@margay/ccl-core 1.3.5-rc.7 → 1.3.6-alpha.1

package/README.md

@@ -63,12 +63,18 @@ configuration.
 | Claude OAuth | Claude subscription sessions | Run `ccl` and follow the login prompt, or use `/login` |
 | Anthropic API key | Direct Anthropic API use | Set `ANTHROPIC_API_KEY=<key>` or pass `--api-key <key>` |
 
-Gateway configuration is saved to `~/.ccl/gateway.json` and synchronized into a
-managed shell rc block by `/gateway login` and `/gateway register`. If a parent
-terminal already exported `CCL_GATEWAY_URL` or `CCL_GATEWAY_KEY`, that terminal's
-environment still wins for newly launched child processes. Use `/gateway doctor`
-to detect mismatches, then open a new terminal, reload the shell rc file, or
-unset the old variables.
+Gateway configuration is saved to `~/.ccl/gateway.json`. CCL records the
+credential type and binds it to the normalized Gateway URL. `/gateway register`
+accepts only the returned Gateway JWT and verifies it with the same Gateway's
+`/auth/me`; `/gateway login` verifies a Gateway-owned credential before saving
+it. Do not paste an upstream model-provider API key into either command or into
+`CCL_GATEWAY_KEY`.
+
+If a parent terminal explicitly exports a Gateway configuration, use all four
+variables as one atomic set: `CCL_GATEWAY_URL`, `CCL_GATEWAY_KEY`,
+`CCL_GATEWAY_CREDENTIAL_TYPE`, and `CCL_GATEWAY_ISSUER`. Prefer the slash
+commands so CCL creates this metadata safely. `/gateway doctor` reports and
+quarantines untyped opaque or issuer-mismatched credentials before any request.
 
 ## Gateway Commands
 
@@ -178,6 +184,20 @@ ccl -p "summarize this diff" --model sonnet
 ccl -p "generate a migration plan" --model deepseek-v4-pro --effort high
 ```
 
+Capability pools use explicit `cost-first ranking` and `quality-first ranking`
+policies. For `visual-ui-analysis`, the current cost-first ranking is Qwen 3.8
+Flash → DeepSeek V4 Flash Vision Exp → Grok 4.5; the quality-first ranking is
+Qwen 3.8 Flash → Grok 4.5 → K3 / Moonshot Platform. DeepSeek Vision remains
+experimental. The hidden K3 visual route is reported as canonical model
+`kimi-platform/kimi-k3`.
+
+Anthropic Messages remains the transport for the main Agent, planning, editing,
+tool calling, Advisor, Critic, and general subagent loops. Native OpenAI Chat
+Completions support is deliberately bounded to zero-tool, one-shot visual
+analysis and context compaction. These consumers select and pin one configured
+model before the request; they do not convert protocols, vote on normal results,
+or automatically escalate to another model after a completed answer.
+
 ## Workflows
 
 The `workflow` command and `/workflows` slash command run multi-step task
@@ -232,7 +252,8 @@ SDK references:
 
 | Variable | Purpose |
 |---|---|
-| `CCL_GATEWAY_URL`, `CCL_GATEWAY_KEY` | Margay gateway URL and token |
+| `CCL_GATEWAY_URL`, `CCL_GATEWAY_KEY` | Margay gateway URL and credential; prefer `/gateway login` over manual export |
+| `CCL_GATEWAY_CREDENTIAL_TYPE`, `CCL_GATEWAY_ISSUER` | Credential admission metadata; required as an atomic pair for opaque environment credentials |
 | `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL` | Direct Anthropic API-key channel |
 | `CCL_MODEL` | Default model |
 | `CCL_ROUTING_PRIORITY` | Default routing preference, usually `cost` or `quality` |