Expose observed model identity and single-lane semantics instead of presenting static policy selection as team routing

[moonweave]

Context

The current default model policy is a static lookup: runner lanes resolve to Codex (gpt-5.6-luna/gpt-5.6-sol) and reviewer lanes resolve to AGY (gemini-3.5-flash). The policy selects a requested adapter/model, but the model declaration layer correctly marks some adapter/model results as requested-unverified when the provider gives no reliable identity signal.

For the default code-change path, flowplan currently compiles one runner lane and records multi_model_execution: false. That is honest metadata, but the surrounding team/workflow surface still makes users ask whether a team or multi-model run actually occurred. A current plan also does not give one compact view of requested adapter/model, observed adapter/model, fallback, project-context identity, and the number of execution/reviewer lanes.

Why this matters

A static routing choice is not the same thing as an observed model execution. Without the distinction, operators cannot tell whether a requested model ran, whether a provider silently fell back, or whether a “team” run was only one execution lane. This makes benchmarking, incident review, and handoff decisions harder.

Requested contract

Make the distinction first-class in plan, run, status, and handoff output:

• requested policy: role, tier, adapter, model, and budget;
• observed execution: adapter/model identity and observation status;
• fallback/unavailable/context-binding status;
• lane counts with a prominent 1 execution lane / 0 reviewer lanes style summary;
• an explicit multi-lane/multi-model opt-in or rolepack requirement rather than implying that the default single runner is a team.

This is a follow-up to the completed honest-labeling work in #33/#46, not a request to undo multi_model_execution: false.

Suggested acceptance criteria

• JSON receipts/status expose requested vs observed identity without conflating them.
• Unknown or unverified identity is visible and cannot be rendered as a confirmed benchmark result.
• Human summaries state lane counts and reviewer presence plainly.
• Tests cover the default single-lane code-change path and an explicit multi-lane path.

Evidence collected against the installed release set on 2026-07-26.

[moonweave]

Phase 1 shipped in witnessd 2.34.0 (PR #215), designed in #139.

The run-scoped orro status now separates requested from observed identity in distinct columns, states a missing observation as its own fact rather than falling back to the request, reports lane counts from observation, keeps the Depone verdict apart from the four producer declarations the verifier does not re-derive, and no longer describes a single runner lane as a team.

Two dependencies were fixed first, because building this view on them would have baked the conflation in: witnessd #212 (the plan was overwriting the observation, under an 'evidence present' heading) and witnessd #211 (a signed declaration asserted a write-scope violation on a passing run).

Phase 2 remains open in the design: repository identity, the observed model as a field, and ledger lane model/tier — all producer-side capture that does not exist today. Repository identity is deliberately absent from the view rather than derived from the run directory path.