v0.9.7: provider-native Ultra reasoning and truthful Operate orchestration

[Hmbown]

Problem

Codewhale already exposes ultra vocabulary and Operate, but the contracts are internally inconsistent:

• ReasoningEffort::XHigh and Ultra exist, while strict parsing and durable Work Graph receipts collapse them to Max
• OpenAI/Codex currently displays and sends Ultra as xhigh
• the bundled Meta Muse Spark 1.2 ladder advertises through ultra, but not every request/sub-agent mapper accepts that value
• the GPT-5.6 family has no complete route capability ladder proving which exact IDs and provider wires accept Ultra
• Operate can add depth through coordinated child agents, but that is orchestration—not a provider-native reasoning capability

We need one truthful contract: native effort is exact per resolved provider/model route; Operate extends task depth by bounded composition and never relabels that composition as a stronger model.

Scope

• preserve a typed requested Ultra end to end only where the exact route advertises and proves that wire tier; initial verification targets are the GPT-5.6 family and Meta Muse Spark 1.2
• centralize a resolved-route capability ladder and exact wire mapping; record requested versus effective effort and explicit unsupported/downgrade outcomes
• complete the existing Operate path as a bounded coordinator over agent/Fleet roles such as scout, planner, builder, reviewer, verifier, and consultant
• record each child route, native effort, permissions, lifecycle, usage/cost, and evidence receipt
• reuse Work Graph and the unified task surfaces rather than inventing another progress taxonomy

Acceptance criteria

• ultra no longer aliases silently to max; parsing, persistence, picker state, request tuning, sub-agent/Fleet/Workflow schemas, and Work Graph receipts preserve requested/effective tiers.
• Exact request-body tests prove the supported wire value for every targeted GPT-5.6 route and Meta Muse Spark 1.2 route. An unproven or unsupported route hides/rejects Ultra, or visibly resolves to a documented lower tier, with a truthful receipt.
• Switching provider/model re-resolves effort; the UI never displays native Ultra when the effective request did not receive it.
• Child thinking=ultra follows the same resolved-route capability contract; every child receipt shows provider, model, requested/effective effort, status, usage, and cost.
• Operate can dispatch a bounded mixed-role/mixed-model plan, join and synthesize typed outcomes, and record child lifecycle in the existing Work Graph/task surface.
• Fan-out, nesting, steps, wall time, token/cost budgets, cancellation, permissions, sandbox, and workspace claims are enforced and tested.
• UI, snapshot, and PTY tests distinguish native Ultra from orchestrated depth and show partial failure/cancellation without claiming success.
• Compatibility tests cover old xhigh, max, and ultra settings plus unsupported-route migrations; normal full gates and rebuilt-binary dogfood pass.

Boundaries

No prompt-only “Ultra,” speculative reasoning-token inflation, hidden fan-out/spend, provider claims without exact wire evidence, broad Work Graph rewrite, or v0.9.6 backport. Operate is orchestration and coordination; it does not mean a child model gained a native capability.

Current seams

• crates/tui/src/tui/app/types.rs
• crates/tui/src/tui/model_picker.rs
• crates/tui/src/client/chat.rs and client/responses.rs
• crates/tui/src/work_graph/model.rs
• crates/tui/src/tools/subagent/mod.rs
• crates/tui/src/fleet/
• crates/tui/src/tui/ui/dispatch.rs

Related: #5052, #3205, #5270.

[Hmbown]

Concrete dogfood follow-up: #5305. The configured consultant actually resolved to openai-codex / gpt-5.6-sol; the compact start acknowledgement hid that route, so the parent falsely attributed the child to DeepSeek until a later status poll. #5305 turns this issue’s child-receipt requirement into a bounded, privacy-tested launch contract. Operate must not depend on prompt correction or a second poll to know which model it launched.