feat: route routine reviews to Terra high

README.md

@@ -37,12 +37,14 @@ The bootstrap router uses five profiles:
 | --- | --- |
 | Discovery, tests, mechanical edits | Luna high |
 | Standard implementation | Terra max |
-| Planning, integration, composite review | Sol medium |
-| Routine adversarial or correctness review | Sol high |
+| Planning and integration | Sol medium |
+| Routine adversarial or correctness review | Terra high |
 | Security, architecture, migrations, difficult ambiguity | Sol max |
 
 Direct `model` and `reasoning_effort` overrides are used when the active spawn schema supports them. Otherwise VoltFlow selects a matching agent profile when possible; if neither route exists, it inherits the parent and reports `routing degraded` instead of pretending the requested profile ran.
 
+Routine review-only agents are cost-controlled: they must explicitly use Terra high. Sol is reserved for a named authorization, private-data, payment, booking, destructive/data-integrity migration, or cross-cutting-architecture risk, or a direct user request.
+
 This table starts from the community [Codex quota frontier analysis](https://www.reddit.com/r/codex/comments/1ut3bnp/the_codex_pareto_frontier_luna_high_terra_max_sol/), checked against the different [Artificial Analysis API-cost frontier](https://artificialanalysis.ai/articles/gpt-5-6-intelligence-vs-cost-across-sol-terra-luna). It is a prior, not a permanent benchmark result. OpenAI's [GPT-5.6 prompt guidance](https://developers.openai.com/api/docs/guides/prompt-guidance-gpt-5p6) supplies the prompt shape: one outcome, explicit constraints, evidence, and a stopping condition, with each rule stated once.
 
 ## Multi-agent compatibility

skills/voltflow/SKILL.md

@@ -71,7 +71,7 @@ Before spawning a reviewer, state the supported product boundary and material co
 
 When failures share one mechanism, fix and test that mechanism once. Do not keep adding syntax-specific patterns after the boundary is characterized. If complete enforcement would require a shell parser, a general solver, or control over an interception surface the host does not provide, keep the local guard conservative, document the limit, and route authoritative enforcement to the controller or project configuration.
 
-After a failed review, group findings by root cause and rerun only affected coverage. If a rerun finds another variant of the same bounded limitation, stop patching variants and reassess the abstraction or accepted boundary. Finish when the original acceptance criteria have current evidence and no material ordinary-use blocker remains. Use Sol high for routine independent review; raise effort only for a named risk that changes the completion bar.
+After a failed review, group findings by root cause and rerun only affected coverage. If a rerun finds another variant of the same bounded limitation, stop patching variants and reassess the abstraction or accepted boundary. Finish when the original acceptance criteria have current evidence and no material ordinary-use blocker remains. Use Terra high for routine independent review. Use Sol only when the review names an authorization, private-data, payment, booking, destructive-migration, data-integrity, or cross-cutting-architecture risk that changes the completion bar, or when the user explicitly requests Sol.
 
 ## Gate deployment
 

skills/voltflow/references/routing.md

@@ -6,16 +6,16 @@ Use the smallest profile that clears the task. These profiles seed VoltFlow's ro
 | --- | --- |
 | `gpt-5.6-luna`, `high` | Read-heavy discovery, focused test execution, mechanical edits, and simple pattern-following work. |
 | `gpt-5.6-terra`, `max` | Standard implementation inside established architecture and bounded multi-file changes. |
-| `gpt-5.6-sol`, `medium` | Planning, integration, and composite review that need global coherence without max-cost reasoning. |
-| `gpt-5.6-sol`, `high` | Routine adversarial review, correctness checks, and bounded security review without a named high-risk boundary. |
+| `gpt-5.6-terra`, `high` | Routine independent review, adversarial correctness checks, and bounded security review without a named high-risk boundary. |
+| `gpt-5.6-sol`, `medium` | Planning and integration that need global coherence without max-cost reasoning. |
 | `gpt-5.6-sol`, `max` | High-risk architecture, security, concurrency, migrations, and ambiguous work where a missed constraint is expensive. |
 
 ## Routing rules
 
 1. Choose by difficulty, not by role title. A mechanical security-file edit can use Luna; a subtle one-file race can require Sol max.
 2. Set `model` and `reasoning_effort` directly when the spawn schema exposes them. Omit `service_tier`.
 3. If only `agent_type` is available, select a profile that pins the required model and effort. If neither override surface exists, inherit the parent and state `routing degraded` once in the result.
-4. Use Sol medium for the normal planner and composite reviewer, and Sol high for routine independent review lanes. Raise to Sol max only for a named high-risk fact.
+4. Use Terra high for routine review-only agents. The controller requires it explicitly, so do not inherit the parent model. Use Sol only with a named high-risk exception (authorization, private data, payments, bookings, destructive/data-integrity migrations, or cross-cutting architecture) or when the user explicitly requests it.
 5. Size each wave to the useful independent slices and the host's available concurrency. Do not create slices solely to increase agent count.
 
 ## Spawn schema