@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/ai_council/cli_agency_bounds.ts

@@ -124,6 +124,164 @@ export function boundFor(member: string): readonly string[] {
     return AGENCY_BOUNDS.find((b) => b.member === member)?.bound ?? [];
 }
 
+/**
+ * The read-only ANALYST profile (ADR-288 D8) — a separate class from the seat
+ * bound above, which stays an oracle bound. An analyst reads the scope it is
+ * spawned in and writes nothing; the seat bound is not widened to get there.
+ *
+ * Probed 2026-10-18 in a throwaway directory holding one fact file: each bound
+ * binary was asked to print the fact and then create a sentinel file. A bound
+ * is recorded only where the fact came back AND the sentinel was absent.
+ */
+export interface AnalystBound {
+    readonly member: string;
+    readonly binary: string;
+    /** The argv fragment of the read-only analyst profile. Empty = refused. */
+    readonly bound: readonly string[];
+    /** `stdin` where a variadic flag in `bound` would swallow a positional prompt. */
+    readonly prompt_via: 'stdin' | 'argv';
+    readonly probed_version: string | null;
+    readonly probed_on: string | null;
+    readonly rationale: string;
+}
+
+export const ANALYST_BOUNDS: readonly AnalystBound[] = [
+    {
+        member: 'anthropic',
+        binary: 'claude',
+        bound: ['--tools', 'Read,Grep,Glob'],
+        prompt_via: 'stdin',
+        probed_version: '2.1.302 (Claude Code)',
+        probed_on: '2026-10-18',
+        rationale:
+            'Read, Grep and Glob are the read half of the built-in tool set; no Bash, Edit, Write or WebFetch. Probe: ' +
+            'the fact came back, the sentinel was refused ("no tool that writes local files"). `--tools` is variadic ' +
+            'and swallowed a positional prompt in the same probe, so the prompt goes on stdin.',
+    },
+    {
+        member: 'openai',
+        binary: 'codex',
+        bound: ['--sandbox', 'read-only'],
+        prompt_via: 'argv',
+        probed_version: 'codex-cli 0.148.0',
+        probed_on: '2026-10-18',
+        rationale:
+            'The same flag as the seat bound, because `read-only` already permits reading the workspace and forbids ' +
+            'writing it. Probe: the fact came back, the sentinel was refused ("the workspace is read-only").',
+    },
+    {
+        member: 'gemini',
+        binary: 'gemini',
+        bound: [],
+        prompt_via: 'argv',
+        probed_version: '0.50.0',
+        probed_on: '2026-10-18',
+        rationale:
+            'refused — the 2026-10-18 probe printed "Approval mode overridden to \\"default\\" because the current ' +
+            'folder is not trusted": the `plan` bound is silently dropped in an untrusted directory, and the client was ' +
+            'refused by its service. A bound the binary can override is not a bound.',
+    },
+    {
+        member: 'xai',
+        binary: 'grok',
+        bound: [],
+        prompt_via: 'argv',
+        probed_version: null,
+        probed_on: null,
+        rationale: 'not-probed — binary absent on the probing machine.',
+    },
+    {
+        member: 'perplexity',
+        binary: 'perplexity',
+        bound: [],
+        prompt_via: 'argv',
+        probed_version: null,
+        probed_on: null,
+        rationale: 'not-probed — binary absent on the probing machine.',
+    },
+];
+
+/** The analyst profile's argv fragment for a member, or `[]` when it was refused or never probed. */
+export function analystBoundFor(member: string): readonly string[] {
+    return ANALYST_BOUNDS.find((b) => b.member === member)?.bound ?? [];
+}
+
+/**
+ * A lighter seat launch: a flag that keeps the subscription login but skips the
+ * user environment (instruction files, user rules, hooks, plugins, MCP) a seat
+ * never needs. A seat booting that environment pays it on every call and every
+ * round.
+ *
+ * Each row is one probe of one flag on one binary version, against the same
+ * seat argv without it. A version that was not probed gets no flag: the probe is
+ * the only evidence the binary accepts it and keeps the login.
+ */
+export interface LightLaunchProbe {
+    readonly member: string;
+    readonly binary: string;
+    readonly flag: readonly string[];
+    /** What that CLI's own `--version` printed on `probed_on`. */
+    readonly probed_version: string;
+    readonly probed_on: string;
+    /** First-call input tokens (uncached + cache write + cache read) with the flag. */
+    readonly first_call_tokens: number;
+    /** The same seat argv and question without the flag, same run. */
+    readonly baseline_first_call_tokens: number;
+    /** Whether the probe question saw a rule from `~/.claude/rules`. */
+    readonly user_rules_loaded: boolean;
+    /** The call answered with no API key in the environment. */
+    readonly keeps_subscription_login: boolean;
+    /** At most one row per member is the launch a seat uses. */
+    readonly selected: boolean;
+    readonly rationale: string;
+}
+
+export const LIGHT_LAUNCH_PROBES: readonly LightLaunchProbe[] = [
+    {
+        member: 'anthropic',
+        binary: 'claude',
+        flag: ['--safe-mode'],
+        probed_version: '2.1.308 (Claude Code)',
+        probed_on: '2026-10-22',
+        first_call_tokens: 2_790,
+        baseline_first_call_tokens: 145_587,
+        user_rules_loaded: false,
+        keeps_subscription_login: true,
+        selected: true,
+        rationale:
+            'Skips instruction files, hooks, plugins, MCP and auto memory while auth and the model stay. Chosen over ' +
+            '`--setting-sources` because a seat also has no use for hooks or plugins, and it answers the same question ' +
+            'from the same oracle argv (`--tools ""`).',
+    },
+    {
+        member: 'anthropic',
+        binary: 'claude',
+        flag: ['--setting-sources', 'project,local'],
+        probed_version: '2.1.308 (Claude Code)',
+        probed_on: '2026-10-22',
+        first_call_tokens: 3_548,
+        baseline_first_call_tokens: 145_587,
+        user_rules_loaded: false,
+        keeps_subscription_login: true,
+        selected: false,
+        rationale:
+            'Drops the user setting source and with it the user rule layer, but keeps project and local settings, so ' +
+            'project hooks and instructions still reach a seat spawned inside a repository.',
+    },
+];
+
+/**
+ * The light-launch flag a seat uses for this member on this binary version, or
+ * `[]` when that version was never probed.
+ */
+export function lightLaunchFor(member: string, version: string | null): readonly string[] {
+    if (version === null) return [];
+    const probe = LIGHT_LAUNCH_PROBES.find(
+        (p) => p.selected && p.member === member && p.probed_version === version.trim(),
+    );
+    return probe?.flag ?? [];
+}
+
 /**
  * Documented flags that LIFT an agency bound.
  *

package/src/scripts/ai_council/cli_launch_env.ts

@@ -0,0 +1,54 @@
+/**
+ * What a CLI seat's launch reads from its environment: the session-wide
+ * subagent model ceiling and the vendor binary's version. Kept apart from
+ * `clients.ts`, which is past the source-size ceiling.
+ */
+import { spawnSync } from 'node:child_process';
+
+import { load_agent_settings } from '../_lib/agent_settings.js';
+
+// Session-wide subagent model ceiling (token-economy-dispatch Phase 5.2):
+// class-C setting, default absent, HUMAN-set only. When present, the CLI
+// spawn below exports CLAUDE_CODE_SUBAGENT_MODEL so the spawned vendor
+// session caps its own subagents' models. Memoised PER CWD, not per
+// process (review finding 2026-08-10): a long-lived server process may
+// serve several projects, and a single-slot memo would apply project A's
+// spend cap to project B's spawns. A human edit still needs a process
+// restart to be seen — acceptable for a per-install cap, stated here.
+const _modelCeilingMemo = new Map<string, string | null>();
+export function _subagentModelCeiling(cwd: string = process.cwd()): string | null {
+    const hit = _modelCeilingMemo.get(cwd);
+    if (hit !== undefined) return hit;
+    let ceiling: string | null;
+    try {
+        const settings = load_agent_settings({ cwd }) as Record<string, unknown>;
+        const sub = (settings['subagents'] ?? {}) as Record<string, unknown>;
+        const v = typeof sub['model_ceiling'] === 'string' ? sub['model_ceiling'].trim() : '';
+        ceiling = v.length > 0 ? v : null;
+    } catch {
+        ceiling = null; // unreadable settings → no ceiling (fail-open)
+    }
+    _modelCeilingMemo.set(cwd, ceiling);
+    return ceiling;
+}
+/** Test seam: reset the per-cwd ceiling memo. */
+export function _resetModelCeilingMemo(): void {
+    _modelCeilingMemo.clear();
+}
+
+const _cliVersionCache = new Map<string, string | null>();
+
+/** What `<binary> --version` prints, once per binary per process; null when it cannot run. */
+export function _cliVersion(binary: string): string | null {
+    const cached = _cliVersionCache.get(binary);
+    if (cached !== undefined) return cached;
+    let version: string | null = null;
+    try {
+        const r = spawnSync(binary, ['--version'], { encoding: 'utf8', timeout: 10_000 });
+        if (r.status === 0 && typeof r.stdout === 'string') version = r.stdout.trim() || null;
+    } catch {
+        version = null;
+    }
+    _cliVersionCache.set(binary, version);
+    return version;
+}

package/src/scripts/ai_council/cli_least_agency_canary.ts

@@ -200,16 +200,27 @@ function runPhase(
     if (dryRun) {
         return { mutated: null, argv };
     }
-    spawnSync(argv[0] as string, argv.slice(1), {
+    const r = spawnSync(argv[0] as string, argv.slice(1), {
         input: probe.stdin ? prompt(sentinel) : undefined,
         encoding: 'utf8',
         timeout: 180_000,
+        // Node's 1 MiB default kills a child that logs more than that, before
+        // it could have mutated anything, and a bound phase would then read
+        // that as the bound holding.
+        maxBuffer: 64 * 1024 * 1024,
         // The child runs in the disposable directory, so a relative-path
         // interpretation of the prompt still lands inside the sandbox we watch.
         cwd: dir,
     });
     // The oracle. Not the output, not a phrase — the file.
-    return { mutated: fs.existsSync(sentinel), argv };
+    if (fs.existsSync(sentinel)) {
+        return { mutated: true, argv };
+    }
+    // No file from a child that never finished says nothing about the bound.
+    if (r.error !== undefined || r.signal !== null) {
+        return { mutated: null, argv };
+    }
+    return { mutated: false, argv };
 }
 
 export function probeMember(probe: Probe, dir: string, dryRun: boolean): MemberResult {
@@ -266,6 +277,11 @@ export function probeMember(probe: Probe, dir: string, dryRun: boolean): MemberR
             'the CONTROL did not create the sentinel, so this run demonstrates nothing about the bound — ' +
             'the member may be unable to write for an unrelated reason (auth, model refusal, an ambient default ' +
             'more restrictive than the control value). Sharpen the control before reading this as a pass.';
+    } else if (bound1.mutated === null || bound2.mutated === null) {
+        verdict = 'inconclusive';
+        note =
+            'a bound phase ended without finishing (killed, timed out, or failed to spawn) and left no sentinel. ' +
+            'An interrupted child is not a refusal, so this run says nothing about the bound.';
     } else if (bound1.mutated === false && bound2.mutated === false) {
         verdict = 'pass';
         note = 'bound blocked the mutation, control performed it, restoring the bound blocked it again';

package/src/scripts/ai_council/clients.ts

@@ -1,3 +1,4 @@
+// egress-content: session-content asserted — API seats post through api_transport.curlJsonPost and CLI seats pass councilEgress().check before the spawn; council rounds are replaced through the engine first
 // External-AI clients for the council — ported from the retired Python
 // `src/scripts/ai_council/clients.py` (ADR-200).
 //
@@ -45,8 +46,13 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { vendorPrefix } from '../_lib/egress_rules.js';
 import { hardenedSpawnEnv } from '../_lib/spawn_env.js';
-import { boundFor } from './cli_agency_bounds.js';
+import { boundFor, lightLaunchFor } from './cli_agency_bounds.js';
+import { _cliVersion, _subagentModelCeiling } from './cli_launch_env.js';
+export { _resetModelCeilingMemo, _subagentModelCeiling } from './cli_launch_env.js';
+import { resumeBound, seatResumeArgs, type SeatSession } from './seat_resume.js';
+import { councilEgress } from './council_egress.js';
 import {
     curlJsonPost as _curlJsonPost,
     geminiRestClient,
@@ -54,36 +60,7 @@ import {
     type JsonPost,
 } from './api_transport.js';
 import { SESSION_ROLE_ENV } from '../_lib/session_role.js';
-import { load_agent_settings } from '../_lib/agent_settings.js';
-
-// Session-wide subagent model ceiling (token-economy-dispatch Phase 5.2):
-// class-C setting, default absent, HUMAN-set only. When present, the CLI
-// spawn below exports CLAUDE_CODE_SUBAGENT_MODEL so the spawned vendor
-// session caps its own subagents' models. Memoised PER CWD, not per
-// process (review finding 2026-08-10): a long-lived server process may
-// serve several projects, and a single-slot memo would apply project A's
-// spend cap to project B's spawns. A human edit still needs a process
-// restart to be seen — acceptable for a per-install cap, stated here.
-const _modelCeilingMemo = new Map<string, string | null>();
-export function _subagentModelCeiling(cwd: string = process.cwd()): string | null {
-    const hit = _modelCeilingMemo.get(cwd);
-    if (hit !== undefined) return hit;
-    let ceiling: string | null;
-    try {
-        const settings = load_agent_settings({ cwd }) as Record<string, unknown>;
-        const sub = (settings['subagents'] ?? {}) as Record<string, unknown>;
-        const v = typeof sub['model_ceiling'] === 'string' ? sub['model_ceiling'].trim() : '';
-        ceiling = v.length > 0 ? v : null;
-    } catch {
-        ceiling = null; // unreadable settings → no ceiling (fail-open)
-    }
-    _modelCeilingMemo.set(cwd, ceiling);
-    return ceiling;
-}
-/** Test seam: reset the per-cwd ceiling memo. */
-export function _resetModelCeilingMemo(): void {
-    _modelCeilingMemo.clear();
-}
+
 import * as user_global_paths from '../_lib/user_global_paths.js';
 import { jsonDumpsIndent2 as _jsonDumpsIndent2 } from './_py_json.js';
 import * as budget from './cli_call_budget.js';
@@ -363,12 +340,12 @@ function _loadKey(p: string, prefix: string, installScript: string): string {
 
 export function load_anthropic_key(p: string | null = null): string {
     const resolved = p !== null ? p : _resolveKeyPath(ANTHROPIC_KEY_FILENAME);
-    return _loadKey(resolved, 'sk-ant-', 'src/scripts/install_anthropic_key.sh');
+    return _loadKey(resolved, vendorPrefix('anthropic-api-key'), 'src/scripts/install_anthropic_key.sh');
 }
 
 export function load_openai_key(p: string | null = null): string {
     const resolved = p !== null ? p : _resolveKeyPath(OPENAI_KEY_FILENAME);
-    return _loadKey(resolved, 'sk-', 'src/scripts/install_openai_key.sh');
+    return _loadKey(resolved, vendorPrefix('openai-api-key'), 'src/scripts/install_openai_key.sh');
 }
 
 // ── attribute-access helpers (mirror Python getattr) ──────────────────
@@ -1212,14 +1189,16 @@ export abstract class CliClient extends ExternalAIClient {
     protected _cli_calls_path: string | null;
     /** Attribution label for every booking this client makes. */
     protected _consumer: string;
+    /** The session the last answered call ran in; `resumeNext` continues it once, non-blind only. */
+    lastSession: SeatSession | null = null;
+    resumeNext: SeatSession | null = null;
 
     static _AUTH_FAILURE_PATTERNS: readonly string[] = [
         'authentication',
         'unauthorized',
         'auth failed',
         'auth_error',
-        'login',
-        'not logged in',
+        'not logged in', 'please log in', 'login required',
         'session expired',
         'invalid credentials',
     ];
@@ -1310,6 +1289,10 @@ export abstract class CliClient extends ExternalAIClient {
         }
     }
 
+    protected _cliFailure(latency_ms: number, error: string, metadata: Record<string, unknown>): CouncilResponse {
+        return new CouncilResponse({ provider: this.name, model: this.model, text: '', latency_ms, error, metadata });
+    }
+
     /**
      * Refuse a call this transport cannot serve, BEFORE spawning.
      *
@@ -1332,18 +1315,18 @@ export abstract class CliClient extends ExternalAIClient {
     }
 
     /**
-     * Transport seam (default impl). Mirror
-     * `subprocess.run(cmd, input=..., capture_output=True, text=True,
-     * timeout=..., check=False)`. Throws `SubprocessError` for the timeout /
-     * ENOENT / OSError branches so `ask()` can classify them exactly as the
-     * historical contract requires. Tests override this to inject canned output without
-     * spawning a process.
+     * Transport seam (default impl). Mirror `subprocess.run(cmd, input=..., capture_output=True, text=True,
+     * timeout=..., check=False)`. Throws `SubprocessError` for the timeout / ENOENT / OSError branches so
+     * `ask()` can classify them exactly as the historical contract requires. Tests override this to inject
+     * canned output without spawning a process.
      */
     protected _runSubprocess(cmd: string[], stdinPayload: string | null): SubprocessResult {
         const argv0 = cmd[0] ?? '';
         const spawnOpts: Parameters<typeof spawnSync>[2] = {
             encoding: 'utf-8',
             timeout: Math.round(this.timeout_seconds * 1000),
+            // Node's 1 MiB default ENOBUFS-kills a member CLI that logs beside its answer; API transport's ceiling.
+            maxBuffer: 64 * 1024 * 1024,
             // Neutral cwd, and this one is load-bearing rather than tidy.
             //
             // The spawn used to inherit the caller's directory, so a council
@@ -1476,19 +1459,24 @@ export abstract class CliClient extends ExternalAIClient {
         // bug someone fixes in a minute and a seat that quietly stays dead.
         const preflight = this._preflight_transport();
         if (preflight !== null) {
-            return new CouncilResponse({
-                provider: this.name,
-                model: this.model,
-                text: '',
-                latency_ms: _elapsedMs(t0),
-                error: preflight.code,
-                metadata: { cli: true, transport: this.transport, detail: preflight.detail },
-            });
+            return this._cliFailure(_elapsedMs(t0), preflight.code, { cli: true, transport: this.transport, detail: preflight.detail });
         }
 
         // 2. build command + spawn.
         const cmd = this._build_command(system_prompt, user_prompt, max_tokens);
+        this.resumeNext = null;
         const stdinPayload = this._stdin_payload(system_prompt, user_prompt);
+        // The final egress check, immediately before the request is written
+        // (road-to-one-detector-and-the-senders-we-own 3.3): nothing is spawned
+        // and nothing counts against the daily cap when it refuses.
+        const refusal = councilEgress().check(`${cmd.join('\n')}\n${stdinPayload ?? ''}`);
+        if (refusal !== null) {
+            return this._cliFailure(_elapsedMs(t0), 'egress_refused', {
+                cli: true,
+                egress_reason: refusal.reason,
+                egress_rule: refusal.what,
+            });
+        }
         let proc: SubprocessResult;
         try {
             proc = this._runSubprocess(cmd, stdinPayload);
@@ -1503,24 +1491,10 @@ export abstract class CliClient extends ExternalAIClient {
                     // could not contain, at `timeout_seconds` of wall-clock per
                     // attempt. The process ran; the call counts.
                     this._recordCallQuietly();
-                    return new CouncilResponse({
-                        provider: this.name,
-                        model: this.model,
-                        text: '',
-                        latency_ms: _elapsedMs(t0),
-                        error: 'timeout',
-                        metadata: { cli: true, timeout_seconds: this.timeout_seconds },
-                    });
+                    return this._cliFailure(_elapsedMs(t0), 'timeout', { cli: true, timeout_seconds: this.timeout_seconds });
                 }
                 if (exc.kind === 'file_not_found') {
-                    return new CouncilResponse({
-                        provider: this.name,
-                        model: this.model,
-                        text: '',
-                        latency_ms: _elapsedMs(t0),
-                        error: 'binary_missing',
-                        metadata: { cli: true, binary: this.binary },
-                    });
+                    return this._cliFailure(_elapsedMs(t0), 'binary_missing', { cli: true, binary: this.binary });
                 }
                 // OSError — the spawn was attempted, so it counts. `E2BIG` lands
                 // here when an argv-borne prompt outgrows the platform limit,
@@ -1613,17 +1587,20 @@ export abstract class CliClient extends ExternalAIClient {
             meta['cli'] = true;
         }
         response.metadata = meta;
+        const sid = meta['session_id'];
+        if (typeof sid === 'string' && sid !== '' && !response.error) this.lastSession = { id: sid, at_ms: Date.now() };
         return response;
     }
 
+    /** Fallback-INELIGIBLE classes first: a bare `login` once read a timeout as auth. */
     static _classify_stderr(stderr: string, returncode: number): string {
         const haystack = stderr.toLowerCase();
-        if (this._AUTH_FAILURE_PATTERNS.some((p) => haystack.includes(p))) {
-            return 'auth_expired';
-        }
         if (this._TIMEOUT_PATTERNS.some((p) => haystack.includes(p))) {
             return 'timeout';
         }
+        if (this._AUTH_FAILURE_PATTERNS.some((p) => haystack.includes(p))) {
+            return 'auth_expired';
+        }
         if (this._QUOTA_PATTERNS.some((p) => haystack.includes(p))) {
             return 'cli_quota_exhausted';
         }
@@ -1698,7 +1675,11 @@ export class AnthropicCliClient extends CliClient {
         void max_tokens;
         return [
             this.binary,
+            ...seatResumeArgs(this.name, this.resumeNext, { blind: false, now_ms: Date.now() }),
             '--print',
+            // The seat never needs the user environment; only a version the light
+            // launch was probed on gets the flag (`LIGHT_LAUNCH_PROBES`).
+            ...lightLaunchFor('anthropic', _cliVersion(this.binary)),
             '--output-format',
             'json',
             '--model',
@@ -1841,7 +1822,9 @@ export class OpenAICliClient extends CliClient {
         // the payload itself is assembled in `_stdin_payload`.
         const modelArgs =
             this.model === OPENAI_CLI_VENDOR_DEFAULT ? [] : ['--model', this.model];
-        return [this.binary, 'exec', '--json', '--skip-git-repo-check', ...boundFor('openai'), ...modelArgs, '-'];
+        const resume = seatResumeArgs(this.name, this.resumeNext, { blind: false, now_ms: Date.now() });
+        const bound = resume.length === 0 ? boundFor('openai') : resumeBound(boundFor('openai'));
+        return [this.binary, 'exec', ...resume, '--json', '--skip-git-repo-check', ...bound, ...modelArgs, '-'];
     }
 
     /**
@@ -1972,10 +1955,9 @@ export class OpenAICliClient extends CliClient {
                     input_tokens = _pyIntCoerce(_dictGet(usageObj, 'input_tokens', 0));
                     output_tokens = _pyIntCoerce(_dictGet(usageObj, 'output_tokens', 0));
                 }
-            } else if (event_type === 'session.created') {
-                if (_pyTruthy(_dictGet(ev, 'session_id', undefined))) {
-                    meta['session_id'] = _pyStr(ev['session_id']);
-                }
+            } else if (event_type === 'session.created' || event_type === 'thread.started') {
+                const sid = _dictGet(ev, 'session_id', undefined) ?? _dictGet(ev, 'thread_id', undefined);
+                if (_pyTruthy(sid)) meta['session_id'] = _pyStr(sid);
             } else if (event_type === 'turn.failed') {
                 // The turn's real cause lives ONLY here, and codex still exits
                 // 0. Without this branch the response is an empty text, which

package/src/scripts/ai_council/config.ts

@@ -75,6 +75,7 @@ import * as path from 'node:path';
 
 import { parse as parseYaml } from 'yaml';
 
+import { CREDENTIAL_PREFIXES } from '../_lib/egress_prefixes.js';
 import * as user_global_paths from '../_lib/user_global_paths.js';
 import * as budget from './cli_call_budget.js';
 // LAYERING CONSTRAINT, load-bearing: this is a VALUE import from quorum, while
@@ -84,6 +85,7 @@ import * as budget from './cli_call_budget.js';
 // quorum into config — creates a real ESM cycle in the loader's init path.
 import { OPENAI_CLI_VENDOR_DEFAULT } from './vendor_defaults.js';
 import { parseSeatFields, type PolicyExclusion } from './seat_policy.js';
+import { parseRouteFields, type RouteSpec } from './free_route.js';
 import type { ContentClass } from './content_ceiling.js';
 import { SOLO_FLOOR_MIN_PRESENT } from './quorum.js';
 
@@ -108,17 +110,10 @@ const _FALLBACK_DEPS = {
 
 /**
  * Prefixes that signal "this is a raw API key" so we refuse it loudly
- * even when the user accidentally inlined it in `api_key_ref`.
+ * even when the user accidentally inlined it in `api_key_ref`. The rule
+ * table owns them (road-to-one-detector-and-the-senders-we-own 2.2).
  */
-export const _RAW_KEY_PREFIXES: readonly string[] = [
-    'sk-',
-    'sk-ant-',
-    'ya29.',
-    'AIza',
-    'xai-',
-    'pplx-',
-    'gsk_',
-];
+export const _RAW_KEY_PREFIXES: readonly string[] = CREDENTIAL_PREFIXES;
 
 // ── value type shapes ──────────────────────────────────────────────
 
@@ -338,6 +333,8 @@ export interface MemberConfig {
     readonly disabled_reason: string | null;
     readonly policy_exclusion: PolicyExclusion | null;
     readonly content_ceiling: ContentClass;
+    /** A `base_url` route (`free_route.ts`); absent or null for a provider member. */
+    readonly route?: RouteSpec | null;
 }
 
 /**
@@ -1699,18 +1696,15 @@ function _build_cost_budget(d: Dict): CostBudgetConfig {
 function _build_member(
     name: string,
     cfg: Dict,
-    // road-to-always-on-orchestration Phase 3.1: kept in sync with
-    // `_build_defaults`'s `auto` default for consistency. The sole call site
-    // (`_build_config`) always passes `defaults.mode` explicitly, so this
-    // parameter default is unreachable on the live path today; it exists so
-    // a future caller that omits the third argument observes the same
-    // doctrine rather than silently reverting to the retired `api` default.
+    // Unreachable today (the caller passes `defaults.mode`); mirrors that default.
     default_mode = 'auto',
     ignored: string[] = [],
 ): MemberConfig {
-    if (!_VALID_PROVIDERS.has(name)) {
+    const routeParsed = parseRouteFields(name, cfg as Record<string, unknown>, _VALID_PROVIDERS.has(name));
+    if ('error' in routeParsed) throw new CouncilConfigError(routeParsed.error);
+    if (!_VALID_PROVIDERS.has(name) && routeParsed.route === null) {
         throw new CouncilConfigError(
-            `members.${name}: unknown provider; valid: ` +
+            `members.${name}: unknown provider (or a route without base_url); valid: ` +
                 `${_sortedListRepr(_VALID_PROVIDERS)}.`,
         );
     }
@@ -1719,10 +1713,8 @@ function _build_member(
     const model = _pyTruthy(modelVal) ? (modelVal as string) : '';
     const api_key_ref_raw = _get(cfg, 'api_key_ref', null);
     const api_key_ref = api_key_ref_raw === undefined ? null : api_key_ref_raw;
-    // Per-member transport is no longer configurable either — same reasoning
-    // as `_build_defaults`. A member that pinned `mode: api` would reintroduce
-    // exactly the silent-spend path the global key was removed for, one
-    // provider at a time. Recorded as ignored, never read.
+    // Ignored, never read: a pinned `mode: api` would reopen the silent-spend
+    // path the global key was removed for, one provider at a time.
     if (_get(cfg, 'mode', null) !== null) {
         ignored.push(`members.${name}.mode`);
     }
@@ -1917,6 +1909,8 @@ function _build_member(
         prompt_cache_ttl,
         verified_at,
         ...seat.fields,
+        route: routeParsed.route,
+        ...(routeParsed.route === null ? {} : { content_ceiling: 'public-artifact' as const }),
     };
 }