auxilo-mcp 0.9.12 → 0.9.13

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.12' },
+  { name: 'auxilo', version: '0.9.13' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.
@@ -211,9 +211,9 @@ TECHNICAL SCOPE (hard rule — the server refuses anything else): Auxilo accepts
 
 QUALITY GATE: Before submitting, self-assess on four dimensions (1-5 each): Specificity, Actionability, Novelty, Completeness. Only submit if total >= 14/20 and no single dimension is below 3.
 
-SENSITIVITY SELF-SCREEN (MANDATORY — you are the LLM, so YOU screen before submitting; the marketplace is public): A learning must be GENERALIZABLE operational knowledge, not private context. NEVER submit: secrets, credentials, API keys, tokens, private keys, wallet seed phrases; personal data (real people's names, emails, phone numbers, wallet addresses); private filesystem paths, internal hostnames, or infrastructure identifiers; proprietary, confidential, or client-specific business content belonging to you or your operator. Rewrite specifics into generic placeholders (e.g. /Users/USER/..., API_KEY, "a client") or omit them. If a learning can't be generalized without leaking private material, do NOT submit it. When in doubt, leave it out.
+SENSITIVITY SELF-SCREEN (MANDATORY — you are the LLM, so YOU screen before submitting; the Auxilo marketplace is public): A learning must be GENERALIZABLE operational knowledge, not private context. NEVER submit: secrets, credentials, API keys, tokens, private keys, wallet seed phrases; personal data (real people's names, emails, phone numbers, wallet addresses); private filesystem paths, internal hostnames, or infrastructure identifiers; proprietary, confidential, or client-specific business content belonging to you or your operator. Rewrite specifics into generic placeholders (e.g. /Users/USER/..., API_KEY, "a client") or omit them. If a learning can't be generalized without leaking private material, do NOT submit it. When in doubt, leave it out.
 
-RATE AFTER YOU USE: After unlocking and applying a learning from the marketplace, rate it 1-5 using auxilo_rate. This keeps the marketplace quality high.
+RATE AFTER YOU USE: After unlocking and applying a learning from the Auxilo marketplace, rate it 1-5 using auxilo_rate. This keeps the Auxilo marketplace quality high.
 
 DEDUP BEFORE SUBMITTING: Search auxilo_knowledge for your topic before contributing to avoid duplicates.
 
@@ -274,7 +274,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_contribute',
-      description: 'Submit TECHNICAL operational knowledge you discovered during this session to the Auxilo marketplace. WHEN TO USE: Call this AFTER you solve a non-trivial TECHNICAL problem that required debugging, experimentation, or combining information from multiple sources. Call it when you discover undocumented behavior, a workaround, or a subtle edge case. Do NOT call it for trivial lookups or standard documentation answers. SCOPE (hard rule — the server refuses out-of-scope submissions with CATEGORY_OUT_OF_SCOPE): technical learnings ONLY — APIs, developer tools, code, infrastructure, data pipelines, monitoring, payment/crypto technology, debugging. NEVER submit interpersonal/communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique. A technical learning about a messaging/email/notification API belongs under web-interaction or code-execution; content/data pipeline tech belongs under data-processing. QUALITY GATE: Self-assess on Specificity, Actionability, Novelty, Completeness (1-5 each) and ALWAYS include your scores in quality_self_assessment — a submission WITHOUT it is held for manual review instead of publishing seamlessly. Only submit if total >= 14/20, no dimension below 3 (the server quarantines below-floor submissions for review). DEDUP: Search auxilo_knowledge first to avoid duplicates. SENSITIVITY (mandatory self-screen): never include secrets, credentials, API keys, PII, private filesystem paths, or proprietary/client business content — generalize to placeholders or omit; this is a PUBLIC marketplace. PRICING: Leave unlock_price unset to let the dynamic pricing engine calculate automatically (recommended). If setting manually: $0.05-$0.10 common techniques, $0.10-$1.00 specific solutions, $1.00-$10.00 novel discoveries, $10.00-$50.00 breakthroughs. Minimum $0.05, maximum $50.00. Free to submit — you earn 70% when others unlock. If the result is status pending_review, follow its how_to_review instructions (self-approval via `auxilo review`, the dashboard queue, or GET /account/pending).',
+      description: 'Submit TECHNICAL operational knowledge you discovered during this session to the Auxilo marketplace. WHEN TO USE: Call this AFTER you solve a non-trivial TECHNICAL problem that required debugging, experimentation, or combining information from multiple sources. Call it when you discover undocumented behavior, a workaround, or a subtle edge case. Do NOT call it for trivial lookups or standard documentation answers. SCOPE (hard rule — the server refuses out-of-scope submissions with CATEGORY_OUT_OF_SCOPE): technical learnings ONLY — APIs, developer tools, code, infrastructure, data pipelines, monitoring, payment/crypto technology, debugging. NEVER submit interpersonal/communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique. A technical learning about a messaging/email/notification API belongs under web-interaction or code-execution; content/data pipeline tech belongs under data-processing. QUALITY GATE: Self-assess on Specificity, Actionability, Novelty, Completeness (1-5 each) and ALWAYS include your scores in quality_self_assessment — a submission WITHOUT it is held for manual review instead of publishing seamlessly. Only submit if total >= 14/20, no dimension below 3 (the server quarantines below-floor submissions for review). DEDUP: Search auxilo_knowledge first to avoid duplicates. SENSITIVITY (mandatory self-screen): never include secrets, credentials, API keys, PII, private filesystem paths, or proprietary/client business content — generalize to placeholders or omit; this is a PUBLIC Auxilo marketplace. PRICING: Leave unlock_price unset to let the dynamic pricing engine calculate automatically (recommended). If setting manually: $0.05-$0.10 common techniques, $0.10-$1.00 specific solutions, $1.00-$10.00 novel discoveries, $10.00-$50.00 breakthroughs. Minimum $0.05, maximum $50.00. Free to submit — you earn 70% when others unlock. If the result is status pending_review, follow its how_to_review instructions (self-approval via `auxilo review`, the dashboard queue, or GET /account/pending).',
       inputSchema: {
         type: 'object',
         properties: {
@@ -337,7 +337,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_rate',
-      description: 'Rate a learning 1-5 after using it. WHEN TO USE: After you unlock and apply knowledge from auxilo_unlock, always come back and rate it. Your rating helps other agents find the best knowledge and deprioritizes low-quality submissions. This is how the marketplace stays useful. Free. One rating slot per account per learning: re-rating REPLACES your prior score, it never counts twice (CH-6). REQUIRES: your API key (run `npx auxilo setup` if unset) and a prior unlock of this learning by your account — only verified purchasers can rate (LW-7).',
+      description: 'Rate a learning 1-5 after using it. WHEN TO USE: After you unlock and apply knowledge from auxilo_unlock, always come back and rate it. Your rating helps other agents find the best knowledge and deprioritizes low-quality submissions. This is how the Auxilo marketplace stays useful. Free. One rating slot per account per learning: re-rating REPLACES your prior score, it never counts twice (CH-6). REQUIRES: your API key (run `npx auxilo setup` if unset) and a prior unlock of this learning by your account — only verified purchasers can rate (LW-7).',
       inputSchema: {
         type: 'object',
         properties: {
@@ -432,7 +432,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_review',
-      description: 'Review YOUR OWN pending-review learnings (from background extraction) so they can be approved to the public marketplace, rejected, or kept private. Account-scoped: only the authenticated account\'s own pending items are ever visible or affected. ACTIONS: "list" returns the triage summary (counts incl. by_signal + compact rows with quality score, lane, a one-sentence why for flagged items, and platform screen verdicts: injection, content sensitivity, near-duplicate). "approve" / "reject" apply explicit decisions to the ids you pass (the operator must have named or confirmed these items). "keep_private" finalizes one id or the selected lane (needs_your_eyes by default): it stays yours; owner-only recall at $0; never published. Bulk keep_private is DRY-RUN BY DEFAULT and uses the same selection helper as the CLI. "approve_clean" selects every item that passed ALL platform screens AND has quality >= min_quality (default 14/20); it is DRY-RUN BY DEFAULT and returns exactly what WOULD be approved. "reject_by_signal" bulk-rejects every pending item carrying one flag signal (e.g. social_handle) — REJECT ONLY (items stay private; there is deliberately no bulk approve by class): the operator must confirm the signal AND its by_signal count from "list", and you pass that count as expected_count — the server refuses if the live selection differs. "sanitize" resubmits ONE operator-corrected item through EVERY screen with lineage (the original is retired to private, reason sanitize-resubmit; the replacement is ALWAYS held for the operator\'s explicit approval — never auto-published): only call it with a correction the operator reviewed. CONSENT CONTRACT: nothing goes public without the contributor\'s explicit approval. Before executing approve_clean or bulk keep_private, show the operator the dry-run list and count, then call again with dry_run:false, confirm:true, and expected_count set to the dry-run count. The server also enforces a counted-confirmation gate on every bulk call. Requires your configured API key (or session_token).',
+      description: 'Review YOUR OWN pending-review learnings (from background extraction) so they can be approved to the public Auxilo marketplace, rejected, or kept private. Account-scoped: only the authenticated account\'s own pending items are ever visible or affected. ACTIONS: "list" returns the triage summary (counts incl. by_signal + compact rows with quality score, lane, a one-sentence why for flagged items, and platform screen verdicts: injection, content sensitivity, near-duplicate). "approve" / "reject" apply explicit decisions to the ids you pass (the operator must have named or confirmed these items). "keep_private" finalizes one id or the selected lane (needs_your_eyes by default): it stays yours; owner-only recall at $0; never published. Bulk keep_private is DRY-RUN BY DEFAULT and uses the same selection helper as the CLI. "approve_clean" selects every item that passed ALL platform screens AND has quality >= min_quality (default 14/20); it is DRY-RUN BY DEFAULT and returns exactly what WOULD be approved. "reject_by_signal" bulk-rejects every pending item carrying one flag signal (e.g. social_handle) — REJECT ONLY (items stay private; there is deliberately no bulk approve by class): the operator must confirm the signal AND its by_signal count from "list", and you pass that count as expected_count — the server refuses if the live selection differs. "sanitize" resubmits ONE operator-corrected item through EVERY screen with lineage (the original is retired to private, reason sanitize-resubmit; the replacement is ALWAYS held for the operator\'s explicit approval — never auto-published): only call it with a correction the operator reviewed. CONSENT CONTRACT: nothing goes public without the contributor\'s explicit approval. Before executing approve_clean or bulk keep_private, show the operator the dry-run list and count, then call again with dry_run:false, confirm:true, and expected_count set to the dry-run count. The server also enforces a counted-confirmation gate on every bulk call. Requires your configured API key (or session_token).',
       inputSchema: {
         type: 'object',
         properties: {
@@ -456,7 +456,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'get_knowledge_stats',
-      description: 'Get knowledge marketplace statistics — total learnings, unlocks, contributors, and top categories. Free.',
+      description: 'Get Auxilo knowledge statistics — total learnings, unlocks, contributors, and top categories. Free.',
       inputSchema: { type: 'object', properties: {} },
     },
   ],
@@ -794,7 +794,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             min_quality: plan.min_quality,
             submitted: decisions.length,
             ...totals,
-            note: 'Approved items are now PUBLIC on the marketplace. Screen-flagged and below-threshold items remain pending for individual review.',
+            note: 'Approved items are now PUBLIC on the Auxilo marketplace. Screen-flagged and below-threshold items remain pending for individual review.',
           });
         }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.12",
+  "version": "0.9.13",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",
@@ -25,6 +25,7 @@
     "scripts/extract-local.js",
     "scripts/review-notice.js",
     "scripts/sources/",
+    "scripts/providers/",
     "scripts/hooks/auxilo-extract.sh",
     "README.md",
     "LICENSE"

package/scripts/extract-local.js

@@ -12,7 +12,6 @@
  * runner no-ops immediately (runner.js checks it). runner.js also sets it in-process
  * before we're called; we set it on the child explicitly as belt-and-suspenders.
  */
-const { spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -24,6 +23,8 @@ const {
   rankIndexRowsForCandidate,
   estimatePromptTokens,
 } = require('../lib/extraction-index.js');
+const providers = require('./providers/index.js');
+const claudeCodeProvider = require('./providers/claude-code.js');
 
 // CI-5 (PUNCH-LIST §30, 2026-07-19): Auxilo is TECHNICAL-ONLY. The learning
 // taxonomy is these six tech categories; `communication` and `content-generation`
@@ -148,158 +149,10 @@ function buildExtractionPrompt(opts = {}) {
 /** Back-compat export: the default (gate-evaluated-at-call) prompt. */
 const EXTRACTION_PROMPT = buildExtractionPrompt({ scoreExtraction: false });
 
-/** Resolve the `claude` binary — hook/launchd env may have a minimal PATH. */
-function resolveClaudeBin(opts = {}) {
-  const homeDir = typeof opts.homeDir === 'string' ? opts.homeDir : os.homedir();
-  const existsSync = typeof opts.existsSync === 'function' ? opts.existsSync : fs.existsSync;
-  const candidates = [
-    path.join(homeDir, '.claude', 'local', 'claude'),
-    '/usr/local/bin/claude',
-    '/opt/homebrew/bin/claude',
-    path.join(homeDir, '.local', 'bin', 'claude'),
-  ];
-  for (const c of candidates) {
-    try {
-      if (existsSync(c)) return c;
-    } catch (_) { /* ignore */ }
-  }
-  // Absolute launchd fallbacks are absent; let PATH resolve the final option.
-  return 'claude';
-}
-
-/** Build the subscription-auth-only environment shared by Claude CLI children. */
-function claudeChildEnv() {
-  const childEnv = { ...process.env, AUXILO_EXTRACTING: '1' };
-  delete childEnv.ANTHROPIC_API_KEY;
-  return childEnv;
-}
-
-/**
- * Ask Claude Code for its authoritative local auth state. Only the boolean
- * `loggedIn` field is classified; every other outcome is unknown so callers
- * can fall through to the real model invocation as the classifier of record.
- */
-function checkClaudeAuthStatus(opts = {}) {
-  const spawnSyncImpl = typeof opts.spawnSyncImpl === 'function'
-    ? opts.spawnSyncImpl
-    : spawnSync;
-  const bin = typeof opts.claudeBin === 'string'
-    ? opts.claudeBin
-    : resolveClaudeBin();
-  let res;
-  try {
-    res = spawnSyncImpl(bin, ['auth', 'status'], {
-      encoding: 'utf-8',
-      env: claudeChildEnv(),
-      timeout: 5000,
-      maxBuffer: 1024 * 1024,
-    });
-  } catch {
-    return 'unknown';
-  }
-  if (!res || res.error || res.status !== 0) return 'unknown';
-  try {
-    const status = JSON.parse(String(res.stdout || ''));
-    if (!status || typeof status.loggedIn !== 'boolean') return 'unknown';
-    return status.loggedIn ? 'logged-in' : 'logged-out';
-  } catch {
-    return 'unknown';
-  }
-}
-
-/**
- * Invoke the local Claude Code model headlessly (uses the USER's subscription auth).
- * Prompt+transcript go via stdin. Returns { ok, out, reason } plus auth/cause
- * metadata — never throws, so the SessionEnd hook degrades gracefully (the
- * proactive auxilo_contribute path is the reliable primary; this deterministic
- * hook is best-effort).
- */
-function extractWithClaudeCode(transcript, opts = {}) {
-  const spawnSyncImpl = typeof opts.spawnSyncImpl === 'function'
-    ? opts.spawnSyncImpl
-    : spawnSync;
-  const bin = typeof opts.claudeBin === 'string'
-    ? opts.claudeBin
-    : resolveClaudeBin();
-  const authStatus = checkClaudeAuthStatus({ spawnSyncImpl, claudeBin: bin });
-  if (authStatus === 'logged-out') {
-    return {
-      ok: false,
-      out: '',
-      reason: 'local model not authenticated in this context (run `claude auth login` once); skipping deterministic extraction',
-      reasonCode: 'cli-unauthenticated',
-      authStatus,
-    };
-  }
-  const prompt = typeof opts.prompt === 'string'
-    ? opts.prompt
-    : buildExtractionPrompt({
-      previousLessonsSection: opts.previousLessonsSection,
-      captureVisibility: opts.captureVisibility,
-      ...(opts.scoreExtraction !== undefined && { scoreExtraction: opts.scoreExtraction }),
-    });
-  const input = prompt + String(transcript).slice(0, 200000);
-  // Do NOT pass ANTHROPIC_API_KEY through — we want the user's logged-in Claude
-  // subscription (OAuth), not an API key (which would bill someone). Delete it.
-  let res;
-  try {
-    res = spawnSyncImpl(bin, ['-p'], {
-      input,
-      encoding: 'utf-8',
-      env: claudeChildEnv(),
-      timeout: 120000,
-      maxBuffer: 20 * 1024 * 1024,
-    });
-  } catch (error) {
-    return {
-      ok: false,
-      out: '',
-      reason: `spawn failed (${bin}): ${error.message}`,
-      reasonCode: 'unknown',
-      authStatus,
-    };
-  }
-  if (!res) {
-    return {
-      ok: false,
-      out: '',
-      reason: `spawn failed (${bin}): no process result`,
-      reasonCode: 'unknown',
-      authStatus,
-    };
-  }
-  const out = String(res.stdout || '');
-  if (res.error) {
-    return {
-      ok: false,
-      out: '',
-      reason: `spawn failed (${bin}): ${res.error.message}`,
-      reasonCode: 'unknown',
-      authStatus,
-    };
-  }
-  // Claude prints auth failures ("API Error: 401 ... Please run /login") to stdout.
-  if (/Please run \/login|authentication_error|401/i.test(out) || /Please run \/login|authentication_error/i.test(String(res.stderr || ''))) {
-    return {
-      ok: false,
-      out,
-      reason: 'local model not authenticated in this context (run `claude auth login` once); skipping deterministic extraction',
-      reasonCode: 'cli-unauthenticated',
-      authStatus,
-      ...(authStatus === 'logged-in' && { authDiscrepancy: true }),
-    };
-  }
-  if (res.status !== 0) {
-    return {
-      ok: false,
-      out,
-      reason: `local model exited ${res.status}: ${(out || String(res.stderr || '')).slice(0, 160)}`,
-      reasonCode: 'model-error',
-      authStatus,
-    };
-  }
-  return { ok: true, out, reason: null, authStatus };
-}
+// resolveClaudeBin, claudeChildEnv, checkClaudeAuthStatus, extractWithClaudeCode
+// MOVED to scripts/providers/claude-code.js (EXTRACT-PER-CLIENT W1 PART A).
+// Re-exported below (module.exports) from claudeCodeProvider — required because
+// test/ext-0806b-silent-skip.test.js imports them directly from this module.
 
 /**
  * A1: validate a model-emitted quality_self_assessment. Returns the normalized
@@ -523,59 +376,97 @@ ${JSON.stringify(payload)}`;
   return { prompt, rankings };
 }
 
+// invokeJudgeWithClaudeCode MOVED into scripts/providers/claude-code.js's
+// runModel(mode:'judge') (EXTRACT-PER-CLIENT W1 PART A). Not re-exported here —
+// grep confirmed no test imports it directly from this module (no dead surface
+// carried).
+//
+// judgeUsage's Claude/Anthropic-specific summing (input_tokens +
+// cache_creation_input_tokens + cache_read_input_tokens) moved with it, into
+// claude-code.js's normalizeJudgeUsage() — that's the provider-specific half.
+// This slimmer, provider-agnostic remainder is what's left once a provider's
+// runModel already returns usage normalized to {input_tokens, output_tokens}
+// (or null): apply the SAME text-length-estimate fallback the original judgeUsage
+// used, generically, for whichever provider ran.
 function judgeUsage(usage, prompt, completion) {
   const numeric = usage && typeof usage === 'object' ? usage : {};
   const directInput = Number(numeric.input_tokens) || 0;
-  const cacheCreation = Number(numeric.cache_creation_input_tokens) || 0;
-  const cacheRead = Number(numeric.cache_read_input_tokens) || 0;
   const output = Number(numeric.output_tokens) || 0;
   return {
-    prompt_tokens: directInput + cacheCreation + cacheRead ||
-      estimatePromptTokens(prompt),
+    prompt_tokens: directInput || estimatePromptTokens(prompt),
     completion_tokens: output || estimatePromptTokens(completion),
   };
 }
 
-function invokeJudgeWithClaudeCode(prompt) {
-  const bin = resolveClaudeBin();
-  const childEnv = { ...process.env, AUXILO_EXTRACTING: '1' };
-  delete childEnv.ANTHROPIC_API_KEY;
-  const res = spawnSync(
-    bin,
-    ['-p', '--output-format', 'json', '--no-session-persistence', '--tools', ''],
-    {
-      input: prompt,
-      encoding: 'utf8',
-      env: childEnv,
-      timeout: 120000,
-      maxBuffer: 20 * 1024 * 1024,
-    }
-  );
-  const stdout = String(res.stdout || '');
-  if (res.error) {
-    return { ok: false, out: '', reason: `judge spawn failed (${bin}): ${res.error.message}` };
-  }
-  if (/Please run \/login|authentication_error|401/i.test(stdout) ||
-      /Please run \/login|authentication_error/i.test(String(res.stderr || ''))) {
-    return { ok: false, out: '', reason: 'local judge model is not authenticated' };
-  }
-  if (res.status !== 0) {
-    return {
-      ok: false,
-      out: '',
-      reason: `local judge exited ${res.status}: ${(stdout || String(res.stderr || '')).slice(0, 160)}`,
-    };
+/**
+ * PART C — resolve the extraction_model identity for a runModel result.
+ * Prefers the additive `identity` field a provider's runModel result may
+ * carry (byo-key.js always sets one: {provider:'byo-key', model, version,
+ * vendor}). claude-code.js/codex-cli.js shipped (PART A/B) before this stamp
+ * existed and don't set one — rather than touch those provider modules
+ * (outside this part's disjoint file scope, AGENTS.md's one-build rule),
+ * this falls back to the resolved provider id alone (model/version/vendor
+ * null) so every provider gets SOME stamp, never silently none. Best-effort:
+ * a resolution failure here must never block extraction itself.
+ */
+async function resolveExtractionModelIdentity(runModelResult, opts) {
+  if (runModelResult && runModelResult.identity && typeof runModelResult.identity === 'object') {
+    return runModelResult.identity;
   }
-  let wrapper;
   try {
-    wrapper = JSON.parse(stdout);
-  } catch {
-    return { ok: false, out: '', reason: 'local judge returned malformed JSON wrapper' };
-  }
-  if (!wrapper || typeof wrapper.result !== 'string' || wrapper.is_error === true) {
-    return { ok: false, out: '', reason: 'local judge returned no successful result' };
-  }
-  return { ok: true, out: wrapper.result, usage: wrapper.usage || null, reason: null };
+    const resolved = await providers.resolveProvider(opts);
+    if (resolved && resolved.ok && resolved.id) {
+      return { provider: resolved.id, model: null, version: null, vendor: null };
+    }
+  } catch { /* identity is best-effort; never block extraction on it */ }
+  return null;
+}
+
+/**
+ * Default invokeModel (extractLocally) — routes through the resolved provider's
+ * runModel(mode:'extract'), mapped back to the legacy {ok, out, reason,
+ * reasonCode, authStatus} shape extractLocally's caller already expects. opts
+ * (spawnSyncImpl/claudeBin/etc.) thread straight through so the injection
+ * pattern used by every extractLocally test still works when a test exercises
+ * this default path instead of supplying its own opts.invokeModel.
+ */
+async function defaultInvokeModel(transcript, invokeOpts, opts) {
+  const result = await providers.runModel({
+    ...opts,
+    prompt: invokeOpts.prompt,
+    input: transcript,
+    timeoutMs: 120000,
+    log: opts.log,
+    mode: 'extract',
+  });
+  return {
+    ok: result.ok,
+    out: result.text,
+    reason: result.reason,
+    reasonCode: result.reasonCode,
+    authStatus: result.authStatus,
+    extractionModel: await resolveExtractionModelIdentity(result, opts),
+    ...(result.authDiscrepancy !== undefined && { authDiscrepancy: result.authDiscrepancy }),
+  };
+}
+
+/**
+ * Default invokeJudge (runAnchoredJudge) — routes through the resolved
+ * provider's runModel(mode:'judge'), mapped back to the legacy {ok, out, usage,
+ * reason} shape runAnchoredJudge already consumes. Same opts thread-through as
+ * defaultInvokeModel above.
+ */
+function defaultInvokeJudge(opts) {
+  return async (prompt) => {
+    const result = await providers.runModel({
+      ...opts,
+      prompt,
+      timeoutMs: 120000,
+      log: opts.log,
+      mode: 'judge',
+    });
+    return { ok: result.ok, out: result.text, usage: result.usage, reason: result.reason };
+  };
 }
 
 function parseJudgeDecisions(raw, candidates, rankings) {
@@ -630,7 +521,7 @@ async function runAnchoredJudge(candidates, indexState, opts = {}) {
   if (rankings.some((rows) => rows.length === 0)) return empty;
   const invokeJudge = typeof opts.invokeJudge === 'function'
     ? opts.invokeJudge
-    : invokeJudgeWithClaudeCode;
+    : defaultInvokeJudge(opts);
   let result;
   try {
     result = await invokeJudge(prompt, { candidates: input, rankings });
@@ -765,7 +656,7 @@ async function extractLocally(transcript, sourceType, opts = {}) {
   });
   const invokeModel = typeof opts.invokeModel === 'function'
     ? opts.invokeModel
-    : (text, invokeOpts) => extractWithClaudeCode(text, invokeOpts);
+    : (text, invokeOpts) => defaultInvokeModel(text, invokeOpts, opts);
   const modelResult = await invokeModel(transcript, { prompt });
   const { ok, out, reason } = modelResult;
   if (!ok) {
@@ -779,13 +670,21 @@ async function extractLocally(transcript, sourceType, opts = {}) {
       }),
     };
   }
+  // PART C: which provider/model actually ran this extraction, stamped onto
+  // every learning it produces (below). Absent when the caller supplied its
+  // own opts.invokeModel that doesn't report one (every existing test does
+  // this) — extraction_model then simply never appears, byte-identical to
+  // pre-PART-C behavior.
+  const extractionModel = modelResult.extractionModel || null;
   const parsed = parseExtractionOutput(out, opts);
   const promptDropResult = applyPromptMemoryDrops(
     parsed.prompt_drops,
     promptMemory,
     opts
   );
-  const candidates = [...parsed.learnings, ...promptDropResult.restored];
+  const candidates = [...parsed.learnings, ...promptDropResult.restored].map((l) => (
+    extractionModel ? { ...l, extraction_model: extractionModel } : l
+  ));
 
   // Re-read immediately before the lexical filter. If the index is deleted,
   // becomes unreadable, or is corrupted while the model runs, the filter is
@@ -840,11 +739,18 @@ async function extractLocally(transcript, sourceType, opts = {}) {
 }
 
 module.exports = {
-  extractLocally, extractWithClaudeCode, checkClaudeAuthStatus, EXTRACTABLE_SOURCES, EXTRACTABLE_SOURCE_IDS,
-  parseLearnings, parseExtractionOutput, resolveClaudeBin,
+  extractLocally, EXTRACTABLE_SOURCES, EXTRACTABLE_SOURCE_IDS,
+  parseLearnings, parseExtractionOutput,
   CATEGORIES, PRIVATE_CATEGORIES, RETIRED_CATEGORIES,
   EXTRACTION_PROMPT, buildExtractionPrompt, scoreExtractionEnabled,
   validateQualityAssessment, QUALITY_DIMENSIONS,
   buildAnchoredJudgePrompt, parseJudgeDecisions, runAnchoredJudge,
-  recordDropAudit, invokeJudgeWithClaudeCode, JUDGE_TOP_K,
+  recordDropAudit, JUDGE_TOP_K,
+  // Re-exported from scripts/providers/claude-code.js (moved there in PART A) —
+  // kept here ONLY because test/ext-0806b-silent-skip.test.js imports these
+  // three directly from this module (grep-confirmed; invokeJudgeWithClaudeCode
+  // and judgeUsage had no such importer and are NOT carried forward).
+  extractWithClaudeCode: claudeCodeProvider.extractWithClaudeCode,
+  checkClaudeAuthStatus: claudeCodeProvider.checkClaudeAuthStatus,
+  resolveClaudeBin: claudeCodeProvider.resolveClaudeBin,
 };