Flow-Next Files

Changed

• Multi-model orchestration defaults: delegate model steering, setup pipeline scaffold, recipe hardening (fn-97). A controlled multi-model pipeline eval (2026-07-14: hidden 39-check oracle suite for the work stage, planted-bug review eval at n=3 reps per arm with matched reasoning efforts, dual cross-family blind plan judges) validated the orchestration shape flow-next ships and exposed four small gaps. One task's evidence - cited as motivation, never as a guarantee.
• work.delegateModel default flips gpt-5.6-sol -> gpt-5.6-terra (work.delegateEffort stays medium): terra-medium matched sol on hidden-suite correctness at ~2/3 the wall-clock on frontier-authored specs, with effort above medium pure overhead. The bridge already passes both keys explicitly (-m / -c model_reasoning_effort=); set work.delegateModel gpt-5.6-sol to escalate for gnarly tasks. NOTE: the flip reaches new installs and unset keys only - flowctl init persists defaults into .flow/config.json (raw values win on upgrade), so pre-existing installs keep whatever was persisted; flip manually with flowctl config set work.delegateModel gpt-5.6-terra. Docs updated across flowctl.md, orchestration.md, codex-delegation.md, phases.md, the model-routing snippet, and the usage.md template (which now names both steering keys).
• Setup: bridge-gated multi-model pipeline scaffold. The Model Routing question now fires only when at least one bridge CLI (codex / cursor-agent / grok) is detected on PATH (BRIDGE_DETECTED) - with zero bridges every wiring route would be an inert install-note comment. Question copy reframed as the recommended multi-model pipeline; the snippet now states the recommended default pipeline concretely (session model authors specs - capture/interview/plan - then terra implements, then a cross-family reviewer; resolves to fable->terra->sol on Claude Code, sol->terra->Claude-family-or-sol on Codex) and gains a wrapper-pattern pointer for autonomous loops; the cursor review route now recommends current strongest models (cursor:claude-opus-4-8-thinking-high, fable-5-thinking as the frontier gate - NO ZDR - or cursor:gpt-5.6-sol-high to reach sol without a codex CLI) with composer/grok demoted to quick extra voices; the Review question labels Codex (Recommended - cross-family default) when detected on a Claude-family writer host (on GPT-writer hosts the label and switch offer are skipped - same family), and scaffolding adds an explicit non-destructive switch offer to review.backend codex when a different backend is already configured (decline keeps everything as-is). Still interactive-only (never fires under any autonomy marker) and still never silently overwrites existing config.
• Codex mirror worker pin, opt-in. sync-codex.sh gains CODEX_MODEL_WORKER / CODEX_REASONING_EFFORT_WORKER sync-time knobs for pinning the mirror worker role (recommended: gpt-5.6-terra @ medium, eval-motivated). Default is UNSET: the worker keeps inherit - the Codex session model rules, exactly like the Claude-side worker. flow-next does not hardcode model opinions into generated config; the recommendation lives in the routing scaffold prose. FAST/INTELLIGENT mapping for every other agent unchanged.
• usage.md bridge-recipe hardening (strictly safer). All codex exec recipe lines carry --skip-git-repo-check (outside a trusted git repo codex refuses in ~1s with the error only in the log - a fire-and-forget caller sees a clean silent failure); the write-mode recipe asserts the intended workspace first (the flag also disables codex's git-repo preflight, so the guard keeps it a silence fix, never a safety bypass); the cursor-agent recipe warns to run inside a git repo (in a non-repo dir it blocks on an interactive trust prompt and exits "successfully" with empty output). Existing projects pick both up on the next /flow-next:setup re-run.
• Codex self-bridge documented + MAv2 steering caveat. On GPT-5.6-Sol/Multi-Agent-V2 builds, per-spawn model steering is currently unreliable (openai/codex#31814/#32782/#33268/#33314); orchestration.md, platforms.md, and the usage.md bridge recipes now document the robust route from a Codex host - the same-family codex exec -m self-bridge (flat child prompt; nested MAv2 subagents can return undecodable results, [#33267]). Re-check tracked as a stub spec.
• orchestration.md: "A proven default pipeline". Model-per-role defaults table with a per-host reach column (roles are host-independent because the bridges run both directions; only the reach mechanism differs) - plan session-native by design, work terra-medium, impl-review sol-high cross-family first pass + session-model final gate; luna-xhigh as the equal-recall-slower alternative; grok-4.5 as classic-bug quick pass only, never the gate. Plus the wrapper-pattern subsection (thin fast-tier wrapper for unattended loops; bridge runs in the FOREGROUND; self-heal license covers environment/flags only, never judgment) and the raw-bridge severity-tier note (ad-hoc review prompts should demand P0-P3 tiers + spec-grounded verdicts; the packaged impl-review find-vs-fix split is deliberately unchanged). Single-subscription framing throughout: multi-model routing is optional garnish, every row degrades to the session model.
• No behavior change when the new defaults are untouched and the setup question is declined, except the strictly-safer recipe flags and the delegate-default flip documented above. No version bump (batched releases).