@open-everywhere/create 0.7.0 → 0.8.1

package/README.md

@@ -38,9 +38,11 @@ coding agent and ask it to set up Open Everywhere. The agent reads the app's `AG
 route first: **Vercel** (the `vercel` CLI plus Marketplace Neon) or **Docker** (a self-hosted
 container that satisfies the
 [deployment contract](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md)).
-Vercel is the one route that the project runs end to end. The Docker route is partly proven, and a
-scaffolded app carries no `Dockerfile`: see the
-[deployment contract](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md).
+Vercel is the one route that the project runs end to end. The Docker route is partly proven: a
+scaffolded app carries its `Dockerfile` and a `docker-compose.yml` with the egress proxy and Postgres,
+and the
+[deployment contract](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md)
+says which requirements that stack meets.
 
 ## Use
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-everywhere/create",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "license": "Apache-2.0",
   "type": "module",
   "description": "npx scaffold and setup check for Open Everywhere — one step engine, reported by --check for an agent-led setup.",
@@ -46,8 +46,8 @@
     "test:env-pipe": "tsx scripts/env-pipe-test.ts"
   },
   "dependencies": {
-    "@open-everywhere/core": "0.7.0",
-    "@open-everywhere/provider-slack": "0.7.0",
+    "@open-everywhere/core": "0.8.1",
+    "@open-everywhere/provider-slack": "0.8.1",
     "tsx": "^4.23.9"
   },
   "devDependencies": {

package/src/steps/build-deploy.ts

@@ -39,7 +39,7 @@ function deployOrigin(ctx: StepContext): string | undefined {
 /** The command that deploys, per route. */
 function deployCommand(ctx: StepContext): string {
   return routeOf(ctx) === "docker"
-    ? "build the image and run it on your server (the deployment contract states what it must satisfy)"
+    ? "`docker compose up --build` on your server (the app's Dockerfile and docker-compose.yml; the deployment contract states what it must satisfy)"
     : "npx vercel deploy --prod";
 }
 
@@ -69,7 +69,7 @@ export const buildDeployStep: SetupStep = {
         "`npm run build` (= `oe build`, then `eve build`) — must be green.",
         vercel
           ? "Deploy is a SEPARATE, explicit step: `npx vercel deploy --prod` (confirm the scope and team first). A `git push` does NOT deploy."
-          : "Deploy is a SEPARATE, explicit step: build the image and run it on your server, with the contract's environment set. See https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md.",
+          : "Deploy is a SEPARATE, explicit step: on your server, put the contract's environment in `.env` (with `OE_EGRESS_PROXY_TOKEN`), then run `docker compose up --build`. The app's `Dockerfile` builds the image, and `docker-compose.yml` puts it behind the egress proxy with Postgres. This stack runs the `justbash` sandbox backend: the agent's shell shares the app process's filesystem and environment. That is development grade, and it does not meet the contract's `sandbox-backend` requirement. See https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md.",
         "Then re-run `npx @open-everywhere/create --check --host https://<host>`: it probes the deployed Slack route.",
         "The probe passes on the route's own `401 unauthorized`, which proves the function booted and the route is mounted. It does NOT prove the deployment holds SLACK_SIGNING_SECRET: the route answers the same without it. Only Event Subscriptions showing **Verified** in the Slack console proves that.",
       ],

package/template/.dockerignore

@@ -0,0 +1,35 @@
+# The build context of this app's image (Dockerfile, docker-compose.yml).
+#
+# node_modules stays out: the image installs its own (musl) dependencies with `npm ci`. A host copy
+# would put glibc native modules over them and break the runtime image.
+node_modules
+**/node_modules
+
+# Version control and agent or editor state.
+.git
+.claude
+.vscode
+.idea
+
+# Build output: the image runs its own `oe build` and `eve build`.
+.vercel
+.output
+.nitro
+.eve
+
+# Local secrets and env values. An image layer must never carry one.
+.env
+.env.*
+*.pem
+*.key
+
+# Local state from `npm run dev`, and the egress proxy's own build context.
+.open-everywhere-data
+.open-everywhere-memory
+.workflow-data
+deploy
+
+# Logs and OS files.
+*.log
+npm-debug.log*
+.DS_Store

package/template/AGENTS.md

@@ -65,6 +65,13 @@ Setup is yours to drive, with the user's consent at every command. Use the
 - `npx oe build --check` verifies the slot tree without a write, and proves the overlays hold
   only data. Run it before you merge a pull request that changes an overlay.
 - `npm run typecheck` type-checks the app.
+- `npm run check:model-config` reads the list of endpoints for each model from the model's target
+  (the AI Gateway, unless `models.targets` names another URL). It names a demand that no provider
+  can meet, two regions that conflict, a model id the gateway does not know, and a `via` that
+  names no target. Run it after a change to the model settings, before the deploy. It needs the
+  network and no credential.
+- `npx oe sovereignty --host vercel` (or `--host docker`) prints where each piece of the app's data
+  lives, which region, and which company could be compelled to hand it over. It changes nothing.
 - Deploy is a separate, explicit step. On the Vercel route that is `npx vercel deploy --prod`; a
   `git push` does NOT deploy.
 

package/template/Dockerfile

@@ -0,0 +1,60 @@
+# The Docker route's image for this app: the eve node-server build, run with `eve start`.
+#
+# Use it with docker-compose.yml, which puts the app behind the egress proxy (deploy/egress-proxy)
+# and gives it Postgres. The requirements this image satisfies, and the ones it does not, are in the
+# deployment contract:
+# https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md
+#
+# Run `npm install` once before you build: the build installs from package-lock.json with `npm ci`.
+FROM node:24-alpine AS build
+WORKDIR /app
+
+# eve collects its own CLI usage telemetry, ON by default. Each `eve` command posts the command name,
+# the eve version, the platform, a random installation id and a salted hash of the git remote URL or
+# of the working directory to telemetry.vercel.com. This image turns it OFF:
+# `EVE_TELEMETRY_DISABLED=1` is eve's switch, and both stages set it. Open Everywhere's own telemetry
+# has its own switch, `OE_TELEMETRY` (see README.md § Telemetry).
+ENV EVE_TELEMETRY_DISABLED=1
+
+# git: a dependency or the `git` memory backing can need it at build time.
+RUN apk add --no-cache git
+
+# Install first, from the lockfile, so a source edit does not repeat the install.
+# The app's `postinstall` (`oe-eve-patch`) puts the Open Everywhere patch into eve, and it exits
+# non-zero when the patch does not apply. npm runs a dependency's install script only when
+# package.json's `allowScripts` names it, so `node-liblzma` does not compile here (just-bash then
+# has no `xz` command). The probe then proves the patch is in the eve this image runs: core refuses
+# to boot on an unpatched eve, so a build that ends without it gives a dead container.
+COPY package.json package-lock.json ./
+RUN npm ci \
+ && node --input-type=module -e 'const { probeEvePatch } = await import("@open-everywhere/core/agent/access/eve-patch-probe.js"); const r = await probeEvePatch(); if (r.status !== "patched") { console.error(`eve patch probe: ${r.status}`); process.exit(1); }'
+
+# Build. VERCEL is unset here, so `eve build` writes the node-server bundle (.output/server).
+# `npm run build` runs `oe build` first (the prebuild hook), then `eve build`.
+# 🔴 eve provisions the sandbox template at BUILD time, on the backend the build resolves. This stage
+# has no Docker daemon, so the app must declare `sandbox: { selfHostBackend: "justbash" }` in
+# agent/settings/settings.ts (the template does). With `"docker"` the build fails with
+# `spawn docker ENOENT`.
+# The builder needs memory: `eve build` can take several GB, so the heap limit is raised.
+COPY . .
+RUN NODE_OPTIONS=--max-old-space-size=6144 npm run build
+
+# ── Runtime image ──
+FROM node:24-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+# eve's CLI telemetry stays OFF for `eve start` too (see the build stage).
+ENV EVE_TELEMETRY_DISABLED=1
+# git and openssh-client for real git operations; ca-certificates for TLS egress.
+RUN apk add --no-cache git openssh-client ca-certificates
+
+# The whole tree: the build stage produced node_modules and .output.
+COPY --from=build /app /app
+
+# VERCEL stays UNSET, so the sandbox backend and the egress setup take the self-host branch.
+ENV PORT=3000
+EXPOSE 3000
+
+# `eve start` serves the node-server build and runs the in-process routine dispatcher.
+# It is the binary itself, not `npm start`: the `prestart` hook would run `oe build` again.
+CMD ["npx", "eve", "start", "--host", "0.0.0.0"]

package/template/README.md

@@ -16,6 +16,11 @@ route first:
   Gateway with OIDC, so it needs no gateway key.
 - **Docker** — self-host a container that satisfies the
   [deployment contract](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/contract.md).
+  This app carries the image (`Dockerfile`) and the stack (`docker-compose.yml`: the app behind the
+  egress proxy in `deploy/egress-proxy/`, with Postgres). Run `npm install` once, then
+  `docker compose up --build` on the server. This stack runs the `justbash` sandbox backend: the
+  agent's shell shares the app process's filesystem and environment. That is development grade, and
+  it does not meet the contract's `sandbox-backend` requirement.
 
 These are the two supported routes. Some steps stay with you: creating the Slack app, approving
 each deploy, and pasting each secret where the agent's tools can read it but the chat cannot.
@@ -42,6 +47,12 @@ never ships. Every event and attribute is listed in the
 [telemetry disclosure](https://github.com/open-everywhere/open-everywhere/blob/main/docs/deploy/telemetry.md).
 The `@open-everywhere/create` CLI sends none.
 
+eve, the framework under the app, has its own CLI telemetry, ON by default in eve. This app turns it
+off: the `dev`, `build` and `start` scripts and both stages of the `Dockerfile` set
+`EVE_TELEMETRY_DISABLED=1`. Keep that prefix on any script you add that runs `eve`. The `dev`,
+`build` and `start` scripts use the POSIX form `NAME=value command`. On Windows, use WSL, or set
+npm's `script-shell` to a POSIX shell such as Git Bash.
+
 ## Develop locally
 
 After the deploy, `npm run dev` runs the agent on this machine and talks to it in a terminal UI.
@@ -67,6 +78,8 @@ without a public tunnel.
 | `agent/webhooks/hooks.ts` | Inbound webhook triggers. |
 | `AGENTS.md`, `CLAUDE.md` | The guide a coding agent reads in this repository. |
 | `.mcp.json`, `scripts/ops-mcp.ts` | The `open-everywhere-ops` MCP server: setup status, `.env.local` values and stored secrets, for a coding agent. |
+| `Dockerfile`, `.dockerignore`, `docker-compose.yml` | The Docker route: the app's image, and the stack that runs it behind the egress proxy with Postgres. |
+| `deploy/egress-proxy/` | The egress proxy's image: the only container on the Docker route with a route to the internet. It is a copy of the Open Everywhere repository's `deploy/egress-proxy`. |
 | `scripts/env-pipe.mjs` | `npm run -s env:pipe`: writes one `.env.local` value to a pipe for `vercel env add`. It refuses a terminal or a file. Never run it bare. |
 | `.claude/skills/quickstart-open-everywhere/` | The setup skill that drives that server. |
 

package/template/agent/agent.ts

@@ -9,8 +9,9 @@
 // app. The model per ROLE lives in agent/model/stacks.ts; pick a stack with `models.stack` in
 // agent/settings/settings.ts.
 //
-// Zero data retention and provider allowlists are GATEWAY org policy (AI Gateway → Settings), not
-// app code. This app inherits them.
+// What every model call demands of its provider (zero retention, no training, a region) is
+// `models.dataPolicy` in agent/settings/settings.ts. The model adapter puts it on every call. The
+// gateway's own team settings (AI Gateway → Settings) apply on top.
 
 import { defineAgent } from "eve";
 import { defineDynamic } from "eve/tools";
@@ -25,9 +26,13 @@ import { registerGatewayDreamJudge, registerGatewayFailureFacetJudge } from "@op
 import { registerGatewayMeetingModels } from "@open-everywhere/adapters/agent/model/meeting-gateway.js";
 import { registerGatewayApprovalJudge } from "@open-everywhere/adapters/agent/model/approval-judge.js";
 import { registerGatewayImageDescriber } from "@open-everywhere/adapters/agent/model/gateway-vision.js";
+import { registerModelConfigCheck } from "@open-everywhere/adapters/agent/model/gateway-probe.js";
+import { getConfig } from "@open-everywhere/core/agent/access/config.js";
+import { resolvableModels } from "@open-everywhere/core/agent/model/targets.js";
 import { isModelUsable } from "@open-everywhere/core/agent/model/policy.js";
 import {
   JUDGE_MODEL,
+  MODELS,
   PRIMARY_MODEL,
   PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS,
   TRANSCRIPTION_ROLE,
@@ -52,14 +57,14 @@ const COMPACTION_THRESHOLD_PERCENT = getSettings().agent.compactionThresholdPerc
 const COMPACTION_THRESHOLD_TOKENS = compactionThresholdTokens(PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS, COMPACTION_THRESHOLD_PERCENT);
 
 // The background judges: memory distillation, failure facets and the auto-approval judge.
-registerGatewayDreamJudge({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS });
-registerGatewayFailureFacetJudge({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS });
+registerGatewayDreamJudge({ id: UTILITY_MODEL, via: MODELS.utility.via, gateway: GATEWAY_DEFAULTS });
+registerGatewayFailureFacetJudge({ id: UTILITY_MODEL, via: MODELS.utility.via, gateway: GATEWAY_DEFAULTS });
 
 // The meeting bot's model calls (OPE-2459): the `gateway` transcription route, and the tool-less recap
 // completion on the same `utility` route as the dream judge. Inert until agent/meetings/policy.ts enables
 // meetings; without this line the `gateway` route is unregistered and `meeting_join` refuses before its card.
-registerGatewayMeetingModels({ id: UTILITY_MODEL, gateway: GATEWAY_DEFAULTS }, TRANSCRIPTION_ROLE);
-registerGatewayApprovalJudge({ id: JUDGE_MODEL, gateway: GATEWAY_DEFAULTS });
+registerGatewayMeetingModels({ id: UTILITY_MODEL, via: MODELS.utility.via, gateway: GATEWAY_DEFAULTS }, TRANSCRIPTION_ROLE);
+registerGatewayApprovalJudge({ id: JUDGE_MODEL, via: MODELS.judge.via, gateway: GATEWAY_DEFAULTS });
 
 // The image describer. Fail at boot if the org model policy forbids the vision model, rather than
 // fail every image later.
@@ -69,7 +74,19 @@ if (!isModelUsable(VISION_MODEL, loadModelPolicy())) {
       "check agent/model/policy.ts, or re-point the `vision` role in agent/model/stacks.ts.",
   );
 }
-registerGatewayImageDescriber({ id: VISION_MODEL });
+registerGatewayImageDescriber({ id: VISION_MODEL, via: MODELS.vision.via });
+
+// THE LIVE MODEL CONFIG CHECK (OPE-2556): the deployment status probe (`model-route`) reads the gateway's public
+// endpoints of every model this deployment can resolve, and names a `models.dataPolicy` or `providers.only` demand no
+// provider can meet. `create --check --host` and the setup skill read that row. Read lazily, at status time.
+registerModelConfigCheck(() =>
+  resolvableModels(
+    [...Object.values(MODELS), ...[TRANSCRIPTION_ROLE.primary, TRANSCRIPTION_ROLE.fallback].flatMap((r) => (r?.via === "gateway" ? [{ id: r.id }] : []))],
+    getConfig().loadDomains(),
+    getConfig().loadRoles?.() ?? [],
+    getSettings().models.force,
+  ),
+);
 
 function readAppVersion(): string {
   const version = appPackageJson.version;
@@ -120,7 +137,7 @@ export default defineAgent({
   model: defineDynamic({
     events: {
       "step.started": (() => {
-        const resolve = gatewayModelResolver({ id: PRIMARY_MODEL, gateway: GATEWAY_DEFAULTS });
+        const resolve = gatewayModelResolver({ id: PRIMARY_MODEL, via: MODELS.primary.via, gateway: GATEWAY_DEFAULTS });
         return async (event: unknown, ctx: unknown) => primaryModelSelection(await resolve(event, ctx));
       })(),
     },

package/template/agent/instructions.md

@@ -239,6 +239,12 @@ lookup first: search your memory, THEN reply. Never answer "I don't know" (or gu
 something you could have stored without checking — a miss because you didn't look is the one
 recall failure that's entirely on you.
 
+**A fact this conversation already holds is not a lookup.** If a person said it earlier in
+this conversation, or your own earlier reply said it, answer from that directly, in this
+turn. This rule holds also when you saved the fact to memory: the save does not make the
+conversation a less reliable source. Search memory only for what this conversation does not
+hold.
+
 **To recall a specific fact, grep the whole memory space in one command** — every silo for
 this channel is materialised under `/workspace/memory/`, so one recursive search finds a fact
 wherever it's filed, without walking silo by silo:

package/template/agent/lib/register-config.ts

@@ -11,12 +11,13 @@
 // before the first resolve.
 
 import { registerConfig } from "@open-everywhere/core/agent/access/config.js";
-import { registerSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { getSettings, registerSettings } from "@open-everywhere/core/agent/settings/settings.js";
 import { registerModelPricing } from "@open-everywhere/core/agent/spend/pricing.js";
 import { loadModelPricing } from "../spend/model-pricing.js";
 import { SETTINGS_OVERRIDES } from "../settings/settings.js";
 import { setRegisteredConnectorCredentials } from "@open-everywhere/core/agent/access/connector-credentials.js";
 import { assertRoutesWithinPolicy } from "@open-everywhere/core/agent/model/policy.js";
+import { assertRouteTargets } from "@open-everywhere/core/agent/model/targets.js";
 import { assertDomainCredentialsResolvable } from "@open-everywhere/core/agent/access/domain-credentials.js";
 import {
   assertWindowSourcesVouched,
@@ -165,6 +166,9 @@ setRegisteredConnectorCredentials(loadConnectorCredentials());
 // policy is configured). Domains carry role defaults already (applyRoleDefaults inside
 // loadDomains); roles are validated too since a role rung can carry its own route.
 assertRoutesWithinPolicy(loadDomains(), loadRoles(), loadModelPolicy());
+// Every route's `via` names a `models.targets` entry, and no route still carries the 0.7.0 key `providers` (renamed
+// `providerOrder`, OPE-2556). Fail LOUD: a renamed key that is read as absent would drop the order hint silently.
+assertRouteTargets(loadDomains(), loadRoles(), getSettings().models.targets);
 
 // Multi-source WINDOW vouch (memory/domain.ts assertWindowSourcesVouched, window-tool-gating-design
 // §Q5): any standing WINDOW holding more than one source requires every register-gated source to be

package/template/agent/memory/config/domains/org.ts

@@ -29,7 +29,7 @@
 // changing the engaged thread sessions.
 
 import { defineDomain } from "@open-everywhere/core/agent/memory/domain.js";
-import { SUPERVISOR_MODEL } from "../../../model/models.js";
+import { SUPERVISOR_MODEL, SUPERVISOR_VIA } from "../../../model/models.js";
 
 export const domain = defineDomain({
   name: "org",
@@ -37,5 +37,5 @@ export const domain = defineDomain({
   memory: "org-brain",
   nameDropWake: true,
   admins: [],
-  models: { supervisor: { id: SUPERVISOR_MODEL, reasoning: "low" } },
+  models: { supervisor: { id: SUPERVISOR_MODEL, via: SUPERVISOR_VIA, reasoning: "low" } },
 });

package/template/agent/model/models.ts

@@ -7,6 +7,8 @@ import {
   registerDefaultAgentModelId,
 } from "@open-everywhere/core/agent/model/default-model.js";
 import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { viaProblem, type ModelTargets } from "@open-everywhere/core/agent/model/targets.js";
+import { registerBareModelRoutes } from "@open-everywhere/core/agent/model/bare-model-via.js";
 import { SETTINGS_OVERRIDES } from "../settings/settings.js";
 import { resolveStack, resolveTranscription, type ModelRole, type ModelRoleSpec, type ModelStack } from "./stacks.js";
 
@@ -19,6 +21,10 @@ const STACK: ModelStack = resolveStack(STACK_ALIAS, {});
 
 // A deploy can retarget the primary (`models.force` / `models.primary` in agent/settings/settings.ts).
 // Core owns that precedence, so read the primary back from it.
+// Every role's `via` names a `models.targets` entry (OPE-2556). Fail LOUD at config load: an unknown target would
+// otherwise fail every call of that role at run time.
+assertStackVia(STACK, MODEL_SETTINGS.targets);
+
 registerDefaultAgentModelId(STACK.primary.id);
 
 export const MODELS = {
@@ -29,6 +35,9 @@ export const MODELS = {
   judge: STACK.judge,
 } as const satisfies Record<string, ModelRoleSpec>;
 
+// A bare model id (a declared subagent's `model`) goes through the target of the role that names it, else the primary's.
+registerBareModelRoutes(Object.values(MODELS));
+
 /** The alias of the stack this process resolved — for `/oe status`. */
 export const MODEL_STACK = STACK_ALIAS;
 /** The meeting bot's speech-to-text role: a primary and a fallback route (stacks.ts TRANSCRIPTION). */
@@ -38,6 +47,8 @@ export const PRIMARY_MODEL = MODELS.primary.id;
 export const UTILITY_MODEL = MODELS.utility.id;
 export const VISION_MODEL = MODELS.vision.id;
 export const SUPERVISOR_MODEL = MODELS.supervisor.id;
+/** The supervisor role's `models.targets` entry (OPE-2556): the org domain's supervisor route carries it. */
+export const SUPERVISOR_VIA = MODELS.supervisor.via;
 export const JUDGE_MODEL = MODELS.judge.id;
 export const PRIMARY_MODEL_CONTEXT_WINDOW_TOKENS = MODELS.primary.contextWindowTokens;
 
@@ -62,3 +73,9 @@ export function allowListForStack(stack: ModelStack, extra: readonly ModelPolicy
 export function modelAllowList(extra: readonly ModelPolicyAllowEntry[] = []): ModelPolicyAllowEntry[] {
   return allowListForStack(MODELS, extra);
 }
+
+/** Throw when a stack role's `via` names no `models.targets` entry. Exported for tests. */
+export function assertStackVia(stack: ModelStack, targets: ModelTargets): void {
+  const bad = (Object.keys(stack) as ModelRole[]).flatMap((role) => viaProblem(stack[role].via, targets, `stack role "${role}"`) ?? []);
+  if (bad.length > 0) throw new Error(`open-everywhere: ${bad.join("; ")}`);
+}

package/template/agent/model/stacks.ts

@@ -9,7 +9,9 @@
 //   judge      — the auto-approval judge.
 //
 // Every id is an AI Gateway model id. Add a stack by adding an entry, and give each new id a rate in
-// agent/spend/model-pricing.ts, or a USD spend cap cannot see its cost.
+// agent/spend/model-pricing.ts, or a USD spend cap cannot see its cost. A role's `via` names the
+// `models.targets` entry its calls go through: the European stack uses the `mistral` target in
+// agent/settings/settings.ts (only the Mistral provider, zero retention).
 
 import type { ModelTier } from "@open-everywhere/core/agent/memory/domain.js";
 import type { TranscriptionRoleSpec } from "@open-everywhere/adapters/agent/model/transcription-routes.js";
@@ -21,17 +23,19 @@ export interface ModelRoleSpec {
   readonly tier: ModelTier;
   /** The model's context window. eve compacts at `agent.compactionThresholdPercent` of it. */
   readonly contextWindowTokens: number;
+  /** The `models.targets` entry this role's calls go through (OPE-2556). Absent: `"gateway"`. An unknown name fails config load. */
+  readonly via?: string;
 }
 
 export type ModelStack = Readonly<Record<ModelRole, ModelRoleSpec>>;
 
 export const STACKS = {
   "chinese-open-weights": {
-    primary: { id: "deepseek/deepseek-v4-flash-0731", tier: "high", contextWindowTokens: 1_000_000 },
-    utility: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+    primary: { id: "deepseek/deepseek-v4.1-flash", tier: "high", contextWindowTokens: 1_000_000 },
+    utility: { id: "deepseek/deepseek-v4.1-flash", tier: "low", contextWindowTokens: 1_000_000 },
     vision: { id: "alibaba/qwen3-vl-instruct", tier: "low", contextWindowTokens: 131_072 },
-    supervisor: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
-    judge: { id: "deepseek/deepseek-v4-flash-0731", tier: "low", contextWindowTokens: 1_000_000 },
+    supervisor: { id: "deepseek/deepseek-v4.1-flash", tier: "low", contextWindowTokens: 1_000_000 },
+    judge: { id: "deepseek/deepseek-v4.1-flash", tier: "low", contextWindowTokens: 1_000_000 },
   },
   "american-closed": {
     primary: { id: "openai/gpt-6-luna", tier: "high", contextWindowTokens: 1_050_000 },
@@ -40,6 +44,14 @@ export const STACKS = {
     supervisor: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
     judge: { id: "openai/gpt-6-luna", tier: "low", contextWindowTokens: 1_050_000 },
   },
+  // Mistral Small 4 (Apache 2.0) in every role, vision included, served by Mistral with zero retention.
+  "european-open-weights": {
+    primary: { id: "mistral/mistral-small", tier: "high", contextWindowTokens: 262_144, via: "mistral" },
+    utility: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+    vision: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+    supervisor: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+    judge: { id: "mistral/mistral-small", tier: "low", contextWindowTokens: 262_144, via: "mistral" },
+  },
 } as const satisfies Record<string, ModelStack>;
 
 export type StackAlias = keyof typeof STACKS;
@@ -78,7 +90,7 @@ export function resolveStack(alias: string, overrides: StackOverrides = {}): Mod
 // Speech to text for the meeting bot: a primary and a fallback route per stack, on two different providers, so
 // one provider outage falls through to the other. A route names its transport too: the AI Gateway, DeepInfra
 // (key: `oe secret set DEEPINFRA_API_KEY`), or your own OpenAI-compatible speech server. These defaults are
-// pending a bake-off (`npm run bakeoff:stt` in the Open Everywhere repository).
+// pending a bake-off (the `bakeoff:stt` script of the Open Everywhere repository).
 export const TRANSCRIPTION = {
   "chinese-open-weights": {
     primary: { via: "deepinfra", id: "Qwen/Qwen3-ASR-1.7B" },
@@ -88,6 +100,11 @@ export const TRANSCRIPTION = {
     primary: { via: "gateway", id: "microsoft/mai-transcribe-2" },
     fallback: { via: "gateway", id: "spacexai/grok-stt" },
   },
+  // Mistral's Voxtral on your own speech server, then Qwen3-ASR on a second one: audio stays on your machines.
+  "european-open-weights": {
+    primary: { via: "self-hosted", id: "mistralai/Voxtral-Mini-3B-2507", baseUrl: "http://voxtral:8000/v1" },
+    fallback: { via: "self-hosted", id: "Qwen/Qwen3-ASR-1.7B", baseUrl: "http://qwen3-asr:8000/v1" },
+  },
 } as const satisfies Record<StackAlias, TranscriptionRoleSpec>;
 
 /** Fully local: your own speech server only. For a Docker deployment with no cloud model. */

package/template/agent/settings/settings.ts

@@ -9,8 +9,11 @@
 //
 // Examples:
 //   identity: { name: "Ada" },        // the name the agent answers to
-//   models: { stack: "chinese-open-weights" },   // every model role at once
-//   sandbox: { selfHostBackend: "justbash" },     // the backend a Docker-image build must declare
+//   models: { stack: "chinese-open-weights" },   // every model role at once (or "european-open-weights")
+//   models: { dataPolicy: { zeroRetention: true } },  // every model call: only zero-retention providers
+//   models: { targets: { gateway: { kind: "vercel-ai-gateway", providers: { only: ["openai", "azure"] } } } },  // only these providers
+//   After a change to `models`, run `npm run check:model-config`: it names a model no provider can serve.
+//   sandbox: { selfHostBackend: "docker" },       // a per-session container; needs a Docker daemon at build time
 //
 // Every behaviour choice that used to be an env var lives here too (OPE-2411): the model pins
 // (`models.*`), the admin control plane (`control.*`), the directory sync (`directory.*`), AWS
@@ -31,4 +34,20 @@ export const SETTINGS_OVERRIDES = defineSettings({
   // refuses: no browser tool mounts, no host opens, and the boot logs one line that names the
   // platform. Set `enabled: false` to turn the browser off, and to silence that line off Vercel.
   browser: { enabled: true },
+  // The sandbox backend off Vercel. eve provisions the sandbox template at BUILD time, on this
+  // backend, so it decides where `npm run build` works: `justbash` needs nothing, and `docker` needs
+  // a running Docker daemon at build time. The image (Dockerfile) builds with no daemon, so the
+  // Docker route needs `justbash`, and so does a local build on a machine without Docker.
+  // justbash shares the app process's filesystem: development-grade isolation. On Vercel this line
+  // has no effect: the Vercel Sandbox always runs there.
+  sandbox: { selfHostBackend: "justbash" },
+  // Where model calls go. `gateway` is the shipped target. `mistral` is the European stack's route
+  // (`european-open-weights` in agent/model/stacks.ts): only the `mistral` provider, and every call
+  // demands zero retention. A role with no `via` uses `gateway`, so this entry changes no other call.
+  models: {
+    targets: {
+      gateway: { kind: "vercel-ai-gateway" },
+      mistral: { kind: "vercel-ai-gateway", providers: { only: ["mistral"] }, dataPolicy: { zeroRetention: true } },
+    },
+  },
 });

package/template/agent/spend/model-pricing.ts

@@ -11,11 +11,13 @@ import { defineModelPricing, assertModelPricingValid, type ModelPricingTable } f
 
 const pricing: ModelPricingTable = defineModelPricing({
   // chinese-open-weights: primary, utility, supervisor and judge.
-  "deepseek/deepseek-v4-flash-0731": { inPerMtok: 0.14, outPerMtok: 0.28 },
+  "deepseek/deepseek-v4.1-flash": { inPerMtok: 0.3, outPerMtok: 1.2 },
   // chinese-open-weights: vision.
   "alibaba/qwen3-vl-instruct": { inPerMtok: 0.2, outPerMtok: 0.88 },
   // american-closed: vision.
   "google/gemini-3.8-flash": { inPerMtok: 0.75, outPerMtok: 3.75 },
+  // european-open-weights: every role.
+  "mistral/mistral-small": { inPerMtok: 0.15, outPerMtok: 0.6 },
 });
 
 assertModelPricingValid(pricing);