WilliamAGH · Oct 15, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026
diff --git a/.env.example b/.env.example
@@ -18,7 +18,7 @@ PORT=8085
 OPENAI_API_KEY=
 # Chat and embeddings share the gateway base URL and credential.
 OPENAI_BASE_URL=https://api.llm-gateway.iocloudhost.net/v1
-OPENAI_MODEL=gpt-5.4
+OPENAI_MODEL=claude-haiku-5-5
 # Local Embedding Server (if you have one running)
 APP_LOCAL_EMBEDDING_ENABLED=false
 LOCAL_EMBEDDING_SERVER_URL=http://127.0.0.1:8088

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -22,6 +22,7 @@ env:
 jobs:
   writer-lease-portability:
     runs-on: macos-15
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -37,6 +38,7 @@ jobs:
 
   frontend:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     defaults:
       run:
         working-directory: frontend
@@ -86,6 +88,7 @@ jobs:
 
   build:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -151,6 +154,7 @@ jobs:
       - frontend
       - build
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
 
     steps:
       - name: Checkout code
@@ -210,7 +214,7 @@ jobs:
             --publish 8085:8085 \
             --env OPENAI_API_KEY=ci-smoke-token \
             --env OPENAI_BASE_URL=https://api.llm-gateway.iocloudhost.net/v1 \
-            --env OPENAI_MODEL=gpt-5.4 \
+            --env OPENAI_MODEL=claude-haiku-5-5 \
             --env APP_LOCAL_EMBEDDING_ENABLED=true \
             --env SPRING_PROFILES_ACTIVE=ci \
             --env QDRANT_HOST=qdrant \
@@ -286,7 +290,7 @@ jobs:
             --network java-chat-ci_default \
             --env OPENAI_API_KEY=ci-smoke-token \
             --env OPENAI_BASE_URL=https://api.llm-gateway.iocloudhost.net/v1 \
-            --env OPENAI_MODEL=gpt-5.4 \
+            --env OPENAI_MODEL=claude-haiku-5-5 \
             --env APP_LOCAL_EMBEDDING_ENABLED=true \
             --env SPRING_PROFILES_ACTIVE=ci \
             --env SPRING_APPLICATION_NAME="$conflicting_runtime_name" \

diff --git a/.gitignore b/.gitignore
@@ -103,3 +103,5 @@ screenshots/review/
 screenshots/asc-review/
 ### Stray debug/dogfood captures at the screenshots root (annotated browser shots) ###
 /screenshots/*.png
+### Agent task worktrees ###
+.worktrees/
diff --git a/AGENTS.md b/AGENTS.md
@@ -256,7 +256,7 @@ alwaysApply: true
 
 - [LM1a] **Settings**: Do not change any LLM settings without explicit written approval.
 - [LM1b] **No Fallback**: Do not auto-fallback or regress models across providers; surface error to user.
-- [LM1c] **Config**: Generative inference MUST go through the shared OpenAI-compatible gateway using a non-blank `OPENAI_MODEL` gateway alias (default `gpt-5.4`). Its model/base-url/api-key MUST come from `.env`/environment variables (see [EV1d]). All other LLM settings MUST come from Spring property files and `@ConfigurationProperties`.
+- [LM1c] **Config**: Generative inference MUST go through the shared OpenAI-compatible gateway using a non-blank `OPENAI_MODEL` gateway alias (default `claude-haiku-5-5`). Its model/base-url/api-key MUST come from `.env`/environment variables (see [EV1d]). All other LLM settings MUST come from Spring property files and `@ConfigurationProperties`.
 - [LM1d] **Behavior**: Allowed: logging diagnostics. Not allowed: silently changing LLM behavior.
 - [LM1e] **Streaming**: TTFB < 200ms, streaming start < 500ms.
 - [LM1f] **Events**: `text`, `citation`, `code`, `enrichment`, `suggestion`, `status`.

diff --git a/build.gradle.kts b/build.gradle.kts
@@ -182,7 +182,7 @@ tasks.withType<Test> {
         showStackTraces = true
     }
     systemProperty("spring.profiles.active", "test")
-    environment("OPENAI_MODEL", "gpt-5.4")
+    environment("OPENAI_MODEL", "claude-haiku-5-5")
     useJUnitPlatform()
     maxHeapSize = "1024m"
     jvmArgs(

diff --git a/config/ast-grep-tests/java-no-obsolete-gpt5-chat-model-test.yml b/config/ast-grep-tests/java-no-obsolete-gpt5-chat-model-test.yml
@@ -2,13 +2,17 @@ id: java-no-obsolete-gpt5-chat-model
 valid:
   - |
       class ChatModelConfig {
-          private static final String MODEL = "gpt-5.4";
+          private static final String MODEL = "claude-haiku-5-5";
       }
   - |
       class OtherModelConfig {
           private static final String MODEL = "o3-mini";
       }
 invalid:
+  - |
+      class ObsoleteChatModelConfig {
+          private static final String MODEL = "gpt-5.4";
+      }
   - |
       class ProviderQualifiedChatModelConfig {
           private static final String MODEL = "provider/gpt-5.4";

diff --git a/config/ast-grep/java-no-obsolete-gpt5-chat-model.yml b/config/ast-grep/java-no-obsolete-gpt5-chat-model.yml
@@ -7,12 +7,9 @@ language: Java
 severity: error
 message: |
   [LM1a-c] Obsolete GPT-5 chat-model identifier detected.
-  Use GPT-5.4 through ModelConfiguration; never restore another GPT-5 default.
+  Use the selected gateway model through ModelConfiguration; never restore an obsolete GPT-5 default.
 files:
   - 'src/main/java/**'
 rule:
   kind: string_literal
-  all:
-    - regex: '^"(?i:(?:[^"/:]+[/:])*gpt-5[^"]*)"$'
-    - not:
-        regex: '^"gpt-5\.4"$'
+  regex: '^"(?i:(?:[^"/:]+[/:])*gpt-5[^"]*)"$'
diff --git a/docs/api.md b/docs/api.md
@@ -47,7 +47,7 @@ and hybrid search across the indexed JDK documentation, books, and GitHub reposi
 events carry `message`/`details` only (`code`, `retryable`, and `stage` are `null`) and always
 arrive before the `provider` event.
 
-Chat uses the shared OpenAI-compatible gateway with GPT-5.4. An unavailable, rate-limited,
+Chat uses the shared OpenAI-compatible gateway with Claude Haiku 5.5 at low reasoning effort. An unavailable, rate-limited,
 or failed gateway request terminates the stream with an `error` event; no alternate provider exists.
 
 Example:

diff --git a/docs/configuration.md b/docs/configuration.md
@@ -19,10 +19,10 @@ Common variables:
 
 - `OPENAI_API_KEY` (shared-gateway auth)
 - `OPENAI_BASE_URL` (`https://api.llm-gateway.iocloudhost.net/v1` for Java Chat deployments)
-- `OPENAI_MODEL` (non-blank gateway chat alias; default `gpt-5.4`)
+- `OPENAI_MODEL` (non-blank gateway chat alias; default `claude-haiku-5-5`)
 - `OPENAI_STREAMING_REQUEST_TIMEOUT_SECONDS` (default `90`; bounds the complete SDK call and the visible-output deadline, which shares this same budget)
 
-Non-secret generation policy is owned by `app.llm` in `application.properties`: `temperature`, optional `reasoning-effort`, `completion-output-token-budget`, `enrichment-output-token-budget`, `reranker-temperature`, `reranker-output-token-budget`, and `configured-provider-backoff-seconds`. `gpt-5.4` is a reasoning generation whose upstream accepts only the default temperature (`1.0`) on the Responses API, so both temperature settings stay at `1.0`; any other value fails upstream with `HTTP 400`. `reasoning-effort` is absent by default, preserving the gateway/model default; set it only for an explicit override. Invalid values fail startup. The override applies only to chat generation (streaming and text completions); JSON-object completions (reranker, enrichment) always inherit the gateway/model default so reasoning tokens cannot starve their small output budgets. Java Chat forwards the universal reasoning values `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max` without model inspection; the gateway owns upstream capability translation. A deterministic gateway `HTTP 422 unpreservable_reasoning_intent` means no provider can preserve the configured effort — lower or unset `reasoning-effort`; retrying unchanged cannot succeed.
+Non-secret generation policy is owned by `app.llm` in `application.properties`: `temperature`, `reasoning-effort`, `completion-output-token-budget`, `enrichment-output-token-budget`, `reranker-temperature`, `reranker-output-token-budget`, and `configured-provider-backoff-seconds`. The tested default is Claude Haiku 5.5 with `reasoning-effort=low`, which preserved quality while reducing latency and cost in the Java Chat matrix; both temperature settings stay at `1.0` and the gateway owns provider-specific sampling constraints. The override applies only to chat generation (streaming and text completions); JSON-object completions (reranker, enrichment) always inherit the gateway/model default so reasoning tokens cannot starve their small output budgets. Java Chat forwards the universal reasoning values `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max` without model inspection; the gateway owns upstream capability translation. A deterministic gateway `HTTP 422 unpreservable_reasoning_intent` means no provider can preserve the configured effort — lower or unset `reasoning-effort`; retrying unchanged cannot succeed.
 
 ### Shared LLM gateway
 
@@ -32,7 +32,7 @@ Configure chat through the shared gateway with:
 OPENAI_API_KEY=lgw-...
 OPENAI_BASE_URL=https://api.llm-gateway.iocloudhost.net/v1
 # Default; any non-blank gateway alias is supported.
-OPENAI_MODEL=gpt-5.4
+OPENAI_MODEL=claude-haiku-5-5
 ```
 
 Java Chat sends chat and embedding requests to the same configured gateway URL and credential.

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -20,9 +20,9 @@ cp .env.example .env
 `java-chat-qwen3-embedding-4b-2560-*` collection names, and repository-local generation state roots.
 Configure the shared gateway `OPENAI_BASE_URL` and `OPENAI_API_KEY` used by embeddings and gateway chat.
 
-Set `OPENAI_API_KEY`, `OPENAI_BASE_URL`, and a non-blank gateway `OPENAI_MODEL` alias (the default is `gpt-5.4`).
+Set `OPENAI_API_KEY`, `OPENAI_BASE_URL`, and a non-blank gateway `OPENAI_MODEL` alias (the default is `claude-haiku-5-5`).
 Java Chat uses the shared gateway only and does not dispatch failed requests to another provider.
-Leave `app.llm.reasoning-effort` unset to preserve the gateway/model default; set one of `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, or `max` only for an explicit override.
+Chat uses the tested `app.llm.reasoning-effort=low` setting; supported overrides are `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`.
 
 3) Start the fresh generation-specific Qdrant 1.18.3 Compose project (optional but required for full RAG):
 

diff --git a/docs/retrieval-pipeline.md b/docs/retrieval-pipeline.md
@@ -252,15 +252,15 @@ When the quality message contains "less relevant" or "keyword search", an additi
 
 ### Token budgets
 
-The GPT-5.4 prompt budget is application-owned:
+The shared gateway chat prompt budget is application-owned:
 
 | Provider/model | Token budget | Constant |
 |---|---|---|
-| Shared gateway GPT-5.4 | 100,000 | `GPT54_INPUT_TOKEN_BUDGET` |
+| Shared gateway Claude Haiku 5.5 | 100,000 | `CHAT_INPUT_TOKEN_BUDGET` |
 
 Token estimation uses a conservative `(text.length() / 4) + 1` approximation (~4 characters per token for English text).
 
-GPT-5.4 RAG retrieval is reduced upstream to max 3 documents (`RAG_LIMIT_CONSTRAINED`)
+Constrained chat retrieval is reduced upstream to max 3 documents (`RAG_LIMIT_CONSTRAINED`)
 with max 600 tokens each (`RAG_TOKEN_LIMIT_CONSTRAINED`), defined in `ModelConfiguration.java`.
 
 ---

diff --git a/frontend/src/lib/components/ThinkingIndicator.svelte b/frontend/src/lib/components/ThinkingIndicator.svelte
@@ -15,7 +15,7 @@
   interface Props {
     /** Primary status message (e.g., "Searching the Java documentation index") */
     statusMessage?: string | null
-    /** Secondary details (e.g., "Embedding your question… · Provider: gpt-5.4") */
+    /** Secondary details (e.g., "Embedding your question… · Provider: claude-haiku-5-5") */
     statusDetails?: string | null
     /** Whether we've started receiving content (transitions to "generating" state) */
     hasContent?: boolean

diff --git a/mobile/Makefile b/mobile/Makefile
@@ -1,4 +1,22 @@
+# Every lane runs on the Mac build host. Any other host (the laptop, Linux peers) forwards the goals
+# and command-line variables, each shell-quoted, to a warm mirror of this checkout there through the
+# host tool remote-slot (dotfiles, ~/.local/bin). The environment, gitignored files, and make's own
+# flags do not cross, and every output (installs, archives, receipts) stays on that host. GitHub
+# Actions jobs already run on the Mac their workflow picked.
+APPLE_BUILD_HOST := haiku-7
+ifeq ($(filter $(APPLE_BUILD_HOST),$(shell hostname -s))$(GITHUB_ACTIONS),)
+APPLE_BUILD_HOST_VARIABLES := $(strip $(foreach variable,$(sort $(.VARIABLES)),$(if $(filter command line,$(origin $(variable))),'$(variable)=$(subst ','\'',$(value $(variable)))')))
+.DEFAULT_GOAL := apple-build-host
+.PHONY: apple-build-host $(MAKECMDGOALS)
+apple-build-host:
+	remote-slot run $(APPLE_BUILD_HOST) -- make $(MAKECMDGOALS) $(APPLE_BUILD_HOST_VARIABLES)
+ifneq ($(MAKECMDGOALS),)
+$(MAKECMDGOALS): apple-build-host ; @:
+endif
+else
+
 .PHONY: \
+	signing-session \
 	desktop \
 	desktop-test \
 	desktop-archive \
@@ -12,6 +30,9 @@
 	ios-archive \
 	ios-export-app-store
 
+# Every xcodebuild lane compiles through Xcode's shared per-user compilation cache.
+export XCODE_XCCONFIG_FILE := $(CURDIR)/compilation-cache.xcconfig
+
 DEVELOPMENT_TEAM := NB356A75PU
 ASC_PROFILE := csweb
 DEVELOPER_ID_APPLICATION := Developer ID Application: William Callahan (NB356A75PU)
@@ -27,6 +48,12 @@ IOS_DISTRIBUTION_DIR := iosApp/distribution
 IOS_ARCHIVE := $(IOS_DISTRIBUTION_DIR)/JavaChat.xcarchive
 IOS_APP_STORE_EXPORT := $(IOS_DISTRIBUTION_DIR)/app-store
 
+# Signed lanes unlock this Mac's build keychain through the host tool build-keychain (dotfiles,
+# ~/.local/bin), so they run from a fresh SSH session with no console login [HH0a]; a Mac without
+# one signs from its open login keychain. CI never runs a signed lane.
+signing-session:
+	@build-keychain unlock
+
 desktop:
 	xcodebuild \
 		-project desktopApp/JavaChatDesktop.xcodeproj \
@@ -45,7 +72,7 @@ desktop-test:
 		-derivedDataPath desktopApp/build-test \
 		test CODE_SIGNING_ALLOWED=NO
 
-desktop-archive:
+desktop-archive: signing-session
 	xcodebuild \
 		-project desktopApp/JavaChatDesktop.xcodeproj \
 		-scheme JavaChatDesktop \
@@ -72,7 +99,7 @@ desktop-export-developer-id: desktop-archive
 desktop-dmg: desktop-export-developer-id
 	$(MAKE) desktop-create-signed-dmg
 
-desktop-create-signed-dmg:
+desktop-create-signed-dmg: signing-session
 	rm -rf "$(DESKTOP_DMG_STAGING)"
 	mkdir -p "$(DESKTOP_DMG_STAGING)"
 	ditto \
@@ -135,7 +162,7 @@ ios-test:
 		-derivedDataPath iosApp/build-test \
 		test CODE_SIGNING_ALLOWED=NO
 
-ios-archive:
+ios-archive: signing-session
 	xcodebuild \
 		-project iosApp/JavaChat.xcodeproj \
 		-scheme JavaChat \
@@ -152,3 +179,4 @@ ios-export-app-store: ios-archive
 		-exportPath $(IOS_APP_STORE_EXPORT) \
 		-exportOptionsPlist iosApp/ExportOptions-AppStore.plist \
 		-allowProvisioningUpdates
+endif
diff --git a/mobile/README.md b/mobile/README.md
@@ -10,7 +10,8 @@ authentication session and return through `javachat://sso-callback`; the typed
 callback is then completed by the canonical Clerk client in the hosted app.
 
 The desktop shell adds standard macOS Copy Link and Open in Default Browser
-actions. The iOS target is a universal iPhone and iPad app. It follows the
+actions and requires macOS 26 on Intel or Apple silicon. The iOS target is a
+universal iPhone and iPad app that requires iOS 27. It follows the
 installed-current simulator policy: use a compatible simulator already
 installed on the Mac and identify it by UDID.
 
@@ -63,6 +64,16 @@ packaging it, then submits the signed DMG to Apple's Notary service and staples
 and validates the outer ticket. Both layers therefore retain offline
 notarization evidence after the app is copied out of the disk image.
 
+Every signing lane (`desktop-archive`, `ios-archive`, `desktop-create-signed-dmg`,
+and the exports built on them) starts with `signing-session`, which runs the
+dotfiles host tool `build-keychain unlock`, so it signs from a fresh
+noninteractive SSH session.
+
+`haiku-7` runs every lane in `mobile/Makefile`. From any other host, `make -C mobile <lane>`
+forwards the goals and command-line variables to the dotfiles host tool `remote-slot`, which
+mirrors this checkout's exact bytes into a warm `.worktrees/remote-slot-<n>` on `haiku-7` and runs
+the lane there; its outputs stay on `haiku-7`.
+
 These lanes require the matching Developer ID or Apple Distribution identities,
 profiles, a valid `csweb` App Store Connect profile, and signed agreements for
 the `william@csweb.io` account. They intentionally fail instead of falling back

diff --git a/mobile/compilation-cache.xcconfig b/mobile/compilation-cache.xcconfig
@@ -0,0 +1,6 @@
+// Loaded by every Make lane through XCODE_XCCONFIG_FILE, so package targets are
+// cached too. The cache sits at Xcode's per-user default, not in each lane's
+// DerivedData, so a lane rebuilt from an empty DerivedData replays what it
+// compiled before, and every lane and checkout reuses compiled packages.
+COMPILATION_CACHE_ENABLE_CACHING = YES
+COMPILATION_CACHE_CAS_PATH = $(HOME)/Library/Developer/Xcode/DerivedData/CompilationCache.noindex
diff --git a/mobile/desktopApp/JavaChatDesktop.xcodeproj/project.pbxproj b/mobile/desktopApp/JavaChatDesktop.xcodeproj/project.pbxproj
@@ -240,7 +240,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CLANG_ENABLE_MODULES = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
 				SDKROOT = macosx;
 				SWIFT_VERSION = 6.0;
 			};
@@ -250,7 +250,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				CLANG_ENABLE_MODULES = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 26.0;
 				SDKROOT = macosx;
 				SWIFT_VERSION = 6.0;
 			};
@@ -269,7 +269,6 @@
 				ENABLE_TESTABILITY = YES;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = JavaChatDesktop/Info.plist;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = ai.javachat;
 				PRODUCT_MODULE_NAME = JavaChatDesktop;
@@ -291,7 +290,6 @@
 				ENABLE_HARDENED_RUNTIME = YES;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = JavaChatDesktop/Info.plist;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
 				MARKETING_VERSION = 1.0;
 				PRODUCT_BUNDLE_IDENTIFIER = ai.javachat;
 				PRODUCT_MODULE_NAME = JavaChatDesktop;
@@ -309,7 +307,6 @@
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = NB356A75PU;
 				GENERATE_INFOPLIST_FILE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
 				MARKETING_VERSION = 1.0.0;
 				PRODUCT_BUNDLE_IDENTIFIER = ai.javachat.desktop.tests;
 				PRODUCT_MODULE_NAME = JavaChatDesktopTests;
@@ -329,7 +326,6 @@
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = NB356A75PU;
 				GENERATE_INFOPLIST_FILE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
 				MARKETING_VERSION = 1.0.0;
 				PRODUCT_BUNDLE_IDENTIFIER = ai.javachat.desktop.tests;
 				PRODUCT_MODULE_NAME = JavaChatDesktopTests;

diff --git a/mobile/desktopApp/JavaChatDesktop/WebShellView.swift b/mobile/desktopApp/JavaChatDesktop/WebShellView.swift
@@ -27,17 +27,11 @@ struct WebShellView: View {
             .toolbarBackgroundVisibility(.visible, for: .windowToolbar)
             .toolbar(removing: .title)
             .toolbar {
-                if #available(macOS 26.0, *) {
-                    ToolbarSpacer(.flexible)
-                    ToolbarItem {
-                        pageActionButtons
-                    }
-                    .sharedBackgroundVisibility(.hidden)
-                } else {
-                    ToolbarItem(placement: .primaryAction) {
-                        pageActionButtons
-                    }
+                ToolbarSpacer(.flexible)
+                ToolbarItem {
+                    pageActionButtons
                 }
+                .sharedBackgroundVisibility(.hidden)
             }
     }