feat(models): add fable tier for the four singleton judgment gates

Owner-ratified 2026-07-20: architect, grounding-check, tdd-author and
debugger pin fable/xhigh — cycle-reach singleton gates whose miss
silently ratifies or poisons an entire cycle (drift verdict, autonomous
sign-off signature, RED executable-spec, root-cause). The set is
closed: extending it requires fresh owner ratification, no fable agent
ever runs per-task in a loop or in a parallel fan-out, and workflow
scripts stay fable-free (the implement-loop quality gate caps at opus).

Policy home: docs/agent-template.md $ model rule 1 (effort: fable
gates stay xhigh, not max); the workflow policy headers now point at
the exception instead of the former blanket ban.

audit/agents/architect.md

@@ -2,7 +2,7 @@
 name: architect
 description: Read-only architecture reviewer. Checks at cycle close whether the codebase still matches the project's design ledger and CLAUDE.md, identifies drift and technical debt with paths and short justifications, and recommends one direction for the next iteration. Names problems; does NOT propose implementations.
 tools: Read, Glob, Grep, Bash
-model: opus
+model: fable
 effort: xhigh
 ---
 

debug/agents/debugger.md

@@ -2,7 +2,7 @@
 name: debugger
 description: Diagnoses bugs in the project. Reproduces, finds the root cause, writes a RED test that pins down the symptom, and hands off to implement mini-mode for the GREEN side. Does NOT apply the fix itself.
 tools: Read, Edit, Write, Bash, Glob, Grep
-model: opus
+model: fable
 effort: xhigh
 ---
 

docs/agent-template.md

@@ -109,24 +109,40 @@ unchanged; the workflow simply does the orchestration the retired
 
 ### `model`
 
-Mandatory. Every agent pins an explicit model — `opus` or `sonnet`,
-nothing else. An omitted field means the agent inherits the *session*
-model, which routes the dispatch to whatever the user happens to be
-chatting on (possibly `fable` — banned for all plugin agents and
-workflows, by owner decree). Pinning removes that coupling.
+Mandatory. Every agent pins an explicit model — `fable`, `opus` or
+`sonnet`, nothing else. An omitted field means the agent inherits the
+*session* model, which routes the dispatch to whatever the user happens
+to be chatting on — an unintended tier for every role that has not
+earned its pin. Pinning removes that coupling.
 
 Assignment rule, in priority order:
 
-1. **Consequence of a miss** — agents whose errors silently poison
-   downstream work (adversarial gates, root-cause diagnosis,
-   architecture judgment) run `opus`. Opus is the documented
-   strength for code review, debugging, and deep reasoning.
-2. **Mechanical scope** — tightly-scoped execution of a pre-made
+1. **Cycle-reach singleton gates** — agents that run at most a
+   couple of times per cycle or bug AND whose miss silently
+   ratifies or poisons an entire cycle run `fable` (owner-ratified
+   2026-07-20): `architect` (the drift verdict steering the next
+   iteration), `grounding-check` (the autonomous sign-off
+   signature under `/boss`), `tdd-author` (the RED executable-spec
+   the GREEN side builds on), `debugger` (the root-cause a full
+   RED→GREEN cycle rides on). Fable is the scarcest tier and
+   shares its budget with a fable main session, so the set is
+   CLOSED — extending it requires a fresh owner ratification —
+   and a fable agent is never dispatched per-task inside a loop
+   or in a parallel fan-out. Workflow scripts stay fable-free
+   entirely; the implement-loop quality gate caps at `opus`.
+2. **Consequence of a miss** — the remaining judgment roles —
+   errors still silently poison downstream work, but the role
+   either fans out, runs per-task, or feeds a decider rather than
+   gating a cycle (adversarial lenses, plan recon, field/bench
+   evidence, the in-loop quality review) — run `opus`. Opus is
+   the documented strength for code review, debugging, and deep
+   reasoning.
+3. **Mechanical scope** — tightly-scoped execution of a pre-made
    plan, recon, extraction, compliance-diffing run `sonnet`
    (near-opus coding quality at lower latency and cost).
-3. **Volume × wall-clock** — agents dispatched per-task inside
+4. **Volume × wall-clock** — agents dispatched per-task inside
    loops or fanned out in parallel swarms multiply their model's
-   latency; they run `sonnet` unless rule 1 overrides (currently
+   latency; they run `sonnet` unless rule 2 overrides (currently
    only `quality-reviewer`, the loop's last correctness review).
    That override is itself **size-conditioned** (issue #30):
    consequence-of-a-miss scales with diff size, so the
@@ -138,14 +154,16 @@ Assignment rule, in priority order:
    is what makes the lower tier defensible; the agent-file
    frontmatter keeps the opus default.
 
-Current distribution: `opus` — architect, bencher, debugger,
-fieldtester, grounding-check, plan-recon, quality-reviewer,
-spec-skeptic, tdd-author. `sonnet` — docwriter, glossary-extractor,
-implementer, spec-reviewer, synthetic-user, tester.
+Current distribution: `fable` — architect, debugger,
+grounding-check, tdd-author. `opus` — bencher, fieldtester,
+plan-recon, quality-reviewer, spec-skeptic. `sonnet` — docwriter,
+glossary-extractor, implementer, spec-reviewer, synthetic-user,
+tester.
 
 The same rule binds Workflow scripts: every `agent()` call passes an
-explicit `model:` option (see the model-policy header comments in
-`implement/workflows/*.js`).
+explicit `model:` option, and `fable` is never a valid value there —
+rule 1's gates are frontmatter agents, not workflow stages (see the
+model-policy header comments in `implement/workflows/*.js`).
 
 ### `effort`
 
@@ -156,9 +174,12 @@ effort, coupling every dispatch's thinking budget to whatever the user
 happens to be chatting at — the same session-state coupling the `model`
 pin exists to remove. Effort follows the model split:
 
-- **`xhigh` on every `opus` agent.** The judgement roles are the
-  pipeline's quality floor; their thinking budget must not silently
-  degrade because the session runs lower.
+- **`xhigh` on every `fable` and `opus` agent.** The judgement
+  roles are the pipeline's quality floor; their thinking budget
+  must not silently degrade because the session runs lower. The
+  fable gates deliberately stay at `xhigh`, not `max` — the
+  marginal thinking is not worth the extra latency and
+  scarce-budget burn.
 - **`high` on every `sonnet` agent.** Tightly-scoped execution of a
   pre-made plan gains little from `xhigh` but pays its latency on
   every dispatch — and these are exactly the roles dispatched

implement/workflows/compiler-driven-edit.js

@@ -41,7 +41,8 @@
 //
 // Model policy: every agent() call pins an explicit model — never the
 // session-model inherit (which could route to an unintended tier, e.g. fable —
-// banned for all plugin agents and workflows). Both phases here are mechanical
+// reserved for the four ratified frontmatter gates, never for workflow stages;
+// agent-template § model rule 1). Both phases here are mechanical
 // (compiler-enumerated propagation, build/suite re-run), so both run sonnet.
 // Effort policy mirrors it: every call pins an explicit effort — the edit
 // (real code work) runs high, the build/suite verify (schema-bound check)

implement/workflows/implement-loop.js

@@ -80,7 +80,8 @@
 //     the end-report for the orchestrator to write.
 //   • Model policy: every agent() call pins an explicit model — never the
 //     session-model inherit (which could route to an unintended tier, e.g.
-//     fable — banned for all plugin agents and workflows). Mechanical and
+//     fable — reserved for the four ratified frontmatter gates, never for
+//     workflow stages; agent-template § model rule 1). Mechanical and
 //     in-loop steps run sonnet; the quality gate runs opus by default (last
 //     correctness review before the end-verify), TIERED to sonnet/high for a
 //     small (<= 25 changed lines), non-contract diff as measured

specify/agents/grounding-check.md

@@ -2,7 +2,7 @@
 name: grounding-check
 description: Read-only grounding-check reviewer for spec drafts. Dispatched by the specify skill in Step 5, between linguistic self-review and user-approval. Reads the draft with fresh context, extracts its load-bearing assumptions about current codebase behaviour, and for each one searches the workspace for a currently-green test that ratifies it. Reports PASS or BLOCK. Does NOT propose fixes, does NOT edit files.
 tools: Read, Glob, Grep, Bash
-model: opus
+model: fable
 effort: xhigh
 ---
 

tdd/agents/tdd-author.md

@@ -2,7 +2,7 @@
 name: tdd-author
 description: Turns a test-specifiable feature description or issue into a single minimal, autonomous RED executable-spec test ("how it should work"), then hands the GREEN side to implement mini-mode. On a design fork (behaviour not test-specifiable) it bounces to brainstorm; on a GREEN one iteration can't reach, it decomposes the headline into BLOCKER sub-tests. Does NOT implement the feature.
 tools: Read, Edit, Write, Bash, Glob, Grep
-model: opus
+model: fable
 effort: xhigh
 ---