chore: release 7.1.0 — per-dispatch model tiers, project-agent routin…

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "forgebee",
       "source": "./forgebee",
       "description": "Full-stack agent framework for Claude Code, Codex, Cursor, Gemini — 39 slash commands, 46 specialist agents, 35 skills, 28 hooks. Karpathy principles (trace test, YAGNI, orphan rule, anti-stop) on every code agent. Adversarial debate triads, two-stage review (spec compliance + code quality), forensic /investigate, /elicit (18 reasoning methods), checkpoint-preview, budget circuit breaker, adversarial input hardening, continuous learning with auto-nudge, Growth OS marketing pipeline, automated PM, /audit-self regression detection.",
-      "version": "7.0.0"
+      "version": "7.1.0"
     }
   ]
 }

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "forgebee",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "Full-stack agent framework — 39 slash commands, 46 specialist agents, 35 skills, 28 hooks. Karpathy principles on every code agent, adversarial debate triads, two-stage review, /investigate, /elicit (18 methods), checkpoint-preview, budget circuit breaker, continuous learning, Growth OS, /audit-self.",
   "author": {
     "name": "Forbee Dev",

.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "forgebee",
   "displayName": "ForgeBee",
   "description": "Full-stack agent framework — 39 commands, 46 specialist agents, 35 skills, 28 hooks. Karpathy principles, adversarial debate, two-stage review, /investigate, /elicit, checkpoint-preview, budget circuit breaker, continuous learning, Growth OS, /audit-self.",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "author": {
     "name": "Forbee Dev",
     "url": "https://github.com/forbee-dev"

CHANGELOG.md

@@ -6,6 +6,24 @@ The format roughly follows [Keep a Changelog](https://keepachangelog.com/) and t
 
 ---
 
+## [7.1.0] — 2026-10-20
+
+### Added
+
+- **Model tier per dispatch.** The orchestrator rules, `/workflow`, and `/team` give each workstream a model tier and pass `model` and `effort` on the Agent call: `mechanical` → `haiku`/`low`, `implement` → `sonnet`/`medium`, `design` → `opus`/`high`. The SessionStart routing digest carries the same rule, so commands outside `/workflow` and `/team` use it too. The handoff carries `model` and `effort`, and the 8 router agents pass them on when they delegate. A `BLOCKED` report gets one re-dispatch at the next tier up, with the blocker text and `git diff --stat`. `--fable` now applies to every dispatch that would run on Opus.
+- **Project agents and skills are routable.** The orchestrator rules, the routing digest, `/workflow`, and `/team` said to route only to `forgebee:` agents and ForgeBee skills. Now a project agent or skill (`.claude/agents/`, `.claude/skills/`) beats a generic ForgeBee one for the same work. A project skill that edits files runs inside an agent, because main-thread edits are blocked.
+- **Dispatch log.** `audit-trail.js` runs on PreToolUse `Task|Agent` and logs each dispatch's agent, model, effort, and caller (`main` or the router) to `.claude/audit/`. Query with `/audit` (`filter_type: dispatch`).
+
+### Changed
+
+- The orchestrator rule says "pass only what the task needs" instead of "pass full context". Subagents never see the main conversation, so "full" only invited copying it into the prompt.
+
+### Fixed
+
+- `orchestrator-mode.js` Bash guard: heredoc bodies are data, not commands. Body lines that start with `rm`/`cp`/`mv` or contain `>` no longer read as product-file writes; the opening line (`<<EOF > file`) is still checked.
+
+---
+
 ## [7.0.0] — 2026-10-19
 
 ### Breaking

README.md

@@ -3,7 +3,7 @@
   <img src="https://img.shields.io/badge/Codex-Compatible-10B981?style=for-the-badge&logoColor=white" alt="Codex" />
   <img src="https://img.shields.io/badge/Cursor-Compatible-1F2937?style=for-the-badge&logoColor=white" alt="Cursor" />
   <img src="https://img.shields.io/badge/Gemini-Compatible-4285F4?style=for-the-badge&logoColor=white" alt="Gemini" />
-  <img src="https://img.shields.io/badge/version-7.0.0-blue?style=for-the-badge" alt="Version" />
+  <img src="https://img.shields.io/badge/version-7.1.0-blue?style=for-the-badge" alt="Version" />
   <img src="https://img.shields.io/badge/license-MIT-green?style=for-the-badge" alt="License" />
 </p>
 

docs/learnings/2026-10-20-per-dispatch-model-and-effort-tiers.md

@@ -0,0 +1,21 @@
+---
+title: Per-dispatch model and effort tiers for orchestrator subagents
+author: Tiago Santos
+date: 2026-10-20
+touches:
+  - forgebee/hooks/scripts/orchestrator-mode.js
+  - forgebee/commands/workflow.md
+  - forgebee/commands/team.md
+---
+
+## Decided
+- Agent tool `model` param overrides agent frontmatter `model:` per call. 24 agents (all FE/BE impl agents) are `model: opus` today.
+- Proposed (not built): Work Breakdown tags each task with a tier (mechanical=haiku/low, implement=sonnet/medium, design=opus/high); orchestrator passes model+effort on dispatch; escalate one tier once on BLOCKED/DONE_WITH_CONCERNS.
+
+## Tried and ruled out
+- Switching impl-agent frontmatter to sonnet: cheaper default but also downgrades direct /debug and /review runs.
+
+## Watch out
+- Agent tool `effort` may only be set when an instruction (CLAUDE.md, skill, hook RULES) explicitly says so. The tier rule must be written into orchestrator RULES and the /workflow and /team dispatch steps.
+- Override does not reach nested delegation: frontend-specialist -> wordpress-frontend via Task uses the inner agent's own frontmatter. Dispatch the leaf specialist directly.
+- Override only applies with `forgebee:<name>` dispatch, not bare names.

forgebee/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "forgebee",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "Full-stack agent framework — 39 slash commands, 46 specialist agents, 35 skills (inline + context:fork), 28 Node hooks. Karpathy principles (trace test, YAGNI, orphan rule, anti-stop) on every code-producing agent. Adversarial debate triads with judges, two-stage review (spec compliance + code quality), forensic /investigate (Confirmed/Deduced/Hypothesized), /elicit (18 reasoning methods), checkpoint-preview (diff-by-concern), budget circuit breaker on Task() dispatches, adversarial input hardening on all agents, terse-report mode (~65% token reduction for sub-agent reports), continuous learning with auto-nudge, Growth OS 9-phase marketing pipeline, automated PM, /audit-self regression detection. Works with Claude Code, Codex, Cursor, Gemini, OpenClaw.",
   "author": {
     "name": "Forbee Dev"

forgebee/README.md

@@ -38,7 +38,7 @@ forgebee/
 └── eval/                        # Eval scenarios
 ```
 
-## Key Features (v7.0.0)
+## Key Features (v7.1.0)
 
 ### Behavioral discipline (Karpathy principles)
 - **P1 Trace test** — every changed line traces to the user's request; no drive-by edits

forgebee/agents/backend-engineer.md

@@ -44,7 +44,7 @@ Before you implement, check project triage and route to the most precise special
 | No triage available | Infer from codebase (`wp-config.php`, `package.json`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `Gemfile`, etc.) |
 | **AMBIGUITY-FALLTHROUGH** — stack unclear, conflicting signals, or no recognizable framework | **Stop — invoke the `surface-ambiguity` skill**: list the candidate stacks, state your chosen interpretation and why, before you write code. Do not pick a framework silently |
 
-3. When you delegate, pass the full task description, relevant triage fields, and user context. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+3. When you delegate, pass the full task description, relevant triage fields, and user context. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 4. When the subagent returns, synthesize the result and report back.
 
 Handle generic tasks (API design, auth patterns, error-handling strategy) directly.

forgebee/agents/content-creator.md

@@ -39,7 +39,7 @@ For on-site content, read `.claude/session-cache/project-triage.json` and route:
 | No CMS / generic content | Handle directly — markdown, social-native, conversion copy, case studies, READMEs |
 | No triage available | Infer from codebase (`wp-config.php`, `next.config.js`, `.mdx` files) |
 
-When you delegate, pass the full brief, brand voice guidelines, and target audience. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. Review the result for quality, brand alignment, and conversion.
+When you delegate, pass the full brief, brand voice guidelines, and target audience. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch. Review the result for quality, brand alignment, and conversion.
 
 **Email work → `email-strategist`** (single source of truth for welcome, nurture, cart recovery, win-back, lifecycle). Delegate; do not write sequences inline, so agents do not drift.
 

forgebee/agents/database-specialist.md

@@ -43,7 +43,7 @@ Before you implement, check project triage and route to the most precise special
 | No triage available | Infer from codebase (`supabase/config.toml`, `prisma/schema.prisma`, `knexfile.js`, `alembic.ini`, `wp-config.php`) |
 | **AMBIGUITY-FALLTHROUGH** — ORM/platform unclear, conflicting signals, or no recognizable DB config | **Stop — invoke the `surface-ambiguity` skill**: list the candidate ORMs/databases, state your chosen interpretation and why, before you write any schema or migration. Do not pick a platform silently |
 
-3. When you delegate (Task tool), pass the full task description, relevant triage fields, and user context. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+3. When you delegate (Task tool), pass the full task description, relevant triage fields, and user context. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 4. When the subagent returns, synthesize the result and report back.
 
 Handle generic tasks (schema principles, query optimization, indexing strategy) directly.

forgebee/agents/frontend-specialist.md

@@ -45,7 +45,7 @@ Before you implement, check project triage and route to the most precise special
 | No triage available | Infer from codebase (`next.config.js`, `astro.config.mjs`, `remix.config.js`, `style.css` with Theme Name, etc.) |
 | **AMBIGUITY-FALLTHROUGH** — framework unclear, conflicting signals, or no recognizable build setup | **Stop — invoke the `surface-ambiguity` skill**: list the candidate frameworks, state your chosen interpretation and why, before you write any components. Do not pick a framework silently |
 
-3. When you delegate, pass the full task description, relevant triage fields, and styling info. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+3. When you delegate, pass the full task description, relevant triage fields, and styling info. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 4. When the subagent returns, synthesize the result and report back.
 
 Handle generic tasks (component design, accessibility, styling strategy) directly.

forgebee/agents/growth-engineer.md

@@ -39,7 +39,7 @@ Before deep CRO work, read `.claude/session-cache/project-triage.json` and route
 | `triage.wordpress.type != "none"` (no WooCommerce) | Handle directly — landing-page CRO with WP considerations |
 | No triage available | Infer from codebase (`woocommerce.php`, `package.json`) |
 
-When you delegate, dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+When you delegate, dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 
 You may delegate and run growth-loop / generic CRO analysis in parallel. Merge the subagent's tech-specific fixes into one report. Handle generic work (loop design, funnel analysis, A/B design, psychology audit) directly.
 

forgebee/agents/security-auditor.md

@@ -40,7 +40,7 @@ Before the audit, check project triage and route stack-specific checks:
 | Node.js / Next.js project | Handle directly — dependency audit, auth middleware, CORS, CSP |
 | No triage available | Infer from codebase and run all applicable checks |
 
-When you delegate, dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+When you delegate, dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 
 3. You can delegate and run generic checks in parallel. Always run cross-stack checks (secrets, dependencies) yourself.
 4. When the subagent returns, merge findings into one severity-sorted report.

forgebee/agents/seo-specialist.md

@@ -38,7 +38,7 @@ You are a senior SEO strategist and technical SEO engineer. You route stack-spec
 | Other Node.js / generic web | Handle directly |
 | No triage | Infer from the codebase (`wp-config.php`, `next.config.js`) |
 
-When you delegate, dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+When you delegate, dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 
 3. Handle generic work (keyword research, content gaps, link strategy) yourself, in parallel with the subagent.
 4. Merge subagent findings into one SEO report.

forgebee/agents/test-engineer.md

@@ -41,7 +41,7 @@ Before you write tests, check project triage and route to the most precise speci
 | `"playwright" in triage.node.tools` | Handle directly — E2E test patterns |
 | No triage available | Infer from codebase (`phpunit.xml`, `vitest.config.ts`, `jest.config.*`) |
 
-3. When you delegate, pass the full task description, relevant triage fields, and the code under test. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent.
+3. When you delegate, pass the full task description, relevant triage fields, and the code under test. Dispatch as `forgebee:<name>`. Use the bare name only if the agent list has no `forgebee:` entry. If neither exists, handle the task directly and say so in your report. Never substitute a different agent. If the handoff carries `model` and `effort`, pass the same values on that dispatch.
 4. When the subagent returns, verify the tests pass and report back.
 
 Handle generic tasks (test strategy, coverage analysis, fixture design) directly.