prime-vimihi · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "codex-sdlc",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Run evidence-backed software delivery across one or more repositories with Codex.",
   "author": {
     "name": "vimihi",

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 All notable changes to codex-sdlc are documented here.
 
+## 1.0.1 - 2026-10-05
+
+- Update `--save-my-token` to use `gpt-6.1-sol/high` for BA. PM inherits, and backend, web/mobile frontend, and QC continue to use `gpt-6-luna/xhigh`.
+- Require plugin/runtime 1.0.1 for the updated preset and document reapplying it after upgrade. Saved project settings, existing run snapshots, optional PO settings, and explicitly chosen fallbacks are preserved until the user changes them.
+- Add migration coverage for previewing and reapplying the preset, freezing earlier GPT-6 Sol runs, and rejecting a host without GPT-6.1 Sol instead of substituting another model.
+- Refresh the dependency lockfile to patched `fast-uri` 3.1.8; a clean install reports no dependency vulnerabilities.
+
 ## 1.0.0 - 2026-09-25
 
 - Add opt-in, assessed Compact runs with a frozen revisioned graph, one canonical BA specification, generated compatibility views, and one independent integrated QC record. Full remains the default; saved model settings and existing runs retain their meaning.

diff --git a/README.md b/README.md
@@ -56,6 +56,8 @@ Eight Codex skills and a repository-local CLI keep tasks, evidence, blockers, an
 
 ## Get started
 
+**New in 1.0.1:** Token-saving mode now selects GPT-6.1 Sol for BA. Update both plugin and project runtime, then reapply the preset for new runs. See the [release notes](docs/releases/1.0.1.md).
+
 **New in 1.0.0:** Runtime-assisted delivery reduces manual task bookkeeping, and eligible bounded features can use opt-in Compact mode. See the [release notes](docs/releases/1.0.0.md) for changes and upgrade guidance.
 
 You need **Codex**, **Node.js `>=24.16.0 <25`**, **npm 11**, and an existing application repository. Setup configures your application directories; it does not scaffold application code.
@@ -93,7 +95,7 @@ To continue later, ask Codex to resume the existing run. Its manifest records th
 Run this against an existing web repository:
 
 ```sh
-npx --yes codex-sdlc@1.0.0 init \
+npx --yes codex-sdlc@1.0.1 init \
   --root /absolute/path/to/web --name example-web \
   --applications web --web-root . --web-preset nextjs \
   --dry-run
@@ -108,7 +110,7 @@ node .sdlc/runtime.cjs doctor
 node .sdlc/runtime.cjs validate-config
 ```
 
-For a global CLI installation, use `npm install --global codex-sdlc@1.0.0`.
+For a global CLI installation, use `npm install --global codex-sdlc@1.0.1`.
 
 </details>
 
@@ -124,7 +126,7 @@ The runtime can now prepare task assignments, record agent activation, collect d
 - `timing` reports recorded lifecycle intervals and collector durations, with overlapping work and unknown model time clearly distinguished.
 - Configured roots such as `apps/api` and Next.js route groups/dynamic segments work consistently. Several technical capabilities can reference one business requirement.
 
-See [runtime-assisted delivery](skills/sdlc-pm/references/task-operations.md) and [1.0.0 release notes](docs/releases/1.0.0.md). Full remains the default; eligible new runs can now opt into Compact. Parallel scheduling, evidence caching, and model-default changes remain deferred. Automatic handoff verifies the caller-declared task-owned subset of actual uncommitted Git changes; it does not independently infer ownership of omitted files or support deleted product paths.
+See [runtime-assisted delivery](skills/sdlc-pm/references/task-operations.md) and [1.0.0 release notes](docs/releases/1.0.0.md). Full remains the default; eligible new runs can now opt into Compact. Parallel scheduling and evidence caching remain deferred. Automatic handoff verifies the caller-declared task-owned subset of actual uncommitted Git changes; it does not independently infer ownership of omitted files or support deleted product paths.
 
 ### Compact delivery for bounded features
 
@@ -199,9 +201,9 @@ These chat shortcuts, introduced in 0.6.0, remain available:
 /sdlc --normal
 ```
 
-Token-saving mode keeps PM inherited, uses Sol (`gpt-6-sol`) with high reasoning for BA, and Luna (`gpt-6-luna`) with extra-high reasoning for backend, web/mobile frontend, and QC. Normal mode restores inheritance for those roles. Both save to the current project's `.sdlc/project.yaml` for every new run; existing runs and optional AI Product Owner settings are preserved.
+Token-saving mode keeps PM inherited, uses GPT-6.1 Sol (`gpt-6.1-sol`) with high reasoning for BA, and Luna (`gpt-6-luna`) with extra-high reasoning for backend, web/mobile frontend, and QC. Normal mode restores inheritance for those roles. Both save to the current project's `.sdlc/project.yaml` for every new run; existing runs and optional AI Product Owner settings are preserved.
 
-These are skill-handled chat shortcuts. In clients that reject custom slash commands, invoke `$sdlc --save-my-token` or `$sdlc --normal`. Both plugin and runtime must be 0.6.0 or newer. See [project mode details and CLI equivalents](docs/agent-models.md#project-model-modes).
+These are skill-handled chat shortcuts. In clients that reject custom slash commands, invoke `$sdlc --save-my-token` or `$sdlc --normal`. The updated token-saving preset requires plugin/runtime 1.0.1 or newer; normal mode requires 0.6.0 or newer. After upgrading an existing project, reapply `--save-my-token` to update its saved preset. See [project mode details and CLI equivalents](docs/agent-models.md#project-model-modes).
 
 ## What stays in your repository
 
@@ -226,7 +228,7 @@ codex-sdlc does not operate a hosted service or send repository content to a cod
 Preview a project upgrade before applying it:
 
 ```sh
-npx --yes codex-sdlc@1.0.0 upgrade \
+npx --yes codex-sdlc@1.0.1 upgrade \
   --root /absolute/path/to/coordinator --dry-run
 ```
 
@@ -240,10 +242,10 @@ Applied upgrades create backups. Rollback checks managed-file integrity before r
 | --- | --- |
 | [Getting started](docs/getting-started.md) | [CLI setup and lifecycle reference](docs/cli-reference.md) |
 | [Multi-repository workspaces](docs/multi-repository.md) | [Role models and dispatch records](docs/agent-models.md) |
-| [What's new in 1.0.0](docs/releases/1.0.0.md) | [Release history](https://github.com/prime-vimihi/codex-sdlc/releases) |
+| [What's new in 1.0.1](docs/releases/1.0.1.md) | [Release history](https://github.com/prime-vimihi/codex-sdlc/releases) |
 | [Support](SUPPORT.md) | [Contributing](CONTRIBUTING.md) |
 
-Current verification includes automated runtime tests, plugin and skill validation, and independent built-CLI checks. Native Linux/Windows qualification and a matched real-agent performance benchmark remain pending. See the [1.0.0 validation notes](docs/releases/1.0.0.md#validation).
+Current verification includes automated runtime tests, plugin and skill validation, and independent built-CLI checks. Native Linux/Windows qualification and a matched real-agent performance benchmark remain pending. See the [1.0.1 validation notes](docs/releases/1.0.1.md#validation).
 
 ## Build with us
 

diff --git a/assets/framework.yaml b/assets/framework.yaml
@@ -1,7 +1,7 @@
 schema_version: 1
 framework:
   name: codex-sdlc
-  version: 1.0.0
+  version: 1.0.1
   run_schema_version: 1
   project_schema_version: 2
 installation:

diff --git a/docs/agent-models.md b/docs/agent-models.md
@@ -1,6 +1,6 @@
 # Choose a model for each SDLC role
 
-Custom role settings are available in codex-sdlc 0.5.0. The project mode shortcuts below require both the 0.6.0 plugin and runtime. Updating the plugin does not upgrade existing projects; upgrade the runtime as described in the [getting started guide](getting-started.md).
+Custom role settings are available in codex-sdlc 0.5.0. The updated token-saving preset requires both the 1.0.1 plugin and runtime; normal mode remains supported from 0.6.0. Updating the plugin does not upgrade existing projects; upgrade the runtime as described in the [getting started guide](getting-started.md).
 
 ## Project model modes
 
@@ -15,7 +15,7 @@ The new `sdlc` skill interprets this chat shorthand and saves the following proj
 | Role | Model | Reasoning |
 | --- | --- | --- |
 | PM | Inherited | Inherited |
-| BA | `gpt-6-sol` | `high` |
+| BA | `gpt-6.1-sol` | `high` |
 | Backend | `gpt-6-luna` | `xhigh` (extra-high) |
 | Frontend, including web and mobile | `gpt-6-luna` | `xhigh` (extra-high) |
 | QC | `gpt-6-luna` | `xhigh` (extra-high) |
@@ -28,7 +28,7 @@ To restore normal inherited models:
 
 Normal mode removes model, reasoning, and fallback overrides for PM, BA, backend, frontend, and QC. It does not restore custom models that existed before token-saving mode. Both commands preserve optional AI Product Owner configuration and all other project settings.
 
-Each selection is stored in the coordinator's `.sdlc/project.yaml` and applies to **every new run** until you change it. Other projects and existing runs are unaffected. A mode-only request does not start a feature run. In a multi-repository workspace, run it in the coordinator to cover its mapped applications. An uninitialized project needs setup first.
+Each selection is stored in the coordinator's `.sdlc/project.yaml` and applies to **every new run** until you change it. After upgrading from 1.0.0, send `/sdlc --save-my-token` again to replace the saved BA selection with GPT-6.1 Sol. Upgrading alone preserves saved settings. Other projects and existing runs are unaffected. A mode-only request does not start a feature run. In a multi-repository workspace, run it in the coordinator to cover its mapped applications. An uninitialized project needs setup first.
 
 Codex's explicit skill syntax is `$sdlc --save-my-token` or `$sdlc --normal`; use it if your client reserves slash commands for built-in actions. The plugin handles `/sdlc` as prompt shorthand rather than registering a native slash command. See [official skill invocation guidance](https://learn.chatgpt.com/docs/build-skills).
 
@@ -41,7 +41,9 @@ node .sdlc/runtime.cjs configure-agents --normal
 
 Add `--dry-run --json` to preview without saving. Use `--root /absolute/path/to/coordinator` to select a project explicitly. The two modes are mutually exclusive and cannot be combined with individual role or PO configuration flags; make custom changes in a separate invocation. Applying the same preset again keeps the same settings.
 
-The presets require `gpt-6-sol/high` and `gpt-6-luna/xhigh` support on the user's host. Configuration saves the requested policy; dispatch still validates availability. No fallback is added, and an unavailable model or effort stops dispatch. Token-saving mode selects these models; actual token usage depends on the work.
+The preset requires `gpt-6.1-sol/high` and `gpt-6-luna/xhigh` support on the user's host. Configuration saves the requested policy; dispatch still validates availability. No fallback is added, and an unavailable model or effort stops dispatch. Token-saving mode selects these models; actual token usage depends on the work.
+
+The model IDs match [OpenAI's current Codex model guidance](https://learn.chatgpt.com/docs/models), checked on 2026-10-05. GPT-6.1 Sol is the newer Sol selection; GPT-6 Luna remains the current Luna selection. SDLC pins exact IDs rather than silently changing a saved policy when another generation is released. Reasoning effort is retained across this update; compare actual delivery results before claiming time or token savings.
 
 ## Custom role settings
 

diff --git a/docs/cli-reference.md b/docs/cli-reference.md
@@ -4,7 +4,7 @@ For the first-run walkthrough, read [Getting started](getting-started.md). Retur
 
 ## Build and test
 
-Version 1.0.0 is in development. Release-pinned 1.0.0 commands below apply after publication; use the local tarball procedure while testing this branch.
+Version 1.0.1 updates the token-saving preset to GPT-6.1 Sol for BA. Upgrade the runtime and reapply the preset to update saved project settings for new runs.
 
 Requirements: Node.js `>=24.16.0 <25` and npm 11.
 
@@ -17,7 +17,7 @@ npm pack
 Install the published CLI with:
 
 ```sh
-npm install --global codex-sdlc@1.0.0
+npm install --global codex-sdlc@1.0.1
 ```
 
 ## Project setup modes
@@ -67,7 +67,7 @@ node .sdlc/runtime.cjs configure-agents --save-my-token
 node .sdlc/runtime.cjs configure-agents --normal
 ```
 
-Both commands accept `--root <coordinator>`. Token-saving mode uses inherited PM, `gpt-6-sol/high` for BA, and `gpt-6-luna/xhigh` for backend, web/mobile frontend, and QC. Normal mode removes those five roles' overrides. Optional PO configuration is preserved. The choice persists for new runs in this project; existing runs keep their policies. Mode flags cannot be combined with one another or individual agent/PO settings, and are supported on `configure-agents`, not `init` or `start`. See [model modes](agent-models.md#project-model-modes) for chat invocation and compatibility.
+Both commands accept `--root <coordinator>`. In runtime 1.0.1 or newer, token-saving mode uses inherited PM, `gpt-6.1-sol/high` for BA, and `gpt-6-luna/xhigh` for backend, web/mobile frontend, and QC. Normal mode removes those five roles' overrides. Optional PO configuration is preserved. The choice persists for new runs in this project; existing runs keep their policies. After upgrading an older project, reapply `--save-my-token` to update its saved preset. Mode flags cannot be combined with one another or individual agent/PO settings, and are supported on `configure-agents`, not `init` or `start`. See [model modes](agent-models.md#project-model-modes) for chat invocation and compatibility.
 
 ### Application setup
 
@@ -149,9 +149,9 @@ Use the `generic` application preset or `none` database preset when a listed pre
 Install the generated tarball, preview the bounded changes, and then initialize. During local testing, pin the generated repository launcher to the tarball:
 
 ```sh
-npm install --global ./codex-sdlc-1.0.0.tgz
-codex-sdlc init --root /path/to/project --name example --applications web --web-root . --web-preset nextjs --runtime-spec file:/absolute/path/codex-sdlc-1.0.0.tgz --dry-run
-codex-sdlc init --root /path/to/project --name example --applications web --web-root . --web-preset nextjs --runtime-spec file:/absolute/path/codex-sdlc-1.0.0.tgz
+npm install --global ./codex-sdlc-1.0.1.tgz
+codex-sdlc init --root /path/to/project --name example --applications web --web-root . --web-preset nextjs --runtime-spec file:/absolute/path/codex-sdlc-1.0.1.tgz --dry-run
+codex-sdlc init --root /path/to/project --name example --applications web --web-root . --web-preset nextjs --runtime-spec file:/absolute/path/codex-sdlc-1.0.1.tgz
 cd /path/to/project
 node .sdlc/runtime.cjs restore
 ```
@@ -170,8 +170,8 @@ The installer preserves existing `AGENTS.md` and `.gitignore` content, refuses c
 Preview and apply an upgrade with the new runtime package pinned into the repository:
 
 ```sh
-codex-sdlc upgrade --root /path/to/project --runtime-spec file:/absolute/path/codex-sdlc-1.0.0.tgz --dry-run
-codex-sdlc upgrade --root /path/to/project --runtime-spec file:/absolute/path/codex-sdlc-1.0.0.tgz
+codex-sdlc upgrade --root /path/to/project --runtime-spec file:/absolute/path/codex-sdlc-1.0.1.tgz --dry-run
+codex-sdlc upgrade --root /path/to/project --runtime-spec file:/absolute/path/codex-sdlc-1.0.1.tgz
 cd /path/to/project
 node .sdlc/runtime.cjs restore
 node .sdlc/runtime.cjs doctor

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -16,7 +16,7 @@ Version 1.0.0 includes opt-in Compact delivery and runtime-assisted task operati
 Open the repository that should own `.sdlc` and start a new Codex task:
 
 ```text
-Initialize codex-sdlc for this existing repository. Explain the setup choices and show the dry run before applying changes. If the CLI is unavailable, use codex-sdlc@1.0.0 through npx.
+Initialize codex-sdlc for this existing repository. Explain the setup choices and show the dry run before applying changes. If the CLI is unavailable, use codex-sdlc@1.0.1 through npx.
 ```
 
 Tell Codex which applications already exist and where they live. Supported presets are Go for backend, Next.js for web, Flutter for mobile, PostgreSQL for the primary database, and Redis for cache. Codex will inspect the repository, show the proposed files, apply the same command without `--dry-run`, restore the pinned project runtime, and run diagnostics.
@@ -38,7 +38,7 @@ For a new bounded feature using established patterns, ask `$sdlc --compact <desc
 Preview first:
 
 ```sh
-npx --yes codex-sdlc@1.0.0 init --root /absolute/path/to/web --name example-web \
+npx --yes codex-sdlc@1.0.1 init --root /absolute/path/to/web --name example-web \
   --applications web --web-root . --web-preset nextjs --dry-run
 ```
 
@@ -58,7 +58,7 @@ One checkout is the coordinator and owns `.sdlc`. The reserved repository ID `co
 This example uses the frontend checkout as the coordinator and maps a backend elsewhere:
 
 ```sh
-npx --yes codex-sdlc@1.0.0 init \
+npx --yes codex-sdlc@1.0.1 init \
   --root /absolute/path/to/frontend \
   --name example-platform \
   --workspace-mode multi-repository \
@@ -79,22 +79,22 @@ node .sdlc/runtime.cjs doctor
 node .sdlc/runtime.cjs validate-config
 ```
 
-Only the coordinator receives `.sdlc`. The plugin skills remain in each user's Codex plugin cache. Another contributor binds their local checkout paths with `npx --yes codex-sdlc@1.0.0 configure --root <coordinator> --repo <id>=<absolute-path>` and reruns `doctor`.
+Only the coordinator receives `.sdlc`. The plugin skills remain in each user's Codex plugin cache. Another contributor binds their local checkout paths with `npx --yes codex-sdlc@1.0.1 configure --root <coordinator> --repo <id>=<absolute-path>` and reruns `doctor`.
 
 Choose single-repository or multi-repository mode before starting delivery. Version 1.0.0 does not automatically convert an initialized single-repository project to multi-repository mode. Preserve existing runs before changing topology.
 
 ## Choose agent models (optional)
 
 Ask Codex: `Configure frontend to use Astra, backend to use Luna, and PM and QC to use Sol.` The setup skill maps your choices to model IDs supported by your Codex host and stores them in the coordinator’s `.sdlc/project.yaml`. Unspecified roles inherit from Codex.
 
-You can also ask: `Enable an advisory AI Product Owner review using Sol.` The review runs after QC; final acceptance remains your decision. See [Choose a model for each role](agent-models.md) for exact commands, explicit fallbacks, and resetting settings. Custom role settings require plugin/runtime 0.5.0 or newer. Project presets (`$sdlc --save-my-token` and `$sdlc --normal`) require 0.6.0. Existing runs keep their original model settings.
+You can also ask: `Enable an advisory AI Product Owner review using Sol.` The review runs after QC; final acceptance remains your decision. See [Choose a model for each role](agent-models.md) for exact commands, explicit fallbacks, and resetting settings. Custom role settings require plugin/runtime 0.5.0 or newer. The GPT-6.1 Sol preset (`$sdlc --save-my-token`) requires plugin/runtime 1.0.1 or newer; `$sdlc --normal` requires 0.6.0. After upgrading, reapply the token-saving preset to update existing saved settings. Existing runs keep their original model settings.
 
 ## Upgrade an existing project
 
 After installing the new plugin version, preview the project runtime upgrade:
 
 ```sh
-npx --yes codex-sdlc@1.0.0 upgrade --root /absolute/path/to/coordinator --dry-run
+npx --yes codex-sdlc@1.0.1 upgrade --root /absolute/path/to/coordinator --dry-run
 ```
 
 Run the same command without `--dry-run`, then run `node .sdlc/runtime.cjs restore`, `doctor`, and `validate-config` from the coordinator. The plugin update supplies skills; the project upgrade supplies commands and schemas.