effort })   // `model`/`effort` = your runtime's resolution
+                                    // of the `judgment` tier (reviewer/implementer)
+                                    // or the `mechanical` tier (sub-agent) —
+                                    // resolve via RuntimePreset.TierModels /
+                                    // runtime.role_models for the literal values
 ```
 
-**THE DIRECTIVE, imperative and not a comment: REVIEWERS RUN SONNET AT MEDIUM
-EFFORT.** Pass `effort: "medium"` literally under Workflow, in the agent
-definition, or on `thrum tmux create`/`launch`. Never dispatch a reviewer "from
-memory".
+**THE DIRECTIVE, imperative and not a comment: REVIEWERS RUN THE `judgment`
+TIER, WHICH IS MEDIUM EFFORT ON EVERY RUNTIME THAT HAS AN EFFORT KNOB.** Pass
+the resolved effort literally under Workflow, in the agent definition, or on
+`thrum tmux create`/`launch` (the Agent tool takes no `effort`, so `model`
+alone must still be the `judgment`-tier value there). Never dispatch a
+reviewer "from memory", and never dispatch one at the mechanical tier.
 
 **AND VERIFY, DO NOT ASSERT:** any claim about what a tool does or does not expose
 must be checked against the schema in front of you.
 
-Never select Opus or Haiku on own judgment — use Sonnet, at the floor of
-sonnet-low.
+Never select the `orchestration` tier or a below-floor model on your own
+judgment — use the `judgment` tier's resolved value for your runtime, at the
+floor of that tier's lowest effort.
+
+## Where the tier-model mapping lives
+
+**Do not copy a tier's model string from this doc — read it at the moment of
+use.** The three semantic tiers (`mechanical` / `judgment` / `orchestration`)
+are the same across every runtime; only the concrete model+effort differs per
+runtime, and that mapping lives in exactly two places:
+
+- **The runtime's own preset** (the `TierModels` field of the runtime preset
+  schema) — the machine-checked, per-runtime tier→model
+  table. A runtime with no entry for a tier has no fleet-configured value for
+  it and resolves to nothing rather than inheriting another runtime's model.
+- **`runtime.role_models` in `.thrum/config.json`** — operator configuration
+  for this project, which always outranks the preset's tier table.
 
-## Fleet model-tiering by runtime/role
+**If you are running under Claude**, use the Agent tiers table above
+(orchestrator/implementer/reviewer/sub-agent → orchestration/judgment/
+judgment/mechanical), plus brainstormer → `orchestration` and brainstormer's
+own subagents → `mechanical` (except reviewers, which are always `judgment`).
 
-Different runtimes and roles pin different tiers. Claude tiers are canonical —
-see the Agent tiers table above (orchestrator/implementer/reviewer/sub-agent),
-plus brainstormer → opus-medium and brainstormer's own subagents → sonnet-low
-(except reviewers → sonnet-medium). Other runtimes:
+**If you are running under a different runtime, read your own tier's value
+from the two sources above** — never assume Claude's model names apply, and
+never hard-code a model string you saw once in a doc or a prior session.
 
-| Runtime      | Role                         | Model / effort                                      |
-| ------------ | ---------------------------- | --------------------------------------------------- |
-| OpenCode     | default                      | GLM-5.2 (fine as-is)                                |
-| Codex        | orchestrator / reviewer      | gpt-5.5-medium                                      |
-| Codex        | implementer                  | gpt-5.5-low                                         |
-| Cursor-agent | default                      | composer-2.5 (fine as-is)                           |
+A runtime/role pair with no fleet-configured tier value has no override —
+resolve it to that runtime's own configured default, and pass it explicitly
+(never leave it unset — see "Never let an unresolved pin fall through"
+below).
 
 ## Pin every spawn explicitly — the floor depends on the ROLE, not the depth
 
-Every orchestrator MUST pass an explicit `model:` on EVERY subagent it spawns, and
-`effort` wherever the mechanism exposes it. An unspecified subagent SILENTLY
-INHERITS THE PARENT'S MODEL — so an Opus orchestrator that forgets the pin just
-spent Opus tokens on a grep.
+Every orchestrator MUST pass an explicit `model:` on EVERY subagent it spawns,
+resolved for its own runtime, and `effort` wherever the mechanism exposes it.
+An unspecified subagent SILENTLY INHERITS THE PARENT'S MODEL — so an
+orchestration-tier orchestrator that forgets the pin just spent its
+(expensive) tier's tokens on a grep.
 
 **The floor is set by what the agent DOES, not by how deep it sits** — see the
 Agent tiers table above. This applies recursively: an implementer spawning its
 own helpers pins them by THEIR role, not by copying its own tier down.
 
 The check before every spawn: what is this agent's ROLE? Reviewer or implementer?
-sonnet-medium. Pure investigation or mechanical work? sonnet-low. Never leave it
+`judgment` tier. Pure investigation or mechanical work? `mechanical` tier. Then
+resolve that tier to your runtime's concrete model+effort. Never leave it
 unspecified.
 
+### Never let an unresolved pin fall through
+
+**An unsupported or unrecognized model name must never block delegation, and
+must never cause silent inheritance of the parent's model.** If your
+runtime's preset has no `TierModels` entry for this tier, or a resolved name
+is rejected by the runtime you're spawning under, do NOT skip the pin and do
+NOT let the spawn go unpinned so it falls back to inheriting the caller's
+model — fall back explicitly to the runtime's own configured default for the
+matching tier and pass THAT, so every spawn is always pinned to some resolved
+model+effort. An unset `model:` is a bug at every layer of this stack, not
+just under Claude.
+
 ## Paste the constraint block into the child prompt — the pin is not enough
 
 **A model pin is an ARGUMENT and travels by itself. A behavioural constraint is
@@ -148,8 +236,11 @@ that stops at depth 1 is absent where the work happens.
   tool's own guidance suggests it. It trips a permission modal, and A FROZEN
   PANE EMITS NOTHING, so nobody can tell you are blocked. If you must background
   work, wait for the completion notification.
-- Every sub-agent YOU spawn gets an explicit `model:` — sonnet (low mechanical,
-  medium judgment). HAIKU IS BANNED. Opus is never yours.
+- Every sub-agent YOU spawn gets an explicit `model:`, resolved for your
+  runtime's tier — `mechanical` (rote/find-replace) or `judgment` (real
+  analysis). On Claude that's sonnet-low / sonnet-medium and HAIKU IS BANNED;
+  on another runtime, use that runtime's own resolved row. The
+  `orchestration` tier is never yours to spawn.
 - READ-ONLY git outside your own worktree. NEVER `checkout`/`reset`/`restore`/
   `stash`/`clean` in ANY directory — `stash` is one shared stack across all
   worktrees and the shared tree holds live agents' uncommitted state.
@@ -161,7 +252,8 @@ signal this condition produces.
 
 ### Cheap subagents → fan out, don't pile up
 
-Because sonnet-low subagents are cheap, prefer MANY small parallel subagents
+Because `mechanical`-tier subagents are cheap (sonnet-low on Claude; the
+mechanical-tier row for your runtime otherwise), prefer MANY small parallel subagents
 over one subagent handed a pile of tasks. When a research or investigation task
 has independent parts, partition it and dispatch the parts in parallel (use the
 `efficient-multi-agent-research` skill) — smaller scopes are cheaper, run
@@ -170,6 +262,12 @@ given ten tasks is the anti-pattern.
 
 ## ⚠️ The pin-verification command LIES — do not trust it
 
+**This section's examples are Claude-specific** (`thrum tmux capture`'s footer
+format, and the historical Sonnet/Opus incident it documents) because that is
+where this defect was measured — but the underlying rule generalizes: verify
+a pin by reading the runtime's own RESOLVED status output, never a stored
+"configured" value, whichever runtime you're on.
+
 `thrum agent runtime-config get <agent>` reports the **configured** value, not the
 **resolved** one.
 
@@ -250,3 +348,35 @@ launch **by construction**.
 An implementer pinned to sonnet, with an implementer role-default of sonnet, comes up
 correct whether or not the pin landed — so "pin sonnet, confirm sonnet" passes whether
 or not the fix works.
+
+## Paste blocks for child prompts
+
+Paste these verbatim into a child prompt when the work involves the named activity.
+
+--- SUB-AGENT HYGIENE ---
+- No kill -0, Monitor or until-loop polling.
+- No pgrep -f.
+- Kill only by a captured PID number.
+- Use rm -r, never rm -rf; a variable path uses "${d:?}".
+- No 2>/dev/null on destructive commands.
+- Bounded timeouts on everything.
+- Remove only the worktree you created in this task, by its recorded path, never with --force.
+- Never demonstrate an unguarded destructive idiom, even on a literal path.
+--- END SUB-AGENT HYGIENE ---
+
+--- TESTS ---
+- To prove a selector resolves, use `go test <pkg> -list '<selector>'` plus a `-list '^TestNoSuchThingAtAll$'` negative control that must list zero tests. Never `-run '<sel>' -list '.*'`.
+- `bd list -l` is --label; use `-n` for a limit.
+- A timeout with 0 FAIL is neither red nor green: classify it as a bound failure, read the panic's "running tests:" line, and re-run wider.
+--- END TESTS ---
+
+--- WORKTREE TEARDOWN & SALVAGE ---
+- Before any teardown, enumerate with both flags: `git -C <wt> status --porcelain --untracked-files=all --ignored -- .thrum`.
+- Salvage anything found to a durable path (not /tmp), one subdirectory per worktree, filenames path-flattened.
+- Never glob `.thrum/context/*.md`; salvage the exact agent-name file only, and assert no `project_state.md` landed in any salvage output.
+- Verify salvage by name set first, then `cmp` each file, with a negative control proving `cmp` detects a difference.
+- Kill the tmux session first (`thrum tmux kill <session>`), verify it is gone, then plain `git worktree remove`, never `--force`.
+- Afterwards verify by effect: gone from `git worktree list` and from disk, and every remaining live pane's cwd still resolves (`tmux list-panes -a -F '#{pane_current_path}'`, then `git rev-parse --show-toplevel` per pane).
+- Build the in-use protection set from live pane cwds, not from a name or registry list.
+- Report the removal count and the registry delta separately.
+--- END WORKTREE TEARDOWN & SALVAGE ---

package/assets/skills/closing-findings-while-warm/SKILL.md

@@ -94,8 +94,7 @@ tool that can prove it, not by trusting the sentence that claims it.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it
 via the `implementer-maintaining-memory` skill (or `coordinator-maintaining-

package/assets/skills/configure-roles/SKILL.md

@@ -155,7 +155,7 @@ For each role:
    - If beads detected: include `bd` commands in Task Tracking section
    - If MCP servers detected: add to Efficiency section
    - If specific skills detected: reference them
-   - If worktree restrictions: adjust Scope Boundaries
+   - If worktree restrictions: adjust the Scope section
 
 3. Write to `.thrum/role_templates/{role}.md`. Keep per-agent template tokens
    (`{{.AgentName}}`, `{{.Module}}`, `{{.WorktreePath}}`,
@@ -226,4 +226,4 @@ rendered files from saved answers without asking any questions.
 | Thrum MCP server     | Add MCP tool references, CLI fallback for sub-agents     |
 | Claude plugin skills | List installed skills with usage guidance                |
 | Context7 MCP         | Add library docs guidance to Efficiency section          |
-| Multiple worktrees   | Add worktree scope rules to Scope Boundaries             |
+| Multiple worktrees   | Add worktree scope rules to the Scope section            |

package/assets/skills/conversation-only-context/SKILL.md

@@ -62,7 +62,7 @@ Workflow `agent()` opts, agent-definition frontmatter, `thrum tmux launch
 ```python
 Agent(subagent_type="general-purpose",
       name="<prefix>_<slug>",
-      model="sonnet",
+      model="<per choosing-subagent-models>",
       description="<3-5 words>",
       prompt="""<task>
 
@@ -92,14 +92,14 @@ to fire-and-forget monitors, not to a named agent you re-message.
 
 | Subagent role | Name prefix | Model / effort (effort only where exposed) | Result file |
 |---|---|---|---|
-| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | `sonnet` / low | `<scratch>/<name>.md` |
-| Root-cause | `<bead>_rc` | `sonnet` / low | `<scratch>/<bead>-rc.md` |
-| Verifier, reviewer, design-verify | `<bead>_verify` | `sonnet` / medium | `<scratch>/<bead>-verify.md` |
-| Implementer | `impl_<slug>` | `sonnet` / medium | `<scratch>/<slug>-impl.md` |
-| VM driver | `vmdriver_<slug>` | `sonnet` / medium | `<scratch>/<slug>-vm.md` |
-| Prose or deep review | any | `opus` — **only when the operator asks** | as above |
+| Investigation, grep, doc summary, mechanical | `<topic>` (e.g. `vmdocs`) | per `choosing-subagent-models` | `<scratch>/<name>.md` |
+| Root-cause | `<bead>_rc` | per `choosing-subagent-models` | `<scratch>/<bead>-rc.md` |
+| Verifier, reviewer, design-verify | `<bead>_verify` | per `choosing-subagent-models` | `<scratch>/<bead>-verify.md` |
+| Implementer | `impl_<slug>` | per `choosing-subagent-models` | `<scratch>/<slug>-impl.md` |
+| VM driver | `vmdriver_<slug>` | per `choosing-subagent-models` | `<scratch>/<slug>-vm.md` |
+| Prose or deep review | any | per `choosing-subagent-models` — **only when the operator asks** | as above |
 
-Haiku is banned. Opus is never yours to grant onward.
+The model ban list lives in `choosing-subagent-models`. A costly tier is never yours to grant onward.
 
 ### CONSTRAINTS block — paste verbatim into every dispatch
 
@@ -111,8 +111,8 @@ Haiku is banned. Opus is never yours to grant onward.
   tool's own guidance suggests it. It trips a permission modal, and A FROZEN
   PANE EMITS NOTHING, so nobody can tell you are blocked. If you must background
   work, wait for the completion notification.
-- Every sub-agent YOU spawn gets an explicit `model:` — sonnet (low mechanical,
-  medium judgment). HAIKU IS BANNED. Opus is never yours.
+- Every sub-agent YOU spawn gets an explicit `model:` chosen per `choosing-subagent-models`
+  (read `runtime.role_models`). The model ban list lives there. A costly tier is never yours.
 - READ-ONLY git outside your own worktree. NEVER `checkout`/`reset`/`restore`/
   `stash`/`clean` in ANY directory — `stash` is one shared stack across all
   worktrees and the shared tree holds live agents' uncommitted state.
@@ -186,7 +186,7 @@ Restart on a number read from the pane footer, never on a felt sense.
 - The parent reading code or docs "to just check quickly" — message the subagent that already read them and ask for the one field.
 - One subagent handed ten tasks — partition it and dispatch the parts in parallel.
 - A spawn with no `name:` — it cannot be re-messaged. Name every spawn.
-- A spawn with no `model:` — it silently inherits Opus. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
+- A spawn with no `model:` — it silently inherits your own model. Pin `model:` on every spawn, and `effort` wherever the mechanism takes it.
 - Holding a design-gating answer behind the rest of the pass while an implementer builds on the old premise — that one goes immediately; the rest ships as one consolidated message.
 - Acting on the resume plan alone and skipping the middle of the prime — the falsified premise sits in the part you skipped.
 - Trusting an older "not started" message over a newer "already running" one — verify, do not recall; that cuts both directions.

package/assets/skills/conversation-only-context/resources/driver-subagent-pattern.md

@@ -21,7 +21,7 @@ findings, and its troubleshooting state across rounds.
 
 Do this:
 
-1. `Agent(name: "vmdriver_<slug>", model: "sonnet", prompt: <round-1 GO>)`.
+1. `Agent(name: "vmdriver_<slug>", model: <per choosing-subagent-models>, prompt: <round-1 GO>)`.
 2. Wait for its report.
 3. `SendMessage(to: "vmdriver_<slug>", message: <round-2 GO>)`.
 

package/assets/skills/conversation-only-context/resources/remote-environment-scenarios.md

@@ -10,7 +10,7 @@ sanctions for reaching it.
 
 You want a multi-hour load or soak run and a verdict, not a log.
 
-1. Spawn `vmdriver_<slug>` with `model: "sonnet"`. The GO names the run, the
+1. Spawn `vmdriver_<slug>` with `model: <per choosing-subagent-models>`. The GO names the run, the
    revision under test, and the exact metrics to report.
 2. The driver opens a persistent session with `<your-ssh-wrapper> <remote-host>`,
    starts the run detached, and writes the exit code to its own file.

package/assets/skills/coordinator-assessing-agent-completion/SKILL.md

@@ -19,6 +19,30 @@ Apply the gate and containment checks below and reach your own
 conclusion. Destructive steps still follow the standing reap preconditions and
 pacing rules; nothing here shortcuts them.
 
+## Standing reap preconditions — ALL must hold
+
+Reaping an agent (removing its worktree) is safe only when every one of these is
+true. It is a gate, not a checklist to rationalize past:
+
+1. **Idle > 48h** — no activity in its transcript for more than two days (rank by
+   message CONTENT, not mtime; your own broadcasts reset mtime).
+2. **No messages exchanged in the last 24h** — nothing sent to it or from it.
+3. **Task complete AND nobody is waiting on it** — it finished and its
+   dispatcher/manager moved on, so a reply it waits for will never come. (A pushed
+   branch held on a still-queued merge is the one nuance — see the
+   held-pending-merge rule.)
+4. **Salvage done first** — its only-copy state is copied to a durable location and
+   verified (see Containment and the reap steps).
+
+**When a needed decision or merge is delayed, ESCALATE — never silently wait.** If an
+agent is parked past the 24h window on something its manager/owner has not acted on,
+raise it explicitly to whoever owns that decision, and re-raise on every subsequent
+run. If the human owner is unresponsive, escalate through your designated escalation
+contact (the human's proxy) rather than leaving the agent parked. A silent park is
+the failure this whole procedure exists to prevent: each run must drive a parked
+agent toward a terminal state — decision made / merge lands (reap-able) or deemed
+orphaned (reap).
+
 ## The instruments, in order of trust
 
 | Question | Instrument |
@@ -81,10 +105,42 @@ sentence IS the terminal statement; a working agent's merely contains one.
 **Name what it is waiting for, then prove that thing is dead or landed.**
 
 *"Held pending the coordinator merge"* is finished only if the merge landed or was
-abandoned. If the merge is still queued, the agent is **correctly** waiting and
-reaping it destroys live context that nobody else holds.
-
-**If you cannot name the blocker, it is not a candidate.**
+abandoned. If the merge is still queued, whether the agent is *correctly* waiting
+depends on its branch and its idle time — see the held-pending-merge rule below.
+
+**If you cannot name the blocker, it is not a candidate.** (This governs the
+*no-transcript* case — absence of evidence — not a named-but-stale merge wait.)
+
+## 🔴 The held-pending-merge case — a PUSHED branch changes the gate
+
+An agent parked "pending the merge" is judged by ONE thing first — **is its branch
+pushed?** — because a merge wait only makes sense if the merge king can reach the
+branch.
+
+- **Branch NOT pushed — broken at ANY idle age.** The merge king cannot access an
+  unpushed branch, so the wait can never resolve, and the agent's commits are also
+  the only copy (unsafe to reap). This is not a legitimate wait — it is a stuck one.
+  → Get the branch PUSHED (nudge the agent / its orchestrator to push it, or escalate
+  that it needs pushing). Never reap an unpushed held-pending-merge agent — pushing
+  first is both what unblocks the merge and what makes any later reap safe.
+- **Branch pushed, idle < 24h.** Legitimately waiting its turn in the merge queue.
+  Leave it (the pushed branch means the merge king can reach it and nothing is lost).
+- **Branch pushed, idle ≥ 24h.** The wait is no longer legitimate — a pushed branch
+  is not the only copy of anything, so any agent could carry the merge. Resolve it to
+  one of two clear states:
+  - **Merge HAPPENED** (branch is an ancestor of trunk, or was abandoned/superseded)
+    → the agent is **ORPHANED**, waiting for a response that will never come → **reap**
+    (salvage-first, and still subject to the standing reap preconditions).
+  - **Merge still PENDING** (branch not on trunk, not abandoned) → the merge king
+    forgot it or the queue is stuck → **ESCALATE** to the merge king (name the branch
+    tip + how long it has waited), and **re-escalate on every subsequent skill run**
+    until it resolves. Never leave it silently parked.
+
+**The escalation is the load-bearing half.** Because each skill run re-checks and
+re-escalates a still-pending merge, the condition is self-correcting: it drives toward
+one of two terminal states — the merge completes (agent then reap-able) or the agent
+is deemed orphaned (reap) — instead of a pushed-branch agent parked forever on a merge
+nobody is tracking. A silent park is exactly the failure this rule prevents.
 
 ## Containment, before anything is stood down
 
@@ -126,8 +182,8 @@ an empty/never-read premise as a match"*). `--force` does NOT bypass it; the gua
 correct. So the reap that actually frees load is worktree removal — but salvage BEFORE you remove,
 then remove PLAIN (no `--force`):
 
-1. Enumerate untracked+ignored `.thrum` content — BOTH flags, one flag alone misses a class
-   (thrum-j14q3): `git status --untracked-files=all --ignored -- .thrum`
+1. Enumerate untracked+ignored `.thrum` content — BOTH flags, one flag alone misses a class:
+   `git status --untracked-files=all --ignored -- .thrum`
 2. Salvage BOTH kinds to their canonical redirect paths, and `cmp`-verify each copy is
    byte-identical to its source:
    - `?? .thrum/agents/<agent>/sessions/*-restart.md` — the restart snapshot.
@@ -218,6 +274,42 @@ RSS-MB.
   you decide**. It is read-only and dry-run — it prints a kill-list, it never
   kills anything.
 
+## 🔴 Footguns — never do these (each measured, each cost real time or state)
+
+- **Never glob/`cp` `.thrum/context/*.md` when salvaging** — the glob matches the
+  shared `project_state.md` and overwrites the canonical copy with a stale worktree
+  copy. Salvage the agent-specific `<agent>.md` by exact name only.
+- **A worktree's `.thrum/` holds a redirect file to the main repo AND a physical
+  stale local copy of shared files** (e.g. `project_state.md`) — the physical
+  worktree copy is NOT canonical; never treat it as the source of truth or copy it
+  upward.
+- **Never use shell-specific builtins in a reap loop without checking the shell** —
+  `mapfile`/`readarray` are bash-only and silently fail in zsh (`command not
+  found`), so the salvage you thought ran did not. Use portable `while read` and
+  verify each salvaged file actually landed.
+- **`rm -rf` raises a confirmation modal that blocks the PARENT pane invisibly** —
+  use `rm -r` for scratch cleanup (identical deletion, no modal). Never `rm -rf`.
+- **`git worktree remove` (plain) silently deletes gitignored-only content (rc=0)**
+  and refuses (rc=128) only on untracked/modified files — salvage is the ONLY
+  protection for gitignored only-copy state.
+- **`git worktree remove` refuses while a just-salvaged untracked snapshot still
+  sits in the worktree** — remove that salvaged copy from the worktree first, then
+  plain-remove.
+- **Never `checkout`/`reset`/`restore`/`stash`/`clean` in a shared tree, even to
+  undo** — to restore a file to its committed version, write it with a plain
+  redirect from `git show <ref>:<path>`, not a checkout.
+- **Test the reap on ONE agent first and verify the EFFECT** (gone from the worktree
+  list AND disk), not just the exit code.
+- **Rank candidates by last-message CONTENT, not elapsed time** — your own
+  broadcasts reset every recipient's idle clock.
+- **`--force` on agent-delete does NOT bypass the CAS guard** on a stale agent — the
+  reap that frees load is worktree removal, not the delete.
+- **Reap order is `thrum tmux kill <session>` FIRST, THEN `git worktree remove`** —
+  removing the worktree alone leaves the agent's tmux session alive with a
+  now-deleted cwd, which the fleet flags as recurring "cwd drift" and whose runtime
+  process keeps consuming RAM/CPU. Kill the session, verify it's gone, then remove
+  the worktree.
+
 ## Why this fails dangerously if you skip the gate
 
 The failure direction is **false-GONE**: concluding a live agent is finished. It

package/assets/skills/coordinator-branch-split-on-block/SKILL.md

@@ -159,8 +159,7 @@ asserted after the fact).
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session about branch-splitting, capture it
 via the `coordinator-maintaining-memory` skill — it references the