nyldn/claude-octopus v9.55.0

v9.55.0 — Opus 5 default routing and resilient Council/Tangle workflows

on GitHub

Added

• Frontier model routing strategy and prompt policy (docs/MODEL-ROUTING-STRATEGY.md, docs/GPT-5.6-PROMPTING.md, skills/blocks/frontier-model-routing.md): defines Opus 5 as the premium lead, GPT-5.6 Sol as the independent implementation/review peer, Sonnet 5 as the standard Claude seat, and Fable 5 as an explicit capability escalation rather than an automatic default.

• Cross-harness continuity contract (AI_AGENT_HANDOFF.md, AGENTS.md, CLAUDE.md): gives Claude Code, Codex, Copilot, OpenCode, and other coding agents one committed resume point for active decisions, evidence, blockers, verification, and branch state while retaining Beads as the task system of record.

• Tangle now has an explicit verification-only mode (#675). orchestrate.sh verify "<prompt>" diagnoses the committed baseline in a disposable detached worktree, accepts only a structured and internally consistent result, reports VERIFIED_NO_CHANGE, DEFECT_REPRODUCED, or NEEDS_DIAGNOSIS, and never launches implementation agents or preserves diagnostic writes.

• Tangle implementation runs now execute in an isolated Git worktree by default (#673). Each real run gets a deterministic octopus/run/<run-id>/integration branch, records source and run metadata, reuses that run ID for delegated tasks and validation artifacts, resolves caller-relative ignored context before changing worktrees, restores the caller's project context afterward, and preserves failed worktrees for inspection; setup failures roll back both the worktree and branch.

• Councils configure per-seat dispatch timeouts and salvage a finished review from a non-zero dispatch (#667). A single global timeout was too tight for large-diff reviews and the strict pass/fail dispatch check discarded seats that had already written a complete VERDICT:-bearing response but were killed at the boundary. council_seat_timeout now resolves most-specific-first (OCTOPUS_COUNCIL_TIMEOUT_<PROVIDER> > the run-wide --seat-timeout flag > the legacy OCTOPUS_COUNCIL_AGENT_TIMEOUT > a 120s default), so a slow provider such as agy can be given more room without loosening the others. The advice phase now counts a seat whose response is non-empty, substantive, and carries an explicit verdict even when its dispatch return code was non-zero, so a complete review is no longer thrown away as a shortage.

• Council summary.json now records a per-seat seats[] array, making quorum integrity machine-checkable without reading responses/* by hand. Each advice seat carries seat (role), provider, provider_org, model, response_bytes, payload_kind (currently full), verdict, status (responded / degenerate / empty / no-response), and counted_as_approver. distinct_approving_providers is recomputable as the count of distinct providers among seats where counted_as_approver is true — so a chair or degenerate seat can no longer masquerade as a distinct approving vendor. First of the sail-cruisey #2077 council-runner reliability fixes; later fixes extend payload_kind (agy chunking) and status (timeout/degraded).

Changed

• Real Tangle implementation runs now require a clean Git baseline by default (#674). Modified tracked files, untracked files, and non-Git workspaces fail before provider dispatch with each blocking status entry reported; ignored files remain allowed and direct library consumers may explicitly opt out with OCTOPUS_TANGLE_REQUIRE_CLEAN_BASELINE=false.
• Current-model defaults now prefer Opus 5, Sonnet 5, and GPT-5.6 when the installed Claude Code and Codex versions support them. Fresh provider configurations use GPT-5.6 Sol/Terra/Luna and Opus 5/Sonnet 5/Haiku 4.5; existing environment, session, and providers.json pins retain precedence.
• Fable 5 remains opt-in and falls back to Opus 5 for security routing or a refusal/empty response. OCTOPUS_FABLE5_FALLBACK_MODEL can select another fallback, and automatic Opus 5 xhigh phase routing is now opt-in through OCTOPUS_OPUS5_AUTO_XHIGH=1.
• Provider capability gates and cost reporting recognize the new roster: Sonnet 5 requires Claude Code v2.1.197+, Opus 5 requires v2.1.219+, and GPT-5.6 routing requires Codex CLI v0.144.0+.

Fixed

• A council advice seat now survives an interrupt to the council process instead of dying mid-write (#669). Advice seats ran inline in the council's own process group, so a SIGHUP/SIGINT/SIGTERM to the council (a Claude Code tool timeout, a user Ctrl-C, an orchestrator-level signal) propagated to the in-flight provider child, killing it mid-write and leaving a torn response file — the council then hung or reported a false provider shortage. council_dispatch_member_detached now runs each advice/chair-fallback seat in a signal-isolated, disowned background subshell (trap '' HUP INT TERM + disown — the portable equivalent of setsid, which is absent on macOS) that writes to a .partial file and atomically renames it into place on completion, dropping a .done sentinel that carries the exit code. Reaping uses the same per-provider timeout as dispatch, and timeout cleanup kills the provider process tree before removing temporary artifacts so no stale response can publish later. Seats still run one at a time; this is a reliability change, not a concurrency change. Set OCTOPUS_COUNCIL_DETACH=0 to restore the legacy inline dispatch.
• The chair seat no longer counts toward the distinct-approving-vendor quorum (#670). council_run_advice_phase added every substantive seat's provider to the responding/approving vendor sets, including the chair. Because the chair is the synthesizer rather than an independent cross-lab reviewer — and the count gate already excludes it via received_non_chair — a chair-only vendor could inflate distinct_approving_providers, letting a single independent approver plus the chair's own vendor pass a 2-vendor quorum. The vendor tally now skips the chair seat (the chair-fallback path never added to it either), so seats[] and quorum stay consistent and a chair-only approving vendor no longer satisfies consensus. A vendor that also holds an independent seat still counts through that seat, so the exclusion is seat-scoped, not vendor-scoped. The #577 quorum tests are unaffected (provider diversity is enforced among non-chair seats).
• Tangle now stops immediately when its validation gate fails (#672). A failed validation no longer falls through into contextual review and correction agents, preventing additional writes after the run has already been declared invalid while preserving the generated validation report for diagnosis.
• An oversized council prompt to agy now degrades to a structured skip instead of OOM-killing the seat (#2077). The adapter's existing file-path fallback sidesteps the argv MAX_ARG_STRLEN limit but not agy itself — a multi-megabyte prompt is loaded whole into agy's context and OOM-kills the headless process (or is rejected by the backend for context length), leaving the seat dead with an opaque exit code or a silent-empty result the retry cannot recover. agy-exec.sh now enforces a configurable payload ceiling (OCTOPUS_AGY_MAX_PAYLOAD_BYTES, default 1 MiB): above it, the adapter refuses to dispatch, exits 0, and emits a provider-rejection marker that classify_agent_output already recognizes, so dispatch records a structured skipped:oversize seat and the council keeps its remaining seats rather than crashing on this one. The ceiling is measured in bytes on the exact prompt content agy would read.