lynkr 9.9.0 → 9.9.1

package/src/routing/classifier-setup.js

@@ -0,0 +1,207 @@
+/**
+ * Classifier bootstrap — verifies ollama is installed and the classifier
+ * model is pulled + warm. Called from:
+ *  - `lynkr init` (interactive, prompts user for install, blocks on completion)
+ *  - server boot (non-blocking, logs warnings, never errors out)
+ *
+ * Ollama install is intentionally NOT auto-executed. Silent `curl | sh`
+ * during npm install is a supply-chain footgun; we detect and instruct
+ * instead.
+ *
+ * "Later" work per user directive:
+ *  - Fine-tune qwen2.5:3b on labeled classification data (needs LoRA infra)
+ *  - Canary verification against known-good prompts on every startup
+ */
+
+const { spawn } = require('child_process');
+const os = require('os');
+
+// Reads the classifier model constant from difficulty-classifier.js so this
+// module and the classifier stay in lock-step.
+const { CLASSIFIER_MODEL_INFO } = require('./difficulty-classifier');
+
+/**
+ * Check whether the `ollama` CLI is on PATH.
+ * @returns {Promise<{installed: boolean, version?: string}>}
+ */
+function detectOllama() {
+  return new Promise((resolve) => {
+    const proc = spawn('ollama', ['--version'], { stdio: ['ignore', 'pipe', 'ignore'] });
+    let out = '';
+    proc.stdout?.on('data', (d) => { out += d.toString(); });
+    proc.on('error', () => resolve({ installed: false }));
+    proc.on('close', (code) => {
+      if (code === 0) {
+        resolve({ installed: true, version: out.trim() });
+      } else {
+        resolve({ installed: false });
+      }
+    });
+  });
+}
+
+/**
+ * Check whether a specific ollama model is present locally.
+ * @param {string} model
+ * @returns {Promise<boolean>}
+ */
+function isModelPulled(model) {
+  return new Promise((resolve) => {
+    const proc = spawn('ollama', ['list'], { stdio: ['ignore', 'pipe', 'ignore'] });
+    let out = '';
+    proc.stdout?.on('data', (d) => { out += d.toString(); });
+    proc.on('error', () => resolve(false));
+    proc.on('close', () => {
+      // ollama list prints "NAME ID SIZE MODIFIED" — grep by exact model name
+      const rows = out.split('\n').slice(1);
+      resolve(rows.some((line) => line.startsWith(model + ' ') || line.split(/\s+/)[0] === model));
+    });
+  });
+}
+
+/**
+ * Pull a model, streaming progress to stdout.
+ * @param {string} model
+ * @returns {Promise<void>}
+ */
+function pullModel(model) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn('ollama', ['pull', model], { stdio: 'inherit' });
+    proc.on('error', reject);
+    proc.on('close', (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`ollama pull exited with code ${code}`));
+    });
+  });
+}
+
+/**
+ * Warm the model — one dummy inference so first real call isn't cold.
+ * Best-effort; failure doesn't block.
+ * @param {string} model
+ */
+async function warmModel(model, endpoint = 'http://localhost:11434') {
+  try {
+    const url = `${endpoint.replace(/\/$/, '')}/api/chat`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 60000);
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        model,
+        messages: [{ role: 'user', content: 'ok' }],
+        stream: false,
+        options: { num_predict: 3 },
+      }),
+      signal: controller.signal,
+    });
+    clearTimeout(timer);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+/** Instructions to print when ollama is missing. */
+function installInstructions() {
+  const plat = os.platform();
+  const lines = ['Ollama is required for the difficulty classifier and SIMPLE-tier serving.'];
+  if (plat === 'darwin') {
+    lines.push('Install on macOS:');
+    lines.push('  brew install ollama');
+    lines.push('  # or download: https://ollama.com/download');
+  } else if (plat === 'linux') {
+    lines.push('Install on Linux:');
+    lines.push('  curl -fsSL https://ollama.com/install.sh | sh');
+  } else if (plat === 'win32') {
+    lines.push('Install on Windows:');
+    lines.push('  Download the installer from https://ollama.com/download/windows');
+  } else {
+    lines.push('Install from https://ollama.com/download');
+  }
+  lines.push('After installing, re-run `lynkr init` (or restart the server).');
+  return lines.join('\n');
+}
+
+/**
+ * Full bootstrap flow with prompts.
+ * @param {object} opts
+ * @param {'interactive'|'boot'} opts.mode — interactive blocks on failure, boot warns and continues
+ * @param {function} [opts.log] — logger function (defaults to console)
+ * @param {function} [opts.warn] — warn function
+ * @param {function} [opts.prompt] — async prompt(text)→string for interactive install/pull confirmations
+ * @returns {Promise<{ready: boolean, ollama: boolean, model: boolean, reason?: string}>}
+ */
+async function ensureClassifierReady(opts = {}) {
+  const mode = opts.mode || 'boot';
+  const log = opts.log || ((msg) => console.log(msg));
+  const warn = opts.warn || ((msg) => console.warn(msg));
+  const { provider, model, endpoint } = CLASSIFIER_MODEL_INFO;
+
+  if (provider !== 'ollama') {
+    // Non-ollama providers not supported today — bail cleanly.
+    warn(`Classifier provider "${provider}" is not yet auto-provisioned. Ensure ${model} is reachable manually.`);
+    return { ready: false, ollama: false, model: false, reason: 'non_ollama_provider' };
+  }
+
+  // 1. Ollama detection
+  const ollama = await detectOllama();
+  if (!ollama.installed) {
+    const msg = installInstructions();
+    if (mode === 'interactive') {
+      log('');
+      log('⚠ Ollama not found on PATH.');
+      log('');
+      log(msg);
+      log('');
+    } else {
+      warn(`[classifier-setup] Ollama not installed — classifier disabled. ${installInstructions().split('\n')[0]}`);
+    }
+    return { ready: false, ollama: false, model: false, reason: 'ollama_missing' };
+  }
+  if (mode === 'interactive') log(`✓ Ollama detected (${ollama.version || 'unknown version'}).`);
+
+  // 2. Model pull
+  const hasModel = await isModelPulled(model);
+  if (!hasModel) {
+    if (mode === 'interactive') {
+      log('');
+      log(`Classifier model "${model}" not present locally.`);
+      const yes = opts.prompt ? await opts.prompt(`Pull ${model} now? [Y/n] `) : 'y';
+      if (yes.trim().toLowerCase().startsWith('n')) {
+        warn(`Skipped pull — classifier will be disabled until you run: ollama pull ${model}`);
+        return { ready: false, ollama: true, model: false, reason: 'pull_declined' };
+      }
+      log(`Pulling ${model} (this can take a few minutes on first run)...`);
+      try {
+        await pullModel(model);
+        log(`✓ Model ${model} pulled.`);
+      } catch (err) {
+        warn(`✗ Pull failed: ${err.message}`);
+        return { ready: false, ollama: true, model: false, reason: 'pull_failed' };
+      }
+    } else {
+      // Boot mode — don't auto-pull. Log a clear instruction and continue.
+      warn(`[classifier-setup] Classifier model ${model} not pulled. Run: ollama pull ${model}. Classifier will fall back to anchor-only scoring until then.`);
+      return { ready: false, ollama: true, model: false, reason: 'model_missing' };
+    }
+  }
+
+  // 3. Warm-up
+  const warmed = await warmModel(model, endpoint);
+  if (mode === 'interactive') {
+    log(warmed ? `✓ Model warmed (first classification will be fast).` : `⚠ Warm-up call failed — the first classification may be slow.`);
+  }
+
+  return { ready: true, ollama: true, model: true, warmed };
+}
+
+module.exports = {
+  detectOllama,
+  isModelPulled,
+  pullModel,
+  warmModel,
+  installInstructions,
+  ensureClassifierReady,
+};

package/src/routing/complexity-analyzer.js

@@ -92,9 +92,23 @@ const ADVANCED_PATTERNS = {
   },
 };
 
-// Force cloud patterns - always route to cloud regardless of score
-const FORCE_CLOUD_PATTERNS = [
+// Force REASONING patterns - deterministic escalation to top tier (Claude in
+// config B). Checked before force_cloud. Hardcoded constants (no env var).
+// Security/governance asks route to the trusted Claude provider; deep
+// reasoning asks route to extended thinking.
+const FORCE_REASONING_PATTERNS = [
   /\b(security\s+(audit|review|assessment)|penetration\s+test|vulnerability\s+scan)\b/i,
+  /\b(ultrathink|ultra[\s-]?think)\b/i,
+  /\b(think\s+(hard|deeply|carefully|step[\s-]by[\s-]step|through\s+this))/i,
+  /\b(prove|proof|formal\s+proof|verify|verification)\b/i,
+  /\b(from\s+first\s+principles)\b/i,
+  /\b(reason\s+(through|about|from)\s+(the|this))/i,
+];
+
+// Force COMPLEX patterns - route to COMPLEX (GLM in config B) regardless of
+// score. Architecture/refactor/code-review are substantial but not
+// security-critical, so GLM is appropriate.
+const FORCE_CLOUD_PATTERNS = [
   /\b(architect(ure)?\s+(review|design|diagram)|system\s+design)\b/i,
   /\b(refactor\s+(entire|whole|all|the\s+entire)|complete\s+rewrite)\b/i,
   /\b(code\s+review|pr\s+review|pull\s+request\s+review)\b/i,
@@ -465,7 +479,13 @@ function scoreTools(payload) {
 function scoreTaskType(content) {
   const contentLower = content.toLowerCase();
 
-  // Check force patterns first
+  // Check force patterns first (priority: REASONING > cloud > local)
+  for (const pattern of FORCE_REASONING_PATTERNS) {
+    if (pattern.test(content)) {
+      return { score: 100, reason: 'force_reasoning', pattern: pattern.source.slice(0, 40) };
+    }
+  }
+
   for (const pattern of FORCE_LOCAL_PATTERNS) {
     if (pattern.test(content)) {
       return { score: 0, reason: 'force_local', pattern: 'greeting_or_simple' };
@@ -474,7 +494,7 @@ function scoreTaskType(content) {
 
   for (const pattern of FORCE_CLOUD_PATTERNS) {
     if (pattern.test(content)) {
-      return { score: 25, reason: 'force_cloud', pattern: pattern.source.slice(0, 30) };
+      return { score: 75, reason: 'force_cloud', pattern: pattern.source.slice(0, 30) };
     }
   }
 
@@ -926,6 +946,20 @@ function shouldForceCloud(payload) {
   return !!matched;
 }
 
+/**
+ * Quick check if request should be forced to REASONING tier (Claude in
+ * config B). Matches: ultrathink, think hard/deeply, prove/formal proof,
+ * from first principles, security audit.
+ */
+function shouldForceReasoning(payload) {
+  const content = extractContent(payload);
+  const matched = FORCE_REASONING_PATTERNS.find(pattern => pattern.test(content));
+  if (matched) {
+    logger.debug({ pattern: matched.source.slice(0, 50), text: content.slice(0, 100) }, '[Force] force_reasoning matched');
+  }
+  return !!matched;
+}
+
 // ============================================================================
 // PHASE 4: Embeddings-Based Similarity (Optional Enhancement)
 // ============================================================================
@@ -1041,6 +1075,7 @@ module.exports = {
   // Quick checks
   shouldForceLocal,
   shouldForceCloud,
+  shouldForceReasoning,
 
   // Individual scoring (for testing/debugging)
   scoreTokens,
@@ -1069,6 +1104,7 @@ module.exports = {
   // Constants (for testing)
   PATTERNS,
   ADVANCED_PATTERNS,
+  FORCE_REASONING_PATTERNS,
   FORCE_CLOUD_PATTERNS,
   FORCE_LOCAL_PATTERNS,
   DIMENSION_WEIGHTS,

package/src/routing/difficulty-classifier.js

@@ -0,0 +1,219 @@
+/**
+ * Difficulty classifier — LLM-based 4-way classification of user prompts.
+ *
+ * WHY THIS EXISTS: The anchor-embedding scorer (intent-score.js) measures
+ * *topical* similarity to labeled difficulty exemplars. It confuses "list
+ * the exports from this file" (LOW difficulty, technical vocabulary) with
+ * hard problems. An LLM reading the actual sentence knows better.
+ *
+ * DESIGN:
+ *  - Uses whatever model is configured for the SIMPLE tier (fetched at call
+ *    time via getModelTierSelector). When the user later swaps in a
+ *    fine-tuned classifier as SIMPLE, this picks it up automatically.
+ *  - Structured JSON output; parse failure → null → caller falls back.
+ *  - Hard 2500ms timeout; on timeout → null → caller falls back.
+ *  - LRU cache keyed by sha256(text.trim().toLowerCase()); capacity 500.
+ *  - Skip conditions surface via classifyDifficulty returning null with
+ *    reason=skipped: text.length<15, force-pattern matched, risk=high,
+ *    cache hit is transparent (returns cached).
+ *  - Hardcoded kill-switch CLASSIFIER_ENABLED — no env var per user policy.
+ *
+ * Failure modes are all null: anchor+lexical scoring already handles the
+ * fallback. This module never blocks routing.
+ */
+
+const crypto = require('crypto');
+const logger = require('../logger');
+
+const CLASSIFIER_ENABLED = true;
+// Thinking models (minimax-m2.5) spend 1-4s in <thinking> before emitting
+// JSON — 2.5s is not enough. Raise to 10s and rely on skip conditions +
+// LRU cache to keep amortized latency low.
+const TIMEOUT_MS = 10000;
+const CACHE_CAPACITY = 500;
+const MIN_TEXT_LENGTH = 15;
+
+// Classifier model — decoupled from tier serving so SIMPLE tier can run a
+// more capable model for real traffic while the classifier stays fast and
+// cheap. Chosen 2026-07-19: qwen2.5:3b hit 87.3% hand-labeled accuracy at
+// ~500ms warm latency, zero cost-critical over-routes. Replace with your
+// fine-tuned classifier when you build one. Hardcoded per user directive
+// (no env var).
+const CLASSIFIER_PROVIDER = 'ollama';
+const CLASSIFIER_MODEL = 'qwen2.5:3b';
+
+const VALID_TIERS = ['SIMPLE', 'MEDIUM', 'COMPLEX', 'REASONING'];
+
+// One-shot classification prompt. Kept in a const so drift is diffable.
+// Difficulty framing (not intent) — matches config B routing goals.
+const CLASSIFY_PROMPT = `You are a classifier for an LLM routing proxy. Classify the difficulty of the user prompt below into exactly one of four tiers. Reply with ONLY valid JSON on a single line, no other text.
+
+Tiers:
+- SIMPLE: casual acknowledgments, greetings, one-word answers, trivial factual lookups. Any tiny model handles.
+  examples: "hi", "ok thanks", "yes continue", "what time is it"
+- MEDIUM: one specific mechanical task or a focused explanation. Mid-size local model suffices.
+  examples: "list the exports from this file", "run the unit tests", "fix the linter warnings", "explain this regex", "add error handling to this block"
+- COMPLEX: multi-file design, systemic refactor, architecture review, debugging that requires broad code understanding. Needs a strong general model.
+  examples: "architecture review of the orchestrator", "refactor the entire ingestion pipeline", "debug this complex race condition across three services"
+- REASONING: formal proof, correctness verification, security audit, novel algorithm design, formal reasoning from first principles. Needs a frontier reasoning model.
+  examples: "prove the correctness of this lock-free queue", "security audit the auth middleware", "formally verify this state machine never deadlocks", "derive the optimal eviction policy and prove its competitive ratio"
+
+Reply format (strict): {"tier":"SIMPLE|MEDIUM|COMPLEX|REASONING","confidence":0.0-1.0}
+
+User prompt: `;
+
+// --- LRU cache --------------------------------------------------------------
+
+class LruCache {
+  constructor(capacity) {
+    this.capacity = capacity;
+    this.map = new Map();
+  }
+  get(key) {
+    if (!this.map.has(key)) return undefined;
+    const val = this.map.get(key);
+    this.map.delete(key);
+    this.map.set(key, val); // move to MRU
+    return val;
+  }
+  set(key, val) {
+    if (this.map.has(key)) this.map.delete(key);
+    else if (this.map.size >= this.capacity) {
+      const oldest = this.map.keys().next().value;
+      this.map.delete(oldest);
+    }
+    this.map.set(key, val);
+  }
+  stats() { return { size: this.map.size, capacity: this.capacity }; }
+}
+
+const _cache = new LruCache(CACHE_CAPACITY);
+
+function _cacheKey(text) {
+  return crypto.createHash('sha256').update(text.trim().toLowerCase()).digest('hex');
+}
+
+// --- Ollama dispatch (only supported provider for the SIMPLE tier today) ----
+
+async function _callOllama(text, opts) {
+  const config = require('../config');
+
+  // First cut supports ollama-family classifier only. Other providers can
+  // be wired later; today's classifier is qwen2.5:3b on ollama.
+  if (CLASSIFIER_PROVIDER !== 'ollama') {
+    logger.debug({ provider: CLASSIFIER_PROVIDER, model: CLASSIFIER_MODEL }, '[DifficultyClassifier] non-ollama classifier not yet supported');
+    return null;
+  }
+
+  const endpoint = config.ollama?.endpoint || 'http://localhost:11434';
+  const url = `${endpoint.replace(/\/$/, '')}/api/chat`;
+  const body = {
+    model: CLASSIFIER_MODEL,
+    messages: [{ role: 'user', content: CLASSIFY_PROMPT + '"""' + text + '"""' }],
+    stream: false,
+    format: 'json',
+    // num_predict generous because thinking models (minimax-m2.5) burn
+    // budget in message.thinking before producing message.content JSON.
+    options: { temperature: 0, num_predict: 512 },
+  };
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs || TIMEOUT_MS);
+  try {
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+    if (!res.ok) return null;
+    const json = await res.json();
+    // Thinking models put output in message.thinking; regular in message.content.
+    // /api/generate variants use `response`. Try all three, biggest first.
+    const candidates = [
+      json?.message?.content,
+      json?.message?.thinking,
+      json?.response,
+    ].filter(s => typeof s === 'string' && s.length > 0);
+    return candidates.join('\n') || null;
+  } catch (err) {
+    logger.debug({ err: err.message, textPreview: text.slice(0, 60) }, '[DifficultyClassifier] call failed');
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// --- Parse & validate the model's JSON output -------------------------------
+
+function _parseResult(raw) {
+  if (!raw) return null;
+  // Ollama with format:'json' usually gives clean JSON, but the model can
+  // still surround it with junk — extract the first { ... } span.
+  const match = raw.match(/\{[\s\S]*?\}/);
+  if (!match) return null;
+  let obj;
+  try { obj = JSON.parse(match[0]); } catch { return null; }
+  const tier = String(obj.tier || '').toUpperCase().trim();
+  if (!VALID_TIERS.includes(tier)) return null;
+  const rawConf = Number(obj.confidence);
+  const confidence = Number.isFinite(rawConf) ? Math.max(0, Math.min(1, rawConf)) : 0.5;
+  return { tier, confidence };
+}
+
+// --- Public API -------------------------------------------------------------
+
+/**
+ * Classify difficulty of user text.
+ *
+ * @param {string} text — cleaned user prompt
+ * @param {object} [opts]
+ * @param {number} [opts.timeoutMs] — override default 2500ms
+ * @param {boolean} [opts.forceMatched] — caller already matched a FORCE_* pattern; skip classifier
+ * @param {string} [opts.riskLevel] — 'high' | 'medium' | 'low'; skip when 'high'
+ * @returns {Promise<{tier:string,confidence:number,source:'cache'|'model'}|null>}
+ *   null when: disabled, skipped, model failure, parse failure, timeout.
+ */
+async function classifyDifficulty(text, opts = {}) {
+  if (!CLASSIFIER_ENABLED) return null;
+  if (typeof text !== 'string') return null;
+  const trimmed = text.trim();
+  if (trimmed.length < MIN_TEXT_LENGTH) return null;
+  if (opts.forceMatched) return null;
+  if (opts.riskLevel === 'high') return null;
+
+  const key = _cacheKey(trimmed);
+  const cached = _cache.get(key);
+  if (cached) return { ...cached, source: 'cache' };
+
+  const raw = await _callOllama(trimmed, opts);
+  const parsed = _parseResult(raw);
+  if (!parsed) return null;
+  _cache.set(key, parsed);
+  return { ...parsed, source: 'model' };
+}
+
+// --- Test helpers -----------------------------------------------------------
+
+function _clearCacheForTests() { _cache.map.clear(); }
+function _getCacheStats() { return _cache.stats(); }
+
+// Exposed metadata for the bootstrap module — keeps model choice in one file
+// so classifier-setup.js pulls exactly what the classifier will call.
+const CLASSIFIER_MODEL_INFO = Object.freeze({
+  provider: CLASSIFIER_PROVIDER,
+  model: CLASSIFIER_MODEL,
+  endpoint: process.env.OLLAMA_ENDPOINT || 'http://localhost:11434',
+});
+
+module.exports = {
+  classifyDifficulty,
+  CLASSIFIER_ENABLED,
+  CLASSIFIER_MODEL_INFO,
+  VALID_TIERS,
+  // internals for tests only
+  _parseResult,
+  _cacheKey,
+  _clearCacheForTests,
+  _getCacheStats,
+};

package/src/routing/index.js

@@ -14,6 +14,7 @@ const {
   analyzeComplexity,
   shouldForceLocal,
   shouldForceCloud,
+  shouldForceReasoning,
   routingMetrics,
   analyzeWithEmbeddings,
 } = require('./complexity-analyzer');
@@ -706,11 +707,14 @@ async function _determineProviderSmartInner(payload, options = {}) {
   if (risk?.level === 'high' && isFallbackEnabled()) {
     try {
       const selector = getModelTierSelector();
-      const modelSelection = selector.selectModel('COMPLEX', null);
+      // Config B (local → GLM → Claude): high-risk requests route to the
+      // trusted provider (Claude) via REASONING, not the mid-tier GLM.
+      // Security/auth/middleware changes belong on the governance path.
+      const modelSelection = selector.selectModel('REASONING', null);
       const decision = {
         provider: modelSelection.provider,
         model: modelSelection.model,
-        tier: 'COMPLEX',
+        tier: 'REASONING',
         method: 'risk',
         reason: 'high_risk_forced_tier',
         score: 100,
@@ -719,7 +723,7 @@ async function _determineProviderSmartInner(payload, options = {}) {
         escalations: [{
           source: 'risk',
           fromTier: null,
-          toTier: 'COMPLEX',
+          toTier: 'REASONING',
           fromModel: null,
           toModel: modelSelection.model,
         }],
@@ -731,7 +735,7 @@ async function _determineProviderSmartInner(payload, options = {}) {
       };
       routingMetrics.record(decision);
       logger.debug({
-        tier: 'COMPLEX',
+        tier: 'REASONING',
         provider: decision.provider,
         instructionHits: risk.instructionHits,
         pathHits: risk.pathHits,
@@ -785,6 +789,33 @@ async function _determineProviderSmartInner(payload, options = {}) {
     return decision;
   }
 
+  // Force REASONING (Claude in config B) — checked before force_cloud.
+  // Matches ultrathink/prove/security-audit/first-principles. Deterministic
+  // routing to the top tier regardless of embedding score.
+  if (shouldForceReasoning(payload) && isFallbackEnabled() && config.modelTiers?.enabled) {
+    try {
+      const selector = getModelTierSelector();
+      const modelSelection = selector.selectModel('REASONING', null);
+      const decision = {
+        provider: modelSelection.provider,
+        model: modelSelection.model,
+        tier: 'REASONING',
+        method: 'force',
+        reason: 'force_reasoning_pattern',
+        score: 100,
+        risk,
+        propensity: 1.0,
+        candidates: [{ provider: modelSelection.provider, model: modelSelection.model }],
+        _queryEmbedding: queryEmbedding,
+        _queryText: queryText,
+      };
+      routingMetrics.record(decision);
+      return decision;
+    } catch (err) {
+      degradation.record('tier_select', err);
+    }
+  }
+
   if (shouldForceCloud(payload) && isFallbackEnabled()) {
     // When tier routing is enabled, force-cloud means the COMPLEX tier's
     // configured model — NOT getBestCloudProvider()'s credential-priority