@geraldmaron/construct 1.2.3 → 1.3.1

package/lib/migrations/index.mjs

@@ -1,8 +1,8 @@
 /**
  * lib/migrations/index.mjs — Schema migration registry and runner.
  *
- * Construct's machine-readable artifacts (specialists/registry.json, contracts.json,
- * role-manifests.json, .cx/config.json, profile JSON) carry an integer
+ * Construct's machine-readable artifacts (specialists/org/, .cx/config.json,
+ * .cx/config.json, profile JSON) carry an integer
  * `version` field. When the installed binary's expected schema version is
  * higher than the on-disk version, migrations apply in order. When the on-disk
  * version is higher, the runner refuses to load and instructs the operator to
@@ -18,9 +18,11 @@
  */
 
 import v1Baseline from './v1-baseline.mjs';
+import v2UnifiedRegistry from './v2-unified-registry.mjs';
 
 const REGISTRY = [
   v1Baseline,
+  v2UnifiedRegistry,
 ];
 
 export const CURRENT_SCHEMA_VERSION = Math.max(...REGISTRY.map((m) => m.to));

package/lib/migrations/v2-unified-registry.mjs

@@ -0,0 +1,35 @@
+/**
+ * lib/migrations/v2-unified-registry.mjs — v1 → v2 schema stamp.
+ *
+ * v2 is the version that unified-registry.json was born at when the legacy
+ * specialists/registry.json + contracts.json + teams.json were consolidated
+ * into a single unified file. Artifacts already at v2 need no shape change.
+ * For any v1 artifact carrying the old flat-registry shape, this stamps the
+ * version field so the migrate runner reports "already at v2" on re-run.
+ */
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+
+export default {
+  from: 1,
+  to: 2,
+  description: 'Stamp legacy v1 artifacts with version: 2 (no shape changes required)',
+  async apply(artifactPath, { dryRun = false } = {}) {
+    if (!existsSync(artifactPath)) {
+      return { changed: false, summary: `${artifactPath}: not present (skip)` };
+    }
+    let data;
+    try { data = JSON.parse(readFileSync(artifactPath, 'utf8')); }
+    catch (err) { throw new Error(`failed to parse ${artifactPath}: ${err.message}`); }
+
+    if (data && typeof data === 'object' && data.version === 2) {
+      return { changed: false, summary: `${artifactPath}: already at v2` };
+    }
+
+    const next = { ...data, version: 2 };
+    if (!dryRun) {
+      writeFileSync(artifactPath, JSON.stringify(next, null, 2) + '\n');
+    }
+    return { changed: true, summary: `${artifactPath}: stamped version: 2` };
+  },
+};

package/lib/model-router.mjs

@@ -38,10 +38,13 @@ import {
 } from "./model-free-selector.mjs";
 import {
   applyModelVisibilityFilter,
+  collectTierDefaultIds,
   loadModelsCatalogContext,
   mergeLiveModelsIntoProviders,
+  providerFamilyEnabled,
 } from "./models/catalog.mjs";
 import { configDir } from "./config/xdg.mjs";
+import { getUserEnvPath } from "./env-config.mjs";
 
 function uniqueStrings(values = []) {
   return [...new Set(values.filter((value) => typeof value === "string" && value.trim()))];
@@ -448,7 +451,7 @@ export function getProviderModelCatalog({
 } = {}) {
   const baseProviders = PROVIDER_FAMILY_TIERS.map((family) => {
     const tiers = family.resolve({});
-    const options = {
+    const staticOptions = {
       reasoning: uniqueStrings([...(family.options?.reasoning ?? []), tiers.reasoning]),
       standard: uniqueStrings([...(family.options?.standard ?? []), tiers.standard]),
       fast: uniqueStrings([...(family.options?.fast ?? []), tiers.fast]),
@@ -457,7 +460,8 @@ export function getProviderModelCatalog({
       id: family.id,
       label: family.label,
       tiers,
-      options,
+      staticOptions,
+      options: staticOptions,
       local: family.local === true,
       requiresEnv: Array.isArray(family.requiresEnv) ? family.requiresEnv : [],
       pricingHint: family.pricingHint ?? null,
@@ -488,6 +492,54 @@ export function getProviderModelCatalog({
   );
 }
 
+/**
+ * Tier pins and option lists for configured provider families limit live
+ * OpenRouter polls in model-selection surfaces without dumping the full catalog.
+ */
+export function getPickerModelAllowlist({
+  env = process.env,
+  cwd = process.cwd(),
+  currentModel = null,
+  modelsConfig = null,
+  registryModels = null,
+} = {}) {
+  const ctx = loadModelsCatalogContext({ cwd, env });
+  const vis = modelsConfig?.visibility ?? ctx.modelsConfig.visibility;
+  const registry = registryModels ?? ctx.registryModels;
+  const tierDefaults = collectTierDefaultIds(registry);
+  const allowed = new Set();
+
+  if (currentModel) allowed.add(currentModel);
+
+  for (const family of PROVIDER_FAMILY_TIERS) {
+    if (!isProviderConfigured(family.id, env)) continue;
+    if (!providerFamilyEnabled(family.id, vis)) continue;
+
+    const tiers = family.resolve({});
+    const pins = uniqueStrings(['reasoning', 'standard', 'fast'].map((tier) => tiers[tier]));
+    const shipped = uniqueStrings(
+      ['reasoning', 'standard', 'fast'].flatMap((tier) => family.options?.[tier] || []),
+    );
+
+    if (vis.mode === 'explicit') {
+      for (const id of vis.include || []) allowed.add(id);
+      continue;
+    }
+    if (vis.mode === 'all_configured') {
+      for (const id of [...pins, ...shipped]) allowed.add(id);
+      continue;
+    }
+    if (tierDefaults.length > 0) {
+      for (const id of [...tierDefaults, ...pins]) allowed.add(id);
+    } else {
+      for (const id of [...pins, ...shipped]) allowed.add(id);
+    }
+  }
+
+  for (const id of vis.exclude || []) allowed.delete(id);
+  return allowed;
+}
+
 // Provider families with open-ended model catalogs: credential presence is the
 // gate; static option lists are hints, not exhaustive allowlists.
 
@@ -504,16 +556,44 @@ const LENIENT_MODEL_FAMILIES = new Set([
   'local',
 ]);
 
+export const RETIRED_MODEL_SLUGS = new Set([
+  'anthropic/claude-3.5-sonnet',
+  'openrouter/anthropic/claude-3.5-sonnet',
+]);
+
+function shippedModelIdsForFamily(family) {
+  if (!family) return [];
+  const tiers = family.resolve({});
+  return uniqueStrings([
+    tiers.reasoning,
+    tiers.standard,
+    tiers.fast,
+    ...(family.options?.reasoning ?? []),
+    ...(family.options?.standard ?? []),
+    ...(family.options?.fast ?? []),
+  ]);
+}
+
+function isLenientPollSlug(modelId) {
+  return modelId === 'openrouter/free'
+    || modelId === 'openrouter/openrouter/free'
+    || /:free$/i.test(modelId);
+}
+
 /**
  * Check whether a model id can be used on this machine right now: the provider
  * family must match, credentials must be present (including op:// and Copilot
  * auth-store), and for fixed-catalog families (e.g. github-copilot) the id must
  * appear in the shipped option list or tier defaults — not a stale CX_MODEL pin.
  */
-export function isChatModelAvailable(modelId, { env = process.env, excludeFamilies = [] } = {}) {
+export function isModelAvailable(modelId, { env = process.env, excludeFamilies = [], strictPin = false } = {}) {
   if (!modelId || typeof modelId !== 'string') {
     return { ok: false, reason: 'missing', modelId: modelId || null };
   }
+  if (RETIRED_MODEL_SLUGS.has(modelId)) {
+    const family = matchProviderFamily(modelId);
+    return { ok: false, reason: 'model_retired', modelId, provider: family?.id || null };
+  }
   const family = matchProviderFamily(modelId);
   if (!family) {
     return { ok: false, reason: 'unknown_family', modelId };
@@ -543,7 +623,14 @@ export function isChatModelAvailable(modelId, { env = process.env, excludeFamili
     return { ok: true, modelId, provider: family.id };
   }
   if (LENIENT_MODEL_FAMILIES.has(family.id)) {
-    return { ok: true, modelId, provider: family.id };
+    if (!strictPin || isLenientPollSlug(modelId)) {
+      return { ok: true, modelId, provider: family.id };
+    }
+    const shipped = shippedModelIdsForFamily(family);
+    if (shipped.includes(modelId)) {
+      return { ok: true, modelId, provider: family.id };
+    }
+    return { ok: false, reason: 'model_not_available', modelId, provider: family.id };
   }
   const { providers } = getProviderModelCatalog({ env });
   const provider = providers.find((p) => p.id === family.id);
@@ -564,27 +651,105 @@ export function isChatModelAvailable(modelId, { env = process.env, excludeFamili
   return { ok: false, reason: 'model_not_available', modelId, provider: family.id };
 }
 
-function availabilityNotice(rejected) {
-  if (!rejected?.modelId) return null;
-  const label = rejected.modelId;
+export function listAvailableModels({ env = process.env, cwd = process.cwd(), activeModelId = null } = {}) {
+  const { providers } = getProviderModelCatalog({ env, cwd, activeModelId });
+  const models = [];
+  const seen = new Set();
+  for (const provider of providers) {
+    for (const tier of ['reasoning', 'standard', 'fast']) {
+      for (const id of provider.options?.[tier] || []) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        models.push({
+          id,
+          label: id,
+          provider: provider.id,
+          configured: provider.configured,
+          local: provider.local === true,
+          suitable: true,
+          tier,
+          available: isModelAvailable(id, { env }).ok,
+        });
+      }
+    }
+  }
+  return models.sort((a, b) => Number(b.configured) - Number(a.configured) || a.id.localeCompare(b.id));
+}
+
+/**
+ * Structured notices when a pinned model cannot run and a fallback is used.
+ * Returns multiple lines; `notice` on the resolution object joins them for
+ * single-string consumers.
+ */
+export function formatModelResolutionNotices({
+  rejected,
+  activeId = null,
+  activeProviderLabel = null,
+  configEnvPath = null,
+} = {}) {
+  if (!rejected?.modelId) return [];
+  const pinned = rejected.modelId;
+  const configPath = configEnvPath || getUserEnvPath();
+  const lines = [];
+
   if (rejected.reason === 'provider_not_configured') {
     const family = rejected.provider || '';
+    lines.push(`Pinned ${pinned}`);
     if (family.startsWith('openrouter')) {
-      return `Saved ${label} — OpenRouter not configured. Set OPENROUTER_API_KEY in ~/.config/construct/config.env or run \`construct creds set openrouter\`.`;
+      lines.push(`OpenRouter unavailable: OPENROUTER_API_KEY not found in ${configPath}`);
+      lines.push('Set a value or op:// ref in config.env, run `node scripts/setup-credentials.mjs`, or launch with `op run --env-file=…`');
+    } else {
+      lines.push(`Provider unavailable: credentials not configured for ${family || 'requested provider'}`);
+      lines.push(`Set keys in ${configPath} or run \`construct creds set <provider>\``);
     }
-    return `Saved ${label} — provider not configured.`;
+    if (activeId) {
+      const suffix = activeProviderLabel ? ` (${activeProviderLabel})` : '';
+      lines.push(`Active model: ${activeId}${suffix}`);
+    }
+    return lines;
   }
-  if (rejected.reason === 'model_not_available') {
-    return `Pinned ${label} — not available on your account.`;
+
+  if (rejected.reason === 'model_not_available' || rejected.reason === 'model_retired') {
+    lines.push(`Pinned ${pinned} — not available on your account.`);
+    if (activeId) {
+      const suffix = activeProviderLabel ? ` (${activeProviderLabel})` : '';
+      lines.push(`Active model: ${activeId}${suffix}`);
+    }
+    return lines;
   }
+
   if (rejected.reason === 'model_not_pulled') {
-    const native = rejected.nativeModel || toOllamaNativeModelId(label);
-    return `Pinned ${label} — not installed locally. Run \`ollama pull ${native}\` or \`construct ollama pull ${native}\`.`;
+    const native = rejected.nativeModel || toOllamaNativeModelId(pinned);
+    lines.push(`Pinned ${pinned} — not installed locally. Run \`ollama pull ${native}\` or \`construct ollama pull ${native}\`.`);
+    if (activeId) {
+      const suffix = activeProviderLabel ? ` (${activeProviderLabel})` : '';
+      lines.push(`Active model: ${activeId}${suffix}`);
+    }
+    return lines;
   }
+
   if (rejected.reason === 'unknown_family') {
-    return `Pinned ${label} — unrecognized model id.`;
+    lines.push(`Pinned ${pinned} — unrecognized model id.`);
+    return lines;
+  }
+
+  lines.push(`Pinned ${pinned} — unavailable.`);
+  if (activeId) {
+    const suffix = activeProviderLabel ? ` (${activeProviderLabel})` : '';
+    lines.push(`Active model: ${activeId}${suffix}`);
   }
-  return `Pinned ${label} — unavailable.`;
+  return lines;
+}
+
+function resolutionNotices(rejections, activeId, activeProviderLabel) {
+  if (!rejections.length) return { notice: null, notices: [] };
+  const notices = formatModelResolutionNotices({
+    rejected: rejections[0],
+    activeId,
+    activeProviderLabel,
+    configEnvPath: getUserEnvPath(),
+  });
+  return { notice: notices.length ? notices.join(' ') : null, notices };
 }
 
 function recommendTierModel(tier, { env = process.env, excludeFamilies = [] } = {}) {
@@ -596,7 +761,7 @@ function recommendTierModel(tier, { env = process.env, excludeFamilies = [] } =
       ...(provider.options?.[tier] ?? []),
     ]);
     for (const id of candidates) {
-      const check = isChatModelAvailable(id, { env, excludeFamilies });
+      const check = isModelAvailable(id, { env, excludeFamilies });
       if (check.ok) return { id, provider: provider.label, tier };
     }
   }
@@ -604,17 +769,17 @@ function recommendTierModel(tier, { env = process.env, excludeFamilies = [] } =
 }
 
 /**
- * Resolve the chat model with validation: explicit request and CX_MODEL pins
+ * Resolve a model with validation: explicit request and CX_MODEL pins
  * are preferences, not blind truth. Stale or unconfigured pins fall through to
  * the next configured provider for the tier, with a human-readable notice.
  */
-export function resolveValidatedChatModel({ env = process.env, requested = null, excludeFamilies = [] } = {}) {
+export function resolveValidatedModel({ env = process.env, requested = null, excludeFamilies = [] } = {}) {
   const rejections = [];
 
   if (requested) {
-    const check = isChatModelAvailable(requested, { env, excludeFamilies });
+    const check = isModelAvailable(requested, { env, excludeFamilies, strictPin: true });
     if (check.ok) {
-      return { id: requested, source: 'explicit', notice: null, rejected: [] };
+      return { id: requested, source: 'explicit', notice: null, notices: [], rejected: [] };
     }
     rejections.push(check);
   }
@@ -626,34 +791,36 @@ export function resolveValidatedChatModel({ env = process.env, requested = null,
   ];
   for (const [tier, pin] of pinOrder) {
     if (!pin) continue;
-    const check = isChatModelAvailable(pin, { env, excludeFamilies });
+    const check = isModelAvailable(pin, { env, excludeFamilies, strictPin: true });
     if (check.ok) {
-      const notice = rejections.length
-        ? `${availabilityNotice(rejections[0])} Using ${pin}.`
-        : null;
-      return { id: pin, source: 'pin', tier, notice, rejected: rejections };
+      const { notice, notices } = rejections.length
+        ? resolutionNotices(rejections, pin, null)
+        : { notice: null, notices: [] };
+      return { id: pin, source: 'pin', tier, notice, notices, rejected: rejections };
     }
     rejections.push(check);
   }
 
   const standard = recommendTierModel('standard', { env, excludeFamilies });
   if (standard) {
-    const notice = rejections.length
-      ? `${availabilityNotice(rejections[0])} Using ${standard.id} (${standard.provider}).`
-      : null;
-    return { id: standard.id, source: 'recommended', tier: 'standard', notice, rejected: rejections };
+    const { notice, notices } = rejections.length
+      ? resolutionNotices(rejections, standard.id, standard.provider)
+      : { notice: null, notices: [] };
+    return { id: standard.id, source: 'recommended', tier: 'standard', notice, notices, rejected: rejections };
   }
 
   const anyTier = recommendTierModel('reasoning', { env, excludeFamilies }) || recommendTierModel('fast', { env, excludeFamilies });
   if (anyTier) {
-    const notice = rejections.length
-      ? `${availabilityNotice(rejections[0])} Using ${anyTier.id} (${anyTier.provider}).`
-      : null;
-    return { id: anyTier.id, source: 'recommended', tier: anyTier.tier, notice, rejected: rejections };
+    const { notice, notices } = rejections.length
+      ? resolutionNotices(rejections, anyTier.id, anyTier.provider)
+      : { notice: null, notices: [] };
+    return { id: anyTier.id, source: 'recommended', tier: anyTier.tier, notice, notices, rejected: rejections };
   }
 
-  const notice = rejections.length ? availabilityNotice(rejections[0]) : null;
-  return { id: null, source: null, notice, rejected: rejections };
+  const { notice, notices } = rejections.length
+    ? resolutionNotices(rejections, null, null)
+    : { notice: null, notices: [] };
+  return { id: null, source: null, notice, notices, rejected: rejections };
 }
 
 /**
@@ -893,7 +1060,7 @@ export function classifyProviderFailure(input) {
 
   const patterns = [
     { kind: "rate_limit", retryable: true, test: /\b429\b|rate limit|usage limits?|too many requests|quota exceeded|weekly limit|monthly limit|daily limit/i },
-    { kind: "provider_unavailable", retryable: true, test: /model unavailable|model.*overloaded|ProviderModelNotFoundError|model.*not found|no such model/i },
+    { kind: "provider_unavailable", retryable: true, test: /model unavailable|model.*overloaded|ProviderModelNotFoundError|model.*not found|no such model|no endpoints found/i },
     { kind: "provider_unavailable", retryable: true, test: /service unavailable|temporarily unavailable|upstream error|server error|\b5\d\d\b/i },
     { kind: "transient_network", retryable: true, test: /timeout|timed out|ETIMEDOUT|ECONNRESET|network error|fetch failed/i },
     { kind: "auth_error", retryable: false, test: /unauthorized|forbidden|invalid api key|authentication failed/i },

package/lib/models/catalog.mjs

@@ -2,11 +2,12 @@
  * lib/models/catalog.mjs — live model catalog merge, cache, and visibility filter.
  *
  * Merges static provider-family hints with cached OpenRouter free-model polls,
- * then applies construct.config.json models.visibility rules so chat, CLI, and
+ * then applies construct.config.json models.visibility rules so CLI, hosts, and
  * dashboard share one filtered catalog surface.
  */
 
 import fs from 'node:fs';
+import { loadRegistry } from '../registry/loader.mjs';
 import path from 'node:path';
 import os from 'node:os';
 import { pollFreeModels } from '../model-free-selector.mjs';
@@ -18,7 +19,7 @@ export const MODEL_VISIBILITY_MODES = ['all_configured', 'tier_defaults', 'expli
 
 export const DEFAULT_MODELS_CONFIG = Object.freeze({
   visibility: Object.freeze({
-    mode: 'all_configured',
+    mode: 'tier_defaults',
     include: [],
     exclude: [],
     providers: {},
@@ -93,7 +94,7 @@ export async function refreshLiveOpenRouterCatalog({ env = process.env, homeDir
   return models;
 }
 
-function providerFamilyEnabled(providerId, visibility) {
+export function providerFamilyEnabled(providerId, visibility) {
   const map = visibility.providers || {};
   if (Object.keys(map).length === 0) return true;
   if (map[providerId] === false) return false;
@@ -101,7 +102,7 @@ function providerFamilyEnabled(providerId, visibility) {
   return map[providerId] !== false;
 }
 
-function collectTierDefaultIds(registryModels = {}) {
+export function collectTierDefaultIds(registryModels = {}) {
   const ids = [];
   for (const tier of ['reasoning', 'standard', 'fast']) {
     const def = registryModels[tier];
@@ -130,6 +131,18 @@ export function mergeLiveModelsIntoProviders(providers, liveModels = [], { maxLi
   });
 }
 
+function collectShippedModelIds(provider) {
+  if (!provider) return [];
+  return uniqueStrings([
+    provider.tiers?.reasoning,
+    provider.tiers?.standard,
+    provider.tiers?.fast,
+    ...(provider.staticOptions?.reasoning ?? []),
+    ...(provider.staticOptions?.standard ?? []),
+    ...(provider.staticOptions?.fast ?? []),
+  ]);
+}
+
 export function applyModelVisibilityFilter(catalog, {
   visibility = DEFAULT_MODELS_CONFIG.visibility,
   registryModels = {},
@@ -138,6 +151,7 @@ export function applyModelVisibilityFilter(catalog, {
   const includeSet = new Set(visibility.include || []);
   const excludeSet = new Set(visibility.exclude || []);
   const tierDefaults = collectTierDefaultIds(registryModels);
+  const providerById = new Map((catalog.providers || []).map((provider) => [provider.id, provider]));
 
   const modelAllowed = (modelId, providerId) => {
     if (!modelId) return false;
@@ -148,7 +162,11 @@ export function applyModelVisibilityFilter(catalog, {
       return includeSet.has(modelId);
     }
     if (visibility.mode === 'tier_defaults') {
-      return tierDefaults.includes(modelId);
+      const shipped = collectShippedModelIds(providerById.get(providerId));
+      if (tierDefaults.length > 0) {
+        return tierDefaults.includes(modelId) || shipped.includes(modelId);
+      }
+      return shipped.includes(modelId);
     }
     return true;
   };
@@ -183,10 +201,8 @@ export function loadModelsCatalogContext({ cwd = process.cwd(), env = process.en
   const modelsConfig = resolveModelsConfig(config);
   let registryModels = {};
   try {
-    const registryPath = path.join(cwd, 'specialists', 'registry.json');
-    if (fs.existsSync(registryPath)) {
-      registryModels = JSON.parse(fs.readFileSync(registryPath, 'utf8')).models ?? {};
-    }
+    const registry = loadRegistry({ rootDir: cwd, skipValidation: true });
+    registryModels = registry?.models ?? {};
   } catch { /* registry read is best-effort outside repo root */ }
   const liveModels = modelsConfig.catalog.liveOpenRouter
     ? (readLiveCatalogCache({ homeDir }) ?? [])

package/lib/models/execution-capability-profile.mjs

@@ -3,7 +3,7 @@
  * record (construct-6zga.1.8).
  *
  * Consolidates the four formerly-scattered capability producers into one
- * serializable, versioned record that chat (resolveCapabilityTier) and specialist
+ * serializable, versioned record that model routing (resolveCapabilityTier) and specialist
  * prompt composition (resolveModelOperatingProfile via lib/prompt-composer.js) both
  * consume. It is keyed by provider, requested/resolved model, adapter protocol, and
  * observation time. Every capability declares an evidence source
@@ -57,8 +57,8 @@ export function providerGroupForModel(model) {
   return seg || 'unknown';
 }
 
-// Adapter protocol mirrors the dispatch in apps/chat/engine/ai-sdk-agent.mjs:
-// Anthropic uses its native messages API, OpenAI and Copilot use chat completions,
+// Adapter protocol mirrors provider worker dispatch:
+// Anthropic uses its native messages API, OpenAI and Copilot use completions,
 // and every other provider goes through the OpenAI-compatible shim.
 
 function adapterProtocolForGroup(group) {

package/lib/models/execution-policy.mjs

@@ -81,11 +81,10 @@ function oneOf(allowed, value, fallback) {
   return allowed.includes(value) ? value : fallback;
 }
 
-// The chat turn overlay (lib/chat/transparency.mjs) speaks the orchestration
-// vocabulary (INTENT_CLASSES, risk flags, externalResearch). These helpers map it
+// Routing overlays speak the orchestration vocabulary (INTENT_CLASSES, risk flags,
+// externalResearch). These helpers map that vocabulary
 // onto the compiler's stable input enums so the compiler stays decoupled from
-// routing changes. A turn that follows a failed tool result is the recovery case
-// the loop signals with toolFailure.
+// routing changes. A turn that follows a failed tool result is the recovery case.
 
 export function normalizePolicyIntent({ intent = null, assumptionsBlocked = false, toolFailure = false } = {}) {
   if (toolFailure === true) return 'tool-failure';
@@ -240,10 +239,10 @@ export function compileExecutionPolicy({
 }
 
 /**
- * Compile a policy directly from a chat turn overlay (lib/chat/transparency.mjs),
+ * Compile a policy directly from a routing overlay,
  * normalizing its routing vocabulary into the compiler's input enums first.
  */
-export function compilePolicyFromOverlay({ profile = null, overlay = null, toolFailure = false } = {}) {
+export function compilePolicyFromRoutingOverlay({ profile = null, overlay = null, toolFailure = false } = {}) {
   const intent = normalizePolicyIntent({
     intent: overlay?.intent,
     assumptionsBlocked: overlay?.assumptionsBlocked === true,
@@ -257,6 +256,8 @@ export function compilePolicyFromOverlay({ profile = null, overlay = null, toolF
   return compileExecutionPolicy({ profile, intent, risk, evidenceRequirement });
 }
 
+export const compilePolicyFromOverlay = compilePolicyFromRoutingOverlay;
+
 /**
  * Hand-rolled validator (no ajv — Construct stays dependency-free at startup).
  * Returns { valid, errors } against schemas/execution-policy.schema.json.

package/lib/models/provider-poll.mjs

@@ -71,8 +71,16 @@ function openRouterCapabilities(model) {
   };
 }
 
+function resolveSecretOrNull(varNames, opts) {
+  try {
+    return resolveFirstSecret(varNames, opts);
+  } catch {
+    return null;
+  }
+}
+
 export async function pollOpenRouter({ env = process.env } = {}) {
-  const apiKey = resolveFirstSecret(['OPENROUTER_API_KEY', 'OPEN_ROUTER_API_KEY'], { env });
+  const apiKey = resolveSecretOrNull(['OPENROUTER_API_KEY', 'OPEN_ROUTER_API_KEY'], { env, allowAmbient: env === process.env });
   const headers = apiKey ? { Authorization: `Bearer ${apiKey}` } : {};
   const data = await fetchJson('https://openrouter.ai/api/v1/models', { headers });
   if (!data) return null;
@@ -80,10 +88,15 @@ export async function pollOpenRouter({ env = process.env } = {}) {
   const models = [];
   for (const m of list) {
     if (!m?.id) continue;
+    const outputs = m.architecture?.output_modalities;
+    if (Array.isArray(outputs) && outputs.length && !outputs.includes('text')) continue;
+    if (/(embed|rerank|whisper|tts|dall-e|moderation|transcribe|sora)/i.test(m.id)) continue;
     const free = isFreePricing(m.pricing);
     const input = Number(m.pricing?.prompt);
     const output = Number(m.pricing?.completion);
     const caps = openRouterCapabilities(m);
+    const context = Number(m.context_length) || null;
+    if (!free && context && context < 8000) continue;
     models.push({
       id: `openrouter/${m.id}`,
       label: m.name || m.id,
@@ -92,11 +105,12 @@ export async function pollOpenRouter({ env = process.env } = {}) {
       pricing: Number.isFinite(input) && Number.isFinite(output)
         ? { input: input * 1_000_000, output: output * 1_000_000 }
         : null,
-      context: Number(m.context_length) || null,
+      context,
       reasoning: caps.reasoning,
       tools: caps.tools,
       toolsKnown: true,
       vision: caps.vision,
+      architecture: m.architecture || null,
       source: 'live',
     });
   }
@@ -110,7 +124,7 @@ export async function pollOpenRouter({ env = process.env } = {}) {
 const OPENAI_NON_CHAT = /(embedding|whisper|tts|audio|realtime|image|dall-e|moderation|search|babbage|davinci|transcribe|sora)/i;
 
 export async function pollOpenAI({ env = process.env } = {}) {
-  const apiKey = resolveFirstSecret(['OPENAI_API_KEY'], { env });
+  const apiKey = resolveSecretOrNull(['OPENAI_API_KEY'], { env, allowAmbient: env === process.env });
   if (!apiKey) return null;
   const data = await fetchJson('https://api.openai.com/v1/models', {
     headers: { Authorization: `Bearer ${apiKey}` },
@@ -141,7 +155,7 @@ export async function pollOpenAI({ env = process.env } = {}) {
 }
 
 export async function pollAnthropic({ env = process.env } = {}) {
-  const apiKey = resolveFirstSecret(['ANTHROPIC_API_KEY'], { env });
+  const apiKey = resolveSecretOrNull(['ANTHROPIC_API_KEY'], { env, allowAmbient: env === process.env });
   if (!apiKey) return null;
   const data = await fetchJson('https://api.anthropic.com/v1/models?limit=100', {
     headers: { 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' },