Upgrade Fable route to Claude Fable 5.1

[kushthakker]

Change summary

• Upgrade the sealed current Fable route to claude-fable-5-1 with schema/policy 6.
• Preserve schemas 1-5 and legacy claude-fable-5 disable/restore behavior.
• Port Fable-only first-party API-key and Console managed-key auth while keeping Opus subscription-only.
• Re-attest Claude Code 2.1.257+ and exact runtime model/provider metadata on every current-Fable call.

Validation

• python3 scripts/preflight.py full: local compile, focused tests, full tests, lifecycle, diff, and release identity passed.
• Live sealed Fable Planner call returned PLAN_DRAFT with exact model claude-fable-5-1, provider firstParty, and no helper.
• Local Ruff was unavailable; Python 3.11/3.13, Windows portability, and CodeQL remain hosted checks.

Review attestation

{
"schema": 1,
"risk_tier": "security-state",
"repository": "Cjbuilds/Codex-Orchestration",
"base_branch": "main",
"reviewed_head_sha": "9f3d54e0991411b8c0082efe167521a9dc156b25",
"reviewer_identity": "Codex independent reviewer agent",
"reviewer_route": "gpt-5.6-sol@high",
"threat_model": {
"assets": [
"Claude credentials, user billing selection, and persisted Codex routing restore state"
],
"threats": [
"Ambient credential leakage, Opus API-key billing drift, stale CLI replacement, forged routing state, and runtime model substitution"
],
"mitigations": [
"Fable-scoped key forwarding, Opus subscription-only auth, minimal subprocess environment, schema-pinned legacy validation, per-call CLI version checks, and exact runtime identity allowlists"
]
},
"negative_test_evidence": [
{
"category": "negative",
"evidence": "Tests reject Opus API-key and managed-key auth, old Claude Code versions, helper models, and unsealed provider tuples"
},
{
"category": "malformed",
"evidence": "Tests reject malformed CLI versions, contradictory auth metadata, malformed modelUsage values, and tampered schema or future fields"
},
{
"category": "regression",
"evidence": "Schemas 1-5 validate and disable with restore snapshots intact; full local test and lifecycle suites pass"
}
],
"findings_disposition": "All review findings resolved; final exact-head review found no remaining production issues"
}

[kushthakker]

@Cjbuilds This upgrades the bundled Planner/Advisor route to Claude Fable 5.1 and ports the first-party API-key/Console managed-key authentication behavior already validated on remote_mac. The full local preflight, lifecycle suite, live sealed Fable call, and exact-head security review passed. Could you please review and merge this so the canonical Codex plugin installation can update safely?