tickmarkr 2.6.4 → 2.6.6

package/README.md

@@ -258,9 +258,13 @@ two-pane surface: the left rail lists views (**All models**, **Shapes**, **Steer
 installed agent CLI with its auth state and model count; the right pane is a searchable model list
 with tier, context, price, and probe-latency columns. `Space` allows/denies, `Enter` classifies an
 unclassified model (with a required benchmark-provenance note) or pins a classified one to a shape,
-`m` opens the routing-mode presets, and `w` renders the unified diff of your repo config overlay.
-Nothing is written until you confirm the diff with `y`; quitting leaves config unchanged. The
-Shapes view pins from a candidate picker ranked by the production router.
+`m` opens the routing-mode presets, and `w` renders the unified diff of the one overlay the save
+lands in, named in the review: an allow/deny membership edit goes to the layer that holds it (the
+repo overlay when it declares that family, else your user overlay), everything else to the user
+overlay; a batch needing both is refused — save each half in its own session. Nothing is written
+until you confirm with `y`. A worker-only deny on a partially excluded adapter takes two rail
+presses: out · all seats, then out · workers. The Shapes view pins from a candidate picker ranked by
+the production router.
 
 Routing-mode semantics, pin/floor/prefer precedence, review and consult steering syntax,
 provenance rules, and `--quality` / `--mode` flags are documented in

package/dist/adapters/catalog-remote.d.ts

@@ -18,6 +18,8 @@ export interface CatalogReadResult {
     source: "cache" | "vendored";
     stale: boolean;
     warning?: string;
+    /** v2.6.5 T9: `adapter:model` keys a failed post-discovery refresh left at UNKNOWN coverage, never "uncovered". */
+    coverageUnknown?: readonly string[];
 }
 export interface CatalogModelEvidence {
     modelId: string;
@@ -62,6 +64,27 @@ export interface RefreshCatalogResult {
     warning?: string;
     legs: CatalogLegResult[];
 }
+/**
+ * v2.6.5 T9 (H): records persisted from cited sources, never inferred from a model name or an API
+ * price. Prices are normal API USD per million tokens — a subscription seat is never billed from them.
+ * The tier is CONTINUITY of the shipped alias seeds (config.ts DEFAULT_CONFIG: sonnet=mid,
+ * opus=frontier), not a benchmark ruling: doctor prints it as an inference for operator confirmation
+ * and the configured (Fleet-confirmed) tier stays the routing authority.
+ */
+export interface SourcedIdentityRecord {
+    identity: string;
+    alias: "sonnet" | "opus";
+    inputCostPerMtok: number;
+    outputCostPerMtok: number;
+    contextWindow: number;
+    outputWindow: number;
+    tier: "mid" | "frontier";
+    tierBasis: string;
+    sources: readonly string[];
+    fetchedAt: string;
+}
+export declare const SOURCED_IDENTITY_RECORDS: readonly SourcedIdentityRecord[];
+export declare const sourcedIdentityRecord: (identity: string | undefined) => SourcedIdentityRecord | undefined;
 export declare const formatCatalogRefreshLegs: (legs: readonly CatalogLegResult[]) => string;
 export declare const catalogCachePath: (repoRoot: string) => string;
 /**

package/dist/adapters/catalog-remote.js

@@ -13,6 +13,40 @@ export const CATALOG_CACHE_MAX_AGE_MS = 7 * 86_400_000;
 export const CATALOG_REFRESH_TIMEOUT_MS = 10_000;
 const ARTIFICIAL_ANALYSIS_PAGE_SIZE = 100;
 const ARTIFICIAL_ANALYSIS_MAX_PAGES = 100;
+export const SOURCED_IDENTITY_RECORDS = [
+    {
+        identity: "claude-sonnet-5-5",
+        alias: "sonnet",
+        inputCostPerMtok: 2,
+        outputCostPerMtok: 10,
+        contextWindow: 1_000_000,
+        outputWindow: 128_000,
+        tier: "mid",
+        tierBasis: "continuity of the existing sonnet=mid configuration, not derived from the name or price",
+        sources: [
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/providers/anthropic/models/claude-sonnet-5-5.toml",
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/models/anthropic/claude-sonnet-5-5.toml",
+            "https://platform.claude.com/docs/en/models/sonnet-5-5/overview",
+        ],
+        fetchedAt: "2026-09-30",
+    },
+    {
+        identity: "claude-opus-5-5",
+        alias: "opus",
+        inputCostPerMtok: 4,
+        outputCostPerMtok: 20,
+        contextWindow: 1_000_000,
+        outputWindow: 128_000,
+        tier: "frontier",
+        tierBasis: "continuity of the existing opus=frontier configuration, not derived from the name or price",
+        sources: [
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/providers/anthropic/models/claude-opus-5-5.toml",
+            "https://raw.githubusercontent.com/anomalyco/models.dev/dev/models/anthropic/claude-opus-5-5.toml",
+        ],
+        fetchedAt: "2026-09-30",
+    },
+];
+export const sourcedIdentityRecord = (identity) => SOURCED_IDENTITY_RECORDS.find((r) => r.identity === identity);
 const VENDORED_CATALOG = {
     schemaVersion: 1,
     // Package fallback copied from https://models.dev/api.json on 2026-08-05. It is deliberately
@@ -26,6 +60,10 @@ const VENDORED_CATALOG = {
                 "claude-fable-5-1": { id: "claude-fable-5-1", cost: { input: 10, output: 50 }, limit: { context: 1_000_000, output: 128_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
                 "claude-opus-4-8": { id: "claude-opus-4-8", cost: { input: 5, output: 25 }, limit: { context: 1_000_000, output: 128_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
                 "claude-sonnet-5": { id: "claude-sonnet-5", cost: { input: 2, output: 10 }, limit: { context: 1_000_000, output: 128_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
+                // v2.6.5 T9: the sourced 5-5 records above, so a refresh-less resolution still covers them.
+                ...Object.fromEntries(SOURCED_IDENTITY_RECORDS.map((r) => [r.identity, {
+                        id: r.identity, cost: { input: r.inputCostPerMtok, output: r.outputCostPerMtok }, limit: { context: r.contextWindow, output: r.outputWindow }, reasoning: true, tool_call: true, structured_output: true, attachment: true,
+                    }])),
                 "claude-haiku-4-5-20251001": { id: "claude-haiku-4-5-20251001", cost: { input: 1, output: 5 }, limit: { context: 200_000, output: 64_000 }, reasoning: true, tool_call: true, structured_output: true, attachment: true },
             },
         },

package/dist/adapters/claude-code.d.ts

@@ -2,7 +2,7 @@ import { type AuthHealth, type TrustDialog, type WorkerAdapter } from "./types.j
 export declare const CLAUDE_ALIAS_IDENTITY_STAMPS: {
     readonly fable: "claude-fable-5-1";
     readonly opus: "claude-opus-4-8";
-    readonly sonnet: "claude-sonnet-5";
+    readonly sonnet: "claude-sonnet-5-5";
     readonly haiku: "claude-haiku-4-5-20251001";
 };
 export type ClaudeAlias = keyof typeof CLAUDE_ALIAS_IDENTITY_STAMPS;

package/dist/adapters/claude-code.js

@@ -32,7 +32,10 @@ export const CLAUDE_ALIAS_IDENTITY_STAMPS = {
     // OBS-871, 2026-09-03: Fable's floating alias now resolves to the 5.1 benchmark identity.
     fable: "claude-fable-5-1",
     opus: "claude-opus-4-8",
-    sonnet: "claude-sonnet-5",
+    // v2.6.5 T9 (H, PREMISES-v265 P31): the author's live probeClaudeAliasIdentity call on 2026-09-30
+    // resolved sonnet to claude-sonnet-5-5. Its sourced price/window and continuity tier basis live in
+    // SOURCED_IDENTITY_RECORDS (catalog-remote.ts); this re-stamp re-dates no tier and adopts nothing.
+    sonnet: "claude-sonnet-5-5",
     haiku: "claude-haiku-4-5-20251001",
 };
 // v1.75 T2 / OBS-137: current Claude Code workspace-trust prompt (2.1.218). The full question

package/dist/adapters/codex-commit-check.d.ts

@@ -0,0 +1,36 @@
+import { type AuthHealth, type CodexCommitStatus, type WorkerAdapter } from "./types.js";
+export type { CodexCommitStatus };
+export interface CodexCommitProbe {
+    worktree: string;
+    commonDir: string;
+    branch: string;
+    control: string;
+    lock: string;
+    hostileHook: string;
+    hostileRoot: string;
+    token: string;
+    signal?: AbortSignal;
+}
+/** Runs the probe script inside the Codex sandbox and resolves its stdout. Injected in tests. */
+export type CodexSandbox = (probe: CodexCommitProbe) => Promise<string>;
+export interface CodexCommitResult {
+    status: CodexCommitStatus;
+    detail: string;
+}
+/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+export declare const codexSandboxArgs: (p: CodexCommitProbe, grant?: string) => string[];
+/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
+export declare const codexSandboxFor: (grant: string) => CodexSandbox;
+export declare const codexSandbox: CodexSandbox;
+export declare function probeCodexCommit(repoRoot: string, sandbox?: CodexSandbox, signal?: AbortSignal): Promise<CodexCommitResult>;
+/** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */
+export declare const codexCommitStatus: (health: Record<string, AuthHealth>) => CodexCommitStatus;
+/** Doctor's one call: gated on the REAL codex adapter object (a codex-id stub gets no probe and no output
+ *  unless a test injects a sandbox — the kimiTurnEnabled rule). Mutates only the health record doctor owns. */
+export declare function recordCodexCommit(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, cwd: string, sandbox?: CodexSandbox): Promise<void>;
+/** Plan's headline beneath a Codex worker row; null for every other worker and for an allowed probe.
+ *  An absent field is unknown, but only the real adapter earns the line — stubs stay byte-identical. */
+export declare function codexCommitHeadline(worker: string, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): string | null;
+/** Plan's one line for Codex's NON-worker roles (judge, review, consult): they launch with the same grant, so
+ *  only an escape earns it — allowed, protected and unknown concern commits, which those roles never make. */
+export declare function codexEscapeRoleLine(roles: string[], adapters: WorkerAdapter[], health: Record<string, AuthHealth>): string | null;

package/dist/adapters/codex-commit-check.js

@@ -0,0 +1,205 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { CODEX_GIT_GRANT, codex } from "./codex.js";
+import { shq } from "./types.js";
+const exec = promisify(execFile);
+const git = async (cwd, ...args) => (await exec("git", args, { cwd })).stdout.trim();
+const CONTROL = "tickmarkr-codex-commit-control";
+// $1 control, $2 token, $3 hostile hooks member, $4 hostile common-root member. The commit disables hooks (the
+// probe asks what the sandbox permits, never what a user hook decides) and forces the reflog so common/logs is
+// always exercised. noclobber (set -C) never writes over a foreign occupant of a hostile path.
+const SCRIPT = `printf %s "$2" > "$1" && echo control=ok || echo control=fail
+git add -- "$1" && git -c core.hooksPath=/dev/null -c core.logAllRefUpdates=true -c commit.gpgsign=false -c user.name=tickmarkr -c user.email=probe@tickmarkr.invalid commit -q -m "tickmarkr-probe $2" && echo commit=ok || echo commit=fail
+(set -C; printf %s "$2" > "$3") 2>/dev/null && echo hook=written || echo hook=denied
+(set -C; printf %s "$2" > "$4") 2>/dev/null && echo root=written || echo root=denied`;
+/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+export const codexSandboxArgs = (p, grant = CODEX_GIT_GRANT) => [
+    "-c",
+    `codex sandbox -c 'sandbox_mode="workspace-write"' ${grant} -- sh -c ${shq(SCRIPT)} sh ${[p.control, p.token, p.hostileHook, p.hostileRoot].map(shq).join(" ")}`,
+];
+/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
+export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal })).stdout;
+export const codexSandbox = codexSandboxFor(CODEX_GIT_GRANT);
+const holds = (path, token) => {
+    try {
+        return readFileSync(path, "utf8") === token;
+    }
+    catch {
+        return false;
+    }
+};
+const unknown = (detail) => ({ status: "unknown", detail });
+// The bytes on disk decide an escape whatever the receipts say — and whether or not the sandbox exited cleanly.
+const escaped = (hostile, token) => {
+    const written = hostile.filter((m) => holds(m, token));
+    return written.length ? { status: "escape", detail: `the sandbox wrote ${written.join(" and ")} outside the worker grant` } : undefined;
+};
+// One outcome per receipt field: a field reporting two outcomes (commit=ok AND commit=fail) is contradictory.
+const contradictory = (out) => {
+    const seen = new Map();
+    for (const [, field, outcome] of out.matchAll(/^(control|commit|hook|root)=(\S+)/gm)) {
+        if ((seen.get(field) ?? outcome) !== outcome)
+            return true;
+        seen.set(field, outcome);
+    }
+    return false;
+};
+const tipOf = async (repo, ref) => git(repo, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`).catch(() => undefined);
+// This probe's commit and nothing else: one parent (the fixture base), its token in the subject and the control.
+const isProbeCommit = async (repo, commit, base, token) => {
+    try {
+        return await git(repo, "log", "-1", "--format=%P %s", commit) === `${base} tickmarkr-probe ${token}`
+            && await git(repo, "cat-file", "blob", `${commit}:${CONTROL}`) === token;
+    }
+    catch {
+        return false;
+    }
+};
+export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal) {
+    const token = randomUUID();
+    const parent = mkdtempSync(join(tmpdir(), "tickmarkr-codex-commit-"));
+    // git names the fixture's metadata directory after the checkout's basename; a unique one makes that
+    // directory — and so the lock path — known BEFORE `worktree add`, which can fail after creating it
+    const branch = `tickmarkr-probe-${token}`;
+    const ref = `refs/heads/${branch}`;
+    const worktree = join(parent, branch);
+    let lock;
+    let base;
+    let hostile = [];
+    try {
+        const commonDir = await git(repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+        lock = join(commonDir, "worktrees", basename(worktree), "index.lock");
+        const hostileHook = join(commonDir, "hooks", branch), hostileRoot = join(commonDir, branch);
+        hostile = [hostileHook, hostileRoot];
+        if (hostile.some((m) => existsSync(m)))
+            return unknown("a foreign file already holds a hostile probe path");
+        base = await git(repoRoot, "rev-parse", "--verify", "HEAD^{commit}");
+        await git(repoRoot, "worktree", "add", "-b", branch, worktree, base);
+        if (join(await git(worktree, "rev-parse", "--absolute-git-dir"), "index.lock") !== lock)
+            return unknown("the fixture worktree metadata is not where git was expected to put it");
+        const control = join(worktree, CONTROL);
+        if (existsSync(lock))
+            return unknown("a foreign index.lock already holds the fixture worktree");
+        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal });
+        // An escape on disk dominates; every other verdict needs consistent receipts AND disk.
+        const escape = escaped(hostile, token);
+        if (escape)
+            return escape;
+        if (contradictory(out))
+            return unknown("the sandbox receipts contradict each other");
+        if (!/^control=ok$/m.test(out) || !holds(control, token))
+            return unknown("the sandbox did not write the ordinary control file");
+        if (!/^hook=denied$/m.test(out) || !/^root=denied$/m.test(out) || hostile.some((m) => existsSync(m))) {
+            return unknown("the sandbox result for the shared-metadata members was unreadable");
+        }
+        const tip = await tipOf(repoRoot, ref);
+        if (/^commit=ok$/m.test(out) && tip && tip !== base && await isProbeCommit(repoRoot, tip, base, token)) {
+            let reflog = "";
+            try {
+                reflog = readFileSync(join(commonDir, "logs", ref), "utf8");
+            }
+            catch { /* absent: unknown below */ }
+            if (reflog.trimEnd().split("\n").pop()?.startsWith(`${base} ${tip} `)) {
+                return { status: "allowed", detail: "the sandbox committed on its fixture branch and was denied both shared-metadata members" };
+            }
+            return unknown("the fixture branch moved but its reflog does not record the probe commit");
+        }
+        if (/^commit=fail$/m.test(out) && tip === base) {
+            return { status: "protected", detail: "the sandbox wrote an ordinary worktree file but denied the linked-worktree commit" };
+        }
+        return unknown("the fixture branch does not match the sandbox commit report (a foreign change may have moved it)");
+    }
+    catch (e) {
+        // a sandbox that wrote a hostile member and then failed (or was cancelled) still escaped: inspect before cleanup
+        const escape = escaped(hostile, token);
+        if (escape)
+            return escape;
+        return unknown(signal?.aborted ? "probe cancelled" : `probe did not run (${(e instanceof Error ? e.message : String(e)).split("\n")[0]})`);
+    }
+    finally {
+        // only files holding this probe's token are ours to remove; a foreign occupant is never touched
+        for (const m of hostile)
+            if (holds(m, token))
+                rmSync(m, { force: true });
+        if (lock && holds(lock, token))
+            rmSync(lock, { force: true });
+        // a foreign lock lives in the fixture's metadata directory, which `worktree remove` would delete with
+        // it: drop only the checkout and leave that metadata to the lock's owner. Never a repository-wide
+        // prune — that would take an earlier probe's preserved foreign lock (or anyone's prunable worktree).
+        const foreign = lock !== undefined && existsSync(lock);
+        if (lock && !foreign) {
+            await git(repoRoot, "worktree", "remove", "--force", worktree).catch(() => undefined);
+            // a failed `worktree add` leaves metadata git no longer removes by path: drop this probe's own directory
+            rmSync(dirname(lock), { recursive: true, force: true });
+            try {
+                rmdirSync(dirname(dirname(lock)));
+            }
+            catch { /* other worktrees live there */ }
+        }
+        // The fixture branch and its reflog go only while the tip is still this probe's (the base or its own
+        // commit), and update-ref's old-value check refuses if anyone moves it between this read and the delete.
+        // Metadata preserved for a foreign lock keeps its branch too: that checkout's HEAD still names it.
+        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref);
+        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token))) {
+            await git(repoRoot, "update-ref", "-d", ref, tip).catch(() => undefined);
+        }
+        rmSync(parent, { recursive: true, force: true });
+    }
+}
+const NOTE = {
+    protected: "linked-worktree git metadata protected",
+    allowed: "linked-worktree commit probe: commit allowed, shared hooks/config denied",
+    escape: "BLOCKING security warning: codex sandbox escape into shared git metadata",
+    unknown: "linked-worktree commit probe unknown",
+};
+const CONSEQUENCE = {
+    protected: "; a Codex worker cannot commit in its worktree",
+    allowed: "",
+    escape: "; every Codex role (worker, judge, review, consult) launches with this grant — stop Codex seats and inspect .git/hooks and git config --list --show-origin (core.hooksPath, core.fsmonitor, filter.*, diff.external)",
+    unknown: "",
+};
+const STATUSES = new Set(Object.keys(NOTE));
+/** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */
+export const codexCommitStatus = (health) => {
+    const s = health[codex.id]?.codexCommit;
+    return s !== undefined && STATUSES.has(s) ? s : "unknown";
+};
+/** Doctor's one call: gated on the REAL codex adapter object (a codex-id stub gets no probe and no output
+ *  unless a test injects a sandbox — the kimiTurnEnabled rule). Mutates only the health record doctor owns. */
+export async function recordCodexCommit(adapters, health, cwd, sandbox) {
+    const adapter = adapters.find((a) => a.id === codex.id);
+    const h = health[codex.id];
+    if (!adapter || (adapter !== codex && !sandbox) || !h?.installed)
+        return;
+    const r = await probeCodexCommit(cwd, sandbox);
+    const say = `${NOTE[r.status]} — ${r.detail}${CONSEQUENCE[r.status]}`;
+    health[codex.id] = { ...h, codexCommit: r.status, note: `${h.note ? `${h.note}; ` : ""}${say}` };
+}
+const ESCAPE_ACTION = "stop Codex seats and inspect .git/hooks and git config --list --show-origin (core.hooksPath, core.fsmonitor, filter.*, diff.external) before dispatch";
+/** Plan's headline beneath a Codex worker row; null for every other worker and for an allowed probe.
+ *  An absent field is unknown, but only the real adapter earns the line — stubs stay byte-identical. */
+export function codexCommitHeadline(worker, adapters, health) {
+    if (worker !== codex.id || !adapters.includes(codex))
+        return null;
+    const status = codexCommitStatus(health);
+    if (status === "escape") {
+        return `    BLOCKING security warning: codex sandbox escape (doctor probe) — this worker's launch grant let the sandbox write shared git metadata; ${ESCAPE_ACTION}`;
+    }
+    if (status === "protected") {
+        return "    worker restriction: codex linked-worktree git metadata is protected (doctor probe) — this worker cannot commit its own work; routing consequence: steer this task to an eligible non-Codex worker";
+    }
+    return status === "unknown"
+        ? "    worker restriction: unknown — the codex linked-worktree commit probe has no verdict; run tickmarkr doctor"
+        : null;
+}
+/** Plan's one line for Codex's NON-worker roles (judge, review, consult): they launch with the same grant, so
+ *  only an escape earns it — allowed, protected and unknown concern commits, which those roles never make. */
+export function codexEscapeRoleLine(roles, adapters, health) {
+    if (!roles.length || !adapters.includes(codex) || codexCommitStatus(health) !== "escape")
+        return null;
+    return `BLOCKING security warning: codex sandbox escape (doctor probe) — Codex ${roles.join("/")} seats launch with the worker grant that let the sandbox write shared git metadata; ${ESCAPE_ACTION}`;
+}

package/dist/adapters/codex.d.ts

@@ -4,6 +4,7 @@ export declare function readCodexModelsCache(path?: string): {
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
 };
+export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -96,9 +96,15 @@ function codexRetirement(upgrade) {
 }
 // tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
 // workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
-// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the pane shell at the
-// worktree cwd; in a plain repo it resolves to ./.git (already writable, harmless).
-const GITDIR_WRITABLE = `-c "sandbox_workspace_write.writable_roots=[\\"$(git rev-parse --path-format=absolute --git-common-dir)\\"]"`;
+// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the launching shell at the
+// worktree cwd, for EVERY Codex role (worker, judge, review, consult share these builders).
+// v2.6.6 T9 (K, D-912): the grant is exactly what a linked-worktree branch commit writes — the worktree's
+// own gitdir (only when it differs from the common dir), common/objects, common/refs, common/logs. The
+// shipped [common] grant (and D-910's [common, gitdir]) let a sandboxed seat write <common>/hooks and
+// <common>/config, which unsandboxed git later runs. No common-root fallback: an ordinary checkout gets
+// no gitdir root and its commit fails closed. packed-refs is not granted (packed-ref ops fail closed).
+// doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
+export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ "$tkr_gitdir" != "$tkr_common" ]; then printf '"%s",' "$tkr_gitdir"; fi; printf '"%s/objects","%s/refs","%s/logs"' "$tkr_common" "$tkr_common" "$tkr_common")]"`;
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
@@ -257,12 +263,12 @@ export const codex = {
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builder below hardcodes (incl. codexMcpSuppressionFlags' -c/
-    // --disable and GITDIR_WRITABLE's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
+    // --disable and CODEX_GIT_GRANT's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
     hardcodedFlags: { binary: "codex", flags: ["--sandbox", "-a", "-s", "--model", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
     // CODEX_HOOK_TRUST (OBS-125) clears the per-worktree "Hooks need review" gate while keeping the sandbox.
-    headlessCommand: (promptFile, model, effort) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`,
+    headlessCommand: (promptFile, model, effort) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`,
     // OBS-930: the visible pane runs the REAL TUI. Codex's TUI takes its prompt only as the [PROMPT]
     // positional (`codex --help`, 0.153.4 — no file/stdin form), so the launch inlines the file exactly
     // as the claude adapter does: the prompt is the LAST positional and every flag value is followed by
@@ -274,7 +280,7 @@ export const codex = {
     // OBS-930 (Linux): the inlined prompt is ONE argv string and Linux caps one at 131072 bytes, so a
     // prompt over promptArgvCeiling() returns null → worker-mode-fallback → the headless form (types.ts).
     interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
-        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
+        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
         : null,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model, a.effort) };

package/dist/adapters/model-discovery-check.d.ts

@@ -0,0 +1,33 @@
+import type { TickmarkrConfig } from "../config/config.js";
+import { type CatalogFetcher, type CatalogReadResult } from "./catalog-remote.js";
+import { type ClaudeAlias } from "./claude-code.js";
+import type { AuthHealth, WorkerAdapter } from "./types.js";
+export interface ModelDiscoveryCheckInput {
+    cwd: string;
+    cfg: TickmarkrConfig;
+    adapters: WorkerAdapter[];
+    /** This doctor's fresh health, BEFORE it is written: the doctor.json on disk is the prior discovery. */
+    health: Record<string, AuthHealth>;
+    catalog: CatalogReadResult;
+    resolved: Partial<Record<ClaudeAlias, string | undefined>>;
+    /** False when this doctor already refreshed, was handed a catalog, or may not touch the network. */
+    mayRefresh: boolean;
+    fetcher?: CatalogFetcher;
+    now?: () => Date;
+}
+/**
+ * Doctor's post-discovery coverage check. A model this discovery ADDED (absent from the prior
+ * doctor.json) that the catalog does not cover earns at most ONE refresh, even under a fresh cache;
+ * a model already seen never re-fetches, so a permanently uncovered model cannot become a per-run
+ * fetch. A failed refresh leaves coverage unknown — never "uncovered" — until a successful refresh. Advisory: no config, tier or
+ * routing write; sourced identity records print as inference for confirmation.
+ */
+export declare function checkModelDiscovery(input: ModelDiscoveryCheckInput): Promise<{
+    catalog: CatalogReadResult;
+    findings: string[];
+}>;
+/**
+ * plan's headline: drift read from the identity doctor PERSISTED for each configured claude alias.
+ * Matching identities stay silent; an alias doctor never resolved stays unknown, never clean.
+ */
+export declare function aliasIdentityHeadlines(cfg: TickmarkrConfig, health: Record<string, AuthHealth>): string[];

package/dist/adapters/model-discovery-check.js

@@ -0,0 +1,123 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { stateDirName } from "../graph/graph.js";
+import { observedIdentity } from "../route/preference.js";
+import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, refreshCatalogCommand, resolveCatalogModel, sourcedIdentityRecord, } from "./catalog-remote.js";
+import { CLAUDE_ALIAS_IDENTITY_STAMPS } from "./claude-code.js";
+import { readDoctor } from "./registry.js";
+const seen = (health, adapter) => {
+    const h = health?.[adapter];
+    return new Set([...(h?.models ?? []), ...Object.values(h?.modelAuth ?? {}).flatMap((v) => (v.identity ? [v.identity] : []))]);
+};
+// A failed refresh's unknown outlives that doctor: keyed to the models.dev spine stamp it failed against,
+// so any later successful refresh (doctor's guard, fleet, catalog refresh) supersedes it by moving the stamp.
+const unknownPath = (cwd) => join(cwd, stateDirName(cwd), "catalog-coverage-unknown.json");
+const spineStamp = (c) => c.source === "cache" ? c.catalog.legFetchedAt?.modelsDev ?? c.catalog.fetchedAt : null;
+function persistedUnknown(cwd, catalog) {
+    try {
+        const v = JSON.parse(readFileSync(unknownPath(cwd), "utf8"));
+        return v.modelsDevAt === spineStamp(catalog) && Array.isArray(v.keys) ? v.keys.filter((k) => typeof k === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Doctor's post-discovery coverage check. A model this discovery ADDED (absent from the prior
+ * doctor.json) that the catalog does not cover earns at most ONE refresh, even under a fresh cache;
+ * a model already seen never re-fetches, so a permanently uncovered model cannot become a per-run
+ * fetch. A failed refresh leaves coverage unknown — never "uncovered" — until a successful refresh. Advisory: no config, tier or
+ * routing write; sourced identity records print as inference for confirmation.
+ */
+export async function checkModelDiscovery(input) {
+    const { cfg, health } = input;
+    const prior = readDoctor(input.cwd);
+    const findings = [];
+    // Discovery is every listed model and resolved alias identity, classified or not: an operator's tier
+    // classification never establishes catalog coverage. A claude alias is checked as the identity it
+    // resolved to; one with no resolved identity has nothing a refresh could cover (its row says unknown).
+    const resolvedOf = (adapter, model) => adapter === "claude-code" && model in CLAUDE_ALIAS_IDENTITY_STAMPS ? input.resolved[model] ?? null : undefined;
+    const added = input.adapters.filter((a) => health[a.id]?.installed).flatMap((a) => {
+        const before = seen(prior, a.id);
+        return [...seen(health, a.id)].filter((model) => !before.has(model) && resolvedOf(a.id, model) !== null)
+            .map((model) => ({ adapter: a.id, model, resolvedModel: resolvedOf(a.id, model) ?? undefined }));
+    });
+    const covered = (catalog, row) => resolveCatalogModel(catalog.catalog, { provider: cfg.tiers[row.adapter]?.vendor ?? undefined, model: row.model, resolvedModel: row.resolvedModel }) !== undefined;
+    let catalog = input.catalog;
+    const unknown = persistedUnknown(input.cwd, catalog);
+    if (unknown.length)
+        catalog = { ...catalog, coverageUnknown: unknown };
+    const uncovered = added.filter((row) => !covered(catalog, row));
+    if (uncovered.length && input.mayRefresh) {
+        const refreshed = await refreshCatalogCommand({
+            repoRoot: input.cwd, fetcher: input.fetcher, timeoutMs: CATALOG_REFRESH_TIMEOUT_MS, now: input.now,
+        });
+        const names = (rows) => rows.map((r) => `${r.adapter}:${r.model}`).join(", ");
+        if (refreshed.legs.some((leg) => leg.leg === "models.dev" && leg.status === "updated")) {
+            catalog = refreshed.catalog;
+            const still = uncovered.filter((row) => !covered(catalog, row));
+            findings.push(`catalog coverage refreshed once after discovery added ${uncovered.length} uncovered model(s) (${names(uncovered)})${still.length ? `; still uncovered: ${names(still)}` : "; now covered"} — ${formatCatalogRefreshLegs(refreshed.legs)} (advisory — routing unchanged)`);
+        }
+        else {
+            const keys = [...new Set([...unknown, ...uncovered.map((r) => `${r.adapter}:${r.model}`)])];
+            catalog = { ...catalog, coverageUnknown: keys };
+            mkdirSync(join(input.cwd, stateDirName(input.cwd)), { recursive: true });
+            writeFileSync(unknownPath(input.cwd), JSON.stringify({ modelsDevAt: spineStamp(refreshed.catalog), keys }) + "\n");
+            findings.push(`catalog coverage unknown for ${names(uncovered)} — the one post-discovery refresh failed: ${formatCatalogRefreshLegs(refreshed.legs)} (advisory — routing unchanged)`);
+        }
+    }
+    findings.push(...identityRecordFindings(cfg, health, input.resolved));
+    return { catalog, findings };
+}
+/**
+ * Sourced tier/price/window per resolved alias; unknown and unsourced identities claim nothing. An alias
+ * the probe proved unauthed is not listed as unknown: its model-status row already names why.
+ */
+function identityRecordFindings(cfg, health, resolved) {
+    const configured = cfg.tiers["claude-code"]?.models ?? {};
+    const unknown = [];
+    const rows = [];
+    for (const [alias, identity] of Object.entries(resolved)) {
+        if (!identity) {
+            if (health["claude-code"]?.modelAuth?.[alias]?.authed !== false)
+                unknown.push(alias);
+            continue;
+        }
+        const record = sourcedIdentityRecord(identity);
+        if (!record || record.alias !== alias) {
+            // A record of another alias family is a disagreement, never a record this alias may borrow.
+            rows.push(`identity record: claude-code:${alias} → ${identity} ${record ? `disagrees with the ${alias} family` : "has no sourced record"} — tier/price/window unknown`);
+            continue;
+        }
+        rows.push(`identity record: claude-code:${alias} → ${identity} · $${record.inputCostPerMtok}/$${record.outputCostPerMtok} per Mtok (API) · window ${record.contextWindow}/${record.outputWindow} · sourced ${record.fetchedAt} (${record.sources.join(", ")})`
+            + ` · INFERRED tier ${record.tier} by ${record.tierBasis} — inference for operator confirmation (tickmarkr fleet); doctor writes no configuration`
+            + ` · routing authority: configured claude-code:${alias}=${configured[alias] ?? "unclassified"}`);
+    }
+    if (unknown.length)
+        rows.unshift(`identity record: claude-code:${unknown.join(", ")} identity unknown — no sourced tier/price/window applies`);
+    return rows;
+}
+/**
+ * plan's headline: drift read from the identity doctor PERSISTED for each configured claude alias.
+ * Matching identities stay silent; an alias doctor never resolved stays unknown, never clean.
+ */
+export function aliasIdentityHeadlines(cfg, health) {
+    if (!health["claude-code"]?.installed)
+        return [];
+    const configured = cfg.tiers["claude-code"]?.models ?? {};
+    const unknown = [];
+    const lines = [];
+    for (const [alias, stamped] of Object.entries(CLAUDE_ALIAS_IDENTITY_STAMPS)) {
+        if (!(alias in configured))
+            continue;
+        const identity = observedIdentity(health, "claude-code", alias);
+        if (!identity)
+            unknown.push(alias);
+        else if (identity !== stamped) {
+            lines.push(`alias drift: claude-code:${alias} serves ${identity} (persisted by doctor), stamped identity ${stamped} — reclassify per benchmark policy (advisory — routing unchanged)`);
+        }
+    }
+    if (unknown.length)
+        lines.push(`alias identity unknown: claude-code:${unknown.join(", ")} — doctor persisted no resolved identity (run tickmarkr doctor)`);
+    return lines;
+}

package/dist/adapters/model-lints.d.ts

@@ -27,7 +27,7 @@ declare const RANKED_BASES: readonly ["agentic-coding", "intelligence"];
 type RankedBasis = typeof RANKED_BASES[number];
 export type CatalogSuggestionBasis = RankedBasis | "price";
 export interface CatalogModelAdvisory {
-    coverage: "covered" | "uncovered";
+    coverage: "covered" | "uncovered" | "unknown";
     evidence?: CatalogModelEvidence;
     suggestion?: {
         tier: Tier;

package/dist/adapters/model-lints.js

@@ -183,6 +183,10 @@ export function catalogModelAdvisory(cfg, catalog, adapter, model, resolvedModel
     const row = { adapter, model, resolvedModel };
     const evidence = catalogEvidenceFor(cfg, catalog, row);
     if (!evidence) {
+        // v2.6.5 T9: a failed post-discovery refresh proves nothing about coverage — unknown, never "uncovered".
+        if ([model, resolvedModel].some((m) => m !== undefined && catalog.coverageUnknown?.includes(`${adapter}:${m}`))) {
+            return { coverage: "unknown", display: `${model} — catalog coverage unknown (post-discovery refresh failed); no tier suggestion` };
+        }
         return {
             coverage: "uncovered",
             display: `${model} — uncovered by ${catalog.source === "cache" ? "cached catalogs" : "vendored catalog"}; no tier suggestion`,

package/dist/adapters/prompt.js

@@ -130,8 +130,9 @@ export function parseWorkerResult(raw, nonce) {
 }
 // Signatures anchor distinctive CLI-error phrasing — never bare fragments or bare status-code
 // numbers (the QUOTA_RE Pitfall-3 lesson): these run only over no-trailer output, but a stalled
-// worker's harvested pane can still contain ordinary work text.
-const AUTH_RE = /not logged in|please (?:log ?in|sign in)|please run [^\n]{0,30}log ?in|authentication[ _](?:required|failed|error)|invalid (?:api key|credentials)|api key (?:is )?(?:not set|missing|invalid|required)|credentials? (?:have )?expired|401 unauthorized/i;
+// worker's harvested pane can still contain ordinary work text. E1: the recorded refresh failure
+// ("access token could not be refreshed") is auth-required — classified, never re-probed or relaunched.
+const AUTH_RE = /not logged in|please (?:log ?in|sign in)|please run [^\n]{0,30}log ?in|authentication[ _](?:required|failed|error)|invalid (?:api key|credentials)|api key (?:is )?(?:not set|missing|invalid|required)|credentials? (?:have )?expired|401 unauthorized|access token could not be refreshed/i;
 const SETUP_RE = /command not found|not recognized as an internal or external command|spawn \S+ ENOENT|missing required config|workspace trust (?:required|not granted)/i;
 const OUTAGE_RE = /unable to reach the model provider|cannot reach the model provider|model provider.{0,40}(?:unavailable|unreachable)|service (?:is )?temporarily unavailable|upstream connect error|overloaded_error/i;
 const TIMEOUT_RE = /\bETIMEDOUT\b|request timed out|connection timed out|deadline exceeded|timed out waiting for/i;