Faber spawns coders with configured model + bounce protocol (#111)

[yihanzhu]

What

Wires up the config/models.conf foundation (#109) into the coder-spawn path, in manager/CLAUDE.md and mirrored in templates/faber-command.md:

1. Coder spawn tiering. Before spawning any coder subagent (round-0 or fix-mode), Faber reads config/models.conf from the control-plane repo, then the target repo's committed .fabrica/models.conf override if present (override wins). Every coder spawn passes an explicit model parameter = FABRICA_CODER_MODEL. The tier is a fixed ceiling — never escalated at runtime, not for bounced rounds, not for risk:high issues. Per-target overrides are static per-repo commitments, never per-task rescues.
2. Bounce protocol (replaces any notion of model escalation). On a bounced review round Faber diagnoses and takes exactly one exit:
   • (a) Spec gap → amend the revision brief with a Faber-authored diagnosis of what the finding means and the intended fix approach; respawn at the SAME tier.
   • (b) Scope too big / genuinely hard → decompose: land the independently-green mergeable core (must pass CI + review and leave the repo coherent, docs in sync); file AND link the follow-up issue BEFORE merging the partial PR; the follow-up inherits the parent issue's approval only as a strict subset of the approved scope — anything beyond goes through the normal gate.
   • (c) Stuck / reviewer disagreement → existing rounds cap → needs-human, unchanged. Decomposition happens WITHIN the cap and never extends it.
3. Capability-ceiling rationale woven in at the point of use: a task exceeding the coder tier signals an upstream spec/scope failure — frontier models think (specs, diagnoses, debate), they never type code.
4. Faber persona note: Faber's own session is expected to run a frontier-tier model; if Faber detects otherwise, it warns the user once at session start.

Also updates README's "Model policy" section (## Model policy) to note the coder spawn is now wired via Faber's own instructions — the hands-work ceiling (FABRICA_HANDS_MODEL) and gate model/effort routing remain unwired, follow-up work for #112.

Why

Coder subagents currently inherit Faber's frontier session model — the dominant usage-throttle driver. Capability ceilings are load-bearing: they force scope discipline upstream instead of reaching for a bigger model mid-task.

Scope

This PR touches only the coder-spawn/model/bounce-protocol concern (#111). The hands/delegation policy is out of scope — that's #112, a separate PR.

Closes #111

Sync

Sync: prompt-only change — inert until scripts/install.sh is re-run to regenerate the live /faber command. Merging does not change live behavior.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 64e279f
Reviewed-base: 1425781

Posted verbatim by codex-review.sh (codex exec review --base refs/codex-review/114-87332/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

No actionable findings were identified.

[cloudflare-workers-and-pages]

Deploying fabrica with    Cloudflare Pages

Latest commit:	32d8110
Status:	✅  Deploy successful!
Preview URL:	https://70079bb8.fabrica-6yx.pages.dev
Branch Preview URL:	https://coder-111-coder-spawn-tier.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Addressed the P2 on bounce-exit (b): follow-up-issue "strict subset" was previously judged only by Faber's prompt-level reading, which let scope-creep dressed as decomposition slip past the approval gate via code review + auto-merge.

Tightened in both manager/CLAUDE.md (exit (b), and the cap-step-4 restatement) and templates/faber-command.md (condensed, single mention): the follow-up issue body must now (1) link the parent issue, (2) quote the parent's approved scope verbatim, and (3) state explicitly which subset of that quote it carries. Faber verifies the follow-up against the quoted scope before treating any of it as pre-approved — anything not clearly inside the quote goes through the normal front gate as new work.

Minimal/surgical — only the decomposition passages touched.

[yihanzhu]

Addressed the LOW consistency finding: reworded the target .fabrica/models.conf override instruction in both manager/CLAUDE.md and templates/faber-command.md. Previously "sourced after" could read as license for Faber to .-source the target repo's committed override file inside its own operator-credentialed session. Now both files are explicit that the target override is parsed as FABRICA_<KEY>=<value> data, never shell-sourced/executed — only the control-plane's own config/models.conf may be sourced (it's operator-owned). This mirrors the parse-not-source principle #115 establishes for the reviewer harness, applied here at the higher-privilege layer of Faber's own session. Resolution semantics are unchanged: the target override still wins on any key it sets. Wording only, both files kept mirrored. Pushed as b9c04a2.

[yihanzhu]

Rebased onto current `main` (post-#115) to resolve a conflict in the README "Model policy" section — both this PR and #115 had edited the same wiring-status paragraph.

Conflict: #115 (already on main) updated the paragraph to say the review/manager-debate gates now read `config/models.conf`, removing the stale "gates don't read this yet" wording — but at that point main still described the coder spawn as unwired follow-up. This branch's commit had also rewritten that same paragraph, to say the coder spawn (#111) now reads the config, but (written before #115 merged) it still said "hands + gates remain follow-up," which is now stale re: gates.

Resolution: merged both intents into one accurate paragraph — gates wired (#115) and coder spawn wired (#111), with only the hands-work ceiling (`FABRICA_HANDS_MODEL`, #112) left as follow-up. No "gates unwired" claim remains. New heading/lead-in:

Wiring status: gates + coder spawn wired, hands remains follow-up. The review and manager-debate gates (`scripts/codex-review.sh` / `scripts/manager-review.sh`) already read `config/models.conf` (and a target's `.fabrica/models.conf` override) to resolve the Codex model + reasoning effort for every run. The coder spawn now reads this config too (#111): ... Only the hands-work ceiling (`FABRICA_HANDS_MODEL`) remains unwired — follow-up work (#112).

`manager/CLAUDE.md` and `templates/faber-command.md` rebased cleanly (no conflicts) — this branch's coder-spawn tiering, bounce protocol, and parse-not-source content are unchanged on top of main.

Force-pushed the rebase (new head `32d8110`). Not merging — leaving that to the normal gate.