@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/providers/service-tier.ts

@@ -1,116 +1,190 @@
 import type { OcxProviderConfig } from "../types";
-import { MODEL_ADAPTER_OVERRIDE_ALLOWED } from "../types";
-import { getProviderRegistryEntry, providerModelWireDefault, type InboundWire } from "./registry";
+import { captureWireAdapterHardPins } from "../types";
+import { isCanonicalOpenAiForwardProvider } from "./openai-tiers";
+import {
+  getProviderRegistryEntry,
+  providerMatchesRegistryTransport,
+  type InboundWire,
+  type ModelWireDefault,
+} from "./registry";
+import {
+  cloneFastWire,
+  resolveFastPolicy,
+  resolveProviderAuthTransport,
+  type FastPolicyAuthority,
+  type ResolvedFastPolicy,
+} from "./fastwire";
 
 /** OpenAI-compatible adapters that can carry the standard `service_tier` field. */
 export const SERVICE_TIER_ADAPTERS = new Set(["openai-chat", "openai-responses"]);
 
-export type CapturedServiceTierAdapterAuthority = Readonly<Record<string, string>>;
+/** @deprecated A1 evolves this snapshot into the complete FastPolicyAuthority. */
+export type CapturedServiceTierAdapterAuthority = FastPolicyAuthority;
 
-const capturedAdapterAuthority = new WeakMap<object, CapturedServiceTierAdapterAuthority>();
+const capturedFastPolicyAuthorities = new WeakMap<object, FastPolicyAuthority>();
 
 type ServiceTierCapabilityProvider = Pick<
   OcxProviderConfig,
-  "adapter" | "supportsServiceTier" | "modelSupportsServiceTier" | "modelAdapters" | "baseUrl" | "authMode" | "chatServiceTier"
+  | "adapter"
+  | "supportsServiceTier"
+  | "modelSupportsServiceTier"
+  | "modelAdapters"
+  | "baseUrl"
+  | "authMode"
+  | "apiKeyTransport"
+  | "chatServiceTier"
+  | "fastWire"
 >;
 
+function cloneRegistryWireDefaults(
+  defaults: Readonly<Record<string, ModelWireDefault>> | undefined,
+): Readonly<Record<string, ModelWireDefault>> {
+  if (!defaults) return Object.freeze({});
+  const clone: Record<string, ModelWireDefault> = {};
+  for (const [modelId, declaration] of Object.entries(defaults)) {
+    clone[modelId.trim().toLowerCase()] = typeof declaration === "string"
+      ? declaration
+      : Object.freeze({ wire: declaration.wire, inbound: Object.freeze([...declaration.inbound]) });
+  }
+  return Object.freeze(clone);
+}
+
 /**
- * Read a model map by exact model identity. Service-tier capability is deliberately
- * stricter than the older model metadata maps: a family key or a colon-qualified
- * fallback must not silently advertise Fast for a sibling model that was never verified.
- * A case-insensitive exact match keeps hand-edited ids consistent with the other maps
- * without widening the model scope.
+ * Capture every registry-owned input before an asynchronous catalog flight begins.
+ * The resolver itself is pure and never reads the live provider registry.
  */
-function exactModelValue<T>(
-  record: Record<string, T> | undefined,
-  modelId: string,
-): T | undefined {
-  if (!record) return undefined;
-  if (Object.prototype.hasOwnProperty.call(record, modelId)) return record[modelId];
-  const folded = modelId.toLowerCase();
-  for (const [key, value] of Object.entries(record)) {
-    if (key.toLowerCase() === folded) return value;
+function buildFastPolicyAuthority(
+  providerName: string,
+  provider: ServiceTierCapabilityProvider,
+  registryTransportMatch: boolean,
+): FastPolicyAuthority {
+  const registry = registryTransportMatch ? getProviderRegistryEntry(providerName) : undefined;
+  const authority: FastPolicyAuthority = Object.freeze({
+    providerAdapter: provider.adapter,
+    fastWireDeclaration: cloneFastWire(
+      provider.fastWire !== undefined ? provider.fastWire : registry?.fastWire,
+      { freeze: true },
+    ),
+    modelWireOverrideAllowed: !isCanonicalOpenAiForwardProvider(provider as OcxProviderConfig),
+    authTransport: resolveProviderAuthTransport(
+      provider.adapter,
+      provider.authMode ?? registry?.authKind ?? "key",
+      provider.apiKeyTransport,
+    ),
+    capability: Object.freeze({
+      ...(provider.supportsServiceTier !== undefined ? { provider: provider.supportsServiceTier } : {}),
+      models: Object.freeze({ ...(provider.modelSupportsServiceTier ?? {}) }),
+      ...(provider.chatServiceTier !== undefined ? { chatServiceTier: provider.chatServiceTier } : {}),
+    }),
+    modelAdapters: Object.freeze({ ...(provider.modelAdapters ?? {}) }),
+    hardPins: captureWireAdapterHardPins(providerName),
+    registryWireDefaults: cloneRegistryWireDefaults(registry?.modelWireDefaults),
+  });
+  return authority;
+}
+
+export function captureFastPolicyAuthority(
+  providerName: string,
+  provider: ServiceTierCapabilityProvider,
+  registryTransportMatch: boolean,
+): FastPolicyAuthority {
+  const authority = buildFastPolicyAuthority(providerName, provider, registryTransportMatch);
+  if (Object.isFrozen(provider)) capturedFastPolicyAuthorities.set(provider, authority);
+  return authority;
+}
+
+/** @deprecated Use captureFastPolicyAuthority. The legacy inbound argument is now snapshot data. */
+export function captureServiceTierAdapterAuthority(
+  providerName: string,
+  provider: ServiceTierCapabilityProvider,
+  registryTransportMatch: boolean,
+  _inbound: InboundWire = "responses",
+): FastPolicyAuthority {
+  return captureFastPolicyAuthority(providerName, provider, registryTransportMatch);
+}
+
+function authorityForProvider(
+  provider: ServiceTierCapabilityProvider,
+  providerName?: string,
+): FastPolicyAuthority {
+  // Preserve the legacy no-name short circuit: serviceTierSupportForModel() used the
+  // provider adapter directly when no provider identity was available, so no configured
+  // override, hard pin, or registry default may participate on this path in A1.
+  if (providerName === undefined) {
+    const authority = buildFastPolicyAuthority("", provider, false);
+    return Object.freeze({
+      ...authority,
+      modelAdapters: Object.freeze({}),
+      hardPins: Object.freeze({}),
+      registryWireDefaults: Object.freeze({}),
+    });
   }
-  return undefined;
+  const captured = Object.isFrozen(provider)
+    ? capturedFastPolicyAuthorities.get(provider)
+    : undefined;
+  if (captured) return captured;
+  const registryTransportMatch = providerMatchesRegistryTransport(providerName, provider);
+  const authority = buildFastPolicyAuthority(providerName, provider, registryTransportMatch);
+  // Frozen provider snapshots cannot drift, so repeated catalog/runtime projections may safely
+  // reuse the registry lookup and detached declaration maps. Mutable configs still rebuild.
+  if (Object.isFrozen(provider)) capturedFastPolicyAuthorities.set(provider, authority);
+  return authority;
+}
+
+/** Resolve the pure Fast policy for a provider/model pair. */
+export function fastPolicyForModel(
+  provider: ServiceTierCapabilityProvider,
+  modelId: string,
+  providerName?: string,
+  inbound: InboundWire = "responses",
+): ResolvedFastPolicy {
+  return resolveFastPolicy(authorityForProvider(provider, providerName), modelId, inbound);
 }
 
 /**
- * Resolve the declared provider/model capability. An explicit provider-level false is a
- * fail-closed boundary and cannot be reopened by a model map. Otherwise an exact model
- * declaration wins over the provider default, including an explicit false. The resolver is
- * provider-local: the caller must first resolve the final provider, so identical bare model ids
- * on two providers cannot share capability state.
+ * Resolve the declared provider/model capability without applying wire availability.
+ * Kept as a public compatibility helper for callers that need the pure tri-state.
  */
 export function supportsServiceTierForModel(
   provider: Pick<OcxProviderConfig, "supportsServiceTier" | "modelSupportsServiceTier">,
   modelId: string,
 ): boolean | undefined {
-  if (provider.supportsServiceTier === false) return false;
-  return exactModelValue(provider.modelSupportsServiceTier, modelId)
-    ?? provider.supportsServiceTier;
+  const authority: FastPolicyAuthority = {
+    providerAdapter: "openai-responses",
+    fastWireDeclaration: undefined,
+    modelWireOverrideAllowed: true,
+    authTransport: "authorization_bearer",
+    capability: {
+      ...(provider.supportsServiceTier !== undefined ? { provider: provider.supportsServiceTier } : {}),
+      models: provider.modelSupportsServiceTier ?? {},
+    },
+    modelAdapters: {},
+    hardPins: {},
+    registryWireDefaults: {},
+  };
+  return resolveFastPolicy(authority, modelId).capability;
 }
 
-/** Whether the Chat serializer may emit a tier for this exact model. */
-export function canSerializeServiceTierForChatModel(
+/** Whether a Chat route may forward an arbitrary caller tier rather than canonical Fast. */
+export function canForwardForeignServiceTierForChatModel(
   provider: Pick<OcxProviderConfig, "supportsServiceTier" | "modelSupportsServiceTier" | "chatServiceTier">,
   modelId: string,
 ): boolean {
-  const exact = exactModelValue(provider.modelSupportsServiceTier, modelId);
-  if (provider.supportsServiceTier === false || exact === false) return false;
-  return provider.chatServiceTier === true || exact === true;
+  const capability = supportsServiceTierForModel(provider, modelId);
+  return capability !== false && provider.chatServiceTier === true;
 }
 
-/** Capture registry-owned model wire defaults before an asynchronous catalog flight begins. */
-export function captureServiceTierAdapterAuthority(
-  providerName: string,
-  provider: Pick<OcxProviderConfig, "adapter" | "baseUrl" | "authMode">,
-  registryTransportMatch: boolean,
-  inbound: InboundWire = "responses",
-): CapturedServiceTierAdapterAuthority {
-  const authority: Record<string, string> = {};
-  const defaults = registryTransportMatch
-    ? getProviderRegistryEntry(providerName)?.modelWireDefaults
-    : undefined;
-  for (const modelId of Object.keys(defaults ?? {})) {
-    const adapter = providerModelWireDefault(
-      providerName,
-      provider,
-      modelId,
-      MODEL_ADAPTER_OVERRIDE_ALLOWED,
-      inbound,
-    );
-    if (adapter !== undefined) authority[modelId.trim().toLowerCase()] = adapter;
-  }
-  const frozen = Object.freeze(authority);
-  capturedAdapterAuthority.set(provider, frozen);
-  return frozen;
-}
-
-/** Resolve an explicit model wire override for catalog-time capability projection. */
+/** Final adapter selected by the Fast policy's four-level wire resolver. */
 export function serviceTierAdapterForModel(
   providerName: string,
-  provider: Pick<OcxProviderConfig, "adapter" | "baseUrl" | "authMode" | "modelAdapters">,
+  provider: ServiceTierCapabilityProvider,
   modelId: string,
   inbound: InboundWire = "responses",
 ): string {
-  // Keep this lookup identical to resolveWireProtocolOverride(): configured model-adapter
-  // entries are exact-case keys, while registry defaults intentionally normalize ids there.
-  const configured = provider.modelAdapters?.[modelId];
-  if (configured !== undefined && MODEL_ADAPTER_OVERRIDE_ALLOWED.has(configured)) return configured;
-  const captured = capturedAdapterAuthority.get(provider);
-  if (captured !== undefined) {
-    return captured[modelId.trim().toLowerCase()] ?? provider.adapter;
-  }
-  return providerModelWireDefault(
-    providerName,
-    provider,
-    modelId,
-    MODEL_ADAPTER_OVERRIDE_ALLOWED,
-    inbound,
-  ) ?? provider.adapter;
+  return fastPolicyForModel(provider, modelId, providerName, inbound).adapter;
 }
 
-/** Whether the final provider/model pair can actually publish/send OpenAI service tiers. */
+/** Whether the final provider/model pair can publish/send OpenAI service tiers. */
 export function canForwardServiceTierForModel(
   provider: ServiceTierCapabilityProvider,
   modelId: string,
@@ -121,9 +195,8 @@ export function canForwardServiceTierForModel(
 }
 
 /**
- * Return the tri-state capability after resolving the model's final wire adapter.
- * `false` means either an explicit provider/model denial or an adapter that cannot carry the
- * field; `undefined` keeps the existing conservative contract for an unclassified OpenAI wire.
+ * Compatibility projection for catalog, routing, and fingerprint consumers. The new
+ * resolver carries richer eligibility internally while preserving the old tri-state bytes.
  */
 export function serviceTierSupportForModel(
   provider: ServiceTierCapabilityProvider,
@@ -131,13 +204,24 @@ export function serviceTierSupportForModel(
   providerName?: string,
   inbound: InboundWire = "responses",
 ): boolean | undefined {
-  const adapter = providerName === undefined
-    ? provider.adapter
-    : serviceTierAdapterForModel(providerName, provider, modelId, inbound);
-  if (!SERVICE_TIER_ADAPTERS.has(adapter)) return false;
-  // Treat the Chat serializer decision as authoritative so catalog metadata, routing
-  // evidence, fast-mode injection, and caller-tier stripping cannot claim support that the
-  // final request builder will omit. A provider-wide false and an exact false stay closed.
-  if (adapter === "openai-chat" && !canSerializeServiceTierForChatModel(provider, modelId)) return false;
-  return supportsServiceTierForModel(provider, modelId);
+  const policy = fastPolicyForModel(provider, modelId, providerName, inbound);
+  return serviceTierSupportFromPolicy(policy);
+}
+
+/** Compatibility projection shared by catalog, routing, and request logging. */
+export function serviceTierSupportFromPolicy(
+  policy: Pick<ResolvedFastPolicy, "eligibility" | "adapter" | "forwardCallerTier">,
+): boolean | undefined {
+  if (policy.eligibility === "eligible") return true;
+  if (policy.eligibility === "unclassified") {
+    // B1 regression guard: an unclassified chat-wire route whose final adapter will not
+    // forward any tier cannot serialize service_tier, so projecting "unknown" would let
+    // require.serviceTier: "unsupported" routing stop matching groq/ollama-class providers
+    // that main projected as false. Chat + no forwarding stays a definitive false; a
+    // chat route with chatServiceTier: true (forwarding allowed) keeps the historical
+    // unknown, as does every unclassified Responses-wire route.
+    if (policy.adapter === "openai-chat" && !policy.forwardCallerTier) return false;
+    return undefined;
+  }
+  return false;
 }

package/src/responses/parser.ts

@@ -169,6 +169,23 @@ function buildTools(tools: unknown[] | undefined): OcxTool[] | undefined {
     if (namespace) tool.namespace = namespace;
     out.push(tool);
   };
+  const pushCustom = (t: Record<string, unknown>, namespace?: string) => {
+    // Freeform custom tools are lowered to a single string `input` because chat models cannot
+    // emit Responses grammar payloads directly. Keep tool-specific input guidance scoped to the
+    // tool that owns it: leaking apply_patch syntax into `exec` or another freeform tool teaches
+    // routed models that the nested helper name is itself a callable top-level tool.
+    const inputDescription = t.name === "apply_patch"
+      ? "Raw tool input. For apply_patch, begin exactly with `*** Begin Patch` (no trailing `***`), then use its standard patch envelope."
+      : "Raw freeform input for this tool.";
+    const tool: OcxTool = {
+      name: t.name as string,
+      description: (t.description as string) ?? "",
+      parameters: { type: "object", properties: { input: { type: "string", description: inputDescription } }, required: ["input"] },
+      freeform: true,
+    };
+    if (namespace) tool.namespace = namespace;
+    out.push(tool);
+  };
   for (const t of tools) {
     if (!isObj(t)) continue;
     if (t.type === "function" && isObj(t.function) && typeof t.function.name === "string" && t.function.name.length > 0) {
@@ -178,27 +195,19 @@ function buildTools(tools: unknown[] | undefined): OcxTool[] | undefined {
     if (t.type === "function" && typeof t.name === "string") {
       pushFn(t);
     } else if (t.type === "namespace" && Array.isArray(t.tools)) {
-      // MCP tools arrive grouped under a namespace tool; flatten the inner function tools so
-      // chat-completions models receive them (round-trip restores the namespace in the bridge).
-      const ns = typeof t.name === "string" ? t.name : undefined;
+      // Codex 0.147 groups its ordinary client tools under the reserved `functions` namespace,
+      // including freeform custom tools such as code-mode `exec`. Those children are still
+      // top-level Responses tools, so flatten them without a namespace. Other namespace groups
+      // are MCP-style and keep their namespace for round-trip routing.
+      const builtinFunctions = t.name === "functions";
+      const ns = typeof t.name === "string" && !builtinFunctions ? t.name : undefined;
       for (const inner of t.tools as unknown[]) {
         if (isObj(inner) && inner.type === "function" && typeof inner.name === "string") pushFn(inner, ns);
+        else if (builtinFunctions && isObj(inner) && inner.type === "custom" && typeof inner.name === "string") pushCustom(inner);
       }
     }
     else if (t.type === "custom" && typeof t.name === "string") {
-      // Freeform custom tools are lowered to a single string `input` because chat models cannot
-      // emit Responses grammar payloads directly. Keep tool-specific input guidance scoped to the
-      // tool that owns it: leaking apply_patch syntax into `exec` or another freeform tool teaches
-      // routed models that the nested helper name is itself a callable top-level tool.
-      const inputDescription = t.name === "apply_patch"
-        ? "Raw tool input. For apply_patch, begin exactly with `*** Begin Patch` (no trailing `***`), then use its standard patch envelope."
-        : "Raw freeform input for this tool.";
-      out.push({
-        name: t.name,
-        description: (t.description as string) ?? "",
-        parameters: { type: "object", properties: { input: { type: "string", description: inputDescription } }, required: ["input"] },
-        freeform: true,
-      });
+      pushCustom(t);
     }
     else if (t.type === "tool_search") {
       // Client-executed tool discovery — the gateway to deferred tools (subagents, extra MCP tools).

package/src/responses/reasoning-replay-cache.ts

@@ -123,6 +123,36 @@ export function durableReplayDestinationIdentity(baseUrl: string | undefined): s
   return `destination:${createHash("sha256").update("destination\0").update(canonical).digest("hex")}`;
 }
 
+/**
+ * Restart-stable credential identity for the DURABLE thought-signature store (#1926).
+ *
+ * Unlike the destination, credential material may be secret (an API key), so a plain
+ * unsalted digest would turn the store file into an offline verifier for candidate keys.
+ * The identity is therefore an HMAC under a random salt persisted NEXT TO the store: the
+ * salt is not a secret escrow (it holds no credential material) but it makes every digest
+ * useless outside this installation. Full 256-bit output — no truncation.
+ *
+ * OAuth accounts use the persisted account-slot id (not the rotating token/generation):
+ * relinking a slot to a different upstream account keeps the id, but the upstream then
+ * validates signatures against the new credential and rejects stale ones — the same
+ * fail-closed backstop the destination identity relies on. Credential-scoped header
+ * overrides participate so two provider entries sharing one key but different
+ * authorization headers stay distinct, mirroring the process-local identity.
+ */
+export function durableReplayCredentialIdentity(
+  kind: "key" | "oauth" | "codex",
+  material: string | undefined,
+  headers: Record<string, string> | undefined,
+  salt: Buffer | undefined,
+): string | undefined {
+  if (!nonEmpty(material) || !salt || salt.length < 16) return undefined;
+  const overrides = credentialHeaderOverrides(headers);
+  return `credential:${createHmac("sha256", salt)
+    .update(`credential\0${kind}\0`)
+    .update(JSON.stringify([material, overrides]))
+    .digest("hex")}`;
+}
+
 /** Produce a non-reversible process-local identity for credential material. */
 export function reasoningReplayCredentialIdentity(
   kind: "key" | "oauth" | "codex",

package/src/responses/thought-signature-replay.ts

@@ -20,18 +20,23 @@
  * destination, adapter, model and credential — so a signature can only ever be replayed into
  * the turn that produced it.
  */
-import { readFileSync } from "node:fs";
+import { chmodSync, readFileSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { join } from "node:path";
 import { atomicWriteFileAsync, getConfigDir } from "../config";
 import type { OcxProviderOpaqueToolCallMetadata, OcxReasoningReplayScopeRef } from "../types";
 import { isCarryableSignature, responsesExtraContentFromProviderMetadata } from "./provider-opaque-metadata";
 
 const STORE_FILE_NAME = "thought-signature-replay.json";
+const SALT_FILE_NAME = "thought-signature-replay.salt";
 /**
- * Bumped whenever `keyFor` changes shape. v3 added the durable destination identity, so a
- * v2 file's keys can never match and are dropped on load instead of aging out invisibly.
+ * Bumped whenever `keyFor` changes shape. v3 added the durable destination identity; v4
+ * added the salted durable credential identity (#1926), so a v3 file's keys can never
+ * match and are dropped on load instead of aging out invisibly. v3 rows carried no
+ * credential information, so they are not upgradable — the next Gemini turn re-accumulates
+ * its signatures (bounded, best-effort loss identical to the pre-store status quo).
  */
-const STORE_VERSION = 3;
+const STORE_VERSION = 4;
 
 /** Bound on remembered entries; real signatures are a few hundred bytes, so this stays small. */
 const MAX_ENTRIES = 16_384;
@@ -64,6 +69,45 @@ function storePath(): string {
   return join(getConfigDir(), STORE_FILE_NAME);
 }
 
+function saltPath(): string {
+  return join(getConfigDir(), SALT_FILE_NAME);
+}
+
+let cachedSalt: Buffer | undefined;
+let saltLoaded = false;
+
+/**
+ * Installation-local salt for the durable credential identity (#1926). Created once and
+ * persisted beside the store; losing it invalidates every stored key (the entries then
+ * never match and age out), which is safe — signatures re-accumulate per turn.
+ */
+export function thoughtSignatureReplaySalt(): Buffer | undefined {
+  if (saltLoaded) return cachedSalt;
+  saltLoaded = true;
+  try {
+    const raw = readFileSync(saltPath());
+    if (raw.length >= 16) {
+      // Re-assert owner-only permissions on every load: a pre-existing file may have
+      // been created before this guard or loosened by external tooling.
+      try { chmodSync(saltPath(), 0o600); } catch { /* best effort on exotic filesystems */ }
+      cachedSalt = raw;
+      return cachedSalt;
+    }
+  } catch {
+    // fall through to mint
+  }
+  try {
+    const minted = randomBytes(32);
+    writeFileSync(saltPath(), minted, { mode: 0o600 });
+    cachedSalt = minted;
+  } catch {
+    // Unwritable config dir: no durable credential identity this process; the durable
+    // store fails closed (keyFor returns undefined) rather than keying under a shared id.
+    cachedSalt = undefined;
+  }
+  return cachedSalt;
+}
+
 function nonEmpty(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0;
 }
@@ -84,6 +128,10 @@ function keyFor(callId: string, scope: OcxReasoningReplayScopeRef | undefined):
     || !nonEmpty(identity?.providerName)
     || !nonEmpty(identity?.adapterName)
     || !nonEmpty(identity?.modelId)
+    // v4 (#1926): a missing durable credential identity means we cannot isolate this
+    // entry per credential across restarts. Refusing the key is the fail-closed choice —
+    // "credential:unknown" would let two different credentials share one durable slot.
+    || !nonEmpty(identity?.credentialDurableIdentity)
   ) return undefined;
   return JSON.stringify([
     scope.clientThreadId,
@@ -93,6 +141,7 @@ function keyFor(callId: string, scope: OcxReasoningReplayScopeRef | undefined):
     // reasoning cache's randomBytes-keyed HMAC cannot. Without it, one provider NAME
     // serving two endpoints shares signatures across both.
     identity.providerDestinationDurableIdentity ?? "destination:unknown",
+    identity.credentialDurableIdentity,
     identity.adapterName,
     identity.modelId,
     callId,
@@ -265,6 +314,8 @@ export function resetThoughtSignatureReplayForTests(): void {
   totalBytes = 0;
   loaded = false;
   persistChain = Promise.resolve();
+  cachedSalt = undefined;
+  saltLoaded = false;
 }
 
 export function thoughtSignatureReplayCountForTests(): number {
@@ -275,3 +326,22 @@ export function thoughtSignatureReplayCountForTests(): number {
 export function flushThoughtSignatureReplayForTests(): Promise<void> {
   return persistChain;
 }
+
+/**
+ * Bounded commit barrier (#1926 gap 2). All durable writes serialize onto
+ * `persistChain`, so awaiting it (with a cap) before a turn's terminal frame becomes
+ * externally visible bounds the restart window in which a handed-out signature could
+ * be lost. Bounded BEST EFFORT: on timeout the turn proceeds — availability wins, and
+ * the miss cost is one turn's re-accumulation (the pre-store status quo). The
+ * in-memory map is updated synchronously at remember() time, so within one process
+ * lifetime replay never races this barrier at all.
+ */
+export function awaitThoughtSignatureDurability(capMs = 250): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const cap = new Promise<void>(resolve => {
+    timer = setTimeout(resolve, capMs);
+  });
+  return Promise.race([persistChain, cap]).then(() => {
+    if (timer !== undefined) clearTimeout(timer);
+  });
+}

package/src/router.ts

@@ -13,6 +13,7 @@ import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
 import { PROVIDER_REGISTRY, providerCodexAccountMode } from "./providers/registry";
 import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./providers/derive";
+import { cloneFastWire } from "./providers/fastwire";
 import {
   providerMatchesRegistryTransportWithStaticGuards,
   providerSupportsLiveModelDiscovery,
@@ -333,6 +334,11 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       && registryEntry.requiresAdjacentResponsesToolResults !== undefined
       ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
       : {}),
+    ...(provider.fastWire === undefined && registryEntry.fastWire !== undefined
+      ? {
+        fastWire: cloneFastWire(registryEntry.fastWire),
+      }
+      : {}),
     ...(provider.supportsServiceTier === undefined && registryEntry.supportsServiceTier !== undefined
       ? { supportsServiceTier: registryEntry.supportsServiceTier }
       : {}),

package/src/routing/compatibility/behavior.ts

@@ -1,6 +1,8 @@
+import { modelInList } from "../../types";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
-import { PROVIDER_REGISTRY, type ProviderAuthKind } from "../../providers/registry";
-import { serviceTierSupportForModel } from "../../providers/service-tier";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import { fastPolicyForModel, serviceTierSupportForModel } from "../../providers/service-tier";
+import { resolveProviderAuthTransport } from "../../providers/fastwire";
 import { localFingerprint } from "../../lab/digest";
 import type { LabBehaviorSource, LabBehaviorValues } from "../../lab/live/types";
 
@@ -36,8 +38,17 @@ function behaviorRow(source: LabBehaviorSource, value: unknown) {
   return { source, value };
 }
 
+/**
+ * Membership for the provider's `no*Models`-style lists.
+ *
+ * Delegates to modelInList so the report matches the wire: every runtime gate these
+ * rows describe (openai-chat's sampling/reasoning/tool-choice gates, reasoning-effort's
+ * noReasoningModels) matches through modelInList, which also accepts a bare entry for a
+ * tagged id. ollama-cloud serves `gpt-oss:120b` and lists the bare `gpt-oss`, so an
+ * exact-only check here reported "temperature is sent" on a request that omits it.
+ */
 function includesModel(list: string[] | undefined, modelId: string): boolean {
-  return Array.isArray(list) && list.includes(modelId);
+  return modelInList(list, modelId);
 }
 
 function modelValue<T>(map: Record<string, T> | undefined, modelId: string): T | undefined {
@@ -57,18 +68,6 @@ function nonCredentialHeaderDigest(
   return localFingerprint("nonCredentialHeaders", rows, installationSalt);
 }
 
-function authTransportFor(
-  effective: OcxProviderConfig,
-  adapter: string,
-  mode: ProviderAuthKind,
-): string {
-  if (mode === "oauth") return "oauth_bearer";
-  if (mode === "forward") return "forwarded_authorization";
-  if (mode === "local") return "none";
-  if (adapter === "anthropic" && effective.apiKeyTransport !== "bearer") return "x_api_key";
-  return "authorization_bearer";
-}
-
 function effectiveOpenRouterRouting(effective: OcxProviderConfig, modelId: string) {
   return effective.modelOpenRouterRouting?.[modelId] ?? effective.openRouterRouting;
 }
@@ -104,6 +103,7 @@ export function resolveProductionBehaviorValues(
   const project = typeof effective.project === "string" && effective.project ? effective.project : null;
   const location = typeof effective.location === "string" && effective.location ? effective.location : null;
   const nativeLocalExec = effective.nativeLocalExec === "on" || effective.unsafeAllowNativeLocalExec === true;
+  const fastPolicy = fastPolicyForModel(effective, modelId, providerName);
 
   const values: LabBehaviorValues = {
     "wire.adapter": behaviorRow("provider_config", adapter),
@@ -115,12 +115,23 @@ export function resolveProductionBehaviorValues(
       effective.modelSuffixBracketStrip === true ? "bracket_strip" : "none",
     ),
     "auth.mode": behaviorRow("provider_config", authMode),
-    "auth.transport": behaviorRow("provider_config", authTransportFor(effective, adapter, authMode)),
+    "auth.transport": behaviorRow(
+      "provider_config",
+      resolveProviderAuthTransport(adapter, authMode, effective.apiKeyTransport),
+    ),
     "responses.stateful": behaviorRow("provider_config", effective.statelessResponses !== true),
     "responses.serviceTier": behaviorRow(
       "provider_config",
       serviceTierSupportForModel(effective, modelId, providerName) ?? null,
     ),
+    "responses.fastWireKind": behaviorRow(
+      "provider_config",
+      fastPolicy.fastWire?.kind ?? null,
+    ),
+    "responses.fastWireValue": behaviorRow(
+      "provider_config",
+      fastPolicy.fastWire?.canonicalToWire.priority ?? null,
+    ),
     "responses.snapshotRepair": behaviorRow("provider_config", effective.responsesSnapshotRepair === true),
     "responses.itemIdRepair": behaviorRow("provider_config", effective.responsesItemIdRepair ?? null),
     "limits.contextWindow": behaviorRow(