@sema-agent/core 5.56.0 → 5.58.0

package/dist/bench/metrics.d.ts

@@ -71,7 +71,7 @@ export interface DeliveryDecision {
 }
 /**
  * design/95 §3.2 — the lifecycle status of a run, so INFRA noise never poisons the mode signal
- * (codex BLOCKER B4 / design/89 §3.3 Beatsep red line). The Beatsep task#2b 9% pass-rate was infra
+ * (design/89 §3.3 Beatsep red line). The Beatsep task#2b 9% pass-rate was infra
  * death (OOM / K8S passthrough / nested-root), NOT a mode signal — feeding such runs into the
  * numerator turns them into spurious DELIVERED-WRONG / zero datapoints and reproduces the very noise
  * the design claims to have isolated. `buildReport` SCORES only `scored`; `infra-failed` / `excluded`
@@ -94,7 +94,7 @@ export interface RunRecord {
     /** Repeat/seed index within the cell (design/89 §3.4 N-repeat). */
     seed?: number | string;
     /**
-     * design/95 §3.2 / codex B4 — lifecycle status. Only "scored" runs reach the numerator / cost /
+     * design/95 §3.2 — lifecycle status. Only "scored" runs reach the numerator / cost /
      * Pareto. Absent ⇒ "scored" (back-compat). See {@link RunStatus}.
      */
     runStatus?: RunStatus;
@@ -313,7 +313,7 @@ export interface ArmCell {
     /** Avoided-loss rate = CORRECTLY-WITHHELD / n. The supervisor's §2.2.1 value, single-listed. */
     correctlyWithheldRate: number;
     /**
-     * codex MINOR / design/95 M10 — withhold treated as a binary detector of would-be-wrong delivery
+     * design/95 M10 — withhold treated as a binary detector of would-be-wrong delivery
      * (positive = withheld; ground truth = would-be-wrong, established by the §2.4 counterfactual). Reported
      * as precision/recall — NOT just the raw correctly-withheld count — so an arm cannot look good by
      * withholding indiscriminately (high count, low precision) or by rarely withholding (high precision,
@@ -420,10 +420,10 @@ export declare function riskTransferDisclosure(cells: ArmCell[]): {
     };
 };
 /**
- * codex B2 — a paired-binary comparison of two arms on the SAME tasks/seeds. The two arms' truly-
+ * a paired-binary comparison of two arms on the SAME tasks/seeds. The two arms' truly-
  * correct flags are paired row-by-row (paired-seed, design/89 §3.4). For binary paired data the
  * RIGHT tests are McNemar (discordant pairs) and a paired-bootstrap difference interval — NOT two
- * independent proportions with "CI non-overlap" (that ignores the pairing and is under-powered, codex B2).
+ * independent proportions with "CI non-overlap" (that ignores the pairing and is under-powered).
  */
 export interface PairedBinaryComparison {
     /** Arm A (e.g. "sup") vs arm B (e.g. "solo"). pDiff = P(A) − P(B). */
@@ -440,12 +440,12 @@ export interface PairedBinaryComparison {
      *  b+c large). */
     mcnemarP: number;
     /** Bootstrap percentile 95% CI for the paired difference (lo, hi) — a percentile CI on the seeded
-     *  paired-bootstrap distribution, NOT Newcombe's analytic interval (codex MAJOR-B). Crosses 0 ⇒ not significant. */
+     *  paired-bootstrap distribution, NOT Newcombe's analytic interval. Crosses 0 ⇒ not significant. */
     ci95: [number, number];
     /** TRUE iff the difference is statistically significant at α=0.05 (CI excludes 0 AND McNemar p<0.05). */
     significant: boolean;
     /**
-     * codex B2 — pre-registered Minimum Detectable Effect at the observed nPairs (the difference this
+     * pre-registered Minimum Detectable Effect at the observed nPairs (the difference this
      * comparison COULD have detected at 80% power). When |pDiff| is below this AND not significant, the
      * verdict is "not powered" — NOT "no difference". This is the field that stops "N≥15 is an assertion".
      */
@@ -456,8 +456,8 @@ export interface PairedBinaryComparison {
     verdict: "A-better" | "B-better" | "no-detectable-difference" | "not-powered";
 }
 /**
- * codex B2 — compare two arms' delivered truly-correct as PAIRED binary. Pairs runs by the COMPOSITE
- * `(taskId, seed)` key (codex MAJOR-A: a bare `seed` collides across tasks — the same repeat index
+ * compare two arms' delivered truly-correct as PAIRED binary. Pairs runs by the COMPOSITE
+ * `(taskId, seed)` key (a bare `seed` collides across tasks — the same repeat index
  * recurs per task — so cross-task input would overwrite pairs and contaminate the McNemar sample);
  * only rows where BOTH arms delivered (not withheld, both scored) form a pair — a
  * withheld run has no delivered binary to pair (it is scored in the withhold/avoided-loss axis, not
@@ -469,7 +469,7 @@ export declare function pairedBinaryCompare(scoredRuns: RunRecord[], armA: Arm,
     bootstrapIters?: number;
 }): PairedBinaryComparison;
 /**
- * codex B3 — the pre-registered C2 exchange rate(s): how many human-review SECONDS we are willing to
+ * the pre-registered C2 exchange rate(s): how many human-review SECONDS we are willing to
  * pay to buy one unit of supervisor value. Without these, "higher P / more withholds ⇒ worth it" is
  * unfalsifiable (the "helpful but too expensive" counter-thesis cannot be observed). Declared BEFORE
  * the run (design/95 §9), not fit after.
@@ -482,20 +482,20 @@ export interface C2Thresholds {
 }
 export interface ParetoVerdict {
     arm: Arm;
-    /** Non-dominated on (C1, C2.sec, P) — necessary condition to be considered at all (codex B3). */
+    /** Non-dominated on (C1, C2.sec, P) — necessary condition to be considered at all. */
     nonDominated: boolean;
     /** The pre-registered exchange-rate check: does the arm's extra C2 buy enough avoided-loss / saved
      *  decisions to clear the declared threshold? Undefined when the arm has no extra C2 over baseline. */
     clearsC2Threshold?: boolean;
     /**
-     * codex B3 — the label. An arm may ONLY be "worth-it" when it is non-dominated AND clears the C2
+     * the label. An arm may ONLY be "worth-it" when it is non-dominated AND clears the C2
      * threshold. A non-dominated but threshold-failing arm is "quality-tradeoff" (higher quality, but the
      * cost is not bought back) — NEVER "worth-it". A dominated arm is "dominated".
      */
     label: "worth-it" | "quality-tradeoff" | "dominated";
 }
 /**
- * codex B3 — classify each arm against the SUP/TEAM-vs-baseline value question with a pre-registered
+ * classify each arm against the SUP/TEAM-vs-baseline value question with a pre-registered
  * exchange rate. `baselineArm` is the cost floor to compare extra C2 against (default "solo").
  * `avoidedWrong` / `savedDecisions` per arm come from the cells / campaign report.
  *
@@ -518,31 +518,31 @@ export declare function paretoValueVerdict(cells: ArmCell[], thresholds: C2Thres
  * design/95 §7.1 — V1 (免重复劳动): campaign-level human-decision delta. The ONLY authoritative V1
  * mechanism (design/95 reconcile, MAJOR#2): cross-task reuse of a decided strategy. Semantics:
  *   - `soloHumanDecisions` is the V1 BASELINE — the operator's actual up-front decision count when
- *     running solo across the campaign (codex M7: NOT 0, NOT synthetic — measured from real operator
+ *     running solo across the campaign (NOT 0, NOT synthetic — measured from real operator
  *     prep across runs). `0` is only valid when the campaign genuinely needed no human decision.
  *   - `repeatedDecisionsSaved = soloHumanDecisions − supHumanDecisions` (may be negative = SUP cost
  *     MORE human decisions; reported honestly, not floored).
  */
 export interface CampaignV1Saved {
     decisionKind: string;
-    /** V1 baseline (codex M7): operator's measured up-front decisions when running SOLO. Provenance MUST
+    /** V1 baseline: operator's measured up-front decisions when running SOLO. Provenance MUST
      *  be recorded in the stamp (real prep, not 0/synthetic). */
     soloHumanDecisions: number;
     /** SUP arm's actual human-review decision count for this decision kind. */
     supHumanDecisions: number;
     /** = soloHumanDecisions − supHumanDecisions. Positive ⇒ SUP saved repeated labour (V1 evidence). */
     repeatedDecisionsSaved: number;
-    /** Whether the baseline is a real measurement vs absent (codex M7 honesty gate). */
+    /** Whether the baseline is a real measurement vs absent (honesty gate). */
     baselineProvenance: "measured-operator-baseline" | "absent-not-claimable";
 }
 /**
- * design/95 §7.2 — V2 (蓝图清晰度) THREE-arm ablation (codex BLOCKER#1 + MAJOR#3 / M8). All three are
+ * design/95 §7.2 — V2 (蓝图清晰度) THREE-arm ablation. All three are
  * paired on the SAME seeds (paired===true ⇒ the three pX arrays/values are over the same n seeds).
  * INVARIANT: `n` is the paired-seed count common to all three sub-arms; the three deltas are computed
  * over those n pairs.
  *   - pSoloRaw            — only the original brief (no blueprint baseline).
  *   - pSoloSupGenerated   — the SUP-arm-GENERATED blueprint (attributable to supervisor; gen cost charged).
- *   - pSoloExperimenterIdeal — the experimenter "ideal" blueprint. codex M8: this is a CONSTRAINED upper
+ *   - pSoloExperimenterIdeal — the experimenter "ideal" blueprint. this is a CONSTRAINED upper
  *     bound on "better-prompt help", NOT "supervisor's mechanistic ceiling", UNLESS the ideal blueprint
  *     was generated under the {@link IdealBlueprintConstraints} (run-time, visible-brief-only, no oracle
  *     access, same info budget, leak-reviewed). `idealConstraintsSatisfied` records which it is.
@@ -557,16 +557,16 @@ export interface BlueprintAblationTriple {
     pSoloExperimenterIdeal: number;
     /** = pSoloSupGenerated − pSoloRaw (supervisor blueprint's real net value). */
     deltaSupVsRaw: number;
-    /** = pSoloExperimenterIdeal − pSoloRaw. LABELLED per `idealConstraintsSatisfied` (codex M8). */
+    /** = pSoloExperimenterIdeal − pSoloRaw. LABELLED per `idealConstraintsSatisfied`. */
     deltaIdealVsRaw: number;
-    /** codex M8 — when false, deltaIdealVsRaw is "manual-prompt upper bound", NOT "supervisor potential". */
+    /** when false, deltaIdealVsRaw is "manual-prompt upper bound", NOT "supervisor potential". */
     idealConstraintsSatisfied: boolean;
-    /** codex M3 — blueprint generation cost charged to the sup-generated arm (budget-match red line). */
+    /** blueprint generation cost charged to the sup-generated arm (budget-match red line). */
     blueprintGenC1MicroUsd: number;
     blueprintGenC2Count: number;
     blueprintGenC2Sec: number;
 }
-/** codex M8 — the constraints under which an "ideal" blueprint may be read as a supervisor-mechanism
+/** the constraints under which an "ideal" blueprint may be read as a supervisor-mechanism
  *  upper bound rather than a generic "better prompt helps" result. Recorded per ablation. */
 export interface IdealBlueprintConstraints {
     generatedBeforeRun: boolean;
@@ -575,10 +575,10 @@ export interface IdealBlueprintConstraints {
     sameInfoBudget: boolean;
     solutionLeakReviewed: boolean;
 }
-/** True iff ALL ideal-blueprint constraints hold (codex M8 gate). */
+/** True iff ALL ideal-blueprint constraints hold. */
 export declare function idealConstraintsSatisfied(c: IdealBlueprintConstraints): boolean;
 /**
- * design/95 §7.3 — V3 (无关性隔离) contamination probe (canary, mechanical, zero LLM-judge). codex M9:
+ * design/95 §7.3 — V3 (无关性隔离) contamination probe (canary, mechanical, zero LLM-judge).
  * the isolated-vs-shared P delta CONFOUNDS execution order / context size / worker count / budget; the
  * PRIMARY signal must be per-subgoal oracle failure + explicit wrong-use of a sibling artifact (the
  * canary leak), with the P delta kept as a DIAGNOSTIC only.
@@ -590,12 +590,12 @@ export interface IsolationContamination {
     isolatedSubgoalP: number[];
     /** Per-factor P under shared context. length === factorCount. */
     sharedSubgoalP: number[];
-    /** PRIMARY mechanical signal (codex M9): cross-factor canary leak rate (explicit token bleed). */
+    /** PRIMARY mechanical signal: cross-factor canary leak rate (explicit token bleed). */
     canaryLeakRate: number;
-    /** PRIMARY mechanical signal (codex M9): count of factors that failed their oracle AND demonstrably
+    /** PRIMARY mechanical signal: count of factors that failed their oracle AND demonstrably
      *  used a sibling factor's artifact (the controlled-ablation harm signal). */
     wrongSiblingArtifactUses: number;
-    /** DIAGNOSTIC ONLY (codex M9 confound): mean(isolated P) − mean(shared P). Not the primary signal. */
+    /** DIAGNOSTIC ONLY (confound): mean(isolated P) − mean(shared P). Not the primary signal. */
     contaminationRateDiag: number;
     /** Extra C1 the isolation cost (multi-worker / repeated context load). */
     isolationOverheadC1: number;
@@ -614,7 +614,7 @@ export interface CampaignReport {
     implementedAxes: ImplementedAxes;
 }
 /**
- * design/95 §2 / codex B1 — one heterogeneity CELL: a `(suiteVersion, taskId, archetype, valueDimension,
+ * design/95 §2 — one heterogeneity CELL: a `(suiteVersion, taskId, archetype, valueDimension,
  * arm)` group with its folded {@link ArmCell}. The decision surface is the per-cell vector — NOT the
  * arm mean (the Simpson's-paradox guard). `groupKey` is the stable join key.
  */
@@ -648,7 +648,7 @@ export interface ComparisonCell {
     pareto: ParetoResult;
 }
 /**
- * codex MINOR11 / council Q1 — capability metadata: which of the four §7/Pareto value axes are actually
+ * council Q1 — capability metadata: which of the four §7/Pareto value axes are actually
  * IMPLEMENTED in this report. Consumers must read this before claiming a V1/V2/V3 result; an unset axis
  * is NOT a null result, it is "not measured here". (The T1 structures above are types + pure helpers;
  * the report-level V1/V2/V3 fields are populated by the harness, not synthesized in `buildReport`.)
@@ -660,7 +660,7 @@ export interface ImplementedAxes {
     v3: boolean;
 }
 export interface ValueJudgmentReport {
-    /** codex B1 — per-arm cells grouped by full heterogeneity key (incl. arm). Single-arm; use for cell
+    /** per-arm cells grouped by full heterogeneity key (incl. arm). Single-arm; use for cell
      *  inspection / `pairedBinaryCompare` inputs. NOT directly a cross-arm verdict surface (each is one arm). */
     groupedCells: GroupedCell[];
     /**
@@ -671,7 +671,7 @@ export interface ValueJudgmentReport {
      */
     comparisons: ComparisonCell[];
     /**
-     * codex B1 — suite-level rollup: per-arm cells folded over ALL scored runs. A WEIGHTED summary for
+     * suite-level rollup: per-arm cells folded over ALL scored runs. A WEIGHTED summary for
      * dashboards ONLY — NOT a decision surface (folding heterogeneous tasks can flip a verdict, Simpson).
      * Consumers MUST decide on `comparisons`; this is convenience aggregation.
      */
@@ -687,7 +687,7 @@ export interface ValueJudgmentReport {
     /** design/89 §3.4: cells with n<8 are directional-only, not verdict-grade. Flagged, not dropped. */
     directionalOnly: Arm[];
     /**
-     * codex B4 — the exclusion ledger: runs dropped from scoring (infra-failed / excluded) with reasons.
+     * the exclusion ledger: runs dropped from scoring (infra-failed / excluded) with reasons.
      * A regression-grade invariant: these never reach `cells` / `pareto` (no infra noise in the verdict).
      */
     excluded: Array<{
@@ -696,16 +696,16 @@ export interface ValueJudgmentReport {
         seed?: number | string;
         reason: RunStatus;
     }>;
-    /** codex MINOR11 — which value axes this report actually measured. */
+    /** which value axes this report actually measured. */
     implementedAxes: ImplementedAxes;
 }
 /**
- * Top-level (codex B1+B4): SCORE only `scored` runs (B4 — drop infra-failed/excluded with reasons),
+ * Top-level: SCORE only `scored` runs (B4 — drop infra-failed/excluded with reasons),
  * group by `(suiteVersion, taskId, archetype, valueDimension, arm)` (B1 — the per-cell decision surface,
  * Simpson's-paradox guard), fold each group, AND provide a suite-level per-arm rollup for dashboards
  * (explicitly NOT a decision surface). Deterministic; no model.
  *
- * `opts.implementedAxes` lets the harness declare which §7 axes it populated (codex MINOR11); default
+ * `opts.implementedAxes` lets the harness declare which §7 axes it populated; default
  * = only Pareto (the V1/V2/V3 structures are T1 net-new, not synthesized here).
  */
 export declare function buildReport(runs: RunRecord[], opts?: {

package/dist/brain/anthropic.js

@@ -5,7 +5,8 @@ import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js"
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, stripAuthHeaders, takeHeaderCasefold } from "./request-params.js";
+import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
+import { adjudicateModelRoute, applyRouteCredentialHeaders, createBrainRouteJudge, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 function thinkingBudget(maxTokens, share, fixed, hardCap = false) {
@@ -234,7 +235,17 @@ export function createAnthropicBrain(config = {}) {
             httpLabel: "anthropic",
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const apiKey = options?.apiKey ?? config.apiKey;
+                const routeCredential = resolveRouteCredential({
+                    optionsApiKey: options?.apiKey,
+                    optionsHeaders: options?.headers,
+                    modelHeaders: model.headers,
+                    configApiKey: config.apiKey,
+                    configHeaders: config.headers,
+                });
+                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl });
+                if (!routeVerdict.ok)
+                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const apiKey = routeCredential.apiKey;
                 const root = (model.baseUrl || config.baseUrl || "https://api.anthropic.com").replace(/\/+$/, "");
                 const nonEmptyBlocks = context.systemBlocks?.filter((b) => b.text.length > 0);
                 const system = nonEmptyBlocks?.length
@@ -302,8 +313,7 @@ export function createAnthropicBrain(config = {}) {
                     betas.push("interleaved-thinking-2025-05-14");
                 }
                 const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                if (options?.apiKey !== undefined)
-                    stripAuthHeaders(headers);
+                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
                 if (betas.length > 0) {
                     const existing = (takeHeaderCasefold(headers, "anthropic-beta") ?? "").split(",").map((b) => b.trim()).filter(Boolean);
                     for (const beta of betas) {
@@ -680,5 +690,5 @@ export function createAnthropicBrain(config = {}) {
             },
         });
     };
-    return { stream };
+    return { stream, adjudicateRoute: createBrainRouteJudge(config) };
 }

package/dist/brain/circuit-breaker.js

@@ -153,5 +153,6 @@ export function createCircuitBreakerBrain(inner, opts = {}) {
         })();
         return out;
     };
-    return { stream };
+    const adjudicateRoute = (model, perModelAuth) => inner.adjudicateRoute?.(model, perModelAuth);
+    return { stream, adjudicateRoute };
 }

package/dist/brain/degrading.d.ts

@@ -75,7 +75,7 @@ export declare function readDegradation(msg: {
     diagnostics?: AssistantMessageDiagnostic[];
 } | undefined): DegradationInfo | undefined;
 /**
- * design/131 (codex 131 审 A) — resilience-standdown pass-through: forward one brain's stream
+ * design/131 — resilience-standdown pass-through: forward one brain's stream
  * verbatim, but keep the decorator discipline that a REJECTING inner brain (throw instead of an
  * error event) still leaves a terminal on the returned stream — otherwise `result()` never
  * resolves and the harness hangs (the same class as the degradation-brain blocker).

package/dist/brain/degrading.js

@@ -144,6 +144,8 @@ export function createDegradingBrain(opts) {
                         break;
                     if (hop.model.id === failedModelId)
                         continue;
+                    if (hop.brain.adjudicateRoute?.(hop.model)?.ok === false)
+                        continue;
                     chainPath.push(hop.model.id);
                     degradeInfo = {
                         from: model.id,
@@ -182,5 +184,6 @@ export function createDegradingBrain(opts) {
         })();
         return out;
     };
-    return { stream };
+    const adjudicateRoute = (model, perModelAuth) => opts.primary.adjudicateRoute?.(model, perModelAuth);
+    return { stream, adjudicateRoute };
 }

package/dist/brain/errors.d.ts

@@ -12,7 +12,7 @@ export declare const ZERO_USAGE: Usage;
 /** The single source of truth for brain error codes — the type, the `[code]` parser, and the prefix
  *  stripper all derive from this one list, so adding a code can't silently diverge across call sites.
  *
- *  The last three are IN-BAND terminal-output codes ([1086]③): stamped on errored assistant MESSAGES
+ *  The last three are IN-BAND terminal-output codes: stamped on errored assistant MESSAGES
  *  (never thrown as BrainError) so `TaskResult.errorCode` covers the error family end-to-end and
  *  downstream consumers can bucket without string-matching. Deliberately behavior-neutral everywhere
  *  else: the circuit breaker's default countCodes excludes them (model-output problems, not provider
@@ -27,7 +27,7 @@ export type BrainErrorCode = (typeof BRAIN_ERROR_CODES)[number];
  *  tool-errors.ts must classify every member — a code added here but missed there folds to "unknown"). */
 export declare const ALL_BRAIN_ERROR_CODES: readonly BrainErrorCode[];
 /** The in-band terminal-output subset (see the list doc above). The circuit breaker collapses these
- *  to the legacy `"http"` bucket before counting (codex [1086]③ 审): its taxonomy is TRANSPORT-level,
+ *  to the legacy `"http"` bucket before counting: its taxonomy is TRANSPORT-level,
  *  and before these codes existed the same failures reached it as the unprefixed→"http" fallback — a
  *  custom `countCodes: ["http"]` policy must keep counting them exactly as it always did. */
 export declare const IN_BAND_OUTPUT_CODES: ReadonlySet<BrainErrorCode>;
@@ -65,7 +65,7 @@ export declare function stripErrorCodePrefix(errorMessage: string): string;
  */
 export type ConnectFailureClass = "deterministic" | "indeterminate";
 export declare function classifyConnectFailure(e: unknown): ConnectFailureClass;
-/** RB-386③ ([2090]) — render a transport-level error WITHOUT folding away its cause chain. undici's
+/** RB-386③ — render a transport-level error WITHOUT folding away its cause chain. undici's
  *  `fetch` rejects with `TypeError("fetch failed", { cause })` where the CAUSE carries the actually
  *  actionable fact (`connect ECONNREFUSED …` / `getaddrinfo ENOTFOUND …` / `SocketError: other side
  *  closed` with a `code`); `String(e)` / `e.message` alone collapsed ALL THREE network-failure shapes

package/dist/brain/failover.js

@@ -82,5 +82,20 @@ export function createFailoverBrain(brains) {
         })();
         return out;
     };
-    return { stream };
+    const adjudicateRoute = (model, perModelAuth) => {
+        let firstRefusal;
+        let sawUnjudged = false;
+        for (const b of brains) {
+            const verdict = b.adjudicateRoute?.(model, perModelAuth);
+            if (verdict === undefined) {
+                sawUnjudged = true;
+                continue;
+            }
+            if (verdict.ok)
+                return verdict;
+            firstRefusal ??= verdict;
+        }
+        return sawUnjudged ? undefined : firstRefusal;
+    };
+    return { stream, adjudicateRoute };
 }

package/dist/brain/open-responses.js

@@ -5,7 +5,8 @@ import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js"
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { OUTPUT_CAP_KEYS, RESPONSES_RESERVED, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, stripAuthHeaders } from "./request-params.js";
+import { OUTPUT_CAP_KEYS, RESPONSES_RESERVED, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
+import { adjudicateModelRoute, applyRouteCredentialHeaders, createBrainRouteJudge, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
 import { mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 const DEGENERATE_POLL_CHARS = 64;
@@ -228,7 +229,17 @@ export function createOpenResponsesBrain(config = {}) {
             httpLabel: "responses",
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const apiKey = options?.apiKey ?? config.apiKey;
+                const routeCredential = resolveRouteCredential({
+                    optionsApiKey: options?.apiKey,
+                    optionsHeaders: options?.headers,
+                    modelHeaders: model.headers,
+                    configApiKey: config.apiKey,
+                    configHeaders: config.headers,
+                });
+                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl });
+                if (!routeVerdict.ok)
+                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const apiKey = routeCredential.apiKey;
                 const root = (model.baseUrl || config.baseUrl || "").replace(/\/+$/, "");
                 if (!root) {
                     throw new Error("createOpenResponsesBrain: no baseUrl configured (set config.baseUrl or model.baseUrl)");
@@ -265,8 +276,7 @@ export function createOpenResponsesBrain(config = {}) {
                 if (effort !== undefined)
                     body.reasoning = { effort };
                 const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                if (options?.apiKey !== undefined)
-                    stripAuthHeaders(headers);
+                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
                 lockHeader(headers, "content-type", "application/json");
                 if (apiKey)
                     headers["authorization"] = `Bearer ${apiKey}`;
@@ -738,5 +748,5 @@ export function createOpenResponsesBrain(config = {}) {
             },
         });
     };
-    return { stream };
+    return { stream, adjudicateRoute: createBrainRouteJudge(config) };
 }

package/dist/brain/openai.js

@@ -5,7 +5,9 @@ import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js"
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { OPENAI_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, stripAuthHeaders } from "./request-params.js";
+import { OPENAI_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
+import { BrainError } from "./errors.js";
+import { adjudicateModelRoute, applyRouteCredentialHeaders, createBrainRouteJudge, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
 import { mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 function closeToolCallAccum(acc) {
@@ -270,7 +272,17 @@ export function createOpenAIBrain(config = {}) {
             httpLabel: "gateway",
             stallTimeouts: options?.stallTimeouts,
             buildRequest: (overrides) => {
-                const apiKey = options?.apiKey ?? config.apiKey;
+                const routeCredential = resolveRouteCredential({
+                    optionsApiKey: options?.apiKey,
+                    optionsHeaders: options?.headers,
+                    modelHeaders: model.headers,
+                    configApiKey: config.apiKey,
+                    configHeaders: config.headers,
+                });
+                const routeVerdict = adjudicateModelRoute(model, routeCredential, { baseUrl: config.baseUrl });
+                if (!routeVerdict.ok)
+                    throw new BrainError("invalid_request", routeRefusalText(routeVerdict));
+                const apiKey = routeCredential.apiKey;
                 const root = (model.baseUrl || config.baseUrl || "").replace(/\/+$/, "");
                 if (!root) {
                     throw new Error("createOpenAIBrain: no baseUrl configured (set config.baseUrl or model.baseUrl)");
@@ -304,8 +316,7 @@ export function createOpenAIBrain(config = {}) {
                     body.stop = options.stop;
                 applyThinking(body, model, options?.reasoning);
                 const headers = mergeHeaders(model.headers, config.headers, options?.headers);
-                if (options?.apiKey !== undefined)
-                    stripAuthHeaders(headers);
+                applyRouteCredentialHeaders(headers, routeCredential, { model: model.headers, options: options?.headers });
                 lockHeader(headers, "content-type", "application/json");
                 if (apiKey)
                     headers["authorization"] = `Bearer ${apiKey}`;
@@ -618,5 +629,5 @@ export function createOpenAIBrain(config = {}) {
             },
         });
     };
-    return { stream };
+    return { stream, adjudicateRoute: createBrainRouteJudge(config) };
 }

package/dist/brain/reasoning.d.ts

@@ -92,7 +92,7 @@ export interface ReasoningResolution {
  *  the cap-wins predicate below and the brain's budget-window math read ONE constant. */
 export declare const MIN_THINKING_TOKENS = 1024;
 /**
- * The anthropic BUDGET path's cap-wins arm (#346, single-sourced; design/119 #2 review codex H4):
+ * The anthropic BUDGET path's cap-wins arm (#346, single-sourced; design/119 #2 review):
  * a HARD per-request output cap (an engine-imposed override or the caller's explicit
  * `options.maxTokens` — the two lanes the brain refuses to raise) too small to host a legal thinking
  * budget (≥ {@link MIN_THINKING_TOKENS}) plus answer room means the CAP WINS and thinking is skipped
@@ -276,7 +276,7 @@ export interface ReasoningProfileFlags {
 }
 /**
  * design/96 §D (S4) — map a named {@link ReasoningTier} to its engine {@link ReasoningProfileFlags} (default
- * mapping). G2 (clay): the intensity→capability mapping is PROFILE-layer data — core gives this primitive +
+ * mapping). G2: the intensity→capability mapping is PROFILE-layer data — core gives this primitive +
  * a sane default; a profile/scenario layer calls it (and may override the table) to set a task's `thinking` +
  * prompt flags. Core never forces it. Returns a fresh COPY (callers may mutate).
  */

package/dist/brain/repetition.d.ts

@@ -36,7 +36,7 @@ export declare const DEGENERATE_MESSAGE = "degenerate repetition detected \u2014
  * One detector hit — either the event that CUT a stream (`degenerate`) or a repetition that landed in
  * a detection window but was SPARED by a 2e1c161 structural allowance (code-line shape / divider run).
  * Spared events are the RSI raw material for judging whether the allowance is too wide or too narrow
- * (clay 2026-07-10: the detector must report counts AND the detected segment, not just a boolean).
+ * (2026-07-10: the detector must report counts AND the detected segment, not just a boolean).
  */
 export interface RepetitionEvent {
     /** Which rule's window the repetition landed in: rule 1 (`char-run`) or rule 2 (`unit-loop`). */

package/dist/brain/request-params.d.ts

@@ -22,17 +22,16 @@ export declare function reservedFor(api: string): ReadonlySet<string>;
  * deployment with no `extraBody` is unaffected.
  */
 export declare function applyExtraBody(body: Record<string, unknown>, extraBody: Record<string, unknown> | undefined, reserved: ReadonlySet<string>): Record<string, unknown>;
-/**
- * Per-call auth REPLACES construction-time auth: drop every auth-bearing header
- * (case-insensitive `authorization` / `x-api-key`) from an already-merged header bag. Called by a
- * brain's buildRequest ONLY when a per-call `options.apiKey` is present — the brain then re-emits
- * the credential in its own wire posture (anthropic `x-api-key`, openai `Bearer`), making the
- * per-call key the request's single credential. Case-insensitivity matters twice: a
- * construction-time `Authorization` (capital A) is what boot env tokens ship, and a case-variant
- * duplicate would otherwise ride the wire alongside the hard-locked lowercase form (fetch Headers
- * folds duplicates into one comma-joined value — broken auth both ways).
- */
-export declare function stripAuthHeaders(headers: Record<string, string>): void;
+/** The auth-bearing header names (case-fold), single-sourced for the credential enforcement
+ *  (`applyRouteCredentialHeaders`, route-adjudicator.ts — the ONE authority over auth spelling: a
+ *  per-model winner strips every carrier, any case, and re-asserts the winning bag's own),
+ *  {@link mergeHeaders} (which EXEMPTS them — see there), and the route credential resolver (which
+ *  reads carrier PRESENCE per bag to classify a headers-borne credential). The former per-call
+ *  strip helper that lived here (`stripAuthHeaders` — "per-call auth replaces construction-time
+ *  auth", triggered on `options.apiKey` presence) is retired: the three brains now run the
+ *  route-credential resolution instead, whose per-model arm strips a strict superset of what the
+ *  helper did. */
+export declare const AUTH_CARRIER_NAMES: ReadonlySet<string>;
 /**
  * #343 — the shared USER-HEADER merge layer (`model.headers` → construction `config.headers` →
  * per-call `options.headers`, later bag wins), CASE-FOLD deduplicated: HTTP header field names are
@@ -45,26 +44,29 @@ export declare function stripAuthHeaders(headers: Record<string, string>): void;
  * deployment — is byte-identical on the wire).
  *
  * EXEMPT: the auth carriers (`authorization` / `x-api-key`, any case) pass through with the exact
- * legacy spread semantics (same-spelling override only, no case-fold dedup), so that
- * {@link stripAuthHeaders} stays the ONE authority over auth spelling and this layer never becomes a
- * second, subtly different one.
+ * legacy spread semantics (same-spelling override only, no case-fold dedup), so that the credential
+ * enforcement (`applyRouteCredentialHeaders`, route-adjudicator.ts) stays the ONE authority over
+ * auth spelling and this layer never becomes a second, subtly different one.
  *
  * RE-RULED, because the exemption used to be justified by a reason that does not hold: the
  * note claimed it protected "the header-only ANTHROPIC_AUTH_TOKEN shape, which must survive under its
  * own capital-A spelling". Dedup would not endanger that shape — it keeps the WINNER'S spelling, and a
  * lone `Authorization` has nothing to be deduped against, so it survives either way; nor does the
- * per-call-replaces flow depend on the exemption, since {@link stripAuthHeaders} already deletes every
- * spelling present. Measured, not reasoned: `mergeHeaders({Authorization:A},{authorization:B})` keeps
- * BOTH, and the platform `Headers` fold sends `authorization: A, B`.
+ * credential-replaces flow depend on the exemption, since the enforcement already deletes every
+ * spelling present when a per-model credential wins. Measured, not reasoned:
+ * `mergeHeaders({Authorization:A},{authorization:B})` keeps BOTH, and the platform `Headers` fold
+ * sends `authorization: A, B`.
  *
- * STATED RESIDUAL (deliberately not fixed here): a deployment that spells the SAME auth carrier two
- * ways across two layers therefore ships both, comma-folded — the very disease this function fixed
- * for every other header. It is held, not denied, on severity: no server accepts a comma-joined
- * credential, so the failure is a LOUD 401 attributable to the misconfiguration, whereas the
- * non-auth case this function exists for produced a silently WRONG value (`X-Tenant: a, b` — neither
- * writer's, the later layer's documented override defeated). Tightening it changes which credential
- * reaches the wire, so it belongs in a window that discloses an auth-face behavior change, not in one
- * whose subject is the reasoning knob.
+ * STATED RESIDUAL (deliberately not fixed here), NARROWED by the credential enforcement: where a
+ * PER-MODEL credential wins (an options- or entry-bag carrier), every carrier is stripped and only
+ * the winning bag's re-asserted, so a cross-layer double spelling now folds to the winner. What
+ * remains is the DEPLOYMENT-CONFIG arm — its bytes ride untouched by design — so a config bag that
+ * itself spells the SAME auth carrier two ways still ships both, comma-folded. It is held, not
+ * denied, on severity: no server accepts a comma-joined credential, so the failure is a LOUD 401
+ * attributable to the misconfiguration, whereas the non-auth case this function exists for produced
+ * a silently WRONG value (`X-Tenant: a, b` — neither writer's, the later layer's documented
+ * override defeated). Tightening it changes which credential reaches the wire, so it belongs in a
+ * window that discloses an auth-face behavior change.
  */
 /**
  * #343 (review r4) — assign a STRUCTURAL locked header under its canonical lowercase name, deleting
@@ -72,8 +74,9 @@ export declare function stripAuthHeaders(headers: Record<string, string>): void;
  * the user-bag merge precisely so they "can NEVER be overridden" (council design/40) — but a valid
  * user bag carrying `Content-Type: text/plain` survived BESIDE the lowercase lock, and the platform
  * `Headers` fold turns the pair into `text/plain, application/json` on the wire: the lock decided
- * nothing. Auth carriers are deliberately NOT routed through here (per-call replacement + the
- * header-only boot flow are {@link stripAuthHeaders}' pinned jurisdiction).
+ * nothing. Auth carriers are deliberately NOT routed through here (credential replacement + the
+ * header-only boot flow are the pinned jurisdiction of `applyRouteCredentialHeaders`,
+ * route-adjudicator.ts).
  */
 export declare function lockHeader(headers: Record<string, string>, lowerName: string, value: string): void;
 /**

package/dist/brain/request-params.js

@@ -54,13 +54,7 @@ export function applyExtraBody(body, extraBody, reserved) {
     }
     return { ...passthrough, ...body };
 }
-const AUTH_CARRIER_NAMES = new Set(["authorization", "x-api-key"]);
-export function stripAuthHeaders(headers) {
-    for (const k of Object.keys(headers)) {
-        if (AUTH_CARRIER_NAMES.has(k.toLowerCase()))
-            delete headers[k];
-    }
-}
+export const AUTH_CARRIER_NAMES = new Set(["authorization", "x-api-key"]);
 export function lockHeader(headers, lowerName, value) {
     for (const k of Object.keys(headers)) {
         if (k !== lowerName && k.toLowerCase() === lowerName)