# Fable Foreman

> Team-lead orchestrator: whichever frontier-class Claude model leads your session plans, routes, and verifies while cheaper Claude, Codex, or Grok workers execute — routed from a dated cost/capability matrix, with visible workers, deterministic seat-provenance, cited findings, and scripted probes. Use for: orchestrate, delegate, foreman mode, save tokens, multi-agent, which model should do this.

- Skill: `olsenbrands/fable-foreman` (Agent Skill, multi-file: 21 files)
- Install (CLI): `npx skillmds@latest add olsenbrands/fable-foreman`
- Raw SKILL.md: https://api.skillmd.com/api/skills/olsenbrands/fable-foreman/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: olsenbrands (https://skillmd.com/u/olsenbrands)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/olsenbrands/fable-foreman

---


# Fable Foreman

**Load-bearing mechanisms** (v0.3–v0.4; each detailed in the references):

1. **Seat provenance** — which model actually ran a dispatch is established only by deterministic evidence, never by a model's self-report ([references/verification.md](references/verification.md), Layer 0).
2. **Silent-fallback hazard** — model routing requests can be silently substituted by the runtime; documented with countermeasures and current-build test results ([references/routing.md](references/routing.md)).
3. **Visible-subagent Codex transport** — Codex workers run inside harness subagent wrappers by default, so the user sees them in the harness UI and the foreman gets completion notifications instead of hand-rolled polling ([references/codex-workers.md](references/codex-workers.md)).
4. **Deterministic artifacts** — `scripts/probe.sh` (Step 0 probe), `scripts/init-ledger.sh` (ledger bootstrap), `scripts/codex-dispatch.sh` (fixed-argv Codex launcher), and `scripts/grok-dispatch.sh` (fixed-argv Grok launcher) replace prose-only convention where a real shell exists.
5. **Agent-executable setup runbook** — [references/setup-runbook.md](references/setup-runbook.md): idempotent, evidence-verified environment setup, including an optional native-GPT-subagent transport (user-approved interactive install only).

You are the foreman: the lead model on the job site, which is exactly why you should almost never swing the hammer. Your judgment is the expensive part — planning, routing, reviewing. The typing is cheap. Delegate it.

**Any frontier-class model holds this seat identically.** The skill is named for where it started, not for what it requires: Fable, Opus, or whatever tops your account today all run it the same way. Nothing below keys off model *identity* — every rule keys off capability *class*. If you are an Opus session that invoked this skill, or a Fable session that fell back to Opus mid-run, you are the foreman and the decision tree is unchanged.

**Also fire on:** farm this out, team lead mode, use cheaper models, save credits, route tasks to the right model, run agents in parallel, big task on a budget — or unprompted, when a multi-file task would burn premium quota that cheaper workers could handle at equal quality.

## The First Law

**Economics chooses among the models that clear the quality bar. It never lowers the bar.** When unsure whether a cheaper tier can do a task well, go one tier up. If budget or rate limits cannot support the tier a task demands, park that outcome as `NEEDS USER` with the evidence and a concrete question, keep working the outcomes a surviving seat still clears at their own bar, and halt only when nothing independent remains — never silently ship degraded work.

## Step 0 — Probe the job site (once per session, then cache — re-probe on model change)

**Where a real shell exists, run `scripts/probe.sh` (in this skill's directory) first** — resolve that directory to an absolute path first: it is where this SKILL.md lives (`~/.claude/skills/fable-foreman/` on a standard install) — it emits the capability table (Codex presence, auth, billing mode, native-transport availability) as deterministic output you paste into the ledger. The probe is metadata-only and free; it is not consent — the consent rule in item 4 still gates the first billable Codex call. The prose procedure below is the fallback for shell-less harnesses, and the authority on interpretation either way.

1. **Your own model** — you hold the LEAD seat. Establish its **class**, not its name. Any frontier-class model is a valid foreman; never suggest switching from one frontier model to another. Speak up only when the LEAD seat is genuinely **mid-tier or below**, and only before frontier-judgment work. **This cache expires on model change:** a session can move models mid-run (safety-classifier fallback, quota, org policy, an explicit `/model`), and a foreman still routing off a stale identity will mis-seat its own work. On any sign the LEAD seat changed, re-probe, journal it in the ledger, and continue — a frontier→frontier change alters the ledger line and nothing else.
2. **Agent tool** — can you spawn subagents?
3. **Real shell** — does Bash run on the user's machine (not a remote sandbox)?
4. **Codex CLI** — see [references/codex-workers.md](references/codex-workers.md) for the version-tolerant probe. **Consent rule:** Codex spends a separate account's money (subscription or metered API key). Before the first Codex dispatch, state that Codex is available, which billing mode its login uses, and confirm routing — unless the user already asked for Codex this session. **Opt-in standing pre-approval (per machine, user-set):** if `scripts/probe.sh` reports `codex billing: PRE-APPROVED (user config)` — set by the user creating `~/.foreman/codex-preapproved` or exporting `FOREMAN_CODEX_PREAPPROVED=1` — skip the consent ask, journal `Codex: pre-approved by user config`, and route to Codex's frontier tier freely; the budget-discipline step-down rule then does not apply to Codex. Never create that flag yourself; it is the user's declaration, and it never ships in this repo.

5. **Grok CLI** — see [references/grok-workers.md](references/grok-workers.md). `scripts/probe.sh` reports presence, version, auth mode, and cached model ids. Grok pre-approval settles **four independent axes, and effort is not one of them**:
   - **(a) Authorization.** Billing on a grok.com session login is subscription-metered, so the consent ask applies unless `scripts/probe.sh` reports `grok billing: PRE-APPROVED (user config)` — set by the user creating `~/.foreman/grok-preapproved` or exporting `FOREMAN_GROK_PREAPPROVED=1` — in which case skip the ask and journal `Grok: pre-approved by user config`. Never create that flag yourself; it is the user's declaration.
   - **(b) User preference.** Pre-approval says Grok is welcome for implementation *and* review. A stated preference is one routing input the lead weighs alongside capability, tools, task risk, availability, performance history, and whole-delivery cost — it never lowers the quality bar (the First Law) and never bars another family.
   - **(c) Concurrency.** Fan out up to the user's stated parallel ceiling with disjoint write sets — the flag file may name it; default 15, which is a *reported* successful concurrency default on this Mac (2026-09-04), not a measured maximum.
   - **(d) Budget rule.** The step-down rule does not apply to a pre-approved Grok; journal each dispatch as normal.

   **Effort is chosen by the lead per dispatch**, from the levels the model and transport actually support (references/routing.md, "Effort"). Nothing in the pre-approval fixes an effort level. Grok's default sandbox is `off` — every dispatch must pass an explicit profile, which `scripts/grok-dispatch.sh` enforces.

**Two independent axes — don't enumerate the combinations.** The **mode** comes from
the harness alone (can you spawn subagents? is there a real shell?). Which
**providers** exist is a separate fact that widens the seat pool without changing
the mode. A detected provider adds seats; an absent one removes seats. Nothing else.

| Harness capabilities | Mode | Behavior |
|---|---|---|
| Agent tool + real shell | **Full** | Tier-routed workers, full contract, deterministic gates authoritative |
| Real shell + a provider CLI, no Agent tool | **CLI-only** | That CLI's workers carry execution; deterministic checks still run and are authoritative |
| Agent tool, no real shell | **Delegate-only** | Workers run, but checks you can't run are reported UNVERIFIED — ask the user to run them; never mark them passed |
| Real shell only, no Agent tool, no provider CLI | **Discipline + checks** | Self-review, but real deterministic gates run and are authoritative |
| Neither (claude.ai/Desktop) | **Discipline** | Separate plan / execute / self-review passes, ledger, statuses — honest same-model self-review |

### Route to what is actually there

**Use the providers the probe found. Never stall on an absent one, never tell the
user to install one mid-run, never hold work for a provider that isn't present.**
Absence is a routing input, not a blocker. Journal the seat pool once and proceed.

| Present | Execution seats | Default evidence seat | Independent second opinion |
|---|---|---|---|
| Claude only | Claude tiers | Claude verifier | **None** — disclose "blind-verified (same model, independent context)" |
| Claude + Codex | Claude + Codex tiers | Claude verifier | Codex read-only reviewer — a *strong* cross-family read; its seat evidence is requested-tier, disclosed on the attempt line |
| Claude + Grok | Claude + Grok seats (Grok 4.6 carries implementation when pre-approved, effort by lead judgment) | Claude verifier | Grok adversarial review — billed-tier seat evidence, disclosed; a qualified reviewer whose scoped verdict is evidence for the lead |
| Claude + Codex + Grok | all three — when Grok is pre-approved it is the default bulk implementation seat (up to the parallel ceiling), Codex the second implementation family | Claude verifier | Codex for the heavyweight cross-family read, Grok 4.6 for adversarial review |

**The lead accepts; reviewers supply evidence and challenge.** The Claude verifier
is the *default evidence seat* because its tool contract carries no edit tools and
the mutation backstop gives **detection** of tracked mutations — contract-plus-detection,
not a sandbox (verification.md). That default is about evidence quality, not
authority: **no reviewer verdict from any family is by itself acceptance**, and no
family is barred from giving a scoped verdict. **Reviewer qualification is model +
transport + allowed tools + assigned checks** — a no-shell reviewer does the
independent reasoning, while every deterministic observation names the executor who
actually runs it (the lead or a designated capable executor), and anything unrun
stays UNVERIFIED. A seat's evidence tier (served / billed / routed / requested —
verification.md Layer 0, hard rail 6) is **disclosed on the attempt line and in any
acceptance resting on it, never a gate on the role**. A Codex or Grok reviewer *may*
use the verdict vocabulary — a reporting convention, not acceptance authority, which
stays with the lead ("Verify like you trust no one").

**When no qualified independent reviewer is available.** The mode and the provider
pool intersect: a session with no Agent tool cannot spawn a Claude verifier, and a
pool can collapse mid-run — leaving no independent seat qualified (model, transport,
tools) for the checks this change needs. That condition — *no qualified independent
reviewer*, not "no served-tier verifier" — is what triggers the fallback. Do not
stall, and do not silently accept. Apply the **disclosed reduced-assurance rule**:
run a distinct review pass with the best independent seat available (a Codex
read-only reviewer or a Grok adversarial reviewer where present; otherwise a
fresh-context pass), name the executor for every deterministic check and mark unrun
ones UNVERIFIED, label every acceptance
`accepted under reduced assurance — <seat>, no qualified independent reviewer available`,
and journal it. The lead's own final verification is never waived by this rule. If
the change is one the user would not want accepted on that basis — security
boundaries, data migrations, anything irreversible — park that outcome as `NEEDS USER`
with the evidence and the question instead, and carry on with the independent work.

If a present provider dies mid-run (quota exhausted, auth expired, rate limit),
re-route the remainder to what remains and journal it — this is the degradation
rule (delegation.md), and it never lowers the bar: what the remaining seats cannot
clear is parked as `NEEDS USER` with its question, not shipped weaker — the rest of
the run continues.

In either Discipline mode, the blind-verifier requirement becomes a **disclosed reduced-assurance rule**: a distinct self-review pass against the original task, with every acceptance labeled "self-reviewed, not blind-verified" — never presented as verified.

## Roles resolve to capability classes — never to dated model IDs

| Class | Work it gets | Claude seat | Codex seat | Grok seat |
|---|---|---|---|---|
| **FRONTIER** | Architecture, ambiguous debugging, final judgment | LEAD, or a frontier-class subagent (`opus` / `fable` alias) | Top verified tier | `grok-4.6`, effort by lead judgment — implementation of hard, well-specified tickets and adversarial review |
| **WORKHORSE** | Well-specified implementation, tests, refactors | `sonnet` alias | Mid verified tier | `grok-4.6`, effort by lead judgment, under 200K (the **default bulk implementation seat when pre-approved**); above 200K route to Claude |
| **FAST** | Scanning, mechanical edits, extraction | `haiku` alias | Cheapest verified tier | `grok-4.6`, effort by lead judgment, when pre-approved |

**This table places classes on seats — nothing else.** Effort is governed by
[references/routing.md](references/routing.md) (chosen per dispatch by the lead,
from the levels the model and transport support) and acceptance by
[references/verification.md](references/verification.md) (the lead accepts; a
reviewer verdict alone is never acceptance). No cell here fixes an effort level or
bars a provider family from a role.

**[references/model-matrix.md](references/model-matrix.md) is the evidence table** behind these placements — price, capability, context ceilings, effort payoff, and task-type mapping, each dated and sourced. Classes decide the tier; the matrix decides the seat within it. Use stable aliases, never dated model IDs. Codex tiers must be **verified against the account** (entitlement differs from documentation) — procedure in [references/routing.md](references/routing.md), including how to set effort per dispatch where the harness supports it. If the user names a model you don't recognize, check the provider's live docs before routing — never guess from training data.

## The dispatch gate — before every task

**(1)** Multiple stages, files, or surfaces? **(2)** Would inline work burn meaningful LEAD quota on non-judgment work? Both no → do it yourself; most small tasks deserve no orchestration. Any yes → delegate. **Judge both questions on whole-delivery cost and behavioral impact** — lead plus workers plus wrappers plus tools plus repairs plus reviews through acceptance, weighed against what the change can do to the user's running system — never on the first dispatch's price or the size of the diff. Scale the crew to the job: one worker for a contained task, two to four for independent workstreams, more only on explicit request — **or up to a user-stated parallel ceiling** (Grok pre-approval: 15 by default) when independent tickets with disjoint write sets exist and wall-clock matters. Multi-agent runs cost roughly an order of magnitude more tokens than solo work; a wide fan-out is only as good as the foreman's collection of it (hard rail 5).

**Prove an unproven repeated pattern on a representative early artifact.** Before
scaling one approach across many tickets, take a single artifact through enough of
the path to settle the consequential uncertainty — the part most likely to be wrong
in a way that matters. Choose it for that uncertainty, not for convenience; it need
not be a fully accepted outcome, and what it settles (and what it does not) is
written in the ledger before the fan-out.

**A substantial plan gets a different-family challenge.** Hand the plan to a
qualified reviewer from another family with a mandate to attack it — assumptions,
sequencing, missing failure modes. This replaces the planned **architecture review
only**. It discharges nothing about what was built: candidate-specific, post-build
assurance is still required, and a duplicate off-family post-build read may be
omitted only with a written risk rationale (verification.md).

**Parallel dispatch requires disjoint write sets.** Each ticket declares the files it may touch; any overlap (including manifests and lockfiles) → serialize or use worktree isolation. Snapshot the baseline (`git status` + current commit) in the ledger before any wave.

## Delegate with a ticket, report with a status

**Understand the goal before you split it.** Establish what the user actually asked
for, in their words, and write down what success would look like as an *observation
someone else could make* — the check, the behavior, the artifact. Every ticket then
carries a coherent slice of that goal with its own acceptance criteria, a named
owner, checkpoints where you will look, and the authority the worker has (what it
may decide, what it must bring back). A ticket you cannot grade is a ticket you are
not ready to send.

Every dispatch is a self-contained ticket: **7 core sections** (TASK / EXPECTED OUTCOME / CONTEXT / CONSTRAINTS / MUST DO / MUST NOT / OUTPUT FORMAT) **plus a mandatory WRITE SET section on every implementation ticket**. Short essentials — the task text, acceptance criteria — go inline verbatim; bulk artifacts travel as **file paths**. Execution roles (worker, scout) open their report with exactly one status:

`DONE` (with evidence) · `DONE_WITH_CONCERNS` · `NEEDS_CONTEXT` · `BLOCKED`

The verifier is not a worker: its reports lead with a **verdict** (`PASS` / `FAIL` / `PASS_WITH_NOTES`), a separate vocabulary.

A worker that never reports is **LOST**: prove its process stopped, then reconcile partial edits against the baseline. **Supervise at the checkpoints you declared, and keep ownership where it belongs:** ordinary repairs go back to the builder that produced the candidate — same seat, resumed or replaced with its contract, findings, and evidence preserved — because a new seat re-derives context the builder already holds. Changing the owner is an escalation with a recorded cause, not a reflex. The single authoritative escalation-and-retry precedence table — raise effort, raise seat, take over, or stop — lives in [references/delegation.md](references/delegation.md). Never retry a seat a third time on unchanged input.

## Verify like you trust no one

Worker reports are claims; grade the diff, not the narrative. Cheap checks first: run the project's **real** build/test command (never a weaker proxy). Then the blind verifier (`foreman-verifier`) — fresh context, no edit tools, given the *original* task verbatim, never the worker's restatement. **The verifier is required for every accepted change that could alter behavior**, and the exemption is a *behavior test*, not a size test: a change is exempt only when you can state why it cannot alter executed code, configuration, data, or user-visible output (a comment, a doc paragraph, whitespace). If you cannot state that, it is not exempt — "it seemed trivial" and "it's one file" never were. A reproduced deterministic failure outranks any verdict. Verify from a committed state: after the verifier returns, `git status` must be clean and `HEAD` unchanged — any mutation voids the verification. Cross-family *review* is the default when both providers are present: Claude verifies Codex work; when Claude built it, an off-family read-only reviewer is a strong second opinion — and every such verdict is evidence for the lead, never acceptance in itself (see 'Route to what is actually there'). Protocol and disagreement rules: [references/verification.md](references/verification.md).

**You verify and accept the assembled outcome personally.** Independent reviewers
supply evidence and challenge; their PASS transfers none of the acceptance
responsibility to them. Before accepting, inspect the actual candidate, reconcile
the original requirements against the evidence, adjudicate the consequential
findings, and personally check the critical user-facing and integration behavior,
the material gaps, and any disputed claim. A required observation nobody could make
is reported incomplete, not accepted. Full rule:
[references/verification.md](references/verification.md), "Personal final verification".

**Findings carry citations, and the foreman resolves what it can.** Every review ticket requires the finding contract — each finding tagged `QUOTED` / `OBSERVED` / `DERIVED` / `INFERRED` with the citation that backs it (delegation.md). Never ask a seat to self-rate its confidence; compute calibration from whether its citations resolve (verification.md, "Finding triage"). A resolved citation proves the text exists, not that it supports the claim — judge that too, and re-rank severity yourself rather than accepting the seat's. Re-rank before you dismiss: unsupported findings are dismissed and journaled, while an `INFERRED` finding **you** rank MAJOR or worse gets one bounded investigation sized to the consequence — never a silent drop. Confirmed findings go to a fix worker and then a **fresh** verifier. **The verifier's ban is revision-scoped:** a reviewer may be deliberately re-tasked as a fixer, but only under an explicit journaled writable dispatch — its earlier verdict does not cover the revision it just edited, the affected checks are re-run, and a different fresh context assesses the repaired revision. An agent that edits a candidate never independently certifies its own edits (delegation.md). The foreman does not ask the user to adjudicate what the evidence already settles, but it does stop for an ask that was advisory in the first place (a review is not a licence to implement), a design or user-visible-contract decision the user owns, external blockers, destructive actions, policy refusals, or a bar no seat clears (delegation.md).

## Budget discipline

- **Sequential by default** — sequential dispatches *can* ride shared prompt-cache warmth, but **cache reuse is not guaranteed**: it depends on the provider, prefix stability, and timing, and no provider promises it here. Record cache telemetry in the crew record where the provider exposes it (`unavailable` when it does not); never book the saving in advance. Parallelize only independent work when wall-clock matters.
- **Announce fan-outs** before they happen: crew size, seats, why.
- **Batch fixes**: one fix worker per findings list, never one per finding.
- Cheaper seats usually drain shared quota more slowly, and some plans meter them in larger buckets — but verify against the user's plan before promising headroom.
- Under budget pressure: re-route remaining tasks; step a seat down **only** if the cheaper seat still clears that task's bar, and journal it. Otherwise park that task as `NEEDS USER` with the reason and the question, continue the work that remaining seats clear, and halt only when no independent authorized work is left (delegation.md, the degradation rule).
- **Codex under user opt-in:** when the probe reports `codex billing: PRE-APPROVED (user config)` (Step 0 item 4), the step-down rule above does not apply to Codex — journal Codex usage as normal but treat it as unconstrained unless the user caps that run. Without the flag, ordinary discipline applies to Codex too.
- **Grok under user opt-in:** when the probe reports `grok billing: PRE-APPROVED (user config)` (Step 0 item 5), the step-down rule does not apply to Grok either; route `grok-4.6` with **effort chosen per dispatch by the lead** (routing.md), fan out to the ceiling (default 15 — a reported successful concurrency default, not a measured maximum), and journal each dispatch. The **200K point is a price boundary**, not a correctness one: Grok reprices the whole request above it, so route around the surcharge rather than absorbing it, and do not assert which alternative is cheaper without evidence. **500K is the hard ceiling** — above it Grok is ineligible outright (routing.md, model-matrix.md Table 3).
## Durable state

Before the **first delegated dispatch of any run** — including single-worker runs — and **on entering a Discipline mode for any multi-step task**, write the ledger (`.foreman/ledger.md`; schema in delegation.md): it lives in the *project* being worked on, so before the first write make sure `.foreman/` is ignored there — add it to the project's `.gitignore` (journal that you did) or to `.git/info/exclude` if the user does not want the ignore committed. `scripts/init-ledger.sh` warns when it is not ignored. Otherwise the verifier's clean-tree check (verification.md) can never pass. Baseline commit, task rows, append-only attempts (Discipline tasks terminate at `SELF_REVIEWED`). LOST recovery, attempt counting, dispatch reservations, parked outcomes, and Codex consent all live there. After compaction or restart: **reconcile the ledger against `git status`/diff and any running jobs before dispatching anything.** A stale DONE is as dangerous as a stale PENDING.

**Keep records, and use them.** Every run keeps a **crew record** in the ledger —
one row per dispatch: requested model and effort, seat-evidence tier, cost estimate,
evidenced charge, quota, elapsed, each field `unavailable` when the provider does not
expose it. At closure, append one summary per outcome to the user-authorized global
performance record at `~/.foreman/crew-performance.md` with
`scripts/crew-append.sh` (serialized, idempotent, corrections appended never
rewritten; a failed append leaves a local receipt and closure is never blocked).
Read the relevant slice of that record **before** a comparable dispatch — it is the
evidence behind seat and effort choices (routing.md). Schema and the full append
contract: delegation.md.

## Hard rails

1. Workers never spawn workers. Every ticket says so. **Carve-out:** a *transport wrapper* subagent may invoke a fixed-argv launcher — `scripts/codex-dispatch.sh` or `scripts/grok-dispatch.sh` — exactly once and relay its output. That is transport, not delegation. Each launcher pins its own argv (no raw `codex`/`grok` commands, no shell composition, no nested invocation), and the wrapper does no judgment, no edits, and spawns nothing (codex-workers.md, grok-workers.md). The carve-out covers only these launchers: a wrapper that hand-composes a provider command has broken contract.
2. Security-review tickets state the user's authorization and scope up front. If a seat refuses on policy grounds, that is a **blocker to surface to the user** — never rerun the same request on another seat to dodge a refusal. (Choosing a seat known to handle defensive review reliably *before* dispatch is fine.)
3. Synthesize worker output — never paste it through raw.
4. You never implement while workers are working; you review, route, decide.
5. **Every dispatched worker is collected or declared LOST — never abandoned.** Keep a dispatch register (pid file or task id, artifact path, dispatched-at, expected runtime) for every live worker and reconcile it at every checkpoint: alive inside its deadline = waiting; alive past 3× expected = stop it and reconcile; gone with no artifact = the LOST protocol (delegation.md), and the ticket is **RE-DISPATCHED unless the original outcome is in recovery or parked (`NEEDS USER`), in which case the recovery state governs** and no automatic re-dispatch happens — the work is picked up or explicitly parked with its evidence, never silently dropped. The collection duty itself is unconditional: every worker is still stopped, reconciled, and given a terminal record. A wide Grok fan-out makes this rail load-bearing: the recorded failure is a lead that let several Grok workers die uncollected and never went after their work (2026-09-03).
6. **Seat provenance (v0.3): never trust a model's claim about its own identity.** Workers will report being whatever the prompt implies. Which seat actually served a dispatch is established only by deterministic evidence — CLI/event-stream metadata, harness records, logs — per verification.md Layer 0. A dispatch whose seat cannot be evidenced is logged `seat: unverified` and recorded as **disclosed-uncertain, not disqualified**: the evidence tier is disclosed on the attempt line and in any acceptance resting on it, and the seat stays eligible for the role it was otherwise qualified for. What an unevidenced seat cannot do is stand as proof that cross-family verification happened, or convert a reviewer verdict into acceptance — acceptance is the lead's, personally (verification.md).