gHashTag · Oct 20, 2026 · Oct 20, 2026
@@ -75,7 +75,7 @@ A `/loop` tick on this epic follows this order, so a new tick never undoes or du
 
 1. **Read state.** The ledger is a comment on #10486 (the one headed "Loop ledger"). Read it, `CronList` (delete duplicate crons after a restart), and list running subagents. A lane the ledger says is running is not started again.
 2. **Look for anomalies before new work.** Open PRs of this epic that are red, conflicting or stale (`tri pr ready`); a subagent that reported done but whose PR does not exist (`git ls-remote`); a merged PR whose spec is missing on master (`tri pr landed`); a seal that no longer verifies (`tri seals drift`); a ledger row older than 45 minutes still "running". Fix or file each one first (self-repair beats new work).
-3. **Everything on Sonnet 5.5, Opus only on evidence** (`specs/claw/model_route.t27`, owner 2026-10-19, #10921: the orchestrator included; Opus after 2 failed attempts on one task or on the owner's word): 3 to 5 subagents on the 8 GB Mac while `memory_pressure` stays above 25 % free; each lane in its own worktree and branch; the orchestrator reads every diff before auto-merge is enabled. Fast review: check out the PR head, `t27c frontier --only <its specs> --list` and `t27c seal --verify`; re-run `test-report` only when frontier says rebuild or the diff looks wrong; regenerate any `gen/` file the PR touches and compare it byte for byte; run `python3 -I tools/dupe_scan.py`. To change a PR that has auto-merge on, disable auto-merge first, push, then enable it again (a second push races the merge).
+3. **Sub-tasks start in a free T27 OS pane** (`specs/claw/model_route.t27` TIER_PANE, owner 2026-10-20, #11317; how: skills `model-routing` and `t27os-orchestra`): a pane on the free key tier, a Sonnet subagent after 2 failures, Opus after 4 or on the owner's word; the orchestrator stays on Sonnet. Until #11316 lands a pane cannot run unattended (no permission mode on its command line), so a lane falls back to a Sonnet subagent. 3 to 5 lanes (panes or subagents) on the 8 GB Mac while `memory_pressure` stays above 25 % free; each lane in its own worktree and branch; the orchestrator reads every diff before auto-merge is enabled. Fast review: check out the PR head, `t27c frontier --only <its specs> --list` and `t27c seal --verify`; re-run `test-report` only when frontier says rebuild or the diff looks wrong; regenerate any `gen/` file the PR touches and compare it byte for byte; run `python3 -I tools/dupe_scan.py`. To change a PR that has auto-merge on, disable auto-merge first, push, then enable it again (a second push races the merge).
 4. **Merge only green.** Auto-merge after the required checks pass. A red is inherited only if it is a subset of master's failures; `claw-sarif` failing on "permissions requested are not granted to this installation" is the known App-permission red (owner steps in `docs/claw/README.md`).
 5. **Write state.** Edit the ledger row, tick the epic's Progress table, republish the dashboard, and add a learning to this skill when a trap cost more than one try. Renew the keep-awake hold at the start of each tick (it lapses after about 5 idle minutes). Then run `/self-cleanup` (`.claude/skills/self-cleanup/SKILL.md`): remove the worktrees and Zig caches of lanes whose PRs merged, and put the freed space in the row.
 6. **Requests out, never questions.** Owner, 2026-10-19: "do not ask, request; everything not forbidden is allowed". A blocked item is not parked as "waiting for the owner": name who holds what it needs, send that party a request with the options, a default and a time, and continue on the default. End every tick with `Requests out:` -- who, what, sent when, default, due. An unanswered request is chased once, then the default is taken and written in the ledger row. The owner is asked only for a password, a sign-in, a payment, a legal commitment or a choice between two businesses (rule: `CLAUDE.md` "Proactivity: request, do not ask").

@@ -60,7 +60,7 @@ For a `.zig` file there is no rustc oracle: the converted spec carries the file'
 
 1. Read the ledger comment on #10522; `CronList` (delete duplicates after a restart); list running subagents. A lane a row calls running is not started again. The analog loop keeps its own ledger on #10486 and owns #10509 and `specs/analog/`: never start work there.
 2. Anomalies before new work: open PRs of the epic that are red, conflicting or stale; a lane that reported done with no PR (`git ls-remote origin | grep t27o`); a seal that no longer verifies.
-3. Sonnet 5.5 plans, implements and reviews (`specs/claw/model_route.t27`, #10929, owner 2026-10-19); Opus only after two failed attempts or on the owner's word. Two lanes at most from this loop while the analog loop runs on the same 8 GB Mac; one lane at a time edits `rust_convert.t27`.
+3. Sonnet 5.5 plans and reviews; sub-tasks start in a free T27 OS pane, then a Sonnet subagent after 2 failures, Opus after 4 or on the owner's word (`specs/claw/model_route.t27` TIER_PANE, #11317, owner 2026-10-20; skills `model-routing` and `t27os-orchestra`; until #11316 lands a pane cannot run unattended, so a lane falls back to a Sonnet subagent). Two lanes at most from this loop while the analog loop runs on the same 8 GB Mac; one lane at a time edits `rust_convert.t27`.
 4. The local gate is `tri pr preflight --quick` (#11207; `tri pr preflight` adds the corpus ratchet, about 11 minutes): check, tests with vacuity, seal, types, dupes against the base, ledger rows, census, the own-language budget and the home-path scan; exit 0 all passed, 1 a rule failed, 2 evidence unreadable (never a pass). It does not run `check_seal_currency.py`, `check_seal_coverage.py` or the cargo tests: run those after an emitter or spec change. Review before auto-merge, on the PR head: `t27b test` and once `t27c test-report` (vacuous 0) on every touched spec; `t27c seal --verify`; regenerate each gen file and compare byte for byte; `python3 -I tools/dupe_scan.py` and `--like <spec>` (bodies -- `t27c dupes --name` only finds names; #10801 passed the name check with 13 copied bodies); the own-language budget compiled from the merge base (below); `python3 -I tools/check_devhome_paths.py` (#10646 brought nine `/Users/...` test literals); `tri types ratchet` when the diff declares a struct or enum (a fixture type named `Gate` clashed with crm-sellers' `Gate`: the types ratchet counts a second definition of a name as a conflict, so name fixture types uniquely); `cargo check -p tri`. A red is inherited only if the PR's failures are a subset of master's: run `dupe_scan` on the PR head AND on its merge base and `comm -23` the findings (against current master the base drift shows up as false extras). A spec that `use`s `rust_convert.t27` (spice, zig) carries it in its seal closure: re-seal it when rust_convert changes.
 5. Merge only green, then auto-merge (GraphQL `enablePullRequestAutoMerge`). It refuses with "in unstable status" while a NON-required check is red; when the four required checks (validate, check-linked-issue, parse-ratchet, own-language) are green and every red is master's, merge with `PUT /repos/gHashTag/t27/pulls/N/merge` and `{"merge_method":"squash","sha":"<the head you reviewed>"}` (the sha makes a late push fail the merge instead of slipping in). Turning auto-merge off does not hold a PR -- any actor with the token can re-arm it (#10801 merged five minutes after it was switched off). To hold a PR, convert it to a draft (`convertPullRequestToDraft`); `markPullRequestReadyForReview` when it may go.
 6. Stacked PRs and squash merges: after the base merges, `git rebase --onto origin/master <old base tip>`, check `git diff <reviewed head> HEAD -- <converter files>` is empty, push with `--force-with-lease=<branch>:<old sha>`; auto-merge survives a force push.

@@ -136,10 +136,13 @@ Every loop tick ends with `Requests out:` (who, what, sent when, default, due).
 
 Load these skills when their functionality matches the task.
 
-### Model routing (owner directive 2026-10-19, replacing 2026-10-18)
+### Model routing (owner directive 2026-10-20, replacing 2026-10-19)
 
-Every agent runs on **Sonnet 5.5** by default, the orchestrating session included; any job escalates to
-**Opus 5.5** only after 2 failed attempts on the same task or on the owner's word. The law is `specs/claw/model_route.t27`; how to follow it is the `model-routing` skill.
+Sub-tasks (implement, port, search, test, docs, fix) start in a **free T27 OS pane** (the key master's free
+tier, visible in the window), go to a **Sonnet 5.5** subagent after 2 failed attempts and to **Opus 5.5**
+after 4 or on the owner's word; the orchestrating session plans and reviews on Sonnet 5.5. The law is
+`specs/claw/model_route.t27` (TIER_PANE, #11317); how to follow it is the `model-routing` skill, and a lane
+as a pane is the `t27os-orchestra` skill.
 `.claude/settings.json` sets `CLAUDE_CODE_SUBAGENT_MODEL` and each agent in `.claude/agents/` names its
 model.
 

@@ -29,7 +29,7 @@ behind one front door, with the gate logic in `.t27` specs. Epic
 | Red origin: whose red a failing check is. A file the log names that the PR changes, or a green master, makes it the PR's; a red master, or a named file master changed since the PR's base, makes it inherited, and the PR gets no push. Ask required_red first | `specs/claw/red_origin.t27` (the PR's paths, the log's named paths, master's moved paths and master's state in; one `O own/inherited/unknown` line with the reason out; not wired to a job yet) | #10821 |
 | Merge judge: which open pull requests TRI CLAW merges, and why it leaves the rest alone. First match wins: the no-auto-merge label, a draft, a base that is not master, a `queen-` bee branch (the reviewer-bee merger's), a conflict, no closing reference, an unread rollup, a pending check, a required check red or missing, any other red that is not inherited from master (claw-sarif is, by definition), a head commit under ten minutes old; then a squash merge pinned to the judged head sha, five per run at most, lowest number first | `specs/claw/merge_judge.t27` (`P`/`K`/`F`/`O`/`B` lines in; `G` merge, `W`/`H`/`N` skip with the reason, `L` failing log wanted and `M` summary out; lowered to `gen/c/claw/merge_judge.c`; run by the `claw-merge` job of `gate-topology.yml`, which also carries `refresh.t27`'s update-branch step; plan-only into the step summary until the repository variable `CLAW_MERGE_LIVE` is `1`) | #10973 |
 | Known survivors: whether a mutation sweep holds anything new. A survivor is keyed by its spec, operator and line text, not its line number, so an argued equivalent stays known when lines above it move; a new survivor, a NOAPPLY line or an unreadable line holds; a known entry no line matches asks to be pruned | `specs/claw/mut_known.t27` (the sweep text and the known list in; one `E pass/hold` line with the reason, and one `E new/harness/unreadable` line per holding sweep line, out; applied by hand, not wired to the sweep script yet) | #10835 |
-| Model routing: Opus 5.5 orchestrates, Sonnet 5.5 runs sub-tasks | `specs/claw/model_route.t27`, skill `model-routing`, `.claude/settings.json` + `.claude/agents/*` | owner directive 2026-10-18 |
+| Model routing: sub-tasks start in a free T27 OS pane, then Sonnet 5.5, then Opus 5.5; Sonnet 5.5 orchestrates | `specs/claw/model_route.t27` (TIER_PANE), skills `model-routing` and `t27os-orchestra`, `.claude/settings.json` + `.claude/agents/*` | owner directive 2026-10-20 (#11317), replacing 2026-10-18 and 2026-10-19 |
 | A T27F visual in every answer that needs one | rule `specs/t27mcp/visual_output.t27`, particle-still layer `specs/claw/visual_output.t27`, procedure in skill `t27f`, "Visual in every output" | owner directive 2026-10-18 |
 | `reel_still`: one particle still (PNG at STILL_MS of a token_floor reel) from TRI CLAW's `/mcp` | `specs/claw/reel_still.t27`, rendered on the Railway lab only | follow-up of the row above |
 | Positioning / pricing | `docs/claw/competitors.md` | T6, started |