ci(agents): gate that every .claude/agents/ definition declares a model (#6803) (#6836)

An agent definition with no `model:` in its frontmatter INHERITS the dispatching
session's model, so the role's tier becomes a property of whoever dispatched it
and when, rather than a property of the role. `os-dev.md` already carries
`model: opus` (#6686 / PR #6688) — this adds the mechanism that keeps it there
and covers the next definition someone adds.

Why the assertion belongs on the definition rather than at the call site: the
caller-side half already existed and did not hold. `.claude/skills/pm-dispatch/
SKILL.md` §5 has said "pass `model: \"opus\"` on every dev dispatch" since before
the incident, and a seat that had read it still dispatched twelve os-dev agents
in a row without passing it, with no signal. The frontmatter holds regardless of
caller compliance.

The gate asserts PRESENCE, never which tier. Which model a role runs on is
maintainer policy (#6803 puts changing it out of scope), and a policy change
should not have to edit a gate to land. `model: inherit` stays legal for a role
that genuinely follows its caller, but only with a written justification the
script re-checks against the live file — so a deliberate inherit is a recorded
decision and a silent one is red.

Every absence is red, never a skip (#4690): missing directory, no .md files, no
frontmatter, empty value, unresolvable value, unjustified inherit, and stale or
dead INHERIT_JUSTIFIED entries. 18 self-test cases pin those red paths.


Claude-Session: https://claude.ai/code/session_01F8q5J1MQyocgtNspb15fSn

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

.github/workflows/lint.yml

@@ -878,6 +878,33 @@ jobs:
       - name: Check SKILL.md compatibility declarations match the workspace majors
         run: pnpm check:skill-compatibility
 
+      # The fourth gate over the .claude/ file tree, and the first to read
+      # .claude/agents/ at all (#6803). An agent definition that declares no `model:`
+      # INHERITS the dispatching session's model, so the role's tier is set by whoever
+      # dispatched it and when — a property of the caller's ambient state rather than
+      # of the role. Measured cost: four devs dispatched from one smaller-model session
+      # all died on the same shared quota wall, three leaving uncommitted and wholly
+      # ungated work in their worktrees (#6686). The failure is batched, and invisible
+      # to the dispatcher, whose pre-dispatch checks never ask what model the batch runs.
+      #
+      # The caller-side half of this rule already existed and did not hold: pm-dispatch
+      # SKILL.md §5 has said 'pass `model: "opus"` on every dev dispatch' since before
+      # that incident, and a seat that had read it still dispatched twelve agents in a
+      # row without passing it. That is why the assertion is over the DEFINITION, which
+      # holds regardless of caller compliance, rather than more prose at the call site.
+      #
+      # It asserts PRESENCE, never which tier — the tier is maintainer policy (#6803
+      # puts changing it out of scope), and a policy change should not have to edit a
+      # gate to land. `model: inherit` stays legal for a role that genuinely follows its
+      # caller, but only with a written justification the script re-checks against the
+      # live file, so a deliberate inherit is a recorded decision and a silent one is red.
+      #
+      # Same job and same reasons as its neighbours: no paths filter and required, so it
+      # cannot go dormant on exactly the PR that breaks it — and a `.claude/**` filter
+      # would blind it to the PR that adds a new agent definition anywhere else.
+      - name: Check every agent definition declares a model
+        run: pnpm check:agent-model-declared
+
       - name: Check the react-blocks contract is in sync with the spec
         run: pnpm --filter @objectstack/spec check:react-blocks
 

package.json

@@ -41,6 +41,7 @@
     "check:skill-frame-sync": "node scripts/check-skill-frame-sync.mjs --self-test && node scripts/check-skill-frame-sync.mjs",
     "check:skill-frame-freshness": "node scripts/check-skill-frame-freshness.mjs --self-test && node scripts/check-skill-frame-freshness.mjs",
     "check:skill-compatibility": "node scripts/check-skill-compatibility-version.mjs --self-test && node scripts/check-skill-compatibility-version.mjs",
+    "check:agent-model-declared": "node scripts/check-agent-model-declared.mjs --self-test && node scripts/check-agent-model-declared.mjs",
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",