@akagilnc/pi-workflow-roles 0.1.3733 → 0.1.3741

package/dist/public-cli/option-definitions.js

@@ -1068,7 +1068,7 @@ const SUPPORT_COMMAND_HELP = {
     },
     config: {
         command: "config",
-        summary: "Persistent seat model, labor-engine, host, and auto-resume defaults.",
+        summary: "Persistent seat model, labor-engine, host, and auto-resume defaults. Host providers live in ~/.ak-roles/host-providers.json (owner-edited).",
         usage: [
             "ak-role config set <seat> <provider/model[:thinking]> [<seat> <spec> ...]",
             "ak-role config unset <gatekeeper|inspector|notary>",
@@ -1077,8 +1077,6 @@ const SUPPORT_COMMAND_HELP = {
             "ak-role config set-host <seat> <name>",
             "ak-role config unset-host <seat>",
             "ak-role config set-auto-resume-limit <N>",
-            "ak-role config set-provider-alias <provider> <host> <alias>",
-            "ak-role config unset-provider-alias <provider> <host>",
         ],
         examples: [
             "ak-role config set judge openai-codex/gpt-5.6-sol:high",
@@ -1086,7 +1084,6 @@ const SUPPORT_COMMAND_HELP = {
             "ak-role config set-engine judge opus",
             "ak-role config set-host judge grok-build",
             "ak-role config set-auto-resume-limit 3",
-            "ak-role config set-provider-alias xai hermes xai-oauth",
         ],
     },
     help: {

package/dist/public-role-summons.js

@@ -70,9 +70,6 @@ function projectSeatEngine(seat) {
 function projectSeatHost(seat) {
   return seat.host === void 0 ? {} : { host: seat.host };
 }
-function projectSeatModel(seat) {
-  return seat.selection === void 0 ? {} : { model: seat.selection };
-}
 async function createSummonEnv(options) {
   const [{ piDurablePrincipalAuthority }, { appendPiSessionCustomEntry, createPiRoleTurnHost }] = await Promise.all([
     import("./pi/durable-principal.js"),
@@ -122,6 +119,13 @@ async function createSummonEnv(options) {
       }
     };
   }
+  const { loadHostProvidersTable, projectHostFacingProvider } = await import("./public-cli/host-providers.js");
+  const hostFacingSelection = options.seat.selection === void 0 ? void 0 : projectHostFacingProvider(
+    options.seat.selection,
+    hostName,
+    loadHostProvidersTable(options.home),
+    options.home
+  );
   return {
     home: options.home,
     principalAuthority,
@@ -131,7 +135,7 @@ async function createSummonEnv(options) {
     roleTurnHost,
     cwd: options.cwd,
     credentials: options.credentials,
-    ...projectSeatModel(options.seat),
+    ...hostFacingSelection === void 0 ? {} : { model: hostFacingSelection },
     ...projectSeatEngine(options.seat),
     ...projectSeatHost(options.seat)
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.3733",
+  "version": "0.1.3741",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/souls/countersign.md

@@ -11,7 +11,7 @@
 2 第二发源立法：
 适用 ADR——由你自行检索，按票面触及的席位、接缝、术语在 docs/adr 与 CONTEXT.md 查全，票面引没引都算——并逐键列出其决策键；质量法、审刑院法典；
 
-3 第二法源合法性检查：判断第二法源 以及 输入的 prombt等 对比第一法源是否有超出或不足，曲解。如有，除非有陛下原话批准，否则直接封驳 要求改正或陛下批准。
+3 第二法源合法性检查：判断第二法源 以及 输入的 prompt等 对比第一法源是否有超出或不足，曲解。如有，除非有陛下原话批准，否则直接封驳 要求改正或陛下批准。
 
 **二、相抵。** 票面，相关票与在飞分支与法源有无抵触。
 

package/souls/judge.md

@@ -1,68 +1,21 @@
-# Judge Soul（大理寺）
-
-你是大理寺。卷由别人提交，你只负责逐条审理、裁决和判断是否收敛；不承担施工，
-不提交变更。票庭审读（开工前的方案听证）归给事中，不归你；你判的是已提交的
-案卷。
-
-## 证据
-
-- 主张不是证据。核对引文、代码、测试与历史；只把指向当前 head 的材料当作
-  当前事实。修复者的自述不能替代新 head 上的机械验证和独立复查。
-- 机器已执行并 typed 落卷的确定性事实（受理结果、配对回执、时间区间、哈希
-  之类——判据：出自机器执行，而非任何 LLM 之口），信指针加抽查即可，不必
-  逐项重跑重算；一切 LLM 主张照旧亲验。
-- 每条问题都必须有显式记录和处置。严重度不是入场券；不得沉默遗漏，
-  也不得安静降级。驳回须给出可核验的理由和证据。
-
-## 案面
-
-**开工先立案。** 开庭先枚举本单适用法源，逐项对表，引用不等于适用。
-**finding 的事实与处方分开对宪：事实成立而处方违宪时，保留事实，驳回处方或
-改开合宪处方。** 再以法源与当前一手证据独立完成双向抽样重推（误删与该删未删
-同查），然后落判词。判词与驳回须锚到具体法源；无可依法源时不得以「无法可依」
-收敛，应上抛请立法。立案先于按派单收缩的审理范围。
-
-**法源位阶：已落定 ADR 的具体决策在本仓优先于宪法通则；疑似违宪须核其所绑陛下原话与 decision key。已批断言不容翻。** 动过既有断言的改动须溯源到票面授权、ADR 或
-先前裁定；权威仍在而相抵触即为 blocking。改动触及治理法文件（含 `docs/adr/`、
-`CONTEXT.md`）而票面未授权时，实质审理并在判词中点名；确属宪法问题则上抛。
-
-**全部提交物都是案面**：票面、计划、处置清单、packet、派单措辞与输入 prompt、
-代码、测试。举证责任由所审材料决定，不由派单指定。
-
-**审查范围绑定本次授权的 target/range**，覆盖范围内完整变更与未声明的生产
-默认行为；不得因派单或票面清单缩减举证责任。派单非法缩 scope：可施工纠正判
-`continue`；属陛下取舍、法源冲突或无法安全裁定判 `escalate`。
-
-**落判前逐项过改动清单，与票面双向对表。** 每项改动标明由票面哪条驱动，
-标不出来的即为夹带；票面有要求而清单没有的即为缺口（夹带的默认值、护栏、
-平行机制、仅测试用的生产钩子同论）。多与少同为缺陷，逐条处置；清单未列全
-不得收敛。
-
-## 修理原则
-
-删除或简化根因优先于增加平行机制。提出或批准护栏前必答三问：①哪个真实、
-可复现的失败证明需要它？②哪个接缝拥有它要维护的不变式？③为什么删除或简化
-根因不足以解决这类失败？
-
-审查修复波及面，区分原始缺陷所需改动、修复引入后再修的改动和无依据的新机制；
-后两类主导时优先删除/简化。超出本次授权的取舍必须上抛。**一轮轮只加不减的
-修复流，本身就是该上报的病。**
-
-**测试质量亲审。** 亲审测试是否忠实证明所主张行为并向 spec 负责；准绳唯 quality-law。
-
-## 判词
-
-合法判词只有三种，含义相对所审材料的举证责任：
-
-- `converged` — 适用举证责任下的事项均已明确处置。修内司/将作监的提交，建议有
-  本轮御史台无 p2 及以上 finding 为辅证（p 级由你自行判定；被你驳回的不计数）。
-- `continue` — 仍有可施工的问题；给出清晰、可验证的修理正文。
-- `escalate` — 存在必须由陛下决定的门槛、相互冲突的法源，或依据失败走势
-  与专业证据已无法形成安全裁定；写明问题和可选项。
-
-**送修正文由你执笔——判词即包。** 首轮可薄（finding + 法源锚点 + 边界）；有
-病史则综合（病史全列、方向可钉、拆除清单明文）。同缝反复、根因不明、范围
-持续发散、疑跨接缝或 flake 即为发散，送修单中要求先做最小化、证据驱动的
-诊断定根因。
-
-送修仅含尚未结清、须派施工的根因类；已结清项、过程账与双向抽样不得入送修。
+Judge Soul（大理寺）
+你是大理寺。负责逐条裁决并判断是否收敛；不施工做修复。票庭归给事中
+审理
+一、立第一法源。 起居录、全局宪法，仓级治理文件，
+二、立第二法源。自行查全相关 ADR（票面引了也不等于适用，自行判断。）、CONTEXT.md、票面、派单、输入的prompt等决策相关，你自身自带的质量/测试/审核等法典。
+三、核第二法源：如有违反第一法源且没有陛下原话授权的，直接上呈。
+四、核案。 全审本次授权的 target/range。计划、处置清单、packet、代码、测试都是案面，举证责任由材料决定，不由派单指定。
+每项改动须有票面依据，每项要求须有落实或明确处置；相抵、夹带、缺口一并查（标不出来的即为夹带；有要求而清单没有的即为缺口（夹带的默认值、护栏、平行机制、仅测试用的生产钩子同论）），未授权改治理法文件，未声明的生产默认行为同论。清单不全不得收敛。复审亦全审授权范围，上轮问题不划定本轮案面。
+五、裁断。 主张不是证据。一切 LLM 主张须亲验；当前事实只认当前 head，修复者自述不能替代新 head 上的机械验证与独立复查。出自机器执行，而非任何 LLM 之口的确定性事实，核指针加抽查即可。
+事实与处方分判：事实成立而处方违法源，保留事实，驳回处方或另开合法处方。 每条问题显式记录和处置，严重度由你裁定，不因级别低而遗漏或暗降；裁决与驳回须锚定法源和证据。依当前一手证据独立双向抽样重推，误删与该删未删同查。
+测试质量须亲审。取证与同类复核依《审法》；复杂度、测试质量与成本依《质量法》，不另立一套标准。
+删简根因优先。提出或批准护栏，须说明真实可复现的失败、不变式所属接缝，以及为何删简根因不足。
+区分原缺陷所需改动、修复自身造成的返工、无依据的新机制；后两类主导时优先拆除或简化。同缝反复、根因不明、范围发散、疑跨接缝或 flake，先做最小化、证据驱动的诊断，不继续猜修。一轮轮只加不减，本身就是须上报的问题。
+判词
+
+* converged——署：适用举证责任下的事项均已明确处置。施工提交推荐有本轮御史台无 p2 及以上 finding 为辅证，严重度由你裁定，已驳回的不计。
+* continue——封驳：仍有授权内可纠正的问题，给出需修理的问题类别与法源，具体发现可作为案例/证据，不作施工白名单；授权范围内同类问题一并处置，超出授权的取舍上呈。一次扫净所有类别。
+* escalate——上呈：缺少法源、法源冲突、取舍超出授权，或依据失败走势与证据已无法安全裁定；写明争点与选项。
+
+
+封驳时 有病史须列全相关失败经过，钉明方向。送修只含未结清、须施工的根因类，不带已结清项、过程账和双向抽样记录。

package/souls/notary.md

@@ -6,7 +6,7 @@
 
 **二、核旨**：用已读法源 核受审之物
 	**票面与判词**——有没有加戏：每一条**重大决策／设计／改变实际行为的**机制／约束条款逐条与陛下原话的意思是否相符？
-	ADR Content 票面 prombt 具体实现 被审衙门的输出 等相关产物 是否合法
+	ADR Content 票面 prompt 具体实现 被审衙门的输出 等相关产物 是否合法
 
 **不因票面已签押、判词已引用而免核**。
 案例示例：

package/src/public-cli/cli.ts

@@ -28,14 +28,17 @@ import {
   setPersistentSeatConfig,
   setPersistentSeatEngine,
   setPersistentSeatHost,
-  setProviderHostAlias,
-  unsetProviderHostAlias,
   validatePublicCliConfigAxes,
   type CredentialProviders,
   type EffectiveSeat,
   type InvocationModelOverride,
   type PublicCliConfig,
 } from "./config.ts";
+import {
+  loadHostProvidersTable,
+  projectHostFacingProvider,
+  renderHostProvidersTable,
+} from "./host-providers.ts";
 import { seatModelOnly } from "./registry.ts";
 import { CliUsageError } from "./cli-errors.ts";
 import type { CliIo } from "./cli-io.ts";
@@ -428,23 +431,36 @@ function createRoleEnvironment(
 
   // #617 DK-3: resume and new legs share one seat resolution — model/host/engine
   // come from the live seat table (invocation flag → persistent → default).
+  // #788 expectation 2: select a registered host first; only then project the
+  // host-facing provider (table > unique directory > fail). Bad host never
+  // reaches model resolution.
+  const roleTurnHost = resolveRoleTurnHost(env, {
+    role,
+    seat: options.seat,
+    principalAuthority: env.principalAuthority!,
+    ...(extraPiArgs === undefined ? {} : { extraPiArgs }),
+    ...(timeoutMs === undefined ? {} : { timeoutMs }),
+  });
+  const hostFacingSelection =
+    options.seat.selection === undefined
+      ? undefined
+      : projectHostFacingProvider(
+          options.seat.selection,
+          options.seat.host,
+          loadHostProvidersTable(options.home),
+          options.home,
+        );
   return {
     home: options.home,
     principalAuthority: env.principalAuthority!,
     agentDir: options.agentDir,
     sessionAppender: appendPiSessionCustomEntry,
     packageRoot: env.packageRoot,
-    roleTurnHost: resolveRoleTurnHost(env, {
-      role,
-      seat: options.seat,
-      principalAuthority: env.principalAuthority!,
-      ...(extraPiArgs === undefined ? {} : { extraPiArgs }),
-      ...(timeoutMs === undefined ? {} : { timeoutMs }),
-    }),
+    roleTurnHost,
     cwd: options.cwd,
     ...(options.credentials === undefined ? {} : { credentials: options.credentials }),
     ...(env.correlationId === undefined ? {} : { correlationId: env.correlationId }),
-    ...(options.seat.selection === undefined ? {} : { model: options.seat.selection }),
+    ...(hostFacingSelection === undefined ? {} : { model: hostFacingSelection }),
     ...projectSeatEngine(options.seat),
     ...projectSeatHost(options.seat),
     ...(timeoutMs === undefined ? {} : { timeoutMs }),
@@ -771,7 +787,7 @@ function renderHelp(): string {
     "Persistent config: ak-role config set <seat> <provider/model[:thinking]> | unset <gatekeeper|inspector|notary>",
     "Persistent engine (callable roles): ak-role config set-engine <seat> <name> | unset-engine <seat>",
     "Persistent host (callable roles): ak-role config set-host <seat> <name> | unset-host <seat>",
-    "Provider host alias: ak-role config set-provider-alias <provider> <host> <alias> | unset-provider-alias <provider> <host>",
+    "Host providers: ~/.ak-roles/host-providers.json (owner-edited; table > unique host directory > fail)",
     "Host resolution: --host → persistent seat host → pi (resume uses the same order; #617)",
     "Effective seats: ak-role roles",
   );
@@ -900,7 +916,7 @@ function renderConfigDisplaySeat(row: ConfigDisplaySeat): string {
   return `${row.seat}\t${row.source}\t${model}\t${engine}\t${host}`;
 }
 
-function renderConfig(config: PublicCliConfig): string {
+function renderConfig(config: PublicCliConfig, home: string): string {
   const lines: string[] = ["seat\tsource\tmodel\tengine\thost"];
   const rows = projectConfigDisplaySeats(config);
   if (rows.length === 0) {
@@ -912,17 +928,9 @@ function renderConfig(config: PublicCliConfig): string {
   }
   // #422: show the effective auto-resume ceiling (configured value or default).
   lines.push(`autoResumeLimit\t${config.autoResumeLimit ?? AUTO_RESUME_LIMIT}`);
-  // #778: owner-registered provider→host aliases (disk face; seats stay as written).
-  const aliases = config.providerAliases;
-  if (aliases !== undefined) {
-    for (const provider of Object.keys(aliases).sort()) {
-      const byHost = aliases[provider]!;
-      for (const host of Object.keys(byHost).sort()) {
-        lines.push(`providerAlias\t${provider}\t${host}\t${byHost[host]}`);
-      }
-    }
-  }
-  return `${lines.join("\n")}\n`;
+  // #788: owner host-providers table as written on disk (separate file).
+  const hostProvidersBlock = renderHostProvidersTable(loadHostProvidersTable(home));
+  return `${lines.join("\n")}\n${hostProvidersBlock}`;
 }
 
 async function runConfigCommand(
@@ -942,7 +950,7 @@ async function runConfigCommand(
       );
       return 0;
     }
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 
@@ -971,7 +979,7 @@ async function runConfigCommand(
       config = setPersistentSeatConfig(config, seat, parseModelSpec(spec));
     }
     await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 
@@ -993,7 +1001,7 @@ async function runConfigCommand(
       seat,
     );
     await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 
@@ -1011,7 +1019,7 @@ async function runConfigCommand(
       throw new CliUsageError(error instanceof Error ? error.message : String(error), { cause: error });
     }
     await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 
@@ -1035,7 +1043,7 @@ async function runConfigCommand(
       );
     }
     await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 
@@ -1057,7 +1065,7 @@ async function runConfigCommand(
       );
     }
     await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 
@@ -1090,48 +1098,7 @@ async function runConfigCommand(
     let config = await loadAndValidateConfig(home, packageRoot);
     config = setAutoResumeLimit(config, converted);
     await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
-    return 0;
-  }
-
-  // #778: owner-registered provider→host alias (opaque strings; no host catalog).
-  if (args[0] === "set-provider-alias") {
-    if (args.length !== 4) {
-      throw new CliUsageError(
-        "usage: ak-role config set-provider-alias <provider> <host> <alias>",
-      );
-    }
-    let config = await loadAndValidateConfig(home, packageRoot);
-    try {
-      config = setProviderHostAlias(config, args[1]!, args[2]!, args[3]!);
-    } catch (error) {
-      throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
-        { cause: error },
-      );
-    }
-    await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
-    return 0;
-  }
-
-  if (args[0] === "unset-provider-alias") {
-    if (args.length !== 3) {
-      throw new CliUsageError(
-        "usage: ak-role config unset-provider-alias <provider> <host>",
-      );
-    }
-    let config = await loadAndValidateConfig(home, packageRoot);
-    try {
-      config = unsetProviderHostAlias(config, args[1]!, args[2]!);
-    } catch (error) {
-      throw new CliUsageError(
-        error instanceof Error ? error.message : String(error),
-        { cause: error },
-      );
-    }
-    await savePublicCliConfig(config, home);
-    io.stdout(renderConfig(config));
+    io.stdout(renderConfig(config, home));
     return 0;
   }
 

package/src/public-cli/config.ts

@@ -54,15 +54,6 @@ export type PersistentSeatConfig = {
   host?: string;
 };
 
-/**
- * #778: owner-registered provider name by host. Keyed seat-table provider →
- * host → host-facing provider. Package code carries the map only — no built-in
- * pairs. Unregistered (provider, host) pairs pass the seat provider through.
- */
-export type ProviderHostAliases = Readonly<
-  Record<string, Readonly<Record<string, string>>>
->;
-
 export type PublicCliConfig = {
   seats: Partial<Record<PublicConfigurableSeat, PersistentSeatConfig>>;
   /**
@@ -72,11 +63,6 @@ export type PublicCliConfig = {
    * bound (ADR 0035).
    */
   autoResumeLimit?: number;
-  /**
-   * #778: owner-registered provider→host aliases. Sibling of `seats`; never
-   * invents pairs. Absent or empty means pure pass-through.
-   */
-  providerAliases?: ProviderHostAliases;
   /**
    * #592: opaque seat rows this build does not own. Carried through every
    * parse→save cycle so a write never silently erases neighboring-line rows
@@ -307,81 +293,6 @@ export function setAutoResumeLimit(
   return { ...config, autoResumeLimit: parseAutoResumeLimit(limit) };
 }
 
-function requireNonEmptyToken(value: string, label: string): string {
-  const trimmed = value.trim();
-  if (trimmed === "") {
-    throw new Error(`${label} must be a non-empty string`);
-  }
-  return trimmed;
-}
-
-/**
- * #778: register one owner provider→host alias. Opaque strings only — no host
- * catalog check and no built-in provider pairs. Sibling keys (seats included)
- * are preserved.
- */
-export function setProviderHostAlias(
-  config: PublicCliConfig,
-  provider: string,
-  host: string,
-  alias: string,
-): PublicCliConfig {
-  const from = requireNonEmptyToken(provider, "provider");
-  const hostName = requireNonEmptyToken(host, "host");
-  const to = requireNonEmptyToken(alias, "alias");
-  const previous = config.providerAliases ?? {};
-  return {
-    ...config,
-    providerAliases: {
-      ...previous,
-      [from]: {
-        ...(previous[from] ?? {}),
-        [hostName]: to,
-      },
-    },
-  };
-}
-
-/** #778: drop one owner provider→host alias. Empty map collapses to absent. */
-export function unsetProviderHostAlias(
-  config: PublicCliConfig,
-  provider: string,
-  host: string,
-): PublicCliConfig {
-  const from = requireNonEmptyToken(provider, "provider");
-  const hostName = requireNonEmptyToken(host, "host");
-  const previous = config.providerAliases;
-  if (previous === undefined || previous[from] === undefined) return config;
-  const { [hostName]: _dropped, ...restHosts } = previous[from]!;
-  const nextForProvider =
-    Object.keys(restHosts).length === 0 ? undefined : restHosts;
-  const { [from]: _provider, ...restProviders } = previous;
-  const nextAliases =
-    nextForProvider === undefined
-      ? restProviders
-      : { ...restProviders, [from]: nextForProvider };
-  if (Object.keys(nextAliases).length === 0) {
-    const { providerAliases: _gone, ...rest } = config;
-    return rest;
-  }
-  return { ...config, providerAliases: nextAliases };
-}
-
-/**
- * #778: project seat-table provider through owner aliases for one host.
- * Unregistered pairs return the seat selection unchanged (pass-through).
- */
-export function applyProviderHostAlias(
-  selection: SeatModelConfig | undefined,
-  host: string,
-  aliases: ProviderHostAliases | undefined,
-): SeatModelConfig | undefined {
-  if (selection === undefined || aliases === undefined) return selection;
-  const mapped = aliases[selection.provider]?.[host];
-  if (mapped === undefined) return selection;
-  return { ...selection, provider: mapped };
-}
-
 /**
  * Config-parse seam: persistent call axes belong to PUBLIC_CALLABLE_ROLES;
  * engine names need only path-safety syntax (no closed material catalog;
@@ -476,7 +387,6 @@ export function buildSeatModelCliArgs(model: SeatModelConfig | undefined): strin
 function serializePublicCliConfig(config: PublicCliConfig): {
   seats: Record<string, unknown>;
   autoResumeLimit?: number;
-  providerAliases?: ProviderHostAliases;
 } {
   return {
     // Known seats win on any key clash; by construction the two maps are
@@ -488,48 +398,9 @@ function serializePublicCliConfig(config: PublicCliConfig): {
     ...(config.autoResumeLimit === undefined
       ? {}
       : { autoResumeLimit: config.autoResumeLimit }),
-    ...(config.providerAliases === undefined ||
-    Object.keys(config.providerAliases).length === 0
-      ? {}
-      : { providerAliases: config.providerAliases }),
   };
 }
 
-function parseProviderHostAliases(value: unknown): ProviderHostAliases {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("public CLI config.providerAliases must be an object");
-  }
-  const out: Record<string, Record<string, string>> = {};
-  for (const [provider, byHost] of Object.entries(value as Record<string, unknown>)) {
-    if (provider.trim() === "") {
-      throw new Error("public CLI config.providerAliases provider key must be non-empty");
-    }
-    if (byHost === null || typeof byHost !== "object" || Array.isArray(byHost)) {
-      throw new Error(
-        `public CLI config.providerAliases[${provider}] must be an object`,
-      );
-    }
-    const hosts: Record<string, string> = {};
-    for (const [host, alias] of Object.entries(byHost as Record<string, unknown>)) {
-      if (host.trim() === "") {
-        throw new Error(
-          `public CLI config.providerAliases[${provider}] host key must be non-empty`,
-        );
-      }
-      if (typeof alias !== "string" || alias.trim() === "") {
-        throw new Error(
-          `public CLI config.providerAliases[${provider}][${host}] must be a non-empty string`,
-        );
-      }
-      hosts[host] = alias;
-    }
-    if (Object.keys(hosts).length > 0) {
-      out[provider] = hosts;
-    }
-  }
-  return out;
-}
-
 function parsePublicCliConfig(value: unknown): PublicCliConfig {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("public CLI config must be an object");
@@ -537,7 +408,6 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
   const record = value as {
     seats?: unknown;
     autoResumeLimit?: unknown;
-    providerAliases?: unknown;
     unknownSeats?: unknown;
   };
   // #422 round-trip preservation: the sibling top-level key must survive every
@@ -546,15 +416,6 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
   if (record.autoResumeLimit !== undefined) {
     autoResumeLimit = parseAutoResumeLimit(record.autoResumeLimit);
   }
-  // #778: same survival duty as autoResumeLimit — owner aliases must not vanish
-  // on an unrelated seat write.
-  let providerAliases: ProviderHostAliases | undefined;
-  if (record.providerAliases !== undefined) {
-    const parsed = parseProviderHostAliases(record.providerAliases);
-    if (Object.keys(parsed).length > 0) {
-      providerAliases = parsed;
-    }
-  }
   // #592: opaque bucket may already be present on an in-memory round-trip
   // (load→set→save calls parse again). Carry it before seats iteration so a
   // disk-shaped seats map and a memory-shaped bucket both survive.
@@ -572,7 +433,6 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
   const withOpaque = (seats: PublicCliConfig["seats"]): PublicCliConfig => ({
     seats,
     ...(autoResumeLimit === undefined ? {} : { autoResumeLimit }),
-    ...(providerAliases === undefined ? {} : { providerAliases }),
     ...(Object.keys(unknownSeats).length === 0 ? {} : { unknownSeats }),
   });
   if (record.seats === undefined) {
@@ -818,23 +678,13 @@ export function resolveEffectiveSeat(
     }
   }
 
-  const withAxes = attachHostAxis(
+  // Seat axes only. Host-facing provider projection (#788) runs after the host
+  // is selected as registered — never before (bad host must not reach model).
+  return attachHostAxis(
     attachEngineAxis(modelSeat, config, invocation),
     config,
     invocation,
   );
-  // #778: host-facing provider is the seat-table value after owner aliases.
-  // Disk seats stay as written; only the effective selection is projected.
-  const selection = applyProviderHostAlias(
-    withAxes.selection,
-    withAxes.host,
-    config.providerAliases,
-  );
-  if (selection === undefined) {
-    const { selection: _dropped, ...rest } = withAxes;
-    return rest;
-  }
-  return { ...withAxes, selection };
 }
 
 export function effectiveSeatConfigurations(