@odla-ai/cli 0.5.0 → 0.7.0

package/llms.txt

@@ -1,6 +1,6 @@
 # @odla-ai/cli — LLM context
 
-> Agent-operable CLI for provisioning odla apps, services, credentials, Worker secrets, and local runtime files.
+> Agent-operable CLI for odla provisioning, scoped System AI administration, hosted security runs, Worker secrets, and smoke checks.
 
 > ⚠️ **Early access — pre-1.0.** Agents work from bounded runbooks; humans
 > approve credentials, production changes, releases, and merges. APIs and exact
@@ -9,9 +9,11 @@
 
 Project-neutral provisioning CLI for odla apps. It creates and validates an
 `odla.config.mjs`, then uses that config to register an app, enable services,
-push odla-db schema/rules, configure platform AI, configure Clerk auth, record
+push odla-db schema/rules, configure per-app BYOK AI, configure Clerk auth, record
 deployment links, provision o11y ingest credentials, and transfer local or
-deployed Worker secrets without printing them.
+deployed Worker secrets without printing them. It also gives platform admins a
+scoped System AI control surface and gives app owners a provider-key-free
+hosted security command.
 
 It does not know about any specific app. App identity, environments, services,
 schema, rules, auth, AI provider, and links all come from config.
@@ -29,8 +31,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.5.0 version
-npm i -D --save-exact @odla-ai/cli@0.5.0
+npm view @odla-ai/cli@0.7.0 version
+npm i -D --save-exact @odla-ai/cli@0.7.0
 ```
 
 ## Prerequisites
@@ -59,6 +61,14 @@ npx odla-ai provision --dry-run
 npx odla-ai provision --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai secrets push --env dev
+npx odla-ai security run . --env dev --ack-redacted-source
+npx odla-ai admin ai show
+npx odla-ai admin ai models
+npx odla-ai admin ai set security --discovery-provider anthropic --discovery-model claude-opus-4-8 --validation-provider openai --validation-model gpt-5.5 --enabled
+npx odla-ai admin ai credentials
+npx odla-ai admin ai credential set anthropic --from-env ANTHROPIC_API_KEY
+npx odla-ai admin ai usage --app-id my-app --env prod --limit 50
+npx odla-ai admin ai audit --limit 25
 npx odla-ai skill install
 npx odla-ai version
 ```
@@ -119,17 +129,56 @@ when provisioning has not written `.odla/credentials.local.json`.
 
 The bundled build/migration skills add a passive pre-ship gate with
 `@odla-ai/security`: after the exact-version availability check, run
-`npm i -D --save-exact @odla-ai/security@0.1.0`, then
+`npm i -D --save-exact @odla-ai/security@0.2.0`, then
 `npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical`.
-This is a separate binary, not a hidden `odla-ai` subcommand; it makes no model
-calls and does not execute target code.
+The passive scan remains a separate binary: it makes no model calls and does
+not execute target code. After explicit redacted-source approval,
+`odla-ai security run . --env dev --ack-redacted-source` adds hosted discovery
+and independent validation. The CLI obtains/reuses app-owner auth and the
+platform supplies bounded role grants; it never requests provider keys.
+The CLI schedules within those grants: recon consumes one discovery call,
+first-pass hunts are capped before retries, and validation handles the
+highest-risk candidates first. Used/skipped role calls appear in the summary
+and report. Budget-limited coverage is explicitly incomplete and still fails
+the default gate unless `--allow-incomplete` is supplied after review.
+All hosted-security network calls target the configured odla platform origin.
+The CLI transmits typed redacted security operations only and never contacts a
+model-provider host; odla.ai owns the prompts/schemas, route, credential,
+provider call, attribution, and receipt. Cached/environment tokens are bound to
+their canonical platform audience and are rejected before disclosure on a
+different origin. For a non-default platform, set the matching
+`ODLA_DEV_TOKEN_AUDIENCE` with `ODLA_DEV_TOKEN`.
+Early-access run ceilings are rolling; a `429` includes the platform's safe
+retry hint, which the CLI surfaces without echoing arbitrary response text.
 Before installing the exact release, require
-`npm view @odla-ai/security@0.1.0 version` to succeed before installation. An
+`npm view @odla-ai/security@0.2.0 version` to succeed before installation. An
 exact-version `E404` means the release is unavailable, not that the security
 preflight passed, and does not prove the package name is absent. odla's own
 engineering environment uses an equivalent internal gate; customer projects
 should use the published `odla-security` command above.
 
+`admin ai show|models|set|credentials|credential set|usage|audit` manages platform-funded System
+AI (`o11y.triage`, `security.discovery`, `security.validation`). It uses a
+separate, mode-`0600` `.odla/admin-token.local.json` cache. Studio displays the
+exact scope, only an admin can approve it, and it expires after ~15 minutes;
+policy, credential, and usage capabilities are separate and cannot act as the
+approver on ordinary app/db/o11y routes. `admin ai models` reads the server
+catalog. `admin ai set security` updates discovery and independent validation
+together with expected revisions; a concurrent edit returns 409 and reloads
+instead of being overwritten. `admin ai usage` requests its own read-only
+capability and lists metadata-only events and status aggregates; filter by
+`--app-id`, `--env`, `--run-id`, and `--limit`, or emit `--json`. Prompts,
+repository source, model output, reports, and provider credentials are never in
+that response.
+`admin ai audit` uses its own read capability for immutable, metadata-only
+policy and credential change events with actor attribution; credential values
+never enter that trail. Credential writes accept only
+`--from-env <NAME>` or `--stdin` and never place the value in argv, output, or
+the cache. System AI and each app's BYOK AI are separate vault/funding paths.
+Admin bounds can only narrow hard ceilings of 64 calls per role/run and, for
+each call, 512 KiB input and 32,768 output tokens. A non-default platform environment token
+must declare the matching `ODLA_ADMIN_TOKEN_AUDIENCE`.
+
 `secrets push --env <env>` is the narrower recovery/retry command. It moves the
 configured env's odla-db key and/or o11y ingest token from
 `.odla/credentials.local.json` into the deployed Worker by piping each value
@@ -151,7 +200,8 @@ agent owns application semantics: installing `@odla-ai/o11y`, wrapping the
 Worker with `withObservability`, and choosing useful spans, metrics, errors, and
 LLM-usage records. The human owns the device approval, production consent, and
 explicit destructive rotation. Studio is where people view telemetry and
-perform manual recovery; its token control is not the normal setup path.
+perform manual recovery, configure System AI, and inspect app/run-attributed
+platform usage; its o11y token control is not the normal setup path.
 Run `npx odla-ai capabilities` for the human-readable contract or add `--json`
 when an agent or tool needs to branch on it without scraping prose.
 
@@ -230,9 +280,11 @@ If schema is present and rules are omitted, `defaultRules: "deny"` generates
 deny-all rules for every schema entity. That is the safe default for Workers
 that mediate reads and writes with an app key.
 
-## API reference (generated from dist/index.d.ts, v0.5.0)
+## API reference (generated from dist/index.d.ts, v0.7.0)
 
 ```ts
+import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+
 /**
  * Parse CLI arguments and dispatch to the matching command — the entry point
  * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first
@@ -243,7 +295,11 @@ that mediate reads and writes with an app key.
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `provision` runs the full provision (including optional secret
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies,
+ * transfers write-only credentials, and reads metadata-only attributed usage
+ * through separate short-lived exact-scope device grants;
+ * `security run` performs an explicitly acknowledged, app-attributed hosted
+ * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
  * `setup` and `skill install` install the bundled offline runbooks for Claude
  * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and
@@ -256,13 +312,77 @@ that mediate reads and writes with an app key.
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** One exact platform scope obtainable through the admin device flow. */
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: ScopedPlatformScope;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+
+/** Hosted platform purposes whose provider, model, and budgets an admin may route. */
+declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
+/** One catalog-validated, platform-funded System AI purpose. */
+type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
+
+/** Inputs for one System AI policy/catalog read, policy update,
+ * credential-status read, write-only credential transfer, or metadata-only
+ * usage or admin-audit read. Provider values may come only from a named environment variable
+ * or stdin. */
+interface AdminAiOptions {
+    action: "show" | "models" | "set" | "credentials" | "credential-set" | "usage" | "audit";
+    purpose?: string;
+    provider?: string;
+    model?: string;
+    enabled?: boolean;
+    maxInputBytes?: number;
+    maxOutputTokens?: number;
+    maxCallsPerRun?: number;
+    platform?: string;
+    token?: string;
+    json?: boolean;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    credentialProvider?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    readStdin?: () => Promise<string>;
+    discoveryProvider?: string;
+    discoveryModel?: string;
+    validationProvider?: string;
+    validationModel?: string;
+    /** Optional metadata-only usage filters. */
+    appId?: string;
+    env?: string;
+    runId?: string;
+    limit?: number;
+    /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
+    tokenFile?: string;
+}
+/** Read or update platform-funded AI routing and inspect attributed usage.
+ * Authentication is a short-lived,
+ * explicitly scoped device grant; ordinary app developer tokens never become
+ * platform admins. Credential writes accept values only from a named env var
+ * or stdin, transfer them once, and never place them in argv, output, or the
+ * scoped-token cache. */
+declare function adminAi(options: AdminAiOptions): Promise<void>;
+
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges"];
-    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable"];
+    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
+    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -535,6 +655,61 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/** Built-in security coverage profile selected for a hosted reasoning run. */
+type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
+/** Exact attribution and authorization need supplied to a lazy token callback. */
+interface HostedSecurityTokenRequest {
+    platform: string;
+    appId: string;
+    env: string;
+    selfAudit: boolean;
+    /** Self-audit asks the caller for an explicitly scoped platform credential. */
+    /** Ordinary app runs use owner authority and therefore request no platform scope. */
+    scope: "platform:security:self" | null;
+}
+/** Local snapshot/orchestration controls for an app-attributed hosted security
+ * run. The platform supplies model routes and provider credentials. */
+interface RunHostedSecurityOptions {
+    /** Project config; loaded for customer-app runs and ignored for self-audit. */
+    configPath?: string;
+    /** Scan odla itself under the protected odla-ai/prod identity. */
+    selfAudit?: boolean;
+    /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */
+    target?: string;
+    /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */
+    out?: string;
+    /** Customer environment. Must be declared in config. Self-audit always uses prod. */
+    env?: string;
+    profile?: HostedSecurityProfile;
+    maxHuntTasks?: number;
+    /** Exact acknowledgement required before any source capture or network call. */
+    sourceDisclosureAck?: "redacted";
+    /** Optional client correlation id; the platform returns the authoritative run id. */
+    runId?: string;
+    /** Platform override. Customer runs otherwise use config.platformUrl. */
+    platform?: string;
+    /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */
+    token?: string;
+    /** Lazy token acquisition. Receives the exact app/env and required scope. */
+    getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/** Completed local report, public platform run metadata, and private artifact path. */
+interface HostedSecurityResult {
+    report: SecurityReport;
+    run: Readonly<PlatformSecurityRun>;
+    output: string;
+}
+/**
+ * Run the hosted, redacted-source security harness for an odla app or odla's
+ * protected self-audit identity. Provider/model selection and provider secrets
+ * remain platform-owned; this function accepts only an app/scoped bearer and
+ * the opaque role grants remain inside @odla-ai/security's reasoner closures.
+ */
+declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
+
 /** Agent harnesses with a first-class local adapter. */
 declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 /** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
@@ -614,5 +789,5 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, doctor, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, secretsPush, smoke };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type SystemAiPurpose, adminAi, doctor, getScopedPlatformToken, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, runHostedSecurity, secretsPush, smoke };
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.5.0",
-  "description": "Agent-operable CLI for provisioning odla apps, services, credentials, Worker secrets, and local runtime files.",
+  "version": "0.7.0",
+  "description": "Agent-operable CLI for odla provisioning, scoped System AI administration, hosted security runs, Worker secrets, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
   "repository": {
@@ -59,9 +59,10 @@
     "prepublishOnly": "npm run build && npm run gen:llms"
   },
   "dependencies": {
-    "@odla-ai/ai": "^0.3.0",
+    "@odla-ai/ai": "^0.3.2",
     "@odla-ai/apps": "^0.7.1",
-    "@odla-ai/db": "^0.6.0"
+    "@odla-ai/db": "^0.6.2",
+    "@odla-ai/security": "^0.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",

package/skills/odla/SKILL.md

@@ -69,8 +69,12 @@ guessing which platform/credential steps need manual work. Then:
    ingest token when enabled), pushes schema + rules, writes `.dev.vars`, and
    transfers Worker secrets through Wrangler stdin.
 4. **run** — `npx wrangler dev` (auto-loads `.dev.vars`); verify locally.
-5. **security** — run the passive `@odla-ai/security` odla profile;
-   inspect every lead and keep critical candidate gating enabled.
+5. **security** — run the passive `@odla-ai/security` odla profile; inspect
+   every lead and keep critical candidate gating enabled. If the human approves
+   redacted source disclosure, follow with
+   `npx @odla-ai/cli security run . --env dev --ack-redacted-source` for
+   app-attributed discovery + independent validation. Never request provider
+   keys; the platform selects the routes and returns bounded role grants.
 6. **ship** ⏸ — after adding `prod`, run `npx @odla-ai/cli provision --dry-run`,
    show the human, then `npx @odla-ai/cli provision --yes --push-secrets` and
    `npx wrangler deploy`.

package/skills/odla/references/build.md

@@ -66,12 +66,12 @@ re-provision to push it, and retry.
 Install the passive harness and scan before any production secret or deploy:
 
 Before installing the exact release, first verify
-`npm view @odla-ai/security@0.1.0 version`. An exact-version `E404` means the
+`npm view @odla-ai/security@0.2.0 version`. An exact-version `E404` means the
 release is unavailable and blocks this preflight; it is not a clean scan and
 does not prove the package name is absent.
 
 ```
-npm i -D --save-exact @odla-ai/security@0.1.0
+npm i -D --save-exact @odla-ai/security@0.2.0
 npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical
 ```
 
@@ -80,6 +80,19 @@ not execute target code. A `candidate` is a review lead, not a confirmed
 vulnerability; do not suppress one merely to clear the gate. Baseline entries
 need a fingerprint, concrete reason, owner, and expiry.
 
+Optional hosted follow-up (human must explicitly approve redacted tracked-source
+disclosure under the configured providers' retention/residency terms):
+
+```
+npx @odla-ai/cli security run . --env dev --ack-redacted-source
+```
+
+Do not ask for Anthropic/OpenAI/Google keys. The CLI obtains app-owner auth;
+the platform fixes separate discovery/validation grants to the admin-configured
+routes, attributes usage to this app/env/run, and retains no source or prompts
+in its accounting ledger. If a rolling early-access ceiling returns `429`,
+surface the CLI's safe retry hint and do not loop or manufacture a provider key.
+
 ## 6. Ship  ⏸ human checkpoint
 
 Add `"prod"` to `envs`, provision again (prod tenant = the bare `appId`), then:

package/skills/odla/references/sdks.md

@@ -70,18 +70,21 @@ Run the passive CLI in local/CI development; do not import it into the running
 Worker:
 
 Before installing the exact release, require
-`npm view @odla-ai/security@0.1.0 version` to succeed before installing it. An
+`npm view @odla-ai/security@0.2.0 version` to succeed before installing it. An
 exact-version `E404` means the release is unavailable, not that the preflight
 passed, and does not prove the package name is absent.
 
 ```
-npm i -D --save-exact @odla-ai/security@0.1.0
+npm i -D --save-exact @odla-ai/security@0.2.0
 npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical
 ```
 
-Deterministic rules emit leads. Autonomous recon/hunt/validation is an optional
-library flow with separate models, persistent state, and an explicitly injected
-isolated executor; it never falls back to the host shell.
+Deterministic rules emit leads. After explicit redacted-source approval, run
+`npx @odla-ai/cli security run . --env dev --ack-redacted-source` for hosted,
+app-attributed discovery and independent validation. It obtains owner auth and
+never asks for provider keys. The lower-level library flow remains available
+for custom orchestrators; active reproduction still requires an explicitly
+injected isolated executor and never falls back to the host shell.
 
 ## Others
 

package/skills/odla-migrate/references/phase-2-db.md

@@ -10,8 +10,8 @@ in the browser in interactive terminals).
 
 ## Steps
 
-1. Require `npm view @odla-ai/cli@0.5.0 version` to succeed, then run
-   `npm i -D --save-exact @odla-ai/cli@0.5.0` and `npm i @odla-ai/db`.
+1. Require `npm view @odla-ai/cli@0.7.0 version` to succeed, then run
+   `npm i -D --save-exact @odla-ai/cli@0.7.0` and `npm i @odla-ai/db`.
 2. `npx @odla-ai/cli init --app-id <id> --name "<Name>" --env dev --services db`
    Review `odla.config.mjs`. Keep `envs: ["dev"]` — prod is Phase 5. Set
    `links.dev` to the URL the Phase 1 `wrangler deploy` **actually printed** —

package/skills/odla-migrate/references/phase-5-cutover.md

@@ -24,13 +24,17 @@ instance, never a second Clerk app per env; final go/no-go at each step.
    `secrets push --env prod --yes` only to retry the transfer (see
    references/secrets-map.md).
 3. Build, then run the passive pre-cutover security gate:
-   first require `npm view @odla-ai/security@0.1.0 version` to succeed. An
+   first require `npm view @odla-ai/security@0.2.0 version` to succeed. An
    exact-version `E404` means the release is unavailable and blocks cutover;
    it is not a clean scan and does not prove the package name is absent. Run
-   `npm i -D --save-exact @odla-ai/security@0.1.0` followed by
+   `npm i -D --save-exact @odla-ai/security@0.2.0` followed by
    `npx odla-security scan . --profile odla --out .odla/security/pre-cutover --fail-on high --fail-on-candidates critical`.
    Review `REPORT.md`; a candidate is a lead, not confirmation, and a baseline
    requires a concrete reason, owner, and expiry.
+   If the human explicitly approves redacted tracked-source disclosure, follow
+   with `npx @odla-ai/cli security run . --env prod --ack-redacted-source`.
+   The platform owns provider credentials and attributes the bounded,
+   independent-model run to this app; never request provider keys locally.
 4. `npx wrangler deploy` (first prod deploy). Verify
    `/api/health` and the parity paths on the prod workers.dev URL.
 5. `npx @odla-ai/cli smoke --env prod`.

package/skills/odla-migrate/references/secrets-map.md

@@ -10,10 +10,15 @@
 | LLM provider key | tenant vault | env var in the HUMAN's shell for one provision run; never wrangler vars, never git, never chat |
 | `odla_sk_…` (tenant db key) | wrangler secret `ODLA_API_KEY` + `.odla/credentials.local.json` (0600) + `.dev.vars` | present when db is enabled; move it only with the pipeline below |
 | `odla_dev_…` (developer token) | `.odla/dev-token.json` (0600) | ~24h lifetime, provision-time only; never deployed |
+| scoped `odla_dev_…` (admin-approved platform capability) | `.odla/admin-token.local.json` (0600) | separate policy/credential/usage/self-audit scope, ~15m lifetime, denied on owner routes, never deployed |
 | `o11y_…` (o11y ingest token) | wrangler secret `ODLA_O11Y_TOKEN` + `.odla/credentials.local.json` (0600) + `.dev.vars` | only if the app enables o11y; provision issues/reuses it and moves it alongside the db key; never a var, never chat |
 | `ODLA_ENDPOINT` / `ODLA_TENANT` / `ODLA_PLATFORM` / `ODLA_APP_ID` / `ODLA_ENV` | wrangler `vars` | not secrets; keep them set in every env block |
 | `ODLA_O11Y_ENDPOINT` / `ODLA_O11Y_SERVICE` | `.dev.vars` from provision or optional wrangler `vars` overrides | not secrets; public ingest defaults to `https://o11y.odla.ai` and `ODLA_APP_ID` when the token is present |
 
+System AI provider credentials are platform-owned and never enter a customer
+migration. `odla-ai security run` receives only app/run-bound role grants; do
+not ask the human for Anthropic/OpenAI/Google keys for hosted security.
+
 ## Moving the db key (+ o11y token) into the Worker (never through the transcript)
 
 Normal provisioning owns the complete sequence — issuance, mode-0600 local