fix(review): fail closed on unavailable Fable and bind the actual reviewer identity

[BaseInfinity]

Feedback type

Bug / SDLC isolation defect.

Problem

A consumer repo can say "use Fable" in shared SDLC prose even when the Codex host has no configured Fable route. A driver can then invoke another Anthropic model and incorrectly record the result as Fable review. Policy text is being mistaken for executable provider configuration.

Observed 2026-08-15:

• repo-local SDLC policy requested a Fable reviewer;
• the Codex host exposed only Sol, Terra, and Daybreak subagent models;
• model=fable, effort=high was rejected;
• Claude Opus output was nevertheless mislabeled as Fable before the attribution was retracted.

Required behavior

• Codex-owned reviewer adapters/config stay under Codex-owned surfaces.
• Shared repo policy may declare "Fable High required," but must not imply availability or completion.
• A named-reviewer gate fails closed when that reviewer cannot be invoked.
• Review evidence records the actual provider, model, effort, invocation path, candidate identity, and terminal verdict from the runner—not from prose written by the implementing agent.
• Never substitute Opus, Sol, or another model while retaining the Fable label.

Acceptance

• A Fable-required test with no Fable adapter returns ReviewerUnavailable.
• A non-Fable response cannot satisfy a Fable gate even if its prompt or output says "Fable."
• Evidence is bound to actual runner metadata and the frozen candidate.
• Codex setup/update does not install or infer Claude-owned advisor configuration.
• Consumer guidance distinguishes policy declarations from executable reviewer configuration.
• Cross-link the corresponding Claude harness issue.

Related: #137 (review runner metadata/liveness).

[BaseInfinity]

Paired Claude harness issue: BaseInfinity/claude-sdlc-harness#643

[BaseInfinity]

Confirmed fallback lane (2026-08-16)

Repository: BaseInfinity/codex-sdlc-wizard.

A live tool-free Claude CLI probe confirmed that claude-opus-4-8 at xhigh remains available while the preferred claude-fable-5 High route is blocked by subscription quota/overage exhaustion. The Opus response reported its actual model identity (claude-opus-4-8) and a separate seven-day utilization value (81%).

Proposed KISS contract

1. Prefer Fable High.
2. Only when the runner classifies Fable as unavailable (quota, auth, or model availability), try Opus 4.8 xhigh once.
3. Record the actual provider/model/effort and the Fable failure reason in the receipt. Never label Opus as Fable.
4. Opus must review the same frozen candidate with the same tool-free, bounded review prompt.
5. If Opus is also unavailable or fails, fail closed. Never degrade to Sol-only certification.
6. Do not fall back when Fable returns substantive findings or a non-certification verdict; fallback is availability recovery, not reviewer shopping.

Added acceptance

• A Fable quota failure can invoke configured claude-opus-4-8 xhigh exactly once.
• The resulting receipt says Opus 4.8 xhigh, preserves the Fable failure classification, and never claims Fable certified.
• Fable findings/non-certification never trigger fallback.
• Opus failure leaves the gate ReviewerUnavailable/not certified.
• Tests cover preferred Fable success, Fable-unavailable → Opus success, Fable substantive failure (no fallback), and both unavailable.

This should be implemented before resuming #109 so its final cross-model gate can complete without waiting for the Fable reset.

[BaseInfinity]

Scope clarification from the maintainer (2026-08-16): reviewer choice is repository policy, not an ad-hoc task guess and not "Fable for every complex project."

Required 1.0 behavior:

• A repo may select opus-4.8-xhigh as its normal cross-model review lane.
• A high-stakes/high-blast-radius repo may select fable-high; only this lane gets the one-shot Opus 4.8 xhigh availability fallback.
• The runner reads the repo-selected lane by default and supports an explicit override for controlled testing.
• Every receipt records the requested lane plus actual provider/model/effort/route. Opus must never be labeled as Fable.
• Updates preserve an explicit repo choice.
• This meta harness remains on fable-high; ordinary consumer repos are not required to use Fable merely because their work is complex.

Keep the implementation KISS: one policy value, two valid lanes, no hidden risk inference in the review runner.

[BaseInfinity]

Bounded final-gate status (2026-08-16): implementation remains staged and uncommitted. Final broad proof passed 11/11 on the exact candidate; the repo-policy override P1 was fixed with RED/GREEN coverage; and a second bounded Sol High plus cross-model gate ran. Fable was unavailable, so the new recorded Opus 4.8 xhigh fallback executed successfully. The gate still returned NOT CERTIFIED because Sol retained one P1 after reconciliation: availability classification currently scans stdout on nonzero Claude exits, which may let candidate-influenced text trigger the fallback. Opus reviewed the same concern and downgraded it to P2, but the reviewers did not agree. Per the anti-review-loop contract, no third correction loop, commit, push, or PR was started. The next cycle should replace free-text stdout classification with trusted structured error evidence or another fail-closed, tested signal. Evidence: 11/11 proof logs at /var/folders/m4/wmggw2n90qq12py32x4790gh0000gn/T/codex-sdlc-proof-f1Yh2A; staged worktree /private/tmp/codex-sdlc-issue143.

[BaseInfinity]

Reopened from live #158 completion-gate evidence. Claude 2.1.221 emitted a stream-json rate_limit_event plus result envelope with is_error=true, terminal_reason=api_error, api_error_status=429, and weekly-limit text, but exited 0. runClaudeReviewer only computes reviewerAvailabilityReason when status is nonzero/error/timeout/cancel, then tried to parse this successful-exit error envelope as a review and returned INVALID_VERDICT. Acceptance regression: recognize explicit rate-limit/error envelopes independent of process exit status, independently confirm Fable unavailable, and use the configured Opus 4.8 xhigh fallback with truthful identity. Keep malformed successful review output fail-closed; do not broaden fallback beyond explicit quota/model unavailability. Cross-link #158.

[BaseInfinity]

Live regression fix candidate is frozen and ready for the completion gate.\n\n- Branch/worktree: fix/issue-143-zero-exit-quota / /private/tmp/codex-sdlc-issue143-v2\n- Exact staged tree: 72727f1d5c3abe19c0850f3dcebc86bcb42f6d20\n- TDD RED reproduced the status-0 rate-limit-envelope defect.\n- Focused GREEN: tests/test-adapter.sh 115/115.\n- Canonical broad proof: 11/11; no rerun is needed while the tree remains unchanged.\n- Exact-diff self-review: clean.\n- Live completion-gate evidence: Sol High returned no findings. The runner correctly classified the Fable status-0 stream-json 429 envelope as quota_exhausted, independently confirmed it, and truthfully attempted the approved Opus 4.8 xhigh fallback.\n- External blocker: both Fable and Opus reported the same weekly quota reset at 23:00 America/Los_Angeles. No review receipt was fabricated and no downgrade/bypass occurred.\n\nCandidate remains unchanged. Per the bounded workflow, the only next action is one post-reset retry of the final review gate; do not rerun focused tests or broad proof unless the tree changes.

[BaseInfinity]

Live regression fix candidate is frozen and ready for the completion gate.\n\n- Branch/worktree: / \n- Exact staged tree: \n- TDD RED reproduced the status-0 rate-limit-envelope defect.\n- Focused GREEN: === Codex SDLC Adapter Tests ===

�[0;32mPASS�[0m: pre-tool hook blocks git commit
�[0;32mPASS�[0m: pre-tool hook blocks git push
�[0;32mPASS�[0m: pre-tool hook blocks git commit/push after shell prefixes
�[0;32mPASS�[0m: pre-tool hook allows safe commands
�[0;32mPASS�[0m: pre-tool hook reads tool_input.command
�[0;32mPASS�[0m: pre-tool hook allows non-git commands that mention git commit/push
�[0;32mPASS�[0m: pre-tool hook does not crash on non-git prototype words
�[0;32mPASS�[0m: pre-tool hook blocks deep wrapper recursion
�[0;32mPASS�[0m: session hook warns when AGENTS.md is missing
�[0;32mPASS�[0m: session hook is silent when AGENTS.md exists
�[0;32mPASS�[0m: universal pre-tool hook blocks git commit
�[0;32mPASS�[0m: universal pre-tool hook allows git commit with fresh SDLC proof
�[0;32mPASS�[0m: universal pre-tool hook blocks git commit when SDLC proof is stale
�[0;32mPASS�[0m: universal pre-tool hook blocks cross-repo SDLC proof reuse
�[0;32mPASS�[0m: universal pre-tool hook blocks cd-based SDLC proof reuse
�[0;32mPASS�[0m: universal pre-tool hook blocks GIT_DIR/GIT_WORK_TREE SDLC proof reuse
�[0;32mPASS�[0m: universal pre-tool hook blocks exported GIT_DIR/GIT_WORK_TREE SDLC proof reuse
�[0;32mPASS�[0m: universal pre-tool hook blocks auto-exported GIT_DIR/GIT_WORK_TREE SDLC proof reuse
�[0;32mPASS�[0m: universal pre-tool hook checks proof against Bash workdir
�[0;32mPASS�[0m: universal pre-tool hook allows Bash workdir with fresh SDLC proof
�[0;32mPASS�[0m: universal pre-tool hook allows an explicitly targeted linked worktree with fresh proof
�[0;32mPASS�[0m: universal pre-tool hook blocks git commit/push after shell prefixes
�[0;32mPASS�[0m: universal pre-tool hook allows non-git commands that mention git commit/push
�[0;32mPASS�[0m: universal pre-tool hook does not crash on non-git prototype words
�[0;32mPASS�[0m: universal pre-tool hook blocks deep wrapper recursion
�[0;32mPASS�[0m: universal session hook warns when AGENTS.md is missing
�[0;32mPASS�[0m: universal compact guard emits SDLC lifecycle context before compaction
�[0;32mPASS�[0m: universal compact guard emits post-compact recovery context
�[0;32mPASS�[0m: universal Node hooks work in type=module repos
�[0;32mPASS�[0m: hook matcher is ^Bash$
�[0;32mPASS�[0m: hook config uses the current compact lifecycle hooks without over-wiring noisy events
�[0;32mPASS�[0m: live hooks.json uses universal Node hook entrypoints
�[0;32mPASS�[0m: config.toml enables codex hooks with the current feature flag
�[0;32mPASS�[0m: install.sh preserves existing AGENTS.md
�[0;32mPASS�[0m: install.sh creates the explicit SDLC docs and helper
�[0;32mPASS�[0m: install.sh creates global helper skills and one repo-scoped sdlc entrypoint
�[0;32mPASS�[0m: install.sh preserves user-owned global sdlc and prunes legacy codex-sdlc
�[0;32mPASS�[0m: install.sh migrates deprecated codex_hooks and writes hooks=true
�[0;32mPASS�[0m: install.sh backs up existing hooks.json
�[0;32mPASS�[0m: AGENTS.md is under the Codex limit
�[0;32mPASS�[0m: setup-wizard carries the confidence-driven setup contract
�[0;32mPASS�[0m: update-wizard carries the idempotent selective-update contract
�[0;32mPASS�[0m: update-wizard defaults profile-less repos to Sol high while preserving explicit mixed opt-ins
�[0;32mPASS�[0m: setup/update skills document the hooks feature flag rename and /hooks review
�[0;32mPASS�[0m: update-wizard frontloads package upgrade vs repo repair guidance
�[0;32mPASS�[0m: helper skill metadata says Codex SDLC and avoids XDLC/palette leakage
�[0;32mPASS�[0m: setup/update skills stop before unrelated product remediation and recommend restart/resume
�[0;32mPASS�[0m: feedback carries the privacy-first scan and dedupe contract
�[0;32mPASS�[0m: setup docs include Codex Desktop handoff guidance
�[0;32mPASS�[0m: setup docs include Microsoft 365 auth-lane guidance
�[0;32mPASS�[0m: setup docs include task-routing gate for Desktop/computer-use boundaries
�[0;32mPASS�[0m: sdlc carries doc-sync, learning capture, and merge-guard rules
�[0;32mPASS�[0m: consumer guidance defaults to high while this wizard repo preserves its xhigh exception
�[0;32mPASS�[0m: repo documents Max versus Ultra without making either a default
�[0;32mPASS�[0m: package.json ships the npm release surface for the current Codex wizard
�[0;32mPASS�[0m: package exposes one canonical SDLC skill name, display name, and entrypoint: sdlc
�[0;32mPASS�[0m: npm CLI help advertises the supported model-profile flag
�[0;32mPASS�[0m: npm CLI help documents Sol high as the normal driver and mixed as experimental opt-in
�[0;32mPASS�[0m: npm CLI help explains that update uses the invoked package version
�[0;32mPASS�[0m: npm CLI help advertises the check command
�[0;32mPASS�[0m: npm CLI help advertises the update command
�[0;32mPASS�[0m: npm CLI runs check.sh and reports uninitialized repos
�[0;32mPASS�[0m: npm CLI runs update.sh and reports uninitialized repos
�[0;32mPASS�[0m: README documents the npm entrypoint
�[0;32mPASS�[0m: E2E tests require explicit token-consuming opt-in
�[0;32mPASS�[0m: E2E explicitly bypasses hook trust for every ephemeral automation session
�[0;32mPASS�[0m: docs document the proof-stamp git gate

=== Results: 67 passed, 0 failed === 115/115.\n- Canonical broad proof: 11/11; no rerun is needed while the tree remains unchanged.\n- Exact-diff self-review: clean.\n- Live completion-gate evidence: Sol High returned no findings. The runner correctly classified Fable's status-0 stream-json 429 envelope as , independently confirmed it, and truthfully attempted the approved Opus 4.8 xhigh fallback.\n- External blocker: both Fable and Opus reported the same weekly quota reset at 23:00 America/Los_Angeles. No review receipt was fabricated and no downgrade/bypass occurred.\n\nCandidate remains unchanged. Per the bounded workflow, the only next action is one post-reset retry of the final review gate; do not rerun focused tests or broad proof unless the tree changes.