fix(paperless): cap OCR at 5 threads per worker

Unset, paperless derives cpu_count / TASK_WORKERS, i.e. 20 parallel
ocrmypdf workers on k8s-1. Memory during OCR scales with that count, so
the limit alone is not enough headroom for large scans.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.woodpecker/build-ci-images.yml

@@ -396,11 +396,16 @@ steps:
       - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
       - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
       - TAG=$(date +%Y-%m-%d)
+      # Also a per-commit tag: several builds a day (branch pushes and the
+      # merge) all rewrite the dated tag, and the deployment pin raced them
+      # on 2026-09-20. The commit tag is immutable and needs no digest lookup.
+      - SHORT=$(printf '%s' "$CI_COMMIT_SHA" | cut -c1-8)
       - |
         /kaniko/executor \
           --context . \
           --dockerfile Containerfile \
           --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG \
+          --destination gitea.renner.uno/gitea_admin/wiki-index:$TAG-$SHORT \
           --destination gitea.renner.uno/gitea_admin/wiki-index:latest
 
   # bird: BGP daemon for the pod-network mesh over pod0 (#576). Runtime

.woodpecker/wiki-maintenance.yml

@@ -0,0 +1,140 @@
+# Nightly wiki maintenance for the Notes vault (k.renner/notes), replacing the
+# workstation's wiki-maintenance.timer: distill the raw/ backlog into wiki/,
+# then audit wiki/. Each agent is its own `claude` run, not a subagent of an
+# orchestrator, so nothing depends on background tasks in print mode (the
+# workstation job died on their 600 s ceiling). The pipeline commits and pushes
+# as Claude Bot; the push webhook then refreshes the wiki-index service.
+#
+# The agents and their retrieval scripts address the vault as ~/Notes, so each
+# agent step links $HOME/Notes to the checkout instead of rewriting them.
+when:
+  - event: cron
+    cron: wiki-maintenance
+  # Hand-started runs: `woodpecker pipeline create k.renner/homelab --branch master`.
+  # The typesafe_api_key secret is scoped to cron and manual, not deployment.
+  - event: manual
+
+steps:
+  - name: checkout-notes
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    pull: true
+    environment:
+      WIKI_BOT_TOKEN:
+        from_secret: wiki_bot_token
+    commands:
+      - |
+        set -eu
+        # Token only on the wire, never in .git/config. Secrets set from files carry
+        # a trailing newline (run 10220: "could not read Username"); strip CR/LF.
+        TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
+        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" \
+          clone --depth 50 --branch main https://gitea.renner.uno/k.renner/notes.git notes
+        echo "raw backlog: $$(ls notes/raw/*.md | grep -v _index.md | wc -l) file(s)"
+
+  - name: distill
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    pull: true
+    environment:
+      CLAUDE_CODE_OAUTH_TOKEN:
+        from_secret: claude_code_oauth_token
+      TYPESAFE_API_KEY:
+        from_secret: typesafe_api_key
+      WIKI_INDEX_BASIC_AUTH:
+        from_secret: wiki_index_basic_auth
+    commands:
+      - |
+        set -eu
+        ln -sfn "$$PWD/notes" "$$HOME/Notes"
+        mkdir -p "$$HOME/.config/wiki-index"
+        printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
+        chmod 600 "$$HOME/.config/wiki-index/basic-auth"
+        "$$HOME/Notes/bin/wiki_rank.py" --probe-index
+      - |
+        set -eu
+        MODEL=$$(sh scripts/ci/pick-model.sh "distill raw source notes into atomic wiki notes: read sources, check the wiki for existing coverage, write or merge notes; careful writing, moderate reasoning")
+        if [ -n "$$MODEL" ]; then echo "distill: selected model $$MODEL"; else echo "distill: using the CLI default model"; fi
+        cd notes
+        cat ../ci/agents/wiki-maintenance/distill.md | claude $${MODEL:+--model $$MODEL} \
+          --agent wiki-distill \
+          --permission-mode acceptEdits \
+          --allowedTools "Read,Edit,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*),Bash(mv /root/Notes/raw/:*),Bash(mkdir -p /root/Notes/:*)" \
+          --settings ../ci/agents/wiki-maintenance/settings.json \
+          -p
+
+  - name: audit
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    pull: true
+    environment:
+      CLAUDE_CODE_OAUTH_TOKEN:
+        from_secret: claude_code_oauth_token
+      TYPESAFE_API_KEY:
+        from_secret: typesafe_api_key
+      WIKI_INDEX_BASIC_AUTH:
+        from_secret: wiki_index_basic_auth
+    commands:
+      - |
+        set -eu
+        ln -sfn "$$PWD/notes" "$$HOME/Notes"
+        mkdir -p "$$HOME/.config/wiki-index"
+        printf '%s' "$$WIKI_INDEX_BASIC_AUTH" | tr -d '\r\n' > "$$HOME/.config/wiki-index/basic-auth"
+        chmod 600 "$$HOME/.config/wiki-index/basic-auth"
+      - |
+        set -eu
+        MODEL=$$(sh scripts/ci/pick-model.sh "structural audit of ~1700 markdown notes: frontmatter completeness, broken links, orphans; mechanical checks, little reasoning")
+        if [ -n "$$MODEL" ]; then echo "audit: selected model $$MODEL"; else echo "audit: using the CLI default model"; fi
+        cd notes
+        cat ../ci/agents/wiki-maintenance/audit.md | claude $${MODEL:+--model $$MODEL} \
+          --agent wiki-audit \
+          --permission-mode acceptEdits \
+          --allowedTools "Read,Write,Glob,Grep,Bash(/root/Notes/bin/wiki_rank.py:*),Bash(/root/Notes/bin/wiki_ask.py:*)" \
+          --settings ../ci/agents/wiki-maintenance/settings.json \
+          -p
+
+  - name: push-notes
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    pull: true
+    environment:
+      WIKI_BOT_TOKEN:
+        from_secret: wiki_bot_token
+    commands:
+      - |
+        set -eu
+        cd notes
+        git config user.email "claude-bot@renner.uno"
+        git config user.name "Claude Bot"
+        if git diff --quiet && git diff --cached --quiet && [ -z "$$(git ls-files --others --exclude-standard)" ]; then
+          echo "wiki-maintenance: no changes"
+          exit 0
+        fi
+        # The workstation pushes main on its own (notes-push.path), so main moves
+        # while the agents run (run 10241: non-fast-forward). The run's work goes
+        # to a branch and a PR that this step merges through Gitea; a conflict
+        # leaves the PR open for a human and fails the run.
+        BRANCH="wiki-maintenance/$$(date -u +%F)-$$CI_PIPELINE_NUMBER"
+        git checkout -q -b "$$BRANCH"
+        git add -A
+        git commit -q -m "wiki maintenance $$(date -u +%F): distill + audit (CI run $$CI_PIPELINE_NUMBER)"
+        TOKEN=$$(printf '%s' "$$WIKI_BOT_TOKEN" | tr -d '\r\n')
+        git -c http.extraheader="AUTHORIZATION: token $$TOKEN" push origin "HEAD:$$BRANCH"
+        API="https://gitea.renner.uno/api/v1/repos/k.renner/notes"
+        jq -n --arg title "wiki maintenance $$(date -u +%F) (CI run $$CI_PIPELINE_NUMBER)" \
+              --arg body "Nightly distill + audit. Merged by the pipeline; open only if the merge failed." \
+              --arg head "$$BRANCH" '{title: $$title, body: $$body, head: $$head, base: "main"}' > /tmp/pr.json
+        code=$$(curl -s -o /tmp/pr-resp.json -w '%{http_code}' -X POST \
+          -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" --data @/tmp/pr.json "$$API/pulls")
+        echo "POST pull -> HTTP $$code"
+        [ "$$code" -ge 200 ] && [ "$$code" -lt 300 ] || { cat /tmp/pr-resp.json; exit 1; }
+        NUM=$$(jq -r '.number' /tmp/pr-resp.json)
+        # Merge without delete_branch_after_merge: run 10254 got HTTP 500 from that
+        # call although the merge itself had landed. Verify the PR state instead of
+        # trusting the status code, then drop the branch as a separate, best-effort step.
+        code=$$(curl -s -o /tmp/merge-resp.json -w '%{http_code}' -X POST \
+          -H "Authorization: token $$TOKEN" -H "Content-Type: application/json" \
+          --data '{"Do":"merge"}' "$$API/pulls/$$NUM/merge")
+        echo "POST merge #$$NUM -> HTTP $$code"
+        MERGED=$$(curl -s -H "Authorization: token $$TOKEN" "$$API/pulls/$$NUM" | jq -r '.merged')
+        echo "PR #$$NUM merged: $$MERGED"
+        [ "$$MERGED" = "true" ] || { cat /tmp/merge-resp.json; echo "PR #$$NUM left open"; exit 1; }
+        code=$$(curl -s -o /tmp/del-resp.json -w '%{http_code}' -X DELETE -H "Authorization: token $$TOKEN" \
+          "$$API/branches/$$(printf '%s' "$$BRANCH" | sed 's|/|%2F|g')")
+        echo "DELETE branch $$BRANCH -> HTTP $$code (best effort)"

ci/agents/wiki-maintenance/audit.md

@@ -0,0 +1,5 @@
+You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes).
+
+Run the standard audit pass over ~/Notes/wiki/ and write the dated report to ~/Notes/output/. Do not modify any wiki note. Do not commit or push; the pipeline does that.
+
+End with two lines: notes scanned, and issues found by category.

ci/agents/wiki-maintenance/distill.md

@@ -0,0 +1,7 @@
+You are running as the scheduled wiki-maintenance job in CI. The Notes vault is checked out at ~/Notes (the repository k.renner/notes). Do exactly this, nothing else:
+
+Glob ~/Notes/raw/*.md (top level only, never ~/Notes/raw/_processed/). Distill every file you find into ~/Notes/wiki/ following your process, including the ranker check for every concept. Move each fully processed source to ~/Notes/raw/_processed/. If raw/ has no top-level files besides _index.md, say so and stop.
+
+Do not commit or push; the pipeline does that after you finish. Do not touch anything outside ~/Notes/wiki/ and ~/Notes/raw/.
+
+End with one line per file: which wiki notes it produced or merged into, or "nothing distillable".

ci/agents/wiki-maintenance/settings.json

@@ -0,0 +1,37 @@
+{
+  "//": "Permission scope for the wiki-maintenance agents (wiki-distill, wiki-audit) in CI.",
+  "//2": "The step's environment holds a Gitea push token, a TypeSafe key and the wiki-index",
+  "//3": "client credential, so the Read tool is kept away from /proc (env dumps), /root outside",
+  "//4": "the vault symlink target, /etc and the checkout's .git/. The vault itself is the work.",
+  "//5": "Mirrors ci/agents/issue-fix/settings.json; absolute globs because the vault is reached",
+  "//6": "through the ~/Notes symlink the pipeline creates.",
+  "permissions": {
+    "allow": [
+      "Read(//root/Notes/**)",
+      "Edit(//root/Notes/wiki/**)",
+      "Edit(//root/Notes/output/**)",
+      "Edit(//root/Notes/raw/**)",
+      "Bash(/root/Notes/bin/wiki_rank.py:*)",
+      "Bash(/root/Notes/bin/wiki_ask.py:*)",
+      "Bash(mv /root/Notes/raw/:*)",
+      "Bash(mkdir -p /root/Notes/:*)",
+      "Bash(ls:*)",
+      "Bash(date:*)",
+      "Bash(wc:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)"
+    ],
+    "deny": [
+      "Read(//proc/**)",
+      "Read(//etc/**)",
+      "Read(//root/.config/**)",
+      "Read(//root/Notes/.git/**)",
+      "Read(//root/Notes/_archive/**)",
+      "Edit(//root/Notes/_archive/**)",
+      "Bash(rm:*)",
+      "Bash(git:*)",
+      "Bash(curl:*)",
+      "Bash(wget:*)"
+    ]
+  }
+}

ci/images/claude/Containerfile

@@ -13,7 +13,9 @@ RUN apk add --no-cache \
       git \
       jq \
       openssh-client \
-      openssl
+      openssl \
+      python3 \
+      py3-yaml
 
 # Install Claude Code, then make the resulting layer byte-stable so that a
 # rebuild of the SAME version DEDUPS in the Gitea registry instead of orphaning

ci/images/wiki-index/test_wiki_index.py

@@ -50,6 +50,32 @@ class ParseTests(unittest.TestCase):
         finally:
             wi.http, wi.SA_TOKEN = original, original_sa
 
+    def test_tree_paging_stops_on_short_last_page(self):
+        # Gitea: truncated=true on every page including the last, "tree": null past it.
+        pages = {
+            1: {"tree": [{"path": f"wiki/n{i}.md", "type": "blob", "sha": f"s{i}"} for i in range(1000)], "truncated": True, "total_count": 1192},
+            2: {"tree": [{"path": f"wiki/n{i}.md", "type": "blob", "sha": f"s{i}"} for i in range(1000, 1192)] + [{"path": "raw/x.md", "type": "blob", "sha": "r"}, {"path": "wiki/sub/y.md", "type": "blob", "sha": "y"}], "truncated": True, "total_count": 1192},
+            3: {"tree": None, "truncated": False, "total_count": 1192},
+        }
+        calls = []
+        original = wi.http
+
+        def fake_http(method, url, body=None, headers=None, timeout=60.0):
+            page = int(url.rsplit("page=", 1)[1])
+            calls.append(page)
+            return pages[page]
+
+        wi.http = fake_http
+        try:
+            tree = wi.Gitea("t").tree("abc")
+        finally:
+            wi.http = original
+        self.assertEqual(calls, [1, 2])
+        self.assertEqual(len(tree), 1192)
+        self.assertNotIn("raw/x.md", tree)
+        self.assertNotIn("wiki/sub/y.md", tree)
+        self.assertEqual(tree["wiki/n1191.md"], "s1191")
+
     def test_signature(self):
         body = b'{"ref":"refs/heads/master"}'
         sig = hmac.new(b"s3cret", body, hashlib.sha256).hexdigest()
@@ -58,20 +84,6 @@ class ParseTests(unittest.TestCase):
         self.assertFalse(wi.verify_signature("s3cret", body, ""))
 
 
-class TreeTests(unittest.TestCase):
-    def test_paging_stops_on_null_page(self):
-        # Gitea clamps per_page, keeps `truncated` true while pages remain and answers
-        # `"tree": null` for the first page past the end.
-        pages = {1: {"truncated": True, "tree": [{"type": "blob", "path": "wiki/a.md", "sha": "a"}]},
-                 2: {"truncated": True, "tree": [{"type": "blob", "path": "wiki/b.md", "sha": "b"},
-                                                 {"type": "tree", "path": "wiki/sub", "sha": "d"},
-                                                 {"type": "blob", "path": "wiki/sub/c.md", "sha": "c"}]},
-                 3: {"truncated": True, "tree": None}}
-        g = wi.Gitea("tok")
-        g.api = lambda path, **params: pages[params["page"]]
-        self.assertEqual(g.tree("c1"), {"wiki/a.md": "a", "wiki/b.md": "b"})
-
-
 class FakeGitea:
     def __init__(self, head, tree, files):
         self._head, self._tree, self.files = head, tree, files
@@ -143,11 +155,11 @@ class IndexTests(unittest.TestCase):
 
     def test_status_reports_age_and_errors(self):
         idx = wi.Index(self.path)
-        self.assertFalse(idx.status()["ok"])
+        self.assertFalse(idx.status()["ready"])
         g = FakeGitea("c1", {"wiki/a.md": "x"}, {"wiki/a.md": "---\ntitle: A\n---\n# A\n\nt\n"})
         idx.sync(g)
         st = idx.status()
-        self.assertTrue(st["ok"])
+        self.assertTrue(st["ready"])
         self.assertEqual(st["notes"], 1)
         self.assertEqual(st["commit"], "c1")
 
@@ -159,6 +171,7 @@ class IndexTests(unittest.TestCase):
             idx.sync(Broken("c1", {}, {}))
         self.assertIn("gitea down", idx.status()["last_error"])
         self.assertEqual(idx.status()["notes"], 1)  # last good index kept
+        self.assertTrue(idx.status()["ready"])  # and still served
 
 
 if __name__ == "__main__":

ci/images/wiki-index/wiki_index.py

@@ -9,7 +9,8 @@ runs at start, on every push webhook from Gitea, and every RESYNC_SECONDS.
 
 HTTP:
   POST /rank     {"query": str, "k": int}   -> {"rows": [{"slug","title","score"}], "index": {...}}
-  GET  /health   -> {"ok", "notes", "commit", "synced_at", "age_s", "syncing"}
+  GET  /health   -> 200 always (liveness) with {"ready", "notes", "commit", "synced_at", "age_s", "syncing", "last_error"}
+  GET  /ready    -> 200 when an index exists, else 503 (readiness)
   POST /webhook  Gitea push event, HMAC-SHA256 in X-Gitea-Signature -> {"queued": true}
 
 Credentials (Gitea token, webhook secret) are read from OpenBao through the
@@ -120,15 +121,17 @@ class Gitea:
     def tree(self, commit: str) -> dict[str, str]:
         """path -> blob sha for every wiki note at that commit."""
         out: dict[str, str] = {}
-        page = 1
+        page, per_page, seen = 1, 1000, 0
         while True:
-            t = self.api(f"/git/trees/{commit}", recursive="true", per_page=1000, page=page)
-            entries = t.get("tree") or []  # Gitea clamps per_page and answers `"tree": null` past the last page
+            t = self.api(f"/git/trees/{commit}", recursive="true", per_page=per_page, page=page)
+            entries = t.get("tree") or []  # Gitea answers "tree": null past the last page
             for e in entries:
                 p = e.get("path", "")
                 if e.get("type") == "blob" and p.startswith(WIKI_DIR + "/") and p.endswith(".md") and "/" not in p[len(WIKI_DIR) + 1:]:
                     out[p] = e["sha"]
-            if not entries:  # the only reliable end-of-tree signal: `truncated` stays true while pages remain
+            seen += len(entries)
+            total = int(t.get("total_count") or 0)
+            if not entries or len(entries) < per_page or (total and seen >= total):
                 break
             page += 1
             if page > 50:
@@ -283,8 +286,9 @@ class Index:
         return [{"slug": s, "title": t, "score": round(sc, 4)} for s, t, sc in rows[:k]]
 
     def status(self) -> dict:
+        """`ready` = an index exists and can answer /rank; a failed sync keeps the last good index."""
         with self.lock:
-            return {"ok": bool(self.notes) and not self.last_error, "notes": len(self.notes), "commit": self.commit,
+            return {"ready": bool(self.notes), "notes": len(self.notes), "commit": self.commit,
                     "synced_at": self.synced_at, "age_s": round(time.time() - self.synced_at) if self.synced_at else None,
                     "syncing": self.syncing, "last_error": self.last_error or None}
 
@@ -345,9 +349,11 @@ def make_handler(index: Index, syncer: Syncer, creds: Credentials):
             return self.rfile.read(n) if n else b""
 
         def do_GET(self):
-            if self.path == "/health":
+            if self.path == "/health":  # liveness: the process serves
+                return self.send_json(200, index.status())
+            if self.path == "/ready":  # readiness: an index exists
                 st = index.status()
-                return self.send_json(200 if st["ok"] else 503, st)
+                return self.send_json(200 if st["ready"] else 503, st)
             self.send_json(404, {"error": "not found"})
 
         def do_POST(self):

kubernetes/apps/paperless/paperless.yaml

@@ -27,6 +27,8 @@ data:
   PAPERLESS_ALLOWED_HOSTS: "*"
   PAPERLESS_TIME_ZONE: "Europe/Berlin"
   PAPERLESS_OCR_LANGUAGE: "deu+eng"
+  # Default is cpu_count / TASK_WORKERS, 20 on k8s-1; OCR memory scales with it.
+  PAPERLESS_THREADS_PER_WORKER: "5"
   PAPERLESS_CONSUMER_RECURSIVE: "true"
   PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
   PAPERLESS_CONSUMER_ENABLE_BARCODES: "true"
@@ -183,7 +185,7 @@ spec:
               drop: ["ALL"]
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.2.0 # {"$imagepolicy": "flux-system:paperless-ngx"}
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.2.1 # {"$imagepolicy": "flux-system:paperless-ngx"}
           ports:
             - name: http
               containerPort: 8000
@@ -273,7 +275,7 @@ spec:
               cpu: 200m
               memory: 512Mi
             limits:
-              memory: 2Gi
+              memory: 4Gi
           securityContext:
             runAsNonRoot: false
             allowPrivilegeEscalation: true

kubernetes/apps/paperless/redis.yaml

@@ -25,7 +25,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: redis
-          image: redis:8.10.1-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
+          image: redis:8.10.2-alpine # {"$imagepolicy": "flux-system:redis-paperless"}
           args:
             - redis-server
             - --save

kubernetes/apps/wiki-index/deployment.yaml

@@ -56,7 +56,8 @@ spec:
           type: RuntimeDefault
       containers:
         - name: wiki-index
-          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20@sha256:8b4815f6371a951be64b80fcebee46804944f40ccfbdf9314ab97e4738a0b6b3
+          # Per-commit tag (build-ci-images.yml): immutable, no same-day overwrite.
+          image: gitea.renner.uno/gitea_admin/wiki-index:2026-09-20-4b529cd1
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -92,26 +93,26 @@ spec:
             limits:
               cpu: "1"
               memory: 512Mi
-          # /health is 503 until the first sync produced an index. Cold start with an
-          # empty PVC embeds every note: budget 15 min.
+          # /health: the process serves (liveness). /ready: an index exists; a cold
+          # start on an empty PVC embeds every note (~5 min) before traffic arrives.
           startupProbe:
             httpGet:
               path: /health
               port: http
-            periodSeconds: 10
-            failureThreshold: 90
+            periodSeconds: 5
+            failureThreshold: 12
           readinessProbe:
             httpGet:
-              path: /health
+              path: /ready
               port: http
-            periodSeconds: 30
+            periodSeconds: 10
           livenessProbe:
             httpGet:
               path: /health
               port: http
             periodSeconds: 60
             timeoutSeconds: 10
-            failureThreshold: 10
+            failureThreshold: 3
           volumeMounts:
             - name: data
               mountPath: /data

scripts/ci/choose-model.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Turn the TypeSafe picker's probability distribution into one model id.
+#
+# The judgment (how well each catalog model fits the task) comes from the
+# model; the policy lives here, in code: among the candidates whose probability
+# is within MARGIN of the best one, take the most recently released. Several
+# same-family models (Sonnet 4.5 / 4.6 / 5) split the probability for a
+# mid-weight task, and the newest of a comparable set is the one to run.
+#
+# Usage: choose-model.sh <catalog-table-file> < <systemone-response.json>
+#   The table is fetch-models.sh --table output: id \t name \t released=YYYY-MM-DD ...
+#   Prints the chosen id, or nothing when the answer is NONE / unusable.
+# Env: CHOOSE_MODEL_MARGIN (default 0.7): candidate if p >= MARGIN * p_best.
+
+set -eu
+TABLE_FILE="${1:?usage: choose-model.sh <catalog-table-file> < response.json}"
+MARGIN="${CHOOSE_MODEL_MARGIN:-0.7}"
+
+jq -r --rawfile table "$TABLE_FILE" --argjson margin "$MARGIN" '
+  ($table | split("\n") | map(select(length > 0) | split("\t")
+     | {key: .[0], value: ((.[2:] | map(select(startswith("released="))) | .[0] // "released=") | ltrimstr("released="))})
+   | from_entries) as $released
+  | (.answers.model.probabilities // {}) | to_entries
+  | map(select(.key != "NONE")) | sort_by(-.value)
+  | if length == 0 then empty
+    else (.[0].value) as $best
+      | map(select(.value >= $margin * $best))
+      | sort_by([($released[.key] // ""), .value])
+      | .[-1].key
+    end' 2>&1

scripts/ci/pick-model.sh

@@ -33,6 +33,42 @@ none() { log "$1"; exit 0; }            # emit nothing -> caller uses CLI defaul
 TABLE="$(sh "$HERE/fetch-models.sh" --table || true)"
 [ -n "$TABLE" ] || none "no catalog available — caller will use the CLI default model"
 
+# First choice: one TypeSafe (System One) Choice over the catalog. The task and
+# the catalog rows are state, every model id is an option with its catalog row
+# as the criterion, and the answer is typed — no prompt, no JSON parsing, and a
+# request that takes a fraction of a second instead of a claude run. The id is
+# still validated against the pristine catalog. Falls through to the claude
+# picker when the key is absent or the request fails.
+if [ -n "${TYPESAFE_API_KEY:-}" ]; then
+  REQ="$(printf '%s\n' "$TABLE" | jq -R -s --arg task "$GUIDANCE" '
+    split("\n") | map(select(length > 0) | split("\t") | {id: .[0], name: .[1], info: (.[2:] | join(", "))})
+    | {model: "jev-latest",
+       state: {task: $task, models: .},
+       questions: {model: {
+         type: "choice",
+         instructions: "Which model in `models` should run `task`? Match the model to the task: not the largest or newest flagship for trivial or mechanical work, not a minimal model for hard, multi-step or security-sensitive work; prefer a newer model when otherwise comparable. Consider every listed model, including unfamiliar ones. Pick NONE only if no listed model fits.",
+         criteria: ((map({key: .id, value: "\(.name); \(.info)"}) | from_entries) + {NONE: "No listed model fits the task"})}}}')"
+  if [ -n "${PICK_MODEL_TYPESAFE_DRYRUN:-}" ]; then printf '%s\n' "$REQ"; exit 0; fi
+  RESP="$(printf '%s' "$REQ" | curl -sS --max-time 30 -X POST https://api.typesafe.ai/v1/systemone \
+           -H "Authorization: Bearer $TYPESAFE_API_KEY" -H 'Content-Type: application/json' --data-binary @- || true)"
+  # Policy in code (choose-model.sh): among candidates within a margin of the
+  # best probability, the most recently released wins. Same-family models split
+  # the probability for mid-weight tasks (live catalog: Sonnet 4.5 chosen at
+  # 0.23 over Sonnet 4.6).
+  TABLE_FILE="$(mktemp)"
+  printf '%s\n' "$TABLE" > "$TABLE_FILE"
+  CHOICE="$(printf '%s' "$RESP" | sh "$HERE/choose-model.sh" "$TABLE_FILE" | head -1)"
+  rm -f "$TABLE_FILE"
+  TOP="$(printf '%s' "$RESP" | jq -r '(.answers.model.probabilities // {}) | to_entries | sort_by(-.value) | .[0:4] | map("\(.key)=\(.value)") | join(" ")' 2>&1 | head -1)"
+  VALID="$(printf '%s\n' "$TABLE" | sh "$HERE/valid-model.sh" "$CHOICE")"
+  if [ -n "$VALID" ]; then
+    log "typesafe chose '$VALID' (top: ${TOP:-?}) for: $GUIDANCE"
+    printf '%s\n' "$VALID"
+    exit 0
+  fi
+  log "typesafe picker returned '${CHOICE:-<empty>}' (rejected, NONE, or request failed) — falling back to the claude picker"
+fi
+
 PROMPT="$(cat <<EOF
 You are a model-selection agent for an automated CI job. From the models
 currently available (listed below with their capabilities), choose the single

scripts/ci/test-model-selection.sh

@@ -84,9 +84,40 @@ else
   printf 'FAIL  recorded fixture: opus=[%s] haiku=[%s]\n' "$opusline" "$haikuline"; fails=$((fails + 1))
 fi
 
+
+# TypeSafe path of pick-model.sh: the request offers exactly the catalog ids plus
+# NONE as options, carries the task as state, and never sends anything else.
+printf '%s' '{"data":[{"type":"model","id":"claude-opus-5","display_name":"Claude Opus 5","created_at":"2026-07-24T00:00:00Z","max_input_tokens":1000000,"max_tokens":128000},{"type":"model","id":"claude-haiku-4-5-20251001","display_name":"Claude Haiku 4.5","created_at":"2025-10-15T00:00:00Z","max_input_tokens":200000,"max_tokens":64000}],"has_more":false}' > "$FX"
+req="$(FETCH_MODELS_BODY_FILE="$FX" TYPESAFE_API_KEY=dry PICK_MODEL_TYPESAFE_DRYRUN=1 sh "$HERE/pick-model.sh" "a task; with \"quotes\" and $ signs" 2>/dev/null || true)"
+keys="$(printf '%s' "$req" | jq -r '.questions.model.criteria | keys | join(",")' 2>/dev/null || true)"
+task="$(printf '%s' "$req" | jq -r '.state.task' 2>/dev/null || true)"
+if [ "$keys" = "NONE,claude-haiku-4-5-20251001,claude-opus-5" ] && [ "$task" = 'a task; with "quotes" and $ signs' ]; then
+  printf 'ok    typesafe request offers catalog ids + NONE and carries the task verbatim\n'
+else
+  printf 'FAIL  typesafe request: keys [%s] task [%s]\n' "$keys" "$task"; fails=$((fails + 1))
+fi
+
+# choose-model.sh: newest among comparable candidates, best otherwise, NONE -> nothing.
+TB="$(mktemp)"
+printf '%s\n' 'claude-sonnet-4-5	Claude Sonnet 4.5	released=2025-09-29	context=200000' \
+              'claude-sonnet-4-6	Claude Sonnet 4.6	released=2026-02-17	context=200000' \
+              'claude-opus-5	Claude Opus 5	released=2026-07-24	context=1000000' \
+              'claude-haiku-4-5	Claude Haiku 4.5	released=2025-10-15	context=200000' > "$TB"
+choose() { printf '%s' "$1" | sh "$HERE/choose-model.sh" "$TB" || true; }
+got="$(choose '{"answers":{"model":{"probabilities":{"claude-sonnet-4-5":0.30,"claude-sonnet-4-6":0.25,"claude-opus-5":0.10,"NONE":0.05}}}}')"
+if [ "$got" = "claude-sonnet-4-6" ]; then printf 'ok    newer sibling within margin wins\n'; else printf 'FAIL  comparable: got [%s]\n' "$got"; fails=$((fails + 1)); fi
+got="$(choose '{"answers":{"model":{"probabilities":{"claude-opus-5":0.90,"claude-haiku-4-5":0.05,"claude-sonnet-4-6":0.04,"NONE":0.01}}}}')"
+if [ "$got" = "claude-opus-5" ]; then printf 'ok    clear best is kept\n'; else printf 'FAIL  clear best: got [%s]\n' "$got"; fails=$((fails + 1)); fi
+got="$(choose '{"answers":{"model":{"probabilities":{"claude-haiku-4-5":0.60,"claude-sonnet-4-5":0.35,"NONE":0.05}}}}')"
+if [ "$got" = "claude-haiku-4-5" ]; then printf 'ok    older best outside margin is kept\n'; else printf 'FAIL  margin: got [%s]\n' "$got"; fails=$((fails + 1)); fi
+got="$(choose '{"answers":{"model":{"probabilities":{"NONE":1.0}}}}')"
+if [ -z "$got" ]; then printf 'ok    NONE yields nothing\n'; else printf 'FAIL  NONE: got [%s]\n' "$got"; fails=$((fails + 1)); fi
+rm -f "$TB"
+
 if [ "$fails" -eq 0 ]; then
   echo "All model-selection tests passed."
 else
   echo "$fails test(s) FAILED."
   exit 1
 fi
+