docs: the routing rulings, the credential store, the report inbox and the two-session run

[REPPL]

What

The product thinker's routing interview of 2026-09-22, after two independent research passes and an ideate gauntlet:

• adr-2609221009491186: a provider adapter serves only the models it lists, under a vendor denylist no listing overrides; everything else runs on the host. adr-2609221017021499: every external credential abcd holds is named in configuration and kept in one store the person chose.

• Planned and READY: the OpenAI-compatible API adapter with OpenRouter as configuration, the allowlist, the named key, the run record and a one-time ahoy walkthrough (itd-2609081951381895); the credential store with three homes and one reader (itd-2609221017023290); a decision adapter for abcd's typed judgements that runs in shadow as an abcd lab and whose research note is the evidence a ruling turns a judgement type on with (itd-2609221009495079); the command-line runner, with a configured fallback host and every fall back recorded as intel (itd-2609201916056194).

• Amended: the model tier takes the escalation rule (one tier up on a failed fix round) and the allowlist; itd-22 is widened so "any harness" includes none; itd-17's learned router is superseded.

• Recorded, not adopted: the control-programme idea went through the ideate gauntlet and came out reframed — an operator console served by the binary over local web, with a product-thinker pane in their own register, sequenced after the runner. Two kill attempts were fatal to the idea as put.

• Two more, interviewed the same evening for tomorrow's run: a managed repository reports back to abcd through an inbox in the user account, with identity in the inbox and a fingerprint in anything committed (itd-2609221656361680); and two orchestrator sessions share one run, all three division modes measured a window at a time under bounds that keep the second from stopping or overloading the first (itd-2609221656373558).

Why

Jev (TypeSafe AI, on OpenRouter) is a typed-decision model, not a router: it fits abcd's closed-option judgements and nothing generative. Reaching it means reaching an aggregator that also serves the frontier models a person already pays for through their host, so the allowlist is the condition of the integration, not a refinement of it. The same walkthrough is the pattern for every credential abcd will hold, which is why the store is its own record rather than the adapter's private habit.

Review

Three independent passes fed this: a state-of-the-art pass on Jev and model routing (filed as a research note with its sources), a primary-source pass on headless harness invocation, and an adversarial review of the console idea by an evaluator that saw the artefact without its provenance. Every record went through the readiness gate; the record, reviews-charter, decisions-append and docs gates and the full preflight pass.

A note on this branch

It replaces an identical branch whose secret scan failed on a false positive: a spec's footprint line read internal/core/oracle, internal/adapter/openaiapi, internal/surface/cli, and the generic-api-key rule read the package name plus the next token as a key and its value. No credential was involved. Because the scan reads history and force-pushing is not done here, the work was rebuilt commit by commit off main with the two footprint lines reworded; this branch scans clean.

Records

Assisted-by: Claude:claude-opus-5