[codex] Add governed Claude model profiles

.claude/skills/opusminimax/SKILL.md

@@ -41,6 +41,10 @@ Worker summaries are claims until verified by diffs, logs, tests, or artifacts.
 - If `executor_provider=claude-sonnet` is explicit, treat it as the optional
   Claude-only `/opussonnet` route: no MiniMax base URL, executor model must be
   Sonnet, and the run artifact must not imply MiniMax executed anything.
+- If `model_profile=sonnet|opus|default|custom` is explicit, treat it as a
+  governed Anthropic-only route: no MiniMax base URL, no MiniMax executor model,
+  and no runtime model identity claim without `/status`, sentinel, or artifact
+  proof.
 - Run `/introspect` before plan freeze, after executor execution, after failed
   verification, and before push or ship decisions.
 - Run `/verify` against `SPEC.md` after executor aggregation.
@@ -68,6 +72,8 @@ Record:
 
 - planner profile path and whether it is provider-neutral
 - executor profile path and whether it uses `MiniMax-M2.7-highspeed`
+- selected `model_profile` and whether it is default cost-optimized or an
+  explicit user override
 - requested planner model
 - requested executor model
 - local capacity ceiling
@@ -207,6 +213,7 @@ When `/opusminimax` executes or prepares a real run, produce:
   "run_id": "YYYYMMDD-HHMMSS-task",
   "outer_route": "opusworkflow",
   "inner_contract": "workflow",
+  "model_profile": "minimax",
   "executor_provider": "minimax",
   "planner_identity_status": "blocked",
   "executor_identity_status": "configured",
@@ -219,6 +226,12 @@ When `/opusminimax` executes or prepares a real run, produce:
     "planner_requested": "claude-opus-4-7",
     "executor_requested": "MiniMax-M2.7-highspeed"
   },
+  "model_route": {
+    "profile": "minimax",
+    "planner": {"provider": "anthropic", "requested_model": "claude-opus-4-7", "identity_status": "blocked"},
+    "executor": {"provider": "minimax", "requested_model": "MiniMax-M2.7-highspeed", "identity_status": "configured"},
+    "fallback_policy": "fail-closed-unless-explicit"
+  },
   "capacity": {
     "local_ceiling": 10,
     "provider_ceiling": 1,

.claude/skills/opussonnet/SKILL.md

@@ -25,6 +25,8 @@ MiniMax is not required for this optional route.
 - This is a suggested alternative, not the standard default. The default
   `/opusworkflow` route remains Claude/Opus judgment plus MiniMax-M2.7-highspeed
   execution.
+- It is also available as `/opusworkflow --model-profile opussonnet` or the
+  backward-compatible `/opusworkflow --executor-provider claude-sonnet`.
 - Use the same governed `/workflow` lifecycle: research brief, SPEC, bounded
   implementation, `/introspect`, `/verify`, and command-backed closeout.
 - Use Claude Code's `opusplan` behavior for the interactive session when
@@ -75,6 +77,12 @@ claude
 /opussonnet "build or fix the thing"
 ```
 
+Equivalent static artifact preparation:
+
+```bash
+bash scripts/opusworkflow.sh --task "build or fix the thing" --model-profile opussonnet
+```
+
 ## Anti-Patterns
 
 - Presenting `opussonnet` as the default MiniMax-backed budget strategy.

.claude/skills/opusworkflow/SKILL.md

@@ -26,13 +26,26 @@ Optional Claude-only sibling:
 Opus 4.7 planning/judgment and Sonnet 4.6 execution, with no MiniMax token.
 ```
 
+Model-profile selector:
+
+```text
+--model-profile minimax    # default: Opus judgment + MiniMax execution
+--model-profile opussonnet # Opus judgment + Sonnet execution
+--model-profile sonnet     # Sonnet planning + Sonnet execution
+--model-profile opus       # Opus planning + Opus execution, explicit high-cost route
+--model-profile default    # Claude Code account default
+--model-profile custom --planner-model MODEL --executor-model MODEL
+```
+
 ## Contract
 
 - Treat `/opusworkflow` as `/opusminimax --mode workflow` with stricter budget
   defaults and as the normal daily route for all mutating work in this harness.
 - Keep MiniMax as the standard executor provider. Use `/opussonnet` or
   `--executor-provider claude-sonnet` only when the operator explicitly wants
   the optional Claude-only route.
+- Allow explicit model freedom through `--model-profile`; treat it as a
+  governed route request, not runtime identity proof.
 - Record the specialist being executed as
   `inner_contract=workflow|agentfactory|hiveworkflow|parallel|defineicp|deepretaste|demo|visualizeworkflow`.
 - If the task asks for Hermes, Hive, ICP/taste mutation, approved
@@ -86,6 +99,15 @@ execution: claude-sonnet-4-6 through opusplan/Sonnet profile
 MiniMax token: not required
 ```
 
+Explicit Anthropic-only profiles:
+
+```text
+sonnet: claude-sonnet-4-6 for planning and execution
+opus: claude-opus-4-7 for planning and execution; use intentionally
+default: Claude Code account default; confirm with /status before claims
+custom: explicit planner/executor model IDs; static gates only prove request shape
+```
+
 ## Workflow
 
 1. Run provider/capacity preflight:
@@ -117,6 +139,14 @@ For the optional Claude-only executor:
 bash scripts/opusworkflow.sh --task "$ARGUMENTS" --executor-provider claude-sonnet
 ```
 
+For explicit model profiles:
+
+```bash
+bash scripts/opusworkflow.sh --task "$ARGUMENTS" --model-profile sonnet
+bash scripts/opusworkflow.sh --task "$ARGUMENTS" --model-profile opus
+bash scripts/opusworkflow.sh --task "$ARGUMENTS" --model-profile custom --planner-model claude-sonnet-4-6 --executor-model claude-sonnet-4-6
+```
+
 4. MiniMax executes only planner-approved packets with owned paths,
    forbidden paths, allowed commands, acceptance checks, rollback notes, and
    stop conditions.

.taste/fixtures/artifact-lint/green/valid-sonnet-model-profile-run.json

@@ -0,0 +1,67 @@
+{
+  "artifact_type": "opusminimax-run",
+  "run_id": "20260507-150000-sonnet-profile",
+  "outer_route": "opusworkflow",
+  "inner_contract": "workflow",
+  "model_profile": "sonnet",
+  "executor_provider": "anthropic",
+  "planner_identity_status": "blocked",
+  "executor_identity_status": "configured",
+  "fallback_status": "explicit_user_override",
+  "provider_profiles": {
+    "planner": {
+      "path": ".claude/settings.opusminimax-planner.example.json",
+      "anthropic_base_url": "",
+      "model": "claude-sonnet-4-6"
+    },
+    "executor": {
+      "path": ".claude/settings.opusminimax-planner.example.json",
+      "anthropic_base_url": "",
+      "model": "claude-sonnet-4-6",
+      "provider": "anthropic"
+    }
+  },
+  "model_ids": {
+    "planner_requested": "claude-sonnet-4-6",
+    "executor_requested": "claude-sonnet-4-6"
+  },
+  "model_route": {
+    "profile": "sonnet",
+    "planner": {
+      "provider": "anthropic",
+      "requested_model": "claude-sonnet-4-6",
+      "identity_status": "blocked"
+    },
+    "executor": {
+      "provider": "anthropic",
+      "requested_model": "claude-sonnet-4-6",
+      "identity_status": "configured"
+    },
+    "fallback_policy": "fail-closed-unless-explicit"
+  },
+  "capacity": {
+    "local_ceiling": 10,
+    "provider_ceiling": 1,
+    "task_packet_count": 1,
+    "safety_cap": 1,
+    "effective_concurrency": 1
+  },
+  "packets": [
+    "P1"
+  ],
+  "verification": {
+    "status": "runtime-pending",
+    "commands_run": [
+      "bash scripts/opusworkflow.sh --task ... --model-profile sonnet"
+    ],
+    "closeout_status": "runtime-pending"
+  },
+  "failures": [],
+  "retries": 0,
+  "final_confidence": "medium",
+  "model_identity_confirmed": false,
+  "claims": {
+    "opus_planned": false,
+    "runtime_model_calls": false
+  }
+}

AGENTS.md

@@ -12,6 +12,7 @@ This repo is optimized for Claude Code first, but it also ships project-scoped C
 - For `/deepretaste`, run a governed intent-to-ICP-to-taste bootstrap or retaste workflow, not a generic persona generator. Keep `/deepresearch` available for non-taste research such as architecture, debugging, benchmarks, provider behavior, market work, and product strategy; `/deepretaste` uses it only when findings will shape intent, ICP, or taste-kernel decisions. Detect product scope with evidence, compute an effective parallel or hive budget as a ceiling, define primary/secondary/anti-ICPs, and route fresh missing kernels through `/tastebootstrap`. Existing `taste.md` and `taste.vision` must use `/defineicp` proposal/apply semantics: no mutation by default, exact apply approval, backups, hashes, changed-line trace, protected-kernel preservation, validation, and rollback evidence.
 - For `/defineicp`, run a governed ICP-to-taste evolution workflow. Define primary, secondary, and anti-ICPs with deepresearch discipline, claim/source ledgers, buyer/user distinction, JTBD, disqualifiers, and missing-evidence labels. Default to proposal mode: draft ICP artifacts and `taste.md` / `taste.vision` patch proposals without mutation. Apply only with explicit approval, backups, hashes, changed-line trace, protected-kernel preservation, validation, and rollback evidence.
 - For `/opusworkflow`, use the recommended cost-optimized end-to-end route for a Claude subscription plus MiniMax Plus-Highspeed Token Plan. It wraps `/opusminimax --mode workflow`: Claude/Opus is used sparingly for plan/spec freeze, adversarial review, and final ship/no-ship judgment when model identity is proven; MiniMax-M2.7-highspeed handles bulk coding, repair loops, and exploration packets. Default executor concurrency to 1 for Plus-Highspeed unless runtime provider evidence proves a higher safe ceiling. Never claim the $20 Claude plan guarantees Opus, never silently enable PAYG, and never treat local 10-lane capacity as MiniMax provider capacity.
+- For explicit Claude model choice, `/opusworkflow` may use `--model-profile minimax|opussonnet|sonnet|opus|default|custom`. Treat this as a governed model request, not runtime proof. The default remains `minimax`; Anthropic-only profiles must not inherit MiniMax base URLs or MiniMax model IDs, and Opus/Sonnet identity still needs `/status`, sentinel, or artifact evidence before claims.
 - For `/opussonnet`, use the optional Claude-only suggested route installed by `setup.sh --mode opussonnet`. It keeps the same governed workflow but requests Claude Code `opusplan`, pins `claude-opus-4-7` for plan/judgment and `claude-sonnet-4-6` for execution, requires no MiniMax token, and must never be described as the default MiniMax-backed budget strategy. Runtime Opus/Sonnet identity remains account-dependent and must be proven before claims.
 - For ordinary build/plan tasks in this harness, treat `/opusworkflow` as the default outer route unless the user explicitly requests plain `/workflow`, the provider split is unavailable, or the task is analysis-only. Plain `/workflow` remains the underlying governed lifecycle and manual fallback.
 - For any mutating specialist route, keep `/opusworkflow` as the default outer route and record the specialist as the inner contract. Examples: use `/opusworkflow "run this as a governed /agentfactory workflow: ..."` for Hermes agents, `/opusworkflow "run this as a /hiveworkflow with role map, blackboard, dissent log, packet ownership, and verification: ..."` for file-changing hive work, and `/opusworkflow --inner-contract defineicp|deepretaste|demo|visualizeworkflow` semantics for specialist mutation. Direct specialist commands are still valid when explicitly invoked, but they inherit the same Claude/Opus planner-reviewer plus MiniMax executor policy by default.

CLAUDE.md

@@ -29,7 +29,8 @@ We prioritize getting it right over getting it done fast. Parallel agents only h
 17. **Release Governance**: Public harness changes must pass `scripts/release-check.sh --static-only`; authenticated runtime checks stay explicit and secret-gated
 18. **OpusMiniMax Split**: `/opusminimax` uses Claude/Opus for bounded planning, adversarial review, and verification while MiniMax-M2.7-highspeed executes bounded packets. Provider identity lives in ignored local profiles, not shared `.claude/settings.json`.
 19. **OpusWorkflow Default**: `/opusworkflow` is the cost-optimized daily route over `/opusminimax --mode workflow` and the default for all mutating work: Opus only at judgment gates when proven available, MiniMax for bulk execution, executor concurrency 1 by default for Plus-Highspeed. Mutating specialist routes keep their own contracts as `inner_contract` values under this outer route.
-20. **OpusSonnet Option**: `/opussonnet` is an optional Claude-only suggested route for installs created with `setup.sh --mode opussonnet`. It requests Claude Code `opusplan`, pins Opus 4.7 for planning/judgment and Sonnet 4.6 for execution, and requires no MiniMax token. Do not present it as the default MiniMax-backed budget strategy or claim runtime model identity without proof.
+20. **Model Profile Freedom**: `/opusworkflow --model-profile minimax|opussonnet|sonnet|opus|default|custom` lets the operator choose Claude model routing without changing the default. Anthropic-only profiles must stay provider-neutral and never claim runtime identity without proof.
+21. **OpusSonnet Option**: `/opussonnet` is an optional Claude-only suggested route for installs created with `setup.sh --mode opussonnet`. It requests Claude Code `opusplan`, pins Opus 4.7 for planning/judgment and Sonnet 4.6 for execution, and requires no MiniMax token. Do not present it as the default MiniMax-backed budget strategy or claim runtime model identity without proof.
 
 ## Default Behavior
 
@@ -50,6 +51,8 @@ We prioritize getting it right over getting it done fast. Parallel agents only h
 
 **When you say `/opusworkflow` or give a normal build/plan task:** run `/opusminimax` in workflow mode with stricter cost policy: use Opus only for plan/spec freeze, adversarial review, and final judgment when identity is proven; use MiniMax-M2.7-highspeed for coding packets and repair loops; keep Plus-Highspeed executor concurrency at 1 unless provider evidence proves more.
 
+**When you specify a model profile:** honor `/opusworkflow --model-profile sonnet|opus|opussonnet|default|custom` as an explicit operator choice while keeping the same SPEC, introspection, verification, no-secret, and runtime-identity-proof rules.
+
 **When you say `/opussonnet`:** run the same governed lifecycle as `/opusworkflow`, but use the optional Claude-only contract: Claude Code `opusplan`, `claude-opus-4-7` for planning/judgment, and `claude-sonnet-4-6` for execution. Do not require a MiniMax token, and do not claim runtime model proof without `/status`, a sentinel, or artifact evidence.
 
 **When you request a governed Hermes agent, hive workflow, ICP/taste mutation, visualization continuation, or demo-producing work:** keep `/opusworkflow` as the outer route and apply the specialist as the inner contract. Direct `/agentfactory`, `/hiveworkflow`, `/defineicp`, `/deepretaste`, `/visualizeworkflow --continue`, and `/demo` invocations remain allowed, but they must inherit the same Opus planner-reviewer plus MiniMax executor policy before mutating files.
@@ -136,6 +139,7 @@ We prioritize getting it right over getting it done fast. Parallel agents only h
 - **Security Profiles**: Validate profile examples with `bash scripts/security-smoke.sh`; the committed project default is trusted-local `bypassPermissions`, while `team-safe` remains the shared-work fallback and `solo-fast` documents the fast solo posture.
 - **OpusMiniMax Profiles**: `.claude/settings.json` is provider-neutral. Use ignored planner/executor local profiles copied from `.claude/settings.opusminimax-planner.example.json` and `.claude/settings.minimax-executor.example.json`; never claim Opus involvement unless runtime identity is proven.
 - **OpusWorkflow Budget**: `/opusworkflow` is the mutating-work default for the $20 Claude + $40 MiniMax strategy. It must not run Opus as a bulk executor, must not silently use PAYG, and must record `outer_route`, `inner_contract`, `planner_identity_status`, `executor_identity_status`, `fallback_status`, and `provider_ceiling=1` until runtime MiniMax tier evidence proves a higher safe executor budget.
+- **Governed Model Profiles**: Explicit `--model-profile sonnet|opus|opussonnet|default|custom` overrides are allowed, but the artifact must record `model_profile`, `model_route`, requested planner/executor models, provider boundaries, and identity status. Static profile selection is not runtime proof.
 - **OpusSonnet Suggested Profile**: `.claude/settings.opussonnet.example.json` and `.claude/settings.sonnet-executor.example.json` are optional Claude-only profiles. They pin `opusplan`, `claude-opus-4-7`, and `claude-sonnet-4-6`, and must not contain MiniMax base URLs or credentials.
 - **Opus Runtime Proof**: A Claude subscription login plus exact `OPUSWORKFLOW_AUTH_OK` sentinel from `claude --model claude-opus-4-7` proves the planner side for the current account state. MiniMax executor runtime is a separate proof and must not be implied by the Opus check.
 - **Release Gate**: `bash scripts/release-check.sh --static-only` runs the no-secret public harness gate. Runtime checks belong to the manual/scheduled workflow.