@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/modules/cockpit/tests/cockpit-knowledge-decision-handoff.test.ts

@@ -30,6 +30,7 @@ import { createCockpitCardFeedbackStore } from '@/modules/cockpit/cockpit-card-f
 import { createCockpitCardRegistry } from '@/modules/cockpit/cockpit-card-registry.js';
 import { createCockpitFleetProjection } from '@/modules/cockpit/cockpit-fleet-card-projection.js';
 import { createCockpitKnowledgeAuthority } from '@/modules/cockpit/cockpit-knowledge-decision.js';
+import { readKnowledgeCase } from '@/modules/cockpit/cockpit-knowledge-reading.js';
 import type { ICockpitActionExecutor, ICockpitCardProvider } from '@/shared/interfaces.js';
 import type {
   CockpitCard,
@@ -97,6 +98,18 @@ function knowledgeCard(overrides: Partial<CockpitCard> = {}): CockpitCard {
   };
 }
 
+/** The same card with its apply option routed to another declared executor. */
+function withApplyExecutor(card: CockpitCard, executor: string): CockpitCard {
+  return {
+    ...card,
+    options: card.options.map((option) =>
+      option.id === 'apply'
+        ? { ...option, action: { executor, params: { caseId: 'case-1' } } }
+        : option,
+    ),
+  };
+}
+
 /** A provider over a mutable card list, with a refresh counter. */
 class MutableProvider implements ICockpitCardProvider {
   readonly id = 'test';
@@ -112,7 +125,15 @@ class MutableProvider implements ICockpitCardProvider {
   }
 
   declaredExecutors(): readonly string[] {
-    return ['test.apply', 'test.modify', 'test.defer', 'test.not-applicable', 'test.feedback'];
+    return [
+      'test.apply',
+      'test.modify',
+      'test.defer',
+      'test.not-applicable',
+      'test.feedback',
+      'fleet.apply',
+      'session.send',
+    ];
   }
 
   feedbackExecutor(): string | null {
@@ -145,6 +166,8 @@ function setup(cards: readonly CockpitCard[]) {
   const actionExecutors = ['apply', 'modify', 'defer', 'not-applicable'].map((id) =>
     countingExecutor(`test.${id}`),
   );
+  const fleetApply = countingExecutor('fleet.apply');
+  const sessionSend = countingExecutor('session.send');
   const feedback = countingExecutor('test.feedback');
   feedback.execute = (params) => {
     feedback.calls.push(structuredClone(params));
@@ -158,13 +181,23 @@ function setup(cards: readonly CockpitCard[]) {
   const store = createCockpitCardFeedbackStore();
   const actions = createCockpitCardActions({
     registry,
-    executors: [...actionExecutors, feedback],
+    executors: [...actionExecutors, fleetApply, sessionSend, feedback],
     feedbackStore: store,
     knowledge,
     refreshCards: () => provider.refreshCards(),
     now: () => new Date(AT),
   });
-  return { provider, registry, knowledge, actions, store, feedback, actionExecutors };
+  return {
+    provider,
+    registry,
+    knowledge,
+    actions,
+    store,
+    feedback,
+    fleetApply,
+    sessionSend,
+    actionExecutors,
+  };
 }
 
 /** The reference the card list route would mint for this card. */
@@ -249,6 +282,76 @@ test('the projection carries a knowledge card’s case, plan and per-option deci
   assert.equal(card.options[1]?.plan, undefined, 'a deferred decision carries no plan');
 });
 
+test('a knowledge block’s title and statement are read verbatim, and omitted when unstated', () => {
+  // The type accepts the two display fields (compile-time part of this criterion).
+  const typed: CockpitKnowledgeCase = {
+    caseId: 'case-text',
+    knowledgeRevision: 1,
+    proposalRevision: 1,
+    state: 'pending',
+    title: '卡面显示知识标题',
+    statement: '正文第一段。\n\n- 要点',
+  };
+
+  const stated = readKnowledgeCase({ ...typed });
+  assert.equal(stated?.title, '卡面显示知识标题');
+  assert.equal(stated?.statement, '正文第一段。\n\n- 要点');
+
+  const bare = readKnowledgeCase({ caseId: 'case-bare', knowledgeRevision: 1, proposalRevision: 1 });
+  assert.ok(bare !== null);
+  assert.equal('title' in bare, false, 'an unstated title leaves NO key on the block');
+  assert.equal('statement' in bare, false, 'an unstated statement leaves NO key on the block');
+
+  const blank = readKnowledgeCase({
+    caseId: 'case-blank',
+    knowledgeRevision: 1,
+    proposalRevision: 1,
+    title: '   ',
+    statement: '\n\t ',
+  });
+  assert.ok(blank !== null);
+  assert.equal('title' in blank, false, 'a whitespace-only title is unstated');
+  assert.equal('statement' in blank, false, 'a whitespace-only statement is unstated');
+});
+
+test('the projection passes a knowledge entry’s title and statement through verbatim', () => {
+  const projection = createCockpitFleetProjection({ readSessionAsk: () => null });
+  const card = (knowledge: Record<string, unknown>) =>
+    JSON.stringify({
+      id: 'fleet-text',
+      revision: 2,
+      kind: 'knowledge',
+      group: 'ruling',
+      rank: 0,
+      state: 'open',
+      waitingSince: '2026-10-27T00:00:00.000Z',
+      surfacedAt: '2026-10-27T00:00:01.000Z',
+      subject: { uri: 'quay://knowledge/k-text' },
+      facts: [],
+      options: [],
+      knowledge: {
+        caseId: 'case-text',
+        knowledgeRevision: 6,
+        proposalRevision: 2,
+        state: 'pending',
+        ...knowledge,
+      },
+    });
+
+  const stated = projection.project(
+    card({ title: '卡面显示知识标题', statement: '正文第一段。\n\n- 要点' }),
+  );
+  assert.equal(stated.skippedLines, 0);
+  assert.equal(stated.cards[0]?.knowledge?.title, '卡面显示知识标题');
+  assert.equal(stated.cards[0]?.knowledge?.statement, '正文第一段。\n\n- 要点');
+
+  const bare = projection.project(card({}));
+  const knowledge = bare.cards[0]?.knowledge;
+  assert.ok(knowledge !== undefined);
+  assert.equal('title' in knowledge, false);
+  assert.equal('statement' in knowledge, false);
+});
+
 test('an informational card keeps its own group and is never shown as a rescue card', () => {
   const projection = createCockpitFleetProjection({ readSessionAsk: () => null });
   const line = JSON.stringify({
@@ -323,6 +426,11 @@ test('a complete apply decision delivers the plan under a derived feedback id',
   assert.equal(answer.executor, 'test.apply');
   const action = actionExecutors[0];
   assert.equal(action?.calls.length, 1, 'the action runs exactly once');
+  assert.equal(
+    'confirmation' in ((action?.calls[0] ?? {}) as Record<string, unknown>),
+    false,
+    'a non-fleet.apply executor gains no confirmation field',
+  );
   assert.equal(feedback.calls.length, 1, 'the feedback call is made exactly once');
 
   const params = feedback.calls[0] as Record<string, unknown>;
@@ -343,6 +451,100 @@ test('a complete apply decision delivers the plan under a derived feedback id',
   assert.equal(stored.feedbackId, params.feedbackId);
 });
 
+test('a knowledge apply decision injects the trusted confirmation into fleet.apply params', async () => {
+  const card = withApplyExecutor(knowledgeCard(), 'fleet.apply');
+  const ref = issuedRef(card);
+  const { actions, fleetApply, feedback } = setup([card]);
+
+  const answer = await actions.confirm({
+    cardId: card.id,
+    revision: card.revision,
+    optionId: 'apply',
+    confirmationRef: ref,
+  });
+
+  assert.equal(answer.executor, 'fleet.apply');
+  assert.equal(fleetApply.calls.length, 1);
+  const params = fleetApply.calls[0] as Record<string, unknown>;
+  assert.equal(params.caseId, 'case-1', 'the option’s declared params are kept');
+
+  const confirmation = params.confirmation as Record<string, unknown>;
+  assert.ok(confirmation, 'fleet.apply receives a confirmation');
+  assert.equal(confirmation.actorKind, 'human');
+  assert.equal(typeof confirmation.decisionRef, 'string');
+  assert.equal(confirmation.decisionRef, ref);
+  assert.notEqual(confirmation.decisionRef, '');
+
+  const at = confirmation.at as string;
+  assert.equal(Number.isNaN(Date.parse(at)), false, '`at` parses as a date');
+  assert.equal(new Date(at).toISOString(), at, '`at` is an ISO-8601 UTC instant');
+
+  // `binding` is the case evidence the confirmation authority verified, minus its token, and
+  // every field fleet's `confirmationShapeRefusals` requires is present.
+  assert.deepEqual(confirmation.binding, {
+    caseId: 'case-1',
+    knowledgeRevision: 4,
+    proposalRevision: 2,
+    decision: 'apply',
+    factsFingerprint: 'fingerprint-a',
+    plan: PLAN,
+  });
+  assert.deepEqual(answer.params.confirmation, confirmation, 'the answer states what ran');
+
+  // The feedback receipt is still the SECOND call, and its params did not gain a confirmation.
+  assert.equal(feedback.calls.length, 1);
+  assert.equal(feedback.calls[0]?.confirmation, undefined);
+});
+
+test('a knowledge decision routed to another executor gains no confirmation', async () => {
+  const card = withApplyExecutor(knowledgeCard(), 'session.send');
+  const ref = issuedRef(card);
+  const { actions, sessionSend } = setup([card]);
+
+  await actions.confirm({
+    cardId: card.id,
+    revision: card.revision,
+    optionId: 'apply',
+    confirmationRef: ref,
+  });
+
+  assert.deepEqual(sessionSend.calls[0], { caseId: 'case-1' });
+  assert.equal(
+    'confirmation' in (sessionSend.calls[0] as Record<string, unknown>),
+    false,
+  );
+});
+
+test('a non-knowledge confirmation passes its declared params unchanged', async () => {
+  const card: CockpitCard = {
+    ...knowledgeCard({ kind: 'ask', knowledge: undefined }),
+    options: [
+      {
+        id: 'send',
+        label: 'send',
+        does: 'send the reply',
+        suggested: false,
+        source: 'provider',
+        action: { executor: 'session.send', params: { sessionId: 'session-1', text: 'go' } },
+      },
+    ],
+  };
+  const { actions, sessionSend } = setup([card]);
+
+  const answer = await actions.confirm({
+    cardId: card.id,
+    revision: card.revision,
+    optionId: 'send',
+  });
+
+  assert.equal(answer.executor, 'session.send');
+  assert.deepEqual(sessionSend.calls[0], { sessionId: 'session-1', text: 'go' });
+  assert.equal(
+    'confirmation' in (sessionSend.calls[0] as Record<string, unknown>),
+    false,
+  );
+});
+
 test('the trusted chain is readable back on the next card read', async () => {
   const card = knowledgeCard();
   const ref = issuedRef(card);

package/server/modules/context-events/context-event-writer.ts

@@ -1,5 +1,5 @@
 /**
- * The host-level context event writer — the CloudCLI side of the shared
+ * The host-level context event writer — the Cloudpit side of the shared
  * `~/.quay-fleet/context/events/<YYYY-MM-DD>.jsonl` stream.
  *
  * WHAT THIS OWNS. One append-only file per UTC day, one JSON object per line, and
@@ -24,7 +24,7 @@
  * `write(2)` on a handle opened `O_APPEND`. Two writers in two processes can
  * interleave whole lines but never halves of one. There is no per-event fsync:
  * the stream is evidence, not a write-ahead log, and the fleet's retention job
- * owns rotation and cleanup — CloudCLI never deletes a context event.
+ * owns rotation and cleanup — Cloudpit never deletes a context event.
  *
  * BOUND. One line is at most {@link CONTEXT_EVENT_MAX_LINE_BYTES} (16 KB). An
  * over-long text field is truncated (and `data.truncated` set) rather than
@@ -52,14 +52,14 @@ import path from 'node:path';
 import type { ISessionAskEventWriter } from '@/shared/interfaces.js';
 import type { SessionAskEvent } from '@/shared/types.js';
 
-/** The only `source` this writer may mint: this process is the CloudCLI producer. */
+/** The only `source` this writer may mint: this process is the Cloudpit producer. */
 export const CONTEXT_EVENT_SOURCE = 'cloudcli';
 
 /** One line's ceiling, in UTF-8 bytes, exactly as the task's write discipline states. */
 export const CONTEXT_EVENT_MAX_LINE_BYTES = 16 * 1024;
 
 /**
- * Every kind CloudCLI may produce. A kind outside this list is a programming
+ * Every kind Cloudpit may produce. A kind outside this list is a programming
  * error in a producer, and the writer rejects it even before the schema is read,
  * so a typo cannot enter the stream while the fleet release is absent.
  */
@@ -112,7 +112,7 @@ export type ContextEventDraft = {
  * The `data` payload of a `session.asking` row, as quay-fleet's v1 schema states it.
  *
  * `askId` is `<sessionId>:<assistantMessageId>` — the identity the fleet dedups on — and
- * `contentRef` names the CloudCLI resolver a fleet consumer can call to read the question.
+ * `contentRef` names the Cloudpit resolver a fleet consumer can call to read the question.
  */
 export type SessionAskingEventData = {
   askId: string;
@@ -733,7 +733,7 @@ export function createContextEventWriter(options: ContextEventWriterOptions = {}
   const append = async (draft: ContextEventDraft): Promise<AppendContextEventResult> => {
     if (!(CLOUDCLI_CONTEXT_EVENT_KINDS as readonly string[]).includes(draft.kind)) {
       rejected += 1;
-      return { ok: false, reason: 'invalid-kind', detail: `"${draft.kind}" is not a CloudCLI-produced kind` };
+      return { ok: false, reason: 'invalid-kind', detail: `"${draft.kind}" is not a Cloudpit-produced kind` };
     }
     const document = loadSchema();
     if (document === null) {

package/server/modules/context-events/context-events.module.ts

@@ -1,10 +1,10 @@
 /**
- * The context event stream — the CloudCLI side of the host-level interaction
+ * The context event stream — the Cloudpit side of the host-level interaction
  * ledger, plus the shadow predictor that runs on top of it.
  *
  * TWO JOBS, ONE SEAM.
  *
- *   1. Append CloudCLI-produced events (an utterance, a chip, a cockpit focus or
+ *   1. Append Cloudpit-produced events (an utterance, a chip, a cockpit focus or
  *      send, later a build/restart) to `~/.quay-fleet/context/events`.
  *   2. For every utterance, classify it, score the previous prediction, and mint
  *      the next `shadow.prediction`. Predictions go to the same file and to

package/server/modules/context-events/session-ask-stream-reader.ts

@@ -1,7 +1,7 @@
 /**
  * Reads BACK the two session-ask kinds from the context-event stream.
  *
- * The writer beside this file is the CloudCLI producer's only route into
+ * The writer beside this file is the Cloudpit producer's only route into
  * `~/.quay-fleet/context/events/<day>.jsonl`. This reader is the boot-time consumer: it answers
  * which asks this host stated as `session.asking` and never followed with `session.answered`.
  *

package/server/modules/context-events/session-blocked-events.ts

@@ -23,7 +23,7 @@
  * declares `fixtureHome` — an isolated fleet home, checked against the real `~/.quay-fleet` (and
  * an operator's `QUAY_FLEET_HOME`) and refused when it resolves to the real one. This is the same
  * discipline as ADR-003's "fixture HOME 隔离与清理": the fixture root is declared, never defaulted
- * to the real home. Real CloudCLI session ids are unaffected. The failure that motivated the guard
+ * to the real home. Real Cloudpit session ids are unaffected. The failure that motivated the guard
  * was a DoD run writing `dod-codex-blocked-*` rows through the production adapter into the real
  * `~/.quay-fleet/context/events/`, where the fleet upgraded them into ghost cards.
  *
@@ -99,13 +99,13 @@ export function toSessionBlockedEventDraft(event: SessionBlockedEventRecord): Co
 
 /**
  * The marker a fixture/DoD scenario puts on a session id it synthesised, as opposed to a real
- * CloudCLI session (a UUID or ULID). The repository's DoD scenarios name their sessions `dod-*`
+ * Cloudpit session (a UUID or ULID). The repository's DoD scenarios name their sessions `dod-*`
  * (`dod-codex-session`, `dod-codex-blocked-<epoch>`); `fixture-*` and `synthetic-*` are the same
  * declaration under other spellings.
  */
 const FIXTURE_SESSION_ID = /(^|[-_.])(dod|fixture|synthetic)([-_.]|$)/i;
 
-/** True when the session id declares itself a fixture rather than a real CloudCLI session. */
+/** True when the session id declares itself a fixture rather than a real Cloudpit session. */
 function isFixtureSession(session: string | null | undefined): boolean {
   return typeof session === 'string' && FIXTURE_SESSION_ID.test(session);
 }

package/server/modules/context-events/tests/session-ask-event-writer.test.ts

@@ -99,7 +99,7 @@ function descriptiveSchema(version: number, kinds: Record<string, unknown>): Rec
         source: 'the writer: cloudcli | fleet',
         kind: 'one of `kinds` below',
         project: 'optional Quay project id',
-        session: 'optional CloudCLI session id',
+        session: 'optional Cloudpit session id',
         refs: 'optional array of references',
         data: 'kind-specific payload (a JSON object)',
       },

package/server/modules/context-events/tests/session-blocked-events.test.ts

@@ -68,7 +68,7 @@ const SCHEMA = {
       source: 'the writer: cloudcli | fleet',
       kind: 'one of `kinds` below',
       project: 'optional Quay project id',
-      session: 'optional CloudCLI session id',
+      session: 'optional Cloudpit session id',
       refs: 'optional array of references',
       data: 'kind-specific payload (a JSON object)',
     },
@@ -144,7 +144,7 @@ const APPROVAL_BLOCK: SessionBlockedEvent = {
   toolName: 'commandExecution',
 };
 
-/** The synthetic session a DoD/fixture scenario mints; never a real CloudCLI session id. */
+/** The synthetic session a DoD/fixture scenario mints; never a real Cloudpit session id. */
 const FIXTURE_SESSION = 'dod-codex-blocked-1793458130445';
 const FIXTURE_BLOCK: SessionBlockedEvent = {
   kind: 'session.blocked',
@@ -360,7 +360,7 @@ test('a fixture session is refused before the record seam: production wiring, an
 });
 
 test('the same production adapter still writes a real session id (AC2 regression arm)', async () => {
-  // The guard must be discriminating, not a blanket refusal: a real CloudCLI session id goes
+  // The guard must be discriminating, not a blanket refusal: a real Cloudpit session id goes
   // through the production-wired adapter untouched, in the same run that refused the fixture.
   const reached: ContextEventDraft[] = [];
   const adapter = createSessionBlockedEventWriter({

package/server/modules/context-events/tests/session-run-events.test.ts

@@ -63,7 +63,7 @@ const SCHEMA = {
       source: 'the writer: cloudcli | fleet',
       kind: 'one of `kinds` below',
       project: 'optional Quay project id',
-      session: 'optional CloudCLI session id',
+      session: 'optional Cloudpit session id',
       refs: 'optional array of references',
       data: 'kind-specific payload (a JSON object)',
     },

package/server/modules/database/migrations.ts

@@ -786,7 +786,7 @@ const reclassifySelfAssignedSessionNames = (db: Database): void => {
   }
   if (readings.length + overrides.length > 0) {
     console.log(
-      `Running migration: Re-filing ${readings.length + overrides.length} session(s) named after a CloudCLI resident address`
+      `Running migration: Re-filing ${readings.length + overrides.length} session(s) named after a legacy resident address`
     );
   }
 };
@@ -825,6 +825,26 @@ const addSessionPermissionModeColumn = (db: Database): void => {
   ensureColumns(db, 'sessions', [['permission_mode', 'TEXT']]);
 };
 
+/**
+ * Adds the `model_provider_id` column: the upstream provider a session's model
+ * is bound to, recorded by the first send after the row exists.
+ *
+ * Existing rows stay NULL on purpose. A session that has already run under a
+ * bound provider is the only case where a backfill could be right, and it
+ * cannot be told apart from one that ran under the provider default without
+ * re-reading every model entry's config — a guess written into the column would
+ * then be enforced as if the session had really recorded it. NULL keeps its
+ * documented meaning ("no binding recorded"), and the switch guard only ever
+ * refuses a session that RECORDED a different provider.
+ *
+ * Runs after every sessions-table rebuild: `dropLaunchProfileStructures` copies
+ * an explicit column list, so a column added before it would be dropped with
+ * the old table.
+ */
+const addSessionModelProviderIdColumn = (db: Database): void => {
+  ensureColumns(db, 'sessions', [['model_provider_id', 'TEXT']]);
+};
+
 /**
  * Adds the `lifecycle_mode` column: how long a session's process is meant to
  * live ('per-run' or 'resident').
@@ -1083,6 +1103,9 @@ export const runMigrations = (db: Database) => {
     // lifecycle_mode added before it would be dropped along with the old table
     // and every existing session would come back with the column missing.
     addSessionLifecycleModeColumn(db);
+    // After every rebuild for the same reason: this column is appended, so a
+    // rebuild that copies an explicit column list would drop it.
+    addSessionModelProviderIdColumn(db);
     ensureProjectsForSessionPaths(db);
     db.exec(SCHEDULED_MESSAGES_TABLE_SCHEMA_SQL);
     // OAuth storage (mcp-gateway-SPEC stage 5, AC-258). Order matters: the

package/server/modules/database/repositories/sessions.db.ts

@@ -75,6 +75,16 @@ type SessionRow = {
   model: string | null;
   /** Reasoning effort this session runs with; NULL until the app records one. */
   effort: string | null;
+  /**
+   * The upstream provider the session's model is bound to; NULL when no binding
+   * has been recorded. Written once, by the session's first send.
+   *
+   * Optional in the type the way `transcript_name` is — a hand-built row (a
+   * test stub or an in-memory lookup) written before the column existed stays a
+   * valid `SessionRow` — but never absent from one this repository read out of
+   * the database.
+   */
+  model_provider_id?: string | null;
   /**
    * Permission mode the session last sent a message with; NULL until a send
    * records one. NULL is a real answer, not "unknown": it means no message has
@@ -221,7 +231,8 @@ function sessionRowColumns(prefix = ''): string {
   ${displayNameSql(prefix)} AS custom_name,
   ${displayNameSourceSql(prefix)} AS name_source,
   ${prefix}transcript_name, ${prefix}transcript_name_source,
-  ${prefix}model, ${prefix}effort, ${prefix}permission_mode, ${prefix}lifecycle_mode,
+  ${prefix}model, ${prefix}effort, ${prefix}model_provider_id, ${prefix}permission_mode,
+  ${prefix}lifecycle_mode,
   ${prefix}forked_from_session_id, ${prefix}isArchived, ${prefix}created_at, ${prefix}updated_at`;
 }
 
@@ -522,7 +533,7 @@ export const sessionsDb = {
    * `session_id` is the stable app-facing id, while `provider_session_id`
    * stays NULL until the provider runtime announces its own id and
    * `assignProviderSessionId` records the mapping. `customName` is derived
-   * from the first visible CloudCLI message by the sessions service.
+   * from the first visible Cloudpit message by the sessions service.
    *
    * `selection` is the model/effort/permission-mode the session is being created
    * WITH, written in the same statement that mints the row. It is a parameter
@@ -594,6 +605,8 @@ export const sessionsDb = {
     forkedFromSessionId: string;
     model: string | null;
     effort: string | null;
+    /** The source's upstream-provider binding; copied so the branch resumes it. */
+    modelProviderId?: string | null;
     permissionMode: string | null;
     lifecycleMode: HostMode;
   }): string {
@@ -609,8 +622,8 @@ export const sessionsDb = {
       db.prepare('DELETE FROM sessions WHERE session_id = ? AND session_id <> ?')
         .run(input.providerSessionId, input.sessionId);
       db.prepare(
-        `INSERT INTO sessions (session_id, provider, provider_session_id, custom_name, project_path, jsonl_path, model, effort, permission_mode, lifecycle_mode, forked_from_session_id, isArchived, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`
+        `INSERT INTO sessions (session_id, provider, provider_session_id, custom_name, project_path, jsonl_path, model, effort, model_provider_id, permission_mode, lifecycle_mode, forked_from_session_id, isArchived, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`
       ).run(
         input.sessionId,
         input.provider,
@@ -620,6 +633,7 @@ export const sessionsDb = {
         input.jsonlPath,
         input.model,
         input.effort,
+        input.modelProviderId ?? null,
         input.permissionMode,
         input.lifecycleMode,
         input.forkedFromSessionId,
@@ -746,6 +760,29 @@ export const sessionsDb = {
     ).run(model, sessionId);
   },
 
+  /**
+   * Records the upstream provider a session's model is bound to.
+   *
+   * Write-once by construction, not by convention: the UPDATE only matches a
+   * row whose binding is still NULL or blank, so a second call cannot move a
+   * conversation to another provider behind the switch guard's back. Returns
+   * whether the binding was actually written.
+   *
+   * The service is the one that decides WHEN a binding exists
+   * (`providerModelsService.setSessionModel`), so this stays an ordinary row
+   * write with no provider knowledge of its own.
+   */
+  setSessionModelProviderId(sessionId: string, modelProviderId: string): boolean {
+    const db = getConnection();
+    const result = db.prepare(
+      `UPDATE sessions
+       SET model_provider_id = ?
+       WHERE session_id = ?
+         AND (model_provider_id IS NULL OR trim(model_provider_id) = '')`
+    ).run(modelProviderId, sessionId);
+    return result.changes > 0;
+  },
+
   /**
    * Records the reasoning effort one session runs with.
    *

package/server/modules/database/repositories/voice-user-identifiers.db.ts

@@ -26,7 +26,7 @@ export const voiceUserIdentifiersDb = {
    * frequency that no single message explains. The `canonical` spelling is kept
    * from the FIRST sighting (the conflict branch deliberately does not overwrite
    * it), so a later message that spells `cloudcli` does not rename a token the
-   * listing already showed as `CloudCLI`.
+   * listing already showed as `Cloudpit`.
    */
   incrementTokens(entries: VoiceIdentifierIncrement[]): void {
     if (entries.length === 0) {

package/server/modules/database/schema.ts

@@ -163,7 +163,7 @@ CREATE TABLE IF NOT EXISTS sessions (
     -- \`name_source\`: 'manual' there means the user renamed it *in this app*,
     -- a claim the transcript cannot make.
     --
-    -- 'self-assigned' is the app's own rung: the address CloudCLI handed the CLI
+    -- 'self-assigned' is the app's own rung: the address Cloudpit handed the CLI
     -- as \`--name\`, which the CLI writes back into the transcript as both
     -- \`agent-name\` and \`custom-title\`. It is a name the app invented rather
     -- than one the session earned, so it ranks below 'ai' and above 'derived' —
@@ -176,6 +176,20 @@ CREATE TABLE IF NOT EXISTS sessions (
     -- restores its exact runtime configuration instead of provider defaults.
     model TEXT,
     effort TEXT,
+    -- The upstream provider this session's model is bound to, written once by
+    -- the session's first send (a custom model entry may name one through its
+    -- \`codexProviderId\`, AC-461). It is a property of the SESSION because a
+    -- provider runtime records it inside the conversation it starts and checks
+    -- it again on every resume: switching the model to one from another
+    -- provider would not switch providers, it would break the thread.
+    --
+    -- NULL means no binding has been recorded: the selection ran under the
+    -- provider's own default, or the session predates this column. NULL is not
+    -- "the default provider", so a later selection may still establish a
+    -- binding; once a value is recorded it never changes in place (see the
+    -- session-provider-binding.ts switch guard) — a fork or a new session is
+    -- how a conversation moves to another upstream provider.
+    model_provider_id TEXT,
     -- Permission mode this session last sent a message with (one of the
     -- modes the provider's capabilities declare: default, auto, acceptEdits,
     -- bypassPermissions, plan). Unlike model and effort there is no picker
@@ -316,7 +330,7 @@ CREATE TABLE IF NOT EXISTS user_voice_settings (
  * two rows, which is what lets a future per-project view exist without a
  * migration, while `listTop` sums across them for the one global list the API
  * returns today. `token_lower` is the lookup key and `canonical` keeps the
- * spelling first seen, so `CloudCLI` and `cloudcli` count as one token and the
+ * spelling first seen, so `Cloudpit` and `cloudcli` count as one token and the
  * listing still shows a real casing.
  *
  * `first_seen_at` / `last_seen_at` are epoch milliseconds written by the

package/server/modules/database/tests/migrations-ensure-columns.test.ts

@@ -60,6 +60,7 @@ const EXPECTED_SHAPE: Record<string, ColumnShape[]> = {
     ['jsonl_path', 'TEXT', 0, null, 0],
     ['model', 'TEXT', 0, null, 0],
     ['effort', 'TEXT', 0, null, 0],
+    ['model_provider_id', 'TEXT', 0, null, 0],
     ['permission_mode', 'TEXT', 0, null, 0],
     ['lifecycle_mode', 'TEXT', 0, "'per-run'", 0],
     ['forked_from_session_id', 'TEXT', 0, null, 0],
@@ -130,6 +131,7 @@ const DROPPED_COLUMNS: Record<string, string[]> = {
     'jsonl_path',
     'model',
     'effort',
+    'model_provider_id',
     'permission_mode',
     'lifecycle_mode',
   ],

package/server/modules/database/tests/sessions-provider-mapping.test.ts

@@ -45,7 +45,7 @@ test('disk-discovered sessions are keyed by the provider id for both columns', a
 
 test('app sessions get the provider id assigned without creating a duplicate row', async () => {
   await withIsolatedDatabase(() => {
-    sessionsDb.createAppSession('app-id-1', 'claude', '/workspace/demo', 'Initial CloudCLI message');
+    sessionsDb.createAppSession('app-id-1', 'claude', '/workspace/demo', 'Initial Cloudpit message');
     sessionsDb.assignProviderSessionId('app-id-1', 'provider-xyz');
 
     // A later synchronizer pass that discovers the transcript on disk must
@@ -66,7 +66,7 @@ test('app sessions get the provider id assigned without creating a duplicate row
     const row = sessionsDb.getSessionById('app-id-1');
     assert.equal(row?.provider_session_id, 'provider-xyz');
     assert.equal(row?.jsonl_path, '/fake/path/provider-xyz.jsonl');
-    assert.equal(row?.custom_name, 'Initial CloudCLI message');
+    assert.equal(row?.custom_name, 'Initial Cloudpit message');
   });
 });
 

package/server/modules/debug-agent/tests/debug-agent-permission-popup.test.ts

@@ -119,8 +119,8 @@ type AnyRecord = Record<string, unknown>;
 // --------------------------- fixture identities ---------------------------
 
 const USER_ONE = 1;
-const READ_SCOPE = 'cloudcli:read';
-const APPROVE_SCOPE = 'cloudcli:approve';
+const READ_SCOPE = 'cloudpit:read';
+const APPROVE_SCOPE = 'cloudpit:approve';
 /** The instant every relative reading is measured against. */
 const NOW = Date.now();
 /** How long a leg waits for the walk to park before it reds. */