From b5dc5f4a281943259d3ce9606a6d269dc309585e Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Thu, 13 Aug 2026 18:16:39 -0400
Subject: [PATCH 1/3] feat: pin a separate implementation model for write jobs

Maestro pinned one Codex model shared by read-only debates and write
dispatches. Add an optional implementation model in
~/.codex/maestro-impl-model so write jobs can run on a different model,
inheriting the debate model when unpinned so existing installs are
unchanged.

--pin gains a fourth tab field, publish_pin extends its rollback
transaction to the third file, and companion_turn selects the model in
the same mode branch that already selects the effort. The session-start
and on-demand pickers now ask for the implementation model and carry the
curated menu.

Verified: tests/model-selector.sh (10 passed), tests/preflight.sh,
tests/bounded-calls.sh (22 passed), plus a standalone pin-contract check
confirmed red before the change.
---
 ARCHITECTURE.md                   |  12 +--
 hooks/codex-model-select.sh       | 127 +++++++++++++++++++++++++-----
 hooks/lib-companion.sh            |  40 ++++++----
 hooks/orchestrator-inject.mjs     |  16 ++--
 hooks/session-start.mjs           |  31 ++++++--
 tests/bounded-calls.sh            |  35 +++++++-
 tests/fixtures/fake-companion.mjs |  15 +++-
 tests/model-selector.sh           | 105 +++++++++++++++++++++++-
 8 files changed, 323 insertions(+), 58 deletions(-)

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index f16e665..19ddc8e 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -93,7 +93,7 @@ machine-readable", not for parallelism.
 
 | Component | Trigger | Responsibility | Depends on |
 |---|---|---|---|
-| `session-start.mjs` | `SessionStart` | Reads the Codex model/effort pin; emits the setup question (when armed via `~/.maestro/ask-on-start`); appends a validated `MAESTRO_SESSION_ID` export to `$CLAUDE_ENV_FILE` for session attribution | `~/.codex/config.toml`, `~/.codex/maestro-impl-effort` |
+| `session-start.mjs` | `SessionStart` | Reads the Codex model/effort pin; emits the setup question (when armed via `~/.maestro/ask-on-start`); appends a validated `MAESTRO_SESSION_ID` export to `$CLAUDE_ENV_FILE` for session attribution | `~/.codex/config.toml`, `~/.codex/maestro-impl-effort`, `~/.codex/maestro-impl-model` |
 | `orchestrator-inject.mjs` | `UserPromptSubmit` | Resets the direct-edit authorization flag on new tasks; sets it only on an explicit "edit it yourself"-class imperative; emits the orchestrator/implementer directive only when the prompt carries a code/design signal; intercepts "codex model" setup phrasing | `maestro-policy.mjs`, `~/.maestro/direct-edit/` |
 | `orchestrator-gate.mjs` | `PreToolUse` (`Edit\|Write\|MultiEdit`) | Blocks the orchestrator's direct source edits; allows non-code allowlisted files, anchored scratch/Desktop paths, any path carrying a `.claude` or `.codex` segment (harness exemption — segment-based, not root-anchored), and only a session-scoped, owner-private, exact-content direct-edit flag; refuses overrides inside subagents; fails closed on unreadable payloads | `maestro-policy.mjs`, `~/.maestro/direct-edit/` |
 | `maestro-policy.mjs` | (shared module) | Single source of truth for file classification (non-code extensions/basenames), session-id validation, and direct-edit directive parsing with negation/quote guards | none |
@@ -128,7 +128,7 @@ Layering is strict and directional: `lib-process.sh` → `lib-companion.sh` →
 
 | Component | Role |
 |---|---|
-| `codex-model-select.sh` | Transactionally pins Codex model + debate effort (in `~/.codex/config.toml`) and implementation effort (in `~/.codex/maestro-impl-effort`); serialized by its own lock; `--show`, `--pin`, `--ask-on-start on\|off` |
+| `codex-model-select.sh` | Transactionally pins Codex model + debate effort (in `~/.codex/config.toml`) and implementation effort/model (in `~/.codex/maestro-impl-effort` and `~/.codex/maestro-impl-model`); serialized by its own lock; `--show`, `--pin`, `--ask-on-start on\|off` |
 | `codex-mcp-check.sh` | Reports which MCP servers background Codex jobs inherit from `~/.codex/config.toml`, env keys masked |
 
 ### 2.6 Installer / uninstaller (package entry points)
@@ -203,7 +203,7 @@ kill without a recovery daemon.
 | Session-start preference | `~/.maestro/ask-on-start` | Empty marker file; armed by default on first install, managed by `codex-model-select.sh --ask-on-start on\|off` and removed by uninstall | `install.mjs`, `codex-model-select.sh` | `session-start.mjs`, `uninstall.mjs` |
 | Installer ownership manifest | `~/.maestro/install-manifest.json` | `{ "version": 1, "files": { "<key>": "<sha256>" } }`, `0600` | `install.mjs` | `install.mjs`, `uninstall.mjs` |
 | Session identity | `$CLAUDE_ENV_FILE` | `export MAESTRO_SESSION_ID=<validated id>` appended at session start | `session-start.mjs` | All lease/provenance code via `write_lock_session_id` |
-| Codex pin | `~/.codex/config.toml` (top-level `model`, `model_reasoning_effort`), `~/.codex/maestro-impl-effort` | TOML preamble / single line | `codex-model-select.sh` | `companion_pin`, `session-start.mjs` |
+| Codex pin | `~/.codex/config.toml` (top-level `model`, `model_reasoning_effort`), `~/.codex/maestro-impl-effort`, `~/.codex/maestro-impl-model` | TOML preamble / single line | `codex-model-select.sh` | `companion_pin`, `session-start.mjs` |
 | Hook registrations | `~/.claude/settings.json` | `hooks.<event>` blocks with exact `# maestro-managed:<script>` command markers | `install.mjs` | Claude Code |
 | Backups | `*.maestro.bak` beside settings/config | Byte copy of the pre-merge state | `install.mjs` | Operator, uninstall |
 
@@ -289,7 +289,7 @@ implementer-loop.sh --clear-lease
 implementer-watchdog.sh --file <plan-file> [max_idle] [poll]
 discussion-loop.sh --new "<topic>" [slug]
 discussion-loop.sh --turn <file> [slug] [max_idle] [poll]
-codex-model-select.sh --show | --pin | <model> <debate-effort> [impl-effort] | --ask-on-start on|off|status
+codex-model-select.sh --show | --pin | <model> <debate-effort> [impl-effort] [impl-model] | --ask-on-start on|off|status
 codex-mcp-check.sh
 node install.mjs [--with-workflow]
 node uninstall.mjs
@@ -377,7 +377,7 @@ agent processes. The "production environment" is:
 macOS (primary) / Linux  ──►  Claude Code (ships Node)  ──►  Codex CLI (ChatGPT login)
      ├── ~/.claude/           hooks/, rules/, skills/, settings.json
      ├── ~/.maestro/          install-manifest, discussions/, direct-edit/, ask-on-start
-     ├── ~/.codex/            config.toml, maestro-impl-effort
+     ├── ~/.codex/            config.toml, maestro-impl-effort, maestro-impl-model
      └── <repo>/.git/         maestro-write.lock/, maestro-provenance.log
 ```
 
@@ -599,7 +599,7 @@ flowchart LR
     HOOKS["Maestro hooks & adapters<br/>(installed into ~/.claude)"]
     GIT[("Working tree + .git<br/>lease lock, provenance log)")]
     MAE[("~/.maestro<br/>manifest, discussions, direct-edit")]
-    COD[("~/.codex<br/>config.toml, effort pin")]
+    COD[("~/.codex<br/>config.toml, effort/model pins")]
 
     U --> CC
     CC --> HOOKS
diff --git a/hooks/codex-model-select.sh b/hooks/codex-model-select.sh
index 08f6bfb..dc096a3 100644
--- a/hooks/codex-model-select.sh
+++ b/hooks/codex-model-select.sh
@@ -1,15 +1,15 @@
 #!/usr/bin/env bash
 # Maestro Codex model + debate/implementation effort selector.
 # Pins top-level model settings in ~/.codex/config.toml and keeps the
-# implementation effort in ~/.codex/maestro-impl-effort and the scout pin in
-# ~/.codex/maestro-scout.
+# implementation effort/model in ~/.codex/maestro-impl-effort and
+# ~/.codex/maestro-impl-model, plus the scout pin in ~/.codex/maestro-scout.
 #
 # Usage:
 #   codex-model-select.sh --show
 #   codex-model-select.sh --pin
 #   codex-model-select.sh --scout <model> <effort>
 #   codex-model-select.sh --scout-pin
-#   codex-model-select.sh <model> <debate-effort> [impl-effort]
+#   codex-model-select.sh <model> <debate-effort> [impl-effort] [impl-model]
 #   codex-model-select.sh --ask-on-start on|off|status
 #
 # Debate effort: none | minimal | low | medium | high | xhigh | max | ultra
@@ -19,6 +19,7 @@ set -uo pipefail
 
 CODEX_CONF="$HOME/.codex/config.toml"
 IMPL_EFFORT_FILE="$HOME/.codex/maestro-impl-effort"
+IMPL_MODEL_FILE="$HOME/.codex/maestro-impl-model"
 SCOUT_FILE="$HOME/.codex/maestro-scout"
 MAESTRO_DIR="$HOME/.maestro"
 ASK_FLAG="$MAESTRO_DIR/ask-on-start"
@@ -218,10 +219,19 @@ read_impl_effort() {
   printf -v "$1" '%s' "${VALUE:-medium}"
 }
 
+read_impl_model() {
+  local VALUE=""
+  if [ -f "$IMPL_MODEL_FILE" ]; then
+    IFS= read -r VALUE < "$IMPL_MODEL_FILE" || :
+  fi
+  printf -v "$1" '%s' "$VALUE"
+}
+
 show() {
-  local M E I SM SE
+  local M E I IM SM SE
   read_pin M E || return 3
   read_impl_effort I
+  read_impl_model IM
   echo "model=${M:-(not pinned — Codex default)}"
   if [ -n "$E" ] && ! valid_effort "$E"; then
     echo "effort=$E (invalid)"
@@ -229,6 +239,13 @@ show() {
     echo "effort=${E:-(not pinned — Codex default)}"
   fi
   echo "impl-effort=$I"
+  if [ -n "$IM" ] && valid_model "$IM"; then
+    echo "impl-model=$IM"
+  elif [ -f "$IMPL_MODEL_FILE" ] && [ -n "$IM" ]; then
+    echo "impl-model=$IM (invalid)"
+  else
+    echo "impl-model=${M:-(not pinned — Codex default)} (inherited)"
+  fi
   if [ ! -f "$SCOUT_FILE" ]; then
     echo "scout=(not pinned — scout dispatch disabled)"
   else
@@ -243,9 +260,10 @@ show() {
 }
 
 pin() {
-  local M E I
+  local M E I IM
   read_pin M E || return 3
   read_impl_effort I
+  read_impl_model IM
   if [ -z "$M" ] || [ -z "$E" ]; then
     echo "SELECT_ERROR: Codex model and effort must both be pinned in the config.toml preamble" >&2
     return 3
@@ -258,7 +276,12 @@ pin() {
     echo "SELECT_ERROR: invalid implementation effort '$I' (expected: none | minimal | low | medium | high | xhigh; max/ultra are debate-only because the companion wrapper cannot express them for write jobs)" >&2
     return 3
   fi
-  printf '%s\t%s\t%s\n' "$M" "$E" "$I"
+  if [ -n "$IM" ] && ! valid_model "$IM"; then
+    echo "SELECT_ERROR: invalid implementation model '$IM' (expected letters, digits, . _ -)" >&2
+    return 3
+  fi
+  [ -n "$IM" ] || IM="$M"
+  printf '%s\t%s\t%s\t%s\n' "$M" "$E" "$I" "$IM"
 }
 
 stat_mode() {
@@ -319,15 +342,19 @@ render_config() { # source destination model effort
   ' "$source" > "$destination"
 }
 
-publish_pin() { # model debate-effort impl-effort
-  local model="$1" effort="$2" impl="$3"
-  local config_source config_tmp impl_tmp config_original impl_original
-  local config_existed=0 impl_existed=0 config_mode=600 impl_mode=600
+publish_pin() { # model debate-effort impl-effort impl-model
+  local model="$1" effort="$2" impl="$3" impl_model="$4"
+  local config_source config_tmp impl_tmp model_tmp
+  local config_original impl_original model_original
+  local config_existed=0 impl_existed=0 model_existed=0
+  local config_mode=600 impl_mode=600 model_mode=600
   mkdir -p "$HOME/.codex" || return 3
   config_tmp="$CODEX_CONF.mtmp.$$"
   impl_tmp="$IMPL_EFFORT_FILE.mtmp.$$"
+  model_tmp="$IMPL_MODEL_FILE.mtmp.$$"
   config_original="$CODEX_CONF.moriginal.$$"
   impl_original="$IMPL_EFFORT_FILE.moriginal.$$"
+  model_original="$IMPL_MODEL_FILE.moriginal.$$"
 
   if [ -f "$CODEX_CONF" ]; then
     config_existed=1
@@ -348,19 +375,34 @@ publish_pin() { # model debate-effort impl-effort
       return 3
     }
   fi
+  if [ -f "$IMPL_MODEL_FILE" ]; then
+    model_existed=1
+    model_mode=$(stat_mode "$IMPL_MODEL_FILE") || {
+      rm -f "$config_original" "$impl_original"
+      return 3
+    }
+    cp -p "$IMPL_MODEL_FILE" "$model_original" || {
+      rm -f "$config_original" "$impl_original"
+      return 3
+    }
+  fi
 
   if ! render_config "$config_source" "$config_tmp" "$model" "$effort" ||
     ! chmod "$config_mode" "$config_tmp" ||
     ! printf '%s\n' "$impl" > "$impl_tmp" ||
-    ! chmod "$impl_mode" "$impl_tmp"; then
-    rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+    ! chmod "$impl_mode" "$impl_tmp" ||
+    ! printf '%s\n' "$impl_model" > "$model_tmp" ||
+    ! chmod "$model_mode" "$model_tmp"; then
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
     echo "SELECT_ERROR: could not stage Codex pin files" >&2
     return 3
   fi
 
   if [ "$config_existed" -eq 1 ] && [ ! -f "$CODEX_CONF.maestro.bak" ]; then
     cp -p "$CODEX_CONF" "$CODEX_CONF.maestro.bak" || {
-      rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+      rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+        "$config_original" "$impl_original" "$model_original"
       echo "SELECT_ERROR: could not back up config.toml" >&2
       return 3
     }
@@ -368,7 +410,8 @@ publish_pin() { # model debate-effort impl-effort
   fi
 
   if ! mv -f "$config_tmp" "$CODEX_CONF"; then
-    rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
     echo "SELECT_ERROR: could not publish config.toml" >&2
     return 3
   fi
@@ -379,14 +422,42 @@ publish_pin() { # model debate-effort impl-effort
     else
       rm -f "$CODEX_CONF"
     fi
-    if [ "$impl_existed" -eq 1 ] && [ ! -f "$IMPL_EFFORT_FILE" ]; then
-      cp -p "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null || :
+    if [ "$impl_existed" -eq 1 ]; then
+      [ -f "$IMPL_EFFORT_FILE" ] ||
+        cp -p "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null || :
+    else
+      rm -f "$IMPL_EFFORT_FILE"
     fi
-    rm -f "$config_tmp" "$impl_tmp" "$config_original" "$impl_original"
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
     echo "SELECT_ERROR: could not publish implementation effort; previous pin restored" >&2
     return 3
   fi
-  rm -f "$config_original" "$impl_original"
+  if ! mv -f "$model_tmp" "$IMPL_MODEL_FILE"; then
+    if [ "$config_existed" -eq 1 ]; then
+      mv -f "$config_original" "$CODEX_CONF" 2>/dev/null ||
+        cp -p "$config_original" "$CODEX_CONF" 2>/dev/null || :
+    else
+      rm -f "$CODEX_CONF"
+    fi
+    if [ "$impl_existed" -eq 1 ]; then
+      mv -f "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null ||
+        cp -p "$impl_original" "$IMPL_EFFORT_FILE" 2>/dev/null || :
+    else
+      rm -f "$IMPL_EFFORT_FILE"
+    fi
+    if [ "$model_existed" -eq 1 ]; then
+      mv -f "$model_original" "$IMPL_MODEL_FILE" 2>/dev/null ||
+        cp -p "$model_original" "$IMPL_MODEL_FILE" 2>/dev/null || :
+    else
+      rm -f "$IMPL_MODEL_FILE"
+    fi
+    rm -f "$config_tmp" "$impl_tmp" "$model_tmp" \
+      "$config_original" "$impl_original" "$model_original"
+    echo "SELECT_ERROR: could not publish implementation model; previous pin restored" >&2
+    return 3
+  fi
+  rm -f "$config_original" "$impl_original" "$model_original"
   return 0
 }
 
@@ -438,11 +509,15 @@ case "${1:-}" in
     esac
     exit $? ;;
   ""|--help|-h)
-    echo "usage: codex-model-select.sh --show | --pin | --scout <model> <effort> | --scout-pin | <model> <debate-effort> [impl-effort] | --ask-on-start on|off|status" >&2
+    echo "usage: codex-model-select.sh --show | --pin | --scout <model> <effort> | --scout-pin | <model> <debate-effort> [impl-effort] [impl-model] | --ask-on-start on|off|status" >&2
     exit 3 ;;
 esac
 
 pin_lock_acquire || exit 3
+[ "$#" -le 4 ] || {
+  echo "usage: codex-model-select.sh <model> <debate-effort> [impl-effort] [impl-model]" >&2
+  exit 3
+}
 MODEL="${1:-}"
 EFFORT="${2:-}"
 if [ $# -ge 3 ]; then
@@ -450,6 +525,12 @@ if [ $# -ge 3 ]; then
 else
   read_impl_effort IMPL_EFFORT
 fi
+if [ "$#" -eq 4 ]; then
+  IMPL_MODEL="$4"
+else
+  read_impl_model IMPL_MODEL
+  [ -n "$IMPL_MODEL" ] || IMPL_MODEL="$MODEL"
+fi
 
 if ! valid_model "$MODEL"; then
   echo "SELECT_ERROR: invalid model name '$MODEL' (expected e.g. gpt-5.6-sol — letters, digits, . _ -)" >&2
@@ -463,8 +544,12 @@ if ! valid_impl_effort "$IMPL_EFFORT"; then
   echo "SELECT_ERROR: invalid implementation effort '$IMPL_EFFORT' (expected: none | minimal | low | medium | high | xhigh; max/ultra are debate-only because the companion wrapper cannot express them for write jobs)" >&2
   exit 3
 fi
+if ! valid_model "$IMPL_MODEL"; then
+  echo "SELECT_ERROR: invalid implementation model '$IMPL_MODEL' (expected letters, digits, . _ -)" >&2
+  exit 3
+fi
 
-if ! publish_pin "$MODEL" "$EFFORT" "$IMPL_EFFORT"; then
+if ! publish_pin "$MODEL" "$EFFORT" "$IMPL_EFFORT" "$IMPL_MODEL"; then
   exit 3
 fi
-echo "SELECT: Codex pin updated → model=$MODEL debate-effort=$EFFORT impl-effort=$IMPL_EFFORT (applies from the next dispatch)"
+echo "SELECT: Codex pin updated → model=$MODEL debate-effort=$EFFORT impl-effort=$IMPL_EFFORT impl-model=$IMPL_MODEL (applies from the next dispatch)"
diff --git a/hooks/lib-companion.sh b/hooks/lib-companion.sh
index b7024fb..13c6ff3 100644
--- a/hooks/lib-companion.sh
+++ b/hooks/lib-companion.sh
@@ -142,32 +142,40 @@ companion_resolve() {
 }
 
 companion_pin() {
-  local here selector pin model efforts debate_effort impl_effort
+  local here selector pin model fields debate_effort impl_effort impl_model
   here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
   selector="$here/codex-model-select.sh"
   if ! pin=$(bash "$selector" --pin 2>/dev/null); then
-    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort>" >&2
+    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
     return 3
   fi
   case "$pin" in
-    *$'\t'*$'\t'*) ;;
+    *$'\t'*$'\t'*$'\t'*) ;;
     *)
-      echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort>" >&2
+      echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
       return 3 ;;
   esac
   model=${pin%%$'\t'*}
-  efforts=${pin#*$'\t'}
-  debate_effort=${efforts%%$'\t'*}
-  impl_effort=${efforts#*$'\t'}
-  if [ -z "$model" ] || [ -z "$debate_effort" ] || [ -z "$impl_effort" ]; then
-    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort>" >&2
+  fields=${pin#*$'\t'}
+  debate_effort=${fields%%$'\t'*}
+  fields=${fields#*$'\t'}
+  impl_effort=${fields%%$'\t'*}
+  impl_model=${fields#*$'\t'}
+  if [ -z "$model" ] || [ -z "$debate_effort" ] ||
+    [ -z "$impl_effort" ] || [ -z "$impl_model" ]; then
+    echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
     return 3
   fi
   if ! companion_wrapper_accepts_effort "$impl_effort"; then
     echo "unsupported implementation effort '$impl_effort' — choose none|minimal|low|medium|high|xhigh; max/ultra are debate-only" >&2
     return 3
   fi
-  printf '%s\t%s\t%s\n' "$model" "$debate_effort" "$impl_effort"
+  case "$impl_model" in
+    *[!a-zA-Z0-9._-]*)
+      echo "unsupported implementation model '$impl_model' — choose letters, digits, . _ -" >&2
+      return 3 ;;
+  esac
+  printf '%s\t%s\t%s\t%s\n' "$model" "$debate_effort" "$impl_effort" "$impl_model"
 }
 
 companion_start() { # companion prompt mode model effort lifecycle job-file stdout stderr
@@ -623,7 +631,7 @@ _companion_turn_cleanup() { # profile-file [retain-job-lock]
 companion_turn() { # mode prompt-file max-idle poll result-file profile-file evidence-file lifecycle
   local mode="${1-}" prompt_file="${2-}" max_idle="${3-}" poll="${4-}"
   local result="${5-}" profile="${6-}" evidence="${7-}" lifecycle="${8-}"
-  local prompt C pin efforts model effort job rc cleanup_rc derived
+  local prompt C pin fields model effort impl_model job rc cleanup_rc derived
   local override_model="${MAESTRO_COMPANION_MODEL-}"
   local override_effort="${MAESTRO_COMPANION_EFFORT-}"
   local override_model_set=0 override_effort_set=0
@@ -663,11 +671,15 @@ companion_turn() { # mode prompt-file max-idle poll result-file profile-file evi
   C=$(companion_resolve) || return 3
   pin=$(companion_pin) || return 3
   model=${pin%%$'\t'*}
-  efforts=${pin#*$'\t'}
+  fields=${pin#*$'\t'}
+  fields=${fields#*$'\t'}
+  effort=${fields%%$'\t'*}
+  impl_model=${fields#*$'\t'}
   if [ "$mode" = write ]; then
-    effort=${efforts#*$'\t'}
+    model=$impl_model
   else
-    effort=${efforts%%$'\t'*}
+    fields=${pin#*$'\t'}
+    effort=${fields%%$'\t'*}
   fi
   [ "${MAESTRO_COMPANION_MODEL+x}" = x ] && override_model_set=1
   [ "${MAESTRO_COMPANION_EFFORT+x}" = x ] && override_effort_set=1
diff --git a/hooks/orchestrator-inject.mjs b/hooks/orchestrator-inject.mjs
index cb32daa..9d2d154 100644
--- a/hooks/orchestrator-inject.mjs
+++ b/hooks/orchestrator-inject.mjs
@@ -97,13 +97,19 @@ if (directiveOpensGate(prompt)) {
 // it before the code-signal logic so "codex model" never triggers the work loop.
 if (/(codex (model|settings|effort|config)|pick (the )?codex|change codex|set codex)/i.test(prompt)) {
   process.stdout.write(
-    'CODEX MODEL SETUP — ask the user for the Codex model and separate role-specific efforts.\n' +
+    'CODEX MODEL SETUP — ask the user for the debate model, implementation model, and separate role-specific efforts.\n' +
     'Show current settings first:  bash ~/.claude/hooks/codex-model-select.sh --show\n' +
     'Debate effort governs read-only discussions; implementation effort governs write jobs.\n' +
-    'minimal/low = quick mechanics, medium = default, high = delicate work; max/ultra are\n' +
-    'debate-only because the companion cannot express them for write jobs.\n' +
-    'Apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>\n' +
-    'and confirm all three values in one line.'
+    'Implementation model — default: gpt-5.6-luna-max (with impl effort xhigh).\n' +
+    'Alternatives: gpt-5.6-sol at low | medium | high; gpt-5.6-luna at xhigh;\n' +
+    'gpt-5.6-terra at xhigh; gpt-5.6-terra-max. Availability depends on the\n' +
+    "user's ChatGPT plan.\n" +
+    'Debate default stays: model gpt-5.6-sol, effort max.\n' +
+    'Effort tiers max/ultra are debate-only — the companion wrapper accepts only\n' +
+    'none|minimal|low|medium|high|xhigh per write job, so a "max" tier on the\n' +
+    'implementation side is expressed as a *-max model name, not as an effort.\n' +
+    'Apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>\n' +
+    'and confirm all four values in one line.'
   );
   process.exit(0);
 }
diff --git a/hooks/session-start.mjs b/hooks/session-start.mjs
index 62ea310..3193dc7 100644
--- a/hooks/session-start.mjs
+++ b/hooks/session-start.mjs
@@ -14,6 +14,7 @@ try { payload = JSON.parse(fs.readFileSync(0, 'utf8')); } catch {}
 const HOME = os.homedir();
 const CONF = path.join(HOME, '.codex', 'config.toml');
 const IMPL_EFFORT = path.join(HOME, '.codex', 'maestro-impl-effort');
+const IMPL_MODEL = path.join(HOME, '.codex', 'maestro-impl-model');
 const SCOUT_PIN = path.join(HOME, '.codex', 'maestro-scout');
 const ASK = path.join(HOME, '.maestro', 'ask-on-start');
 
@@ -30,6 +31,15 @@ const debateEffort = pinnedDebateEffort || '(Codex default — not pinned)';
 const hasDispatchPin = Boolean(pinnedModel && pinnedDebateEffort);
 let implEffort = 'medium';
 try { implEffort = fs.readFileSync(IMPL_EFFORT, 'utf8').trim() || 'medium'; } catch {}
+let implModel = model;
+let hasImplModelPin = false;
+try {
+  const candidate = fs.readFileSync(IMPL_MODEL, 'utf8').trim();
+  if (/^[a-zA-Z0-9._-]+$/.test(candidate)) {
+    implModel = candidate;
+    hasImplModelPin = true;
+  }
+} catch {}
 let scout = 'unpinned';
 try {
   const pin = fs.readFileSync(SCOUT_PIN, 'utf8');
@@ -58,22 +68,27 @@ if (armed && source !== 'resume') {
     'Show the current pin first:\n' +
     '  bash ~/.claude/hooks/codex-model-select.sh --show\n' +
     'Then use the AskUserQuestion tool as an interactive picker, not a prose question, to ask:\n' +
-    `  1) Codex model for this session — current: ${model}. Availability depends on the user's\n` +
-    '     ChatGPT plan (e.g. gpt-5.6-sol if the plan reaches it).\n' +
+    `  1) Debate model for this session — current: ${model}.\n` +
     `  2) Debate/design effort — current: ${debateEffort}.\n` +
     `  3) Implementation effort — current: ${implEffort}.\n` +
-    'The real tiers are: none | minimal | low | medium | high | xhigh | max | ultra.\n' +
-    'max and ultra are available for debate/design only because the companion wrapper cannot\n' +
-    'express them as an explicit per-job implementation effort.\n' +
-    'Then apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>\n' +
-    'and confirm the new settings in one line. “Keep current” is valid only when the current pin is\n' +
+    `  4) Implementation model — current: ${implModel}.\n` +
+    'Implementation model — default: gpt-5.6-luna-max (with impl effort xhigh).\n' +
+    'Alternatives: gpt-5.6-sol at low | medium | high; gpt-5.6-luna at xhigh;\n' +
+    'gpt-5.6-terra at xhigh; gpt-5.6-terra-max. Availability depends on the\n' +
+    "user's ChatGPT plan.\n" +
+    'Debate default stays: model gpt-5.6-sol, effort max.\n' +
+    'Effort tiers max/ultra are debate-only — the companion wrapper accepts only\n' +
+    'none|minimal|low|medium|high|xhigh per write job, so a "max" tier on the\n' +
+    'implementation side is expressed as a *-max model name, not as an effort.\n' +
+    'Then apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>\n' +
+    'and confirm all four settings in one line. “Keep current” is valid only when the current pin is\n' +
     (hasDispatchPin
       ? 'complete; if the user declines or skips, preserve it and proceed.\n'
       : 'NOT complete: explain that Maestro cannot dispatch Codex until values are selected; do not claim setup succeeded.\n')
   );
 } else {
   process.stdout.write(
-    `Maestro: Codex pin is model=${model}, debate-effort=${debateEffort}, impl-effort=${implEffort}, scout=${scout}. ` +
+    `Maestro: Codex pin is model=${model}, debate-effort=${debateEffort}, impl-effort=${implEffort}, impl-model=${implModel}${hasImplModelPin ? '' : ' (inherited)'}, scout=${scout}. ` +
     'Say "codex model" to change it before starting work' +
     (armed
       ? '.'
diff --git a/tests/bounded-calls.sh b/tests/bounded-calls.sh
index 125ad14..f92cb24 100755
--- a/tests/bounded-calls.sh
+++ b/tests/bounded-calls.sh
@@ -89,7 +89,7 @@ t0c_failed_started_publication_cancels_job() (
   local evidence="$TEST_ROOT/publication-failure.evidence"
   local calls="$TEST_ROOT/publication-failure.calls" rc
   companion_resolve() { printf '%s' "$FIXTURE"; }
-  companion_pin() { printf 'gpt-5.6-sol\thigh\thigh\n'; }
+  companion_pin() { printf 'gpt-5.6-sol\thigh\thigh\tgpt-5.6-luna-max\n'; }
   reject_started() {
     [ "$1" != started ]
   }
@@ -108,6 +108,38 @@ t0c_failed_started_publication_cancels_job() (
     { echo "profile omitted publication failure"; return 1; }
 )
 
+t0e_role_dispatch_uses_pinned_models() (
+  local read_prompt="$TEST_ROOT/model-routing-read.prompt"
+  local read_result="$TEST_ROOT/model-routing-read.result"
+  local read_profile="$TEST_ROOT/model-routing-read.profile"
+  local read_evidence="$TEST_ROOT/model-routing-read.evidence"
+  local read_argv="$TEST_ROOT/model-routing-read.argv"
+  local write_prompt="$TEST_ROOT/model-routing-write.prompt"
+  local write_result="$TEST_ROOT/model-routing-write.result"
+  local write_profile="$TEST_ROOT/model-routing-write.profile"
+  local write_evidence="$TEST_ROOT/model-routing-write.evidence"
+  local write_argv="$TEST_ROOT/model-routing-write.argv" rc
+  companion_resolve() { printf '%s' "$FIXTURE"; }
+  companion_pin() { printf 'gpt-5.6-sol\thigh\thigh\tgpt-5.6-luna-max\n'; }
+  write_lifecycle() { return 0; }
+  printf 'read objective\n' > "$read_prompt"
+  export MAESTRO_TEST_ARGV="$read_argv"
+  companion_turn read "$read_prompt" 2 1 "$read_result" "$read_profile" \
+    "$read_evidence" :
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "read dispatch rc=$rc"; return 1; }
+  grep -Fq '"--model","gpt-5.6-sol"' "$read_argv" ||
+    { echo "read dispatch used the implementation model: $(cat "$read_argv")"; return 1; }
+  printf 'write objective\n' > "$write_prompt"
+  export MAESTRO_TEST_ARGV="$write_argv"
+  companion_turn write "$write_prompt" 2 1 "$write_result" "$write_profile" \
+    "$write_evidence" write_lifecycle
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "write dispatch rc=$rc"; return 1; }
+  grep -Fq '"--model","gpt-5.6-luna-max"' "$write_argv" ||
+    { echo "write dispatch used the debate model: $(cat "$write_argv")"; return 1; }
+)
+
 t0d_read_interrupt_never_cancels_unknown_writer() (
   local evidence="$TEST_ROOT/read-interrupt.evidence"
   local calls="$TEST_ROOT/read-interrupt.calls"
@@ -503,6 +535,7 @@ printf '=== Bounded companion calls verification ===\n'
 check t0_process_module_contract "deep process module owns bounded output and rc"
 check t0b_companion_module_contract "companion interface requires an explicit mode"
 check t0c_failed_started_publication_cancels_job "failed launch publication cancels the unpublished job"
+check t0e_role_dispatch_uses_pinned_models "read and write dispatches use their pinned models"
 check t0d_read_interrupt_never_cancels_unknown_writer "read interrupt never cancels an unknown writer"
 check t1_hanging_status_is_bounded "hanging status honors the companion timeout"
 check t2_timeout_reaps_process_group "timeout returns 125 and reaps the process group"
diff --git a/tests/fixtures/fake-companion.mjs b/tests/fixtures/fake-companion.mjs
index ec63226..95bc514 100644
--- a/tests/fixtures/fake-companion.mjs
+++ b/tests/fixtures/fake-companion.mjs
@@ -27,6 +27,17 @@ function nextSequenceValue(file, fallback) {
   return values[0];
 }
 
+function requestedFlag(name, fallback) {
+  if (!process.env.MAESTRO_TEST_ARGV) return fallback;
+  try {
+    const argv = JSON.parse(fs.readFileSync(process.env.MAESTRO_TEST_ARGV, "utf8"));
+    const index = argv.indexOf(name);
+    return typeof argv[index + 1] === "string" ? argv[index + 1] : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
 if (command === "--help") {
   appendCall("--help");
   const delay = Number(process.env.MAESTRO_TEST_HELP_DELAY ?? "0");
@@ -130,13 +141,15 @@ if (command === "status" && args.at(-1) === "--json") {
         process.env.MAESTRO_TEST_JOB_PHASE_FILE,
         process.env.MAESTRO_TEST_JOB_PHASE ?? "completed"
       );
+  const requestedModel = requestedFlag("--model", "gpt-5.6-sol");
+  const requestedEffort = requestedFlag("--effort", "high");
   const job = {
     id: args[0],
     status,
     phase: status === "running" ? "running" : "done",
     elapsed: "1s",
     progressPreview: [],
-    request: { model: "gpt-5.6-sol", effort: "high" }
+    request: { model: requestedModel, effort: requestedEffort }
   };
   if (process.env.MAESTRO_TEST_LOGFILE) {
     job.logFile = process.env.MAESTRO_TEST_LOGFILE;
diff --git a/tests/model-selector.sh b/tests/model-selector.sh
index b19d3b2..23bfd73 100644
--- a/tests/model-selector.sh
+++ b/tests/model-selector.sh
@@ -47,7 +47,7 @@ EOF
   printf '%s\n' "$nested" | grep -qx '  model = "nested-model"' || { echo "nested model changed: $nested"; return 1; }
   printf '%s\n' "$nested" | grep -qx '  model_reasoning_effort = "low"' || { echo "nested effort changed: $nested"; return 1; }
   [ "$(cat "$impl")" = low ] || { echo "implementation effort not updated"; return 1; }
-  [ "$(HOME="$home" bash "$SELECTOR" --pin)" = $'gpt-5.6-sol\thigh\tlow' ] ||
+  [ "$(HOME="$home" bash "$SELECTOR" --pin)" = $'gpt-5.6-sol\thigh\tlow\tgpt-5.6-sol' ] ||
     { echo "--pin disagrees with written values"; return 1; }
 }
 
@@ -148,7 +148,103 @@ EOF
   [ "$a_rc" -eq 0 ] && [ "$b_rc" -eq 0 ] ||
     { echo "selector rc values A=$a_rc B=$b_rc; A=$(cat "$home/a.out") B=$(cat "$home/b.out")"; return 1; }
   final=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
-  [ "$final" = $'model-b\tlow\tlow' ] || { echo "concurrent final pin is torn or reordered: $final"; return 1; }
+  [ "$final" = $'model-b\tlow\tlow\tmodel-a' ] || { echo "concurrent final pin is torn or reordered: $final"; return 1; }
+}
+
+t6_publishes_and_shows_implementation_model() {
+  local home config impl output pin show
+  home=$(new_home impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  output=$(HOME="$home" bash "$SELECTOR" gpt-5.6-sol max xhigh gpt-5.6-luna-max 2>&1) ||
+    { echo "selector failed: $output"; return 1; }
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-sol\tmax\txhigh\tgpt-5.6-luna-max' ] ||
+    { echo "pin=$pin"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-model=gpt-5.6-luna-max'*) ;; *)
+    echo "show omitted implementation model: $show"; return 1 ;; esac
+}
+
+t7_missing_implementation_model_is_inherited() {
+  local home config impl pin show
+  home=$(new_home inherited)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "gpt-5.6-sol"\nmodel_reasoning_effort = "high"\n' > "$config"
+  printf 'high\n' > "$impl"
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-sol\thigh\thigh\tgpt-5.6-sol' ] ||
+    { echo "inherited pin=$pin"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-model=gpt-5.6-sol (inherited)'*) ;; *)
+    echo "show omitted inherited marker: $show"; return 1 ;; esac
+}
+
+t8_corrupt_implementation_model_fails_pin() {
+  local home config impl output rc
+  home=$(new_home corrupt-impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "gpt-5.6-sol"\nmodel_reasoning_effort = "high"\n' > "$config"
+  printf 'high\n' > "$impl"
+  printf 'bad model!\n' > "$home/.codex/maestro-impl-model"
+  output=$(HOME="$home" bash "$SELECTOR" --pin 2>&1); rc=$?
+  [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
+  case "$output" in *'SELECT_ERROR:'*"invalid implementation model"*) ;; *)
+    echo "corrupt model error missing: $output"; return 1 ;; esac
+}
+
+t9_three_argument_repin_preserves_implementation_model() {
+  local home config impl model pin output
+  home=$(new_home preserve-impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  model="$home/.codex/maestro-impl-model"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  printf 'gpt-5.6-luna-max\n' > "$model"
+  output=$(HOME="$home" bash "$SELECTOR" gpt-5.6-sol high low 2>&1) ||
+    { echo "selector failed: $output"; return 1; }
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-sol\thigh\tlow\tgpt-5.6-luna-max' ] ||
+    { echo "three-argument repin changed implementation model: $pin"; return 1; }
+}
+
+t10_failed_implementation_model_publish_rolls_back_all_files() {
+  local home config impl model shim real_mv output rc
+  home=$(new_home rollback-impl-model)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  model="$home/.codex/maestro-impl-model"
+  shim="$home/shim"
+  real_mv=$(command -v mv)
+  mkdir -p "$shim"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  printf 'old-impl-model\n' > "$model"
+  cp "$config" "$home/config.before"
+  cp "$impl" "$home/impl.before"
+  cp "$model" "$home/model.before"
+  cat > "$shim/mv" <<EOF
+#!/usr/bin/env bash
+last="\${!#}"
+if [ "\$last" = "$model" ] && [ ! -e "$home/failed-once" ]; then
+  : > "$home/failed-once"
+  exit 1
+fi
+exec "$real_mv" "\$@"
+EOF
+  chmod +x "$shim/mv"
+  output=$(HOME="$home" PATH="$shim:$PATH" bash "$SELECTOR" new-model high low new-impl-model 2>&1); rc=$?
+  [ "$rc" -ne 0 ] || { echo "failed publish returned success: $output"; return 1; }
+  case "$output" in *'implementation model'*'previous pin restored'*) ;; *)
+    echo "model publication error missing: $output"; return 1 ;; esac
+  cmp -s "$config" "$home/config.before" || { echo "config was not rolled back"; return 1; }
+  cmp -s "$impl" "$home/impl.before" || { echo "impl effort was not rolled back"; return 1; }
+  cmp -s "$model" "$home/model.before" || { echo "impl model was not rolled back"; return 1; }
 }
 
 check() {
@@ -162,5 +258,10 @@ check t2_indented_table_is_not_top_level_pin "indented table keys cannot fake a
 check t3_failed_publish_rolls_back_both_files "failed second publish rolls back both files"
 check t4_rejects_unexpressible_implementation_effort "selector rejects implementation effort the wrapper cannot express"
 check t5_concurrent_selection_cannot_publish_torn_pin "concurrent selectors cannot publish a torn model/effort tuple"
+check t6_publishes_and_shows_implementation_model "selector publishes and shows the implementation model"
+check t7_missing_implementation_model_is_inherited "missing implementation model inherits the debate model"
+check t8_corrupt_implementation_model_fails_pin "corrupt implementation model fails closed"
+check t9_three_argument_repin_preserves_implementation_model "three-argument repin preserves the implementation model"
+check t10_failed_implementation_model_publish_rolls_back_all_files "failed implementation model publication rolls back all files"
 printf '\n=== %d passed, %d failed ===\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ]

From e1dcfb8baa904088b6843f42793f3a98599b21f1 Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Thu, 13 Aug 2026 18:31:32 -0400
Subject: [PATCH 2/3] feat: allow max/ultra implementation effort when the
 config carries it

The companion wrapper accepts only none|minimal|low|medium|high|xhigh
for --effort (codex-companion.mjs:71, both cached versions), so max and
ultra never reach a write job as a flag. They do reach Codex through the
top-level model_reasoning_effort in ~/.codex/config.toml, which is how
debate runs at max today.

Write mode refused a non-expressible effort outright to avoid silently
running at the debate tier. Narrow that to an exact-match rule: a write
job may use max/ultra only when it is identical to the pinned top-level
effort, in which case omitting --effort delivers precisely the requested
tier. Any mismatch, or an unset config value, still refuses. The scout
pin keeps the strict wrapper cap.

Pickers now default the implementer to gpt-5.6-luna at effort max and
the debate side to gpt-5.6-sol at max.

Verified: tests/model-selector.sh (13 passed), tests/bounded-calls.sh
(24 passed), tests/preflight.sh PASS.
---
 ARCHITECTURE.md                   | 10 ++++--
 hooks/codex-model-select.sh       | 29 +++++++++++++----
 hooks/lib-companion.sh            | 37 +++++++++++++++++++---
 hooks/orchestrator-inject.mjs     | 10 +++---
 hooks/session-start.mjs           | 10 +++---
 rules/orchestrator-implementer.md |  2 +-
 tests/bounded-calls.sh            | 38 ++++++++++++++++++++++
 tests/model-selector.sh           | 52 ++++++++++++++++++++++++++++---
 8 files changed, 157 insertions(+), 31 deletions(-)

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 19ddc8e..a980d60 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -143,7 +143,7 @@ Layering is strict and directional: `lib-process.sh` → `lib-companion.sh` →
 | Dependency | Role | Boundary |
 |---|---|---|
 | Claude Code | Host runtime; fires hooks; runs the orchestrator model | Contract: hook JSON payloads on stdin, exit codes |
-| Codex CLI + `openai-codex` plugin (`codex-companion.mjs`) | Executes background agent jobs | Contract: `codex task --background [--write] --model … --effort …`, `status --json`, `cancel`, `result`, `status --all --json`; a **compatibility probe** on `--help` refuses write dispatch if `task` is described without `--write` |
+| Codex CLI + `openai-codex` plugin (`codex-companion.mjs`) | Executes background agent jobs | Contract: `codex task --background [--write] --model … [--effort …]`, `status --json`, `cancel`, `result`, `status --all --json`; wrapper-expressible write efforts use `--effort`, while max/ultra omit it only when identical to the pinned top-level `model_reasoning_effort`; a **compatibility probe** on `--help` refuses write dispatch if `task` is described without `--write` |
 | `~/.codex/config.toml` | Codex configuration: model, reasoning efforts, MCP servers, `web_search` | Parsed as TOML; only true top-level keys are trusted |
 | Git | Repository scope, tree digests (`git hash-object --no-filters`), worktree/submodule discovery | Must be present in the working directory |
 
@@ -325,7 +325,10 @@ cancellation (unconfirmed quiescence).
 ### 4.4 Companion transport (Maestro → Codex)
 
 Implemented in `lib-companion.sh` via the plugin's `codex-companion.mjs`:
-`task --background [--write] --model <m> --effort <e> <prompt>`,
+`task --background [--write] --model <m> [--effort <e>] <prompt>`;
+write jobs omit `--effort` only for an exact max/ultra match with the pinned
+top-level `model_reasoning_effort`, otherwise the wrapper-expressible effort is
+passed explicitly.
 `status <job> --json`, `cancel <job>`, `result <job>`, `status --all --json`
 (repository-global writer visibility, parsed strictly, session filter
 deliberately stripped). Jobs are identified as `task-<id>-<id>`.
@@ -432,7 +435,8 @@ Pull requests and pushes to `main` both trigger it. There is no CD — the
   `task` synopsis lacks `--write` (guards against upstream flag drift).
 - The model pin is verified against the launched job's recorded
   `request.model`/`request.effort` (`companion_verify_pin`), warning on
-  mismatch.
+  mismatch; an absent/null effort is accepted only for an exact-match write
+  dispatch that omitted the wrapper flag.
 
 **Boundary statement.** The write path is coupled to the companion transport's
 JSON contract: status fields (`phase`, `elapsed`, `progressPreview`,
diff --git a/hooks/codex-model-select.sh b/hooks/codex-model-select.sh
index dc096a3..f16f21a 100644
--- a/hooks/codex-model-select.sh
+++ b/hooks/codex-model-select.sh
@@ -13,7 +13,8 @@
 #   codex-model-select.sh --ask-on-start on|off|status
 #
 # Debate effort: none | minimal | low | medium | high | xhigh | max | ultra
-# Implementation effort: none | minimal | low | medium | high | xhigh
+# Implementation effort: none | minimal | low | medium | high | xhigh, or
+# max | ultra only when it exactly matches the top-level debate effort.
 # Exit codes: 0 = ok | 3 = bad args, invalid values, or failed publication
 set -uo pipefail
 
@@ -123,6 +124,14 @@ valid_impl_effort() {
   esac
 }
 
+impl_effort_acceptable() { # implementation-effort debate-effort
+  valid_impl_effort "$1" && return 0
+  case "$1" in
+    max|ultra) [ "$1" = "$2" ] ;;
+    *) return 1 ;;
+  esac
+}
+
 valid_model() {
   [[ "$1" =~ ^[a-zA-Z0-9._-]+$ ]]
 }
@@ -238,7 +247,15 @@ show() {
   else
     echo "effort=${E:-(not pinned — Codex default)}"
   fi
-  echo "impl-effort=$I"
+  case "$I" in
+    max|ultra)
+      if [ "$I" = "$E" ]; then
+        echo "impl-effort=$I (via top-level config)"
+      else
+        echo "impl-effort=$I (invalid — top-level effort is $E)"
+      fi ;;
+    *) echo "impl-effort=$I" ;;
+  esac
   if [ -n "$IM" ] && valid_model "$IM"; then
     echo "impl-model=$IM"
   elif [ -f "$IMPL_MODEL_FILE" ] && [ -n "$IM" ]; then
@@ -272,8 +289,8 @@ pin() {
     echo "SELECT_ERROR: invalid debate effort '$E' (expected: none | minimal | low | medium | high | xhigh | max | ultra)" >&2
     return 3
   fi
-  if ! valid_impl_effort "$I"; then
-    echo "SELECT_ERROR: invalid implementation effort '$I' (expected: none | minimal | low | medium | high | xhigh; max/ultra are debate-only because the companion wrapper cannot express them for write jobs)" >&2
+  if ! impl_effort_acceptable "$I" "$E"; then
+    echo "SELECT_ERROR: implementation effort '$I' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently '$E'" >&2
     return 3
   fi
   if [ -n "$IM" ] && ! valid_model "$IM"; then
@@ -540,8 +557,8 @@ if ! valid_effort "$EFFORT"; then
   echo "SELECT_ERROR: invalid effort '$EFFORT' (expected: none | minimal | low | medium | high | xhigh | max | ultra)" >&2
   exit 3
 fi
-if ! valid_impl_effort "$IMPL_EFFORT"; then
-  echo "SELECT_ERROR: invalid implementation effort '$IMPL_EFFORT' (expected: none | minimal | low | medium | high | xhigh; max/ultra are debate-only because the companion wrapper cannot express them for write jobs)" >&2
+if ! impl_effort_acceptable "$IMPL_EFFORT" "$EFFORT"; then
+  echo "SELECT_ERROR: implementation effort '$IMPL_EFFORT' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently '$EFFORT'" >&2
   exit 3
 fi
 if ! valid_model "$IMPL_MODEL"; then
diff --git a/hooks/lib-companion.sh b/hooks/lib-companion.sh
index 13c6ff3..70d0c11 100644
--- a/hooks/lib-companion.sh
+++ b/hooks/lib-companion.sh
@@ -34,6 +34,14 @@ companion_wrapper_accepts_effort() {
   return 1
 }
 
+companion_effort_acceptable() { # candidate top-level-config-effort
+  companion_wrapper_accepts_effort "$1" && return 0
+  case "$1" in
+    max|ultra) [ "$1" = "$2" ] ;;
+    *) return 1 ;;
+  esac
+}
+
 
 companion_version_is_newer() { # candidate current
   awk -v left="$1" -v right="$2" '
@@ -166,8 +174,8 @@ companion_pin() {
     echo "no Codex model/effort pinned — run: codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>" >&2
     return 3
   fi
-  if ! companion_wrapper_accepts_effort "$impl_effort"; then
-    echo "unsupported implementation effort '$impl_effort' — choose none|minimal|low|medium|high|xhigh; max/ultra are debate-only" >&2
+  if ! companion_effort_acceptable "$impl_effort" "$debate_effort"; then
+    echo "unsupported implementation effort '$impl_effort' — the companion expresses only none|minimal|low|medium|high|xhigh per write job; max/ultra require the top-level debate effort to be the same value (currently '$debate_effort')" >&2
     return 3
   fi
   case "$impl_model" in
@@ -208,11 +216,14 @@ companion_start() { # companion prompt mode model effort lifecycle job-file stdo
   [ "$mode" = "write" ] && args+=(--write)
   args+=(--model "$MODEL")
   if [ "$mode" = "write" ]; then
-    if ! companion_wrapper_accepts_effort "$EFFORT"; then
+    if companion_wrapper_accepts_effort "$EFFORT"; then
+      args+=(--effort "$EFFORT")
+    elif companion_effort_acceptable "$EFFORT" "${COMPANION_CONFIG_EFFORT:-}"; then
+      progress "CODEX: companion cannot express implementation effort=$EFFORT as a flag; the pinned top-level config value is the same tier and governs this write dispatch"
+    else
       echo "companion cannot express implementation effort=$EFFORT; refusing to silently substitute the debate tier" >&2
       return 3
     fi
-    args+=(--effort "$EFFORT")
   elif companion_wrapper_accepts_effort "$EFFORT"; then
     args+=(--effort "$EFFORT")
   else
@@ -271,6 +282,18 @@ companion_verify_pin() { # companion job model effort lifecycle stdout stderr
     [ "$RECORDED_WRITE" = false ]; then
     return 0
   fi
+  # A write with max/ultra may omit --effort only when the pinned top-level
+  # config carries the identical tier; an absent/null recorded effort is then
+  # the companion's representation of that omitted flag.
+  case "$EXPECTED_EFFORT" in
+    max|ultra)
+      if [ "$RECORDED_MODEL" = "$EXPECTED_MODEL" ] &&
+        [ "$RECORDED_WRITE" = true ] &&
+        [ "${COMPANION_CONFIG_EFFORT:-}" = "$EXPECTED_EFFORT" ] &&
+        { [ -z "$EFFORT_FIELD" ] || [ "$RECORDED_EFFORT" = "null" ]; }; then
+        return 0
+      fi ;;
+  esac
   echo "Codex pin verification warning for $JOB: requested model=$EXPECTED_MODEL effort=$EXPECTED_EFFORT; recorded model=$RECORDED_MODEL effort=$RECORDED_EFFORT" >&2
   return 4
 }
@@ -631,7 +654,7 @@ _companion_turn_cleanup() { # profile-file [retain-job-lock]
 companion_turn() { # mode prompt-file max-idle poll result-file profile-file evidence-file lifecycle
   local mode="${1-}" prompt_file="${2-}" max_idle="${3-}" poll="${4-}"
   local result="${5-}" profile="${6-}" evidence="${7-}" lifecycle="${8-}"
-  local prompt C pin fields model effort impl_model job rc cleanup_rc derived
+  local prompt C pin fields model debate_effort effort impl_model job rc cleanup_rc derived
   local override_model="${MAESTRO_COMPANION_MODEL-}"
   local override_effort="${MAESTRO_COMPANION_EFFORT-}"
   local override_model_set=0 override_effort_set=0
@@ -672,6 +695,10 @@ companion_turn() { # mode prompt-file max-idle poll result-file profile-file evi
   pin=$(companion_pin) || return 3
   model=${pin%%$'\t'*}
   fields=${pin#*$'\t'}
+  debate_effort=${fields%%$'\t'*}
+  # ~/.codex/config.toml carries this top-level value; Codex uses it when a
+  # task omits --effort, and this is the only channel companion_start has for it.
+  COMPANION_CONFIG_EFFORT="$debate_effort"
   fields=${fields#*$'\t'}
   effort=${fields%%$'\t'*}
   impl_model=${fields#*$'\t'}
diff --git a/hooks/orchestrator-inject.mjs b/hooks/orchestrator-inject.mjs
index 9d2d154..b2bf1d5 100644
--- a/hooks/orchestrator-inject.mjs
+++ b/hooks/orchestrator-inject.mjs
@@ -100,14 +100,12 @@ if (/(codex (model|settings|effort|config)|pick (the )?codex|change codex|set co
     'CODEX MODEL SETUP — ask the user for the debate model, implementation model, and separate role-specific efforts.\n' +
     'Show current settings first:  bash ~/.claude/hooks/codex-model-select.sh --show\n' +
     'Debate effort governs read-only discussions; implementation effort governs write jobs.\n' +
-    'Implementation model — default: gpt-5.6-luna-max (with impl effort xhigh).\n' +
+    'Implementation model — default: gpt-5.6-luna at effort max.\n' +
     'Alternatives: gpt-5.6-sol at low | medium | high; gpt-5.6-luna at xhigh;\n' +
-    'gpt-5.6-terra at xhigh; gpt-5.6-terra-max. Availability depends on the\n' +
-    "user's ChatGPT plan.\n" +
+    "gpt-5.6-terra at xhigh or max. Availability depends on the user's ChatGPT plan.\n" +
     'Debate default stays: model gpt-5.6-sol, effort max.\n' +
-    'Effort tiers max/ultra are debate-only — the companion wrapper accepts only\n' +
-    'none|minimal|low|medium|high|xhigh per write job, so a "max" tier on the\n' +
-    'implementation side is expressed as a *-max model name, not as an effort.\n' +
+    'max/ultra work on the implementation side only when the debate effort is the same value —\n' +
+    'the companion cannot pass them as a per-job flag, so the pinned top-level config value is what delivers that tier.\n' +
     'Apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>\n' +
     'and confirm all four values in one line.'
   );
diff --git a/hooks/session-start.mjs b/hooks/session-start.mjs
index 3193dc7..bb59afa 100644
--- a/hooks/session-start.mjs
+++ b/hooks/session-start.mjs
@@ -72,14 +72,12 @@ if (armed && source !== 'resume') {
     `  2) Debate/design effort — current: ${debateEffort}.\n` +
     `  3) Implementation effort — current: ${implEffort}.\n` +
     `  4) Implementation model — current: ${implModel}.\n` +
-    'Implementation model — default: gpt-5.6-luna-max (with impl effort xhigh).\n' +
+    'Implementation model — default: gpt-5.6-luna at effort max.\n' +
     'Alternatives: gpt-5.6-sol at low | medium | high; gpt-5.6-luna at xhigh;\n' +
-    'gpt-5.6-terra at xhigh; gpt-5.6-terra-max. Availability depends on the\n' +
-    "user's ChatGPT plan.\n" +
+    "gpt-5.6-terra at xhigh or max. Availability depends on the user's ChatGPT plan.\n" +
     'Debate default stays: model gpt-5.6-sol, effort max.\n' +
-    'Effort tiers max/ultra are debate-only — the companion wrapper accepts only\n' +
-    'none|minimal|low|medium|high|xhigh per write job, so a "max" tier on the\n' +
-    'implementation side is expressed as a *-max model name, not as an effort.\n' +
+    'max/ultra work on the implementation side only when the debate effort is the same value —\n' +
+    'the companion cannot pass them as a per-job flag, so the pinned top-level config value is what delivers that tier.\n' +
     'Then apply their picks:  bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>\n' +
     'and confirm all four settings in one line. “Keep current” is valid only when the current pin is\n' +
     (hasDispatchPin
diff --git a/rules/orchestrator-implementer.md b/rules/orchestrator-implementer.md
index ac09658..68c1457 100644
--- a/rules/orchestrator-implementer.md
+++ b/rules/orchestrator-implementer.md
@@ -12,7 +12,7 @@ bash ~/.claude/hooks/codex-model-select.sh --show
 bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>
 ```
 
-Effort guide: minimal/low for quick mechanical work, medium for default implementation, and **high for architecture debates, delicate refactors, and final-review judgment**. Debate effort may also use max/ultra through top-level Codex config; implementation effort is limited to none/minimal/low/medium/high/xhigh because the companion must express it explicitly per write job. Never accept a silent fallback from an unsupported implementation tier. Model availability depends on the user's ChatGPT plan; the script validates the name's shape only, and Codex itself rejects a model it cannot reach. “Keep current” is usable only when `--pin` succeeds; a fresh unpinned install cannot dispatch until the user selects values.
+Effort guide: minimal/low for quick mechanical work, medium for default implementation, and **high for architecture debates, delicate refactors, and final-review judgment**. Debate effort may also use max/ultra through top-level Codex config; implementation effort uses none/minimal/low/medium/high/xhigh per write job, while max/ultra are allowed only when the implementation effort exactly matches the pinned top-level debate effort and the companion omits the per-job flag. Never accept a silent fallback from an unsupported implementation tier. Model availability depends on the user's ChatGPT plan; the script validates the name's shape only, and Codex itself rejects a model it cannot reach. “Keep current” is usable only when `--pin` succeeds; a fresh unpinned install cannot dispatch until the user selects values.
 
 ## Dispatch
 
diff --git a/tests/bounded-calls.sh b/tests/bounded-calls.sh
index f92cb24..2c2a583 100755
--- a/tests/bounded-calls.sh
+++ b/tests/bounded-calls.sh
@@ -138,6 +138,42 @@ t0e_role_dispatch_uses_pinned_models() (
   [ "$rc" -eq 0 ] || { echo "write dispatch rc=$rc"; return 1; }
   grep -Fq '"--model","gpt-5.6-luna-max"' "$write_argv" ||
     { echo "write dispatch used the debate model: $(cat "$write_argv")"; return 1; }
+  grep -Fq '"--effort","high"' "$write_argv" ||
+    { echo "write dispatch omitted explicit high effort: $(cat "$write_argv")"; return 1; }
+)
+
+t0f_matching_top_level_effort_omits_write_flag() (
+  local argv="$TEST_ROOT/max-write.argv" calls="$TEST_ROOT/max-write.calls"
+  local job_file="$TEST_ROOT/max-write.job" out="$TEST_ROOT/max-write.stdout"
+  local err="$TEST_ROOT/max-write.stderr" output rc
+  : > "$calls"
+  export MAESTRO_TEST_ARGV="$argv" MAESTRO_TEST_CALL_LOG="$calls"
+  output=$(COMPANION_CONFIG_EFFORT=max companion_start "$FIXTURE" objective write \
+    gpt-5.6-luna max : "$job_file" "$out" "$err" 3>&1 2>&1)
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "matching max write rc=$rc output=$output"; return 1; }
+  [ -s "$argv" ] || { echo "matching max write did not launch a task"; return 1; }
+  ! grep -Fq '"--effort"' "$argv" ||
+    { echo "matching max write passed an effort flag: $(cat "$argv")"; return 1; }
+  grep -q '^task ' "$calls" || { echo "matching max write did not launch a task"; return 1; }
+  case "$output" in
+    *'CODEX: companion cannot express implementation effort=max as a flag; the pinned top-level config value is the same tier and governs this write dispatch'*) ;;
+    *) echo "matching max progress missing: $output"; return 1 ;;
+  esac
+)
+
+t0g_mismatched_top_level_effort_refuses_write() (
+  local argv="$TEST_ROOT/mismatch-write.argv" calls="$TEST_ROOT/mismatch-write.calls"
+  local job_file="$TEST_ROOT/mismatch-write.job" out="$TEST_ROOT/mismatch-write.stdout"
+  local err="$TEST_ROOT/mismatch-write.stderr" output rc
+  : > "$calls"
+  export MAESTRO_TEST_ARGV="$argv" MAESTRO_TEST_CALL_LOG="$calls"
+  output=$(COMPANION_CONFIG_EFFORT=high companion_start "$FIXTURE" objective write \
+    gpt-5.6-luna max : "$job_file" "$out" "$err" 3>&1 2>&1)
+  rc=$?
+  [ "$rc" -ne 0 ] || { echo "mismatched max write was accepted: $output"; return 1; }
+  ! grep -q '^task ' "$calls" || { echo "mismatched max write launched a task"; return 1; }
+  [ ! -e "$argv" ] || { echo "mismatched max write produced task argv"; return 1; }
 )
 
 t0d_read_interrupt_never_cancels_unknown_writer() (
@@ -536,6 +572,8 @@ check t0_process_module_contract "deep process module owns bounded output and rc
 check t0b_companion_module_contract "companion interface requires an explicit mode"
 check t0c_failed_started_publication_cancels_job "failed launch publication cancels the unpublished job"
 check t0e_role_dispatch_uses_pinned_models "read and write dispatches use their pinned models"
+check t0f_matching_top_level_effort_omits_write_flag "matching top-level effort omits the write effort flag"
+check t0g_mismatched_top_level_effort_refuses_write "mismatched top-level effort refuses the write dispatch"
 check t0d_read_interrupt_never_cancels_unknown_writer "read interrupt never cancels an unknown writer"
 check t1_hanging_status_is_bounded "hanging status honors the companion timeout"
 check t2_timeout_reaps_process_group "timeout returns 125 and reaps the process group"
diff --git a/tests/model-selector.sh b/tests/model-selector.sh
index 23bfd73..f605661 100644
--- a/tests/model-selector.sh
+++ b/tests/model-selector.sh
@@ -95,17 +95,17 @@ EOF
 
 t4_rejects_unexpressible_implementation_effort() {
   local home config impl output rc
-  home=$(new_home reject-impl-ultra)
+  home=$(new_home reject-impl-max)
   config="$home/.codex/config.toml"
   impl="$home/.codex/maestro-impl-effort"
   printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
   printf 'medium\n' > "$impl"
   cp "$config" "$home/config.before"
   cp "$impl" "$home/impl.before"
-  output=$(HOME="$home" bash "$SELECTOR" new-model high ultra 2>&1); rc=$?
+  output=$(HOME="$home" bash "$SELECTOR" new-model high max 2>&1); rc=$?
   [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
-  case "$output" in *'implementation effort'*'none | minimal | low | medium | high | xhigh'*) ;; *)
-    echo "rejection did not explain wrapper-supported implementation tiers: $output"; return 1 ;; esac
+  [ "$output" = "SELECT_ERROR: implementation effort 'max' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently 'high'" ] ||
+    { echo "unexpected rejection: $output"; return 1; }
   cmp -s "$config" "$home/config.before" || { echo "config changed after rejected implementation effort"; return 1; }
   cmp -s "$impl" "$home/impl.before" || { echo "implementation file changed after rejection"; return 1; }
 }
@@ -247,6 +247,47 @@ EOF
   cmp -s "$model" "$home/model.before" || { echo "impl model was not rolled back"; return 1; }
 }
 
+t11_matching_top_level_max_is_valid() {
+  local home config impl output pin show
+  home=$(new_home matching-top-level-max)
+  config="$home/.codex/config.toml"
+  impl="$home/.codex/maestro-impl-effort"
+  printf 'model = "old-model"\nmodel_reasoning_effort = "medium"\n' > "$config"
+  printf 'medium\n' > "$impl"
+  output=$(HOME="$home" bash "$SELECTOR" gpt-5.6-luna max max 2>&1) ||
+    { echo "selector rejected exact max match: $output"; return 1; }
+  pin=$(HOME="$home" bash "$SELECTOR" --pin) || return 1
+  [ "$pin" = $'gpt-5.6-luna\tmax\tmax\tgpt-5.6-luna' ] ||
+    { echo "pin=$pin"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-effort=max (via top-level config)'*) ;; *)
+    echo "show omitted exact-match diagnostic: $show"; return 1 ;; esac
+}
+
+t12_stored_mismatched_max_fails_pin() {
+  local home output show rc
+  home=$(new_home stored-mismatched-max)
+  printf 'model = "gpt-5.6-sol"\nmodel_reasoning_effort = "high"\n' > "$home/.codex/config.toml"
+  printf 'max\n' > "$home/.codex/maestro-impl-effort"
+  output=$(HOME="$home" bash "$SELECTOR" --pin 2>&1); rc=$?
+  [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
+  [ "$output" = "SELECT_ERROR: implementation effort 'max' cannot be expressed per write job (the companion accepts none|minimal|low|medium|high|xhigh); max/ultra are usable only when the top-level debate effort is the same value, currently 'high'" ] ||
+    { echo "unexpected stored-pin rejection: $output"; return 1; }
+  show=$(HOME="$home" bash "$SELECTOR" --show) || return 1
+  case "$show" in *'impl-effort=max (invalid — top-level effort is high)'*) ;; *)
+    echo "show omitted mismatch diagnostic: $show"; return 1 ;; esac
+}
+
+t13_scout_keeps_strict_effort_cap() {
+  local home output rc
+  home=$(new_home scout-strict-cap)
+  output=$(HOME="$home" bash "$SELECTOR" --scout gpt-5.6-luna max 2>&1); rc=$?
+  [ "$rc" -eq 3 ] || { echo "rc=$rc want 3: $output"; return 1; }
+  [ "$output" = "SELECT_ERROR: invalid scout effort 'max' (expected: none | minimal | low | medium | high | xhigh)" ] ||
+    { echo "scout cap changed: $output"; return 1; }
+  [ ! -e "$home/.codex/maestro-scout" ] || { echo "scout pin was written"; return 1; }
+}
+
 check() {
   local fn="$1" label="$2" detail
   if detail=$("$fn" 2>&1); then ok "$label"; else bad "$label" "${detail:-no detail}"; fi
@@ -263,5 +304,8 @@ check t7_missing_implementation_model_is_inherited "missing implementation model
 check t8_corrupt_implementation_model_fails_pin "corrupt implementation model fails closed"
 check t9_three_argument_repin_preserves_implementation_model "three-argument repin preserves the implementation model"
 check t10_failed_implementation_model_publish_rolls_back_all_files "failed implementation model publication rolls back all files"
+check t11_matching_top_level_max_is_valid "matching top-level max implementation effort is valid"
+check t12_stored_mismatched_max_fails_pin "stored mismatched max implementation effort fails pin"
+check t13_scout_keeps_strict_effort_cap "scout keeps the strict wrapper effort cap"
 printf '\n=== %d passed, %d failed ===\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ]

From 9c076312d2231f7427bb76e34f568662ac4f9637 Mon Sep 17 00:00:00 2001
From: elkaix <melkholy@techmatrix.com>
Date: Thu, 13 Aug 2026 18:56:47 -0400
Subject: [PATCH 3/3] test: cover the max-effort write pin verification branch

The fake companion substituted a "high" effort whenever --effort was absent
from the recorded argv and never emitted request.write, so the accept branch
in companion_verify_pin for a max/ultra write that legitimately omits the flag
was unreachable from the suite.

Make the fixture faithful: requestedFlag now returns null when the argv parses
but omits the flag (keeping the fallback only for an unset, missing, or
unreadable file), and the status response carries request.write derived from
the recorded task argv. This also fixes a latent fixture bug where a missing
flag read argv[0] as its value, because indexOf returned -1.

t0f now verifies both directions through companion_verify_pin: rc 0 with a
matching COMPANION_CONFIG_EFFORT=max, and rc 4 plus the warning line when the
top-level tier does not match.

Also documents the separate implementation model pin: the roles no longer share
one model, and the selector command takes <impl-model> as a fourth argument.

Verified: tests/run.sh 18 passed 0 failed; tests/bounded-calls.sh 24 passed;
tests/scout.sh 7 passed. Reverting only the fixture turns t0f red, confirming
the new assertions can fail.
---
 rules/orchestrator-implementer.md |  6 ++++--
 tests/bounded-calls.sh            | 17 +++++++++++++++--
 tests/fixtures/fake-companion.mjs | 28 ++++++++++++++++++++--------
 3 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/rules/orchestrator-implementer.md b/rules/orchestrator-implementer.md
index 68c1457..0082356 100644
--- a/rules/orchestrator-implementer.md
+++ b/rules/orchestrator-implementer.md
@@ -5,13 +5,15 @@
 
 ## Codex model & effort
 
-At session start a hook asks which Codex model and role-specific reasoning efforts to use (or shows the current pin). Discussion and implementation share the model but keep separate effort tiers. Mid-session, the user can say "codex model" to change them; apply with:
+At session start a hook asks which Codex models and role-specific reasoning efforts to use (or shows the current pin). Discussion and implementation each carry their own model and their own effort tier. Mid-session, the user can say "codex model" to change them; apply with:
 
 ```
 bash ~/.claude/hooks/codex-model-select.sh --show
-bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort>
+bash ~/.claude/hooks/codex-model-select.sh <model> <debate-effort> <impl-effort> <impl-model>
 ```
 
+Name `<impl-model>` explicitly. Omitting it keeps an existing implementation pin, but on a fresh unpinned install it silently inherits `<model>`, which is not the intended implementation default.
+
 Effort guide: minimal/low for quick mechanical work, medium for default implementation, and **high for architecture debates, delicate refactors, and final-review judgment**. Debate effort may also use max/ultra through top-level Codex config; implementation effort uses none/minimal/low/medium/high/xhigh per write job, while max/ultra are allowed only when the implementation effort exactly matches the pinned top-level debate effort and the companion omits the per-job flag. Never accept a silent fallback from an unsupported implementation tier. Model availability depends on the user's ChatGPT plan; the script validates the name's shape only, and Codex itself rejects a model it cannot reach. “Keep current” is usable only when `--pin` succeeds; a fresh unpinned install cannot dispatch until the user selects values.
 
 ## Dispatch
diff --git a/tests/bounded-calls.sh b/tests/bounded-calls.sh
index 2c2a583..156aa73 100755
--- a/tests/bounded-calls.sh
+++ b/tests/bounded-calls.sh
@@ -145,10 +145,12 @@ t0e_role_dispatch_uses_pinned_models() (
 t0f_matching_top_level_effort_omits_write_flag() (
   local argv="$TEST_ROOT/max-write.argv" calls="$TEST_ROOT/max-write.calls"
   local job_file="$TEST_ROOT/max-write.job" out="$TEST_ROOT/max-write.stdout"
-  local err="$TEST_ROOT/max-write.stderr" output rc
+  local err="$TEST_ROOT/max-write.stderr" warning="$TEST_ROOT/max-write.warning"
+  local output job rc
   : > "$calls"
   export MAESTRO_TEST_ARGV="$argv" MAESTRO_TEST_CALL_LOG="$calls"
-  output=$(COMPANION_CONFIG_EFFORT=max companion_start "$FIXTURE" objective write \
+  export COMPANION_CONFIG_EFFORT=max
+  output=$(companion_start "$FIXTURE" objective write \
     gpt-5.6-luna max : "$job_file" "$out" "$err" 3>&1 2>&1)
   rc=$?
   [ "$rc" -eq 0 ] || { echo "matching max write rc=$rc output=$output"; return 1; }
@@ -160,6 +162,17 @@ t0f_matching_top_level_effort_omits_write_flag() (
     *'CODEX: companion cannot express implementation effort=max as a flag; the pinned top-level config value is the same tier and governs this write dispatch'*) ;;
     *) echo "matching max progress missing: $output"; return 1 ;;
   esac
+  job=$(cat "$job_file")
+  companion_verify_pin "$FIXTURE" "$job" gpt-5.6-luna max : "$out" "$err"
+  rc=$?
+  [ "$rc" -eq 0 ] || { echo "matching max pin verification rc=$rc"; return 1; }
+  export COMPANION_CONFIG_EFFORT=high
+  companion_verify_pin "$FIXTURE" "$job" gpt-5.6-luna max : "$out" "$err" \
+    2> "$warning"
+  rc=$?
+  [ "$rc" -eq 4 ] || { echo "mismatched max pin verification rc=$rc"; return 1; }
+  grep -Fq "Codex pin verification warning for $job" "$warning" ||
+    { echo "mismatched max pin verification warning missing: $(cat "$warning")"; return 1; }
 )
 
 t0g_mismatched_top_level_effort_refuses_write() (
diff --git a/tests/fixtures/fake-companion.mjs b/tests/fixtures/fake-companion.mjs
index 95bc514..502bbae 100644
--- a/tests/fixtures/fake-companion.mjs
+++ b/tests/fixtures/fake-companion.mjs
@@ -27,17 +27,24 @@ function nextSequenceValue(file, fallback) {
   return values[0];
 }
 
-function requestedFlag(name, fallback) {
-  if (!process.env.MAESTRO_TEST_ARGV) return fallback;
+function readRecordedArgv() {
+  if (!process.env.MAESTRO_TEST_ARGV) return null;
   try {
     const argv = JSON.parse(fs.readFileSync(process.env.MAESTRO_TEST_ARGV, "utf8"));
-    const index = argv.indexOf(name);
-    return typeof argv[index + 1] === "string" ? argv[index + 1] : fallback;
+    return Array.isArray(argv) ? argv : null;
   } catch {
-    return fallback;
+    return null;
   }
 }
 
+function requestedFlag(name, fallback, argv = readRecordedArgv()) {
+  if (!Array.isArray(argv)) return fallback;
+  const index = argv.indexOf(name);
+  return index >= 0 && typeof argv[index + 1] === "string"
+    ? argv[index + 1]
+    : null;
+}
+
 if (command === "--help") {
   appendCall("--help");
   const delay = Number(process.env.MAESTRO_TEST_HELP_DELAY ?? "0");
@@ -141,15 +148,20 @@ if (command === "status" && args.at(-1) === "--json") {
         process.env.MAESTRO_TEST_JOB_PHASE_FILE,
         process.env.MAESTRO_TEST_JOB_PHASE ?? "completed"
       );
-  const requestedModel = requestedFlag("--model", "gpt-5.6-sol");
-  const requestedEffort = requestedFlag("--effort", "high");
+  const recordedArgv = readRecordedArgv();
+  const requestedModel = requestedFlag("--model", "gpt-5.6-sol", recordedArgv);
+  const requestedEffort = requestedFlag("--effort", "high", recordedArgv);
+  const request = { model: requestedModel, effort: requestedEffort };
+  if (Array.isArray(recordedArgv)) {
+    request.write = recordedArgv.includes("--write");
+  }
   const job = {
     id: args[0],
     status,
     phase: status === "running" ? "running" : "done",
     elapsed: "1s",
     progressPreview: [],
-    request: { model: requestedModel, effort: requestedEffort }
+    request
   };
   if (process.env.MAESTRO_TEST_LOGFILE) {
     job.logFile = process.env.MAESTRO_TEST_LOGFILE;