planr 1.4.0 → 1.5.1

package/docs/PRESET_COMPOSITION.md

@@ -1,109 +0,0 @@
-# Preset Composition
-
-Planr composes two independent inputs:
-
-- a provider-neutral Usage Policy v1 TOML file;
-- a versioned host binding containing exact client/model/effort and dispatch capabilities.
-
-Preview is the default:
-
-```bash
-planr agents preset apply ./policy.toml --binding ./codex-binding.toml --preview --json
-planr agents preset apply ./policy.toml --binding ./codex-binding.toml --confirm --json
-```
-
-The equivalent MCP tool is `planr_preset_apply` with `policy`, `binding`, and optional `confirm` fields. Both surfaces call one application service and return the same compatibility, permission, verification-age, provenance, conflict, and artifact shapes.
-
-## Built-in Catalog and Safe Packs
-
-`planr agents preset list --json` (MCP: `planr_presets_list`) lists the four embedded policy presets, five host bindings, source checksums, and 20 declared safe pairs. Built-ins resolve by id or id plus `.toml`, so they work from any repository without copying package files first:
-
-```bash
-planr agents preset apply balanced --binding codex-openai --preview --json
-planr agents preset apply read-only-audit --binding mixed-host --confirm --json
-```
-
-Policies: `balanced`, `low-usage`, `max-quality`, and `read-only-audit`. Bindings: `codex-openai`, `cursor-openai`, `cursor-fable-grok`, `claude-native`, and `mixed-host`. The exact inspectable sources ship under `presets/policies/` and `presets/bindings/` and are also compiled into the binary.
-
-A response whose inputs came from the embedded catalog carries `pack.status = "safe"` and `pack.safe = true`. Explicit file inputs remain custom even when their internal ids match a built-in; they are allowed, carry `pack.status = "custom"`, and add a warning requiring review of compatibility, permission, and artifact diffs. This prevents copied or modified files from inheriting safe-pack status by name alone.
-
-## Host Binding v1
-
-Bindings use strict TOML: unknown fields fail parsing. Abstract role keys must cover every role in `policy.execution.roles`; bindings may add a driver profile without adding it to execution permissions.
-
-```toml
-schema_version = 1
-id = "codex-team"
-version = "1.0.0"
-host = "codex"
-driver_role = "driver"
-default_role = "driver"
-capability_evidence = ["codex-0.138-cross-tier-smoke"]
-billing_assumptions = ["local subscription"]
-known_limitations = ["effective model requires host evidence"]
-
-[capabilities]
-model_override = true
-effort_override = true
-fork_none = true
-fork_all = true
-max_partial_fork_turns = 4
-
-[profiles.driver]
-profile = "sol"
-client = "codex"
-model = "gpt-5.5"
-effort = "xhigh"
-
-[profiles.worker]
-profile = "luna"
-client = "codex"
-model = "gpt-5.4-mini"
-effort = "high"
-skill = "planr-work"
-# Omit for the deterministic `none` default.
-fork_turns = { mode = "partial", turns = 2 }
-
-[[routes]]
-work_type = "code"
-role = "worker"
-fallback_roles = ["driver"]
-
-[verification]
-id = "verify-codex-team"
-verified_at_unix = 1900000000
-max_age_seconds = 2592000
-
-[[artifacts]]
-path = ".codex/agents/luna.toml"
-kind = "codex_agent"
-content = '''model = "gpt-5.4-mini"
-model_reasoning_effort = "high"
-'''
-```
-
-Codex cross-tier children never accept `fork_turns = { mode = "all" }`, because full history inheritance defeats the requested model/effort override. Omitted fork configuration defaults to `none`. A partial fork must be positive, at or below `max_partial_fork_turns`, and backed by non-empty `capability_evidence`. Secret-like values are forbidden in all binding metadata, including capability evidence, billing assumptions, limitations, profile metadata, routes, and artifact paths/kinds; composition rejects them with field-only diagnostics before producing dispatch/warning output or mutating the repository.
-
-## Preview and Lock
-
-The preview includes:
-
-- composed abstract-role to registry-profile and dispatch-context mappings;
-- compatibility errors and host/billing limitations;
-- execution-permission additions relative to the active policy;
-- verification id, age, maximum age, and fresh/stale state;
-- source ids, versions, SHA-256 hashes, Planr version, and applied-at value;
-- every target's kind, size, proposed/existing hash, `create`, `unchanged`, or `conflict` action, and deterministic old/proposed configuration. TOML is projected structurally so policy limits/transitions and registry routes/profiles/fallbacks are directly auditable; other text is line-projected. Secret-like keys and credential-shaped values are replaced with `[REDACTED]`.
-
-Confirmed apply writes the previewed bytes and records `policy_applied`. The lock at `.planr/preset.lock.toml` contains source hashes and hashes for every generated non-lock artifact. Tests and reproducible packaging can pin `PLANR_PRESET_NOW_UNIX` and `PLANR_PRESET_APPLIED_AT`; ordinary operation records current time.
-
-## Repository Boundary
-
-Only these repository-relative targets are valid:
-
-- `.planr/policy.toml`
-- `.planr/agents.toml`
-- `.planr/preset.lock.toml`
-- files below `.codex/{agents,skills}/`, `.claude/{agents,skills}/`, or `.cursor/{agents,skills}/`
-
-Planr rejects absolute paths, `.`/`..` traversal, non-normalized paths, symlink crossings, home/global targets, and repository `.codex/config.toml` before the first write. Existing different files are conflicts and are never overwritten; there is no force or privileged mode.

package/docs/PRESET_EVALUATION.md

@@ -1,118 +0,0 @@
-# Preset Evaluation
-
-Planr provides three explicit evidence levels over the same versioned fixture and lifecycle engine:
-
-- the default offline policy simulation performs no external execution and can reach `verified` but never `recommended`;
-- the opt-in live-host runner executes every task through a user-selected local adapter and evaluates Planr-owned workspace artifacts, but arbitrary-process route and cost claims cannot reach `recommended` without independent instrumentation.
-- the instrumented live-host runner joins those artifacts to Ed25519-signed telemetry receipts and can reach `recommended` when trusted route, usage, and all other thresholds pass.
-
-`evaluations/preset-suite-v1.toml` defines distinct inputs, artifact kinds, and candidate/task-bound output oracles for exploration, implementation, mechanical, browser, visual, security, and subagent workflows. Input and result artifacts are SHA-256 hashed.
-
-```sh
-planr agents preset evaluate
-planr --json agents preset evaluate --at-unix 1783987200
-planr agents preset evaluate --report-dir reports/preset-v1
-planr agents preset evaluate \
-  --live-host-command /absolute/path/to/host-adapter \
-  --live-host-arg optional-argument \
-  --trusted-telemetry-signer production-collector \
-  --trusted-telemetry-collector /absolute/path/to/collector
-```
-
-Evaluation defaults to current wall-clock time, so evidence becomes `stale` after fixture expiry. `--at-unix` is the deterministic override for tests and reproducible exports. `--host` requires binding compatibility. The signer and collector flags are all-or-none and require live mode. MCP exposes the equivalent optional `at_unix`, `host`, `live_host_command`, `live_host_args`, `trusted_telemetry_signer`, and `trusted_telemetry_collector` inputs.
-
-## Offline simulation
-
-Offline artifacts say `evidence_scope = "policy_simulation"`, `task_executed = false`, `outcome_oracle_evaluated = false`, and `recommendation_eligible = false`. Projected tool, token, credit, and latency values carry `metrics_source = "estimated_projection"` and `metering_confidence = "estimated"`.
-
-Binding configuration populates only requested and resolved route stages. Effective model, effort, and context-fork dimensions remain `unavailable`, so route coverage is zero and the recommendation list is empty. Offline `verified` means only that policy composition, transition simulation, and hashes are complete.
-
-## Explicit live-host runner
-
-`--live-host-command` must be an absolute executable path. Planr starts it once per candidate/task fixture, writes one JSON request to stdin, waits for process completion, measures elapsed time, and parses one JSON response from stdout. This is an explicit arbitrary-process boundary: only run a trusted adapter. No live process is started without the flag.
-
-For each run, Planr creates a Planr-controlled temporary workspace containing `challenge.json`. The request contains schema/suite/candidate/policy/binding/task versions, task kind, input, input hash, required artifact kind, and absolute workspace/challenge/artifact paths. It deliberately does not expose the expected output or challenge contents. The adapter must read the challenge, write a strict schema-v1 artifact to `artifact_path`, hash those exact bytes, and bind its response back to that artifact:
-
-```json
-{
-  "schema_version": 1,
-  "host_id": "example-host",
-  "host_version": "1.0.0",
-  "candidate_id": "balanced-codex-openai",
-  "task_id": "browser-report-smoke",
-  "input_sha256": "<request input hash>",
-  "artifact_kind": "browser_trace",
-  "artifact_sha256": "<SHA-256 of the artifact file>",
-  "output": "balanced-codex-openai:browser-report-smoke:browser-report-inspected",
-  "effective_model": "model-id",
-  "effective_effort": "high",
-  "effective_context_fork": { "mode": "none" },
-  "tool_calls": 1,
-  "tokens": 10,
-  "credits_micros": 100,
-  "retries": 1,
-  "availability_fallbacks": 1,
-  "quality_escalations": 1,
-  "corrections": 0,
-  "violations": 0
-}
-```
-
-The artifact file is separate from stdout and has this strict shape:
-
-```json
-{
-  "schema_version": 1,
-  "candidate_id": "balanced-codex-openai",
-  "task_id": "browser-report-smoke",
-  "input_sha256": "<request input hash>",
-  "artifact_kind": "browser_trace",
-  "challenge_sha256": "<SHA-256 of Planr's challenge file>",
-  "output": "balanced-codex-openai:browser-report-smoke:browser-report-inspected"
-}
-```
-
-Planr reads the artifact itself after the process exits, rejects missing, symlinked, oversized, malformed, or extra-field artifacts, computes its SHA-256 independently, verifies candidate/task/input/artifact and challenge binding, and finally evaluates the versioned task oracle. Neither a constant responder nor a request-aware mapper that only echoes dynamic request fields and public success labels writes this Planr-controlled artifact, so both have `task_executed = false`, `evidence_complete = false`, status `unverified`, and cannot recommend. A wholly failed live attempt also sets the report-level `reproducible_evidence = false`; merely attempting the adapter is never described as evaluated live evidence.
-
-Production policy checks remain authoritative: tool-budget and write-capability checks are evaluated from the candidate policy, never adapter claims. A read-only candidate fails the implementation and mechanical write fixtures even if the adapter returns otherwise successful JSON.
-
-The adapter reports effective route and usage values, but process exit does not make those claims trusted. Effective route fields are labeled `host_report` with `estimated` enforcement, so they do not increment `verified_route_runs`. Tool/token/credit metering is also `estimated`; only elapsed process latency is independently measured by Planr. Retry/fallback/escalation/correction/violation counts remain visible host reports. The process-adapter boundary therefore always sets `recommendation_eligible = false`, even when every workspace artifact passes.
-
-## Independently signed telemetry
-
-Recommendation-capable live evaluation uses a separately provisioned telemetry collector. The repository trust registry at `.planr/trusted-telemetry.toml` pins both an Ed25519 signer key and the SHA-256 of the collector executable; the evaluation invocation supplies only the registry signer id and the absolute collector path. A caller-selected public key, run id, or precomputed receipt bundle is not accepted. The registry shape is:
-
-```toml
-schema_version = 1
-
-[[signers]]
-id = "production-collector"
-public_key_hex = "<64-hex-character-ed25519-public-key>"
-collector_sha256 = "<64-hex-character-executable-sha256>"
-```
-
-Planr creates a fresh run UUID before evaluation and a fresh challenge nonce for every task. Only after the live adapter exits and Planr reads and hashes the workspace artifact does it invoke the hash-pinned collector. The collector receives a strict JSON identity request containing the Planr-owned run id, evaluation and suite identity, candidate/task/input/artifact identity, exact artifact SHA-256, and challenge nonce. It independently adds host route, usage, transition, correction, and violation measurements, then returns `{ "payload": ..., "signature_hex": "..." }`. The adapter never receives a signing key, and pre-run receipts cannot know the fresh run/challenge/artifact tuple.
-
-Before invocation Planr verifies that the collector is a regular absolute-path file whose SHA-256 matches the selected registry entry, and it rechecks the digest for every task. It rejects the trust upgrade for a failed collector, malformed response, bad signature, wrong run/suite/time, wrong task/input/artifact/challenge binding, blank host identity, or host identity mismatch with the live adapter response. Missing or rejected receipts do not abort artifact evaluation: that result falls back to `host_reported`/`estimated`, gets zero verified route credit, and is recommendation-ineligible. Registry, signer, and collector configuration errors fail the evaluation before execution.
-
-For a verified post-run receipt, Planr uses only signed route, usage, transition, correction, and violation values. Effective route dimensions carry `evidence = "telemetry_receipt"` and `enforcement = "verified"`; tool/token/credit dimensions and result `metering_confidence` are `trusted`; process latency remains Planr-observed. These results use `metrics_source = "trusted_telemetry"` and may satisfy recommendation gates.
-
-## Lifecycle and thresholds
-
-- `recommended`: every task artifact and oracle passes, every effective route and usage measurement has a valid signed telemetry receipt, and all thresholds pass;
-- `verified`: offline simulation is complete, or every required live workspace artifact and outcome oracle passed but recommendation-grade instrumentation is unavailable or a threshold failed;
-- `stale`: evaluation time is later than fixture expiry;
-- `incompatible`: requested host is unsupported by the binding;
-- `unverified`: required composition, transition, hash, live task execution, challenge-bound artifact, or outcome-oracle evidence is incomplete.
-
-Only independently instrumented live task evidence can set `recommendation_evidence_complete = true`. Hashing simulator-authored JSON, process stdout, or an adapter-authored route/cost claim cannot promote it.
-
-## Immutable output
-
-`--report-dir` accepts only a normalized repository-relative directory and rejects absolute paths, traversal, non-directory components, and symlink crossings. It creates `verification.json` and `report.md` without overwrite; either existing target fails the command.
-
-The report includes suite/Planr/configured-model provenance. Live results additionally include host id/version, Planr-read workspace artifact and oracle hashes, host route/usage evidence with explicit estimated or trusted provenance, observed process latency, corrections/transitions/violations, policy-capability checks, and result hashes.
-
-## Sol/Luna Codex contract
-
-`evaluations/sol-luna-codex-v1.toml` independently proves that cross-tier `fork_turns = "all"` is rejected, `none` preserves Luna parameters, missing effective evidence cannot route-verify, and process-evidenced effective model/effort/fork values can verify.

package/docs/PRESET_REGISTRY.md

@@ -1,61 +0,0 @@
-# Preset Registry
-
-Planr's registry is an optional distribution boundary, never a runtime dependency. Active projects keep using their repository-local `.planr/policy.toml`, `.planr/agents.toml`, and preset lock when the registry is unavailable. Previously imported packs remain available under `.planr/registry/cache/` for deterministic offline use.
-
-## Trust and integrity
-
-A schema-v1 registry manifest identifies a registry version and one or more versioned entries. Each entry declares:
-
-- kind (`policy`, `host-binding`, or `pack`), lifecycle (`published`, `deprecated`, or `revoked`), and evaluation status;
-- Planr version bounds and compatible hosts;
-- verification and review timestamps, a verification artifact, and optional replacement/revocation metadata;
-- for `verified` or `recommended` entries, the exact policy, binding, and evaluation-suite ids and versions covered by that evidence;
-- the normalized path, declarative kind, byte length, and SHA-256 digest of every artifact;
-- an optional Ed25519 signature.
-
-Signatures do not establish their own trust. Planr verifies them only against keys provisioned separately in `.planr/registry/trusted-maintainers.toml` (or an explicitly selected trust store):
-
-```toml
-schema_version = 1
-
-[[maintainers]]
-id = "planr-maintainers"
-public_key = "<64 hexadecimal Ed25519 public-key characters>"
-revoked = false
-```
-
-An unsigned pack can be checksum-verified, but a manifest's `recommended` claim is demoted to `verified` unless a non-revoked pinned maintainer signature verifies. A trusted signature is necessary but not sufficient: Planr also re-runs canonical policy/binding composition and safe-artifact validation, binds the shipped bytes to the current built-in evaluation inputs, and validates the current suite/task provenance. Candidate metrics and threshold gates are derived again from the task results; result hashes, task-oracle coverage, the canonical Codex dispatch contract, trusted route/metering evidence, and the report recommendation record must all agree before `recommended` survives. A merely signed status label or stale suite therefore cannot promote an entry.
-
-Invalid signatures, revoked entries/signers, incompatible Planr/host constraints, checksum/size mismatches, traversal, symlinks, binary or executable content, secret-like content, semantically invalid bindings, and malformed declarative artifacts fail closed. Every registry policy, including an `experimental` entry without evaluation metadata, uses the same public-distribution safety check: commands, hooks, environment grants, network/MCP access, secret references, and overwrite permission are rejected. Manifest ids, versions, hosts, references, reasons, paths, and signer metadata are screened field-by-field for secret-like values before they can reach diagnostics; public keys and signature bytes are shape-validated but deliberately not classified as secrets. Stale verification or deprecation remains visible and removes recommendation.
-
-## Verification and offline import
-
-Remote retrieval is deliberately outside the command. Downloading a manifest and its content is an explicit operator action; Planr then verifies local inputs:
-
-```sh
-planr agents preset registry verify registry.toml \
-  --entry balanced-codex \
-  --content-root ./download \
-  --host codex
-```
-
-`--host` may be omitted only for entries whose `compatible_hosts` list is empty. A constrained entry with no explicit host fails closed.
-
-Import is preview-first. The preview lists exactly the manifest-declared files and deterministic cache target. `--confirm` copies only those verified files into a manifest-hash-addressed immutable directory and atomically stores both the original registry manifest and a cache receipt:
-
-```sh
-planr agents preset registry import registry.toml \
-  --entry balanced-codex \
-  --content-root ./download \
-  --host codex
-
-planr agents preset registry import registry.toml \
-  --entry balanced-codex \
-  --content-root ./download \
-  --host codex \
-  --confirm
-```
-
-`planr agents preset registry list` requires no source manifest or network. The mutable receipt is inventory metadata, not a checksum or trust authority. Every read binds the cache path to the stored manifest hash, re-verifies the original manifest and maintainer signature against the repository trust store, compares receipt inventory with the manifest, and recomputes artifact sizes and hashes from the manifest. Coordinated edits to content and receipt therefore remain detectable. The command reports `current` or `stale` freshness from the review timestamp and marks malformed or tampered cache entries unusable. Extra source files are never imported.
-
-The equivalent MCP tools are `planr_preset_registry_verify`, `planr_preset_registry_import`, and `planr_preset_registry_list`. MCP import also previews unless `confirm` is true.

package/evaluations/preset-suite-v1.toml

@@ -1,127 +0,0 @@
-schema_version = 1
-id = "planr-preset-suite"
-version = "1.8.0"
-verified_at_unix = 1783987200
-expires_at_unix = 1815523200
-
-[thresholds]
-minimum_runs = 7
-minimum_quality_score_bps = 8500
-minimum_reliability_bps = 9000
-maximum_average_credits_micros = 1200000
-maximum_p95_latency_ms = 5000
-maximum_transition_contract_failures = 0
-maximum_safety_stop_failures = 0
-require_verified_routes = true
-require_result_hashes = true
-
-[[candidates]]
-id = "balanced-codex-openai"
-policy = "balanced"
-binding = "codex-openai"
-
-[[candidates]]
-id = "low-usage-codex-openai"
-policy = "low-usage"
-binding = "codex-openai"
-
-[[candidates]]
-id = "max-quality-codex-openai"
-policy = "max-quality"
-binding = "codex-openai"
-
-[[candidates]]
-id = "read-only-audit-codex-openai"
-policy = "read-only-audit"
-binding = "codex-openai"
-
-[[tasks]]
-id = "explore-routing-boundaries"
-version = "1.0.0"
-kind = "exploration"
-objective = "Inspect policy and host routing boundaries without mutation."
-input = "inspect-routing-boundaries"
-artifact_kind = "inspection_manifest"
-expected_output = "routing-boundaries-inspected"
-work_units = 8
-transition = "retry"
-requires_write = false
-minimum_tool_budget = 1
-
-[[tasks]]
-id = "implement-bounded-policy-change"
-version = "1.0.0"
-kind = "implementation"
-objective = "Implement a bounded policy change and preserve verification evidence."
-input = "implement-bounded-policy-change"
-artifact_kind = "patch_manifest"
-expected_output = "bounded-policy-change-implemented"
-work_units = 14
-transition = "quality_escalation"
-requires_write = true
-minimum_tool_budget = 80
-
-[[tasks]]
-id = "mechanical-schema-rewrite"
-version = "1.0.0"
-kind = "mechanical"
-objective = "Apply a deterministic schema rewrite across owned files."
-input = "rewrite-owned-schema"
-artifact_kind = "rewrite_manifest"
-expected_output = "owned-schema-rewritten"
-work_units = 11
-transition = "availability_fallback"
-requires_write = true
-minimum_tool_budget = 80
-
-[[tasks]]
-id = "browser-report-smoke"
-version = "1.0.0"
-kind = "browser"
-objective = "Render and inspect the generated human report in a browser surface."
-input = "inspect-browser-report"
-artifact_kind = "browser_trace"
-expected_output = "browser-report-inspected"
-work_units = 16
-transition = "retry"
-requires_write = false
-minimum_tool_budget = 80
-
-[[tasks]]
-id = "visual-report-regression"
-version = "1.0.0"
-kind = "visual"
-objective = "Compare the report table and status labels against the visual contract."
-input = "compare-visual-report"
-artifact_kind = "visual_diff"
-expected_output = "visual-contract-matched"
-work_units = 13
-transition = "quality_escalation"
-requires_write = false
-minimum_tool_budget = 80
-
-[[tasks]]
-id = "security-safety-stop"
-version = "1.0.0"
-kind = "security"
-objective = "Prove an unsafe operation resolves to an enforced safety stop."
-input = "attempt-unsafe-operation"
-artifact_kind = "safety_receipt"
-expected_output = "unsafe-operation-stopped"
-work_units = 9
-transition = "safety_stop"
-requires_write = false
-minimum_tool_budget = 1
-
-[[tasks]]
-id = "subagent-sol-luna-dispatch"
-version = "1.0.0"
-kind = "subagent"
-objective = "Verify Sol/Luna cross-tier dispatch and effective route evidence."
-input = "dispatch-sol-luna-worker"
-artifact_kind = "dispatch_trace"
-expected_output = "sol-luna-dispatch-verified"
-work_units = 12
-transition = "availability_fallback"
-requires_write = false
-minimum_tool_budget = 1

package/evaluations/sol-luna-codex-v1.toml

@@ -1,42 +0,0 @@
-schema_version = 1
-id = "sol-luna-codex"
-version = "1.0.0"
-host = "codex"
-driver_role = "driver"
-default_role = "driver"
-capability_evidence = ["fixture-codex-none-fork-contract-v1"]
-billing_assumptions = ["deterministic evaluation fixture; no provider call"]
-known_limitations = ["effective model and effort require host evidence"]
-
-[capabilities]
-model_override = true
-effort_override = true
-fork_none = true
-fork_all = true
-max_partial_fork_turns = 4
-
-[profiles.driver]
-profile = "sol"
-client = "codex"
-model = "gpt-5.5"
-effort = "xhigh"
-cost_tier = "premium"
-
-[profiles.worker]
-profile = "luna"
-client = "codex"
-model = "gpt-5.4-mini"
-effort = "high"
-cost_tier = "standard"
-skill = "planr-work"
-fork_turns = { mode = "none" }
-
-[[routes]]
-work_type = "code"
-role = "worker"
-fallback_roles = ["driver"]
-
-[verification]
-id = "fixture-sol-luna-v1"
-verified_at_unix = 1783987200
-max_age_seconds = 31536000

package/plugins/planr/skills/planr-loop/agents/planr-reviewer.toml

@@ -1,23 +0,0 @@
-# Copy to .codex/agents/planr-reviewer.toml (project) or ~/.codex/agents/ (user).
-# Adjust the skill path to where the Planr skills are installed.
-name = "planr_reviewer"
-description = "Independent findings-first reviewer for one Planr item. Audits evidence and closes the review with a verdict."
-sandbox_mode = "workspace-write"
-
-# Deliberately no model override: the reviewer is the truth gate and inherits
-# the driver session's model. Make workers cheap, not the verdict.
-
-developer_instructions = """
-Use the planr-review skill exactly as written for the single item id you are given.
-You did not write this code; audit it like an owner. Inspect the actual diff and rerun the
-logged verification commands instead of trusting the worker's summary.
-Close the review with `planr review close <review-id> --verdict ... --reviewer <your-id>` and
-always pass `--reviewer` explicitly (e.g. `checker-1`): shell exports do not survive between
-tool calls, and a review closed under the default identity corrupts the independence audit.
-Findings must be specific and actionable. Do not edit implementation files; your only writes
-are planr review commands.
-"""
-
-[[skills.config]]
-path = "~/.codex/skills/planr-review/SKILL.md"
-enabled = true

package/plugins/planr/skills/planr-loop/agents/planr-worker.toml

@@ -1,21 +0,0 @@
-# Copy to .codex/agents/planr-worker.toml (project) or ~/.codex/agents/ (user).
-# Adjust the skill path to where the Planr skills are installed.
-name = "planr_worker"
-description = "Implements exactly one picked Planr map item to evidence-backed completion, then requests review and stops."
-
-# Cost tiering: the pick packet bounds the worker's scope, so it can run on a
-# lower effort tier than the driver session. Verify the pin took effect after
-# the first spawn (some Codex versions ignore custom agent files on spawn —
-# openai/codex#26868); see docs/GOALS.md "Cost Tiering" for the smoke test.
-model = "gpt-5.5"
-model_reasoning_effort = "medium"
-
-developer_instructions = """
-Use the planr-work skill exactly as written for the single item id you are given.
-Implement only that item. Log changed files and the real verification commands you ran.
-Request review with `planr review request <item-id>` and stop. Never close reviews or items yourself.
-"""
-
-[[skills.config]]
-path = "~/.codex/skills/planr-work/SKILL.md"
-enabled = true

package/presets/bindings/claude-native.toml

@@ -1,52 +0,0 @@
-schema_version = 1
-id = "claude-native"
-version = "1.0.0"
-host = "claude-code"
-driver_role = "driver"
-default_role = "driver"
-capability_evidence = ["builtin-claude-project-agent-contract"]
-billing_assumptions = ["Planr records declared tiers; Claude Code remains billing authority"]
-known_limitations = ["session environment may preempt the requested subagent model"]
-
-[capabilities]
-model_override = true
-effort_override = true
-fork_none = true
-fork_all = false
-
-[profiles.driver]
-profile = "claude-native-driver"
-client = "claude-code"
-model = "opus"
-effort = "high"
-cost_tier = "premium"
-
-[profiles.worker]
-profile = "claude-native-worker"
-client = "claude-code"
-model = "sonnet"
-effort = "medium"
-cost_tier = "standard"
-skill = "planr-work"
-fork_turns = { mode = "none" }
-
-[[routes]]
-work_type = "code"
-role = "worker"
-fallback_roles = ["driver"]
-
-[verification]
-id = "builtin-claude-native-v1"
-verified_at_unix = 1783987200
-max_age_seconds = 31536000
-
-[[artifacts]]
-path = ".claude/agents/planr-preset-worker.md"
-kind = "claude_agent"
-content = '''---
-name: planr-preset-worker
-model: sonnet
-effort: medium
----
-Use the planr-work skill and preserve Planr evidence.
-'''

package/presets/bindings/codex-openai.toml

@@ -1,56 +0,0 @@
-schema_version = 1
-id = "codex-openai"
-version = "1.0.0"
-host = "codex"
-driver_role = "driver"
-default_role = "driver"
-capability_evidence = ["builtin-codex-none-fork-contract"]
-billing_assumptions = ["Planr records declared tiers; Codex remains billing authority"]
-known_limitations = ["effective model and effort require host-reported evidence"]
-
-[capabilities]
-model_override = true
-effort_override = true
-fork_none = true
-fork_all = false
-max_partial_fork_turns = 4
-
-[profiles.driver]
-profile = "codex-openai-driver"
-client = "codex"
-model = "gpt-5.5"
-effort = "xhigh"
-cost_tier = "premium"
-
-[profiles.worker]
-profile = "codex-openai-worker"
-client = "codex"
-model = "gpt-5.4-mini"
-effort = "high"
-cost_tier = "standard"
-skill = "planr-work"
-fork_turns = { mode = "none" }
-
-[[routes]]
-work_type = "code"
-role = "worker"
-fallback_roles = ["driver"]
-
-[verification]
-id = "builtin-codex-openai-v1"
-verified_at_unix = 1783987200
-max_age_seconds = 31536000
-
-[[artifacts]]
-path = ".codex/agents/planr-preset-worker.toml"
-kind = "codex_agent"
-content = '''name = "planr_preset_worker"
-description = "Implements one picked Planr map item with evidence-backed handoff."
-model = "gpt-5.4-mini"
-model_reasoning_effort = "high"
-sandbox_mode = "workspace-write"
-
-developer_instructions = """
-Use the planr-work skill for exactly one picked item. Preserve the task scope, record changed files and real verification commands, request review, and stop.
-"""
-'''

package/presets/bindings/cursor-fable-grok.toml

@@ -1,49 +0,0 @@
-schema_version = 1
-id = "cursor-fable-grok"
-version = "1.0.0"
-host = "cursor"
-driver_role = "driver"
-default_role = "driver"
-capability_evidence = ["builtin-cursor-project-agent-contract"]
-billing_assumptions = ["Planr records declared tiers; Cursor remains billing authority"]
-known_limitations = ["workspace policy or Max Mode may override the requested model"]
-
-[capabilities]
-model_override = true
-effort_override = false
-fork_none = true
-fork_all = false
-
-[profiles.driver]
-profile = "cursor-fable-driver"
-client = "cursor"
-model = "fable-5"
-cost_tier = "premium"
-
-[profiles.worker]
-profile = "cursor-grok-worker"
-client = "cursor"
-model = "grok-code-fast-1"
-cost_tier = "standard"
-skill = "planr-work"
-fork_turns = { mode = "none" }
-
-[[routes]]
-work_type = "code"
-role = "worker"
-fallback_roles = ["driver"]
-
-[verification]
-id = "builtin-cursor-fable-grok-v1"
-verified_at_unix = 1783987200
-max_age_seconds = 31536000
-
-[[artifacts]]
-path = ".cursor/agents/planr-preset-worker.md"
-kind = "cursor_agent"
-content = '''---
-name: planr-preset-worker
-model: grok-code-fast-1
----
-Use the planr-work skill and preserve Planr evidence.
-'''