Resolve static model policy once for catalog and routing

scripts/test-layout/layout.json

@@ -1161,6 +1161,7 @@
     "relay-eager.test.ts": "server",
     "release-helper.test.ts": "ci-workflows",
     "release-notes.test.ts": "ci-workflows",
+    "resolved-model-policy.test.ts": "providers",
     "release-version-line.test.ts": "ci-workflows",
     "remote-catalog.test.ts": "clients",
     "remote-workspace-activation.test.ts": "clients",

structure/catalog.md

@@ -22,6 +22,19 @@ validation-pending. Import alone supplies no entitlement evidence for the model
 
 ## Shared catalog
 
+Static policy and observed catalog evidence are separate authorities.
+`src/providers/resolved-model-policy.ts` resolves and freezes only registry/operator static facts,
+hard wire pins, aliases, and explicit false/empty declarations. Discovery responses, generated
+metadata, cache freshness, availability, credentials, account state, quota and health never enter
+that result. A catalog consumer may pass observed context, max-input, or max-output values to the
+resolver's call-local limit projection; the lower observed/static value wins, unknown remains
+unknown, and the projection mutates neither input. P1a establishes this provider-owned contract
+without changing catalog assembly; consumer migration is a separate layer.
+Policy is keyed by the final upstream wire model. Public alias and virtual-model identities remain
+diagnostic/catalog provenance and must be resolved before policy capture. Exact nonempty explicit
+capability modalities outrank the registry/config modality map; an empty capability declaration
+falls through to that map.
+
 `src/codex/catalog.ts` builds a shared Codex-shaped catalog for CLI, TUI, App, and SDK. It:
 
 - preserves native OpenAI entries from the live catalog or static fallback, and emits

structure/config.md

@@ -309,6 +309,21 @@ Both fields must stay positive finite integers at disk-config and management val
 Registry entries may seed them through `providerConfigSeed`, key-login derivation, OAuth reconcile,
 and `routeModel`, but user config overrides registry defaults per field/key.
 
+`src/providers/resolved-model-policy.ts` is the detached static-policy authority for this merge
+contract. It preserves each field's existing rule rather than assigning one global priority:
+operator scalars and explicit booleans fill over registry defaults, per-model maps fill per key,
+selected hard caps use the lower positive value, restriction lists form a stable union, and hard
+wire pins precede valid operator overrides and registry wire defaults. Its output is recursively
+frozen and carries field/model provenance. It never persists resolved policy and excludes API keys,
+account selection, quota, health, cooldowns, discovered availability, and request-owned evidence.
+Observed context/input/output values are combined only in a call-local projection that can narrow a
+captured static cap but cannot write observations into the static result.
+The resolver's model id is the post-alias, post-virtual-rewrite wire identity. An exact nonempty
+`modelCapabilities[model].inputModalities` declaration outranks the legacy per-model modality map;
+an empty declaration is non-authoritative and falls through. OAuth/key override admission remains a
+live caller decision: the resolver accepts only its credential-free effective auth mode and records
+that provenance, never the key, reference, or usability evidence that produced it.
+
 ## Provider validation ownership
 
 `src/config/provider-validation.ts` owns the pure provider payload checks shared by persisted config,

structure/providers-and-adapters.md

@@ -8,6 +8,7 @@ the [bounded ingestion contract](transports/inventory.md#bounded-response-ingest
 | --- | --- |
 | `src/providers/registry.ts` | Compatibility facade; canonical provider presets for CLI, dashboard, OAuth, key providers, and metadata live in `src/providers/registry/entries-core.ts` and `entries-extended.ts`, with model seeds in `model-seeds.ts`. |
 | `src/providers/derive.ts` | Enrichment from provider presets into user config. |
+| `src/providers/resolved-model-policy.ts` | Pure static provider/model policy resolution for the final upstream wire model, after public model aliases and virtual models are rewritten. It detaches and freezes registry defaults, operator overrides, exact explicit capabilities, hard wire pins, aliases, and explicit false/empty values with field-level provenance. Callers supply transport match, the exact capability row, and a credential-free effective auth decision; credential bytes, usability evidence, account/quota/health state, and observed limits remain outside the result. |
 | `src/oauth/` | OAuth providers, token storage, refresh, and auth-token resolution. The login callback listener binds a per-provider FIXED loopback port, so consecutive logins reuse the same number; every response it sends ends its connection (`Connection: close`, including non-callback paths such as a stray `/favicon.ico` 404). Stopping the listener does not close an established socket, so without that a pooled client would deliver the next login's callback to the retired flow, which rejects the unknown state as a CSRF mismatch while the live flow waits. Kiro add-account identity prefers same-session `whoami` over a leftover SQLite state profile, and never persists the Builder ID service profile ARN as `accountId`. |
 | `src/combos/request.ts` | Clones each selected combo target request and applies the existing target capability ladder: adaptive unknown targets and explicit empty ladders receive no unsupported reasoning/thinking controls, while known ladders retain per-target resolution. |
 | `src/adapters/openai-responses.ts` | Native OpenAI/ChatGPT Responses passthrough. |

tests/fixtures/test-layout-expected.json

@@ -986,6 +986,7 @@
   "relay-eager.test.ts": "server",
   "release-helper.test.ts": "ci-workflows",
   "release-notes.test.ts": "ci-workflows",
+  "resolved-model-policy.test.ts": "providers",
   "release-version-line.test.ts": "ci-workflows",
   "remote-catalog.test.ts": "clients",
   "remote-workspace-activation.test.ts": "clients",