feat: gpt-6-astra flagship, codex exec guards, 0.153 epoch (0.0.55)

[okisdev]

summary

• gpt-6-astra becomes the codex flagship: the capability table row (5/4/2, measured shape in its notes), the spec grade routing row with an xhigh effort requirement, the gpt-5.6-sol row removed under the single flagship precedent, the lane reminder, and the doctor checks for a codex default without a table row or a persistent reasoning effort. the dated codex listing enumeration in the rules becomes a rule so it stops rotting with every listing change, and gpt-reserve is documented as the Luna Reserve fallback.
• the codex companion guards exec runs for the new model: every invocation also disables sleep_tool (Astra advertises clock, so codex would register a sleep tool that spends the flight budget) and memories (privacy parity with the grok lane); the persistent reasoning effort is rejected when explicit or inherited through a resume, and a run whose rollout resolved to persistent terminalizes as policy through the generalized policyViolation; the foreground write warning retargets from gpt-5.6-sol to gpt-6-astra; a job whose resolved model differs from its explicit --model records modelDrift and renders a warning, which makes a Luna Reserve handoff visible at collection.
• the codex tested interval moves to [0.152.0, 0.154.0) after live verification on 0.153.2 and 0.153.4; the never populated appliedServiceTier field and its dead session.configured probe are removed; guardian routing and the skills context cost are settled by reading upstream and documented in the contract.
• the grok runtime socket preflight names the engine behind a symlinked /var/run/docker.sock and prints the exact repair (OrbStack: orb config set setup.use_admin false plus removing the symlink; Docker Desktop: the default socket option) in the setup report, the rendered next step, and the managed run sandbox failure, without downgrading strict.
• reviewable logic lives in plugins/codex/scripts/codex-companion.mjs, plugins/codex/scripts/lib/codex-exec.mjs, plugins/grok/scripts/lib/grok-exec.mjs, and plugins/fusion/rules/orchestration.md; plugins/fusion/rules-manifest.json is regenerated and the seven version fields plus CHANGELOG carry the 0.0.55 release.

breaking changes

• codex-cli below 0.152.0 now fails task and review preflight with failureKind: "setup" (the minimum was 0.147.0); the sleep_tool feature the companion disables is absent from older registries.
• appliedServiceTier disappears from codex job records; records that still carry it are normalized on read. the requested serviceTier stays.
• delegated codex runs no longer read or write the account's codex memory store and cannot use the sleep tool or the persistent reasoning effort.
• the routing table loses its gpt-5.6-sol row; explicit --model gpt-5.6-sol still works, but no routing row names it.

test plan

already verified

• npm test on the merged tree with nothing else running -> 1148 tests, 1147 pass, 0 fail, 1 standing skip
• claude plugin validate for codex, grok, fusion, and the marketplace -> all pass
• live probes through the companion on codex-cli 0.153.4: structured output via --output-schema, thread resume by stored thread id, native review, and a task with no effort flag -> all exact; the same set plus a live web consult on gpt-6-astra passed on 0.153.2 earlier the same day
• two adversarial reviews on gpt-6-astra over the diff (150s and about 2.5 min wall clock); both findings (inherited persistent effort on resume, and a config.toml preflight scan that misread profile overrides) were fixed or withdrawn before this PR
• /grok:setup on an OrbStack host renders the orb config set setup.use_admin false remedy under Next steps

reviewer should verify

• after the plugin caches refresh to 0.0.55, /fusion:setup reconciles ~/.claude/rules/orchestration.md to the new prose and keeps the scored table, and /codex:setup reports ready with compatibility tested on codex-cli 0.153.x
• /codex:task --effort persistent -- anything fails before job creation with failure: input naming the persistent mode
• /fusion:smoke passes the codex and worker probes; the grok probe fails fast with the engine specific remedy while a Docker engine keeps the socket symlink

notes

• issue codex 0.153 and gpt-6-astra follow-ups #54 tracked the follow-ups from the first pass of this change and was closed once they landed here.
• the grok lane stays down on hosts where OrbStack runs with admin privileges until the host is repaired or upstream stops rejecting symlinked endpoints; the host change and the upstream report are deliberately left to the user.
• release cadence after merge: refresh the installed plugin caches, run /fusion:setup, /fusion:smoke, /fusion:doctor, and /fusion:stats --prune-dead --yes through the raw args transport.