Adopt cllama v0.9.0: ordered fallback chains, Responses-only models, current model shapes

[mostlydev]

Summary

Adopts the cllama v0.9.0 feature set into the clawdapus compiler and updates the repo for current provider model shapes while keeping broad compatibility.

• Ordered fallback chains — x-claw.models.fallback (and models-defaults) accepts an ordered list, normalized to internal fallback, fallback-2, ... slots. CompileModelPolicy emits every chain link with slot fallback so cllama's declared failover walks the full chain; older cllama uses the first link only (graceful degradation). The fallback family merges atomically across defaults, service overrides, and image labels — chains never interleave — and fallback: [] is a tombstone that clears inherited chains without leaking a blank slot. Clawfile images stay single-fallback; repeated MODEL fallback fails closed pointing at the pod surface (design debate and evidence recorded on Adopt cllama Responses-era model and managed-tool contracts #359).
• Driver projection — OpenClaw receives the whole chain natively in agents.defaults.model.fallbacks (fixes a latent bug where a chain slot would emit an invalid model.fallback-2 config key); picoclaw orders chain slots numerically; Hermes/Nanobot stay primary-only while chain providers still reach policy and providers.json.
• x-claw.terminalOnSuccess — validated as a JSON boolean at claw up time (cllama silently ignores non-bools at runtime); unknown annotations pass through untouched, with an end-to-end manifest projection test.
• claw init import — preserves full source fallback chains (first link in the Clawfile, full ordered list at pod level) instead of truncating.
• Submodule → cllama v0.9.0 (released: tag + GitHub release + multi-arch ghcr.io/mostlydev/cllama:v0.9.0). Brings the Responses API adapter, ordered failover traversal, terminal-on-success mediation, reasoning-replay preservation, and current pricing (cllama SKILL path resolution can follow symlinks outside pod directory #28/Avoid advertising nonexistent surface skill files in CLAWDAPUS.md #30/Service expose ports parsed but never propagated into ResolvedSurface #31/GeneratedSkill/Generated service skill metadata is not consumed #33/feat: interactive claw init + claw agent add #36/feat(driver): add nanobot MVP driver and parity groundwork #40).
• Model shape refresh — living docs, examples, live spikes, and import defaults move to models priced by cllama v0.9.0: gpt-5.6, claude-sonnet-5, claude-opus-5, claude-haiku-4-5, gemini-3.6-flash. Historical changelog/ADR content untouched.
• Docs — ADR-019 amendment (multi-fallback contract), ADR-020 note, cllama guide section for responses-only models, changelog under Unreleased.

Verification

• go test ./..., go vet ./... (plus spike/integration tag vet) clean at head.
• Runtime proof: TestSpikeOrderedModelFailover (real cllama container + fake provider) is RED on pinned cllama v0.7.8 (failover stops at first fallback) and GREEN on released v0.9.0 (walks gpt-5.6 → gpt-4.1 → gpt-4.1-mini, primary dispatched through the Responses adapter). Re-run against the released submodule commit after the bump: PASS (42s).
• Cross-reviewed adversarially by both agents: claude implemented (9c7984a, 2db2430), codex reviewed and hardened (75dc9f2: tombstone semantics, canonical ordinal parsing, ingress-reachability docs, the failover spike), claude reviewed 75dc9f2 and the cllama pricing PR (cllama Merge nanobot phase 1 rollcall work #41).

Release notes for maintainer

DefaultCllamaTag still points at v0.7.7 by design — the bump to v0.9.0 rides the next clawdapus release (release-skill step), not this feature PR. The v0.9.0 image is already published, so the release verifier will pass.

Closes #359

🤖 Generated with Claude Code

[mostlydev]

Final adversarial review: accepted at d3605c4. The review found and fixed one last scope gap before merge: claw init default model, the canonical Clawdapus skill plus embedded mirror, the homepage, and the remaining living model examples now use the v0.9.0-priced current aliases. Verified go generate ./cmd/claw/..., go test ./..., go vet ./..., mirror consistency, no stale retired aliases on living surfaces, and the required GitHub Go check at the exact head.