Model Policy

Replaces the model-ladder. No performance-based promotion/demotion. No ranks. Three models, fixed rules.

Model assignments

Scope	Model	Notes
Hinata main thread	claude-opus-4-8	Michael toggles in console as needed
All subagents (default)	claude-sonnet-4-6	Fixed — no escalation without Michael decision
Fallback only	claude-haiku-4-5-20251001	Only if sonnet weekly cap hit AND near reset date

Max thinking — always on

Extended thinking is the default for all API calls (both main thread and subagents). Never disable without reason.

thinking = {"type": "enabled", "budget_tokens": 10000}

Haiku does not support extended thinking. If haiku fallback is active, disable thinking block.

Sonnet vs Opus parity

Sonnet 4.6 and Opus 4.8 are treated as the same capability tier. The distinction is cost, not quality. Subagents stay on Sonnet. Michael switches main thread to Opus in console when needed.

Forbidden models

• claude-opus-4-6 — retired
• claude-opus-4-7 — never used
• Any model not in the three above

API key

Stored in Itachi. Read via HINATA_ANTHROPIC_API_KEY environment variable (populated from Itachi/Vaultwarden at deploy time). Never hardcode. Never store in .env in plaintext — populate .env from Vaultwarden (CT103, 192.168.1.250) at provisioning. ("Bitwarden" naming deprecated 2026-06-10.)

Subagent dispatch

Agent(
    subagent_type="Trunks",         # registered commander name
    model="sonnet",                 # always sonnet for subagents
    ...
)

model field in Agent call accepts: "sonnet" → claude-sonnet-4-6, "opus" → claude-opus-4-8, "haiku" → claude-haiku-4-5-20251001.

Systemic hardening (2026-06-10, Michael ruling)

Behaviour contracts hold "even if the model is not Fable 5 or Opus 4.6" — hardening is systemic across runtime and BAU, never a property of the current top-tier models:

• Runtime (agent instances): every registered agent in .claude/agents/ carries a Hardening block. Behaviour is fully specified by agent definition + federation context route + dispatch contract — the same STATUS / DELIVERABLE / GAPS output must hold on any model tier in the assignments table, including haiku fallback.
• BAU (unattended services): scripts and Z2 services read the model ID from config/env — never hardcode a model name, never assume tier-specific capability (extended thinking, context size, tool fluency). A model swap is a config change, not a code change.
• Naming discipline: agent prose never names vendor models — it links here (model-policy). This file is the single sanctioned location for explicit model names.

---

Supersedes model-ladder. Cross-links: supreme-court/runtime/agent-frontmatter-standard | supreme-court/format-design/naming-conventions