Limit codex to QA review in the /flow command (item 47)

.claude/commands/flow.md

@@ -70,23 +70,42 @@ private-context reference at source.
 Per item:
 (a) SEED BRIEF: 1 self-contained brief embedding all needed context (problem, exact file/line facts,
     constraints, deliverable shape, acceptance criteria).
-(b) SEEDS: `orch-verify claude|codex|gemini <brief> /opt/cleanlanguage/cleanlanguage --expensive`, the
-    same brief to all 3 in parallel. A family genuinely unreachable OR at its cost cap is
-    skip-and-note (combine at a minimum of 2, queue a re-combine when it returns), never a block.
-(c) COMBINE with Fable: `orch-verify claude <combine-brief> ... --expensive` (the --expensive claude tier
-    is claude-fable-5). The combiner ADJUDICATES (state settled design; name disagreements + recommend;
+(b) SEEDS: `orch-verify claude|gemini <brief> /opt/cleanlanguage/cleanlanguage --expensive`, the
+    same brief to both in parallel. A family genuinely unreachable OR at its cost cap is
+    skip-and-note (combine at a minimum of 2 by adding an independent, differently-primed second seed,
+    given the same facts but a different framing and run in a separate clean context, drawn from
+    the reachable family; queue a re-combine when the skipped family returns), never a block to seeding;
+    when neither combiner in (c) can combine, the COMBINE step is still HELD, as (c) states. If no seed
+    family can run (each is unreachable or at its cost cap), the SEED step is HELD as (c) holds the
+    COMBINE step: the item is not execution-ready, the hold is recorded, and the run routes to the next
+    independent item.
+(c) COMBINE with Fable: `orch-verify claude <combine-brief> ... --super-expensive` (claude-fable-5 at
+    high effort). The combiner ADJUDICATES (state settled design; name disagreements + recommend;
     do not average into mush; discard hallucinated claims, verify at source). Fallback when Fable is
-    exhausted: `orch-verify codex <combine-brief> ... --model gpt-5.6-sol --effort xhigh` (an explicit
-    override; note --expensive codex is gpt-6-astra, not this). NEVER gemini as combiner of record;
+    exhausted or unreachable: `orch-verify claude <combine-brief> ... --expensive` (claude-opus-5-5 at
+    xhigh effort).
+    NEVER codex or gemini as a combiner, of record or otherwise;
     NEVER orchestrator self-synthesis as the combiner.
+    The ONLY lawful combiners are Fable and that fallback (NEVER any other claude tier);
+    when neither can combine, the COMBINE step is HELD: the item is not execution-ready, the
+    hold is recorded, and the run routes to the next independent item.
 (d) PLAN: land it with a numbered step list, a file manifest, an acceptance/verification section, a
     QA-tier declaration, and a rollback note. Execution-ready only when it passes that shape.
 (e) IMPLEMENT (serial): the orchestrator VERIFIES the plan against the seeds + live tree, may dispatch an
-    implementation DRAFT to a worker, then FINALIZES it serially, re-verifying every line at source, as
-    the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge.
+    implementation DRAFT to a claude worker, then FINALIZES it serially, re-verifying every line at
+    source, as the SOLE writer/merger. Commit BEFORE dispatching QA (QA pins a revision); then run the
+    tier's QA, fix at the WIDTH OF THE DEFECT CLASS, re-QA on the fixed state, and merge.
 
 GEMINI ROLE LIMIT: gemini may SEED and QA but NEVER plan-combines or drafts the implementation.
 
+CODEX ROLE LIMIT: codex may QA ONLY; it NEVER seeds, plan-combines, drafts the implementation, or fixes.
+Every codex leg is dispatched with `ORCH_MAX_FAILOVERS=1`. A review that hunts for ways past a security
+control (a review whose task is to find inputs, commands, or paths that a guard, hook, sandbox, filter,
+or permission check fails to block) NEVER goes to codex: run it on claude + gemini, adding an
+independent, differently-primed claude pass in a separate clean context, recorded as a fleet-rule
+substitution, where the tier needs a third family. The orchestrator classifies each review at brief
+time and records the classification in the item QA record.
+
 PROHIBITED: dispatch seeds in the background then END THE TURN before collecting them. STATE, DO NOT
 PROMISE: collect through the tracked background mechanism that survives to completion.
 
@@ -95,18 +114,26 @@ AIQT HOLD: plan-production throughput NEVER shortens a change's per-tier QA.
 ## Tiers (per the machine-local /opt/cleanlanguage/.claude/CLAUDE.md)
 
 - LIGHT (quick fix / bookkeeping / version bumps / record edits): implement directly; mechanical gates;
-  DUAL-family QA (claude + codex; gemini excluded on cost, which is allowed only because 2 families still
-  meet the verifier-diversity floor).
+  DUAL-family QA (claude + codex, or claude + gemini where the CODEX ROLE LIMIT bars codex; gemini is
+  otherwise excluded on cost, which is allowed only because 2 families still meet the verifier-diversity
+  floor).
 - SUBSTANTIVE (skill/site-corpus change; new/edited gate/linter/hook/tool; multi-surface; control value /
-  citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex;
+  citation / normative rule; new feature): the full pipeline; TRI-family adversarial QA weighting codex
+  within the CODEX ROLE LIMIT; where that limit bars codex, that weighting passes to gemini, and the
+  codex seat is filled as the CODEX ROLE LIMIT states;
   validate every finding at source; up to 4 fixing rounds; if it has not converged, trigger a premise review (re-derive the problem from fresh observation) and escalate the ITEM with a too-many-rounds flag and recommendation, continuing other authorized work. The round limit alone never closes the session.
 - SENSITIVE (gate-blind correctness AND delicate scale AND high escaped-error cost, all 3): substantive
   plus the high-assurance harness (independent adversarial verifiers, deterministic apply, a persistent
   register). No de-escalation without a maintainer decision.
 
-VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE, never
-for cost; cost never buys the reduction. When a required family is genuinely unreachable, run an independent, differently-primed second pass in a separate clean context as the recorded fallback, and re-run the dropped family once it returns. QA is dispatched read-only via `orch-verify`; judge by the
-result signal, not by grepping worker output.
+VERIFIER DIVERSITY (QA, every tier): a required family is dropped only when genuinely UNREACHABLE,
+never for cost; cost never buys the reduction. A codex seat barred by the CODEX ROLE LIMIT is filled
+by gemini only where gemini does not already hold a seat (a dual-family tier); where it does, the
+CODEX ROLE LIMIT claude pass fills it. Either way, the substitute is recorded as a fleet-rule
+substitution, not as an unavailability drop. When a required family is genuinely unreachable, run an
+independent, differently-primed second pass in a separate clean context as the recorded fallback, and
+re-run an unreachable family once it returns. QA is dispatched read-only via `orch-verify`; judge by
+the result signal, not by grepping worker output.
 
 ## Gates and merge (cleanlanguage)