agentic-runner 3.2.0__tar.gz → 3.3.0__tar.gz

{agentic_runner-3.2.0 → agentic_runner-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.2.0
+Version: 3.3.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.2.0 → agentic_runner-3.3.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.2.0"
+__version__ = "3.3.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.2.0 → agentic_runner-3.3.0}/src/agentic_runner/activities.py

@@ -44,6 +44,11 @@ from agentic_runner.attempts import (
     fence_work_record,
     refuse_if_prior_attempt_alive,
 )
+from agentic_runner.auth_mode import (
+    AuthModeRefusedError,
+    choose_auth_mode,
+    is_shared_runner,
+)
 from agentic_runner.callback import (
     CALLBACK_TOKEN_ENV,
     AnnotateRequest,
@@ -118,11 +123,12 @@ from agentic_runner.workers._runtime_support import (
 )
 from agentic_runner.workers.agent_runtime import (
     AgentRuntime,
-    AuthModel,
+    AuthMode,
     DirectiveRequest,
     DirectiveResult,
     ResumableAgentRuntime,
 )
+from agentic_runner.workers.contract_device_login import login_file_counts
 from agentic_runner.workers.contract_isolation import (
     NO_CONTRACT,
     ContractIsolation,
@@ -638,6 +644,9 @@ class _DirectiveAttempt:
     # Console-v2 issue 28: the attached Skills, for a runtime with no skills directory to
     # write them into. Prefixed to the Directive prompt; empty when there is none.
     skills_preamble: str = ""
+    # Chosen before anything is spawned (local-agents 04); the runtime runs in it and
+    # the harness-usage report follows it.
+    auth_mode: AuthMode = AuthMode.API_KEY
 
     async def run_environment_hook(self) -> None:
         self.extra_env.update(await self.hooks.environment())
@@ -1432,6 +1441,7 @@ HARNESS_SESSION_EVIDENCE_SOURCE = "runner.harness_session"
 DIRECTIVE_TOKEN_EVIDENCE_SOURCE = "runner.directive_token"
 AGENT_RUNTIME_EVIDENCE_SOURCE = "runner.agent_runtime"
 SKILLS_EVIDENCE_SOURCE = "runner.skills"
+HARNESS_LOGIN_RESIDUE_SOURCE = "runner.harness_login_residue"
 
 
 class _EvidenceWriter(Protocol):
@@ -1578,6 +1588,10 @@ class RunnerRalphActivities:
         # no proxy here keeps calling the backend one, which is exactly the transition
         # the issue describes.
         self._llm_proxy = llm_proxy
+        # Contracts whose harness roots this process has already checked for a login
+        # left behind (local-agents 04). Only de-duplicates an Evidence line -- no later
+        # activity reads it -- so a restart reporting the residue again is the intent.
+        self._residue_checked: set[str | None] = set()
         # Credential References (PRD issue 48, 22 A1). None means this Runner resolves
         # none: a Contract that declares a manifest then fails its Directives closed,
         # which is the right answer -- a Runner with no host store cannot host that
@@ -1969,6 +1983,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
+                    auth_mode=attempt.auth_mode,
                     prompt=attempt.skills_preamble
                     + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
@@ -2000,6 +2015,7 @@ class RunnerRalphActivities:
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
                 result=codex_result,
+                auth_mode=attempt.auth_mode,
             )
             plan = _take_plan(checkout_workspace)
             if codex_result.exit_code != 0:
@@ -2419,6 +2435,8 @@ class RunnerRalphActivities:
         the bearer defensible under ADR-0011 §9.
         """
 
+        auth_mode = await self._directive_auth_mode(work_record_id, state)
+        await self._report_login_residue(work_record_id, state)
         facts = AttemptFacts(
             work_record_id=work_record_id,
             directive_id=directive_id(
@@ -2476,8 +2494,8 @@ class RunnerRalphActivities:
                     )
                 )
                 callback_env = server.env()
-            if self._llm_proxy is not None and self._meters_through_the_proxy(state):
-                # API-key mode only (issue 43): a device-login Contract never has a slot
+            if self._llm_proxy is not None and auth_mode == AuthMode.API_KEY:
+                # API-key mode only (issue 43): a subscription Directive never has a slot
                 # to resolve, and issue 31 meters it from the harness's own output. One
                 # bearer serves the callback socket and the proxy alike.
                 proxy_attempt = await stack.enter_async_context(
@@ -2528,6 +2546,7 @@ class RunnerRalphActivities:
                 mcp_servers=mcp_servers,
                 egress_allow_list=egress_allow_list,
                 skills_preamble=delivered_preamble,
+                auth_mode=auth_mode,
             )
 
     async def _refuse_skill_digest_mismatch(
@@ -2805,26 +2824,86 @@ class RunnerRalphActivities:
             )
             raise
 
-    def _meters_through_the_proxy(self, state: _RuntimeContextState) -> bool:
-        """Whether this Directive's runtime is metered at the proxy (issue 43).
-
-        The mirror of :meth:`_report_harness_usage`'s test: an ``api_key`` Directive
-        routes through the proxy and is metered there; a device-login one bypasses it
-        entirely and is metered from the harness's own output by PRD issue 31. Read off
-        the runtime the Work Record's `cli_kind` names, never a process-wide one.
+    async def _directive_auth_mode(
+        self, work_record_id: str, state: _RuntimeContextState
+    ) -> AuthMode:
+        """This Directive's auth mode, or a non-retryable refusal with Evidence naming the
+        rule (local-agents 04).
+
+        Decided from the host party this process was registered with and from whether a
+        key is present for the Contract -- never from the payload. A runtime that declares
+        no modes (a test double built before the port grew the field) reads as
+        ``api_key``-only, and a kind this Runner does not serve reads the same way; that
+        Directive fails closed in :meth:`_agent_runtime_for` regardless.
         """
 
-        return self._auth_model(state) == AuthModel.API_KEY
-
-    def _auth_model(self, state: _RuntimeContextState) -> AuthModel:
-        # `getattr` with a default, not `.auth_model` outright: a runtime that carries
-        # none (a test double built before this port grew the field) is the same case as
-        # `api_key` -- nothing to report from the harness -- never a crash on an
-        # unrelated Directive. A kind this Runner does not serve reads the same way; the
-        # Directive itself has already failed closed in :meth:`_agent_runtime_for`.
         runtime = self._agent_runtimes.get(state.cli_kind)
-        model = getattr(runtime, "auth_model", AuthModel.API_KEY)
-        return model if isinstance(model, AuthModel) else AuthModel.API_KEY
+        host_party = self._routing_identity.host_party if self._routing_identity else None
+        try:
+            return choose_auth_mode(
+                host_party=host_party,
+                key_present=self._api_key_present(state, runtime),
+                runtime_modes=getattr(runtime, "auth_modes", frozenset({AuthMode.API_KEY})),
+            )
+        except AuthModeRefusedError as refusal:
+            await _raise_recorded(
+                ApplicationError(str(refusal), type=refusal.rule, non_retryable=True),
+                self._fastapi_client,
+                work_record_id,
+                source=AGENT_RUNTIME_EVIDENCE_SOURCE,
+                actor=self._actor(),
+                payload={
+                    "event": "directive.auth_mode_refused",
+                    "rule": refusal.rule,
+                    "cli_kind": state.cli_kind,
+                    "host_party": host_party,
+                    "contract_id": state.contract_id,
+                },
+            )
+
+    def _api_key_present(self, state: _RuntimeContextState, runtime: AgentRuntime | None) -> bool:
+        """A delivered slot for the Contract (or its funder), or the host operator's key."""
+
+        if bool(getattr(runtime, "host_api_key", False)):
+            return True
+        contract_id = _optional_uuid(state.contract_id)
+        return (
+            self._llm_proxy is not None
+            and contract_id is not None
+            and self._llm_proxy.slots.holds(contract_id)
+        )
+
+    async def _report_login_residue(self, work_record_id: str, state: _RuntimeContextState) -> None:
+        """On a shared Runner, say once that a Contract's harness root holds a login.
+
+        A count per harness, never a path or a byte of the file: the Runner does not open
+        it, a shared Runner never runs on it, and ``wipe_contract_residue`` removes it with
+        the Contract. Saying so is what turns a sign-in made before local-agents 03 (or by
+        hand) into something the Organisation can see and act on.
+        """
+
+        host_party = self._routing_identity.host_party if self._routing_identity else None
+        if (
+            self._contract_isolation is None
+            or not is_shared_runner(host_party)
+            or state.contract_id in self._residue_checked
+        ):
+            return
+        self._residue_checked.add(state.contract_id)
+        counts = login_file_counts(self._contract_isolation, state.contract_id)
+        if not counts:
+            return
+        await self._fastapi_client.append_evidence(
+            work_record_id,
+            source=HARNESS_LOGIN_RESIDUE_SOURCE,
+            actor=self._actor(),
+            payload={
+                "event": "harness.login_residue",
+                "contract_id": state.contract_id,
+                "host_party": host_party,
+                "login_files": counts,
+            },
+        )
 
     async def _agent_runtime_for(
         self, work_record_id: str, state: _RuntimeContextState
@@ -4516,6 +4595,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
+                    auth_mode=attempt.auth_mode,
                     prompt=attempt.skills_preamble
                     + _learning_prompt(
                         request,
@@ -4534,6 +4614,7 @@ class RunnerRalphActivities:
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
                 result=result,
+                auth_mode=attempt.auth_mode,
             )
             usage = await self._directive_usage(
                 work_record_id=request.work_record_id,
@@ -4764,6 +4845,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
+                    auth_mode=attempt.auth_mode,
                     prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,
@@ -4789,6 +4871,7 @@ class RunnerRalphActivities:
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
                 result=codex_result,
+                auth_mode=attempt.auth_mode,
             )
             # Taken before the commit below so it never lands on the branch (PRD 59).
             plan = _take_plan(state.workspace_path)
@@ -4987,14 +5070,15 @@ class RunnerRalphActivities:
         work_record_id: str,
         directive_number: int,
         result: DirectiveResult,
+        auth_mode: AuthMode,
     ) -> None:
-        """A device-login/setup-token Directive bypasses the LLM proxy, so this is the
-        only metering the Runner can produce for it (PRD issue 31, 17 A9). A no-op for an
-        ``api_key`` runtime -- the proxy already metered that call at request time -- and
-        never the reason a Directive fails (same posture as :meth:`_directive_usage`).
+        """A subscription Directive bypasses the LLM proxy, so this is the only metering
+        the Runner can produce for it (PRD issue 31, 17 A9). A no-op for an ``api_key``
+        Directive -- the proxy already metered that call at request time -- and never the
+        reason a Directive fails (same posture as :meth:`_directive_usage`).
         """
 
-        if self._auth_model(runtime_state) == AuthModel.API_KEY:
+        if auth_mode == AuthMode.API_KEY:
             return
         directive = directive_id(work_record_id=work_record_id, directive_number=directive_number)
         if runtime_state.cli_kind == "claude_code":

agentic_runner-3.3.0/src/agentic_runner/auth_mode.py

@@ -0,0 +1,86 @@
+"""Which auth mode one Directive runs in, decided on the Runner before spawn (local-agents 04).
+
+Subscriptions follow the person, not the host (owner, 2026-09-26): a harness runs on a
+subscription login only on the Contract person's own Runner -- host party ``user``, which
+routing has already tied to the Contract's person (``assert_routed`` here, the platform's
+``_subscription_bound`` there) -- whatever channel the Runner was installed by. A shared
+Runner (``organisation`` or ``account``) runs every Directive through the LLM proxy on an
+API key and refuses sign-in. The platform refuses an ineligible sign-in at the door
+(local-agents 03); this module is the backstop, so it decides from what the Runner itself
+knows and never from the payload.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Collection
+from typing import Final
+
+from agentic_runner.workers.agent_runtime import AuthMode
+
+__all__ = [
+    "SETUP_TOKEN_REFUSED_RULE",
+    "SHARED_HOST_PARTIES",
+    "SHARED_RUNNER_SIGN_IN_RULE",
+    "SHARED_RUNNER_SUBSCRIPTION_RULE",
+    "AuthModeRefusedError",
+    "choose_auth_mode",
+    "is_setup_token",
+    "is_shared_runner",
+]
+
+SHARED_HOST_PARTIES: Final[frozenset[str]] = frozenset({"organisation", "account"})
+
+# The rule names a refusal's Evidence carries, so a support read can say which line held.
+SHARED_RUNNER_SUBSCRIPTION_RULE: Final[str] = "shared_runner_api_key_only"
+SHARED_RUNNER_SIGN_IN_RULE: Final[str] = "shared_runner_sign_in_refused"
+SETUP_TOKEN_REFUSED_RULE: Final[str] = "setup_token_refused"
+
+# `claude setup-token` mints an OAuth bearer under this prefix; an Anthropic API key is
+# `sk-ant-api…`. The sealed wire carries no mode, so the value's own shape is what the
+# Runner can refuse on.
+_SETUP_TOKEN_PREFIX: Final[str] = "sk-ant-oat"
+
+
+class AuthModeRefusedError(RuntimeError):
+    """A Directive or sign-in this Runner will not run; ``rule`` is the stable code."""
+
+    def __init__(self, rule: str, message: str) -> None:
+        super().__init__(message)
+        self.rule = rule
+
+
+def is_shared_runner(host_party: str | None) -> bool:
+    return host_party in SHARED_HOST_PARTIES
+
+
+def choose_auth_mode(
+    *,
+    host_party: str | None,
+    key_present: bool,
+    runtime_modes: Collection[AuthMode],
+) -> AuthMode:
+    """``api_key`` whenever a key is present; otherwise ``subscription`` on a user-hosted
+    Runner whose runtime can run one, and a refusal on a shared Runner.
+
+    The refusal is the shared Runner's "subscription case": with no key there is nothing
+    for the proxy to spend, and the only thing left that could authenticate the harness is
+    a login, which a shared Runner never uses. An unregistered process (``host_party``
+    ``None``) is not user-hosted either, so it never runs a subscription; it runs on a key
+    or fails at the proxy for want of one, as it would today.
+    """
+
+    if key_present:
+        return AuthMode.API_KEY
+    if is_shared_runner(host_party):
+        raise AuthModeRefusedError(
+            SHARED_RUNNER_SUBSCRIPTION_RULE,
+            f"this Runner is hosted by {host_party!r}, so it runs API keys only, and no API "
+            "key is present for this Contract",
+        )
+    if host_party == "user" and AuthMode.SUBSCRIPTION in runtime_modes:
+        return AuthMode.SUBSCRIPTION
+    return AuthMode.API_KEY
+
+
+def is_setup_token(value: str) -> bool:
+    return value.strip().startswith(_SETUP_TOKEN_PREFIX)

{agentic_runner-3.2.0 → agentic_runner-3.3.0}/src/agentic_runner/config.py

@@ -51,6 +51,11 @@ class RunnerConfig(BaseModel):
     # fails its Directives with Evidence naming the reference (22 A1), instead of running
     # without the credential it was told to use.
     credential_store: Path | None = None
+    # Where a delivered OpenAI / Anthropic key is spent (local-agents 04b), when not at
+    # the vendor itself: a gateway the host runs in front of it. The host already holds
+    # the opened value, so pointing it elsewhere grants the host nothing it lacked.
+    openai_base_url: str | None = None
+    anthropic_base_url: str | None = None
     log_level: str = "info"
 
 

{agentic_runner-3.2.0 → agentic_runner-3.3.0}/src/agentic_runner/device_login_activities.py

@@ -11,7 +11,9 @@ from collections.abc import Callable
 from datetime import UTC, datetime
 
 from temporalio import activity
+from temporalio.exceptions import ApplicationError
 
+from agentic_runner.auth_mode import SHARED_RUNNER_SIGN_IN_RULE
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import ContractIsolation
 from agentic_runner_contracts.activity_io import (
@@ -31,8 +33,12 @@ class ContractDeviceLoginActivities:
         *,
         contract_isolation: ContractIsolation,
         device_login: ContractDeviceLogin | None = None,
+        host_party: str | None = None,
     ) -> None:
         self._contract_isolation = contract_isolation
+        # The party this process was registered as hosted by. A shared Runner never runs a
+        # subscription, so it never starts or reads one either (local-agents 04).
+        self._host_party = host_party
         # Injectable for tests; None falls through to the real `codex` subprocess.
         self._device_login = device_login or ContractDeviceLogin(contract_isolation)
 
@@ -46,6 +52,7 @@ class ContractDeviceLoginActivities:
     async def sign_in_contract_device_login(
         self, request: ContractDeviceLoginInput
     ) -> ContractDeviceLoginResult:
+        self._refuse_on_shared_runner()
         prompt = await self._device_login.sign_in(
             request.contract_id, runtime_kind=request.runtime_kind
         )
@@ -61,6 +68,7 @@ class ContractDeviceLoginActivities:
     async def check_contract_device_login_status(
         self, request: ContractDeviceLoginStatusInput
     ) -> ContractDeviceLoginStatusResult:
+        self._refuse_on_shared_runner()
         present = self._device_login.token_present(
             request.contract_id, runtime_kind=request.runtime_kind
         )
@@ -77,3 +85,19 @@ class ContractDeviceLoginActivities:
             token_present=present,
             delivered_at=delivered_at,
         )
+
+    def _refuse_on_shared_runner(self) -> None:
+        """Non-retryable, and typed by the rule: there is no Work Record to write Evidence
+        on here, so the failure the platform's sign-in workflow receives names it.
+
+        Only a Runner known to be the person's own signs in: one whose state names no host
+        party (registered before issue 42) is refused too, as `choose_auth_mode` never runs
+        a subscription on it either."""
+
+        if self._host_party != "user":
+            raise ApplicationError(
+                f"this Runner is hosted by {self._host_party!r}; only a person's own Runner "
+                "signs in, a shared Runner runs API keys only",
+                type=SHARED_RUNNER_SIGN_IN_RULE,
+                non_retryable=True,
+            )

{agentic_runner-3.2.0 → agentic_runner-3.3.0}/src/agentic_runner/llm_proxy.py

@@ -35,7 +35,7 @@ import contextlib
 import json
 import secrets
 from collections.abc import AsyncIterator, Awaitable, Callable, Iterable, Mapping
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from datetime import UTC, datetime
 from types import TracebackType
 from typing import Any, Final, Self
@@ -67,25 +67,35 @@ __all__ = [
     "ATTEMPT_PREFIX",
     "COMPLETION_PATHS",
     "CALL_REFUSED_SOURCE",
+    "PROXY_API_KEY_ENV",
+    "PROXY_BASE_URL_ENV",
     "PROXY_ENV_NAMES",
     "AttemptHandle",
     "CeilingStore",
     "Ceilings",
     "CredentialSlot",
+    "LLM_SLOT_REFERENCES",
+    "LlmProvider",
     "LlmProxy",
     "SLOT_REFUSED_SOURCE",
     "SLOT_SWAPPED_SOURCE",
     "SlotStore",
     "UsageOutbox",
     "attempt_env",
+    "llm_slot_references",
 ]
 
 ATTEMPT_PREFIX: Final[str] = "/a/"
 
+# The OpenAI-compatible half of `attempt_env`. Codex does not read the base URL from the
+# environment, so its runtime lifts it from here into a provider of its own.
+PROXY_BASE_URL_ENV: Final[str] = "OPENAI_BASE_URL"
+PROXY_API_KEY_ENV: Final[str] = "OPENAI_API_KEY"
+
 # Every name `attempt_env` may set. Reserved on a Directive's environment so no hook
 # can redirect an Agent's traffic away from the metering point (`_runtime_support`).
 PROXY_ENV_NAMES: Final[frozenset[str]] = frozenset(
-    {"ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "OPENAI_BASE_URL", "OPENAI_API_KEY"}
+    {"ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", PROXY_BASE_URL_ENV, PROXY_API_KEY_ENV}
 )
 
 # A Directive's context is the whole reason these bodies are large: Claude Code and Codex
@@ -105,10 +115,12 @@ _TOKEN_BYTES: Final[int] = 32
 _LOOPBACK_HOSTS: Final[frozenset[str]] = frozenset({"127.0.0.1", "::1", "localhost"})
 
 # The completion routes, relayed to the same path at the slot's own base URL: the
-# OpenAI-compatible one the backend proxy served, and Anthropic's, because Claude Code
-# is one of the two harnesses the platform ships and it would otherwise still need a
-# provider key of its own (ADR-0011 §9).
-COMPLETION_PATHS: Final[frozenset[str]] = frozenset({"/chat/completions", "/messages"})
+# OpenAI-compatible one the backend proxy served, Anthropic's, because Claude Code is one
+# of the two harnesses the platform ships and it would otherwise still need a provider key
+# of its own (ADR-0011 §9), and the Responses API, which is the only wire Codex speaks.
+COMPLETION_PATHS: Final[frozenset[str]] = frozenset(
+    {"/chat/completions", "/messages", "/responses"}
+)
 _SSE_DONE: Final[bytes] = b"data: [DONE]"
 
 # Anthropic rejects a request without it, whichever credential shape the request carries.
@@ -183,6 +195,62 @@ class CredentialSlot:
         return f"{self.base_url.rstrip('/')}/{path.lstrip('/')}"
 
 
+@dataclass(frozen=True, slots=True)
+class LlmProvider:
+    """Where a delivered key is spent, and how it is presented there.
+
+    Endpoints are plain config, never a secret (ADR-0013 §11), so the sealed wire does not
+    carry one: the Credential Reference's name says which provider a value belongs to and
+    this says where that provider is.
+    """
+
+    name: str
+    runtime_kind: str
+    base_url: str
+    auth_style: str
+
+    def slot(self, *, reference: str, key_id: str, value: str) -> CredentialSlot:
+        return CredentialSlot(
+            reference=reference,
+            key_id=key_id,
+            provider_name=self.name,
+            base_url=self.base_url,
+            value=value,
+            runtime_kind=self.runtime_kind,
+            auth_style=self.auth_style,
+        )
+
+
+# The Credential References a delivered value fills the proxy's slot from (local-agents
+# 04b), named after the variable each harness reads its own key from, so a funder declares
+# the name the vendor's docs already taught them. Any other reference stays a verb-seam or
+# MCP credential and never reaches the proxy.
+LLM_SLOT_REFERENCES: Final[Mapping[str, LlmProvider]] = {
+    "OPENAI_API_KEY": LlmProvider(
+        name="openai",
+        runtime_kind="codex_cli",
+        base_url="https://api.openai.com/v1",
+        auth_style="bearer",
+    ),
+    "ANTHROPIC_API_KEY": LlmProvider(
+        name="anthropic",
+        runtime_kind="claude_code",
+        base_url="https://api.anthropic.com/v1",
+        auth_style="x-api-key",
+    ),
+}
+
+
+def llm_slot_references(base_urls: Mapping[str, str]) -> dict[str, LlmProvider]:
+    """:data:`LLM_SLOT_REFERENCES` with an operator's endpoint per provider name -- a
+    gateway in front of the vendor, or the chart test's fake provider."""
+
+    return {
+        reference: replace(provider, base_url=base_urls.get(provider.name, provider.base_url))
+        for reference, provider in LLM_SLOT_REFERENCES.items()
+    }
+
+
 SlotProber = Callable[[CredentialSlot], Awaitable[bool]]
 
 
@@ -267,6 +335,13 @@ class SlotStore:
             )
         return SlotProbe.VALID
 
+    def drop(self, contract_id: UUID) -> None:
+        """Forget a Contract's slot: wiped, not listed (22 A9). The next call is refused."""
+
+        self._slots.pop(contract_id, None)
+        self._probes.pop(contract_id, None)
+        self._last_used.pop(contract_id, None)
+
     def resolve(self, contract_id: UUID | None) -> CredentialSlot | None:
         """The slot this call spends, read at the call (22 A8)."""
 
@@ -281,6 +356,13 @@ class SlotStore:
             self._last_used[contract_id] = datetime.now(UTC)
         return slot
 
+    def holds(self, contract_id: UUID) -> bool:
+        """Whether a call for this Contract would find a slot -- without the use stamp
+        :meth:`resolve` leaves, because choosing a Directive's mode spends nothing."""
+
+        funder = self._funded_by.get(contract_id)
+        return contract_id in self._slots or (funder is not None and funder in self._slots)
+
     def statuses(self) -> list[SlotStatus]:
         """The heartbeat's slot fields (22 A10, issue 31's ``valid|invalid|unprobed``)."""
 
@@ -441,7 +523,7 @@ def attempt_env(cli_kind: str, *, base_url: str, token: str) -> dict[str, str]:
         # CLIs are configured with the `/v1` already on. Same attempt, same bearer — only
         # the half of the URL each harness expects to supply differs.
         return {"ANTHROPIC_BASE_URL": base_url, "ANTHROPIC_AUTH_TOKEN": token}
-    return {"OPENAI_BASE_URL": f"{base_url}/v1", "OPENAI_API_KEY": token}
+    return {PROXY_BASE_URL_ENV: f"{base_url}/v1", PROXY_API_KEY_ENV: token}
 
 
 class LlmProxy:
@@ -863,13 +945,14 @@ def _usage_block(body: Mapping[str, object]) -> Mapping[str, object]:
     if isinstance(usage, Mapping):
         return usage
     # Anthropic's `message_start` frame nests the input counts one level down, under the
-    # message it is starting. `message` is followed only to reach that `usage` block --
-    # nothing else in the frame is read (ADR-0010 §4).
-    message = body.get("message")
-    if isinstance(message, Mapping):
-        nested = message.get("usage")
-        if isinstance(nested, Mapping):
-            return nested
+    # message it is starting, and the Responses API's `response.completed` under the
+    # response it completes. Each is followed only to reach that `usage` block -- nothing
+    # else in the frame is read (ADR-0010 §4).
+    for inner in (body.get("message"), body.get("response")):
+        if isinstance(inner, Mapping):
+            nested = inner.get("usage")
+            if isinstance(nested, Mapping):
+                return nested
     return {}
 
 
@@ -931,7 +1014,8 @@ def _cached_tokens(usage: Mapping[str, object]) -> int | None:
     direct = _first_int(usage, "cached_tokens", "cache_read_input_tokens")
     if direct is not None:
         return direct
-    details = usage.get("prompt_tokens_details")
-    if isinstance(details, Mapping):
-        return _usage_int(details, "cached_tokens")
+    for key in ("prompt_tokens_details", "input_tokens_details"):
+        details = usage.get(key)
+        if isinstance(details, Mapping):
+            return _usage_int(details, "cached_tokens")
     return None