@claudexor/orchestrator 3.6.0 → 3.8.1

package/dist/delegatedHome.d.ts

@@ -1,5 +1,4 @@
-import type { ConfinementHost } from "@claudexor/core";
-import type { AccessProfile, HarnessConfinement, WorkspaceEnvelope } from "@claudexor/schema";
+import type { AccessProfile, RecordedAppliedAttemptFacts as HistoricalAppliedAttemptFacts, WorkspaceEnvelope } from "@claudexor/schema";
 import type { WorkspaceManager } from "@claudexor/workspace";
 /** What one attempt's harness HOME actually resolved to, and whether it is scoped. */
 export interface ScopedHarnessHome {
@@ -9,78 +8,35 @@ export interface ScopedHarnessHome {
     isolated: boolean;
     /** The scoped home directory, or null when the attempt inherits the operator's. */
     homeDir: string | null;
-    /** The APPLIED OS boundary, or null when this attempt runs without one. */
-    confinement: HarnessConfinement | null;
-    /**
-     * Why this attempt got NO boundary, when it asked for one and the host had
-     * none. Null both when a boundary WAS applied and when none was ever asked
-     * for — an ordinary run is not "unconfined", it is out of scope, and the
-     * terminal gate below depends on being able to tell those apart.
-     */
-    confinementUnavailableReason: string | null;
+    /** Why no additional outer boundary applies; null for ordinary/non-mutating runs. */
+    outerBoundaryUnavailableReason: string | null;
 }
 /** Access profiles under which the harness can modify the filesystem. */
 export declare function isMutatingAccess(access: AccessProfile): boolean;
 /**
- * Whether this run's lanes should be told to stand their own sandbox down.
- *
- * Only a delegated run asks for an engine-provided boundary, and only a host
- * that can actually provide one earns the trade. Telling a harness to drop its
- * native sandbox where Claudexor will NOT replace it is a pure loss — strictly
- * worse than never having asked — so the two conditions are one expression
- * rather than a flag the caller passes and a check nobody makes.
- */
-export declare function externallyConfinedLane(delegated: boolean, host?: ConfinementHost): boolean;
-/** Roots the confinement is drawn against; overridable so tests never touch the real home. */
-export interface ConfinementRoots {
-    operatorHome: string;
-    runtimeRoot: string;
-    nativeStateRoot: string;
-}
-export declare function defaultConfinementRoots(): ConfinementRoots;
-/**
- * Decide the harness HOME and the OS boundary one attempt runs under.
+ * Decide the harness HOME one attempt runs under.
  *
  * Unchanged for ordinary runs: an ISOLATED envelope gets the envelope's scoped
  * home, while an IN-PLACE attempt deliberately inherits the operator's native
  * environment so a harness whose native session store hangs off `$HOME` can
  * resume its vendor conversation.
  *
- * A DELEGATED run (`execution.delegated`) is scoped either way, and that is a
- * BEHAVIORAL CHANGE against that deliberate design — live + agent is exactly
- * the configuration a delegated mutating subagent uses. It is taken knowingly:
- * the caller is a machine orchestrator that owns the workspace, and the
- * operator's real `$HOME` holds material no delegated harness may read, above
- * all `~/.claudexor/v3/daemon/token`, which grants the entire control API.
- *
- * THE SCOPED HOME IS NOT THE BOUNDARY. It redirects `~`-relative lookups and
- * nothing more; the token above is one absolute path away, and a live probe
- * read it out of an ordinary `workspace_write` agent run. So a delegated
- * MUTATING attempt additionally gets an OS-ENFORCED boundary
- * (`applyConfinement`), verified against a path it denies before the harness is
- * spawned. A delegated READ-ONLY attempt keeps the harness's own read-only
- * enforcement instead: confinement stands that enforcement down (macOS refuses
- * nested sandboxes), which would be a net loss where there is no shell to
- * confine.
- *
- * WHERE THE HOST HAS NO BOUNDARY the attempt still runs, and says so: the
- * reason travels onto the attempt record, into the child's prompt and into the
- * caller's result. A delegated run that refused on every platform Claudexor has
- * not implemented a mechanism for would be a macOS-only feature wearing a
- * general name.
+ * A DELEGATED run (`execution.delegated`) is scoped either way. The scoped HOME
+ * redirects native state and profile selection; it is deliberately not called
+ * a filesystem boundary. Mutating delegated attempts disclose that Claudexor
+ * adds no outer OS boundary and leave the selected harness's native access mode
+ * in effect.
  *
  * THE COST of the scoped home, stated plainly: an in-place delegated attempt
  * CANNOT resume a native vendor session whose store lives under the real `$HOME`
  * — cursor (`~/.cursor`) and opencode (XDG data under `$HOME`) lose resume.
  * codex and claude keep it: their native session stores are Claudexor-owned
- * directories that the adapter re-points on top of this env and that the
- * confinement carves back out, and the macOS login Keychain is reached through
+ * directories that the adapter re-points on top of this env, and the macOS login Keychain is reached through
  * the declared scoped-home bridge (INV-067), so subscription auth is unaffected.
  *
- * Never degrades silently: a delegated attempt whose scoped home is not on disk,
- * or whose boundary cannot be applied and proven, refuses.
+ * Never degrades silently: a delegated attempt whose scoped home is not on disk refuses.
  */
-export declare function scopedHarnessHome(wsm: WorkspaceManager, envelope: WorkspaceEnvelope, inPlaceEnvelope: boolean, delegated: boolean, access?: AccessProfile, roots?: ConfinementRoots, host?: ConfinementHost): ScopedHarnessHome;
+export declare function scopedHarnessHome(wsm: WorkspaceManager, envelope: WorkspaceEnvelope, inPlaceEnvelope: boolean, delegated: boolean, access?: AccessProfile): ScopedHarnessHome;
 /**
  * What the CHILD is told, when it is running without an OS boundary.
  *
@@ -90,19 +46,19 @@ export declare function scopedHarnessHome(wsm: WorkspaceManager, envelope: Works
  * fact, so it is stated to the model in plain words rather than left in an
  * artifact it never reads.
  */
-export declare function confinementNotice(home: ScopedHarnessHome | null | undefined): string | null;
+export declare function outerBoundaryNotice(home: ScopedHarnessHome | null | undefined): string | null;
 /**
  * What an attempt's harness process ACTUALLY ran under.
  *
  * One shape, written by the success path and the failure path alike. An attempt
  * that spawned a harness and then died still ran a process, and the caller of a
  * delegated run still needs to know what that process could reach — "it failed"
- * is not an answer to "was it confined".
+ * is not an answer to "what outer-boundary evidence applied".
  */
 export interface AppliedAttemptFacts {
     /**
      * ABSENT when the attempt died before its home was decided (`wsm.create` or
-     * `applyConfinement` threw). A literal `false` is a POSITIVE claim — this
+     * home selection failed). A literal `false` is a POSITIVE claim — this
      * child ran in the operator's own HOME — and an attempt that never reached
      * the decision made no such claim. Absence keeps it a gap in the record,
      * which is what `appliedEvidenceComplete` already refuses on.
@@ -134,28 +90,24 @@ export interface AppliedAttemptFacts {
  */
 export declare function appliedAttemptFacts(home: ScopedHarnessHome | null | undefined, access: AccessProfile, credentialProfileId: string | null): AppliedAttemptFacts;
 /**
- * Whether an attempt's record is auditable for a delegated MUTATING run.
+ * Whether an attempt's record is auditable for a delegated mutating run.
  *
  * The distinction this predicate exists to draw: evidence that is MISSING is
  * still a reason to refuse — an attempt that cannot say what it ran under is
  * indistinguishable from one that ran unconfined behind a green terminal.
- * Evidence that honestly says "no boundary here, and here is why" is COMPLETE;
- * the absence of a boundary is a fact about the host, not a gap in the record,
- * and refusing on it would make a delegated mutating run impossible wherever
- * Claudexor has not implemented a mechanism.
+ * Evidence that honestly says "no additional boundary, by design" is complete.
  *
  * A named mechanism is a claim, and only `verified_denied_path` discharges it —
  * so a record carrying the name without the proof is NOT complete, and neither
  * is one that claims a boundary and a reason for its absence at the same time.
  */
-export declare function appliedEvidenceComplete(facts: AppliedAttemptFacts | null | undefined): boolean;
+export declare function appliedEvidenceComplete(facts: AppliedAttemptFacts | HistoricalAppliedAttemptFacts | null | undefined): boolean;
 /**
- * The terminal gate, shared by every lane that assembles attempts.
+ * The terminal evidence gate, shared by every lane that assembles attempts.
  *
  * A delegated MUTATING run may only reach a terminal when EVERY attempt it ran
- * can state what it ran under. One lane checking and its twin not is how a
- * mutating child ends up unconfined behind a green run, so the rule lives here
- * and both callers spend it.
+ * can state what it ran under, including the deliberate absence of an outer
+ * boundary, so the rule lives here and both callers spend it.
  */
 export declare function assertDelegatedEvidence(delegated: boolean, access: AccessProfile, attempts: readonly {
     attemptId: string;

package/dist/delegatedHome.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegatedHome.d.ts","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOvD,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,sGAAsG;IACtG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,4BAA4B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAE1F;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,uBAAuB,IAAI,gBAAgB,CAM1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,OAAO,EAClB,MAAM,GAAE,aAAiC,EACzC,KAAK,GAAE,gBAA4C,EACnD,IAAI,CAAC,EAAE,eAAe,GACrB,iBAAiB,CAoCnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAU3F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,aAAa,CAAC;IAC9B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,aAAa,EACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,mBAAmB,CAWrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAM9F;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACxE,IAAI,CAON"}
+{"version":3,"file":"delegatedHome.d.ts","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,2BAA2B,IAAI,6BAA6B,EAC5D,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,sGAAsG;IACtG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,OAAO,EAClB,MAAM,GAAE,aAAiC,GACxC,iBAAiB,CAsBnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQ7F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,aAAa,CAAC;IAC9B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,aAAa,EACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,mBAAmB,CAWrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,GAAG,6BAA6B,GAAG,IAAI,GAAG,SAAS,GAC5E,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACxE,IAAI,CAON"}

package/dist/delegatedHome.js

@@ -1,101 +1,51 @@
 import { existsSync } from "node:fs";
-import { applyConfinement, confinementBoundaryAvailable, DelegatedEvidenceIncompleteError, DelegatedHomeUnavailableError, } from "@claudexor/core";
-import { confinementBoundaryProven } from "@claudexor/schema";
-import { claudexorOwnedRoot, nativeHarnessStateRoot, userHomeDir } from "@claudexor/util";
+import { DelegatedEvidenceIncompleteError, DelegatedHomeUnavailableError } from "@claudexor/core";
+import { confinementBoundaryProven, DELIBERATE_NO_OUTER_BOUNDARY_REASON } from "@claudexor/schema";
 /** Access profiles under which the harness can modify the filesystem. */
 export function isMutatingAccess(access) {
     return access !== "readonly";
 }
 /**
- * Whether this run's lanes should be told to stand their own sandbox down.
- *
- * Only a delegated run asks for an engine-provided boundary, and only a host
- * that can actually provide one earns the trade. Telling a harness to drop its
- * native sandbox where Claudexor will NOT replace it is a pure loss — strictly
- * worse than never having asked — so the two conditions are one expression
- * rather than a flag the caller passes and a check nobody makes.
- */
-export function externallyConfinedLane(delegated, host) {
-    return delegated && confinementBoundaryAvailable(host).available;
-}
-export function defaultConfinementRoots() {
-    return {
-        operatorHome: userHomeDir(),
-        runtimeRoot: claudexorOwnedRoot(),
-        nativeStateRoot: nativeHarnessStateRoot(),
-    };
-}
-/**
- * Decide the harness HOME and the OS boundary one attempt runs under.
+ * Decide the harness HOME one attempt runs under.
  *
  * Unchanged for ordinary runs: an ISOLATED envelope gets the envelope's scoped
  * home, while an IN-PLACE attempt deliberately inherits the operator's native
  * environment so a harness whose native session store hangs off `$HOME` can
  * resume its vendor conversation.
  *
- * A DELEGATED run (`execution.delegated`) is scoped either way, and that is a
- * BEHAVIORAL CHANGE against that deliberate design — live + agent is exactly
- * the configuration a delegated mutating subagent uses. It is taken knowingly:
- * the caller is a machine orchestrator that owns the workspace, and the
- * operator's real `$HOME` holds material no delegated harness may read, above
- * all `~/.claudexor/v3/daemon/token`, which grants the entire control API.
- *
- * THE SCOPED HOME IS NOT THE BOUNDARY. It redirects `~`-relative lookups and
- * nothing more; the token above is one absolute path away, and a live probe
- * read it out of an ordinary `workspace_write` agent run. So a delegated
- * MUTATING attempt additionally gets an OS-ENFORCED boundary
- * (`applyConfinement`), verified against a path it denies before the harness is
- * spawned. A delegated READ-ONLY attempt keeps the harness's own read-only
- * enforcement instead: confinement stands that enforcement down (macOS refuses
- * nested sandboxes), which would be a net loss where there is no shell to
- * confine.
- *
- * WHERE THE HOST HAS NO BOUNDARY the attempt still runs, and says so: the
- * reason travels onto the attempt record, into the child's prompt and into the
- * caller's result. A delegated run that refused on every platform Claudexor has
- * not implemented a mechanism for would be a macOS-only feature wearing a
- * general name.
+ * A DELEGATED run (`execution.delegated`) is scoped either way. The scoped HOME
+ * redirects native state and profile selection; it is deliberately not called
+ * a filesystem boundary. Mutating delegated attempts disclose that Claudexor
+ * adds no outer OS boundary and leave the selected harness's native access mode
+ * in effect.
  *
  * THE COST of the scoped home, stated plainly: an in-place delegated attempt
  * CANNOT resume a native vendor session whose store lives under the real `$HOME`
  * — cursor (`~/.cursor`) and opencode (XDG data under `$HOME`) lose resume.
  * codex and claude keep it: their native session stores are Claudexor-owned
- * directories that the adapter re-points on top of this env and that the
- * confinement carves back out, and the macOS login Keychain is reached through
+ * directories that the adapter re-points on top of this env, and the macOS login Keychain is reached through
  * the declared scoped-home bridge (INV-067), so subscription auth is unaffected.
  *
- * Never degrades silently: a delegated attempt whose scoped home is not on disk,
- * or whose boundary cannot be applied and proven, refuses.
+ * Never degrades silently: a delegated attempt whose scoped home is not on disk refuses.
  */
-export function scopedHarnessHome(wsm, envelope, inPlaceEnvelope, delegated, access = "workspace_write", roots = defaultConfinementRoots(), host) {
+export function scopedHarnessHome(wsm, envelope, inPlaceEnvelope, delegated, access = "workspace_write") {
     if (inPlaceEnvelope && !delegated) {
         return {
             isolated: false,
             homeDir: null,
-            confinement: null,
-            confinementUnavailableReason: null,
+            outerBoundaryUnavailableReason: null,
         };
     }
     const env = wsm.envFor(envelope);
     const homeDir = env["HOME"];
     if (delegated && (!homeDir || !existsSync(homeDir))) {
-        throw new DelegatedHomeUnavailableError(`delegated run cannot be confined: the scoped harness home for attempt ${envelope.attempt_id} is missing (${homeDir || "unset"})`);
+        throw new DelegatedHomeUnavailableError(`delegated run cannot start: the scoped harness home for attempt ${envelope.attempt_id} is missing (${homeDir || "unset"})`);
     }
-    const outcome = delegated && isMutatingAccess(access)
-        ? applyConfinement({
-            operatorHome: roots.operatorHome,
-            runtimeRoot: roots.runtimeRoot,
-            nativeStateRoot: roots.nativeStateRoot,
-            scopedHome: homeDir,
-            worktree: envelope.worktree_path,
-        }, host)
-        : { confinement: null, unavailableReason: null };
     return {
         env,
         isolated: true,
         homeDir: homeDir ?? null,
-        confinement: outcome.confinement,
-        confinementUnavailableReason: outcome.unavailableReason,
+        outerBoundaryUnavailableReason: delegated && isMutatingAccess(access) ? DELIBERATE_NO_OUTER_BOUNDARY_REASON : null,
     };
 }
 /**
@@ -107,16 +57,14 @@ export function scopedHarnessHome(wsm, envelope, inPlaceEnvelope, delegated, acc
  * fact, so it is stated to the model in plain words rather than left in an
  * artifact it never reads.
  */
-export function confinementNotice(home) {
-    const reason = home?.confinementUnavailableReason;
+export function outerBoundaryNotice(home) {
+    const reason = home?.outerBoundaryUnavailableReason;
     if (!reason)
         return null;
     return [
-        "Engine disclosure — NO OS-ENFORCED BOUNDARY: this delegated run was asked to put your",
-        `process inside a kernel-enforced filesystem boundary and could not: ${reason}.`,
-        "Nothing outside this notice stops you from reading or writing any path this user account",
-        "can reach. Confine yourself to the worktree you were given and the HOME you were given,",
-        "and do not read the operator's credential stores or Claudexor's own runtime directory.",
+        `Engine disclosure: ${reason}`,
+        "The scoped HOME selects native state and credentials; it is not containment. Stay within",
+        "the execution workspace and do not access unrelated operator or Claudexor state.",
     ].join("\n");
 }
 /**
@@ -132,22 +80,19 @@ export function appliedAttemptFacts(home, access, credentialProfileId) {
         harness_home_dir: home?.homeDir ?? null,
         access_applied: access,
         credential_profile_applied: credentialProfileId,
-        confinement_mechanism: home?.confinement?.mechanism ?? null,
-        confinement_profile_digest: home?.confinement?.profile_digest ?? null,
-        confinement_verified_denied_path: home?.confinement?.verified_denied_path ?? null,
-        confinement_unavailable_reason: home?.confinementUnavailableReason ?? null,
+        confinement_mechanism: null,
+        confinement_profile_digest: null,
+        confinement_verified_denied_path: null,
+        confinement_unavailable_reason: home?.outerBoundaryUnavailableReason ?? null,
     };
 }
 /**
- * Whether an attempt's record is auditable for a delegated MUTATING run.
+ * Whether an attempt's record is auditable for a delegated mutating run.
  *
  * The distinction this predicate exists to draw: evidence that is MISSING is
  * still a reason to refuse — an attempt that cannot say what it ran under is
  * indistinguishable from one that ran unconfined behind a green terminal.
- * Evidence that honestly says "no boundary here, and here is why" is COMPLETE;
- * the absence of a boundary is a fact about the host, not a gap in the record,
- * and refusing on it would make a delegated mutating run impossible wherever
- * Claudexor has not implemented a mechanism.
+ * Evidence that honestly says "no additional boundary, by design" is complete.
  *
  * A named mechanism is a claim, and only `verified_denied_path` discharges it —
  * so a record carrying the name without the proof is NOT complete, and neither
@@ -162,12 +107,11 @@ export function appliedEvidenceComplete(facts) {
     return Boolean(facts.confinement_unavailable_reason);
 }
 /**
- * The terminal gate, shared by every lane that assembles attempts.
+ * The terminal evidence gate, shared by every lane that assembles attempts.
  *
  * A delegated MUTATING run may only reach a terminal when EVERY attempt it ran
- * can state what it ran under. One lane checking and its twin not is how a
- * mutating child ends up unconfined behind a green run, so the rule lives here
- * and both callers spend it.
+ * can state what it ran under, including the deliberate absence of an outer
+ * boundary, so the rule lives here and both callers spend it.
  */
 export function assertDelegatedEvidence(delegated, access, attempts) {
     if (!delegated || !isMutatingAccess(access))
@@ -175,6 +119,6 @@ export function assertDelegatedEvidence(delegated, access, attempts) {
     const unauditable = attempts.filter((attempt) => !appliedEvidenceComplete(attempt.applied));
     if (unauditable.length === 0)
         return;
-    throw new DelegatedEvidenceIncompleteError(`delegated mutating run cannot terminalize: ${unauditable.length} attempt(s) state neither a proven confinement nor a reason there was none (${unauditable.map((attempt) => attempt.attemptId).join(", ")})`);
+    throw new DelegatedEvidenceIncompleteError(`delegated mutating run cannot terminalize: ${unauditable.length} attempt(s) state neither a historical proven boundary nor the deliberate no-outer-boundary reason (${unauditable.map((attempt) => attempt.attemptId).join(", ")})`);
 }
 //# sourceMappingURL=delegatedHome.js.map

package/dist/delegatedHome.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegatedHome.js","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAsB1F,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAkB,EAAE,IAAsB;IAC/E,OAAO,SAAS,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AASD,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,YAAY,EAAE,WAAW,EAAE;QAC3B,WAAW,EAAE,kBAAkB,EAAE;QACjC,eAAe,EAAE,sBAAsB,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,QAA2B,EAC3B,eAAwB,EACxB,SAAkB,EAClB,MAAM,GAAkB,iBAAiB,EACzC,KAAK,GAAqB,uBAAuB,EAAE,EACnD,IAAsB;IAEtB,IAAI,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;YACjB,4BAA4B,EAAE,IAAI;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,6BAA6B,CACrC,yEAAyE,QAAQ,CAAC,UAAU,gBAAgB,OAAO,IAAI,OAAO,GAAG,CAClI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,gBAAgB,CACd;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,OAAiB;YAC7B,QAAQ,EAAE,QAAQ,CAAC,aAAa;SACjC,EACD,IAAI,CACL;QACH,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,4BAA4B,EAAE,OAAO,CAAC,iBAAiB;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA0C;IAC1E,MAAM,MAAM,GAAG,IAAI,EAAE,4BAA4B,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,uFAAuF;QACvF,uEAAuE,MAAM,GAAG;QAChF,0FAA0F;QAC1F,yFAAyF;QACzF,wFAAwF;KACzF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAqCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0C,EAC1C,MAAqB,EACrB,mBAAkC;IAElC,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,gBAAgB,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;QACvC,cAAc,EAAE,MAAM;QACtB,0BAA0B,EAAE,mBAAmB;QAC/C,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,IAAI,IAAI;QAC3D,0BAA0B,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,IAAI,IAAI;QACrE,gCAAgC,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,IAAI,IAAI;QACjF,8BAA8B,EAAE,IAAI,EAAE,4BAA4B,IAAI,IAAI;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6C;IACnF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAkB,EAClB,MAAqB,EACrB,QAAyE;IAEzE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,gCAAgC,CACxC,8CAA8C,WAAW,CAAC,MAAM,+EAA+E,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7M,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delegatedHome.js","sourceRoot":"","sources":["../src/delegatedHome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAMlG,OAAO,EAAE,yBAAyB,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAenG,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB,EACrB,QAA2B,EAC3B,eAAwB,EACxB,SAAkB,EAClB,MAAM,GAAkB,iBAAiB;IAEzC,IAAI,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,8BAA8B,EAAE,IAAI;SACrC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,6BAA6B,CACrC,mEAAmE,QAAQ,CAAC,UAAU,gBAAgB,OAAO,IAAI,OAAO,GAAG,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,8BAA8B,EAC5B,SAAS,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI;KACrF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0C;IAC5E,MAAM,MAAM,GAAG,IAAI,EAAE,8BAA8B,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,sBAAsB,MAAM,EAAE;QAC9B,0FAA0F;QAC1F,kFAAkF;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAqCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0C,EAC1C,MAAqB,EACrB,mBAAkC;IAElC,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,gBAAgB,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;QACvC,cAAc,EAAE,MAAM;QACtB,0BAA0B,EAAE,mBAAmB;QAC/C,qBAAqB,EAAE,IAAI;QAC3B,0BAA0B,EAAE,IAAI;QAChC,gCAAgC,EAAE,IAAI;QACtC,8BAA8B,EAAE,IAAI,EAAE,8BAA8B,IAAI,IAAI;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA6E;IAE7E,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACpF,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAkB,EAClB,MAAqB,EACrB,QAAyE;IAEzE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAI,gCAAgC,CACxC,8CAA8C,WAAW,CAAC,MAAM,uGAAuG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrO,CAAC;AACJ,CAAC"}

package/dist/modelGovernance.d.ts

@@ -5,11 +5,24 @@
  * adapter has one, else the manifest `known_models` list. A violation throws
  * a typed error BEFORE any vendor CLI spawns; the orchestrator surfaces it
  * through the routing-failure path, so failure.yaml names harness, model, and
- * truth source. Fallback models get the same gate: a downgrade target that
- * cannot run is a config bug better caught before the run than mid-run.
+ * truth source.
+ *
+ * Two rules keep the gate honest about WHICH account answered:
+ * - The inventory is asked of the account the run will actually use. A
+ *   profile-pinned route derives its auth route from that profile's credential
+ *   kind, and the query carries the profile's own state HOME, so model truth
+ *   can never come from the default credential store.
+ * - Nothing about the spawned spec is rewritten to make the two agree. A
+ *   profile-less `auto` run is enumerated with the same `auto` preference the
+ *   adapter will resolve, so preflight and spawn share one resolution instead
+ *   of the gate freezing a route the adapter would then be unable to disclose.
+ *
+ * A fallback model is checked by the authoritative per-spawn gate only after
+ * its own quota/profile preflight; checking it against the primary profile
+ * here would reject a valid cross-profile fallback.
  */
 import type { HarnessAdapter } from "@claudexor/core";
-import { type KnownModelEntry } from "@claudexor/schema";
+import { type CredentialProfile, type HarnessEvent, type HarnessRunSpec, type KnownModelEntry } from "@claudexor/schema";
 export interface ModelGovernedRoute {
     adapter: HarnessAdapter;
     /** Manifest model truth source (used when the adapter has no live models()). */
@@ -18,10 +31,28 @@ export interface ModelGovernedRoute {
      * filtered by it, and stay EXCLUDED when it is null (fail-closed — a
      * route-scoped model never passes the gate on an undecidable route). */
     authRouteEstimate: "local_session" | "api_key" | null;
+    /** Effective account after profile preflight/rotation. Model truth must come
+     * from this same identity, never the default credential store. */
+    quotaAdmission: {
+        profile: CredentialProfile | null;
+    };
     settings: {
         defaultModel: string | null;
         fallbackModel: string | null;
     } | null;
 }
-export declare function assertRouteModelsAllowed(routes: readonly ModelGovernedRoute[], models: Record<string, string> | undefined, cwd: string): Promise<void>;
+export declare function assertRouteModelsAllowed(routes: readonly ModelGovernedRoute[], models: Record<string, string> | undefined, cwd: string, 
+/** The mutable state HOME the eventual spawn will receive for this harness,
+ * so an account-scoped inventory is read from that same home. */
+routeStateEnvFor?: (harnessId: string) => Record<string, string> | undefined): Promise<void>;
+/**
+ * Authoritative per-spawn model gate. Admission validates the initially routed
+ * account early; this guard rebinds the same strict truth contract to the
+ * profile, auth preference, cwd, and mutable state HOME the vendor process will
+ * actually receive. Every routed spawn funnels through this generator, so a
+ * quota rotation or fallback-model preflight cannot reuse another account's
+ * inventory. The spec is passed to the adapter byte-identical: the gate reads
+ * the run's identity, it never rewrites it.
+ */
+export declare function runModelGovernedRoute(routed: ModelGovernedRoute, spec: HarnessRunSpec): AsyncIterable<HarnessEvent>;
 //# sourceMappingURL=modelGovernance.d.ts.map

package/dist/modelGovernance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelGovernance.d.ts","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,gFAAgF;IAChF,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC;;4EAEwE;IACxE,iBAAiB,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACtD,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAChF;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAkCf"}
+{"version":3,"file":"modelGovernance.d.ts","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,gFAAgF;IAChF,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC;;4EAEwE;IACxE,iBAAiB,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACtD;sEACkE;IAClE,cAAc,EAAE;QAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CAChF;AA8DD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM;AACX;iEACiE;AACjE,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC3E,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;;;;;;GAQG;AACH,wBAAuB,qBAAqB,CAC1C,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,cAAc,GACnB,aAAa,CAAC,YAAY,CAAC,CAa7B"}

package/dist/modelGovernance.js

@@ -1,6 +1,43 @@
 import { HarnessUnavailableError, validateModel } from "@claudexor/core";
-import { knownModelIdsForRoute } from "@claudexor/schema";
-export async function assertRouteModelsAllowed(routes, models, cwd) {
+import { knownModelIdsForRoute, } from "@claudexor/schema";
+/** A pinned profile decides the route by its credential kind; without one the
+ * pre-spawn estimate stands (and stays fail-closed when undecidable). */
+function authRouteForProfile(profile, estimate) {
+    if (!profile)
+        return estimate;
+    return profile.credential_kind === "api_key" ? "api_key" : "local_session";
+}
+async function modelTruthForRoute(routed, query) {
+    const route = authRouteForProfile(query.profile, routed.authRouteEstimate);
+    if (typeof routed.adapter.models === "function") {
+        const inventory = await routed.adapter.models({
+            cwd: query.cwd,
+            ...(query.env ? { env: query.env } : {}),
+            ...(query.authPreference ? { authPreference: query.authPreference } : {}),
+            ...(query.profile ? { credentialProfile: query.profile } : {}),
+        });
+        return { list: inventory.map((model) => model.id), source: "api", route };
+    }
+    return { list: knownModelIdsForRoute(routed.knownModels, route), source: "manifest", route };
+}
+function assertModelsAllowed(routed, candidates, truth, profile) {
+    for (const { role, model } of candidates) {
+        const check = validateModel(model, truth.list, truth.source);
+        if (check.status === "ok")
+            continue;
+        // A pinned profile OWNS this inventory: sending the operator to the
+        // profile-less `claudexor models` would print a different account's list.
+        const remedy = profile
+            ? `the selected credential profile '${profile.profile_id}' supplied this inventory; verify or re-authenticate that profile, then inspect its live vendor model list`
+            : `run \`claudexor models --harness ${routed.adapter.id}\``;
+        throw new HarnessUnavailableError(`harness '${routed.adapter.id}' refused ${role} '${model}' (truth source: ${truth.source}${truth.source === "manifest" ? `, route: ${truth.route ?? "undecided"}` : ""}): ${check.message}; ` +
+            remedy);
+    }
+}
+export async function assertRouteModelsAllowed(routes, models, cwd, 
+/** The mutable state HOME the eventual spawn will receive for this harness,
+ * so an account-scoped inventory is read from that same home. */
+routeStateEnvFor) {
     const checked = new Set();
     for (const routed of routes) {
         const id = routed.adapter.id;
@@ -8,32 +45,39 @@ export async function assertRouteModelsAllowed(routes, models, cwd) {
             continue;
         checked.add(id);
         const resolved = models?.[id] ?? routed.settings?.defaultModel ?? null;
-        const candidates = [
-            { role: "model", model: resolved },
-            { role: "fallback_model", model: routed.settings?.fallbackModel ?? null },
-        ].filter((c) => Boolean(c.model));
-        if (candidates.length === 0)
+        if (!resolved)
             continue;
-        let truth;
-        if (typeof routed.adapter.models === "function") {
-            const inventory = await routed.adapter.models({ cwd });
-            truth = { list: inventory.map((m) => m.id), source: "api" };
-        }
-        else {
-            // Route-aware manifest truth (INV-104 x INV-061): route-annotated models
-            // count only on their routes; an undecidable route excludes them.
-            truth = {
-                list: knownModelIdsForRoute(routed.knownModels, routed.authRouteEstimate),
-                source: "manifest",
-            };
-        }
-        for (const { role, model } of candidates) {
-            const check = validateModel(model, truth.list, truth.source);
-            if (check.status !== "ok") {
-                throw new HarnessUnavailableError(`harness '${id}' refused ${role} '${model}' (truth source: ${truth.source}${truth.source === "manifest" ? `, route: ${routed.authRouteEstimate ?? "undecided"}` : ""}): ${check.message}; ` +
-                    `run \`claudexor models --harness ${id}\``);
-            }
-        }
+        const profile = routed.quotaAdmission.profile;
+        const routeStateEnv = routeStateEnvFor?.(id);
+        const truth = await modelTruthForRoute(routed, {
+            cwd,
+            ...(routeStateEnv ? { env: routeStateEnv } : {}),
+            profile,
+        });
+        assertModelsAllowed(routed, [{ role: "model", model: resolved }], truth, profile);
+    }
+}
+/**
+ * Authoritative per-spawn model gate. Admission validates the initially routed
+ * account early; this guard rebinds the same strict truth contract to the
+ * profile, auth preference, cwd, and mutable state HOME the vendor process will
+ * actually receive. Every routed spawn funnels through this generator, so a
+ * quota rotation or fallback-model preflight cannot reuse another account's
+ * inventory. The spec is passed to the adapter byte-identical: the gate reads
+ * the run's identity, it never rewrites it.
+ */
+export async function* runModelGovernedRoute(routed, spec) {
+    const model = spec.model_hint?.trim();
+    if (model) {
+        const profile = spec.credential_profile ?? null;
+        const truth = await modelTruthForRoute(routed, {
+            cwd: spec.cwd,
+            env: spec.env,
+            authPreference: spec.auth_preference,
+            profile,
+        });
+        assertModelsAllowed(routed, [{ role: "model", model }], truth, profile);
     }
+    yield* routed.adapter.run(spec);
 }
 //# sourceMappingURL=modelGovernance.js.map

package/dist/modelGovernance.js.map

@@ -1 +1 @@
-{"version":3,"file":"modelGovernance.js","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,mBAAmB,CAAC;AAahF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqC,EACrC,MAA0C,EAC1C,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;QACvE,MAAM,UAAU,GAAG;YACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;YAClC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE;SAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,IAAI,KAA8D,CAAC;QACnE,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,kEAAkE;YAClE,KAAK,GAAG;gBACN,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC;gBACzE,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAC/B,YAAY,EAAE,aAAa,IAAI,KAAK,KAAK,oBAAoB,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,OAAO,IAAI;oBACzL,oCAAoC,EAAE,IAAI,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"modelGovernance.js","sourceRoot":"","sources":["../src/modelGovernance.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,qBAAqB,GAKtB,MAAM,mBAAmB,CAAC;AAuB3B;yEACyE;AACzE,SAAS,mBAAmB,CAC1B,OAAiC,EACjC,QAAiD;IAEjD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAA0B,EAC1B,KAKC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3E,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA0B,EAC1B,UAAqC,EACrC,KAAiB,EACjB,OAAiC;IAEjC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,SAAS;QACpC,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,oCAAoC,OAAO,CAAC,UAAU,4GAA4G;YACpK,CAAC,CAAC,oCAAoC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;QAC9D,MAAM,IAAI,uBAAuB,CAC/B,YAAY,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,IAAI,KAAK,KAAK,oBAAoB,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,OAAO,IAAI;YAC3L,MAAM,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqC,EACrC,MAA0C,EAC1C,GAAW;AACX;iEACiE;AACjE,gBAA4E;IAE5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC;QACvE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC;QAC9C,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE;YAC7C,GAAG;YACH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO;SACR,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,qBAAqB,CAC1C,MAA0B,EAC1B,IAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE;YAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,OAAO;SACR,CAAC,CAAC;QACH,mBAAmB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/orchestrator-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator-credentials.d.ts","sourceRoot":"","sources":["../src/orchestrator-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,cAAc,EACd,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;mEACmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACxD,QAAQ,IAAI,eAAe,CAAC;IAC5B,cAAc,IAAI,SAAS,aAAa,EAAE,CAAC;IAC3C,aAAa,IAAI,SAAS,YAAY,EAAE,CAAC;IACzC,kBAAkB,IAAI,SAAS,6BAA6B,EAAE,CAAC;IAC/D,wBAAwB,CAAC,GAAG,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACnE,wBAAwB,CACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GACxC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc;AACvB;wDACwD;AACxD,UAAU,EAAE,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;AAC/E,0EAA0E;AAC1E,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,cAAc,CAMhB;AAED,qBAAa,uBAAuB;IAItB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IAEzD,YAA6B,IAAI,EAAE,wBAAwB,EAAI;IAE/D,8EAA8E;IAC9E,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErE;IAED,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;IAED;;8EAE0E;IAC1E,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKtE;IAED,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAmBrF;IAED;;;;yEAIqE;IACrE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,GAAG,IAAI,CAQvF;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,CAKhE;IAED;;;0DAGsD;IACtD,uBAAuB,IAAI,uBAAuB,CAKjD;IAED;;sDAEkD;IAC5C,0BAA0B,CAC9B,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,EACzC,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAa9B;IAED;4EACwE;IACxE,oBAAoB,CAClB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,SAAS,2BAA2B,EAAE;QAGhD,mBAAmB;QASnB,YAAY;;;;;;;;;;MAEf;IAED,kFAAkF;IAC5E,gBAAgB,CACpB,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,GAC/C,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAwBnC;CACF"}
+{"version":3,"file":"orchestrator-credentials.d.ts","sourceRoot":"","sources":["../src/orchestrator-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,cAAc,EACd,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;mEACmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACxD,QAAQ,IAAI,eAAe,CAAC;IAC5B,cAAc,IAAI,SAAS,aAAa,EAAE,CAAC;IAC3C,aAAa,IAAI,SAAS,YAAY,EAAE,CAAC;IACzC,kBAAkB,IAAI,SAAS,6BAA6B,EAAE,CAAC;IAC/D,wBAAwB,CAAC,GAAG,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACnE,wBAAwB,CACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GACxC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc;AACvB;wDACwD;AACxD,UAAU,EAAE,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;AAC/E,0EAA0E;AAC1E,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,cAAc,CAMhB;AAED,qBAAa,uBAAuB;IAItB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IAEzD,YAA6B,IAAI,EAAE,wBAAwB,EAAI;IAE/D,8EAA8E;IAC9E,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErE;IAED,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;IAED;;8EAE0E;IAC1E,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKtE;IAED,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAmBrF;IAED;;;;yEAIqE;IACrE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,GAAG,IAAI,CAQvF;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,CAKhE;IAED;;;0DAGsD;IACtD,uBAAuB,IAAI,uBAAuB,CAKjD;IAED;;sDAEkD;IAC5C,0BAA0B,CAC9B,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,EACzC,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAa9B;IAED;4EACwE;IACxE,oBAAoB,CAClB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,SAAS,2BAA2B,EAAE;QAGhD,mBAAmB;QASnB,YAAY;;;;;;;;;;MAEf;IAED,kFAAkF;IAC5E,gBAAgB,CACpB,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,GAC/C,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6BnC;CACF"}

package/dist/orchestrator-credentials.js

@@ -1,3 +1,4 @@
+import { credentialProfilePolicyProblem, credentialProfilePolicyState } from "@claudexor/core";
 import { PoolRouteFlags, resolveAccountForRun } from "./account-resolution.js";
 import { currentSubjectProber, readyProfilesForRotation } from "./credential-differential.js";
 import { resolveCredentialProfile, } from "./credential-profiles.js";
@@ -133,10 +134,15 @@ export class OrchestratorCredentials {
     /** Thin wrapper over the ONE account-resolution owner (account-resolution.ts). */
     async preflightProfile(input, harnessId, model, log, defaultRoute) {
         const adapter = this.host.registry().get(harnessId);
+        const registry = this.host.config(input.repoRoot)?.global.credential_profiles ?? [];
+        const profileCardinality = credentialProfilePolicyState({ adapter, registry });
+        if (profileCardinality.ambiguous)
+            throw credentialProfilePolicyProblem(profileCardinality, "credential_profile_ambiguous");
         return resolveAccountForRun({
             harnessId,
-            registry: this.host.config(input.repoRoot)?.global.credential_profiles ?? [],
+            registry,
             policy: this.profilePolicy(input.repoRoot, harnessId),
+            profileCardinality,
             snapshots: this.host.quotaSnapshots(),
             quota: this.vendorQuotaObservations(),
             unusable: this.host.credentialUnusable(),