@event4u/agent-config 17.0.0 → 17.1.0

package/src/scripts/ai_council/free_hand_shadow.ts

@@ -9,6 +9,7 @@
  * Bounds, each failing toward not calling the free side:
  *   - the free side must be unpaid (`free-quota` or `self-hosted`); a metered
  *     "free" route would spend, so it is never shadowed;
+ *   - the paid side must not be a `base_url` route, which counts as paid without being one;
  *   - the payload must be `public-artifact`, the ceiling every free route sits at;
  *   - at most `SHADOW_CALL_CAP` rows (decision A5); past it the paid side still
  *     answers and nothing else is called.
@@ -26,7 +27,11 @@ import { pathToFileURL } from 'node:url';
 
 import type { ExternalAIClient } from './clients.js';
 import { admitsContent, type ContentClass } from './content_ceiling.js';
-import { handSystemPrompt, parseHandReturn } from './hand_schemas.js';
+import { councilEgress, type CouncilEgress } from './council_egress.js';
+import type { Exposure, ExposureLedger } from './exposure_ledger.js';
+import { FreeRouteClient } from './free_route_client.js';
+import { buildHandPayload, type HandPayload, type HandSlice } from './hand_payload.js';
+import { parseHandReturn } from './hand_schemas.js';
 import { routeCandidateFromMember } from './route_chooser.js';
 import { classifyRouteOutcome, recordRouteOutcome, type RouteOutcome } from './route_liveness.js';
 import { isUnpaid, type HandKind, type RouteBilling, type VerifyVerdict } from '../_lib/hand_kinds.js';
@@ -63,7 +68,6 @@ export type HeadVerify = (
 ) => { verdict: VerifyVerdict; tokens: number } | Promise<{ verdict: VerifyVerdict; tokens: number }>;
 
 export interface ShadowAskOptions {
-    readonly kind: HandKind;
     readonly contentClass: ContentClass;
     readonly paid: ExternalAIClient;
     readonly free: ExternalAIClient;
@@ -71,9 +75,13 @@ export interface ShadowAskOptions {
     /** Root of the gitignored state the ledger and route liveness live in. */
     readonly stateRoot: string;
     readonly now?: () => Date;
+    /** The run's placeholder scope; default: the council egress state. */
+    readonly egress?: CouncilEgress;
+    /** Recorded against the free route when, and only when, it is asked. */
+    readonly exposure?: { readonly ledger: ExposureLedger; readonly exposes: Exposure };
 }
 
-export type ShadowSkip = 'free-side-metered' | 'paid-side-unpaid' | 'content-ceiling' | 'cap-reached';
+export type ShadowSkip = 'free-side-metered' | 'paid-side-unpaid' | 'paid-side-route' | 'content-ceiling' | 'cap-reached';
 
 export interface ShadowAnswer {
     readonly answer: string;
@@ -94,9 +102,9 @@ interface Called {
     readonly tokens: number;
 }
 
-async function _call(member: ExternalAIClient, kind: HandKind, prompt: string): Promise<Called> {
+async function _call(member: ExternalAIClient, kind: HandKind, payload: HandPayload): Promise<Called> {
     try {
-        const raw = member.ask(handSystemPrompt(kind), prompt);
+        const raw = member.ask(payload.system, payload.user);
         const r = raw instanceof Promise ? await raw : raw;
         const outcome = classifyRouteOutcome(r?.error ?? null);
         const text = (r?.text ?? '').trim();
@@ -147,26 +155,30 @@ function _routeModel(member: ExternalAIClient): string | null {
     return typeof m['base_url'] === 'string' && typeof m['model'] === 'string' && m['model'] !== '' ? m['model'] : null;
 }
 
-export async function shadowAsk(prompt: string, opts: ShadowAskOptions): Promise<ShadowResult> {
+export async function shadowAsk(slice: HandSlice, opts: ShadowAskOptions): Promise<ShadowResult> {
+    const kind = slice.kind;
     const paidRoute = routeCandidateFromMember(opts.paid);
     const freeRoute = routeCandidateFromMember(opts.free);
+    if (isUnpaid(paidRoute.billing)) return { answer: null, row: null, skipped: 'paid-side-unpaid' };
+    if (opts.paid instanceof FreeRouteClient) return { answer: null, row: null, skipped: 'paid-side-route' };
+    const payload = buildHandPayload(slice, opts.egress ?? councilEgress());
     const usePaid = async (skipped: ShadowSkip): Promise<ShadowResult> => {
-        const c = await _call(opts.paid, opts.kind, prompt);
+        const c = await _call(opts.paid, kind, payload);
         return { answer: c.parsed.ok ? { answer: c.text, parsed: c.parsed.value } : null, row: null, skipped };
     };
-    if (isUnpaid(paidRoute.billing)) return { answer: null, row: null, skipped: 'paid-side-unpaid' };
     if (!isUnpaid(freeRoute.billing)) return usePaid('free-side-metered');
     if (!admitsContent(freeRoute.ceiling, opts.contentClass).admitted) return usePaid('content-ceiling');
     if (_rowCount(opts.stateRoot) >= SHADOW_CALL_CAP) return usePaid('cap-reached');
 
-    const [p, f] = await Promise.all([_call(opts.paid, opts.kind, prompt), _call(opts.free, opts.kind, prompt)]);
+    opts.exposure?.ledger.record(freeRoute.name, opts.exposure.exposes);
+    const [p, f] = await Promise.all([_call(opts.paid, kind, payload), _call(opts.free, kind, payload)]);
     const model = _routeModel(opts.free);
     if (model !== null) recordRouteOutcome(opts.stateRoot, freeRoute.name, model, f.outcome);
     const row: ShadowRow = {
         ts: (opts.now ?? (() => new Date()))().toISOString(),
-        kind: opts.kind,
-        paid: await _side(opts.paid, p, opts.kind, 'paid', opts.verify),
-        free: await _side(opts.free, f, opts.kind, 'free', opts.verify),
+        kind,
+        paid: await _side(opts.paid, p, kind, 'paid', opts.verify),
+        free: await _side(opts.free, f, kind, 'free', opts.verify),
     };
     _append(opts.stateRoot, row);
     return { answer: p.parsed.ok ? { answer: p.text, parsed: p.parsed.value } : null, row };

package/src/scripts/ai_council/free_route_catalog.ts

@@ -16,7 +16,9 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { pathToFileURL } from 'node:url';
 
+import { resolve_project_root } from '../_lib/agent_settings.js';
 import { isRealDate } from './free_route.js';
 
 export interface RouteAttestation {
@@ -24,8 +26,14 @@ export interface RouteAttestation {
     readonly checked: string;
     readonly source_url: string;
     readonly trains_on_prompts: boolean;
-    /** Whether the terms permit use inside a client distributed to users in the EEA, Switzerland and the UK. */
-    readonly client_distribution_eea_ch_uk?: 'permitted' | 'forbidden';
+    /** What the terms say about keeping prompts and outputs, in their words' substance. */
+    readonly retention?: string;
+    /**
+     * Whether the terms permit use inside a client distributed to users in the
+     * EEA, Switzerland and the UK. `unknown` records that the terms were read
+     * and say neither, which keeps the route maintainer-only like an absent field.
+     */
+    readonly client_distribution_eea_ch_uk?: 'permitted' | 'forbidden' | 'unknown';
 }
 
 export interface CatalogRoute {
@@ -34,13 +42,36 @@ export interface CatalogRoute {
     readonly keyless: boolean;
     /** `null` until someone reads the terms and dates what they say. */
     readonly attestation: RouteAttestation | null;
+    /**
+     * The route's own model list marking each entry `community: true|false`.
+     * When set, discovery admits only first-party ids and fails closed when the
+     * list cannot be read, because the attestation speaks for first-party
+     * models only.
+     */
+    readonly first_party_list?: string;
 }
 
 /**
- * Base URLs only. No row carries an attestation yet: none has been read and
- * dated, so every row is maintainer-only until one is.
+ * Base URLs only. One row carries an attestation (council 2026-10-22,
+ * decision 2): its terms were read from the provider's published policy, and
+ * they settle neither way whether a distributed client may serve EEA, CH or UK
+ * users, so it stays maintainer-only.
  */
 export const ROUTE_CATALOG: readonly CatalogRoute[] = [
+    {
+        id: 'pollinations',
+        base_url: 'https://text.pollinations.ai/openai',
+        keyless: true,
+        first_party_list: 'https://text.pollinations.ai/models',
+        attestation: {
+            checked: '2026-10-22',
+            source_url: 'https://pollinations.ai/privacy',
+            trains_on_prompts: false,
+            retention:
+                'prompts and outputs processed transiently, with short-lived response caches; the selected model\'s inference host sets its own retention',
+            client_distribution_eea_ch_uk: 'unknown',
+        },
+    },
     { id: 'groq', base_url: 'https://api.groq.com/openai/v1', keyless: false, attestation: null },
     { id: 'cerebras', base_url: 'https://api.cerebras.ai/v1', keyless: false, attestation: null },
     { id: 'openrouter', base_url: 'https://openrouter.ai/api/v1', keyless: false, attestation: null },
@@ -64,7 +95,7 @@ export function consumerDefaultVerdict(route: CatalogRoute, now: Date = new Date
     if (ageDays > ATTESTATION_MAX_AGE_DAYS) {
         return { admissible: false, reason: `${route.id}: attestation from ${a.checked} is older than ${ATTESTATION_MAX_AGE_DAYS} days` };
     }
-    if (a.client_distribution_eea_ch_uk === undefined) {
+    if (a.client_distribution_eea_ch_uk === undefined || a.client_distribution_eea_ch_uk === 'unknown') {
         return { admissible: false, reason: `${route.id}: attestation records no EEA/CH/UK distribution term — maintainer runs only` };
     }
     if (a.client_distribution_eea_ch_uk === 'forbidden') {
@@ -137,6 +168,52 @@ export interface DiscoverOptions {
     readonly fetchImpl?: typeof fetch;
     readonly now?: Date;
     readonly timeoutMs?: number;
+    /** A route's `first_party_list`; when set, only ids it marks `community: false` are kept. */
+    readonly firstPartyListUrl?: string;
+}
+
+/** First-party names and aliases, each mapped to the full alias set of its entry. */
+async function firstPartyIds(url: string, opts: DiscoverOptions): Promise<Map<string, ReadonlySet<string>>> {
+    const res = await (opts.fetchImpl ?? fetch)(url, {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+    });
+    if (!res.ok) throw new Error(`first-party list HTTP ${res.status}`);
+    const body = (await res.json()) as unknown;
+    if (!Array.isArray(body)) throw new Error('first-party list is not a list');
+    const ids = new Map<string, ReadonlySet<string>>();
+    for (const m of body) {
+        if (m === null || typeof m !== 'object') continue;
+        const e = m as Record<string, unknown>;
+        if (e['community'] !== false) continue;
+        const names = [e['name'], ...(Array.isArray(e['aliases']) ? e['aliases'] : [])].filter((n): n is string => typeof n === 'string');
+        const entry = new Set(names);
+        for (const n of names) ids.set(n, entry);
+    }
+    return ids;
+}
+
+/**
+ * The id a route answers under when asked for `model`, from one minimal call; '' when the call
+ * gives no answer. A route may list one id and serve under another, and the client keeps an
+ * answer only on an exact match, so the roster must hold the id the route actually serves.
+ */
+async function servedIdOf(baseUrl: string, model: string, opts: DiscoverOptions): Promise<string> {
+    try {
+        const headers: Record<string, string> = { 'content-type': 'application/json', accept: 'application/json' };
+        if (opts.apiKey) headers['authorization'] = `Bearer ${opts.apiKey}`;
+        const res = await (opts.fetchImpl ?? fetch)(`${baseUrl.replace(/\/+$/, '')}/chat/completions`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ model, max_tokens: 16, messages: [{ role: 'user', content: 'Reply with: ok' }] }),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+        });
+        if (!res.ok) return '';
+        const served = ((await res.json()) as { model?: unknown }).model;
+        return typeof served === 'string' ? served : '';
+    } catch {
+        return '';
+    }
 }
 
 /**
@@ -159,6 +236,18 @@ export async function discoverRouteModels(routeKey: string, baseUrl: string, opt
         models = body.data
             .map((m) => (m !== null && typeof m === 'object' ? (m as Record<string, unknown>)['id'] : undefined))
             .filter((id): id is string => typeof id === 'string' && id !== '');
+        if (opts.firstPartyListUrl) {
+            const fp = await firstPartyIds(opts.firstPartyListUrl, opts);
+            const resolved: string[] = [];
+            for (const id of models.filter((m) => fp.has(m))) {
+                const aliases = fp.get(id) as ReadonlySet<string>;
+                const served = aliases.size > 1 ? await servedIdOf(baseUrl, id, opts) : '';
+                // No answer keeps the listed id; an id outside the entry's declared aliases is a substitution.
+                if (served === '' || served === id) resolved.push(id);
+                else if (aliases.has(served)) resolved.push(served);
+            }
+            models = [...new Set(resolved)];
+        }
     } catch (exc) {
         if (routeKey in store) {
             delete store[routeKey];
@@ -171,3 +260,51 @@ export async function discoverRouteModels(routeKey: string, baseUrl: string, opt
     _writeStore(opts.repoRoot, store);
     return { status: 'known', models, observed_at };
 }
+
+export interface CatalogMainDeps {
+    readonly fetchImpl?: typeof fetch;
+    readonly stdout?: (line: string) => void;
+    readonly now?: Date;
+}
+
+const USAGE = 'usage: free_route_catalog discover [--root <dir>]';
+
+/**
+ * `discover [--root <dir>]` — the production path that writes the first-party
+ * roster `route_member.ts` gates on. Every catalogued row with a
+ * `first_party_list` is discovered under its catalogue id, beneath the same
+ * repository root the gate resolves. Exit 1 when any roster stays unknown.
+ */
+export async function main(argv: readonly string[], deps: CatalogMainDeps = {}): Promise<number> {
+    const out = deps.stdout ?? ((line: string) => process.stdout.write(`${line}\n`));
+    const [cmd, ...rest] = argv;
+    const rootAt = rest.indexOf('--root');
+    const rootArg = rootAt === -1 ? null : (rest[rootAt + 1] ?? '');
+    if (cmd !== 'discover' || rootArg === '' || rest.length !== (rootAt === -1 ? 0 : 2)) {
+        out(USAGE);
+        return 2;
+    }
+    const [repoRoot] = resolve_project_root(rootArg);
+    let unknown = 0;
+    for (const row of ROUTE_CATALOG) {
+        if (row.first_party_list === undefined) continue;
+        const roster = await discoverRouteModels(row.id, row.base_url, {
+            repoRoot,
+            firstPartyListUrl: row.first_party_list,
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+            ...(deps.now ? { now: deps.now } : {}),
+        });
+        if (roster.status === 'known') {
+            out(`${row.id}: known (${roster.models.length} first-party models, observed ${roster.observed_at})`);
+        } else {
+            unknown += 1;
+            out(`${row.id}: unknown (${roster.reason})`);
+        }
+    }
+    out(`roster: ${path.join(repoRoot, ROUTE_MODELS_RELPATH)}`);
+    return unknown === 0 ? 0 : 1;
+}
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+    void main(process.argv.slice(2)).then((code) => process.exit(code));
+}

package/src/scripts/ai_council/free_route_client.ts

@@ -6,6 +6,7 @@
 
 import { curlJsonPost, type JsonPost } from './api_transport.js';
 import { CouncilResponse, ExternalAIClient } from './clients.js';
+import type { ContentClass } from './content_ceiling.js';
 import { familyOf, servedMatches, type RouteBilling } from './free_route.js';
 import { policyExclusionReason, type PolicyExclusion } from './seat_policy.js';
 
@@ -15,6 +16,7 @@ export interface FreeRouteClientOptions {
     readonly base_url: string;
     readonly api_key: string | null;
     readonly billing: RouteBilling;
+    readonly content_ceiling: ContentClass;
     readonly post?: JsonPost;
 }
 
@@ -27,6 +29,7 @@ export interface FreeRouteClientOptions {
 export class FreeRouteClient extends ExternalAIClient {
     readonly base_url: string;
     readonly billing: RouteBilling;
+    readonly content_ceiling: ContentClass;
     private readonly _apiKey: string | null;
     private readonly _post: JsonPost;
 
@@ -36,6 +39,7 @@ export class FreeRouteClient extends ExternalAIClient {
         this.model = opts.model;
         this.base_url = opts.base_url.replace(/\/+$/, '');
         this.billing = opts.billing;
+        this.content_ceiling = opts.content_ceiling;
         this.billable = opts.billing === 'per-token';
         this._apiKey = opts.api_key;
         this._post = opts.post ?? curlJsonPost;

package/src/scripts/ai_council/hand_payload.ts

@@ -98,17 +98,121 @@ function pythonHeaderEnd(src: string): number {
     return -1;
 }
 
+/** `//` and `/* *\/` comments blanked, strings kept. */
+function stripComments(src: string): string {
+    let out = '';
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i] as string;
+        const next = src[i + 1];
+        if (c === '/' && (next === '/' || next === '*')) {
+            const close = next === '/' ? src.indexOf('\n', i) : src.indexOf('*/', i + 2);
+            i = close === -1 ? src.length : next === '/' ? close - 1 : close + 1;
+            out += ' ';
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            const from = i;
+            for (i++; i < src.length && src[i] !== c; i++) if (src[i] === '\\') i++;
+            out += src.slice(from, i + 1);
+            continue;
+        }
+        out += c;
+    }
+    return out;
+}
+
+/** Imports, namespaces and file pragmas: statements around a declaration, never one. */
+const PREAMBLE = [
+    /^<\?php\b/,
+    /^(?:import|export)\s+(?:type\s+)?(?:[^;'"`]*?\s+from\s+)?(['"])[^'"\n]*\1\s*;?/,
+    /^(?:const|let|var)\s+[\w{}\s,]+=\s*require\((['"])[^'"\n]*\1\)\s*;?/,
+    /^(?:namespace|use)\s+[\w\\:{},\s]+?(?:\s+as\s+\w+)?\s*;/,
+    /^declare\s*\([^)]*\)\s*;/,
+    /^(['"])use strict\1\s*;?/,
+];
+
+/** Top-level statements of a brace-language source, preamble dropped. */
+function braceStatements(source: string): string[] {
+    let src = stripComments(source).trim();
+    for (let hit = true; hit; ) {
+        hit = false;
+        for (const re of PREAMBLE) {
+            const m = re.exec(src);
+            if (m !== null) {
+                src = src.slice(m[0].length).trimStart();
+                hit = true;
+            }
+        }
+    }
+    const out: string[] = [];
+    let depth = 0;
+    let from = 0;
+    const cut = (to: number): void => {
+        const stmt = src.slice(from, to).trim();
+        if (stmt !== '' && stmt !== ';') out.push(stmt);
+        from = to;
+    };
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i];
+        if (c === '"' || c === "'" || c === '`') {
+            for (i++; i < src.length && src[i] !== c; i++) if (src[i] === '\\') i++;
+        } else if (c === '(' || c === '[' || c === '{') depth++;
+        else if (c === ')' || c === ']' || c === '}') {
+            depth--;
+            if (c === '}' && depth === 0) {
+                const rest = /^(\s*)(\S?)/.exec(src.slice(i + 1)) as RegExpExecArray;
+                const n = rest[2] as string;
+                if (n === ';') cut(i + 1 + (rest[1] as string).length + 1);
+                else if (n === '' || ((rest[1] as string).includes('\n') && !/[.{)=|&,?:]/.test(n))) cut(i + 1);
+            }
+        } else if (c === ';' && depth === 0) cut(i + 1);
+    }
+    cut(src.length);
+    return out;
+}
+
+/** The one Python `def` of a source, imports and decorators dropped. */
+function pythonDeclaration(source: string): string {
+    const lines = source.split('\n');
+    const starts: number[] = [];
+    let depth = 0;
+    lines.forEach((line, n) => {
+        const atTop = depth === 0 && /^\S/.test(line) && !line.startsWith('#');
+        for (const c of line) {
+            if (c === '(' || c === '[' || c === '{') depth++;
+            else if (c === ')' || c === ']' || c === '}') depth--;
+        }
+        if (atTop && !/^(?:import\s|from\s+\S+\s+import\s|@)/.test(line)) starts.push(n);
+    });
+    const first = starts[0];
+    if (starts.length !== 1 || first === undefined || !/^(?:async\s+)?def\s/.test(lines[first] as string)) {
+        throw new HandPayloadError('a callee must hold exactly one top-level function; send that declaration alone');
+    }
+    return lines.slice(first).join('\n');
+}
+
+const STATEMENT_IN_BLOCK = /\breturn\b|\bthrow\b|\bif\s*\(|(?<![=!<>])=(?![=>])/;
+
 /**
- * A function's signature without its body. Brace languages lose the final
- * top-level block (a return-type literal before it survives); an expression
- * arrow loses everything from its arrow; a Python `def` keeps its header line.
+ * A function's signature without its body. A callee must hold exactly one
+ * top-level declaration once imports, namespaces and comments are dropped,
+ * else it is refused. Brace languages lose the final top-level block (a
+ * return-type literal before it survives); an expression arrow loses
+ * everything from its arrow; a Python `def` keeps its header line.
  */
 export function signatureOf(source: string): string {
-    const src = source.trim();
-    if (/^(?:async\s+)?def\s/.test(src)) {
+    if (/^(?:async\s+)?def\s+\w+\s*\(/m.test(source)) {
+        const src = pythonDeclaration(source);
         const end = pythonHeaderEnd(src);
-        return end === -1 ? src : src.slice(0, end + 1);
+        const sig = end === -1 ? src.trim() : src.slice(0, end + 1);
+        if (sig.includes('\n') && /\breturn\b/.test(sig)) throw new HandPayloadError('a body survived signature extraction');
+        return sig;
     }
+    const stmts = braceStatements(source);
+    if (stmts.length !== 1) {
+        throw new HandPayloadError('a callee must hold exactly one top-level declaration; send that declaration alone');
+    }
+    const src = stmts[0] as string;
     const { blocks, arrows } = scanTopLevel(src);
     const tailEnd = src.replace(/[\s;]+$/u, '').length - 1;
     const last = blocks[blocks.length - 1];
@@ -119,7 +223,11 @@ export function signatureOf(source: string): string {
     } else if (arrows[0] !== undefined) {
         head = src.slice(0, arrows[0]).trimEnd();
     }
-    return `${head.replace(/[\s;]+$/u, '')};`;
+    const sig = `${head.replace(/[\s;]+$/u, '')};`;
+    for (const b of scanTopLevel(sig).blocks) {
+        if (STATEMENT_IN_BLOCK.test(sig.slice(b.start + 1, b.end))) throw new HandPayloadError('a body survived signature extraction');
+    }
+    return sig;
 }
 
 function escapeRegExp(s: string): string {

package/src/scripts/ai_council/orchestrator.ts

@@ -502,16 +502,13 @@ export function consult(
             // Non-blind: the seat is asked about its own reply, so it continues the session that wrote it.
             const seat = member as Partial<Pick<CliClient, 'lastSession' | 'resumeNext'>>;
             if (seat.lastSession !== undefined) seat.resumeNext = seat.lastSession;
-            const rr = _run_round([member], repairQ, resolvedBudget, spent, {
-                table,
-                on_overrun,
-                project,
-                original_ask,
-                advisor_plans,
-                cli_fallback,
-                fallback_ledger,
-                fallback_twins,
-            });
+            let rr: CouncilResponse[];
+            try {
+                const round = { table, on_overrun, project, original_ask, advisor_plans, cli_fallback, fallback_ledger, fallback_twins };
+                rr = _run_round([member], repairQ, resolvedBudget, spent, round);
+            } finally {
+                if (seat.resumeNext !== undefined) seat.resumeNext = null; // a quota gate or refusal returns before the seat clears it
+            }
             const rep = rr[0];
             if (rep !== undefined) {
                 opts.on_stance_repair_result?.(rep);

package/src/scripts/ai_council/route_chooser.ts

@@ -149,7 +149,7 @@ export function routeCandidateFromMember(member: ExternalAIClient): RouteCandida
     const ceiling: ContentClass =
         billing === 'free-quota'
             ? 'public-artifact'
-            : classifyContentClass(m['content_ceiling'], isUnpaid(billing) ? 'public-artifact' : DEFAULT_SEAT_CEILING);
+            : classifyContentClass(m['content_ceiling'], isUnpaid(billing) || typeof m['base_url'] === 'string' ? 'public-artifact' : DEFAULT_SEAT_CEILING);
     const quota = m['remaining_quota'];
     return {
         name,

package/src/scripts/ai_council/route_member.ts

@@ -5,17 +5,22 @@
  * therefore must not import the loader back.
  */
 
+import { resolve_project_root } from '../_lib/agent_settings.js';
 import { PROVIDER_TABLE } from '../_lib/environment_detector.js';
 import { resolve_api_key } from './config.js';
-import type { ContentClass } from './content_ceiling.js';
+import { classifyContentClass, DEFAULT_SEAT_CEILING, type ContentClass } from './content_ceiling.js';
+import type { ExternalAIClient } from './clients.js';
 import { FreeRouteClient } from './free_route_client.js';
+import { readRouteRoster, ROUTE_CATALOG } from './free_route_catalog.js';
 import {
     parseRouteFields,
     resolveRouteTransport,
-    UNPROVEN_PROBE,
+    routeCeiling,
+    type SelfHostedProbeResult,
     type RouteBilling,
     type SelfHostedProbe,
 } from './free_route.js';
+import { SELF_HOSTED_PROBE, type ProbeRoute } from './self_hosted_probe.js';
 import { keyResolves } from './status_surface.js';
 
 export type RouteMemberResult =
@@ -28,15 +33,26 @@ export function routeMemberFor(
     cfg: Record<string, unknown>,
     contentClass: ContentClass,
     modelOverride?: string,
-    probe: SelfHostedProbe = UNPROVEN_PROBE,
+    probe: SelfHostedProbe = SELF_HOSTED_PROBE,
+    stateRoot?: string,
+    now: Date = new Date(),
 ): RouteMemberResult | null {
     const parsed = parseRouteFields(name, cfg, Object.hasOwn(PROVIDER_TABLE, name));
     if ('error' in parsed) return { absent: { member: name, reason: 'policy_unknown', detail: parsed.error } };
     const route = parsed.route;
     if (route === null) return null;
     const model = modelOverride || (typeof cfg['model'] === 'string' ? cfg['model'] : '');
+    // The root discovery writes under, so a run from a subdirectory reads the same roster.
+    const gate = firstPartyGate(route.base_url, model, stateRoot ?? resolve_project_root(null)[0], now);
+    if (gate !== null) return { absent: { member: name, reason: 'policy_model_mismatch', detail: gate } };
     const ref = typeof cfg['api_key_ref'] === 'string' ? cfg['api_key_ref'] : null;
-    const t = resolveRouteTransport({ name, route, model, contentClass, keyPresent: keyResolves(ref), probe });
+    // A keyed loopback route can only be proven with its key on the probe call.
+    let probed: SelfHostedProbeResult | undefined;
+    const keyedProbe: SelfHostedProbe = (r, m) => {
+        const withKey: ProbeRoute = { ...r, api_key_ref: ref };
+        return (probed = probe(withKey, m));
+    };
+    const t = resolveRouteTransport({ name, route, model, contentClass, keyPresent: keyResolves(ref), probe: keyedProbe });
     if (!t.available) {
         return { absent: { member: name, reason: t.absentReason ?? 'unavailable', detail: t.reason ?? 'route unavailable' } };
     }
@@ -47,6 +63,52 @@ export function routeMemberFor(
             base_url: route.base_url,
             api_key: ref === null ? null : resolve_api_key(ref, `ai_council.members.${name}`),
             billing: t.billing as RouteBilling,
+            content_ceiling: routeCeiling(route, probed),
         }),
     };
 }
+
+/** A built seat carries the ceiling its config declares; a route client keeps its own. */
+export function stampSeatCeilings(members: readonly ExternalAIClient[], membersCfg: Record<string, unknown>): void {
+    for (const m of members) {
+        const seat = m as unknown as Record<string, unknown>;
+        if (m instanceof FreeRouteClient || seat['content_ceiling'] !== undefined) continue;
+        const cfg = membersCfg[m.name];
+        const declared = typeof cfg === 'object' && cfg !== null ? (cfg as Record<string, unknown>)['content_ceiling'] : undefined;
+        seat['content_ceiling'] = classifyContentClass(declared, DEFAULT_SEAT_CEILING);
+    }
+}
+
+/** A first-party roster older than this no longer says which models are first-party. */
+export const FIRST_PARTY_ROSTER_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * On a catalogued route whose attestation covers first-party models only, the
+ * model must be in a fresh discovered first-party roster; anything else is a
+ * reason to be absent, so an unknown provenance never reaches the route.
+ */
+function firstPartyGate(baseUrl: string, model: string, stateRoot: string, now: Date): string | null {
+    const key = routeIdentity(baseUrl);
+    const row = ROUTE_CATALOG.find((r) => r.first_party_list !== undefined && routeIdentity(r.base_url) === key);
+    if (row === undefined) return null;
+    const roster = readRouteRoster(stateRoot, row.id);
+    if (roster.status !== 'known') return `${row.id}: no discovered first-party roster (${roster.reason})`;
+    if (now.getTime() - Date.parse(roster.observed_at) > FIRST_PARTY_ROSTER_MAX_AGE_MS) {
+        return `${row.id}: first-party roster from ${roster.observed_at} is older than a day`;
+    }
+    if (!roster.models.includes(model)) return `${row.id}: ${model} is not in the route's first-party roster`;
+    return null;
+}
+
+/**
+ * Host and path, scheme dropped: an `http` or mixed-case spelling of a
+ * catalogued route is the same route to the gate, so it cannot step around it.
+ */
+export function routeIdentity(url: string): string {
+    try {
+        const u = new URL(url);
+        return `${u.host}${u.pathname.replace(/\/+$/, '')}`;
+    } catch {
+        return url.trim().toLowerCase().replace(/\/+$/, '');
+    }
+}

package/src/scripts/ai_council/seat_policy.ts

@@ -160,7 +160,7 @@ export function isUnpaidBilling(billing: string | null | undefined): boolean {
 }
 
 export interface RoleRefusal {
-    readonly reason: 'unpaid_head_role';
+    readonly reason: 'unpaid_head_role' | 'route_head_role';
     readonly message: string;
 }
 
@@ -168,7 +168,14 @@ export function seatRoleRefusal(
     role: CouncilRole,
     billing: string | null | undefined,
     seat = 'this seat',
+    route = false,
 ): RoleRefusal | null {
+    if (HEAD_ROLES.has(role) && route) {
+        return {
+            reason: 'route_head_role',
+            message: `${seat} is a base_url route and may not hold the ${role} role, whatever billing it reports (ADR-257)`,
+        };
+    }
     if (!HEAD_ROLES.has(role) || !isUnpaidBilling(billing)) return null;
     return {
         reason: 'unpaid_head_role',