From efe5adb2220e729e9225f0d0d2e3f5160b8f21cf Mon Sep 17 00:00:00 2001
From: Chris Henesy <chris@heartofgoldventures.com>
Date: Mon, 5 Oct 2026 13:53:01 -0400
Subject: [PATCH 1/4] test(failing): 0064 model roles observations

Add tests/model-roles.test.sh: executes every scripts/lib/models.sh
function in a clean env -i shell against fixture TDDs, a Claude
transcript and a Grok summary.json (TDD 0064 Verification plan
observations 1-15), and pins the fresh-worker independence wording in
the design-reviewer, /tdd-author 7b and plugin.json. Register it in the
implement-gate aggregator. build-tdds-skill [D] now asserts the no-arg
resolve line build=inherit review=inherit verify=inherit.

Red against the unchanged models.sh (prior-gen pairing).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ki3TDnP2bNqqpEkFoZaEXq
---
 tests/build-tdds-skill.test.sh |  13 +-
 tests/implement-gate.test.sh   |   8 +-
 tests/model-roles.test.sh      | 248 +++++++++++++++++++++++++++++++++
 3 files changed, 261 insertions(+), 8 deletions(-)
 create mode 100755 tests/model-roles.test.sh

diff --git a/tests/build-tdds-skill.test.sh b/tests/build-tdds-skill.test.sh
index 500458f..411ccd8 100755
--- a/tests/build-tdds-skill.test.sh
+++ b/tests/build-tdds-skill.test.sh
@@ -50,18 +50,21 @@ echo "[C] skill names require_flip, next_gate, tokens, no nested spawn"
     || bad "missing 'must not spawn children'"
 ) || true
 
-# --- [D] models.sh is the ADR 0009 binding site ------------------------------
-echo "[D] models.sh binds tl_resolve_models"
+# --- [D] models.sh is the ADR 0015 binding site (TDD 0064) -------------------
+# No pins (incl. CLAUDE_CODE_SUBAGENT_MODEL), no session id, no args → every
+# judgment slot inherits the parent session's model.
+echo "[D] models.sh binds tl_resolve_models (inherit by default)"
 ( bash -n "$MODELS" 2>"$ROOT/D.err" \
     && ok "models.sh parses" \
     || bad "models.sh bash -n failed: $(cat "$ROOT/D.err" 2>/dev/null)"
   if env -u GROK_PLUGIN_ROOT -u THROUGHLINE_BUILD_MODEL \
         -u THROUGHLINE_REVIEW_MODEL -u THROUGHLINE_RUNTIME_VERIFY_MODEL \
+        -u CLAUDE_CODE_SUBAGENT_MODEL -u CLAUDE_CODE_SESSION_ID \
         bash -c "source \"$MODELS\"; tl_resolve_models" >"$ROOT/D.out" 2>"$ROOT/D2.err"; then
     out="$(cat "$ROOT/D.out")"
-    printf '%s' "$out" | grep -qE '^build=.+ review=.+ verify=.+$' \
-      && ok "prints build= review= verify= ($out)" \
-      || bad "unexpected resolve line: $out"
+    [ "$out" = "build=inherit review=inherit verify=inherit" ] \
+      && ok "no-arg line is build=inherit review=inherit verify=inherit" \
+      || bad "unexpected resolve line: '$out' want 'build=inherit review=inherit verify=inherit'"
   else
     bad "tl_resolve_models failed: $(cat "$ROOT/D2.err")"
   fi
diff --git a/tests/implement-gate.test.sh b/tests/implement-gate.test.sh
index 7ba2bca..05b45c34 100755
--- a/tests/implement-gate.test.sh
+++ b/tests/implement-gate.test.sh
@@ -6,7 +6,8 @@
 #
 # Coprocess/runner evals were removed with the implement.sh body (TDD 0063+).
 # This aggregator keeps the 0063 stub/status observations and the live
-# 0060–0062 helpers: plugin-root, verdicts, run-record, build-tdds-skill.
+# 0060–0062 helpers: plugin-root, verdicts, run-record, build-tdds-skill,
+# and the 0064 model-roles eval.
 #
 # Run: bash tests/implement-gate.test.sh
 set -uo pipefail
@@ -189,9 +190,10 @@ PASS="$(grep -c '^ok$'   "$RESULTS" 2>/dev/null)"; PASS="${PASS:-0}"
 FAIL="$(grep -c '^fail$' "$RESULTS" 2>/dev/null)"; FAIL="${FAIL:-0}"
 echo "=== 0063 observations: $PASS passed, $FAIL failed ==="
 
-# 0060–0062 evals (kept). Each file is invoked only when it exists.
+# 0060–0062 evals (kept) + 0064 model-roles. Each file is invoked only when
+# it exists.
 EVAL_FAIL=0
-for ev in plugin-root verdicts run-record build-tdds-skill; do
+for ev in plugin-root verdicts run-record build-tdds-skill model-roles; do
   f="$(dirname "$0")/${ev}.test.sh"
   if [ -f "$f" ]; then
     echo
diff --git a/tests/model-roles.test.sh b/tests/model-roles.test.sh
new file mode 100755
index 0000000..a56444b
--- /dev/null
+++ b/tests/model-roles.test.sh
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+# model-roles.test.sh — eval for TDD 0064 / NFR-3, FR-52, FR-87, FR-10,
+# FR-15(d), FR-50: EXECUTES every scripts/lib/models.sh function in a clean
+# `env -i HOME=<tmp> PATH="$PATH" bash -c '. models.sh; …'` shell against
+# fixture TDDs, Claude transcripts and a Grok summary.json (no network), and
+# pins the fresh-worker independence wording (design-reviewer, /tdd-author 7b,
+# plugin.json). Observation numbers [1]–[15] are the TDD's Verification plan.
+#
+# Written red-first. Run: bash tests/model-roles.test.sh
+set -uo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+MODELS="$REPO/scripts/lib/models.sh"
+DR="$REPO/agents/design-reviewer.md"
+TA="$REPO/skills/tdd-author/SKILL.md"
+PJ="$REPO/.claude-plugin/plugin.json"
+RESULTS="$(mktemp)"; export RESULTS
+ok()  { printf 'ok\n'   >>"$RESULTS"; printf '  ok   — %s\n' "$1"; }
+bad() { printf 'fail\n' >>"$RESULTS"; printf '  FAIL — %s\n' "$1"; }
+
+ROOT="$(mktemp -d)"; trap 'rm -rf "$ROOT" "$RESULTS"' EXIT
+H="$ROOT/home"; mkdir -p "$H"
+q() { printf '%q' "$1"; }
+
+# m [VAR=val ...] '<cmds>' — source models.sh then run <cmds> in a CLEAN shell
+# (env -i: no caller variable or function leaks in). A later PATH=/HOME= in the
+# VAR list overrides the default. Sets OUT, ERR, RC, NL (stdout line count).
+m() {
+  local cmd="${!#}"
+  local -a envs=("${@:1:$#-1}")
+  env -i HOME="$H" PATH="$PATH" ${envs[@]+"${envs[@]}"} \
+    bash -c ". $(q "$MODELS") || exit 97; $cmd" >"$ROOT/out" 2>"$ROOT/err"
+  RC=$?
+  OUT="$(cat "$ROOT/out")"; ERR="$(cat "$ROOT/err")"
+  NL="$(wc -l <"$ROOT/out" | tr -d ' ')"
+}
+# eq <label> <want> — rc 0 and stdout is exactly one line equal to <want>.
+eq() {
+  if [ "$RC" -eq 0 ] && [ "$NL" = 1 ] && [ "$OUT" = "$2" ]; then ok "$1 → $2"
+  else bad "$1: rc=$RC lines=$NL out='$OUT' want '$2' (err: $ERR)"; fi
+}
+# unreadable <label> <reason|-> — rc 1, no stdout, one stderr line
+# `tl_parent_model: …` containing <reason> (- = any reason).
+unreadable() {
+  if [ "$RC" -eq 1 ] && [ -z "$OUT" ] && [ "$(printf '%s\n' "$ERR" | grep -c .)" = 1 ] \
+     && printf '%s' "$ERR" | grep -q '^tl_parent_model: ' \
+     && { [ "$2" = - ] || printf '%s' "$ERR" | grep -qF "$2"; }; then
+    ok "$1 → rc 1 ($ERR)"
+  else bad "$1: rc=$RC out='$OUT' err='$ERR' want rc 1 + '$2'"; fi
+}
+
+MECH="$ROOT/mech.md"; NONT="$ROOT/nontrivial.md"
+printf '# TDD 9001: fixture\n\n## Verification plan\n- Run `tool --check`; exit code 0 and stdout has `ok`.\n\n## Touched files\n' >"$MECH"
+printf '# TDD 9002: fixture\n\n## Verification plan\n- Drive the browser UI with playwright and take a screenshot.\n\n## Touched files\n' >"$NONT"
+
+echo "[0] models.sh sources cleanly and binds the function table"
+( bash -n "$MODELS" 2>"$ROOT/n.err" && ok "models.sh parses (bash -n)" \
+    || bad "models.sh bash -n failed: $(cat "$ROOT/n.err" 2>/dev/null)"
+  m 'for f in tl_model_harness tl_light_model tl_escalation_model tl_model_family tl_model_tier tl_parent_model tl_parent_effort tl_plan_class tl_resolve_models tl_model_sources _tl_resolve_slot; do [ "$(type -t "$f")" = function ] || echo "missing $f"; done'
+  [ "$RC" -eq 0 ] && [ -z "$OUT" ] && [ -z "$ERR" ] && ok "all functions defined; source is silent" \
+    || bad "rc=$RC out='$OUT' err='$ERR'"
+  mkdir -p "$ROOT/lone"; cp "$MODELS" "$ROOT/lone/models.sh"
+  env -i HOME="$H" PATH="$PATH" bash -c ". $(q "$ROOT/lone/models.sh")" >/dev/null 2>"$ROOT/lone.err"; rc=$?
+  [ "$rc" -ne 0 ] && grep -q 'FATAL' "$ROOT/lone.err" && ok "missing plan-classifier.sh → FATAL, rc≠0" \
+    || bad "lone models.sh rc=$rc err=$(cat "$ROOT/lone.err")"
+  m 'tl_model_harness'; eq "tl_model_harness (claude)" claude
+  m GROK_PLUGIN_ROOT=/tmp 'tl_model_harness'; eq "tl_model_harness (GROK_PLUGIN_ROOT set)" grok
+  m "tl_plan_class $(q "$MECH")"; eq "tl_plan_class mechanical fixture" mechanical
+  m "tl_plan_class $(q "$NONT")"; eq "tl_plan_class nontrivial fixture" nontrivial
+  m 'tl_plan_class'; eq "tl_plan_class no path" nontrivial
+  m "tl_plan_class $(q "$ROOT/absent.md")"; eq "tl_plan_class missing file (classifier rc≠0)" nontrivial
+) || true
+
+echo "[1] no pins, Claude, no tdd-path → everything inherits the parent"
+( m 'tl_resolve_models'; eq "[1] tl_resolve_models" "build=inherit review=inherit verify=inherit"
+  m 'tl_model_sources'; eq "[1] tl_model_sources" "build_src=parent review_src=parent verify_src=parent"
+  m "tl_resolve_models $(q "$MECH") ''"; eq "[1] mechanical + empty parent" "build=inherit review=inherit verify=inherit"
+  m "tl_model_sources $(q "$MECH") ''"; eq "[1] mechanical + empty parent sources" "build_src=parent review_src=parent verify_src=parent-cap"
+) || true
+
+echo "[2]-[4] runtime-verify tier: light only below an above-light parent"
+( m "tl_resolve_models $(q "$MECH") claude-opus-5-5"; eq "[2] mechanical + opus parent" "build=inherit review=inherit verify=sonnet"
+  m "tl_model_sources $(q "$MECH") claude-opus-5-5"; eq "[2] sources" "build_src=parent review_src=parent verify_src=light"
+  for p in claude-sonnet-5-5 claude-haiku-4-5; do
+    m "tl_resolve_models $(q "$MECH") $p"; eq "[3] mechanical + $p" "build=inherit review=inherit verify=inherit"
+    m "tl_model_sources $(q "$MECH") $p"; eq "[3] sources ($p)" "build_src=parent review_src=parent verify_src=parent-cap"
+  done
+  m "tl_resolve_models $(q "$NONT") claude-opus-5-5"; eq "[4] nontrivial + opus" "build=inherit review=inherit verify=inherit"
+  m "tl_model_sources $(q "$NONT") claude-opus-5-5"; eq "[4] sources" "build_src=parent review_src=parent verify_src=parent"
+) || true
+
+echo "[5]-[6] pins win; CLAUDE_CODE_SUBAGENT_MODEL is a Claude-only pin"
+( m THROUGHLINE_REVIEW_MODEL=sonnet 'tl_resolve_models'; eq "[5] review pin" "build=inherit review=sonnet verify=inherit"
+  m THROUGHLINE_REVIEW_MODEL=sonnet 'tl_model_sources'; eq "[5] review pin sources" "build_src=parent review_src=pin:THROUGHLINE_REVIEW_MODEL verify_src=parent"
+  m CLAUDE_CODE_SUBAGENT_MODEL=haiku 'tl_resolve_models'; eq "[6] subagent env" "build=haiku review=haiku verify=haiku"
+  m CLAUDE_CODE_SUBAGENT_MODEL=haiku 'tl_model_sources'; eq "[6] subagent env sources" "build_src=pin:CLAUDE_CODE_SUBAGENT_MODEL review_src=pin:CLAUDE_CODE_SUBAGENT_MODEL verify_src=pin:CLAUDE_CODE_SUBAGENT_MODEL"
+  m CLAUDE_CODE_SUBAGENT_MODEL=haiku GROK_PLUGIN_ROOT=/tmp 'tl_resolve_models'; eq "[6] Grok ignores subagent env" "build=inherit review=inherit verify=inherit"
+  m THROUGHLINE_BUILD_MODEL=opus CLAUDE_CODE_SUBAGENT_MODEL=haiku 'tl_model_sources'
+  eq "build pin beats subagent env" "build_src=pin:THROUGHLINE_BUILD_MODEL review_src=pin:CLAUDE_CODE_SUBAGENT_MODEL verify_src=pin:THROUGHLINE_BUILD_MODEL"
+  m THROUGHLINE_RUNTIME_VERIFY_MODEL=opus "tl_resolve_models $(q "$MECH") claude-opus-5-5"; eq "verify pin beats light" "build=inherit review=inherit verify=opus"
+  m THROUGHLINE_RUNTIME_VERIFY_MODEL=opus "tl_model_sources $(q "$MECH") claude-opus-5-5"; eq "verify pin source" "build_src=parent review_src=parent verify_src=pin:THROUGHLINE_RUNTIME_VERIFY_MODEL"
+) || true
+
+echo "[7]-[8] family / tier / light / escalation bindings"
+( for pair in claude-sonnet-5-5:light claude-haiku-4-5:light claude-opus-5-5:above claude-fable-5-1:above claude-newname-1:above; do
+    m "tl_model_tier ${pair%%:*}"; eq "[7] tier ${pair%%:*}" "${pair#*:}"
+  done
+  m "tl_model_tier ''"; eq "[7] tier empty" unknown
+  m GROK_PLUGIN_ROOT=/tmp 'tl_model_tier grok-4.5'; eq "[7] Grok tier grok-4.5" light
+  m GROK_PLUGIN_ROOT=/tmp 'tl_model_tier grok-4.6'; eq "[7] Grok tier grok-4.6" above
+  m 'tl_model_family Claude-OPUS-5-5'; eq "family lowercases + names the family" opus
+  m 'tl_model_family claude-mythos-1'; eq "family mythos" mythos
+  m 'tl_model_family Claude-NewName-1'; eq "family unknown → lowercased id" claude-newname-1
+  m GROK_PLUGIN_ROOT=/tmp 'tl_model_family GROK-4.5'; eq "Grok family = lowercased id" grok-4.5
+  m "tl_model_family ''"; [ "$RC" -eq 1 ] && [ -z "$OUT" ] && ok "family of empty id → rc 1, no output" \
+    || bad "family empty: rc=$RC out='$OUT'"
+  m 'tl_light_model'; eq "light (claude)" sonnet
+  m GROK_PLUGIN_ROOT=/tmp 'tl_light_model'; eq "light (grok)" grok-4.5
+  m 'tl_escalation_model'; eq "[8] escalation (claude)" fable
+  m THROUGHLINE_ESCALATION_MODEL=x 'tl_escalation_model'; eq "[8] escalation override" x
+  m GROK_PLUGIN_ROOT=/tmp 'tl_escalation_model'; eq "[8] escalation (grok)" grok-4.6
+) || true
+
+echo "[9]-[10] tl_parent_model reads the Claude transcript as JSON"
+CFG="$ROOT/cfg"; SID="0a1b2c3d-sess"; mkdir -p "$CFG/projects/-tmp-proj"
+T="$CFG/projects/-tmp-proj/$SID.jsonl"
+{ printf '%s\n' '{"type":"assistant","message":{"model":"claude-trunc'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"go"}}'
+  printf '%s\n' '{"type":"assistant","message":{"model":"claude-opus-5-5","content":[{"type":"tool_use","name":"Agent","input":{"model":"haiku","prompt":"x"}}]}}'
+  printf '%s\n' '{"type":"assistant","message":{"model":"<synthetic>","content":[{"type":"text","text":"x"}]}}'
+} >"$T"
+( m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID="$SID" 'tl_parent_model'; eq "[9] transcript fixture" claude-opus-5-5
+  m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID="$SID" 'set -euo pipefail; tl_parent_model'; eq "[9] same under set -euo pipefail" claude-opus-5-5
+  T2="$CFG/projects/-tmp-proj/1-trailing.jsonl"
+  { cat "$T"; printf '%s' '{"type":"assistant","message":{"model":"claude-par'; } >"$T2"
+  m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID=1-trailing 'tl_parent_model'; eq "[9] partial newest line skipped" claude-opus-5-5
+  mkdir -p "$H/.claude/projects/-x"; cp "$T" "$H/.claude/projects/-x/2-home.jsonl"
+  m CLAUDE_CODE_SESSION_ID=2-home 'tl_parent_model'; eq "[9] default \$HOME/.claude" claude-opus-5-5
+  SHIM="$ROOT/shim"; SHIM0="$ROOT/shim0"; mkdir -p "$SHIM" "$SHIM0"
+  for t in bash tac tail tr head cat awk grep sed git; do
+    p="$(command -v "$t")" && ln -sf "$p" "$SHIM/$t" && ln -sf "$p" "$SHIM0/$t"
+  done
+  p="$(command -v python3)" && ln -sf "$p" "$SHIM/python3"
+  if [ -x "$SHIM/python3" ]; then
+    m PATH="$SHIM" CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID="$SID" 'tl_parent_model'; eq "[9] python3 fallback (no jq)" claude-opus-5-5
+  else bad "infra: python3 not found for the fallback check"; fi
+  m PATH="$SHIM0" CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID="$SID" 'tl_parent_model'; unreadable "neither jq nor python3" "no json parser"
+  m CLAUDE_CONFIG_DIR="$CFG" 'tl_parent_model'; unreadable "[10] CLAUDE_CODE_SESSION_ID unset" "no session id"
+  printf '%s\n' '{"type":"assistant","message":{"model":"claude-escaped-1"}}' >"$CFG/projects/x.jsonl"
+  m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID=../x 'tl_parent_model'; unreadable "[10] session id ../x" -
+  m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID=no-such-sess 'tl_parent_model'; unreadable "[10] no transcript file" "transcript not found"
+  printf '%s\n' '{"type":"user","message":{"content":"x"}}' >"$CFG/projects/-tmp-proj/3-nomodel.jsonl"
+  m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID=3-nomodel 'tl_parent_model'; unreadable "transcript with no assistant model" "no model in transcript"
+) || true
+
+echo "[11] tl_parent_model reads Grok summary.json current_model_id"
+( GH="$ROOT/grokhome"; P="$ROOT/proj"; mkdir -p "$P/sub"
+  case "$P" in *[!A-Za-z0-9/._-]*) bad "infra: fixture path has chars needing encoding: $P" ;; esac
+  enc="$(printf '%s' "$P" | sed 's|/|%2F|g')"
+  mkdir -p "$GH/sessions/$enc/gsess1"
+  printf '%s\n' '{"current_model_id":"grok-4.6","title":"x"}' >"$GH/sessions/$enc/gsess1/summary.json"
+  m GROK_PLUGIN_ROOT=/tmp GROK_HOME="$GH" GROK_SESSION_ID=gsess1 "cd $(q "$P") && tl_parent_model"; eq "[11] Grok summary.json" grok-4.6
+  git init -q "$P" 2>/dev/null
+  m GROK_PLUGIN_ROOT=/tmp GROK_HOME="$GH" GROK_SESSION_ID=gsess1 "cd $(q "$P/sub") && tl_parent_model"; eq "[11] retry via git toplevel" grok-4.6
+  m GROK_PLUGIN_ROOT=/tmp GROK_HOME="$GH" "cd $(q "$P") && tl_parent_model"; unreadable "Grok GROK_SESSION_ID unset" -
+  printf '%s\n' '{"current_model_id":"grok-escaped"}' >"$GH/sessions/summary.json"
+  m GROK_PLUGIN_ROOT=/tmp GROK_HOME="$GH" GROK_SESSION_ID=.. "cd $(q "$P") && tl_parent_model"; unreadable "Grok session id .. rejected" -
+) || true
+
+echo "[12] tl_parent_effort: env, then settings.json, else unknown"
+( CE="$ROOT/cfge"; mkdir -p "$CE"; printf '%s\n' '{"effortLevel":"xhigh"}' >"$CE/settings.json"
+  m CLAUDE_CODE_EFFORT_LEVEL=high 'tl_parent_effort'; eq "[12] env" "high env"
+  m CLAUDE_CODE_EFFORT_LEVEL=high CLAUDE_CONFIG_DIR="$CE" 'tl_parent_effort'; eq "env beats settings" "high env"
+  m CLAUDE_CONFIG_DIR="$CE" 'tl_parent_effort'; eq "[12] settings" "xhigh settings"
+  m CLAUDE_CONFIG_DIR="$ROOT/none" 'tl_parent_effort'; eq "[12] neither" "unknown -"
+  m GROK_PLUGIN_ROOT=/tmp CLAUDE_CODE_EFFORT_LEVEL=high 'tl_parent_effort'; eq "Grok" "unknown -"
+) || true
+
+echo "[13] product names only on the four binding lines + the family list"
+( if [ ! -r "$MODELS" ] || [ ! -s "$MODELS" ]; then bad "infra: $MODELS missing/unreadable/empty"
+  else
+    n="$(grep -cE 'sonnet|fable|grok-4' "$MODELS")"; grc=$?
+    ni="$(grep -ciE 'sonnet|fable|grok-4' "$MODELS")"
+    if [ "$grc" -ge 2 ] || [ -z "$n" ]; then bad "infra: grep rc=$grc"
+    elif [ "$n" -eq 5 ] && [ "$ni" -eq 5 ]; then ok "[13] product-name line count is exactly 5"
+    else bad "[13] product-name lines=$n (case-insensitive $ni) want 5:"$'\n'"$(grep -niE 'sonnet|fable|grok-4' "$MODELS")"; fi
+    for b in '_TL_CLAUDE_LIGHT=sonnet' '_TL_CLAUDE_ESCALATION=fable' '_TL_GROK_LIGHT=grok-4.5' '_TL_GROK_ESCALATION=grok-4.6'; do
+      grep -qE "^${b//./\\.}([[:space:]]|\$)" "$MODELS" && ok "binding line $b" || bad "missing binding line $b"
+    done
+    rest="$(grep -E 'sonnet|fable|grok-4' "$MODELS" | grep -vE '^_TL_(CLAUDE|GROK)_(LIGHT|ESCALATION)=')"
+    [ -n "$rest" ] && [ "$(printf '%s\n' "$rest" | grep -c .)" = 1 ] \
+      && printf '%s' "$rest" | grep -q 'mythos fable opus sonnet haiku' \
+      && ok "the one other product-name line is the family list" || bad "non-binding product-name lines: $rest"
+    stale="$(grep -nE 'latest top-tier|prior-gen|author ≠ reviewer' "$MODELS")"; src=$?
+    [ "$src" -eq 1 ] && ok "no latest top-tier / prior-gen / author ≠ reviewer text" \
+      || bad "stale pairing text (rc=$src): $stale"
+  fi
+) || true
+
+norm() { tr '\n' ' ' <"$1" | tr -s ' '; }
+echo "[14] design-reviewer inherits; independence is the fresh worker"
+( pre=1
+  for f in "$DR" "$TA"; do
+    { [ -r "$f" ] && [ -s "$f" ]; } || { bad "infra: $f missing/unreadable/empty (L-001)"; pre=0; }
+  done
+  if [ "$pre" = 1 ]; then
+    head8="$(sed -n '1,8p' "$DR")"
+    [ -n "$head8" ] && printf '%s\n' "$head8" | grep -q '^model: inherit$' \
+      && ok "[14] design-reviewer frontmatter has model: inherit" || bad "[14] frontmatter: $head8"
+    total=0; infra=0
+    for f in "$DR" "$TA"; do
+      c="$(grep -c 'deliberately on a different model\|on a different model than you authored in' "$f")"; grc=$?
+      if [ "$grc" -ge 2 ] || [ -z "$c" ]; then infra=1; else total=$((total + c)); fi
+    done
+    [ "$infra" = 0 ] && [ "$total" = 0 ] && ok "[14] no different-model wording (grep -c total 0)" \
+      || bad "[14] different-model wording count=$total infra=$infra"
+    jn="$(norm "$DR")$(norm "$TA")"
+    [ -n "$jn" ] && ! printf '%s' "$jn" | grep -qiE 'on a different model|deliberately on a different' \
+      && ok "no different-model wording across line breaks" || bad "different-model wording survives (line-joined)"
+    norm "$DR" | grep -qF "You did NOT author this design. You run in a fresh context that is not the author's session; that fresh context is the independence. You may be on the same model as the author." \
+      && ok "design-reviewer opening paragraph pinned" || bad "design-reviewer opening paragraph missing"
+    norm "$TA" | grep -qF "it runs in a fresh worker that is not this session and inherits this session's model (FR-10); independence is the fresh context, not a distinct model name" \
+      && ok "/tdd-author 7b fresh-worker wording pinned" || bad "/tdd-author 7b wording missing"
+  fi
+) || true
+
+echo "[15] plugin.json description: fresh worker, no different-model claims"
+( if [ ! -r "$PJ" ]; then bad "infra: $PJ unreadable"
+  elif ! command -v jq >/dev/null 2>&1; then bad "infra: jq not found"
+  else
+    d="$(jq -r .description "$PJ" 2>"$ROOT/pj.err")"; jrc=$?
+    if [ "$jrc" -ne 0 ] || [ -z "$d" ] || [ "$d" = null ]; then bad "infra: jq rc=$jrc desc='$d' $(cat "$ROOT/pj.err")"
+    else
+      printf '%s' "$d" | grep -qF 'fresh worker' && ok "[15] contains fresh worker" || bad "[15] missing fresh worker"
+      for s in 'prior generation' 'DIFFERENT model' 'latest top-tier' 'different model, fresh context'; do
+        printf '%s' "$d" | grep -qF "$s" && bad "[15] still contains '$s'" || ok "[15] no '$s'"
+      done
+      for s in '(fresh worker, same model allowed)' "on the parent session's model (escalation on demand)" 'an independent review in a fresh worker'; do
+        printf '%s' "$d" | grep -qF "$s" && ok "contains '$s'" || bad "missing '$s'"
+      done
+    fi
+  fi
+) || true
+
+echo
+PASS="$(grep -c '^ok$'   "$RESULTS" 2>/dev/null)"; PASS="${PASS:-0}"
+FAIL="$(grep -c '^fail$' "$RESULTS" 2>/dev/null)"; FAIL="${FAIL:-0}"
+echo "=== model-roles eval: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ] && [ "$PASS" -gt 0 ]

From f316a05bafe780534ad7e72b725d8073683f8528 Mon Sep 17 00:00:00 2001
From: Chris Henesy <chris@heartofgoldventures.com>
Date: Mon, 5 Oct 2026 13:56:35 -0400
Subject: [PATCH 2/4] feat: model roles and parent-model observation (TDD 0064)

Rewrite scripts/lib/models.sh per ADR 0015 / NFR-3: judgment slots
resolve to inherit (dispatch with no model parameter); pins win, with
CLAUDE_CODE_SUBAGENT_MODEL treated as a Claude-only pin. Only the light
tier and the escalation target are named, on four binding lines.
Mechanical runtime-verify uses the light tier only when the parent is
above it, else inherits (parent-cap); the plan class comes from
plan-classifier.sh. tl_resolve_models and tl_model_sources share one
_tl_resolve_slot. tl_parent_model reads the Claude transcript
(.message.model of the newest assistant line, parsed as JSON via a
jq -> python3 cascade) or Grok summary.json current_model_id; an
unreadable model is reported, never guessed. tl_parent_effort reports
the session effort and its source.

The FR-10 design-reviewer now inherits the parent's model; /tdd-author
7b and the plugin.json description say independence is the fresh
worker, not a different model name. Plugin 3.45.0 -> 3.46.0.

The eval gains a key-order / user-line transcript fixture: the spec
fixture alone does not catch a first-match raw regex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ki3TDnP2bNqqpEkFoZaEXq
---
 .claude-plugin/plugin.json |   4 +-
 agents/design-reviewer.md  |   9 +-
 scripts/lib/models.sh      | 321 ++++++++++++++++++++++++++++++++-----
 skills/tdd-author/SKILL.md |   6 +-
 tests/model-roles.test.sh  |   6 +
 5 files changed, 297 insertions(+), 49 deletions(-)

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 22794d5..d4b8e87 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "throughline",
-  "version": "3.45.0",
-  "description": "Throughline plugin: a PRD/TDD/ADR design-doc pipeline with phase-gate PRs, layered as a thin governance overlay on top of the official superpowers/pr-review-toolkit plugins (it owns governance; they own discovery + engineering). /prd-author requires an observable acceptance criterion per new requirement. /tdd-author decides how many TDDs a PRD change needs (git-diff + coverage), recommends ADR actions, requires an alternatives analysis for every new dependency, requires a verification plan (observable surface → observation point(s) → expected observations) per TDD, reads BLOCKERS.md so implementation-time design blockers feed back into design, self-reviews, then runs an independent design-critique gate (different model, fresh context) before the design PR. /build-tdds builds every TDD merged to the integration branch via sequenced workers on the latest top-tier model but does not trust self-reported success: the flip to implemented is gated on failing-test-first discipline, a mechanical ci-checks gate (tests+typecheck+lint — CI's job), a runtime-verify gate that drives the built artifact at its observable surface (PASS/FAIL/BLOCKED/SKIP kept distinct; mechanism delegated, no harness vendored — ADR 0004), and an independent review on a DIFFERENT model (the prior generation's top tier) for reviewer diversity — one stacked PR per TDD, downstream halt-on-failure, never merges. Includes a toolchain bootstrap skill and a format+lint hook for JS/TS, Python, Rust, and Go.",
+  "version": "3.46.0",
+  "description": "Throughline plugin: a PRD/TDD/ADR design-doc pipeline with phase-gate PRs, layered as a thin governance overlay on top of the official superpowers/pr-review-toolkit plugins (it owns governance; they own discovery + engineering). /prd-author requires an observable acceptance criterion per new requirement. /tdd-author decides how many TDDs a PRD change needs (git-diff + coverage), recommends ADR actions, requires an alternatives analysis for every new dependency, requires a verification plan (observable surface → observation point(s) → expected observations) per TDD, reads BLOCKERS.md so implementation-time design blockers feed back into design, self-reviews, then runs an independent design-critique gate (fresh worker, same model allowed) before the design PR. /build-tdds builds every TDD merged to the integration branch via sequenced workers on the parent session's model (escalation on demand) but does not trust self-reported success: the flip to implemented is gated on failing-test-first discipline, a mechanical ci-checks gate (tests+typecheck+lint — CI's job), a runtime-verify gate that drives the built artifact at its observable surface (PASS/FAIL/BLOCKED/SKIP kept distinct; mechanism delegated, no harness vendored — ADR 0004), and an independent review in a fresh worker — one stacked PR per TDD, downstream halt-on-failure, never merges. Includes a toolchain bootstrap skill and a format+lint hook for JS/TS, Python, Rust, and Go.",
   "author": {
     "name": "Chris Henesy"
   },
diff --git a/agents/design-reviewer.md b/agents/design-reviewer.md
index e0a5d97..13c6d3f 100644
--- a/agents/design-reviewer.md
+++ b/agents/design-reviewer.md
@@ -2,12 +2,13 @@
 name: design-reviewer
 description: Independent critique of a design (PRD + TDD set + accepted ADRs) BEFORE the design PR is opened. Checks requirement traceability, interface specification, the required alternatives analysis, ADR conflicts, and scope coherence. Use at /tdd-author close-out.
 tools: Read, Grep, Glob, Bash
-model: sonnet
+model: inherit
 ---
 You are a senior architect doing an INDEPENDENT design review. You did NOT author
-this design, and you are deliberately on a different model than the author — bring
-genuinely independent judgment. There is NO code yet: review the DESIGN, not an
-implementation.
+this design. You run in a fresh context that is not the author's session; that
+fresh context is the independence. You may be on the same model as the author.
+Bring genuinely independent judgment. There is NO code yet: review the DESIGN,
+not an implementation.
 
 **Pre-check already ran.** The skill that invokes you has already run
 `scripts/lib/tdd-lint.sh` against this TDD set and is invoking you only because
diff --git a/scripts/lib/models.sh b/scripts/lib/models.sh
index e64def5..1763924 100644
--- a/scripts/lib/models.sh
+++ b/scripts/lib/models.sh
@@ -1,51 +1,292 @@
 #!/usr/bin/env bash
-# models.sh — the one greppable model-id binding site (TDD 0062 / ADR 0009 /
-# NFR-3). Product names live ONLY in this file. Prose surfaces speak tiers.
+# models.sh — model roles and parent-model observation (TDD 0064 / ADR 0015 /
+# NFR-3: the best cost/performance model for each job, owned by the operator
+# through the parent session's model and effort).
 #
-#   tl_resolve_models [plan-text]
-#     prints: build=<id> review=<id> verify=<id>
+# Judgment slots (implementer, FR-15(d) reviewer, nontrivial runtime-verify)
+# resolve to `inherit`: the worker is dispatched with no model parameter and
+# runs on the parent session's model. Pins win (FR-87). Exactly two models are
+# named per harness, both maintained bindings on the four lines below: the
+# LIGHT tier (mechanical runtime-verify, FR-52, never above the parent) and the
+# ESCALATION target (FR-88, used by /build-tdds escalation). Rebinding one when
+# a vendor ships a new generation is an implementation change, not an ADR.
+# Review independence is a fresh worker, not a distinct model name.
 #
-# Defaults:
-#   build  = latest top-tier on this harness
-#   review = prior-generation top-tier (author ≠ reviewer)
-#   verify = cheaper tier when <plan-text> is only exit-code / file / grep,
-#            else the build model
-# Overrides: THROUGHLINE_BUILD_MODEL, THROUGHLINE_REVIEW_MODEL,
-#            THROUGHLINE_RUNTIME_VERIFY_MODEL
+# Every model decision is a function here, so no skill re-derives a rule in
+# prose. The parent's model is OBSERVED from the harness session artifact
+# (tl_parent_model), never taken from the model's self-report.
 #
-# Harness: GROK_PLUGIN_ROOT set → Grok ids; else Claude ids.
-# No top-level side effects.
+#   tl_model_harness                      claude | grok
+#   tl_light_model / tl_escalation_model  the harness binding (escalation:
+#                                         THROUGHLINE_ESCALATION_MODEL wins)
+#   tl_model_family <id>                  family name (rc 1 on empty id)
+#   tl_model_tier <id>                    light | above | unknown
+#   tl_parent_model                       parent id; rc 1 + one stderr line
+#                                         `tl_parent_model: <reason>`
+#   tl_parent_effort                      `<level> env|settings` | `unknown -`
+#   tl_plan_class [tdd-path]              mechanical | nontrivial
+#   tl_resolve_models [tdd] [parent]      build=<v> review=<v> verify=<v>
+#   tl_model_sources  [tdd] [parent]      build_src=<s> review_src=<s> verify_src=<s>
+#
+# Harness: GROK_PLUGIN_ROOT non-empty → grok; else claude. Sourced, never
+# executed: no shell options set; the only top-level effects are sourcing
+# plan-classifier.sh and the four binding assignments.
 
-tl_resolve_models() {
-  local plan="${1:-}" build review verify cheap
-  if [ -n "${GROK_PLUGIN_ROOT:-}" ]; then
-    build="${THROUGHLINE_BUILD_MODEL:-grok-4.6}"
-    cheap="grok-4.5"
-    if [ -n "${THROUGHLINE_REVIEW_MODEL:-}" ]; then
-      review="$THROUGHLINE_REVIEW_MODEL"
-    else
-      review="grok-4.5"
-    fi
+case "${BASH_SOURCE[0]}" in
+  */*) _tl_models_pc="${BASH_SOURCE[0]%/*}/plan-classifier.sh" ;;
+  *)   _tl_models_pc="./plan-classifier.sh" ;;
+esac
+# shellcheck source=scripts/lib/plan-classifier.sh
+{ [ -r "$_tl_models_pc" ] && . "$_tl_models_pc"; } || {
+  echo "FATAL: cannot source $_tl_models_pc (partial install or perms)" >&2
+  unset _tl_models_pc
+  return 1 2>/dev/null || exit 1
+}
+unset _tl_models_pc
+
+_TL_CLAUDE_LIGHT=sonnet
+_TL_CLAUDE_ESCALATION=fable
+_TL_GROK_LIGHT=grok-4.5        # unverified this pass (see Failure modes)
+_TL_GROK_ESCALATION=grok-4.6   # unverified this pass
+
+tl_model_harness() {
+  if [ -n "${GROK_PLUGIN_ROOT:-}" ]; then printf 'grok\n'; else printf 'claude\n'; fi
+}
+
+tl_light_model() {
+  if [ "$(tl_model_harness)" = grok ]; then printf '%s\n' "$_TL_GROK_LIGHT"
+  else printf '%s\n' "$_TL_CLAUDE_LIGHT"; fi
+}
+
+tl_escalation_model() {
+  if [ -n "${THROUGHLINE_ESCALATION_MODEL:-}" ]; then
+    printf '%s\n' "$THROUGHLINE_ESCALATION_MODEL"
+  elif [ "$(tl_model_harness)" = grok ]; then printf '%s\n' "$_TL_GROK_ESCALATION"
+  else printf '%s\n' "$_TL_CLAUDE_ESCALATION"; fi
+}
+
+# tl_model_family <id> — Claude: the first known family name that is a
+# substring of the lowercased id, else the lowercased id. Grok: lowercased id.
+tl_model_family() {
+  local id f
+  [ -n "${1:-}" ] || return 1
+  id="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+  if [ "$(tl_model_harness)" = claude ]; then
+    for f in mythos fable opus sonnet haiku; do
+      case "$id" in *"$f"*) printf '%s\n' "$f"; return 0 ;; esac
+    done
+  fi
+  printf '%s\n' "$id"
+}
+
+# tl_model_tier <id> — `light` when the id is in the light binding's family
+# (or, on Claude, the haiku family); `above` otherwise; `unknown` when empty.
+# Membership by family name only: no rank table, no live fetch (ADR 0015).
+tl_model_tier() {
+  local fam
+  fam="$(tl_model_family "${1:-}")" || { printf 'unknown\n'; return 0; }
+  if [ "$fam" = "$(tl_model_family "$(tl_light_model)")" ]; then
+    printf 'light\n'
+  elif [ "$(tl_model_harness)" = claude ] && [ "$fam" = haiku ]; then
+    printf 'light\n'
   else
-    build="${THROUGHLINE_BUILD_MODEL:-fable}"
-    cheap="sonnet"
-    if [ -n "${THROUGHLINE_REVIEW_MODEL:-}" ]; then
-      review="$THROUGHLINE_REVIEW_MODEL"
-    else
-      case "$build" in
-        *opus*) review="sonnet" ;;
-        *)      review="opus"   ;;
-      esac
-    fi
+    printf 'above\n'
   fi
-  if [ -n "${THROUGHLINE_RUNTIME_VERIFY_MODEL:-}" ]; then
-    verify="$THROUGHLINE_RUNTIME_VERIFY_MODEL"
+}
+
+# _tl_tac <file> — the file's lines newest-first (tac; BSD `tail -r`).
+_tl_tac() {
+  if command -v tac >/dev/null 2>&1; then tac "$1"; else tail -r "$1"; fi
+}
+
+# _tl_transcript_model <jsonl> — print the newest assistant `.message.model`
+# that is neither empty nor `<synthetic>`. Every line is PARSED as JSON,
+# tolerantly (a truncated line is skipped); never a regex on the raw line,
+# whose tool_use inputs can carry their own "model" key. rc 3 = no parser.
+_tl_transcript_model() {
+  if command -v jq >/dev/null 2>&1; then
+    _tl_tac "$1" | jq -nRr 'first(inputs | fromjson? | objects
+      | select(.type == "assistant") | .message | objects | .model | strings
+      | select(. != "" and . != "<synthetic>"))' 2>/dev/null
+  elif command -v python3 >/dev/null 2>&1; then
+    _tl_tac "$1" | python3 -c '
+import json, sys
+for line in sys.stdin.buffer:
+    try:
+        d = json.loads(line)
+    except Exception:
+        continue
+    if not isinstance(d, dict) or d.get("type") != "assistant":
+        continue
+    m = d.get("message")
+    v = m.get("model") if isinstance(m, dict) else None
+    if isinstance(v, str) and v and v != "<synthetic>":
+        print(v)
+        break
+' 2>/dev/null
+  else
+    return 3
+  fi
+  return 0
+}
+
+# _tl_json_top_string <file> <key> — print the top-level string field <key>
+# of the JSON document <file> (empty when absent / not a string / malformed).
+# jq → python3 cascade; rc 3 = no parser.
+_tl_json_top_string() {
+  if command -v jq >/dev/null 2>&1; then
+    jq -r --arg k "$2" '.[$k]? | strings' "$1" 2>/dev/null
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 -c '
+import json, sys
+try:
+    d = json.load(open(sys.argv[1]))
+except Exception:
+    sys.exit(0)
+v = d.get(sys.argv[2]) if isinstance(d, dict) else None
+if isinstance(v, str):
+    print(v)
+' "$1" "$2" 2>/dev/null
   else
-    case "$plan" in
-      *[Ee]xit-code*|*grep*|*file\ exist*|*rc\ 0*|*rc=0*) verify="$cheap" ;;
-      '') verify="$cheap" ;;
-      *)  verify="$build" ;;
+    return 3
+  fi
+  return 0
+}
+
+# _tl_pct_encode <string> — percent-encode every byte outside A-Za-z0-9._~-
+# (so `/` → %2F, including the leading slash).
+_tl_pct_encode() {
+  local LC_ALL=C s="${1:-}" out="" c hex i
+  for (( i = 0; i < ${#s}; i++ )); do
+    c="${s:i:1}"
+    case "$c" in
+      [A-Za-z0-9._~-]) out="$out$c" ;;
+      *) printf -v hex '%%%02X' "'$c"; out="$out$hex" ;;
     esac
+  done
+  printf '%s' "$out"
+}
+
+# _tl_grok_summary <sessions-dir> <dir> <sid> — print the summary.json path
+# for <dir> (percent-encoded) if it exists. Rejects any `..` so the path stays
+# under <sessions-dir>.
+_tl_grok_summary() {
+  local rel
+  rel="$(_tl_pct_encode "$2")/$3"
+  case "$rel" in *..*) return 1 ;; esac
+  [ -f "$1/$rel/summary.json" ] || return 1
+  printf '%s\n' "$1/$rel/summary.json"
+}
+
+_tl_pm_fail() { printf 'tl_parent_model: %s\n' "$1" >&2; return 1; }
+
+# tl_parent_model — the parent session's model id, observed from the harness
+# session artifact. rc 1 (no stdout, one stderr line) when unreadable; an
+# unreadable model is reported, never guessed (ADR 0015).
+tl_parent_model() {
+  local out rc f="" cand top what
+  if [ "$(tl_model_harness)" = grok ]; then
+    local sid="${GROK_SESSION_ID:-}" base
+    [ -n "$sid" ] || { _tl_pm_fail "no session id"; return 1; }
+    case "$sid" in *..*) _tl_pm_fail "invalid session id"; return 1 ;; esac
+    base="${GROK_HOME:-${HOME:-}/.grok}/sessions"
+    f="$(_tl_grok_summary "$base" "$PWD" "$sid")" || {
+      top="$(git rev-parse --show-toplevel 2>/dev/null)" || top=""
+      f=""
+      [ -z "$top" ] || f="$(_tl_grok_summary "$base" "$top" "$sid")" || f=""
+    }
+    [ -n "$f" ] || { _tl_pm_fail "summary not found"; return 1; }
+    what=summary
+    out="$(_tl_json_top_string "$f" current_model_id)" && rc=0 || rc=$?
+  else
+    local id="${CLAUDE_CODE_SESSION_ID:-}"
+    case "$id" in ''|*[!A-Za-z0-9-]*) _tl_pm_fail "no session id"; return 1 ;; esac
+    for cand in "${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}"/projects/*/"$id".jsonl; do
+      [ -f "$cand" ] && { f="$cand"; break; }
+    done
+    [ -n "$f" ] || { _tl_pm_fail "transcript not found"; return 1; }
+    what=transcript
+    out="$(_tl_transcript_model "$f")" && rc=0 || rc=$?
   fi
-  printf 'build=%s review=%s verify=%s\n' "$build" "$review" "$verify"
+  [ "$rc" -ne 3 ] || { _tl_pm_fail "no json parser"; return 1; }
+  out="${out%%$'\n'*}"
+  [ -n "$out" ] || { _tl_pm_fail "no model in $what"; return 1; }
+  printf '%s\n' "$out"
+}
+
+# tl_parent_effort — `<level> env` | `<level> settings` | `unknown -`.
+# Effort is session-wide on these harnesses; Grok exposes none.
+tl_parent_effort() {
+  local lvl="" f
+  if [ "$(tl_model_harness)" = grok ]; then printf 'unknown -\n'; return 0; fi
+  if [ -n "${CLAUDE_CODE_EFFORT_LEVEL:-}" ]; then
+    printf '%s env\n' "$CLAUDE_CODE_EFFORT_LEVEL"; return 0
+  fi
+  f="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/settings.json"
+  if [ -r "$f" ]; then lvl="$(_tl_json_top_string "$f" effortLevel)" || lvl=""; fi
+  lvl="${lvl%%$'\n'*}"
+  if [ -n "$lvl" ]; then printf '%s settings\n' "$lvl"; else printf 'unknown -\n'; fi
+}
+
+# tl_plan_class [tdd-path] — the FR-52 plan class via tl_classify_plan;
+# no path or a classifier failure → nontrivial (conservative).
+tl_plan_class() {
+  local c
+  [ -n "${1:-}" ] || { printf 'nontrivial\n'; return 0; }
+  c="$(tl_classify_plan "$1")" || c=""
+  case "$c" in
+    mechanical) printf 'mechanical\n' ;;
+    *)          printf 'nontrivial\n' ;;
+  esac
+}
+
+# _tl_resolve_slot <build|review|verify> [tdd-path] [parent-id] — print
+# `<value> <source>`; the one rule both public resolvers share. The source is
+# a single token, so callers split on the LAST space.
+_tl_resolve_slot() {
+  local slot="$1" tdd="${2:-}" parent="${3:-}" pin
+  case "$slot" in
+    build|review)
+      if [ "$slot" = build ]; then pin=THROUGHLINE_BUILD_MODEL; else pin=THROUGHLINE_REVIEW_MODEL; fi
+      if [ -n "${!pin:-}" ]; then
+        printf '%s pin:%s\n' "${!pin}" "$pin"
+      elif [ "$(tl_model_harness)" = claude ] && [ -n "${CLAUDE_CODE_SUBAGENT_MODEL:-}" ]; then
+        # Claude Code applies it to every dispatch without a model: a pin.
+        printf '%s pin:CLAUDE_CODE_SUBAGENT_MODEL\n' "$CLAUDE_CODE_SUBAGENT_MODEL"
+      else
+        printf 'inherit parent\n'
+      fi ;;
+    verify)
+      if [ -n "${THROUGHLINE_RUNTIME_VERIFY_MODEL:-}" ]; then
+        printf '%s pin:THROUGHLINE_RUNTIME_VERIFY_MODEL\n' "$THROUGHLINE_RUNTIME_VERIFY_MODEL"
+      elif [ "$(tl_plan_class "$tdd")" = nontrivial ]; then
+        _tl_resolve_slot build "$tdd" "$parent"
+      elif [ "$(tl_model_tier "$parent")" = above ]; then
+        printf '%s light\n' "$(tl_light_model)"
+      else
+        printf 'inherit parent-cap\n'   # light or unknown parent: never above it
+      fi ;;
+    *) printf '_tl_resolve_slot: unknown slot %s\n' "$slot" >&2; return 2 ;;
+  esac
+}
+
+# tl_resolve_models [tdd-path] [parent-id] — one line `build=<v> review=<v>
+# verify=<v>`; <v> is `inherit` (dispatch with no model) or a model id.
+tl_resolve_models() {
+  local b r v
+  b="$(_tl_resolve_slot build "${1:-}" "${2:-}")"
+  r="$(_tl_resolve_slot review "${1:-}" "${2:-}")"
+  v="$(_tl_resolve_slot verify "${1:-}" "${2:-}")"
+  printf 'build=%s review=%s verify=%s\n' "${b% *}" "${r% *}" "${v% *}"
+}
+
+# tl_model_sources [tdd-path] [parent-id] — one line `build_src=<s>
+# review_src=<s> verify_src=<s>`; <s> ∈ parent, pin:<ENV-NAME>, light,
+# parent-cap.
+tl_model_sources() {
+  local b r v
+  b="$(_tl_resolve_slot build "${1:-}" "${2:-}")"
+  r="$(_tl_resolve_slot review "${1:-}" "${2:-}")"
+  v="$(_tl_resolve_slot verify "${1:-}" "${2:-}")"
+  printf 'build_src=%s review_src=%s verify_src=%s\n' "${b##* }" "${r##* }" "${v##* }"
 }
diff --git a/skills/tdd-author/SKILL.md b/skills/tdd-author/SKILL.md
index cc7794d..69b4e38 100644
--- a/skills/tdd-author/SKILL.md
+++ b/skills/tdd-author/SKILL.md
@@ -530,9 +530,9 @@ scope concern this gate missed.
 
 **7b. Independent design critique (gate — do not skip).** Before opening the design
 PR, get an INDEPENDENT critique of the whole authored set. Spawn the
-`design-reviewer` subagent — it runs in fresh context on a
-different model than you authored in, so it does not share your blind spots. It
-reads the PRD, the TDD(s), and the accepted ADRs and checks requirement
+`design-reviewer` subagent — it runs in a fresh worker that is not this session
+and inherits this session's model (FR-10); independence is the fresh context,
+not a distinct model name. It reads the PRD, the TDD(s), and the accepted ADRs and checks requirement
 traceability, interface specification, the REQUIRED alternatives analysis, ADR
 conflicts, and scope coherence, ending with `DESIGN_REVIEW: PASS` or
 `DESIGN_REVIEW: BLOCK <reason>`.
diff --git a/tests/model-roles.test.sh b/tests/model-roles.test.sh
index a56444b..feb55a6 100755
--- a/tests/model-roles.test.sh
+++ b/tests/model-roles.test.sh
@@ -133,6 +133,12 @@ T="$CFG/projects/-tmp-proj/$SID.jsonl"
   T2="$CFG/projects/-tmp-proj/1-trailing.jsonl"
   { cat "$T"; printf '%s' '{"type":"assistant","message":{"model":"claude-par'; } >"$T2"
   m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID=1-trailing 'tl_parent_model'; eq "[9] partial newest line skipped" claude-opus-5-5
+  # Key order reversed + a newer user line carrying "model": defeats a raw
+  # first-match OR last-match regex; only a JSON .message.model parse passes.
+  { printf '%s\n' '{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Agent","input":{"model":"haiku"}}],"model":"claude-opus-5-5"}}'
+    printf '%s\n' '{"type":"user","message":{"role":"user","content":[]},"toolUseResult":{"model":"haiku"}}'
+  } >"$CFG/projects/-tmp-proj/4-order.jsonl"
+  m CLAUDE_CONFIG_DIR="$CFG" CLAUDE_CODE_SESSION_ID=4-order 'tl_parent_model'; eq "[9] key order / user-line model ignored" claude-opus-5-5
   mkdir -p "$H/.claude/projects/-x"; cp "$T" "$H/.claude/projects/-x/2-home.jsonl"
   m CLAUDE_CODE_SESSION_ID=2-home 'tl_parent_model'; eq "[9] default \$HOME/.claude" claude-opus-5-5
   SHIM="$ROOT/shim"; SHIM0="$ROOT/shim0"; mkdir -p "$SHIM" "$SHIM0"

From 9fc720ce38cb8b99cc727dca787729d4c4feb5d0 Mon Sep 17 00:00:00 2001
From: Chris Henesy <chris@heartofgoldventures.com>
Date: Mon, 5 Oct 2026 14:03:02 -0400
Subject: [PATCH 3/4] chore: releases.json entry for 3.46.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ki3TDnP2bNqqpEkFoZaEXq
---
 .claude-plugin/releases.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.claude-plugin/releases.json b/.claude-plugin/releases.json
index 49dc658..ac62b1d 100644
--- a/.claude-plugin/releases.json
+++ b/.claude-plugin/releases.json
@@ -1,4 +1,5 @@
 [
+  { "version": "3.46.0", "local_impacting": false },
   { "version": "3.45.0", "local_impacting": false },
   { "version": "3.44.0", "local_impacting": false },
   { "version": "3.14.0", "local_impacting": false },

From 500536b71f98412c2ae4248e0438470fa1029b5f Mon Sep 17 00:00:00 2001
From: Chris Henesy <chris@heartofgoldventures.com>
Date: Mon, 5 Oct 2026 14:03:02 -0400
Subject: [PATCH 4/4] docs: flip 0064 to implemented

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ki3TDnP2bNqqpEkFoZaEXq
---
 docs/tdd/0064-judgment-worker-defaults.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/tdd/0064-judgment-worker-defaults.md b/docs/tdd/0064-judgment-worker-defaults.md
index e7dfca4..197cc13 100644
--- a/docs/tdd/0064-judgment-worker-defaults.md
+++ b/docs/tdd/0064-judgment-worker-defaults.md
@@ -1,6 +1,6 @@
 # TDD 0064: Model roles and parent-model observation
 
-Status: draft
+Status: implemented
 PRD refs: NFR-3, FR-52, FR-87, FR-10, FR-15, FR-50
 PRD-rev: f6ef178
 ADR constraints: 0004, 0005, 0006, 0010, 0011, 0013, 0015