From 9f6f6b1dabb61ab79cc8273e6b47920a02b4a726 Mon Sep 17 00:00:00 2001
From: Jason <jasonssdev@gmail.com>
Date: Sat, 25 Jul 2026 00:09:42 -0500
Subject: [PATCH] chore(sdd): archive init-model-picker (#128, Slice B)

Merge the llm-client, workspace-init, and doctor-command delta specs into
the main specs tree and move the change folder to the archive. Closes the
SDD cycle for the interactive model picker (both sub-slices: list_models
widening #172 and the picker #173), which closed #128.
---
 .../archive-report.md                         | 145 ++++++++++++
 .../2026-07-25-init-model-picker}/design.md   |   0
 .../2026-07-25-init-model-picker}/explore.md  |   0
 .../2026-07-25-init-model-picker}/proposal.md |   0
 .../specs/doctor-command/spec.md              |   0
 .../specs/llm-client/spec.md                  |   0
 .../specs/workspace-init/spec.md              |   0
 .../2026-07-25-init-model-picker}/tasks.md    |   0
 .../verify-report.md                          |   0
 openspec/specs/doctor-command/spec.md         |  36 +++
 openspec/specs/llm-client/spec.md             |  67 +++++-
 openspec/specs/workspace-init/spec.md         | 211 +++++++++++-------
 12 files changed, 370 insertions(+), 89 deletions(-)
 create mode 100644 openspec/changes/archive/2026-07-25-init-model-picker/archive-report.md
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/design.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/explore.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/proposal.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/specs/doctor-command/spec.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/specs/llm-client/spec.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/specs/workspace-init/spec.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/tasks.md (100%)
 rename openspec/changes/{init-model-picker => archive/2026-07-25-init-model-picker}/verify-report.md (100%)

diff --git a/openspec/changes/archive/2026-07-25-init-model-picker/archive-report.md b/openspec/changes/archive/2026-07-25-init-model-picker/archive-report.md
new file mode 100644
index 0000000..66b5a72
--- /dev/null
+++ b/openspec/changes/archive/2026-07-25-init-model-picker/archive-report.md
@@ -0,0 +1,145 @@
+# Archive Report: init-model-picker (Slice B, Issue #128)
+
+**Status**: ARCHIVED (CLOSED)
+**Date**: 2026-07-25
+**Change**: init-model-picker (Slice B of GitHub issue #128)
+**Result**: Issue #128 is now CLOSED
+
+## Summary
+
+Interactive model picker for `openkos init` has been fully implemented, verified, reviewed, and merged to main across two sequential PRs (Slice B-i and B-ii). The change replaces free-text model prompts with a numbered picker over installed chat models, properly excluding embedding models by family classification. Both sub-slices have passed strict TDD verification with 100% spec compliance (27/27 scenarios), full test pass (2106 tests), and zero critical or blocking findings.
+
+## Merged PRs
+
+- **PR #172**: init-model-picker B-i — List models widening + doctor adaptation
+  - Merged to main at commit 0652a64
+  - Changes: Widened `OllamaClient.list_models()` to expose per-model family via new `InstalledModel` dataclass
+  - Doctor checks 3/4/5 adapted to new shape (behavior-preserving)
+  - Status: MERGED ✅
+
+- **PR #173**: init-model-picker B-ii — Interactive model picker
+  - Merged to main (after B-i)
+  - Changes: Added `_pick_chat_model()` with numbered TTY prompt, embedding-model exclusion, graceful degradation
+  - Status: MERGED ✅
+
+## Artifact Tracking
+
+All SDD artifacts persisted to both Engram (for audit trail) and openspec folder:
+
+| Artifact | Engram ID | Topic Key | Status |
+|----------|-----------|-----------|--------|
+| Proposal | 1908 | sdd/init-model-picker/proposal | ✅ ARCHIVED |
+| Spec (main + 3 deltas) | 1909 | sdd/init-model-picker/spec | ✅ ARCHIVED |
+| Design | 1910 | sdd/init-model-picker/design | ✅ ARCHIVED |
+| Tasks | 1911 | sdd/init-model-picker/tasks | ✅ ARCHIVED |
+| Apply Progress | 1912 | sdd/init-model-picker/apply-progress | ✅ (reference only) |
+| Verify Report | 1913 | sdd/init-model-picker/verify-report | ✅ ARCHIVED |
+| Archive Report | — | sdd/init-model-picker/archive-report | ✅ ARCHIVED (this file) |
+
+## Specs Merged to Main
+
+All three affected domains have been updated with the new requirements:
+
+### llm-client (`openspec/specs/llm-client/spec.md`)
+- **MODIFIED**: "List Installed Models" — now returns per-model family via `details.family` field
+- **ADDED**: "Family-Based Embedding Model Classification" — helper to distinguish embedding vs. chat models by family
+
+### workspace-init (`openspec/specs/workspace-init/spec.md`)
+- **MODIFIED**: "Static openkos.yaml Template" — precedence now includes interactive picker when preconditions hold
+- **ADDED**: "Interactive Model Picker Over Installed Chat Models" — numbered list with default marked, selection persisted
+- **ADDED**: "Graceful Degradation When Ollama Unreachable Or No Chat Models" — fallback to typed prompt, no hard-fail, workspace still created
+- **ADDED**: "Non-Interactive Paths Bypass The Picker" — `--model` flag wins; non-TTY silent default
+- **ADDED**: "Embedding Models Excluded From Picker Candidates" — embedding models filtered from picker list
+
+### doctor-command (`openspec/specs/doctor-command/spec.md`)
+- **ADDED**: "Doctor Behavior Unchanged By list_models() Contract Widening" — checks 3/4/5 report identical outcomes on new shape
+
+## Verification Summary
+
+**Verdict**: PASS ✅
+
+- **Spec Compliance**: 27/27 scenarios across 8 requirements (3 domains)
+  - llm-client: 2 requirements, 7 scenarios ✅
+  - doctor-command: 1 requirement, 3 scenarios ✅
+  - workspace-init: 5 requirements, 17 scenarios ✅
+- **Task Completion**: 20/20 tasks complete (10 B-i, 10 B-ii)
+- **Tests**: 2106 passed (2099 B-i baseline + 7 net new), exit 0
+- **Quality Gate**: ruff check ✅, ruff format ✅, mypy ✅
+- **Critical Findings**: 0
+- **Blockers**: 0
+
+## Review Findings
+
+**B-i (PR #172)**: Reliability lens
+- Result: 0 findings ✅
+
+**B-ii (PR #173)**: Resilience lens
+- Result: 1 WARNING (bounded-reprompt exhaustion path not explicitly tested) + 1 SUGGESTION (none)
+- Resolution: Both findings fixed with regression tests; WARNING is non-blocking (not a spec scenario, design-level safety feature documented in D3)
+
+## Change Scope
+
+**Sub-slice B-i** (~215 lines):
+- `InstalledModel` dataclass + `is_embedding_model()` classification helper in ollama.py
+- Widened `list_models()` return type with family parsing
+- Doctor checks 3/4/5 adapted to extract `.tag` from new shape
+- Init preflight updated for new shape
+- Tests: test_ollama.py, test_doctor.py updated
+
+**Sub-slice B-ii** (~205 lines):
+- `_pick_chat_model()` function implementing numbered picker
+- `_resolve_model` TTY branch delegation
+- Embedding-model filtering and graceful degradation on Ollama unreachable/zero-chat
+- Tests: test_init.py extended with picker scenarios
+
+**Total**: ~370 lines under 800-line budget, split into two sequential PRs per delivery strategy
+
+## Design Decisions
+
+| Decision | Choice | Rationale |
+|----------|--------|-----------|
+| Return type widening | `list[InstalledModel]` dataclass | mypy-strict, attribute access, immutable, extensible |
+| Embedding classification | Module-level `_EMBEDDING_FAMILIES` frozenset + helper | Declarative, reusable, case-insensitive, no-exclusion-on-ambiguity |
+| Picker degradation | Broad `except Exception` fallback to typed prompt | Mirrors post-write preflight tolerance, never hard-fails |
+| Doctor adaptation | Extract `.tag` at call sites, keep `model_tag_matches` unchanged | Minimal, behavior-preserving, confined contract change |
+
+## Rollback Plan
+
+If needed, revert both PR #172 and PR #173. No migration required — no persisted data or config-format changes. `list_models()` reverts to `list[str]`, picker removed, precedence returns to flag > typed prompt > default.
+
+## Issue Closure
+
+**GitHub Issue #128**: CLOSED ✅
+
+This SDD change (Slice B) completes issue #128's scope:
+- ✅ Picker replaces free-text prompt on TTY
+- ✅ Embedding models excluded via family classification
+- ✅ `--model` flag preserved
+- ✅ Non-TTY silent default preserved
+- ✅ Graceful degradation when Ollama unavailable
+- ✅ Workspace always created on success
+- ✅ Doctor behavior unchanged on new shape
+- ✅ All tests green
+- ✅ No critical/blocking issues
+
+Slice A (config hardening) was previously merged in a separate SDD change.
+
+## Archive Contents
+
+This archive folder (`openspec/changes/archive/2026-07-25-init-model-picker/`) contains:
+- `proposal.md` — User intent and scope
+- `design.md` — Architecture decisions and file changes
+- `explore.md` — Investigation and current state analysis
+- `tasks.md` — Full task breakdown with 20/20 completeness
+- `verify-report.md` — Full verification evidence (27/27 scenarios, 2106 tests)
+- `specs/` folder with delta specs (llm-client, workspace-init, doctor-command)
+
+All artifacts have been synced to the main specs tree. The original `openspec/changes/init-model-picker/` folder may be removed.
+
+## Sign-Off
+
+Archive report persisted:
+- Filesystem: `openspec/changes/archive/2026-07-25-init-model-picker/archive-report.md`
+- Engram: `sdd/init-model-picker/archive-report` (for traceability)
+
+SDD cycle for init-model-picker is CLOSED. Ready for next change.
diff --git a/openspec/changes/init-model-picker/design.md b/openspec/changes/archive/2026-07-25-init-model-picker/design.md
similarity index 100%
rename from openspec/changes/init-model-picker/design.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/design.md
diff --git a/openspec/changes/init-model-picker/explore.md b/openspec/changes/archive/2026-07-25-init-model-picker/explore.md
similarity index 100%
rename from openspec/changes/init-model-picker/explore.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/explore.md
diff --git a/openspec/changes/init-model-picker/proposal.md b/openspec/changes/archive/2026-07-25-init-model-picker/proposal.md
similarity index 100%
rename from openspec/changes/init-model-picker/proposal.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/proposal.md
diff --git a/openspec/changes/init-model-picker/specs/doctor-command/spec.md b/openspec/changes/archive/2026-07-25-init-model-picker/specs/doctor-command/spec.md
similarity index 100%
rename from openspec/changes/init-model-picker/specs/doctor-command/spec.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/specs/doctor-command/spec.md
diff --git a/openspec/changes/init-model-picker/specs/llm-client/spec.md b/openspec/changes/archive/2026-07-25-init-model-picker/specs/llm-client/spec.md
similarity index 100%
rename from openspec/changes/init-model-picker/specs/llm-client/spec.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/specs/llm-client/spec.md
diff --git a/openspec/changes/init-model-picker/specs/workspace-init/spec.md b/openspec/changes/archive/2026-07-25-init-model-picker/specs/workspace-init/spec.md
similarity index 100%
rename from openspec/changes/init-model-picker/specs/workspace-init/spec.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/specs/workspace-init/spec.md
diff --git a/openspec/changes/init-model-picker/tasks.md b/openspec/changes/archive/2026-07-25-init-model-picker/tasks.md
similarity index 100%
rename from openspec/changes/init-model-picker/tasks.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/tasks.md
diff --git a/openspec/changes/init-model-picker/verify-report.md b/openspec/changes/archive/2026-07-25-init-model-picker/verify-report.md
similarity index 100%
rename from openspec/changes/init-model-picker/verify-report.md
rename to openspec/changes/archive/2026-07-25-init-model-picker/verify-report.md
diff --git a/openspec/specs/doctor-command/spec.md b/openspec/specs/doctor-command/spec.md
index 886adda..324ba1e 100644
--- a/openspec/specs/doctor-command/spec.md
+++ b/openspec/specs/doctor-command/spec.md
@@ -314,6 +314,42 @@ is introduced by this requirement.
   `[PASS]`/`[FAIL]`/`[SKIP] <label>` format, with remediation (when present)
   as an indented `-> <fix command>` line — no new line shape is introduced
 
+### Requirement: Doctor Behavior Unchanged By list_models() Contract Widening
+
+Doctor's chat-model-installed and embedding-model-installed checks MUST
+continue to report the exact same pass/fail outcomes as before
+`list_models()`'s return contract widened to include per-model family.
+Outcomes MUST depend solely on tag-normalized matching (`model_tag_matches`)
+against the returned entries' tags, unaffected by the added family field —
+this is a no-behavior-change requirement guarding the refactor.
+
+#### Scenario: Configured model present in installed tags still passes
+
+- GIVEN Ollama reports installed models via the widened `list_models()`
+  shape, and the configured chat model tag matches one of them (exact or
+  `:latest`-normalized)
+- WHEN `openkos doctor` runs
+- THEN the chat model-installed check prints `[PASS]`, identical to its
+  outcome before the contract change
+
+#### Scenario: Configured model absent still fails with pull remediation
+
+- GIVEN Ollama reports installed models via the widened `list_models()`
+  shape, and no entry matches the configured chat model tag
+- WHEN `openkos doctor` runs
+- THEN the chat model-installed check prints `[FAIL]` with a pull
+  remediation naming the configured tag, identical to its outcome before
+  the contract change
+
+#### Scenario: Embedding-model check outcome also unchanged
+
+- GIVEN Ollama reports installed models via the widened `list_models()`
+  shape, and the configured `embedding_model` tag matches an installed
+  entry
+- WHEN `openkos doctor` runs
+- THEN the embedding-model-installed check prints `[PASS]`, identical to
+  its outcome before the contract change
+
 ### Requirement: Git and Git-Filter-Repo Availability Check
 
 `doctor` MUST report whether `git` is resolvable on PATH and whether
diff --git a/openspec/specs/llm-client/spec.md b/openspec/specs/llm-client/spec.md
index 0cdcd00..2549978 100644
--- a/openspec/specs/llm-client/spec.md
+++ b/openspec/specs/llm-client/spec.md
@@ -129,21 +129,42 @@ exercise every success and error path without a running Ollama server.
 
 ### Requirement: List Installed Models
 
-`OllamaClient` MUST provide `list_models()` returning the installed model
-tags via `GET {host}/api/tags`. The method MUST read each installed entry
-defensively, preferring a `model` field and falling back to a `name` field
-when `model` is absent. A connection failure or timeout MUST raise
-`OllamaUnavailable`; any other non-200 response or a 200 response whose
-body is not valid JSON MUST raise `OllamaError` — following the same
-error-mapping discipline as `chat()`. `list_models()` MUST remain
+`OllamaClient` MUST provide `list_models()` returning, per installed model,
+at least the tag and the model family via `GET {host}/api/tags`. The
+method MUST read each installed entry defensively, preferring a `model`
+field and falling back to a `name` field when `model` is absent, for the
+tag — this D2 field-variance handling is unchanged. It MUST additionally
+surface the entry's family, sourced from the `details.family` field when
+present. WHEN an entry's `details` object or `family` field is absent, the
+entry MUST still be returned (never dropped), with its family
+absent/unknown rather than fabricated. A connection failure or timeout
+MUST raise `OllamaUnavailable`; any other non-200 response or a 200
+response whose body is not valid JSON MUST raise `OllamaError` — following
+the same error-mapping discipline as `chat()`. `list_models()` MUST remain
 config-free: the `llm` package MUST NOT import `openkos.config`.
 
-#### Scenario: Reachable server returns installed tags
+#### Scenario: Reachable server returns installed tags with family
 
-- GIVEN an `OllamaClient` and a reachable Ollama server
-- WHEN `list_models()` is called and the server responds 200 with a list
-  of installed model entries
-- THEN it returns the installed model tags as a list of strings
+- GIVEN a reachable Ollama server whose `/api/tags` response includes a
+  chat model entry with `details.family: "qwen"` and an embedding model
+  entry with `details.family: "bert"`
+- WHEN `list_models()` is called
+- THEN both entries are returned, each carrying its tag and its family
+  (`"qwen"` and `"bert"` respectively)
+
+#### Scenario: Entry missing details/family is still returned
+
+- GIVEN a reachable server whose `/api/tags` response includes an entry
+  with no `details` object or no `family` field
+- WHEN `list_models()` is called
+- THEN that entry is still returned (not dropped), with family
+  absent/unknown
+
+#### Scenario: Tag extraction preserves model-or-name fallback
+
+- GIVEN an installed entry with a `name` field but no `model` field
+- WHEN `list_models()` is called
+- THEN the entry's tag is taken from `name`, unchanged from prior behavior
 
 #### Scenario: Unreachable server raises OllamaUnavailable
 
@@ -159,6 +180,28 @@ config-free: the `llm` package MUST NOT import `openkos.config`.
 - WHEN `list_models()` is called
 - THEN `OllamaError` is raised rather than an unhandled exception
 
+### Requirement: Family-Based Embedding Model Classification
+
+A pure classification helper MUST determine whether an installed model
+entry is an embedding model, based on its family: family `"bert"` (and any
+other embedding families explicitly documented at design time) MUST
+classify as embedding. A missing or unrecognized family MUST classify as
+NON-embedding — ambiguity MUST NEVER cause a model to be excluded from
+chat candidates.
+
+#### Scenario: Known embedding family classifies as embedding
+
+- GIVEN an installed entry with family `"bert"`
+- WHEN the classification helper is applied
+- THEN the entry is classified as an embedding model
+
+#### Scenario: Missing or unknown family classifies as non-embedding
+
+- GIVEN an installed entry with no family, or a family not in the
+  documented embedding-family set
+- WHEN the classification helper is applied
+- THEN the entry is classified as NON-embedding
+
 ### Requirement: Model Tag Matching Tolerates Bare And Latest-Qualified Tags
 
 A pure `model_tag_matches(configured, installed)` function MUST return
diff --git a/openspec/specs/workspace-init/spec.md b/openspec/specs/workspace-init/spec.md
index 8062ec8..6a7c833 100644
--- a/openspec/specs/workspace-init/spec.md
+++ b/openspec/specs/workspace-init/spec.md
@@ -91,46 +91,35 @@ and nothing in `openkos.yaml` duplicates it. The packaged template pins
 `review: true`, `default_sensitivity: private`, `freshness_window: 7d`,
 `raw: raw/`, and `bundle: bundle/` — these MUST remain byte-identical to
 the template regardless of the chosen model. The `model:` value MUST
-resolve with precedence flag > interactive prompt > default, default
+resolve with precedence flag > interactive selection > default, default
 `qwen3:8b`, and MUST be written into the template via constrained
 plain-text token replacement of a single placeholder, never a YAML dumper
-or serializer. A colon `:` MUST be allowed in the value, since the default
+or serializer. On an interactive TTY run with no `--model` flag, "interactive
+selection" is the numbered picker (see Interactive Model Picker Over
+Installed Chat Models) when its preconditions hold, or the typed prompt
+otherwise (see Graceful Degradation When Ollama Unreachable Or No Chat
+Models). A colon `:` MUST be allowed in the value, since the default
 `qwen3:8b` and Ollama `name:tag` tags contain one. An empty or blank
 (post-trim) value, or a value containing whitespace, a quote (`'` or `"`),
 `#`, or a newline, MUST be rejected before any file is written.
 `validate_model` MUST additionally reject, case-insensitively, any value
 that is EXACTLY one of the YAML 1.1 boolean/null literals recognized by
 PyYAML's default resolver: `yes`, `no`, `true`, `false`, `on`, `off`,
-`null`, and `~`, in any casing PyYAML accepts for those words (including
-but not limited to `Yes`, `YES`, `No`, `NO`, `True`, `TRUE`, `False`,
-`FALSE`, `On`, `ON`, `Off`, `OFF`, `Null`, `NULL`). This rejection MUST be
-exact-token, not substring — a value that merely contains a reserved word
-as part of a longer token (e.g. `yesmodel`, `notus`) MUST still be
-accepted, since it does not resolve to a YAML boolean/null on round-trip.
-(Previously: the template pinned a static `model: qwen3:8b` line with no
-per-workspace substitution of any field. Additionally: `validate_model`
-rejected blank/whitespace values, quotes, `#`, newlines, and
-leading/trailing-colon or leading-dash forms, but did not reject the YAML
-1.1 reserved boolean/null word set, allowing values like `yes` to be
-written and then re-read as the Python `bool` `True`.)
+`null`, and `~`, in any casing PyYAML accepts for those words. This
+rejection MUST be exact-token, not substring — a value that merely
+contains a reserved word as part of a longer token (e.g. `yesmodel`,
+`notus`) MUST still be accepted.
+(Previously: on a TTY, resolution always used a free-text
+`typer.prompt("Model", default=DEFAULT_MODEL)`, accepting any validated
+token typed by the user, regardless of whether that model was installed
+or was a chat model.)
 
 #### Scenario: Byte-identical template except model, default path
 
 - GIVEN a successful init with no `--model` flag on a non-TTY stdin
 - WHEN the generated `openkos.yaml` is compared to the packaged template
 - THEN the content is identical except the `model:` line resolves to
-  `qwen3:8b`, written with no prompt shown
-
-#### Scenario: No directory-derived field, regardless of directory name
-
-- GIVEN a directory with any name, including one long enough or containing
-  consecutive spaces such that it would previously have risked corruption
-  if written into a YAML scalar
-- WHEN init succeeds and `openkos.yaml` is written
-- THEN the file contains no field derived from the directory name, all
-  fields other than `model:` match the packaged template exactly, and the
-  directory name causes no corruption of the `model:` line or any other
-  line, independent of the directory's name
+  `qwen3:8b`, written with no prompt or picker shown
 
 #### Scenario: Flag override selects the model
 
@@ -139,83 +128,52 @@ written and then re-read as the Python `bool` `True`.)
 - THEN `openkos.yaml` contains `model: gemma3` and every other field is
   byte-identical to the packaged template
 
-#### Scenario: TTY prompt, accept the default
+#### Scenario: TTY, picker preconditions hold, accept the default
 
-- GIVEN an empty current directory, no `--model` flag, and stdin is a TTY
-- WHEN `openkos init` runs and the user accepts the offered default at the
-  prompt
-- THEN the prompt's displayed default is `qwen3:8b`, and `openkos.yaml`
-  contains `model: qwen3:8b`
+- GIVEN an empty current directory, no `--model` flag, stdin is a TTY,
+  Ollama is reachable, and at least one chat model is installed
+- WHEN `openkos init` runs and the user presses Enter at the picker
+- THEN `openkos.yaml` contains `model: qwen3:8b` (the marked-recommended
+  default)
 
-#### Scenario: TTY prompt, custom value
+#### Scenario: TTY, picker preconditions hold, custom selection
 
-- GIVEN an empty current directory, no `--model` flag, and stdin is a TTY
-- WHEN `openkos init` runs and the user enters `mistral` at the prompt
-- THEN `openkos.yaml` contains `model: mistral`
+- GIVEN an empty current directory, no `--model` flag, stdin is a TTY,
+  and the picker lists `qwen3:8b` and `llama3.1:8b` as chat candidates
+- WHEN the user selects `llama3.1:8b` by its list number
+- THEN `openkos.yaml` contains `model: llama3.1:8b`
 
 #### Scenario: Non-TTY, no flag, silent default
 
 - GIVEN an empty current directory, no `--model` flag, and stdin is not a
   TTY
 - WHEN `openkos init` runs
-- THEN no prompt is shown, and `openkos.yaml` contains `model: qwen3:8b`
-
-#### Scenario: Flag wins even when stdin is a TTY
-
-- GIVEN an empty current directory, stdin is a TTY, and `--model mistral`
-  is passed
-- WHEN `openkos init` runs
-- THEN no prompt is shown, and `openkos.yaml` contains `model: mistral`
+- THEN no prompt or picker is shown, and `openkos.yaml` contains
+  `model: qwen3:8b`
 
 #### Scenario: Blank input is rejected
 
 - GIVEN an empty current directory
-- WHEN `openkos init` is run with `--model` set to an empty string, or a
-  string that is empty or whitespace-only after trimming (flag or prompt
-  path)
+- WHEN `openkos init` is run with `--model` set to an empty or
+  whitespace-only string
 - THEN init exits non-zero, no workspace artifact is created, and
   `openkos.yaml` does not exist
 
 #### Scenario: Unsafe token is rejected
 
 - GIVEN an empty current directory
-- WHEN `openkos init --model` is passed a value containing whitespace
-  (e.g. `bad model`), a quote (`'` or `"`), `#`, or a newline
+- WHEN `openkos init --model` is passed a value containing whitespace,
+  a quote, `#`, or a newline
 - THEN init exits non-zero, no workspace artifact is created, and
   `openkos.yaml` does not exist
 
-#### Scenario: Colon-containing tag is accepted verbatim
-
-- GIVEN an empty current directory
-- WHEN `openkos init --model mistral:7b` runs, or `openkos init` runs and
-  resolves to the default `qwen3:8b`
-- THEN init succeeds, and `openkos.yaml` contains the `model:` line with
-  the colon-containing tag written verbatim (`model: mistral:7b` or
-  `model: qwen3:8b` respectively)
-
 #### Scenario: Reserved YAML boolean/null word is rejected, case-insensitively
 
 - GIVEN an empty current directory
 - WHEN `openkos init --model` is passed any of `yes`, `no`, `true`,
-  `false`, `on`, `off`, `null`, `~`, or a case variant such as `Yes`,
-  `YES`, `TRUE`, or `Off`
-- THEN `validate_model` raises `ValueError` with a clear message, init
-  exits non-zero, no workspace artifact is created, and `openkos.yaml`
-  does not exist
-
-#### Scenario: Reserved-word substring is still accepted
-
-- GIVEN an empty current directory
-- WHEN `openkos init --model` is passed `yesmodel` or `notus` — tags that
-  contain a reserved word as a substring but are not exactly one
-- THEN init succeeds and `openkos.yaml` contains that exact tag, unmodified
-
-#### Scenario: Legitimate existing tags remain accepted
-
-- GIVEN an empty current directory
-- WHEN `openkos init --model` is passed `qwen3:8b`, `llama3.1:8b`, or
-  `bge-m3`
-- THEN init succeeds and `openkos.yaml` contains that exact tag
+  `false`, `on`, `off`, `null`, `~`, or a case variant
+- THEN `validate_model` raises `ValueError`, init exits non-zero, and
+  `openkos.yaml` does not exist
 
 ### Requirement: Config Model Field Type Enforcement
 
@@ -260,6 +218,105 @@ unchanged.
 - THEN `Config.review` is `False`, preserving the existing "is not None, not
   truthiness" fallback behavior for other fields
 
+### Requirement: Interactive Model Picker Over Installed Chat Models
+
+On an interactive (TTY) `openkos init` run where `--model` was not given,
+and a reachable Ollama server reports at least one installed chat model
+(after family-based embedding exclusion), the system MUST present a
+numbered selection list of those chat models, with the packaged default
+(`DEFAULT_MODEL`) visibly marked as recommended. Pressing Enter with no
+input MUST select the marked default. The selected tag MUST be persisted
+into `openkos.yaml` under the existing `model:` resolution and validation
+rules.
+
+#### Scenario: Picker lists installed chat models with default marked
+
+- GIVEN a reachable Ollama server with chat models `qwen3:8b` and
+  `llama3.1:8b` installed
+- WHEN the picker is shown on a TTY `openkos init` run
+- THEN both models are listed as numbered options and `qwen3:8b` is
+  visibly marked "(recommended)"
+
+#### Scenario: Selecting a number picks that model
+
+- GIVEN the picker lists `qwen3:8b` as option 1 and `llama3.1:8b` as
+  option 2
+- WHEN the user enters `2`
+- THEN `llama3.1:8b` is the selected model
+
+#### Scenario: Empty input picks the default
+
+- GIVEN the picker is shown with `qwen3:8b` marked recommended
+- WHEN the user presses Enter without typing a number
+- THEN `qwen3:8b` is the selected model
+
+#### Scenario: Selection is persisted to openkos.yaml
+
+- GIVEN the user selects a model from the picker
+- WHEN init completes
+- THEN `openkos.yaml`'s `model:` line contains exactly that selected tag
+
+### Requirement: Graceful Degradation When Ollama Unreachable Or No Chat Models
+
+WHEN Ollama is unreachable during the picker's probe, OR Ollama is
+reachable but reports zero chat models after family-based embedding
+exclusion, `init` MUST fall back to the typed-prompt/packaged-default
+resolution behavior instead of showing a picker, and MUST NOT hard-fail:
+the workspace MUST still be created and the process MUST exit 0 (subject
+to the existing Refusal Idempotency and Write Failure Handling
+requirements). The picker's probe MUST run before any file is written
+(Phase A) and MUST NOT alter Phase A's existing refusal semantics.
+
+#### Scenario: Unreachable Ollama falls back, workspace still created
+
+- GIVEN Ollama is unreachable at the picker's probe time, no `--model`
+  flag, and stdin is a TTY
+- WHEN `openkos init` runs
+- THEN no picker is shown, the typed-prompt/default flow resolves the
+  model, the workspace is created, and the process exits 0
+
+#### Scenario: Only embedding models installed falls back, no crash
+
+- GIVEN Ollama is reachable but every installed model classifies as an
+  embedding model (e.g. only `bge-m3`, family `"bert"`)
+- WHEN `openkos init` runs on a TTY with no `--model` flag
+- THEN no picker is shown, the typed-prompt/default flow resolves the
+  model, no exception propagates, and the workspace is created
+
+### Requirement: Non-Interactive Paths Bypass The Picker
+
+An explicit `--model <tag>` flag MUST resolve the model outright with no
+picker and no typed prompt shown, even when stdin is a TTY. WHEN stdin is
+not a TTY and no `--model` flag was given, `init` MUST silently resolve to
+the packaged default with no picker and no prompt shown.
+
+#### Scenario: --model flag wins, no picker even on a TTY
+
+- GIVEN stdin is a TTY and `--model mistral` is passed
+- WHEN `openkos init` runs
+- THEN no picker or prompt is shown, and `openkos.yaml` contains
+  `model: mistral`
+
+#### Scenario: Non-TTY silently takes the default, no picker
+
+- GIVEN stdin is not a TTY and no `--model` flag is passed
+- WHEN `openkos init` runs
+- THEN no picker or prompt is shown, and `openkos.yaml` contains the
+  packaged default
+
+### Requirement: Embedding Models Excluded From Picker Candidates
+
+Installed models classified as embedding models (per the llm-client
+family-based classification, e.g. `bge-m3` with family `"bert"`) MUST NOT
+appear as selectable entries in the picker's numbered list.
+
+#### Scenario: Embedding model never offered as a picker choice
+
+- GIVEN Ollama has both `qwen3:8b` (chat) and `bge-m3` (embedding,
+  family `"bert"`) installed
+- WHEN the picker is shown
+- THEN only `qwen3:8b` appears in the numbered list; `bge-m3` is absent
+
 ### Requirement: Static AGENTS.md Template
 
 `AGENTS.md` MUST be a byte-identical copy of the packaged template, with no