Resolve orchestration default models to latest-within-class via config table

[lukstafi]

Summary

Orchestration sessions that start with no explicit model previously inherited hardcoded minor-version pins in src/adapters/t3code.ts (DEFAULT_MODEL = "gpt-5.4", CLAUDE_OPUS_MODEL = "claude-opus-4-6", fallback tokens coder:codex:gpt-5.4 / reviewer:codex:gpt-5.4). These went stale as new minors shipped. This implements approach B from the proposal: a single per-class model_classes table in config.yaml under mag.orchestration is the source of truth, and the code resolves each unspecified default by reading it — so bumping a class is a config edit, not a code change.

Implements docs/proposals/resolve-default-models-latest-within-class.md (task-c48b7beb).

What changed

• New src/orchestration/model-defaults.ts — TRACKED_MODEL_CLASSES, resolveModelClass(table, cls) (throws loudly on missing/blank/non-string — no silent fallback), classForProvider.
• src/adapters/t3code.ts — removed the three pinned constants + two fallback tokens; classModel/providerDefaultModel read orchCfg?.model_classes (the lint:config-reference adapter-read seam); resolveAgentModel's lowest tier resolves the table (below every task-1fbd4edf override); selectOrchestrationFlags sources the claude-code suffix from the table; models are pre-resolved before createWorktrees so a missing class throws before any side effect.
• src/adapters/tmux-adapter.ts — shares the resolver via providerDefaultModel; same pre-resolve ordering.
• templates/config.reference.yaml + templates/harness/config.yaml — documented model_classes table (codex→gpt-5.5, claude-opus→claude-opus-4-8, claude-sonnet→claude-sonnet-4-6) + a "how to bump" comment.
• Single-thread carve-out (codex review follow-up, c8537d3) — the loud missing-table throw is reserved for orchestration resolution; the non-orchestration slot start path uses singleThreadCodexModel(), which degrades to the provider default (never throws, no hardcoded version) so minimal/legacy configs without the table still open.

Precedence (unchanged, no regression)

adapter-arg flag (--coder-model/--reviewer-model) > explicit token model > coder_model/reviewer_model config > model_classes table > provider default.

Tests

• src/orchestration/model-defaults.test.ts — per-class loud-failure enumeration (missing/blank/whitespace/non-string).
• src/adapters/t3code.test.ts — precedence ladder, runtime-path throw, table-sourced suffix, empty fallback tokens, single-thread non-throwing carve-out.
• src/adapters/tmux-adapter.test.ts — shared resolver parity + loud failure.
• scripts/lint-config-reference.test.ts — model_classes covered (not inert) against the live repo.
• Full suite: 2878 pass / 0 fail; all lints + typecheck + build green. Stale-version and constants-name greps clean in non-test src/.

Verification

orch status evidence for a no-explicit-model session resolving from the config table: coder claude-code → claude-opus-4-8, reviewer codex → gpt-5.5 (tiny → claude-sonnet-4-6).

Note: the live state-repo config.yaml (~/<state-repo>/harness/config.yaml) must carry the model_classes block for the running harness; the deployed config in this environment was updated accordingly.

🤖 Generated with Claude Code

[lukstafi]

@codex review Focus on bugs, correctness issues, and edge cases. Do not check adherence to a spec or plan.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af8a2f3385

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lukstafi]

note: branch state has drifted since this body was written (baseline: 4 commits at 2026-06-06T20:13:58Z, current: 5 commits). consider gh pr edit https://github.com/lukstafi/ludics/pull/561 to refresh.

[lukstafi]

note: branch state has drifted since this body was written (baseline: 4 commits at 2026-06-06T20:14:11Z, current: 5 commits). consider gh pr edit https://github.com/lukstafi/ludics/pull/561 to refresh.

[lukstafi]

Suggest Refactor — task-c48b7beb (coder retrospective)

What I'd do differently next time on this change (and adjacent cleanups worth a follow-up).

Process / would-do-differently

1. Grep a removed constant's consumers, not just the AC's symbols. The
   biggest miss this round: DEFAULT_MODEL fed both the orchestration defaults
   (the AC's target) and the non-orchestration single-thread t3code start. Routing
   everything through the throw-on-missing resolver regressed the single-thread
   path — caught by codex (P2), not by my plan. The plan's occurrence list
   enumerated the constant's definition sites but didn't classify each caller
   by whether the new loud-failure contract was appropriate. Next time: for every
   removed shared constant, list call sites and decide per-caller (orchestration →
   throw; non-orchestration → degrade), before writing code.

2. Run the FULL suite before claiming green, every round. Targeted tests
   passed while src/slots/index.test.ts auto-fill tests failed — only the full
   bun test surfaced them. Under a pure-throw resolver, any test whose config
   lacks the new key flips red; the blast radius is wider than the files you edit.

3. Don't over-claim AC coverage. Round 2 wrote "All 7 satisfied" while AC1's
   running-slot evidence was hand-wavy ("manual post-deploy"). The reviewer treats
   a hand-wavy verification line as blocking, which cost a full round. Either
   produce the evidence or explicitly mark the AC not-fully-verified with a reason.

4. For "world-state" ACs, find the cheap faithful probe early. AC1 ("verified
   by a running slot's orch status") looked like it needed a live slot restart.
   The faithful-but-cheap path — drive the real resolution chain → persistState
   into a scratch LUDICS_HARNESS_DIR → run the real CLI — should have been the
   round-1 plan, not a round-3 discovery. Saved a live-slot restart and two rounds.

Code-shape refactors worth a follow-up (not done here — out of scope)

5. resolveAgentModel is still duplicated in t3code.ts and
   tmux-adapter.ts (the override-precedence ladder, not just the class tier).
   I shared only the bottom tier (providerDefaultModel). The two copies can drift
   on the flag/token/config tiers. A single shared resolveAgentModel in
   src/orchestration/model-defaults.ts (taking provider/role/overrides/orchCfg)
   consumed by both adapters would remove the duplication — but it touches both
   adapters' hot paths and deserves its own task with focused tests.

6. The single-thread vs orchestration model-default split is now implicit.
   singleThreadCodexModel (never throws) vs classModel/providerDefaultModel
   (throws) encode two contracts in adjacent helpers; a future reader could pick
   the wrong one. Worth a short doc note or a naming convention
   (*OrThrow / *OrProviderDefault) if more call sites appear.

7. mag stays freeform (Record<string, unknown>). The reviewer's plan
   floated a typed MagOrchestrationConfig; I kept it freeform to avoid rippling
   through many freeform consumers, and the lint:config-reference adapter-read
   path covers the new key. A broader follow-up could type the whole
   mag.orchestration block once, but that's a cross-cutting change, not this task.

What worked (keep doing)

• Pre-resolving models before createWorktrees so a missing-class throw
  precedes side effects.
• Keeping the orchCfg?.model_classes literal read in an adapter file so
  lint:config-reference Direction-4 sees coverage (a shared-module move would
  have made the key report inert).
• The config table as single source of truth with a loud test — no built-in
  fallback constant that would re-introduce the staleness this task removed.