@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/server/responses/jev-session-pin.ts

@@ -0,0 +1,203 @@
+/**
+ * Opt-in JEV session pin (#7525).
+ *
+ * A JEV Combo decides a target per request, so consecutive turns of one conversation can land on
+ * different providers and each switch starts with a cold provider prompt cache. With
+ * `sessionPin` set, a session keeps the target JEV chose for it while the session stays active.
+ *
+ * Identity. A pin is keyed by the admitted caller (the salted context principal of the matched
+ * data-plane key, or `loopback`), the Combo id and the explicit session lane from
+ * `sessionLaneIdFromRequest` (thread, session and parent-thread headers). A request without an
+ * explicit session identity never pins, and a body field such as `prompt_cache_key` is never an
+ * identity on its own.
+ *
+ * Lifetime. A pin is written only after the target JEV applied for this session completes a
+ * response, and it is refreshed by every later completion on that same target, including tool-loop
+ * continuations. It is released when the session stays idle past `ttlMs`, when any config
+ * generation change happens after it was written, when its target is not among the request's
+ * current JEV choices (disabled, removed, cooling down, quota exhausted, metered or otherwise
+ * ineligible), when its effort is no longer offered, when opted-in quota evidence reads
+ * `nearly_exhausted`, and when any target of a pinned session fails; a request that was already in
+ * flight when that failure was recorded cannot write the pin back. A cancelled send writes and
+ * releases nothing. Storage is process-local and bounded by `JEV_SESSION_PIN_CAPACITY`.
+ */
+import type { JevCandidate, JevDecision, JevDecisionBackend } from "../../combos/jev";
+import { jevQuotaSignalForTarget } from "../../combos/jev-quota";
+import { JEV_QUOTA_DEFAULT_TIERS, normalizeJevQuotaTiers, type JevQuotaTiers } from "../../combos/jev-quota-config";
+import type { JevSessionPinRelease } from "../../combos/jev-session-pin-config";
+import type { NormalizedComboConfig } from "../../combos/types";
+import { captureConfigGeneration } from "../../lib/state-store-sweeper";
+import type { OcxComboDefaultEffort, OcxConfig } from "../../types";
+import type { DataPlaneAdmission } from "../auth-cors";
+
+export const JEV_SESSION_PIN_ROUTE_REASON = "jev-session-pin";
+export const JEV_SESSION_PIN_CAPACITY = 512;
+
+interface PinEntry {
+  targetKey: string;
+  effort: OcxComboDefaultEffort | null;
+  backend: JevDecisionBackend;
+  at: number;
+  generation: number;
+}
+
+const pins = new Map<string, PinEntry>();
+/**
+ * Failure fence per session key. `forget()` stamps the key with a fresh sequence number; a request
+ * that started before that stamp may no longer write the pin back, so a concurrent completion on
+ * the same session cannot restore a target another request just saw fail. Bounded like the pins;
+ * because an evicted stamp is unknowable, a writer whose key has no stamp is also refused once any
+ * stamp was evicted after it started.
+ */
+const failureFences = new Map<string, number>();
+let failureSequence = 0;
+/** `failureSequence` at the most recent fence eviction. */
+let fenceEvictedAt = 0;
+
+function callerNamespace(admission: DataPlaneAdmission | undefined): string {
+  if (!admission) return "unadmitted";
+  if (admission.kind === "loopback") return "loopback";
+  if (admission.contextPrincipalId) return `principal:${admission.contextPrincipalId}`;
+  return admission.kind === "configured" ? `key:${admission.keyId}` : admission.kind;
+}
+
+function write(key: string, entry: PinEntry): void {
+  // Insertion order is recency order; evicting from the front drops the least recent session.
+  pins.delete(key);
+  pins.set(key, entry);
+  while (pins.size > JEV_SESSION_PIN_CAPACITY) {
+    const oldest = pins.keys().next().value;
+    if (oldest === undefined) break;
+    pins.delete(oldest);
+  }
+}
+
+function fenceFailure(key: string): void {
+  failureFences.delete(key);
+  failureFences.set(key, ++failureSequence);
+  while (failureFences.size > JEV_SESSION_PIN_CAPACITY) {
+    const oldest = failureFences.keys().next().value;
+    if (oldest === undefined) break;
+    failureFences.delete(oldest);
+    fenceEvictedAt = failureSequence;
+  }
+}
+
+export interface JevSessionPinReuse {
+  /** The pinned decision to apply instead of asking the decision backend. */
+  decision?: JevDecision;
+  /** Set when a pin existed and was released instead of reused. */
+  released?: JevSessionPinRelease;
+}
+
+export interface JevSessionPinScope {
+  /**
+   * Reuse the session's pin against this request's current JEV choices, or report its release.
+   * `quota` is passed only when the Combo opted into advisory quota evidence; it is read from
+   * loaded snapshots exactly as the decision payload would read it.
+   */
+  reuse(
+    choices: readonly JevCandidate[],
+    quota?: { config: OcxConfig; tiers?: JevQuotaTiers },
+  ): JevSessionPinReuse;
+  /**
+   * Record a completed response. With the request's applied JEV decision it (re)writes the pin
+   * when the completed target is the decided one; without one it only refreshes a pin that
+   * already names the completed target.
+   */
+  complete(completedTargetKey: string, decision: JevDecision | undefined, writerGeneration: number): void;
+  /** Drop the session's pin after a real target failure. */
+  forget(): void;
+}
+
+/** The pin scope for one Combo request, or undefined when this request can never pin. */
+export function jevSessionPinScope(args: {
+  combo: Pick<NormalizedComboConfig, "strategy" | "sessionPin">;
+  comboId: string;
+  admission: DataPlaneAdmission | undefined;
+  lane: string | undefined;
+  now?: () => number;
+}): JevSessionPinScope | undefined {
+  const ttlMs = args.combo.sessionPin?.ttlMs;
+  if (args.combo.strategy !== "jev" || ttlMs === undefined || !args.lane) return undefined;
+  const key = `${callerNamespace(args.admission)}\u0000${args.comboId}\u0000${args.lane}`;
+  const now = args.now ?? Date.now;
+  const fence = failureFences.get(key) ?? 0;
+  const startedAtSequence = failureSequence;
+  const release = (reason: JevSessionPinRelease): JevSessionPinReuse => {
+    pins.delete(key);
+    return { released: reason };
+  };
+  return {
+    reuse(choices, quota) {
+      const entry = pins.get(key);
+      if (!entry) return {};
+      if (entry.generation !== captureConfigGeneration()) return release("config_changed");
+      const at = now();
+      if (at < entry.at || at - entry.at >= ttlMs) return release("expired");
+      const candidate = choices.find(choice => choice.key === entry.targetKey);
+      if (!candidate) return release("target_unavailable");
+      if (entry.effort !== null && !candidate.reasoningEfforts.includes(entry.effort)) {
+        return release("effort_unavailable");
+      }
+      if (quota && candidate.quotaIdentity !== null) {
+        const identity = candidate.quotaIdentity ?? candidate;
+        const tiers = normalizeJevQuotaTiers(quota.tiers) ?? JEV_QUOTA_DEFAULT_TIERS;
+        const signal = jevQuotaSignalForTarget(quota.config, identity.provider, identity.model, at, tiers);
+        if (signal.tier === "nearly_exhausted") return release("quota_nearly_exhausted");
+      }
+      return {
+        decision: {
+          backend: entry.backend,
+          targetKey: entry.targetKey,
+          effort: entry.effort,
+          gate: "apply",
+          latencyMs: 0,
+          pinned: true,
+          pinReason: "session",
+        },
+      };
+    },
+    complete(completedTargetKey, decision, writerGeneration) {
+      // A config change while the response was in flight makes this completion obsolete.
+      if (writerGeneration !== captureConfigGeneration()) return;
+      // So does a failure on this session reported after this request started.
+      const currentFence = failureFences.get(key);
+      if ((currentFence ?? 0) !== fence) return;
+      if (currentFence === undefined && fenceEvictedAt > startedAtSequence) return;
+      if (!decision) {
+        const entry = pins.get(key);
+        if (entry && entry.targetKey === completedTargetKey && entry.generation === writerGeneration) {
+          write(key, { ...entry, at: now() });
+        }
+        return;
+      }
+      // Only an applied decision pins; a fail-open fallback leaves the next turn to decide again.
+      if (decision.gate !== "apply" || decision.targetKey !== completedTargetKey) return;
+      write(key, {
+        targetKey: decision.targetKey,
+        effort: decision.effort,
+        backend: decision.backend,
+        at: now(),
+        generation: writerGeneration,
+      });
+    },
+    forget() {
+      pins.delete(key);
+      fenceFailure(key);
+    },
+  };
+}
+
+/** Test-only reset, alongside the Combo recall and rotation resets. */
+export function clearJevSessionPinsForTests(): void {
+  pins.clear();
+  failureFences.clear();
+  failureSequence = 0;
+  fenceEvictedAt = 0;
+}
+
+/** Test-only view of the retained pin count. */
+export function jevSessionPinCountForTests(): number {
+  return pins.size;
+}

package/src/server/responses/main-hard-lock-routing.ts

@@ -1,8 +1,8 @@
 import type { OcxConfig } from "../../types";
 import { resolveComboId } from "../../combos";
-import { isBareOpenAiFamilyModel, previewRouteModel } from "../../router";
+import { isBareOpenAiFamilyModel, previewRouteModel, routeConcreteModel } from "../../router";
 import { resolveChosenTarget } from "./shadow-target-availability";
-import { getRoutingProfile, resolvePolicyProfileId } from "../../routing/profile";
+import { getRoutingProfile, resolvePolicyProfileId, type NormalizedRoutingProfile } from "../../routing/profile";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
 import {
   getMainAccountHardLockStatus,
@@ -12,6 +12,7 @@ import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
 import { getEligiblePoolAccounts } from "../../codex/routing/selection";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
+import { FallbackRefusedError, guardFallbackHop, type FallbackAdmission, type FallbackTarget } from "../../routing/fallback-policy";
 /** Resolves to a synchronous ownership proof, or null when the caller does not own the locked main. */
 export type MainHardLockCallerCheck = (sourceModel: string) => Promise<(() => boolean) | null>;
 
@@ -81,6 +82,7 @@ export async function applyMainHardLockFallbackOverride(
   config: OcxConfig,
   now?: number,
   callerCheck?: MainHardLockCallerCheck,
+  admission?: FallbackAdmission,
 ): Promise<MainHardLockFallbackOverride | null> {
   const parsed = rawModelOf(body);
   if (!parsed) return null;
@@ -120,6 +122,21 @@ export async function applyMainHardLockFallbackOverride(
     }
   }
 
+  // OCX-11: the reroute is a proactive model hop; refused, the request is answered with the
+  // fallback refusal and the body is left untouched.
+  const hop = guardFallbackHop(config, {
+    site: "hard-lock",
+    route: parsed.model,
+    from: { provider: OPENAI_CODEX_PROVIDER_ID, model: parsed.model },
+    to: hardLockTargetOf(config, parsed.model, fallback.model),
+    trigger: "hard_lock",
+    admission,
+    ...(now !== undefined ? { now } : {}),
+  });
+  if (!hop.ok) throw new FallbackRefusedError(hop.response);
+  // The rewrite is this site's admission: the body now names the fallback model.
+  hop.commit();
+
   parsed.raw.model = fallback.model;
   if (fallback.reasoningEffort !== undefined) {
     const reasoning = parsed.raw.reasoning;
@@ -132,3 +149,38 @@ export async function applyMainHardLockFallbackOverride(
   }
   return { sourceModel: parsed.model, targetModel: fallback.model };
 }
+
+/**
+ * The hop's destination for the fallback policy, read from config only. A routing profile picks
+ * its candidate from request-history evidence, and evaluating it here would open that index under
+ * OPENCODEX_HOME just to classify the hop (on Windows the open handle then outlives the request's
+ * home); the profile's own dispatch still evaluates it. Its declared candidates are classified
+ * instead, as the hop the profile could take: a candidate on another provider makes it a provider
+ * hop. Combos, account namespaces and concrete targets resolve from config alone.
+ */
+function hardLockTargetOf(config: OcxConfig, sourceModel: string, model: string): FallbackTarget {
+  const policyId = resolvePolicyProfileId(config, model);
+  const profile = policyId ? getRoutingProfile(config, policyId) : undefined;
+  if (profile) return profileHopTarget(config, sourceModel, profile);
+  try {
+    const route = previewRouteModel(config, model);
+    return { provider: route.providerName, model: route.modelId };
+  } catch {
+    const slash = model.indexOf("/");
+    return slash > 0 ? { provider: model.slice(0, slash), model: model.slice(slash + 1) } : { provider: "", model };
+  }
+}
+
+function profileHopTarget(config: OcxConfig, sourceModel: string, profile: NormalizedRoutingProfile): FallbackTarget {
+  const targets = profile.candidates.map((candidate): FallbackTarget => {
+    try {
+      const route = routeConcreteModel(config, candidate.provider + "/" + candidate.model);
+      return { provider: route.providerName, model: route.modelId };
+    } catch {
+      return { provider: candidate.provider, model: candidate.model };
+    }
+  });
+  return targets.find(target => target.provider !== OPENAI_CODEX_PROVIDER_ID)
+    ?? targets.find(target => target.model !== sourceModel)
+    ?? { provider: OPENAI_CODEX_PROVIDER_ID, model: sourceModel };
+}

package/src/server/responses/passthrough-delivery.ts

@@ -80,6 +80,7 @@ import {
   createResponsesItemIdPayloadRewrite,
   repairResponsesJsonItemIds,
 } from "../responses-item-id-repair";
+import { createResponsesPhaseInferenceBlockRewrite } from "../responses-phase-inference";
 import {
   payloadRewriteAsBlockRewrite,
   composeSsePayloadRewrites,
@@ -851,6 +852,9 @@ export async function deliverPassthroughResponse(
         snapshotRepairEnabled
           ? createResponsesSnapshotBlockRewrite(nativeExchange.outboundRequestBody, translatorBudget)
           : undefined,
+        route.provider.messagePhaseInference === true
+          ? createResponsesPhaseInferenceBlockRewrite(translatorBudget)
+          : undefined,
         responseEffects.plaintextV2AgentMessageToolNames.size > 0
           ? payloadRewriteAsBlockRewrite(createPlaintextV2AgentMessageCallRestoreRewrite(
             responseEffects.plaintextV2AgentMessageToolNames, responseEffects.plaintextV2AgentMessageAliasedToolNames,

package/src/server/responses/policy-fallback.ts

@@ -13,6 +13,7 @@ import { resolvePolicyProfileId } from "../../routing/profile";
 import { parseSyntheticRowId } from "../fast-row";
 import { routeConcreteModel } from "../../router";
 import { isPolicyCandidateRefusal, policyWireDestination, type PolicyRequestScope } from "./policy-request-scope";
+import { fallbackTriggerForStatus, guardFallbackHop } from "../../routing/fallback-policy";
 
 type CoreHandler = typeof handleResponsesCore;
 type CoreOptions = Parameters<CoreHandler>[3];
@@ -25,6 +26,23 @@ function candidateKey(candidate: Pick<RouteCandidateTrace, "provider" | "model">
   return `${candidate.provider}\u0000${candidate.model}`;
 }
 
+/**
+ * OCX-11: the destination a candidate physically dispatches to, after provider aliases and
+ * blockedModelRedirects, so the fallback guard compares where requests really go. A candidate
+ * that does not resolve keeps its own selector.
+ */
+function resolvedPolicyTarget(
+  config: OcxConfig,
+  candidate: Pick<RouteCandidateTrace, "provider" | "model">,
+): { provider: string; model: string } {
+  try {
+    const routed = routeConcreteModel(config, `${candidate.provider}/${candidate.model}`);
+    return { provider: routed.providerName, model: routed.modelId };
+  } catch {
+    return { provider: candidate.provider, model: candidate.model };
+  }
+}
+
 function staysWithinPolicyAfterRedirect(
   config: OcxConfig,
   policyEligibility: ReadonlySet<string>,
@@ -219,12 +237,32 @@ export async function handleResponsesWithPolicyFallback(
   policyScope.triedDestinations.add(policyScope.preparedDestination ?? policyWireDestination({
     providerName: initialTrace.selected.provider, modelId: initialTrace.selected.model,
   }));
+  let current = resolvedPolicyTarget(config, initialTrace.selected);
+  const policyRoute = `policy/${initialTrace.profile!.id}`;
 
   while (!storedPool401ReplayDispatched && await shouldHopPolicyCandidate(response, req.signal)) {
     if (req.signal.aborted) return response;
     const next = rankPolicyFallbackCandidates(initialTrace, tried)
       .find(candidate => staysWithinPolicyAfterRedirect(config, policyEligibility, candidate, policyScope.triedDestinations));
     if (!next) return response;
+    // OCX-11: the next candidate is a hop; the fallback policy decides before it is sent, on the
+    // redirected destination the guard above already validated.
+    const nextTarget = resolvedPolicyTarget(config, next);
+    const hop = guardFallbackHop(config, {
+      site: "routing-profile",
+      route: policyRoute,
+      aliases: [initialRequestedModel ?? initialTrace.requestedModel],
+      from: current,
+      to: nextTarget,
+      trigger: fallbackTriggerForStatus(response.status),
+      admission: options.admission,
+      failureStatus: response.status,
+      retryAfter: response.headers.get("retry-after"),
+    });
+    if (!hop.ok) {
+      try { await response.body?.cancel(); } catch { /* the refusal replaces this body */ }
+      return hop.response;
+    }
     tried.add(candidateKey(next));
 
     // Retain the failed response's log owner until a candidate actually replaces it. This is
@@ -243,7 +281,12 @@ export async function handleResponsesWithPolicyFallback(
             if (!Object.hasOwn(failureLog, key)) Reflect.deleteProperty(logCtx, key);
           }
           Object.assign(logCtx, failureLog);
-        } else response = nextResponse;
+        } else {
+          // Dispatched: only a candidate that was not locally skipped counts as a taken hop.
+          hop.commit();
+          response = nextResponse;
+          current = nextTarget;
+        }
         if (policyScope.preparedDestination) policyScope.triedDestinations.add(policyScope.preparedDestination);
       } catch (error) {
         const overload = requestPacingOverloadResponse(error);

package/src/server/responses/request-prepare.ts

@@ -30,6 +30,9 @@ import { recallComboForLane } from "./combo-session-recall";
 import {
   sessionLaneIdFromRequest,
   conversationIdFromResponsesRequest,
+  assignNativeLogConversationId,
+  fillHermesLogConversationFallback,
+  nativeLogConversationIdFromHeaders,
   sessionIdHeaderFromRequest,
   reasoningReplayConversationIdFromResponsesRequest,
 } from "../request-log-conversation";
@@ -160,6 +163,7 @@ import {
 import { acquireUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { applyCompactionRoutingOverride, compactionRoutingKeepsProviderIdentity } from "./compaction-routing";
 import { applyMainHardLockFallbackOverride } from "./main-hard-lock-routing";
+import { FallbackRefusedError } from "../../routing/fallback-policy";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   conversationStateBindingFromAuth,
@@ -367,10 +371,11 @@ export async function prepareResponsesRequest(
     && !shadowCallIntercepted && !shadowCallMatches && !memoryModelApplies && !threadSpawn && inboundWire === "responses") {
     try {
       options.mainHardLockFallbackOverride = await applyMainHardLockFallbackOverride(
-        body, config, undefined, mainHardLockFallbackCallerCheck(req, config, options),
+        body, config, undefined, mainHardLockFallbackCallerCheck(req, config, options), options.admission,
       );
     } catch (error) {
       if (options.abortSignal?.aborted || req.signal.aborted) return clientCancelledResponse();
+      if (error instanceof FallbackRefusedError) return error.response;
       const mapped = mapCodexAuthContextErrorToResponse(error, { now: Date.now() });
       if (mapped) return mapped;
       throw error;
@@ -601,14 +606,16 @@ export async function prepareResponsesRequest(
     // would become enough to read another caller's retained search result. Without a principal
     // bridgeSearchReplayScope yields no scope, so nothing is recorded or restored for it. The
     // field is always rewritten so an absent principal also clears one a reused holder carried.
-    const clientPrincipalId = resolveContextPrincipal(req, config, options.admission);
+    const clientPrincipalId = options.replayPrincipal
+      ? options.replayPrincipal.clientPrincipalId
+      : resolveContextPrincipal(req, config, options.admission);
     parsed._reasoningReplayScope = { ...parsed._reasoningReplayScope, clientPrincipalId };
   }
   // Prefer a pre-populated id (routed Claude) over Responses headers that may be
-  // absent or synthetically injected (session_id from prompt_cache_key).
-  if (!logCtx.conversationId) {
-    logCtx.conversationId = resolvedConversationId;
-  }
+  // absent or synthetically injected (session_id from prompt_cache_key). A Hermes-only id
+  // is a log fallback: native resolution replaces it, and it only fills an empty slot.
+  assignNativeLogConversationId(logCtx, resolvedConversationId ?? nativeLogConversationIdFromHeaders(req.headers));
+  fillHermesLogConversationFallback(logCtx, req.headers);
   // A rewritten turn logs the selector the client asked for, so the usage log never
   // claims the operator typed the fallback model themselves.
   logCtx.requestedModel = options.mainHardLockFallbackOverride?.sourceModel
@@ -1005,7 +1012,9 @@ export async function prepareResponsesRequest(
       subagentFallbackModelEligibleAccountIdsForModel,
       fallbackChain,
       candidateRoute => canPassThroughEncryptedV2AgentTask(candidateRoute, inboundWire),
+      options.admission,
     );
+    if (fallback?.refusal) return fallback.refusal;
     if (fallback) {
       (logCtx as unknown as Record<string, unknown>).subagentModelFallbackFrom = fallback.from;
       (logCtx as unknown as Record<string, unknown>).subagentModelFallbackTo = fallback.to;
@@ -1219,11 +1228,15 @@ export async function prepareResponsesRequest(
                 recoverySelectionOptions,
                 subagentFallbackAccountPreview,
                 subagentFallbackModelEligibleAccountIdsForModel,
+                undefined,
+                undefined,
+                options.admission,
               );
             } finally {
               recoverySelectionAdmission?.release();
             }
           })();
+          if (fallback?.refusal) return fallback.refusal;
           if (fallback) {
             (logCtx as unknown as Record<string, unknown>).subagentModelFallbackFrom = fallback.from;
             (logCtx as unknown as Record<string, unknown>).subagentModelFallbackTo = fallback.to;

package/src/server/responses/request-transport.ts

@@ -41,12 +41,14 @@ import {
 import {
   GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST,
   GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
+  antigravityModelRefusal,
   eligibleFailoverAccounts,
   forgetGenericFailoverRoster,
   isGenericFailoverProvider,
   isProactivePreferenceEnabled,
   preferredInitialAccount,
   refusalAwareInitialKiroAccount,
+  routeAntigravityModel,
   noteGenericPoolSelection,
 } from "../../oauth/generic-account-failover";
 import { admitGenericSessionAccount, bindGenericSessionAccount, genericSessionAccount, genericSessionAccountEligible, genericSessionAffinityEnabled, preferredGenericSessionAccount } from "../../oauth/generic-session-affinity";
@@ -79,7 +81,7 @@ import { recordAnthropicAccountQuotaFromHeadersForInstance, hasPassiveAccountQuo
 import { checkOutboundBodySize, describeOutboundBodyRefusal } from "./outbound-body-guard";
 import { formatErrorResponse } from "../../bridge";
 import { bindRouteReasoningReplayScope } from "./core-replay";
-import { sessionIdHeaderFromRequest, normalizeLogConversationId } from "../request-log-conversation";
+import { assignNativeLogConversationId, sessionIdHeaderFromRequest, normalizeLogConversationId } from "../request-log-conversation";
 import { redactSecretString } from "../../lib/redact";
 import { captureAccountAutoPauseAttempt } from "../../oauth/account-auto-pause";
 import { selectProactiveApiKeyTransport } from "../../providers/key-failover";
@@ -183,6 +185,7 @@ export async function prepareResponsesTransport(
     || route.providerName === "orcarouter-oauth"
     // runTurn transport: the replay runs on the first-event preflight in run-turn-execution.
     || route.providerName === "devin"
+    || route.providerName === "workbuddy-ai"
     || route.providerName === "dsh-account"
   ) && route.provider.authMode === "oauth";
   let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
@@ -244,6 +247,9 @@ export async function prepareResponsesTransport(
       if (candidate.provider !== route.providerName) return null;
       if (anthropicInstance) anthropicRouteDecision = currentAnthropicRouteDecision();
       if (anthropicRouteDecision && !routeCandidates(anthropicRouting!.getEligibleAnthropicAccounts(Date.now(), route.modelId), anthropicRouteDecision).includes(candidate.accountId)) return null;
+      // #7500: no admission, initial or a recovery/failover rebind, may land on an Antigravity
+      // account whose own roster omits the model. Callers abandon the send on null.
+      if (antigravityModelRefusal(config, route.providerName, candidate.accountId, route.modelId)) return null;
       const committed = genericAffinityMode
         ? admitGenericSessionAccount(config, route.providerName, oauthSelection, candidate, route.modelId, genericAffinityMode)
         : await commitOAuthAccountSelection(route.providerName, candidate.accountId, {
@@ -485,6 +491,10 @@ export async function prepareResponsesTransport(
       parsed._kiroAuthContext = kiroContext;
       if (retryParsed !== parsed) retryParsed._kiroAuthContext = { ...kiroContext };
     }
+    if (route.providerName === "workbuddy-ai") {
+      parsed._workbuddyAuthContext = snapshot.workbuddy;
+      if (retryParsed !== parsed) retryParsed._workbuddyAuthContext = snapshot.workbuddy;
+    }
     if (route.providerName === "zed") {
       // Zed signs with its own user id; `snapshot.accountId` is the local slot hash.
       const zedContext = { userId: snapshot.providerUserId ?? "" };
@@ -978,10 +988,16 @@ export async function prepareResponsesTransport(
           ?? refusalAwareId ?? (isGenericFailoverProvider(route.providerName, route.provider)
           ? preferredInitialAccount(config, route.providerName, Date.now(), route.modelId)
           : null);
+        // #7500: an Antigravity account whose own discovery omits the model is never sent to.
+        // A usable listing (or not-yet-discovered) sibling replaces it, or the request is refused.
+        const modelRoute = routeAntigravityModel(config, route.providerName,
+          proposedAccountId ?? oauthSelection?.accountId, route.modelId);
+        if (modelRoute.kind === "refuse") return formatErrorResponse(403, "permission_error", modelRoute.message);
+        const routedAccountId = modelRoute.kind === "reroute" ? modelRoute.accountId : proposedAccountId;
         // An unchanged active choice must retain the ordinary resolver's terminal-refresh
         // recovery (not the speculative-preference fallback that resolves the same dead grant).
-        const preferredAccountId = genericAffinityMode && proposedAccountId === oauthSelection?.accountId
-          ? null : proposedAccountId;
+        const preferredAccountId = genericAffinityMode && routedAccountId === oauthSelection?.accountId
+          ? null : routedAccountId;
         let safetyAlternateId: string | null = !affinityAccountId && preferredAccountId === refusalAwareId ? refusalAwareId : null;
         // Resolved account-scoped, NOT through failoverAccountSnapshot: that helper marks a
         // rotation site, and rotation sites must apply their credential through
@@ -1041,6 +1057,10 @@ export async function prepareResponsesTransport(
           resolved = await getValidAccessTokenSnapshot(route.providerName);
           usedPreferredAccount = false;
         }
+        // Resolution fallbacks can still land on an omitting account; answer with the refusal
+        // here, since the commit below would only report it as a changed selection.
+        const unlisted = antigravityModelRefusal(config, route.providerName, resolved.accountId, route.modelId);
+        if (unlisted) return formatErrorResponse(403, "permission_error", unlisted);
         const admitted = await commitResolvedOAuthSelection(resolved, safetyAlternateId === null);
         if (!admitted) return formatErrorResponse(409, "conflict_error", "OAuth account selection changed; retry the request");
         if (safetyAlternateId && admitted.accountId !== safetyAlternateId)
@@ -1104,6 +1124,7 @@ export async function prepareResponsesTransport(
           // Only genuinely accountless adapter calls leave the context undefined and use local/env fallback.
           parsed._kiroAuthContext = { ...(resolved.kiro ?? {}) };
         }
+        if (route.providerName === "workbuddy-ai") parsed._workbuddyAuthContext = resolved.workbuddy;
         if (route.providerName === "zed") {
           parsed._zedAuthContext = { userId: resolved.providerUserId ?? "" };
         }
@@ -1198,9 +1219,7 @@ export async function prepareResponsesTransport(
     codexAuthContext: admissionState.authCtx,
     forwardHeaders: requestState.selectedForwardHeaders,
   });
-  if (!logCtx.conversationId && parsed._cursorConversationId) {
-    logCtx.conversationId = normalizeLogConversationId(parsed._cursorConversationId);
-  }
+  assignNativeLogConversationId(logCtx, normalizeLogConversationId(parsed._cursorConversationId));
   logCtx.providerAdapter = adapter.name;
   // Ordinary requests receive one durable attempt only after their final initial
   // adapter is resolved. Combo children own their attempt and retries keep it.

package/src/server/responses/run-turn-execution.ts

@@ -19,7 +19,7 @@ import { releaseProviderRequestSlot, waitForProviderRequestSlot, RequestPacingQu
 import type { AdapterEventQueue } from "../../adapters/run-turn-queue";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { providerFetch } from "./fetch-helpers";
-import { normalizeLogConversationId } from "../request-log-conversation";
+import { assignNativeLogConversationId, normalizeLogConversationId } from "../request-log-conversation";
 import { normalizeDeclaredToolName, type AdapterEvent, type OcxProviderContinuationState } from "../../types";
 import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE, SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE, type OcxErrorPayload } from "../../lib/errors";
 import { SendBudgetExhaustedError, markResponseNonReplayable } from "../../lib/upstream-retry";
@@ -406,9 +406,7 @@ export async function executeResponsesRunTurn(
         releaseProviderRequestSlot(pacingSlot);
         // Cursor assigns a stable conversation id inside runTurn on the first headerless
         // turn; backfill so Logs can filter/total that opening request (#330 / #522).
-        if (!logCtx.conversationId && parsed._cursorConversationId) {
-          logCtx.conversationId = normalizeLogConversationId(parsed._cursorConversationId);
-        }
+        assignNativeLogConversationId(logCtx, normalizeLogConversationId(parsed._cursorConversationId));
         targetQueue.close();
       }
     };

package/src/server/responses/sidecar-execution.ts

@@ -51,7 +51,7 @@ import { namespacedToolName } from "../../types";
 import { providerFetch } from "./fetch-helpers";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { recordAdapterReasoning, recordAdapterTier } from "../request-log";
-import { normalizeLogConversationId } from "../request-log-conversation";
+import { assignNativeLogConversationId, normalizeLogConversationId } from "../request-log-conversation";
 import { attemptAccountChanged } from "../request-log-account-rotation";
 import { rememberResponseState } from "../../responses/state";
 import { trackStreamLifetime } from "../lifecycle";
@@ -592,9 +592,7 @@ export async function executeResponsesSidecars(
         // Cursor may assign _cursorConversationId inside the image loop's first runTurn;
         // backfill so Logs can filter/total that opening request (parity with the normal
         // runTurn branch).
-        if (!logCtx.conversationId && parsed._cursorConversationId) {
-          logCtx.conversationId = normalizeLogConversationId(parsed._cursorConversationId);
-        }
+        assignNativeLogConversationId(logCtx, normalizeLogConversationId(parsed._cursorConversationId));
         transportState.bindKeyUsageFromBridge(usage);
       },
       on429: rotateSidecarProviderOn429,