BramVR · Sep 22, 2026 · Sep 22, 2026
@@ -4,6 +4,12 @@ summary: Timeline of guardrail helper changes mirrored from Sweetistics and rela
 
 # Changelog
 
+## 2026-09-22: GPT-6 Sol and Luna role upgrades
+- Require three distinct Architect designs, one per configured runner, before synthesis; verified Sol high, Astra low, and Fable 5.1 high through a complete design-only dry run.
+- Set Arena runners to Astra medium, GPT-6 Sol high, GPT-5.6 Sol high, Opus 5.5 high, and Fable 5.1 high; route both Claude candidates through `claude -p` and require Claude Code 2.1.280+ for Opus.
+- Upgrade active Luna roles to GPT-6 Luna at high reasoning: discovery, Swarm, comment audits, and live-verification lanes; align the plan validator and setup template.
+- Upgrade active Sol roles to GPT-6 Sol at high reasoning: Arena runners and cross-judge pool, Architect, Interrogate, implementation playbooks, explainers, synthesis, tooling reflection, and Codex-first defaults; keep setup templates aligned.
+
 ## 2026-09-17: Design panel models
 - Architect now uses Sol high, Astra low, and Fable 5.1 high; Arena honors the design panel and runs its Fable candidate through Claude CLI.
 

@@ -29,9 +29,9 @@ Skip Phase A only when the work is genuinely greenfield with no surrounding syst
 
 Run the **arena** skill with the design-sketch task and the Phase A grounding artifacts. Pass `references/runner-prompt.md` as each runner's prompt. Each candidate produces a design package shaped per `references/rationale-template.md`.
 
-Use `architect runners` from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` when present. Otherwise default to one each on `gpt-5.6-sol` at `high` reasoning, `gpt-6-astra` at `low` reasoning, `claude-fable-5-1` at `high` reasoning. Pass this panel to Arena as the explicit runner list.
+Use `architect runners` from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` when present. Otherwise default to one each on `gpt-6-sol` at `high` reasoning, `gpt-6-astra` at `low` reasoning, `claude-fable-5-1` at `high` reasoning. Pass this panel to Arena as the explicit runner list.
 
-Design it twice. Require at least two structurally distinct candidates before synthesis, even when the first looks sufficient. This is the **exhaust-the-design-space** principle skill made concrete. Whole-shape alternatives, not point fixes inside one shape.
+Design it three times. Require three structurally distinct candidates before synthesis, one from each configured Architect runner, even when the first looks sufficient. This is the **exhaust-the-design-space** principle skill made concrete. Whole-shape alternatives, not point fixes inside one shape.
 
 Screen every candidate against [`references/design-red-flags.md`](references/design-red-flags.md) before synthesis. Reject or revise shallow modules, information leakage, temporal decomposition, and pass-through methods.
 

@@ -24,20 +24,20 @@ The N candidates will receive the same prompt, so the prompt is the contract.
 
 1. State the artifact each candidate is producing.
 2. Derive the rubric. State what success looks like for *this* task, then turn it into 3-6 concrete gradeable criteria. The rubric is the picker's tool in Phase D. Candidates only see the task.
-3. Pick the runners. Honor an explicit runner list from the caller (including Architect); otherwise use `arena runners` from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` when present. Otherwise default to one each on `gpt-5.6-sol` at `high` reasoning, `gpt-5.6-terra` at `high` reasoning, `gpt-5.6-luna` at `high` reasoning. Spawn more when the arena covers multiple design directions. Same model N times when the work is generation-bound rather than judgment-sensitive.
+3. Pick the runners. Honor an explicit runner list from the caller (including Architect); otherwise use `arena runners` from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` when present. Otherwise default to one each on `gpt-6-astra` at `medium`, `gpt-6-sol` at `high`, `gpt-5.6-sol` at `high`, `claude-opus-5-5` at `high`, `claude-fable-5-1` at `high`. Spawn more when the arena covers multiple design directions. Same model N times when the work is generation-bound rather than judgment-sensitive.
 4. Assign output paths. Each candidate writes to its own location (a git worktree where possible, otherwise `/tmp/arena-<slug>/candidate-<n>/`), per the **separate-before-serializing-shared-state** principle skill.
 
 ## Phase B: Fan out
 
-Launch all N candidates concurrently with the task, the path to the shared grounding, their own output path, and instructions to produce both the artifact and a short rationale. Use Codex collaboration agents with `model` and `reasoning_effort` for Codex entries. Run `claude-fable-5-1` entries through `claude -p --model claude-fable-5-1 --effort <effort>` with the same candidate inputs and output contract.
+Launch all N candidates concurrently with the task, the path to the shared grounding, their own output path, and instructions to produce both the artifact and a short rationale. Use Codex collaboration agents with `model` and `reasoning_effort` for Codex entries. Run Claude entries through `claude -p --model <slug> --effort <effort>` with the same candidate inputs and output contract. `claude-opus-5-5` requires Claude Code 2.1.280 or newer. Schedule in waves when runner count exceeds available concurrency; keep one candidate per configured entry.
 
 Each rationale names the alternatives the candidate considered and what it rejected.
 
 If a candidate fails to produce output, proceed with N-1 and note the dropout in the synthesis record.
 
 ## Phase C: Cross-judge
 
-After all Phase B candidates complete, choose one model from the `arena cross-judge pool` in `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` when present. Otherwise use `gpt-6-astra` at `medium` reasoning, `gpt-5.6-sol` at `high` reasoning. Prefer a different model family from the parent's. Spawn one judge agent on that model and instruct it not to edit files or change repository state. It sees the rubric and the candidates by path label, scores each criterion, and recommends a base with rationale. It runs in parallel with the parent's reading in Phase D, not with the candidates themselves. Don't spawn the judge while candidates are still writing.
+After all Phase B candidates complete, choose one model from the `arena cross-judge pool` in `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` when present. Otherwise use `gpt-6-astra` at `medium` reasoning, `gpt-6-sol` at `high` reasoning. Prefer a different model family from the parent's. Spawn one judge agent on that model and instruct it not to edit files or change repository state. It sees the rubric and the candidates by path label, scores each criterion, and recommends a base with rationale. It runs in parallel with the parent's reading in Phase D, not with the candidates themselves. Don't spawn the judge while candidates are still writing.
 
 ## Phase D: Pick a base
 

@@ -54,12 +54,12 @@ P=$(mktemp); cat >"$P" <<'EOF'
 <goal, repo + key paths, constraints ("don't touch X"), non-goals, proof expected, output shape>
 EOF
 command codex exec --yolo -C <repo> \
-  -m gpt-5.6-sol \
+  -m gpt-6-sol \
   -c model_reasoning_effort="high" \
   -o /tmp/codex-last.md - <"$P" 2>/dev/null
 ```
 
-- Model default: `gpt-5.6-sol`, effort `high` — pin both explicitly; don't rely on user config.
+- Model default: `gpt-6-sol`, effort `high` — pin both explicitly; don't rely on user config.
 - Never fast mode: no `--enable fast_mode`, on any route.
 - `--yolo` is the house default; Codex may run commands/tests freely. Keep prompts scoped to the target repo.
 - `command codex` bypasses any interactive shell alias. If codex isn't on PATH, it depends on how it was installed:
@@ -95,7 +95,7 @@ Follow-up fixes — cheaper than fresh runs, keeps context. `resume` has no `-C`
 For runs you must not babysit, trade the stderr suppression for a log and watch its mtime; read only the `-o` file into context, never the log body.
 
 ```bash
-command codex exec --yolo -C <repo> -m gpt-5.6-sol \
+command codex exec --yolo -C <repo> -m gpt-6-sol \
   -c model_reasoning_effort="high" \
   -o "$OUT" - <"$P" > "$LOG" 2>&1
 # Claude Code: run the line above as its own Bash run_in_background call

@@ -20,23 +20,23 @@ When in doubt, take the simple path.
 
 Decompose the question into 2 to 4 exploration angles, each a distinct slice of the subsystem. Spawn all explorers concurrently:
 
-- `model`: your configured `how explorer` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-5.6-luna` at `high` reasoning)
+- `model`: your configured `how explorer` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-6-luna` at `high` reasoning)
 
 Each explorer gets the prompt in `references/explorer-prompt.md` with its angle filled in. Then go to Step 3.
 
 ## Step 2b. Direct Explain (simple questions)
 
 Spawn one agent that explores and explains in one pass:
 
-- `model`: your configured `how explainer` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-5.6-sol` at `high` reasoning)
+- `model`: your configured `how explainer` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-6-sol` at `high` reasoning)
 
 Build its prompt from `references/explainer-prompt.md` without the explorer-findings section. Go to Step 4.
 
 ## Step 3. Synthesize (complex questions only)
 
 Once all explorers have returned, spawn one agent to synthesize their findings into one explanation:
 
-- `model`: your configured `how explainer` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-5.6-sol` at `high` reasoning)
+- `model`: your configured `how explainer` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-6-sol` at `high` reasoning)
 
 Build its prompt from `references/explainer-prompt.md` with every explorer's findings filled in.
 

@@ -37,7 +37,7 @@ Launch all reviewers as Codex collaboration agents. Use the `interrogate reviewe
 | Subagent | Default model |
 |----------|---------------|
 | Reviewer A | `gpt-6-astra` at `high` reasoning |
-| Reviewer B | `gpt-5.6-sol` at `high` reasoning |
+| Reviewer B | `gpt-6-sol` at `high` reasoning |
 | Reviewer C | `claude -p --model claude-fable-5-1 --effort xhigh` |
 
 For each reviewer:

@@ -15,7 +15,7 @@ Use the caller's files or diff. Otherwise use the current diff against the base
 
 ## Steps
 
-1. Spawn a Codex collaboration agent with the Comment Sicko instructions from `references/comment-sicko.md`, using your configured `Comment Sicko` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-5.6-luna` at `high` reasoning). Pass the scope. Do not restate its rules.
+1. Spawn a Codex collaboration agent with the Comment Sicko instructions from `references/comment-sicko.md`, using your configured `Comment Sicko` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-6-luna` at `high` reasoning). Pass the scope. Do not restate its rules.
 2. Inspect its report and diff. Reject application-code edits, scope escapes, exception-protected deletions, misstated `MUST KILL` reasons, and flags that treat kept intentional code as guilty. Reshape flags on our-code surprises stay actionable. Do not restore those comments. A keep survives only with proof it is about something we cannot change. Audit missed scoped lint and TypeScript suppressions. Correctness or safety suppressions stay actionable `MUST KILL`s. Restore deletions only with exact exceptions and scoped proof. Before accepting thin `IMPORTANT` or `do not remove` kills or keeps, run `$how` or `$why` on their symbol. If a kill is ambiguous, do not restore. If a keep is refuted or still ambiguous, delete it. Revert and rerun one rejected report with the failure named. Reject a second, report it open, and fail `$no-comments`.
 3. Fix trivial accepted flags directly by deleting a dead path, dropping a parameter, or using the real API. If any fix needs a shape, run `$architect` once for the accepted set and surrounding code. Stop at the sketch. Architect shapes. Step 4 implements.
 4. Implement the smallest root-cause fix in scope. Remove every named workaround. If the root cause is out of scope, land the smallest in-scope fix and report the rest open. The **principle-fix-root-causes** and **principle-redesign-from-first-principles** skills guide intent only. Neither authorizes widening the fence nor fixing instances outside it. Never bolt on symptom guards.

@@ -85,7 +85,7 @@ Read the leaf skill in full for any principle you apply. Each entry names when i
 
 **Use the `poteto-agent` instructions in `references/poteto-agent.md` for any subagent you spawn inside a playbook step** (code-writing delegates, ad-hoc helpers). `$poteto-mode` and `poteto-agent` route through the same wrapper. Routed workflow skills (`how`, `why`, `interrogate`, `reflect`, `swarm`) set their own subagent instructions for diverse-model review. Respect what the skill prescribes, don't override to `poteto-agent`.
 
-**Defaults for every spawn.** `fork_turns: "none"` (Codex forks the whole parent context by default), concurrent when independent, file pointers not inlined context, explicit model per role (configurable via `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md`. Defaults `gpt-5.6-sol` at `high` reasoning for code, `gpt-6-astra` at `medium` reasoning for prose and judgment). Code delegates tier by difficulty. The hardest changes (cross-cutting design, gnarly concurrency, subtle algorithms) go to your strongest judgment model (`gpt-6-astra` at `high` reasoning), whether the task needs judgment on vague intent or is a precisely specified sequence of steps to execute to the letter. Trivial mechanical edits go to your fast code model. Per-role lines in `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` override these defaults and the model choices in the routed skills (`how`, `why`, `arena`, `swarm`, `architect`, `interrogate`, `reflect`). A role with no row keeps its default.
+**Defaults for every spawn.** `fork_turns: "none"` (Codex forks the whole parent context by default), concurrent when independent, file pointers not inlined context, explicit model per role (configurable via `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md`. Defaults `gpt-6-sol` at `high` reasoning for code, `gpt-6-astra` at `medium` reasoning for prose and judgment). Code delegates tier by difficulty. The hardest changes (cross-cutting design, gnarly concurrency, subtle algorithms) go to your strongest judgment model (`gpt-6-astra` at `high` reasoning), whether the task needs judgment on vague intent or is a precisely specified sequence of steps to execute to the letter. Trivial mechanical edits go to your fast code model. Per-role lines in `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` override these defaults and the model choices in the routed skills (`how`, `why`, `arena`, `swarm`, `architect`, `interrogate`, `reflect`). A role with no row keeps its default.
 
 You own every subagent's work. Review the diff and write your own summary, don't pass through what it said. Interrupt-chained resumes silently drop directives, so fire a fresh subagent with consolidated scope rather than trusting a "done" summary. A second opinion is the same prompt against a different model. Agreement is high-signal.
 

@@ -6,7 +6,7 @@ Be scientific. Every shipped line traces to runtime evidence. Belt-and-suspender
 
 1. Reproduce it yourself on the matching surface via the control skill (Non-negotiables). Don't hand the repro to the user. A debug or instrumentation protocol that says to ask the user does not override this. You drive the instrumented runtime. Ask the user only with a stated, specific reason the control surface cannot reach the target, and only after driving it as far as it goes. Won't reproduce directly, force it: synthesize the trigger, tighten conditions, or instrument until it fires.
 2. Binary-search the cause. Form the candidate hypotheses, then rule them out until one survives. Seed them with `how` over the affected subsystem and the **why** skill for regression history. Each pass, take the split that cuts the most remaining problem space, get runtime evidence, eliminate. When program state is unclear, add instrumentation or logging and read it as the code runs. Don't guess. Drive a long or stubborn hunt with Codex's `/goal` command. Confirm the surviving *mechanism* with runtime evidence before the step-3 architect/interrogate fan-out.
-3. Plan the fix. If it crosses a function boundary, `architect` first. Delegate implementation to a subagent using your configured `bug-fix` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-5.6-sol` at `high` reasoning) with a specific scope. Review the diff.
+3. Plan the fix. If it crosses a function boundary, `architect` first. Delegate implementation to a subagent using your configured `bug-fix` model from `${CODEX_HOME:-$HOME/.codex}/skills/poteto-mode/references/models.md` (default `gpt-6-sol` at `high` reasoning) with a specific scope. Review the diff.
 4. Verify on the same surface. The original repro now passes. "Inconclusive" or wrong-surface is not a pass. Flag it. Unit tests show branch behavior, not bug absence.
 5. Stage the commits so the failing repro lands before the fix in git history. See the **tdd** skill for the failing-test-first cadence when the bug has a cheap local test path. Skip it when the test would be expensive, integration-heavy, or unclear.
    This is the canonical **sequence-verifiable-units** principle skill, the failing test first and the fix on top.