From ced29806bf8a53de016cf1be06b845468c5fa9b1 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 21:16:56 -0700
Subject: [PATCH 1/6] feat: add capability-driven integration adapters

---
 README.md                                     |  32 +-
 bin/agentic-kit.mjs                           |  15 +-
 claude/aqe-reference.md                       |   2 +-
 claude/dual-mode-reference.md                 |   6 +-
 claude/providers-reference.md                 |  20 +-
 docs/LOCAL-MODEL-VALIDATION.md                |   7 +
 docs/MANAGED-TOOLS.md                         |   8 +-
 docs/PROVIDERS.md                             |  63 ++-
 docs/TRANSCRIPTS.md                           |  36 +-
 docs/TROUBLESHOOTING.md                       |   1 +
 docs/UPGRADING.md                             |  26 +-
 docs/USAGE-SCORECARD-METRICS.md               |  61 +--
 ...-capability-driven-integration-adapters.md | 423 ++++++++++++++++++
 docs/adr/README.md                            |   8 +
 src/commands/dual.mjs                         |   6 +-
 src/commands/setup.mjs                        |  10 +-
 src/commands/status.mjs                       |  11 +-
 src/commands/sync.mjs                         |   4 +-
 src/commands/x/provider.mjs                   |  27 +-
 src/commands/x/verify.mjs                     |   4 +-
 src/lib/adapters/bindings.mjs                 |  97 ++++
 src/lib/adapters/config.mjs                   |  50 +++
 src/lib/adapters/facts.mjs                    | 132 ++++++
 src/lib/adapters/index.mjs                    |   8 +
 src/lib/adapters/lifecycle.mjs                |  60 +++
 src/lib/adapters/migration.mjs                |  56 +++
 src/lib/adapters/ownership.mjs                |  37 ++
 src/lib/adapters/registries.mjs               | 267 +++++++++++
 src/lib/adapters/schema.mjs                   |  51 +++
 src/lib/config.mjs                            |  10 +-
 src/lib/dashboard/client.mjs                  |  11 +-
 src/lib/hosts.mjs                             |  46 +-
 src/lib/live/event-schema.mjs                 |  21 +-
 src/lib/providers.mjs                         |  80 +++-
 src/lib/routing.mjs                           |   5 +-
 src/lib/usage-index.mjs                       |  51 ++-
 src/lib/usage-insights.mjs                    |  10 +-
 tests/dashboard.test.cjs                      |  34 +-
 .../adapter-lifecycle-conformance.test.mjs    |  99 ++++
 tests/kit/adapter-registries.test.mjs         | 103 +++++
 tests/kit/capability-derived.test.mjs         |  88 ++++
 tests/kit/cli-help.test.mjs                   |   3 +-
 tests/kit/dispatch-surface.test.mjs           |   2 +
 tests/kit/helpers/integration-builders.mjs    |  84 ++++
 tests/kit/helpers/lifecycle-harness.mjs       |  65 +++
 tests/kit/host-cli-migration.test.mjs         | 117 +++++
 tests/kit/integration-command-facts.test.mjs  |  33 ++
 tests/kit/integration-config.test.mjs         | 120 +++++
 tests/kit/integration-facts.test.mjs          | 140 ++++++
 tests/kit/live-qe-contract.test.mjs           |   3 +-
 tests/kit/observability-identity.test.mjs     | 113 +++++
 tests/kit/provider-cli.test.mjs               |  24 +-
 tests/kit/provider-credentials.test.mjs       |  35 +-
 .../provider-proving-integrations.test.mjs    |  72 +++
 tests/kit/usage-index.test.mjs                |  27 +-
 tests/kit/usage-limit-insights.test.mjs       |   2 +-
 56 files changed, 2729 insertions(+), 197 deletions(-)
 create mode 100644 docs/adr/0016-capability-driven-integration-adapters.md
 create mode 100644 src/lib/adapters/bindings.mjs
 create mode 100644 src/lib/adapters/config.mjs
 create mode 100644 src/lib/adapters/facts.mjs
 create mode 100644 src/lib/adapters/index.mjs
 create mode 100644 src/lib/adapters/lifecycle.mjs
 create mode 100644 src/lib/adapters/migration.mjs
 create mode 100644 src/lib/adapters/ownership.mjs
 create mode 100644 src/lib/adapters/registries.mjs
 create mode 100644 src/lib/adapters/schema.mjs
 create mode 100644 tests/kit/adapter-lifecycle-conformance.test.mjs
 create mode 100644 tests/kit/adapter-registries.test.mjs
 create mode 100644 tests/kit/capability-derived.test.mjs
 create mode 100644 tests/kit/helpers/integration-builders.mjs
 create mode 100644 tests/kit/helpers/lifecycle-harness.mjs
 create mode 100644 tests/kit/host-cli-migration.test.mjs
 create mode 100644 tests/kit/integration-command-facts.test.mjs
 create mode 100644 tests/kit/integration-config.test.mjs
 create mode 100644 tests/kit/integration-facts.test.mjs
 create mode 100644 tests/kit/observability-identity.test.mjs
 create mode 100644 tests/kit/provider-proving-integrations.test.mjs

diff --git a/README.md b/README.md
index 1ead549..89c7947 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,21 @@ ak setup --codex    # …or bring up Claude + Codex together in one shot
 - **Honest by construction:** every guard traces to a filed upstream issue, and `ak x verify` proves the paths end-to-end against real CLIs.
 - Cross-platform, **zero runtime dependencies** (SQLite embedded).
 
+## Hosts, providers, and bindings
+
+A **host** is the agent CLI driving a session (Claude Code, Codex CLI, or OpenCode). A
+**provider** serves inference (Anthropic, OpenAI, OpenRouter, or Ollama). A **projection** is a
+native configuration surface, and an **observability source** supplies transcript, usage, quota,
+or catalogue evidence. A **binding** connects a host to a provider through a supported projection
+and transport.
+
+Those axes do not imply one another. OpenRouter is a provider behind a host, not another host.
+Ollama can have independent bindings through Claude and Codex. OpenCode is a managed host but is
+not currently a primary or activity-routing target. Existing `providers.dualRouting` and
+`ak dual` remain Claude+Codex host-routing interfaces. Provider, model, and billing claims state
+whether they are observed, configured, inferred, or unknown. See
+[ADR-0016](docs/adr/0016-capability-driven-integration-adapters.md).
+
 ## Why this exists
 
 ruflo promises persistent memory, self-learning, security scanning, and background
@@ -51,6 +66,8 @@ ak status       read-only dashboard: what's true, what's drifted   [--json] [--d
 ak sync         converge to good: upgrade + heal + verify          [--dry-run] [--no-upgrade]
 ak dashboard    open the local web dashboard (auto-opens your browser)
                 [--port N] [--no-open] [--live-source 'surface=path']
+ak host         manage execution hosts, routing, and provider bindings
+                status | pick | refresh | off
 ak dual         run a Claude+Codex collaboration swarm (dual-host)   run <template> "<task>"  [--dry-run] [--escalate] [--route ...]
 ak x statusline manage Codex's native user-wide status line          status | codex native|extended|off
 ak uninstall    leave cleanly                [--dry-run] [--this-project] [--remove-ruflo] [--remove-aqe] [--purge] [--yes]
@@ -73,11 +90,12 @@ What the verbs cover:
 | **sync** | The one convergence verb: upgrades first when a new release exists, then re-heals everything an upgrade wipes, then re-checks and reports. Included in that heal: it **installs any enabled frontier host** (claude/codex) that's entirely absent — never touching an external (mise/brew/native) install — and **re-applies provider wiring** (the `ENABLE_*` host env, the aqe fallback chain, and ruflo API providers) whenever it has drifted — and, on a dual-host project, **seeds/heals the per-activity routing policy** (materializing it into agentic-qe's `agentOverrides`, e.g. after an aqe upgrade first makes it eligible). It also **installs/repins the standalone `agentdb` CLI** to ruflo's bundled version (keeping the shared cognitive store coherent) and appends a **health-history snapshot** so `status` can flag regressions across syncs. It also **re-runs the RuvNet Brain installer** to pull the latest release when the on-disk KB has drifted (or installs it if absent, when enabled). It also **self-updates the kit**: when a newer `@pacphi/agentic-kit` exists it installs it as the *last* step (the new code applies from the next `ak` run, never mid-sync). Prerelease installs (`4.0.0-alpha.*`) track the `next` npm dist-tag as well as `latest`, so alphas see their successors; stable installs only ever follow `latest`. `--no-upgrade` skips the self-update along with the package upgrades. |
 | **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) with seven tabs: **Overview · Hosts & Routing · Providers · Runtime · Intelligence · Usage · Live**. The first five render `ak status` health and routing; Usage indexes local Claude/Codex transcripts on demand. Live groups work by project, then provider-branded root sessions with nested agent/worker threads, and pairs an interactive agent/tool execution canvas with a rich, server-masked transcript stream. Active sessions can be followed live or reviewed with synchronized play/pause/seek; completed sessions remain available for bounded playback. Live contains no chat or control plane. Ruflo, agentic-qe, and dual-run stores are not auto-discovered; register each trusted structured JSONL file with repeatable `--live-source 'surface=path'` (`surface` is `ruflo`, `aqe`, or `dual-run`). The page is self-contained and offline-first (no internet fetches; local files and loopback subprocesses/endpoints only). A fresh **per-session token** is minted at startup and required by every `/api/*` route (`x-dash-token` header; the launch URL carries it in the `#` fragment, same contract as `ak admin` — ADR-0007, ADR-0014) — this page serves full transcript text, so it is gated the same way admin already gated GitHub/npm stats. See [Live Sessions](docs/LIVE-SESSIONS.md) for coverage, syntax, and privacy limits. **Auto-opens your browser** (`--no-open` for headless/SSH); `--port N` changes the port; tabs deep-link (`#live`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
 | **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`, with the same dark/light visual theme and persisted theme preference: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), contributors and watchers, npm download momentum (last 7d vs prior 7d, sparklines — shown as trend only, never an absolute reach number, since mirrors/CI inflate the raw count), latest CI run status and open Dependabot alerts, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007, ADR-0013). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
-| **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak x provider pick --host claude,codex`). **Pre-flight refusal:** before spawning a worker, `dual run` refuses to start when ruflo's memory runtime lacks a native better-sqlite3 binding **and** the shared DB has an active native WAL (`-wal`/`-shm` sidecars) — the native WAL writer and the WASM `ruflo memory store` cannot share that DB without corrupting it; the fix is `ak sync` (builds the native binding), then retry. |
+| **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak host pick --host claude,codex`). **Pre-flight refusal:** before spawning a worker, `dual run` refuses to start when ruflo's memory runtime lacks a native better-sqlite3 binding **and** the shared DB has an active native WAL (`-wal`/`-shm` sidecars) — the native WAL writer and the WASM `ruflo memory store` cannot share that DB without corrupting it; the fix is `ak sync` (builds the native binding), then retry. |
+| **host** | Canonical alpha namespace for execution-host status, selection, primary-host choice, activity routing, and reversible teardown: `ak host status\|pick\|refresh\|off`. The plumbing spelling is `ak x host`. `ak provider` and `ak x provider` are deprecated compatibility aliases that warn on stderr and will be removed before the stable release. |
 | **uninstall** | Removes the kit's footprint (and any legacy shell-kit install); project data is never touched; `--purge` also offers to remove the global packages. |
 
 Power-user mechanisms live under `ak x …` (`daemon-gc`, `harvest`,
-`mcp pick|off`, `provider status|pick|off`, `reference diff|sync`,
+`mcp pick|off`, `host status|pick|refresh|off`, `reference diff|sync`,
 `statusline status|codex native|extended|off`,
 `verify learning|security|aqe|providers|harvest`, `improvement-eval`) — see `ak --help --all`.
 
@@ -123,7 +141,7 @@ you opt in. Two independent axes:
 - **Hosts** — which agent CLI runs the ruflo loop: `claude` (Claude Code) and/or `codex`
   (OpenAI Codex), **both at once** via dual-mode (enabling codex doesn't disable claude).
   Turn codex on at first-time setup with `ak setup --codex` (add `--primary-host codex` to
-  make it lead), or later with `ak x provider pick`. A host that is *entirely absent* is
+  make it lead), or later with `ak host pick`. A host that is *entirely absent* is
   installed for you (`npm i -g @anthropic-ai/claude-code` / `@openai/codex`); an
   externally-managed install (mise/brew/native) is detected, reused, and never shadowed.
 - **Providers** — which LLM the routers use, independent of the host: agentic-qe's
@@ -140,16 +158,16 @@ you opt in. Two independent axes:
   design, review; Codex for implementation, testing — and materializes it into agentic-qe's
   `agentOverrides` (adopting upstream [#568](https://github.com/proffesor-for-testing/agentic-qe/issues/568)).
   It's seeded automatically (subscription-only, so no metered surprises), shown in `status` and the
-  dashboard matrix, and **tunable per activity** (`ak x provider pick --route 'testing:claude:claude-sonnet-5'`)
+  dashboard matrix, and **tunable per activity** (`ak host pick --route 'testing:claude:claude-sonnet-5'`)
   with your edits preserved across syncs. **`--primary-host claude|codex`** chooses which host leads:
   codex-primary *mirrors* the default table so Codex drives and Claude is the alternate — symmetric
   either way. `ak dual run <template> "<task>"` then drives a Claude+Codex collaboration swarm off that
   policy. Nothing is seeded for claude-only projects.
 
-`ak x provider status` shows what's detected, wired, and routed; `ak x provider pick` chooses and
-applies (reversibly); `ak x provider off` restores the claude-only default. Full guide:
+`ak host status` shows what's detected, wired, and routed; `ak host pick` chooses and
+applies (reversibly); `ak host off` restores the claude-only default. Full guide:
 [docs/PROVIDERS.md](docs/PROVIDERS.md). Already on an older `ak` and adopting a later capability
-(like dual-host)? [docs/UPGRADING.md](docs/UPGRADING.md) covers the `sync` vs `provider pick` motion.
+(like dual-host)? [docs/UPGRADING.md](docs/UPGRADING.md) covers the `sync` vs `host pick` motion.
 
 ## Troubleshooting
 
diff --git a/bin/agentic-kit.mjs b/bin/agentic-kit.mjs
index c758493..f2ab65b 100755
--- a/bin/agentic-kit.mjs
+++ b/bin/agentic-kit.mjs
@@ -22,6 +22,8 @@ const PORCELAIN = Object.assign(Object.create(null), {
   dashboard: () => import('../src/commands/x/dashboard.mjs'),
   admin: () => import('../src/commands/x/admin.mjs'),
   dual: () => import('../src/commands/dual.mjs'),
+  host: () => import('../src/commands/x/provider.mjs'),
+  provider: () => import('../src/commands/x/provider.mjs'),
   uninstall: () => import('../src/commands/uninstall.mjs'),
 });
 
@@ -31,6 +33,7 @@ const PLUMBING = Object.assign(Object.create(null), {
   'dashboard': () => import('../src/commands/x/dashboard.mjs'),
   'harvest': () => import('../src/commands/x/harvest.mjs'),
   'mcp': () => import('../src/commands/x/mcp.mjs'),
+  'host': () => import('../src/commands/x/provider.mjs'),
   'provider': () => import('../src/commands/x/provider.mjs'),
   'reference': () => import('../src/commands/x/reference.mjs'),
   'statusline': () => import('../src/commands/x/statusline.mjs'),
@@ -47,6 +50,8 @@ Usage (ak = alias of agentic-kit):
   ak dashboard       open the local web dashboard (localhost; auto-opens browser)  [--port N] [--no-open]
   ak admin           maintainer-only telemetry admin (localhost; GitHub/npm egress)  [--port N] [--no-open]
   ak dual            run a Claude+Codex collaboration swarm (dual-host)  [run <template> "task"] [--dry-run]
+  ak host            manage agent hosts, routing, and provider bindings  [status|pick|refresh|off]
+  ak provider        deprecated alias for ak host; removed before the stable release
   ak uninstall       leave cleanly                                      [--this-project] [--purge]
 
   When in doubt: ak sync
@@ -67,7 +72,8 @@ Plumbing (power users) — each takes --help:
   ak x dashboard [--port N]    read-only local health dashboard (localhost only)
   ak x harvest [--dry-run]     opt-in learning-write: replay experiences into the substrate
   ak x mcp [status|pick|off]   MCP registration + tool-family deny rules
-  ak x provider [status|pick|off]   detect claude/codex CLIs; wire ruflo + aqe hosts/providers
+  ak x host [status|pick|refresh|off]   manage hosts, routing, and provider bindings
+  ak x provider [status|pick|refresh|off]   deprecated alias; removed before the stable release
   ak x reference [diff|sync]   CLAUDE.md managed-block inspection/reconcile
   ak x statusline [status|codex native|codex extended|codex off]   manage Codex's native user status line
   ak x verify [learning|security|aqe|providers|harvest|all]   deep proofs (slow, spawns real CLIs)
@@ -80,6 +86,7 @@ async function main() {
   const argv = process.argv.slice(2);
   let cmd = argv[0];
   let rest = argv.slice(1);
+  let deprecatedProvider = cmd === 'provider';
 
   if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
     console.log(argv.includes('--all') ? HELP_ALL : HELP);
@@ -97,6 +104,7 @@ async function main() {
     table = PLUMBING;
     cmd = rest[0];
     rest = rest.slice(1);
+    deprecatedProvider = cmd === 'provider';
     // `ak x`, `ak x --help`, `ak x -h` → the plumbing index.
     if (!cmd || cmd === '--help' || cmd === '-h') { console.log(HELP_ALL); return 0; }
     if (cmd === 'improvement-eval') {
@@ -120,6 +128,11 @@ async function main() {
     return 2;
   }
 
+  if (deprecatedProvider) {
+    const legacy = argv[0] === 'x' ? 'ak x provider' : 'ak provider';
+    const canonical = argv[0] === 'x' ? 'ak x host' : 'ak host';
+    console.error(`${legacy} is deprecated; use \`${canonical}\`. It will be removed before the stable release.`);
+  }
   const mod = await table[cmd]();
 
   // Per-command help — intercepted BEFORE run() so mutating commands
diff --git a/claude/aqe-reference.md b/claude/aqe-reference.md
index 758b48d..f68b48c 100644
--- a/claude/aqe-reference.md
+++ b/claude/aqe-reference.md
@@ -46,7 +46,7 @@ called first**, e.g. `fleet_init({ topology:"hierarchical", maxAgents:15, memory
   (metered API key), or `ollama`/`onnx` (local). It normalizes `anthropic`→`claude` and ignores
   unknown values. `AQE_MAX_BUDGET_USD` (or `--max-budget-usd`) caps metered spend; `aqe health`
   shows an "LLM Billing" section saying who pays. `aqe init` never writes these — but
-  **`ak x provider pick` now manages `AQE_LLM_PROVIDER` for you** (into
+  **`ak host pick` now manages `AQE_LLM_PROVIDER` for you** (into
   `.claude/settings.local.json` `env`, reversibly), and can write an ordered **fallback chain**
   into `.agentic-qe/llm-config.json` from `kit.json` (`--aqe-fallback 'claude-code:claude-opus-5; openai:gpt-5.6'`) —
   keys stay in the env, never the file. aqe is NOT limited to claude-code: codex the *CLI* isn't a
diff --git a/claude/dual-mode-reference.md b/claude/dual-mode-reference.md
index 08ad73e..943a162 100644
--- a/claude/dual-mode-reference.md
+++ b/claude/dual-mode-reference.md
@@ -17,7 +17,7 @@ fallback.
 ### `ak dual run` — Claude+Codex collaboration pipelines
 
 `ak dual run <template> "<task>"` materializes a multi-worker pipeline from your
-per-activity routing policy (set via `ak x provider`) and runs it through the
+per-activity routing policy (set via `ak host`) and runs it through the
 `claude-flow-codex` adapter. Each worker is assigned a host + model by the policy, so a
 single run can span both vendors.
 
@@ -52,12 +52,12 @@ Register (or repair) both directions with `ak sync`; inspect with `ak status`.
 ### Per-activity routing + escalation ladders
 
 Routing is **per activity**, not per session — coder/tester lean Codex, reviewer and
-security-analysis lean Claude, and so on (`ak x provider` shows and edits the table).
+security-analysis lean Claude, and so on (`ak host` shows and edits the table).
 `--escalate` walks a **cross-vendor** ladder: a failed step retries on the other vendor's
 stronger model, so a Codex miss escalates into Claude (and vice-versa) rather than just
 burning retries on the same engine.
 
-**Which host leads.** The two are peers, but `ak x provider pick --primary-host claude|codex`
+**Which host leads.** The two are peers, but `ak host pick --primary-host claude|codex`
 (default `claude`) picks which one leads: codex-primary **mirrors** the default table so Codex
 takes the reasoning/review lead and Claude becomes the alternate/escalation target — the same
 ambidextrous experience with the roles flipped. `ak status` marks the primary and **fails**
diff --git a/claude/providers-reference.md b/claude/providers-reference.md
index e3de5cb..20fe0c2 100644
--- a/claude/providers-reference.md
+++ b/claude/providers-reference.md
@@ -19,13 +19,19 @@ agentic-qe to use one or both. Two independent axes:
   - **ruflo** — `anthropic` / `openai` / `google` / `ollama` via `ruflo providers configure`.
   - API keys live in the environment; they are never persisted to `kit.json`.
 
+During the alpha, `ak host` is the canonical namespace for execution-host lifecycle and
+selection; `ak x host` is its plumbing spelling. `ak provider` and `ak x provider` are deprecated
+compatibility aliases that warn on stderr and will be removed before stable. This does not rename
+inference providers or bindings into hosts; provider flags remain temporarily co-located on this
+workflow while dedicated capability-driven surfaces mature.
+
 **One or several — you're never forced to pick just one.** All three surfaces run multiple
 providers concurrently:
 - **ruflo hosts** — enable `claude` *and* `codex` together (dual-mode); ruflo runs both.
 - **ruflo LLM providers** — a list, with load-balancing + automatic failover.
 - **agentic-qe** — its `HybridRouter` **auto-enables every provider that has an API key in the
   env** and fails over across an ordered chain. `AQE_LLM_PROVIDER` only pins the *default* (the
-  primary) — the others stay enabled. So `ak x provider` sets aqe's primary; adding
+  primary) — the others stay enabled. So `ak host` sets aqe's primary; adding
   `OPENAI_API_KEY` / `GEMINI_API_KEY` to the env brings those online as fallbacks automatically.
 
 ### aqe fallback chain — managed from `kit.json`
@@ -34,7 +40,7 @@ For **deterministic** ordering (rather than relying on env auto-enable), `ak` wr
 `.agentic-qe/llm-config.json` from `kit.json`:
 
 ```bash
-ak x provider pick --aqe-provider claude-code \
+ak host pick --aqe-provider claude-code \
   --aqe-fallback 'claude-code:claude-opus-5; openai:gpt-5.6; gemini:gemini-3.5-flash'
 ```
 
@@ -43,16 +49,16 @@ priority; model IDs are examples current as of July 2026 — use what your provi
 ak writes a **complete** chain (aqe merges it shallowly, so partial chains would drop
 defaults), sets each provider `enabled`, and tags the file `_managedBy: agentic-kit`. **API keys
 are never written** — they stay in the env (aqe refuses to persist them anyway). `ak sync`
-reapplies the chain; `ak status` flags drift; `ak x provider off` restores the pre-ak file from
+reapplies the chain; `ak status` flags drift; `ak host off` restores the pre-ak file from
 its one-time `.bak` (or removes an ak-created file). Entries need populated models — aqe's router
 skips an entry with none. For lower-level edits, `aqe llm-router config` still works.
 
 ### Managing it (prompts-once, reversible)
 
 ```bash
-ak x provider status   # detected CLIs + versions, what's enabled, what's wired
-ak x provider pick     # choose ruflo hosts / aqe provider / ruflo API providers → persist → apply
-ak x provider off      # reset to claude-only default; strip managed env keys
+ak host status   # detected CLIs + versions, what's enabled, what's wired
+ak host pick     # choose ruflo hosts / aqe provider / ruflo API providers → persist → apply
+ak host off      # reset to claude-only default; strip managed env keys
 ```
 
 `pick` persists your choice to `kit.json` and applies it: it writes the ruflo backend flags
@@ -70,7 +76,7 @@ dual-mode reference block and `docs/PROVIDERS.md` §3.5 for the routing table an
 
 ### Install & update (install-method-aware)
 
-- **First install** — `ak setup` (and `ak x provider pick`) installs any *enabled* host that
+- **First install** — `ak setup` (and `ak host pick`) installs any *enabled* host that
   is entirely **absent**: `npm i -g @anthropic-ai/claude-code` / `@openai/codex`.
 - **Updates** — `ak sync` keeps **npm-managed** hosts current (drift is detected on the same
   cached TTL as ruflo/aqe, and surfaces in the bin nudge + `ak status`).
diff --git a/docs/LOCAL-MODEL-VALIDATION.md b/docs/LOCAL-MODEL-VALIDATION.md
index 73c60a8..d0395d0 100644
--- a/docs/LOCAL-MODEL-VALIDATION.md
+++ b/docs/LOCAL-MODEL-VALIDATION.md
@@ -11,6 +11,13 @@ specifications, not observed** — at research time (2026-07-27) the Ollama daem
 indexed transcripts on the reference machine were vendor-metered. This document is the experiment
 that replaces derivation with measurement.
 
+[ADR-0016](adr/0016-capability-driven-integration-adapters.md) names the relationship this
+exercise is intended to prove: `ollama-via-claude` and `ollama-via-codex` are two independent
+**bindings** to one Ollama **provider**, while Claude Code and Codex CLI remain the transcript
+**hosts**. The catalogue/runtime API is a separate **observability source**. Configuring a binding
+establishes configured provenance; it does not upgrade provider, model digest, token, cache, quota,
+or `$0` claims to observed. This document remains that evidence gate.
+
 **Time:** about 15 minutes of interactive work, plus two paste-backs.
 
 ---
diff --git a/docs/MANAGED-TOOLS.md b/docs/MANAGED-TOOLS.md
index 2bd3928..8c4fcca 100644
--- a/docs/MANAGED-TOOLS.md
+++ b/docs/MANAGED-TOOLS.md
@@ -5,6 +5,12 @@ version-detected, and displayed. This doc states the contract's four
 invariants, maps every managed tool onto them, and gives the checklist for
 adding a new tool without breaking them.
 
+The **host** rows here mean execution drivers such as Claude Code, Codex CLI, and OpenCode.
+Inference **providers** such as OpenRouter and Ollama are not install-owned hosts. Provider intent
+may use a **binding** and native configuration **projection**, while transcripts and catalogues
+remain separate **observability** evidence. The shared lifecycle and value-precise ownership
+design is Proposed in [ADR-0016](adr/0016-capability-driven-integration-adapters.md).
+
 Each invariant traces to a live failure it prevents — the appendix records
 them.
 
@@ -46,7 +52,7 @@ them.
 | --- | --- | --- | --- | --- | --- |
 | **ruflo** | npm `ruflo@latest` | `ak sync` | disk: global `package.json` | npm `view latest` (TTL-cached) | row ✓ / upstream's own `RuFlo V<x>` header ✓ / card + banner ✓ |
 | **agentic-qe** | npm `agentic-qe@latest` | `ak sync` | disk: global `package.json` (project-local fallback) | npm `view latest` (TTL-cached) | row ✓ / `Agentic QE V<x>` chip ✓ / card + banner ✓ |
-| **hosts** (claude, codex) | npm `@latest` — only when npm-managed | `ak sync` if npm-installed; **explicitly disowned** if brew/mise/native | disk: global `package.json`, else `--version` probe | npm latest for npm-managed only; external → `outdated:false` | row ✓ (version + method) / n/a / card + banner (npm-managed only) ✓ |
+| **hosts** (currently Claude/Codex; OpenCode is non-routable) | npm `@latest` — only when npm-managed | `ak sync` if npm-installed; **explicitly disowned** if brew/mise/native | disk: global `package.json`, else `--version` probe | npm latest for npm-managed only; external → `outdated:false` | row ✓ (version + method) / n/a / card + banner (npm-managed only) ✓ |
 | **agentdb** | npm, **pinned to ruflo's bundled version** — deliberately not latest | `ak sync` (repins on core skew) | disk: global `package.json` | ruflo's **bundled** copy (coherence), not npm latest — by design | row ✓ / n/a / card ✓; banner excluded (its authority isn't "latest") |
 | **ruvnet-brain** | npm `ruvnet-brain@latest` + `--version v<tag>` pin (never `github:` HEAD) | `ak sync`; the installer's own nightly self-updater is suppressed at install (`--no-nightly-prompt`) and disabled by sync if found (`ruvnet-brain-nightly` subsystem) | disk: KB `SOURCE.json → releaseTag`, falling back to ak's kit.json stamp for pre-stamping bundles | GitHub `releases/latest` tag (TTL-cached) | row ✓ / `V<tag>` chip ✓ / card + banner ✓ |
 | **kit (self)** | npm, **pinned to the exact version drift saw** (`@pacphi/agentic-kit@<v>`) | `ak sync` (runs last — npm replaces the running code) | disk: running copy's `package.json` | npm `latest` (+ `next` for prereleases, TTL-cached) | row ✓ / n/a / header version + card + banner ✓ |
diff --git a/docs/PROVIDERS.md b/docs/PROVIDERS.md
index 46e0240..18968db 100644
--- a/docs/PROVIDERS.md
+++ b/docs/PROVIDERS.md
@@ -12,6 +12,32 @@ There are two independent things you can point at a model:
 - **Providers** — which LLM the *routers* use: ruflo's provider router and agentic-qe's
   `HybridRouter`. Independent of the host; API keys always live in your environment.
 
+The full model has four separate axes:
+
+| Axis | Meaning | Examples |
+|---|---|---|
+| **Host** | Agent CLI/environment executing work | Claude Code, Codex CLI, OpenCode |
+| **Provider** | Inference service, gateway, or local runtime | Anthropic, OpenAI, OpenRouter, Ollama |
+| **Projection** | Native configuration surface receiving intent | Claude settings, Codex TOML, OpenCode JSON, ruflo/AQE routers |
+| **Observability** | Evidence source establishing facts | host JSONL, OpenRouter metadata, quota channels, Ollama catalogue |
+
+A **binding** connects a host to a provider through a projection and transport. One Ollama
+provider can therefore have independent `ollama-via-claude` and `ollama-via-codex` bindings.
+OpenRouter is a provider behind a host, never automatically a third host. OpenCode may support
+managed lifecycle surfaces while remaining ineligible as a primary or per-activity routing host.
+This Proposed capability model is
+[ADR-0016](adr/0016-capability-driven-integration-adapters.md); current controls below remain
+backward compatible while its implementation proceeds.
+
+> [!IMPORTANT]
+> During the alpha, `ak host` is the canonical namespace for execution-host lifecycle and
+> selection: `status`, `pick`, `refresh`, and `off`; `ak x host` is its plumbing spelling.
+> `ak provider` and `ak x provider` remain only as deprecated compatibility aliases, warn on
+> stderr, and will be removed before the stable release. This is **not** a wholesale
+> rename of inference-provider management: providers and bindings remain separate axes. Some
+> router-provider flags are temporarily co-located on the host configuration workflow while their
+> dedicated capability-driven surfaces mature.
+
 ---
 
 ## Level 0 — do nothing (the point)
@@ -29,7 +55,7 @@ If you happen to have `codex` installed, `ak` notices and *offers* — it never
 for you:
 
 ```text
-ℹ codex CLI detected — run `ak x provider pick` to let ruflo use both claude and codex
+ℹ codex CLI detected — run `ak host pick` to let ruflo use both claude and codex
 ```
 
 ## Two configs, one front door
@@ -59,10 +85,10 @@ use). Level 4 below is the full `ak`-way ↔ raw-tool-way map for every knob in
 > [!NOTE]
 > Already have an older `ak` installed and want a capability that shipped later (like
 > dual-host)? Updating the binary and enabling the feature are two separate motions —
-> see [UPGRADING.md](UPGRADING.md) for the `sync` vs `provider pick` distinction.
+> see [UPGRADING.md](UPGRADING.md) for the `sync` vs `host pick` distinction.
 
 ```bash
-ak x provider pick
+ak host pick
 ```
 
 An interactive picker (or flags for scripts). Enable `codex` and `ak`:
@@ -78,7 +104,7 @@ An interactive picker (or flags for scripts). Enable `codex` and `ak`:
 > machine-wide user settings. Outside any repo, user scope is used and said so.
 
 ```bash
-ak x provider pick --host claude,codex --yes     # non-interactive
+ak host pick --host claude,codex --yes     # non-interactive
 ```
 
 Or enable codex during **first-time setup**, in one shot — same gated/prompted/external-safe
@@ -104,7 +130,7 @@ lives on the **host axis** (Level 1, which CLI runs the loop) — not as an aqe
 paths are reached by enabling those *hosts*, while the provider list is API-metered.
 
 ```bash
-ak x provider pick --aqe-provider claude-code    # run QE on your subscription, no API bill
+ak host pick --aqe-provider claude-code    # run QE on your subscription, no API bill
 ```
 
 `ak` writes `AQE_LLM_PROVIDER` for you. Add `OPENAI_API_KEY` to your env and agentic-qe's
@@ -116,7 +142,7 @@ When you want explicit ordering rather than env auto-enable, `ak` manages agenti
 `.agentic-qe/llm-config.json` from `kit.json`:
 
 ```bash
-ak x provider pick \
+ak host pick \
   --aqe-provider claude-code \
   --aqe-fallback 'claude-code:claude-opus-5; openai:gpt-5.6; gemini:gemini-3.5-flash'
 ```
@@ -133,7 +159,7 @@ writes your API keys.
 provider — add them to the chain and put `OPENROUTER_API_KEY` in your env:
 
 ```bash
-ak x provider pick \
+ak host pick \
   --aqe-provider claude-code \
   --aqe-fallback 'claude-code:claude-opus-5; openrouter:z-ai/glm-5.2'
 ```
@@ -149,14 +175,14 @@ When **both** hosts are enabled and `agentic-qe ≥ 3.13.1` is installed, `ak` s
 **per-activity routing policy**: each kind of work (architecture, implementation, testing,
 review, …) is routed to the host and model that suits it — Claude for reasoning/review,
 Codex for execution — and materialized into `.agentic-qe/llm-config.json` (`agentOverrides`).
-It's seeded automatically on `ak x provider pick` / `ak setup`; nothing happens for
+It's seeded automatically on `ak host pick` / `ak setup`; nothing happens for
 claude-only projects.
 
 ```bash
-ak x provider pick --host claude,codex        # enables both → seeds routing → prints the table
+ak host pick --host claude,codex        # enables both → seeds routing → prints the table
 ak status                                     # a "routing" row; the dashboard shows the matrix
-ak x provider pick --route 'testing:claude:claude-sonnet-5'   # override one activity (persisted)
-ak x provider pick --primary-host codex       # make codex the lead; claude becomes the alternate
+ak host pick --route 'testing:claude:claude-sonnet-5'   # override one activity (persisted)
+ak host pick --primary-host codex       # make codex the lead; claude becomes the alternate
 ```
 
 **Which host leads.** `--primary-host claude|codex` (default `claude`) chooses the primary.
@@ -205,8 +231,13 @@ Defaults (all overridable; your edits are marked `custom` and never re-seeded):
 > frontier domains. Rule of thumb: `claude-opus-5` is the premium default;
 > `claude-fable-5` is the escalation ceiling.
 
-`ak x provider pick --help` prints this list too. Tuning is per-route and reversible: hand-edit
-`kit.json` `providers.dualRouting`, pass `--route`, or `ak x provider off` to clear it entirely.
+`ak host pick --help` prints this list too. Tuning is per-route and reversible: hand-edit
+`kit.json` `providers.dualRouting`, pass `--route`, or `ak host off` to clear it entirely.
+
+`dualRouting` intentionally names a host and model, not an inference provider. Provider resolution
+is a separate binding lookup; absent grounded evidence remains unknown or explicitly inferred.
+Likewise, `ak dual run` continues to mean the Claude+Codex collaboration substrate. Multiple
+providers behind those hosts do not turn it into three-host-or-more orchestration.
 
 ## Level 4 — drop down to raw ruflo / agentic-qe
 
@@ -220,7 +251,7 @@ The two config stores each knob below lives in — and their precedence — are
 
 | You want to…                         | `ak` way                          | The raw ruflo/aqe way it maps to                    |
 | ------------------------------------ | --------------------------------- | --------------------------------------------------- |
-| Enable claude/codex hosts            | `ak x provider pick`              | `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` env + `ruflo init --dual` |
+| Enable claude/codex hosts            | `ak host pick`              | `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` env + `ruflo init --dual` |
 | Register a ruflo LLM provider        | `--provider openai:gpt-5.6`       | `ruflo providers configure -p openai -m gpt-5.6`    |
 | Set which LLM runs QE                | `--aqe-provider gemini`           | `AQE_LLM_PROVIDER=gemini` (env)                     |
 | Order QE's fallback chain            | `--aqe-fallback '…'`              | edit `.agentic-qe/llm-config.json` / `aqe llm-router config` |
@@ -233,7 +264,7 @@ If you hand-edit `.agentic-qe/llm-config.json` yourself and *don't* use `ak`'s
 ## Undo, always
 
 ```bash
-ak x provider off     # reset to the claude-only default, reversibly
+ak host off     # reset to the claude-only default, reversibly
 ```
 
 Strips the managed env keys (leaving your other settings), and restores your pre-`ak`
@@ -252,5 +283,7 @@ just makes the good default automatic and the customization reversible.
   grounded in ruflo's own dual-mode templates.
 - Primary-host selection and ambidextrous mirroring:
   [ADR-0006](adr/0006-primary-host-and-ambidextrous-mirroring.md).
+- Capability-driven integration axes, bindings, and provenance:
+  [ADR-0016](adr/0016-capability-driven-integration-adapters.md).
 - Host env flags (`ENABLE_CLAUDE_CODE` / `ENABLE_CODEX`): upstream ruflo
   ADR-034, "Optional MCP Backends".
diff --git a/docs/TRANSCRIPTS.md b/docs/TRANSCRIPTS.md
index 20826ab..bfe325d 100644
--- a/docs/TRANSCRIPTS.md
+++ b/docs/TRANSCRIPTS.md
@@ -30,18 +30,24 @@ verified against the current source by the test suite
 
 ## 1. The two transcript stores
 
-Both providers write complete session logs to disk as JSONL — one JSON object
+Both supported transcript **hosts** write complete session logs to disk as JSONL — one JSON object
 per line — and the kit reads them **read-only** (transcripts are never
 rewritten; rule 3 of the module header, `usage-index.mjs:22-29`):
 
-| Provider | Store | Discovered by |
+| Host | Store | Discovered by |
 |---|---|---|
-| Claude Code | `~/.claude/projects/<encoded-project-dir>/<sessionId>.jsonl` | `listClaude` (`usage-index.mjs:648`) — exactly one level of project directories |
+| Claude Code | `~/.claude/projects/<encoded-project-dir>/<sessionId>.jsonl` | `listClaude` (`usage-index.mjs:684`) — exactly one level of project directories |
 | Codex CLI | `~/.codex/sessions/<yyyy>/<mm>/<dd>/rollout-<ts>-<uuid>.jsonl` | `listCodex` (`usage-index.mjs:663`) — the `yyyy/mm/dd` tree walk |
 
-Roots come from `defaultRoots()` (`usage-index.mjs:640`) and are injectable
+Roots come from `defaultRoots()` (`usage-index.mjs:676`) and are injectable
 for tests. A malformed line is skipped, never fatal (`jsonLines`,
-`usage-index.mjs:292` — one corrupt line must not cost a whole file).
+`usage-index.mjs:315` — one corrupt line must not cost a whole file).
+
+Host evidence is not inference-provider proof. A Claude transcript may describe Anthropic-,
+OpenRouter-, or Ollama-served inference. ADR-0016 defines separate
+[bindings and field provenance](adr/0016-capability-driven-integration-adapters.md). Until that
+Proposed migration is implemented, the legacy session field named `provider` should be read as the
+transcript host/parser identity unless other evidence grounds the inference provider.
 
 ### 1.1 Claude entry vocabulary
 
@@ -59,7 +65,7 @@ An assistant entry with `isApiErrorMessage: true` is a **local placeholder**
 Claude Code writes when a request dies before a real completion (connection
 drop, rate limit, auth failure — `model: "<synthetic>"`, all-zero usage). It
 is real engaged time but not a model attempt: counted as an *exception*, never
-pushed into `models` or priced (`usage-index.mjs:469-478`; the full story is
+pushed into `models` or priced (`usage-index.mjs:498-517`; the full story is
 [`USAGE-SCORECARD-METRICS.md`](USAGE-SCORECARD-METRICS.md) §10).
 
 ### 1.2 Codex entry vocabulary
@@ -111,7 +117,7 @@ recorded in `USAGE-SCORECARD-METRICS.md` Appendix A).
 |---|---|---|
 | `role` | all | `"user"` or `"assistant"` — the **Messages-API role**, not the author (see below) |
 | `at` | all | ISO timestamp |
-| `text` | all | Flattened display text (`claudeText`, `usage-index.mjs:348` — binary payloads dropped: a pasted screenshot renders as `[image]`, a tool result is prefixed `[tool result]`) |
+| `text` | all | Flattened display text (`claudeText`, `usage-index.mjs:384` — binary payloads dropped: a pasted screenshot renders as `[image]`, a tool result is prefixed `[tool result]`) |
 | `model` | assistant | The model id; the literal string `exception` for an API-error placeholder turn (`usage-index.mjs:473`) |
 | `tools` | assistant | Tool names invoked in the turn |
 | `prompt` | user | `isHumanPrompt`'s verdict (`usage-index.mjs:388-397`) — drives the **prompt counts** |
@@ -135,7 +141,7 @@ story is [Appendix A](#appendix-a--fix-history).)
 
 ### 3.2 `kind` — the attribution field
 
-`userTurnKind` (`usage-index.mjs:415-426`) classifies every user-role turn:
+`userTurnKind` (`usage-index.mjs:451-455`) classifies every user-role turn:
 
 | `kind` | Test | Meaning |
 |---|---|---|
@@ -169,15 +175,15 @@ and image-only pastes get the right kind" (the two edges).
 
 ## 4. The `readSession` pipeline — how one session becomes a payload
 
-`readSession(id, opts)` (`usage-index.mjs:1173-1256`) is the only way
+`readSession(id, opts)` (`usage-index.mjs:1271-1359`) is the only way
 transcript content leaves the module, and every step is a gate:
 
 ### 4.1 Locate, contain, bound
 
 1. **Id grammar before any filesystem access** — `VALID_ID`
    (`/^[A-Za-z0-9._-]{1,128}$/`, `usage-index.mjs:71`) rejects traversal
-   shapes with `ERR_INVALID_SESSION_ID` (`usage-index.mjs:1184`).
-2. **Locate by id** across both roots (`locate`, `usage-index.mjs:1191`),
+   shapes with `ERR_INVALID_SESSION_ID` (`usage-index.mjs:1215`).
+2. **Locate by id** across both roots (`locate`, `usage-index.mjs:1222`),
    consulting the scan cache when present but never requiring it —
    `readSession` works with no prior `buildIndex`.
 3. **Realpath containment** (`usage-index.mjs:1180-1194`) — the resolved file
@@ -192,8 +198,8 @@ transcript content leaves the module, and every step is a gate:
 ### 4.2 Parse and price
 
 The file is parsed with `withTurns: true` by the provider's parser
-(`usage-index.mjs:1217-1223`), and `meta` is assembled
-(`usage-index.mjs:1219-1238`) with the same fields the Sessions view rows
+(`usage-index.mjs:1298-1303`), and `meta` is assembled
+(`usage-index.mjs:1305-1330`) with the same fields the Sessions view rows
 carry — `prompts`, `responses`, `exceptions`, `sidechain`, `threadSource`,
 `models`, `tools`, `skill`/`plugin`, worktree — plus a `cost` priced from the
 same per-model usage rows `aggregate()` uses (the header used to render a
@@ -205,7 +211,7 @@ Every turn body is passed through `maskSecrets` (`usage-index.mjs:184` — the
 23 secret shapes) **server-side, before
 serialization**, then length-capped at `MAX_TURN_CHARS` (40,000,
 `usage-index.mjs:65`) with the marker appended
-(`usage-index.mjs:1308-1315`). Two invariants:
+(`usage-index.mjs:1339-1348`). Two invariants:
 
 - **Presence is the signal.** `truncated`/`originalChars` are emitted only
   when the slice fired, so a complete turn cannot be misread as abridged.
@@ -330,7 +336,7 @@ Deep links: `#usage/<sessionId>` opens the Transcript view directly
 | Delegation markers | `isSidechain` → `sidechain` flag | `thread_source: "subagent"` → excluded from aggregation, session kept visible |
 | Session title | model-written `ai-title`, first-prompt fallback | first prompt clipped |
 
-**Planned third provider:** OpenRouter-served sessions are invisible to the
+**Planned provider attribution:** OpenRouter-served sessions are invisible to the
 scorecard today; ingesting them (discovery → parser → `kind` attribution →
 pricing → by-host UI) is tracked as
 [#59](https://github.com/pacphi/agentic-kit/issues/59).
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index c43de72..bffd5ff 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -30,6 +30,7 @@ ak sync             # apply it
 | `ruflo memory store` says OK but reads return nothing | Absolute-DB-path pin missing, or WAL not checkpointed, or the WASM fallback above | `ak setup` in the project re-pins + verifies a real write lands on disk |
 | `status` shows a `memory-pin` warning | `CLAUDE_FLOW_DB_PATH` is pinned to a dead or foreign path, so every memory op targets the wrong DB ("Database not initialized" beside a healthy in-repo DB). The pin may be deliberate, so `sync` never touches it | repoint (or remove) the pin in `.claude/settings.local.json` `env` |
 | `ak dual run` refuses to start ("ruflo's memory runtime lacks a native better-sqlite3 binding AND … active native WAL") | Pre-flight guard: the orchestrator's native WAL writer and the WASM `ruflo memory store` would share one DB and corrupt it. It refuses **before** spawning a worker rather than crashing mid-run | `ak sync` builds the native binding for ruflo's memory runtime, then retry the `dual run` |
+| `ak provider` or `ak x provider` prints a deprecation warning | Alpha namespace correction: execution-host lifecycle and selection now belong to `host`; inference providers and bindings remain separate concepts | Use `ak host` (or `ak x host` for plumbing). The provider aliases will be removed before stable |
 | Suspicious token burn | Background automation vs interactive usage | ask Claude to run the **ruflo-token-audit** skill (deployed by `setup`) |
 | Live dashboard is empty or has no ruflo/AQE nodes | Live tails new Claude/Codex records by default; existing files start at EOF, while ruflo/AQE stores are not auto-discovered | open Live before producing activity; register a trusted JSONL file with repeatable `--live-source 'surface=path'`; see [Live Sessions](LIVE-SESSIONS.md) |
 | `status` shows `ruvnet-brain … not installed` | The RuvNet Brain (offline KB + `search_ruvnet` MCP) isn't on disk | `ak sync` (or `ak setup`) runs the installer; `npx ruvnet-brain --doctor` health-checks it |
diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md
index ddce915..c6db935 100644
--- a/docs/UPGRADING.md
+++ b/docs/UPGRADING.md
@@ -17,17 +17,29 @@ So a feature can be *installed* (the code is on disk) without being *enabled* (y
 that's what you recorded — the same way it won't pick an LLM provider or exclude an MCP
 family on your behalf.
 
-## `sync` vs `setup` vs `provider pick`
+## `sync` vs `setup` vs `host pick`
 
 | Command              | What it's for                                   | Changes your `kit.json` choices? |
 | -------------------- | ----------------------------------------------- | -------------------------------- |
 | `ak sync`            | update the binary + heal to your recorded state | **no** — converges, never decides |
-| `ak x provider pick` | opt into / retune hosts & LLM providers         | **yes** — this is the switch     |
+| `ak host pick` | opt into or retune execution hosts and host routing | **yes** — this is the switch |
 | `ak x statusline codex native\|extended` | opt into a user-wide Codex status-line preset | **yes** — records the preset |
 | `ak setup`           | first-time bootstrap of absent tooling          | only via explicit flags (`--codex`, `--primary-host`) |
 
+A **host** runs the work; a **provider** serves inference. A binding can connect one provider to
+several hosts through separate native configuration **projections**, while **observability**
+sources establish facts with observed, configured, inferred, or unknown provenance. Upgrading does
+not silently create, adopt, or rewrite these bindings, and credentials remain environment-only.
+See [ADR-0016](adr/0016-capability-driven-integration-adapters.md).
+
+`ak provider` and `ak x provider` are deprecated alpha compatibility aliases for the former
+combined command. They warn on stderr and will be removed before stable. Use top-level `ak host`
+for execution-host lifecycle and selection (`ak x host` only when you specifically want the
+plumbing spelling). This namespace correction does not rename inference providers or provider
+bindings into hosts.
+
 If you already have `ak` working, you almost never need `ak setup` again — it's the
-installer. Enabling a shipped-but-opt-in feature is a `provider pick` (or an `x mcp pick`,
+installer. Enabling a shipped-but-opt-in host feature is a `host pick` (or an `x mcp pick`,
 etc.), not a re-`setup`.
 
 Codex status-line management is deliberately not enabled merely because an
@@ -43,8 +55,8 @@ ambidextrous dual-host experience (per-activity routing across Claude + Codex).
 
 ```bash
 ak sync                              # 1. update the binary (+ heal everything)
-ak x provider pick --host claude,codex   # 2. opt in → wires dual-host
-ak x provider status                 # 3. verify: hosts "enabled, wired" + routing table
+ak host pick --host claude,codex   # 2. opt in → wires dual-host
+ak host status                 # 3. verify: hosts "enabled, wired" + routing table
 ```
 
 Step 1 gets the newer code onto disk. Step 2 is what actually turns dual-host on — it
@@ -55,11 +67,11 @@ Add `--primary-host codex` if you want Codex to lead (Claude becomes the alterna
 
 > [!NOTE]
 > `ak sync` self-updates **last** in its pass, so the newer code applies from your *next*
-> `ak` invocation — which is exactly `ak x provider pick` in the sequence above. Running the
+> `ak` invocation — which is exactly `ak host pick` in the sequence above. Running the
 > two in this order is correct; the pick runs under the freshly-installed version.
 
 From then on, `ak sync` **maintains** the choice — it re-applies your recorded dual-host
-config idempotently on every run. `ak status` flags drift; `ak x provider off` reverts to
+config idempotently on every run. `ak status` flags drift; `ak host off` reverts to
 the claude-only default, reversibly.
 
 The full menu of host/provider levels — QE provider selection, deterministic fallback
diff --git a/docs/USAGE-SCORECARD-METRICS.md b/docs/USAGE-SCORECARD-METRICS.md
index 0c0809e..99f0210 100644
--- a/docs/USAGE-SCORECARD-METRICS.md
+++ b/docs/USAGE-SCORECARD-METRICS.md
@@ -59,7 +59,7 @@ Two transcript stores, read-only, parsed at most once per file (cache keyed by
 `(path, mtime, size)`; `SCHEMA_VERSION` invalidates the whole cache on a
 schema change — `src/lib/usage-index.mjs:51`):
 
-| Provider | Store | Format |
+| Transcript host | Store | Format |
 |---|---|---|
 | Claude Code | `~/.claude/projects/<project>/<sessionId>.jsonl` | one JSON object per line: `user`/`assistant` turns, each assistant turn carrying its own `usage` object |
 | Codex CLI | `~/.codex/sessions/<yyyy>/<mm>/<dd>/rollout-<ts>-<sessionId>.jsonl` | one JSON object per line: `session_meta`, `turn_context`, and `event_msg` records, the latter carrying **cumulative** `token_count` snapshots, not per-turn deltas |
@@ -72,6 +72,14 @@ Nothing in this pipeline calls a provider API or a billing endpoint; **no
 metric on this tab is ever a copy of an actual invoice.** That is the whole
 reason every dollar figure is labelled "API-equivalent."
 
+The current persisted field named `provider` identifies which host transcript parser produced a
+session row; it is not sufficient evidence of the inference provider. The Proposed model in
+[ADR-0016](adr/0016-capability-driven-integration-adapters.md) separates host, provider,
+projection, observability source, and binding, with provenance attached per field. Until that
+migration and issue #59's OpenRouter ingestion land, the Scorecard must not invent an OpenRouter
+host, infer provider identity from a Claude/Codex transcript alone, or turn unknown billing into
+subscription, metered, local, or `$0`.
+
 ---
 
 ## 2. Sessions & Responses
@@ -89,12 +97,12 @@ responses = Σ over included sessions of session.responses
 **Source:**
 
 - Filter: a parsed record with zero assistant turns is dropped entirely — "no
-  assistant turn → not a session" (`usage-index.mjs:856`) — and a record whose
+  assistant turn → not a session" (`usage-index.mjs:877`) — and a record whose
   last activity falls outside the requested window is dropped too
-  (`usage-index.mjs:857`).
+  (`usage-index.mjs:878`).
 - `responses` accumulation: Claude increments per assistant message
-  (`usage-index.mjs:472`); Codex increments per `agent_message` event
-  (`usage-index.mjs:610`).
+  (`usage-index.mjs:493`); Codex increments per `agent_message` event
+  (`usage-index.mjs:631`).
 - Totals: `totals.responses += s.responses` per included session
   (`usage-index.mjs:884`).
 - Render: `kpi("sessions", fmtNum(t.sessions), fmtNum(t.responses)+" assistant
@@ -258,7 +266,7 @@ tokens = input + output + cacheRead + cacheWrite   (summed across all rows in wi
 **Source:** `t.tokens` from `totals`, accumulated per row at
 `usage-index.mjs:824` (`rowTokens = row.input + row.output + row.cacheRead +
 row.cacheWrite`) and rolled into `totals.tokens` via `addTo`
-(`usage-index.mjs:779`). Rendered with `fmtTok()`
+(`usage-index.mjs:843-852`). Rendered with `fmtTok()`
 (`dashboard/client.mjs`): `≥1e9` → `"X.XB"`, `≥1e6` → `"X.XM"`,
 `≥1e3` → `"X.XK"`, else the rounded integer.
 
@@ -270,9 +278,9 @@ numbers as percentages of `t.tokens` (`dashboard/client.mjs`,
 **What "input" excludes.** For both providers, the `input` counter recorded
 per row is **gross input minus cached input** — Claude's parser reads
 `cache_read_input_tokens` and `cache_creation_input_tokens` as separate fields
-the provider already reports separately (`usage-index.mjs:502-503`); Codex's
+the provider already reports separately (`usage-index.mjs:523-524`); Codex's
 parser subtracts `cached_input_tokens` from `input_tokens` explicitly
-(`usage-index.mjs:625-629`, `input: Math.max(0, gross - cacheRead)`) because
+(`usage-index.mjs:645-655`, `input: Math.max(0, gross - cacheRead)`) because
 Codex's own `input_tokens` field **includes** cached tokens and would
 double-count them against the separately-reported `cacheRead` figure if left
 as-is. This is asserted by test:
@@ -366,10 +374,10 @@ session data, and each needs its own fix:
   sorts intervals and merges any two that overlap **or exactly touch**
   (`s <= curEnd`, `usage-index.mjs:105`), returning total covered seconds
   rounded to the nearest second.
-- `activeIntervals()` (`usage-index.mjs:316-328`) — splits one session's
+- `activeIntervals()` (`usage-index.mjs:352-363`) — splits one session's
   sorted timestamp list into sub-intervals wherever a gap exceeds
   `IDLE_GAP_MS`; "a run of one timestamp yields a zero-length interval and so
-  contributes nothing" (comment, `usage-index.mjs:314`).
+  contributes nothing" (comment, `usage-index.mjs:346-350`).
 - Aggregation: `totals.engagedSeconds = mergeIntervals(sessions.flatMap(s =>
   s._active))` (`usage-index.mjs:927`); `totals.spanUnionSeconds =
   mergeIntervals(sessions.map(s => s._span))` (`usage-index.mjs:926`);
@@ -423,7 +431,7 @@ byDay[day].cost = Σ costOf(row) for every usage row whose day == that key
 
 **Source:** the day key is the row's own `row.day`, computed once at parse
 time as **local calendar day**, not UTC
-(`usage-index.mjs:496`/`usage-index.mjs:625` call `localDay(at)`) — so a
+(`usage-index.mjs:520`/`usage-index.mjs:649` call `localDay(at)`) — so a
 session that runs from 23:58 local to 00:05 local is billed to the day its
 *first* row landed on (test:
 `tests/kit/usage-index.test.mjs:634`, "a session that opens before midnight
@@ -449,8 +457,8 @@ renders "no sessions in window" instead of zeroed figures
 (`dashboard/client.mjs`).
 
 **Formula:** identical aggregation to every other bucket
-(`byProvider[s.provider]`, populated via `addTo()`, `usage-index.mjs:775-784`,
-called once per session at `usage-index.mjs:890`), keyed by the literal string
+(`byProvider[s.provider]`, populated via `addTo()`, `usage-index.mjs:843-852`,
+  called once per session at `usage-index.mjs:966`), keyed by the literal string
 `"claude"` or `"codex"` assigned at parse time
 (`blankSession(id, 'claude')` / `blankSession(id, 'codex')`,
 `usage-index.mjs:291-301`, `parseClaude`/`parseCodex` entry points).
@@ -466,12 +474,13 @@ aggregation — never a defect in the aggregation itself, since both hosts
 share it. [Appendix A](#appendix-a--fix-history) documents two real defects
 of exactly that kind, both in `parseCodex`.
 
-**What this does not model:** the by-host cards do not distinguish a session
-that used both providers (not currently possible in this data model — a
-session record has exactly one `provider`) from one that used only one; a
+**What this does not model:** the by-host cards do not yet carry a separate
+inference-provider dimension. The legacy session record has exactly one `provider`
+field, currently used as host/parser identity. A
 workflow that hands off between Claude and Codex mid-task (e.g. `ak dual
 run`) produces two separate session records, one per host, each correctly
-priced on its own, rather than one blended record.
+aggregated under the current transcript-host schedule rather than one blended record. That
+API-equivalent estimate is not proof of the provider that actually served either execution.
 
 ---
 
@@ -488,9 +497,9 @@ punchcard[dow + "-" + hour] += 1   per assistant/agent_message response, at its
 ```
 
 **Source:** incremented once per Claude assistant turn
-(`usage-index.mjs:472-474`, keyed by `punchKey(at)`) and once per Codex
-`agent_message` (`usage-index.mjs:610-612`), merged into the window-level
-`punchcard` object per session (`usage-index.mjs:905`). Cell intensity is
+(`usage-index.mjs:493-496`, keyed by `punchKey(at)`) and once per Codex
+`agent_message` (`usage-index.mjs:630-634`), merged into the window-level
+`punchcard` object per session (`usage-index.mjs:981`). Cell intensity is
 linear against the single busiest cell in the window:
 `v = pcMax ? n/pcMax : 0` (`dashboard/client.mjs`) — this is a
 **relative**, not absolute, scale, so the heatmap's brightest cell is always
@@ -562,7 +571,7 @@ time, someone was genuinely waiting on it — but it is never pushed into
 create a `byModel` row of any kind. It increments a separate
 `rec.exceptions` counter instead (`usage-index.mjs:470`), rolled up into
 `totals.exceptions` (`usage-index.mjs:873-884`) and surfaced per-session
-(`usage-index.mjs:844`, alongside the existing `sidechain`/`threadSource`
+(`usage-index.mjs:920-934`, alongside the existing `sidechain`/`threadSource`
 flags — inspectable in the Sessions tab, never hidden). When
 `totals.exceptions > 0`, the panel header shows a small `"· N
 dropped/errored turns excluded"` note (`dashboard/client.mjs`);
@@ -846,7 +855,7 @@ both credential-free for ak:
 `windowDurationMins: 10080` (the weekly). Windows are therefore keyed and
 labelled by duration (`windowLabel`, `quota.mjs:44`), never by slot name. The
 same rule applies to the historical snapshots parsed out of rollouts: the
-normalizer at `usage-index.mjs:574` keeps a flat `windows` list keyed by
+normalizer at `usage-index.mjs:591-615` keeps a flat `windows` list keyed by
 `window_minutes`.
 
 **Freshness is part of the number.** Both sides carry `fetchedAt`; the view
@@ -871,13 +880,13 @@ Codex ≥0.140 maintains its own SQLite thread ledger (`~/.codex/state_N.sqlite`
 — the `N` is a migration generation, so `codexStateDb` (`codex-state.mjs:30`)
 globs and takes the newest). `readCodexState` (`:49`) reads per-thread
 `thread_source` (`user` vs `subagent`) plus `thread_spawn_edges`, and
-`applyCodexLedger` (`usage-index.mjs:1149`) overlays that onto parsed
+`applyCodexLedger` (`usage-index.mjs:1179`) overlays that onto parsed
 sessions: a ledger-identified subagent has its token usage stripped — its
 rollout replays the parent's entire token history (ccusage/ccusage#950
 measured up to 91× inflation) — while the session record stays visible. The
 rollout's own `session_meta.thread_source` sniff remains as the fallback when
 the ledger is absent or migrated beyond recognition. Codex sessions also carry
-`reasoningOutput` (`usage-index.mjs:638`) — reasoning tokens are a **subset**
+`reasoningOutput` (`usage-index.mjs:656-659`) — reasoning tokens are a **subset**
 of output tokens and are annotation only, never added to any sum.
 
 ## 14. Known limitations, restated as a single checklist
@@ -929,7 +938,7 @@ directly from each usage row's `responses` field (`usage-index.mjs:829`,
 Play" list displayed `0 resp` regardless of real token/cost volume or actual
 `agent_message` count. **Fix:** `parseCodex` now passes `responses:
 rec.responses` (the session's own tallied response count,
-`usage-index.mjs:595`) on its `addUsage()` call.
+`usage-index.mjs:654`) on its `addUsage()` call.
 
 #### Bug B — subagent thread-replay could double-bill tokens
 
@@ -949,7 +958,7 @@ at face value (correctly avoiding the separate naive-summing bug **[C5]**
 documents, since it already used last-event-only logic — see §4's worked
 example) but performed **no de-duplication** against a parent session a
 subagent file might be replaying. **Fix:** the parser now reads
-`session_meta.thread_source` (`usage-index.mjs:542`, confirmed as a real
+`session_meta.thread_source` (`usage-index.mjs:575-579`, confirmed as a real
 Codex rollout field by **[C7]**) and skips the `addUsage()` call entirely
 when its value is `'subagent'` (`usage-index.mjs:609`, guard condition
 `rec.threadSource !== 'subagent'`). The session record itself is **not**
diff --git a/docs/adr/0016-capability-driven-integration-adapters.md b/docs/adr/0016-capability-driven-integration-adapters.md
new file mode 100644
index 0000000..0a86802
--- /dev/null
+++ b/docs/adr/0016-capability-driven-integration-adapters.md
@@ -0,0 +1,423 @@
+# ADR-0016 — Capability-driven host, provider, binding, projection, and observability adapters
+
+- **Status:** Proposed
+- **Date:** 2026-07-28
+- **Deciders:** agentic-kit maintainers
+- **Related:** [ADR-0001](0001-one-routing-policy-many-projections.md),
+  [ADR-0003](0003-auto-seed-dual-host-provenance.md),
+  [ADR-0006](0006-primary-host-and-ambidextrous-mirroring.md),
+  [ADR-0008](0008-guidance-target-scope-split.md),
+  [ADR-0009](0009-usage-scorecard-local-transcript-analytics.md),
+  [ADR-0010](0010-provider-mediated-quota-reads.md),
+  [ADR-0011](0011-local-model-provenance-zero-cost-and-transcript-fidelity.md),
+  [ADR-0012](0012-live-sessions-observability.md),
+  [ADR-0015](0015-managed-codex-native-statusline.md),
+  [issue #59](https://github.com/pacphi/agentic-kit/issues/59),
+  [issue #71](https://github.com/pacphi/agentic-kit/issues/71)
+
+## Context
+
+Agentic-kit currently describes related integration behavior in several adjacent structures:
+`HOST_ADAPTERS` in `hosts.mjs`; `HOSTS`, `API_PROVIDERS`, provider credentials, and AQE provider
+types in `providers.mjs`; routable hosts and constructible providers in `routing.mjs`; and further
+host/provider lists in setup, sync, status, verify, uninstall, transcripts, Live, usage, and the
+dashboard. The lists serve different purposes and can legitimately contain different members, but
+their similar names make drift and category errors likely.
+
+The categories are not interchangeable:
+
+- Claude Code, Codex CLI, and OpenCode are execution hosts.
+- Anthropic, OpenAI, OpenRouter, Ollama, Gemini, Bedrock, and Azure OpenAI are inference
+  providers or endpoints.
+- Claude settings, Codex TOML, OpenCode JSON, the ruflo router, and the agentic-qe router are
+  configuration projections.
+- Host transcripts, vendor response metadata, quota channels, and the Ollama catalogue are
+  observability sources.
+
+A Claude transcript proves that Claude was the host. It does not by itself prove that Anthropic
+served the model. An Ollama model may be reached through both `ollama launch claude` and
+`ollama launch codex`; those are two host bindings to one provider, not two providers. OpenRouter
+may serve a model used by an existing host without becoming a third host. OpenCode may support
+install, configuration, MCP, guidance, transcripts, and teardown while remaining ineligible as a
+primary host or activity-routing target.
+
+Adding integrations by extending every incidental list would permit invalid routing choices,
+partial lifecycle support, destructive ownership assumptions, and fabricated provider, billing,
+quota, cache, or pricing claims. It would also make issue #59's OpenRouter attribution depend on an
+incorrect “transcript provider equals inference provider” assumption.
+
+Agentic-kit remains a plain-ESM, zero-runtime-dependency CLI. Its normal operation is offline-first.
+The design must therefore be a closed, validated registry of built-in code, not an arbitrary
+third-party plugin runtime.
+
+## Decision
+
+### 1. Keep four adapter axes and one relationship type
+
+Agentic-kit defines separate, validated built-in registries:
+
+1. **Host adapters** describe execution drivers and their native surfaces.
+2. **Provider adapters** describe inference, transport, credentials, billing, and evidence
+   capabilities independently of a host.
+3. **Projection adapters** implement a native configuration surface.
+4. **Observability adapters** read and normalize a bounded evidence source.
+
+A **provider binding** is persisted intent connecting a host and provider through a projection and
+transport. It is data, not a fifth executable adapter registry.
+
+All registries are static modules shipped with `ak`. Registration validates the complete built-in
+set at module/test boundaries. Agentic-kit does not dynamically import adapter paths from
+`kit.json`, npm packages, or user directories.
+
+The conceptual descriptors are:
+
+```js
+// HostAdapter
+{
+  id, label,
+  install: { bin, method, package, externalPolicy },
+  capabilities: {
+    driveSession, primary, activityRouting, install,
+    mcp, guidance, statusline, transcripts, usage
+  },
+  auth: { kind, keyEnv, loginProbe },
+  projections: [],
+  observability: [],
+  defaultProvider
+}
+
+// ProviderAdapter
+{
+  id, label,
+  billing, // local | subscription | metered | unknown
+  credentials: { kind, env }, // none | env | host-auth
+  transports: [],
+  capabilities: {
+    modelDiscovery, runtimeDiscovery,
+    pricing, // zero | dated | none
+    quota,
+    cacheAccounting // exact | approximate | none | unknown
+  },
+  projections: [],
+  observability: []
+}
+```
+
+Projection and observability descriptors contain metadata plus references to built-in lifecycle or
+normalizer functions. Registry validation rejects duplicate IDs, unknown capabilities or enum
+values, unresolved projection/observability references, invalid billing/credential combinations,
+and invalid capability implications. In particular, `primary` and `activityRouting` require
+`driveSession`; a provider with `pricing: 'zero'` must be local; and a required credential is
+described by environment-variable name, never by its value.
+
+Host and provider namespaces are typed. An ID appearing on the provider axis can never satisfy a
+host reference, and vice versa. Compatibility exports may derive the old arrays and maps from the
+registries during migration, but they are not independent sources of truth.
+
+### 2. Derive choices from capability, not identity
+
+Commands ask the registry what an adapter can do instead of comparing its ID:
+
+- host selection lists managed host integrations;
+- primary-host selection includes only `capabilities.primary`;
+- activity routing includes only `capabilities.activityRouting`;
+- install, MCP, guidance, status-line, transcript, and usage work runs only for adapters exposing
+  that capability;
+- provider pricing, quota, cache, discovery, and billing views render only supported facts;
+- update and uninstall actions apply only to artifacts `ak` owns;
+- verification selects host, provider, binding, projection, and observation proof contracts by
+  capability.
+
+Consequently, adding OpenCode to the host registry does not make it primary or routable. Adding
+OpenRouter to the provider registry does not make it a host.
+
+### 3. Use one lifecycle contract for managed projections
+
+Every mutating built-in projection uses the same lifecycle:
+
+```text
+detect(context)                 -> facts + health + diagnostics
+plan(context, intent, facts)    -> operations + preconditions + diagnostics
+apply(context, plan, options)   -> operation results + ownership receipts
+verify(context, intent)         -> independently observed facts + proofs
+undo(context, receipts)         -> operation results
+```
+
+- `detect` is read-only.
+- `plan` is deterministic for the same intent and facts.
+- `apply({dryRun:true})` performs no writes or mutating process calls.
+- repeated apply converges without additional writes.
+- `verify` reads the target surface rather than trusting the plan or prior apply result.
+- `undo` runs in reverse dependency order and touches only owned values.
+- malformed, absent, unsupported, or unavailable surfaces produce honest diagnostics and unknown
+  facts rather than guessed success.
+
+Setup, status, sync, provider selection, verify, and uninstall consume this lifecycle and the same
+normalized facts. Commands remain responsible for presentation and orchestration, not native
+surface semantics.
+
+Network and process probes are bounded and explicit. Ordinary config loading and normalization
+perform no network access. A loopback runtime probe may run where the command contract calls for
+it, with a short timeout and an honest unreachable result. Remote provider verification is
+explicit verification, not an implicit side effect of ordinary status.
+
+### 4. Generalize value-precise ownership without adopting external state
+
+An apply operation records a safe receipt shaped as:
+
+```js
+{
+  adapterId, surface, scope, target, keyPath,
+  prior: { present, value },
+  written: { present, value },
+  managedBy: 'agentic-kit',
+  recordedAt
+}
+```
+
+Large or sensitive values may use a stable value hash, provided comparison remains exact for the
+owned field. Credential values are never included.
+
+Undo restores or removes a field only when its current value still equals `written`. If a user or
+external tool changed it, `ak` reports drift and preserves the current value. A receipt never
+authorizes rewriting sibling keys, deleting a containing table, uninstalling an externally
+installed executable, or adopting a host-native profile.
+
+Install ownership is separate from presence. An npm package installed by `ak` can be updated or
+removed under its install receipt. A Homebrew, system, vendor-installer, or otherwise external
+installation remains detectable and usable but unmanaged. This extends PR #67 and ADR-0015's
+no-clobber behavior across JSON, TOML, environment projections, and CLI-managed surfaces without
+weakening it.
+
+### 5. Normalize field-level facts before rendering conclusions
+
+Detection and observation return facts, not pre-rendered status rows:
+
+```js
+{
+  subject: { kind, id },
+  field,
+  value,
+  provenance, // observed | configured | inferred | unknown
+  sourceAdapter,
+  evidenceRef,
+  observedAt,
+  freshness,
+  confidence
+}
+```
+
+Facts merge at field level. `observed` evidence normally outranks `configured`, which outranks
+`inferred`, which outranks `unknown`, but conflicting evidence is retained for diagnostics rather
+than erased. A record never receives one blanket confidence when its host, provider, model, billing,
+and endpoint have different sources.
+
+Consumers receive a resolved execution projection with independently proven dimensions:
+
+```js
+{
+  host:      { id, provenance },
+  provider:  { id, provenance },
+  model:     { id, digest, provenance },
+  transport: { id, provenance },
+  endpoint:  { class, display, provenance },
+  billing:   { kind, provenance },
+  capabilities: { pricing, quota, cacheAccounting },
+  bindingId
+}
+```
+
+An absent provider remains unknown. A legacy host-to-provider default may be labelled `inferred`;
+it is never upgraded to observed merely because a transcript host is known. Price, quota, and cache
+fields are absent when no supporting source exists. `$0` is reserved for grounded local-provider
+evidence under ADR-0011; unknown and unpriced are not rendered as free.
+
+Status rows, setup/sync plans, verification results, dashboard cards, Live events, and usage
+attribution project from these facts. Collection returns immutable snapshots or ordinary values,
+not a mutable global registry cache.
+
+### 6. Add versioned provider bindings without replacing legacy configuration
+
+The initial persisted shape is additive:
+
+```json
+{
+  "integrations": {
+    "version": 1,
+    "hosts": {
+      "claude": true,
+      "codex": false
+    },
+    "bindings": [
+      {
+        "id": "ollama-via-claude",
+        "host": "claude",
+        "provider": "ollama",
+        "projection": "claude",
+        "transport": "anthropic-compatible",
+        "endpoint": "http://127.0.0.1:11434",
+        "model": "qwen3.6:latest",
+        "provenance": "configured",
+        "managedBy": "agentic-kit"
+      }
+    ]
+  }
+}
+```
+
+`integrations.version`, `integrations.hosts`, and `integrations.bindings` are the canonical
+versioned integration envelope. The legacy `providers` object continues alongside it:
+`providers.hosts`, `primaryHost`, `dualRouting`, `aqeProvider`, `aqeFallback`, and `models` remain
+valid during the compatibility window because they still drive the existing downstream
+projections. They are not an alternate location for new bindings.
+
+Loading a legacy Claude-only or Claude+Codex file produces the same effective behavior and does not
+rewrite the file. The loader normalizes legacy `providers.hosts` intent into
+`integrations.hosts` in memory. The next intentional save persists the canonical
+`integrations: { version, hosts, bindings }` envelope alongside the legacy fields; repeating the
+migration produces byte-equivalent intent.
+
+`dualRouting` remains activity-to-host/model/escalation intent. Provider resolution is a separate
+binding lookup rather than an optional provider field on every route. This preserves ADR-0001's
+semantics and permits one route to resolve through a host profile without duplicating provider
+configuration. A route with no grounded matching binding has provider `unknown`, or an explicitly
+`inferred` legacy default. Migration may materialize a deterministic native default binding for an
+enabled legacy Claude/Codex host, but stamps it `provenance: 'inferred'` and
+`managedBy: 'unknown'`; it does not fabricate observed evidence or agentic-kit ownership.
+
+Bindings initially live at the project `kit.json` scope. A binding may reference an external
+machine/user host-native profile, but reference does not transfer ownership. Machine-wide binding
+precedence is deferred until it has a concrete need and an explicit scope model.
+
+A binding has a stable explicit or deterministically generated ID; array position is never
+identity. Disabling or undoing one binding cannot affect another binding to the same provider.
+
+### 7. Validate endpoints and never persist secrets
+
+Endpoint validation distinguishes:
+
+- trusted local HTTP only on literal loopback addresses (`127.0.0.0/8`, `::1`, or `localhost`);
+- remote endpoints only over HTTPS;
+- unknown or malformed endpoints, which are rejected rather than repaired by guessing.
+
+Endpoints containing user information, fragments, or secret-bearing query parameters are rejected.
+Normalization does not follow redirects or resolve hostnames to infer trust. An endpoint is stored
+only as non-secret configuration.
+
+Provider adapters list credential environment-variable names. `kit.json`, ownership receipts,
+plans, diagnostics, and serialized facts never contain API keys, OAuth tokens, authorization
+headers, or credential-bearing URLs. Credential detection reports only states such as present,
+missing, not-required, or unknown.
+
+### 8. Prove the model with Ollama, OpenRouter, and OpenCode
+
+#### Ollama through two hosts
+
+The first multi-host provider proof is two independent bindings to the one `ollama` provider:
+
+```text
+ollama-via-claude: host=claude, provider=ollama,
+  transport=anthropic-compatible, endpoint=http://127.0.0.1:11434
+
+ollama-via-codex: host=codex, provider=ollama,
+  transport=openai-compatible, endpoint=http://127.0.0.1:11434/v1
+```
+
+Host-specific transcript parsing remains unchanged. Provider attribution becomes configured when
+the binding establishes it and observed only when bounded runtime/catalogue or correlated evidence
+does. Exact model digest and local `$0` claims remain gated by ADR-0011 and
+`docs/LOCAL-MODEL-VALIDATION.md`. Until that evidence is captured, representation of the bindings
+does not claim that compatibility-layer behavior has been observed. Each binding has independent
+ownership and teardown.
+
+#### OpenRouter behind a host
+
+OpenRouter is a metered provider/gateway with environment-only credentials and compatible
+transports. It binds behind Claude, Codex, OpenCode, ruflo, or AQE where a concrete projection
+supports it. It never enters the host registry.
+
+A host transcript proves the host. OpenRouter response metadata can prove the provider and exact
+model. The two evidence streams describe one execution only when correlation is grounded. The
+normalized fact/resolution seam is the integration point for issue #59; this ADR does not absorb
+that issue's full parser, ingestion, pricing, or scorecard delivery.
+
+#### OpenCode as a non-routable host
+
+OpenCode uses the same host lifecycle, normalized facts, projections, and observability contracts
+for its supported surfaces. Its initial adapter declares `primary: false` and
+`activityRouting: false`. Tests prove that it appears in applicable management/status choices but
+not in primary-host or activity-routing choices. A later change may enable those capabilities only
+after a separate grounded routing design.
+
+### 9. Deliver in compatibility-preserving slices
+
+Implementation proceeds test-first:
+
+1. Add registry contract tests and pure schema validation.
+2. Extract existing Claude/Codex and provider metadata into registries; retain derived
+   compatibility exports and CLI-output parity where practical.
+3. Add the shared lifecycle/conformance harness and move native writes behind projection adapters.
+4. Make setup, status, sync, provider selection, verify, and uninstall consume the same normalized
+   facts and lifecycle results.
+5. Add versioned binding migration, resolver, provenance, and endpoint validation.
+6. Prove the two Ollama bindings, OpenRouter's provider-only identity, and OpenCode's negative
+   routing capabilities.
+7. Migrate dashboard, Live, usage, and transcript consumers away from incidental lists.
+8. Align README, provider, routing, usage, transcript, local-model, managed-tool, upgrading, and
+   troubleshooting vocabulary.
+
+Compatibility exports and hardcoded lists are removed only after every consumer has migrated.
+Each slice must keep runtime dependencies at zero and use fixtures or injected adapters so tests do
+not write real home/global configuration.
+
+## Compatibility and non-goals
+
+- Existing Claude/Codex behavior, `kit.json`, routing defaults, primary-host mirroring, and
+  `ak dual` projections remain valid.
+- This decision does not rename `ak dual`; provider count does not change the number of routed
+  execution hosts.
+- It does not implement every provider, a public adapter SDK, or arbitrary third-party code
+  loading.
+- It does not persist credentials.
+- It does not make every managed host primary or routable.
+- It does not make OpenCode routable.
+- It does not implement issue #59's full transcript, usage, or pricing work.
+- It does not claim provider provenance from host evidence alone.
+- It does not add dashboard writes or controls.
+- It does not silently adopt or overwrite externally managed configuration.
+- It does not make unverified Ollama compatibility claims; ADR-0011's validation gate remains.
+
+## Consequences
+
+New built-in hosts and providers become additive registry entries plus their own adapters and
+contract tests. Commands and UI use a common vocabulary and cannot accidentally expose a provider
+as a routing host. One provider can be represented behind several hosts, while ownership and
+teardown remain binding-specific.
+
+The cost is a larger explicit domain model, a compatibility layer while consumers migrate, and
+field-level provenance throughout status and observability. Those costs are intentional: a simple
+combined “provider” abstraction would preserve today's ambiguity and make its conclusions easier,
+but less truthful.
+
+## Acceptance mapping
+
+| Issue #71 acceptance criterion | Decision and proof |
+|---|---|
+| ADR covers axes, capabilities, migration, ownership, provenance | Sections 1–7 |
+| Existing Claude/Codex behavior/config remain compatible | Section 6 and compatibility list |
+| Four registries have validation tests | Sections 1 and 9 |
+| Lifecycle commands derive behavior from capabilities | Sections 2, 3, and 9 |
+| Primary/activity routing is capability-limited | Section 2; OpenCode negative test |
+| One provider binds to multiple hosts | Section 8; two Ollama bindings |
+| Ollama through Claude and Codex is represented | Section 8, subject to ADR-0011 evidence |
+| OpenRouter is a provider behind a host | Section 8; typed registry rejection as host |
+| Status/dashboard separate host, provider, model, billing, provenance | Section 5 |
+| npm-managed vs external ownership is truthful | Section 4 |
+| API keys are never persisted | Section 7 and serialization tests |
+| Dry-run/idempotence/undo/no-clobber are shared and tested | Sections 3 and 4; conformance suite |
+| Issue #59 can consume the abstraction without being subsumed | Sections 5 and 8 |
+| Documentation uses one vocabulary | Section 9 |
+
+This ADR remains **Proposed** until the registries, lifecycle conformance suite, compatibility
+fixtures, consumer migration, and proving integrations are implemented, and until Ollama claims
+requiring runtime evidence satisfy ADR-0011's validation requirements.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 6d870d6..eb4fb82 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -24,6 +24,7 @@ Consequences**, and cites the grounded source it rests on where relevant.
 | [0013](0013-admin-build-security-signals-and-honest-reach.md) | Admin: build/security signals, an honest Reach panel, and a pagination fix | Accepted |
 | [0014](0014-dashboard-auth-and-remediation.md) | Dashboard auth token, plus a security/quality remediation pass | Accepted |
 | [0015](0015-managed-codex-native-statusline.md) | Manage Codex's native user-wide status line without claiming rich-renderer parity | Accepted |
+| [0016](0016-capability-driven-integration-adapters.md) | Capability-driven host, provider, binding, projection, and observability adapters | Proposed |
 
 Theme: ADRs **0001–0006** define **dual-host LLM routing and leadership** — how `ak` lets ruflo route
 each development activity (architecture, implementation, testing, review, …) to the right host (Claude
@@ -69,3 +70,10 @@ new test coverage for the previously-untested machine-mutating commands.
 Claude's command-backed telemetry renderer. It adds opt-in, user-scoped presets,
 narrowly projects only the owned `[tui]` keys into `~/.codex/config.toml`, and
 keeps unowned or user-modified configuration outside `sync` and uninstall.
+
+**0016** separates execution hosts, inference providers, configuration projections, and
+observability sources into validated capability registries, with provider bindings as versioned
+intent between them. It standardizes detect/plan/apply/verify/undo, value-precise ownership, and
+field-level provenance; preserves legacy Claude/Codex routing; and proves the shape with one Ollama
+provider behind two hosts, OpenRouter behind an existing host, and OpenCode managed without becoming
+routable by accident.
diff --git a/src/commands/dual.mjs b/src/commands/dual.mjs
index 2cdcd1f..1c394fe 100644
--- a/src/commands/dual.mjs
+++ b/src/commands/dual.mjs
@@ -29,7 +29,7 @@ export const options = {
 
 export const help = `ak dual — run a Claude+Codex collaboration swarm
 
-Uses your per-activity routing policy (from \`ak x provider\`) to assign each pipeline
+Uses your per-activity routing policy (from \`ak host\`) to assign each pipeline
 step to the right host + model, then runs it via ${ADAPTER}.
 
 Usage:
@@ -135,7 +135,7 @@ async function doRun({ positionals, flags }) {
 
   const cfg = loadKitConfig();
   if (Object.keys(cfg.providers?.dualRouting ?? {}).length === 0) {
-    fail('no per-activity routing configured — enable dual-host first: ak x provider pick --host claude,codex');
+    fail('no per-activity routing configured — enable dual-host first: ak host pick --host claude,codex');
     return 1;
   }
 
@@ -152,7 +152,7 @@ async function doRun({ positionals, flags }) {
 
   printPlan(template, task, config);
   if (!(await have(ADAPTER))) {
-    fail(`${ADAPTER} not found — enable dual-host to install the adapter: ak x provider pick --host claude,codex`);
+    fail(`${ADAPTER} not found — enable dual-host to install the adapter: ak host pick --host claude,codex`);
     return 1;
   }
 
diff --git a/src/commands/setup.mjs b/src/commands/setup.mjs
index c55a10c..45f4de9 100644
--- a/src/commands/setup.mjs
+++ b/src/commands/setup.mjs
@@ -13,7 +13,7 @@ import { fixStatusline } from '../lib/statusline.mjs';
 import { registry, syncBlocks } from '../lib/blocks.mjs';
 import { register as mcpRegister, applyExclusions } from '../lib/mcp.mjs';
 import { loadKitConfig, saveKitConfig } from '../lib/config.mjs';
-import { HOSTS, applyHosts, applyProviders, ensureDualAgents, hostInstallState, installHost, applyAqeRouter, seedDualRoutingIfDualHost, printActivityRoutingTable, aqeSupportsAgentOverrides, ensureCodexMcp, ensureRufloMcpInCodex, applySetupHostFlags } from '../lib/providers.mjs';
+import { commandHosts, applyHosts, applyProviders, ensureDualAgents, hostInstallState, installHost, applyAqeRouter, seedDualRoutingIfDualHost, printActivityRoutingTable, aqeSupportsAgentOverrides, ensureCodexMcp, ensureRufloMcpInCodex, applySetupHostFlags } from '../lib/providers.mjs';
 import { installedVersion } from '../lib/versions.mjs';
 import * as rb from '../lib/ruvnet-brain.mjs';
 import * as adb from '../lib/agentdb.mjs';
@@ -150,14 +150,14 @@ export async function run_machine({ flags, pkgRoot, cfg }) {
 
   // 6. frontier hosts — install any ENABLED host that is entirely absent (default
   //    enables claude only). External installs (mise/native/brew) are left alone.
-  for (const h of HOSTS) {
+  for (const h of commandHosts()) {
     if (!cfg.providers?.hosts?.[h.id]) continue;
     const st = await hostInstallState(h);
     if (st.method === 'absent') {
       if (await ask(`${h.id} CLI not found — install ${h.pkg} globally?`, true, flags.yes)) {
         const r = await installHost(h.id);
         (r.ok ? ok : warn)(`${h.id}: ${r.detail}`);
-      } else warn(`${h.id} not installed — enable/install later with: ak x provider pick`);
+      } else warn(`${h.id} not installed — enable/install later with: ak host pick`);
     } else {
       ok(`${h.id} ${st.version ?? ''} present (${st.method}${st.method === 'external' ? ' — self-managed' : ''})`);
     }
@@ -165,7 +165,7 @@ export async function run_machine({ flags, pkgRoot, cfg }) {
 
   // 7. frontier host hint — codex detected but not enabled (opt-in via `x provider pick`)
   if (!cfg.providers?.hosts?.codex && await have('codex')) {
-    info('codex CLI detected — run `ak x provider pick` to let ruflo use both claude and codex');
+    info('codex CLI detected — run `ak host pick` to let ruflo use both claude and codex');
   }
   return true;
 }
@@ -292,7 +292,7 @@ export async function run_project({ flags, cfg }) {
     const prov = await applyProviders(cfg, root);
     if (prov.changed) (prov.ok ? ok : warn)(`providers: ${prov.detail}`);
   } else if (await have('codex')) {
-    info('codex CLI detected — enable dual-host with: ak x provider pick');
+    info('codex CLI detected — enable dual-host with: ak host pick');
   }
 
   // 10. statusline footer — LAST, after ruflo + aqe have settled the helper.
diff --git a/src/commands/status.mjs b/src/commands/status.mjs
index 3836134..ada7dd5 100644
--- a/src/commands/status.mjs
+++ b/src/commands/status.mjs
@@ -19,7 +19,7 @@ import { drift as ruvnetBrainDrift, nightlyAgentPresent as rbNightlyPresent, NIG
 import { coherence as adbCoherence } from '../lib/agentdb.mjs';
 import { readJson } from '../lib/settings.mjs';
 import { have } from '../lib/exec.mjs';
-import { HOSTS, settingsTarget, isDefault, managedEnv, MANAGED_ENV_KEYS, hostInstallState, hostAuthState, bothHostsEnabled, aqeRouterFile, aqeSupportsAgentOverrides, credentialGaps } from '../lib/providers.mjs';
+import { HOSTS, settingsTarget, isDefault, managedEnv, MANAGED_ENV_KEYS, hostInstallState, hostAuthState, bothHostsEnabled, aqeRouterFile, aqeSupportsAgentOverrides, credentialGaps, collectIntegrationFacts } from '../lib/providers.mjs';
 import { policyToAgentOverrides, routingSummary, divergedRoutes } from '../lib/routing.mjs';
 import { qeCourtShipped, readQeCourtConfig, panelFromRouting, validatePanel, healJuryVendorCollision, UPSTREAM_JURY_VENDOR_ISSUE } from '../lib/qeCourt.mjs';
 import { drift as ruvectorDrift } from '../lib/ruvector.mjs';
@@ -53,6 +53,7 @@ const row = (subsystem, level, message, fix = null) => ({ subsystem, level, mess
 export async function collect({ pkgRoot, cwd = process.cwd() }) {
   const rows = [];
   const cfg = loadKitConfig();
+  const integrationFacts = await collectIntegrationFacts({ cwd, cfg });
 
   // versions
   try {
@@ -331,6 +332,12 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
     const primaryHost = cfg.providers?.primaryHost ?? 'claude';
     for (const h of HOSTS) {
       if (!cfg.providers.hosts[h.id]) continue;
+      const detected = integrationFacts.hosts[h.id];
+      if (detected?.present === false) {
+        rows.push(row('hosts', h.id === primaryHost ? 'fail' : 'warn',
+          `${h.id} enabled but not installed${h.id === primaryHost ? ' (primary)' : ''}`, `sync installs ${h.pkg}`));
+        continue;
+      }
       const st = await hostInstallState(h);
       if (st.method === 'absent') {
         rows.push(row('hosts', h.id === primaryHost ? 'fail' : 'warn',
@@ -429,7 +436,7 @@ export async function collect({ pkgRoot, cwd = process.cwd() }) {
           ...d.escalate.map((e) => `${e.model} vs ${e.defaultModel} (escalation)`),
         ]))].join(', ');
         rows.push(row('routing', 'info',
-          `${diverged.length} seeded route(s) diverge from current defaults (${pairs}) — ak x provider refresh`));
+          `${diverged.length} seeded route(s) diverge from current defaults (${pairs}) — ak host refresh`));
       }
     }
   } catch (e) {
diff --git a/src/commands/sync.mjs b/src/commands/sync.mjs
index 80f3fc2..92c92d8 100644
--- a/src/commands/sync.mjs
+++ b/src/commands/sync.mjs
@@ -9,7 +9,7 @@ import { registry, syncBlocks, blocksForTarget, retiredForTarget, guidanceTarget
 import { register as mcpRegister, applyExclusions } from '../lib/mcp.mjs';
 import { listDaemons, staleDaemons, reap } from '../lib/daemons.mjs';
 import { loadKitConfig, saveKitConfig } from '../lib/config.mjs';
-import { HOSTS, applyHosts, applyProviders, hostInstallState, installHost, applyAqeRouter, seedDualRoutingIfDualHost, ensureCodexMcp, ensureRufloMcpInCodex, bothHostsEnabled } from '../lib/providers.mjs';
+import { commandHosts, applyHosts, applyProviders, hostInstallState, installHost, applyAqeRouter, seedDualRoutingIfDualHost, ensureCodexMcp, ensureRufloMcpInCodex, bothHostsEnabled } from '../lib/providers.mjs';
 import { driftReport, selfDrift } from '../lib/versions.mjs';
 import { RUVECTOR_PKG, managed as ruvectorManaged } from '../lib/ruvector.mjs';
 import { pruneNpxStale } from '../lib/npx.mjs';
@@ -180,7 +180,7 @@ export async function run({ flags, pkgRoot }) {
   // hosts: install any ENABLED host that is entirely absent (updates to
   // npm-managed hosts ride the versions branch above via driftReport).
   if (subsystems.has('hosts')) {
-    for (const h of HOSTS) {
+    for (const h of commandHosts()) {
       if (!cfg.providers.hosts[h.id]) continue;
       if ((await hostInstallState(h)).method !== 'absent') continue;
       await step(`install ${h.id}`, () => installHost(h.id));
diff --git a/src/commands/x/provider.mjs b/src/commands/x/provider.mjs
index 5b5baad..c0e52e5 100644
--- a/src/commands/x/provider.mjs
+++ b/src/commands/x/provider.mjs
@@ -6,12 +6,13 @@
 // Two independent axes: ruflo host CLIs (claude/codex) and the LLM the routers use.
 import readline from 'node:readline/promises';
 import {
-  HOSTS, API_PROVIDERS, AQE_PROVIDER_TYPES, detectHosts, detectProviders,
+  HOSTS, API_PROVIDERS, AQE_PROVIDER_TYPES, detectHosts,
   settingsTarget, isDefault, applyHosts, applyProviders, ensureDualAgents,
   undoProviders, hostInstallState, hostAuthState, installHost, applyAqeRouter, undoAqeRouter,
   bothHostsEnabled, DUAL_ROLE_TIP, JUDGE_BIAS_TIP, QE_COURT_TIP, suggestedFallbackFor,
   seedDualRoutingIfDualHost, printActivityRoutingTable, ensureCodexMcp, undoCodexMcp,
   ensureRufloMcpInCodex, undoRufloMcpInCodex, detectAqeProviders, aqeProviderCredential, credentialGaps, fallbackSource,
+  collectIntegrationFacts,
 } from '../../lib/providers.mjs';
 import { parseRouteSpecs, formatModelHelp, PRIMARY_HOSTS, DEFAULT_PRIMARY_HOST, divergedRoutes, refreshSeededRoutes, modelNote, ACTIVITIES } from '../../lib/routing.mjs';
 import { loadKitConfig, saveKitConfig } from '../../lib/config.mjs';
@@ -47,7 +48,7 @@ export const options = {
  *  key (codex/gemini OAuth live on the host axis, not as aqe provider types). */
 export const AQE_BILLING_HINT = 'billing: claude-code = your Claude subscription ($0), ollama/onnx = local ($0), all others = metered API key';
 
-export const help = `ak x provider — frontier-host + LLM-provider detection and wiring
+export const help = `ak host — frontier-host + LLM-provider detection and wiring
 
 Two independent axes: which host CLI runs the ruflo loop (claude/codex, can be
 both), and which LLM the routers use (aqe + ruflo). Mirrors \`ak x mcp\`: detect →
@@ -90,11 +91,11 @@ per-activity routing policy from sensible defaults and materializes it into
 your edits are preserved across syncs. ${formatModelHelp()}
 
 Examples:
-  ak x provider                          show what's detected + wired + routing
-  ak x provider pick --host claude,codex
-  ak x provider pick --route 'testing:claude:claude-sonnet-5'
-  ak x provider refresh --activity architecture,design
-  ak x provider off`;
+  ak host                          show what's detected + wired + routing
+  ak host pick --host claude,codex
+  ak host pick --route 'testing:claude:claude-sonnet-5'
+  ak host refresh --activity architecture,design
+  ak host off`;
 
 /** Stamp provenance onto chain entries. 'suggested' = ak proposed it and the
  *  user pressed enter; 'user' = they typed it. Only 'suggested' entries are
@@ -122,8 +123,9 @@ export async function run({ flags, positionals }) {
 
 async function status({ flags, cwd }) {
   const cfg = loadKitConfig();
-  const hosts = await detectHosts(cwd);
-  const providers = detectProviders();
+  const facts = await collectIntegrationFacts({ cwd, cfg });
+  const hosts = facts.hosts;
+  const providers = facts.providers;
   const { scope } = settingsTarget(cwd);
 
   if (flags.json) {
@@ -183,7 +185,8 @@ async function status({ flags, cwd }) {
   console.log(bold('\nruflo LLM API providers') + dim('  (ruflo router; keys read from env)'));
   for (const p of API_PROVIDERS) {
     const cfgEntry = cm.find((m) => m.id === p.id);
-    const key = p.keyEnv.length ? (providers[p.id].keyPresent ? 'key present' : 'no key') : 'local';
+    const key = p.keyEnv.length
+      ? (providers[p.id]?.credentialPresent ? 'key present' : 'no key') : 'local';
     const conf = cfgEntry ? `configured${cfgEntry.model ? ` (${cfgEntry.model})` : ''}` : dim('not configured');
     console.log(`  ${p.id.padEnd(10)} ${key.padEnd(12)} ${conf}`);
   }
@@ -193,7 +196,7 @@ async function status({ flags, cwd }) {
 
   const codexIdle = hosts.codex.present && !cfg.providers.hosts.codex;
   console.log('');
-  if (codexIdle) info('codex is installed but disabled — enable it with: ak x provider pick');
+  if (codexIdle) info('codex is installed but disabled — enable it with: ak host pick');
   else ok('provider config reflects installed CLIs');
   printDualHostTips(cfg);
   return 0;
@@ -479,7 +482,7 @@ async function pick({ flags, cwd }) {
   if (rmcp.changed || !rmcp.ok) (rmcp.ok ? ok : warn)(`ruflo→codex MCP: ${rmcp.detail}`);
   const prov = await applyProviders(cfg, cwd);
   (prov.ok ? (prov.changed ? ok : info) : warn)(`ruflo providers: ${prov.detail}`);
-  ok('saved to kit.json — reapplied on every `ak sync`; undo with `ak x provider off`');
+  ok('saved to kit.json — reapplied on every `ak sync`; undo with `ak host off`');
   if (seed.seeded) ok(`per-activity routing seeded — ${seed.count} activities (dual-host defaults; tune with --route or edit kit.json)`);
   printActivityRoutingTable(cfg);
   await maybeWriteQeCourtDefaults({ nonInteractive, cwd, enabled, aqeProvider });
diff --git a/src/commands/x/verify.mjs b/src/commands/x/verify.mjs
index f1ee95a..5219cd5 100644
--- a/src/commands/x/verify.mjs
+++ b/src/commands/x/verify.mjs
@@ -9,7 +9,7 @@ import { aidefencePresent, securityPresent } from '../../lib/natives.mjs';
 import { scanRvf } from '../../lib/rvf.mjs';
 import { projectAqeDir } from '../../lib/paths.mjs';
 import { loadKitConfig } from '../../lib/config.mjs';
-import { HOSTS, detectHosts, aqeRouterFile } from '../../lib/providers.mjs';
+import { HOSTS, collectIntegrationFacts, aqeRouterFile } from '../../lib/providers.mjs';
 import { readJson } from '../../lib/settings.mjs';
 import { runHarvest } from '../../lib/harvest.mjs';
 import { ok, warn, fail, heading } from '../../lib/output.mjs';
@@ -85,7 +85,7 @@ async function verifyProviders() {
   const cfg = loadKitConfig();
   let good = true;
   // enabled hosts must actually be installed
-  const hosts = await detectHosts(process.cwd());
+  const hosts = (await collectIntegrationFacts({ cwd: process.cwd(), cfg })).hosts;
   for (const h of HOSTS) {
     if (!cfg.providers?.hosts?.[h.id]) continue;
     if (hosts[h.id].present) ok(`host '${h.id}' enabled and installed${hosts[h.id].version ? ` (v${hosts[h.id].version})` : ''}`);
diff --git a/src/lib/adapters/bindings.mjs b/src/lib/adapters/bindings.mjs
new file mode 100644
index 0000000..f4135b2
--- /dev/null
+++ b/src/lib/adapters/bindings.mjs
@@ -0,0 +1,97 @@
+import { OWNERSHIP_TYPES, PROVENANCE_TYPES, assertEnum, assertId, assertRecord, immutable } from './schema.mjs';
+import { HOST_REGISTRY, PROVIDER_REGISTRY, PROJECTION_REGISTRY } from './registries.mjs';
+import { validateEndpoint } from './config.mjs';
+
+export function assertValidEndpoint(endpoint, { allowRemote = true } = {}) {
+  if (endpoint == null) return 'none';
+  const result = validateEndpoint(endpoint);
+  if (!result.ok) throw new TypeError(`invalid endpoint: ${result.reason}`);
+  const parsed = new URL(result.normalized);
+  const loopback = ['127.0.0.1', 'localhost', '[::1]', '::1'].includes(parsed.hostname);
+  if (!allowRemote && !loopback) throw new TypeError('remote endpoint is not allowed');
+  return loopback ? 'loopback' : 'remote-https';
+}
+
+export function assertValidBinding(value, {
+  hosts = HOST_REGISTRY, providers = PROVIDER_REGISTRY, projections = PROJECTION_REGISTRY,
+} = {}) {
+  assertRecord(value, 'binding');
+  assertId(value.id, 'binding.id');
+  assertId(value.host, 'binding.host');
+  assertId(value.provider, 'binding.provider');
+  const hostMap = Array.isArray(hosts) ? Object.fromEntries(hosts.map((entry) => [entry.id, entry])) : hosts;
+  const providerMap = Array.isArray(providers) ? Object.fromEntries(providers.map((entry) => [entry.id, entry])) : providers;
+  const projectionMap = Array.isArray(projections) ? Object.fromEntries(projections.map((entry) => [entry.id, entry])) : projections;
+  if (!hostMap[value.host]) throw new TypeError(`binding ${value.id} references unknown host ${value.host}`);
+  const provider = providerMap[value.provider];
+  if (!provider) throw new TypeError(`binding ${value.id} references unknown provider ${value.provider}`);
+  if (typeof value.transport !== 'string' || !provider.transports.includes(value.transport)) {
+    throw new TypeError(`binding ${value.id} has unsupported transport ${value.transport}`);
+  }
+  const projection = value.projection ?? hostMap[value.host].configProjection;
+  if (!projectionMap[projection]) throw new TypeError(`binding ${value.id} references unknown projection ${projection}`);
+  if (!provider.projections.includes(projection)) {
+    throw new TypeError(`provider ${value.provider} does not support projection ${projection}`);
+  }
+  if (value.endpoint != null) assertValidEndpoint(value.endpoint);
+  if (value.model != null && (typeof value.model !== 'string' || !value.model)) {
+    throw new TypeError('binding.model must be a non-empty string');
+  }
+  assertEnum(value.provenance ?? 'configured', PROVENANCE_TYPES, 'binding.provenance');
+  assertEnum(value.managedBy ?? 'unknown', OWNERSHIP_TYPES, 'binding.managedBy');
+  return immutable({
+    ...structuredClone(value), projection,
+    endpoint: value.endpoint ?? null, model: value.model ?? null,
+    provenance: value.provenance ?? 'configured', managedBy: value.managedBy ?? 'unknown',
+  });
+}
+
+export function validateBindings(values, registries) {
+  if (!Array.isArray(values)) throw new TypeError('bindings must be an array');
+  const ids = new Set();
+  return immutable(values.map((value) => {
+    const binding = assertValidBinding(value, registries);
+    if (ids.has(binding.id)) throw new TypeError(`duplicate binding id: ${binding.id}`);
+    ids.add(binding.id);
+    return binding;
+  }));
+}
+
+export function resolveBinding(bindings, {
+  host, provider, model, projection, endpoint,
+} = /** @type {any} */ ({})) {
+  const candidates = bindings.filter((binding) =>
+    (!host || binding.host === host)
+    && (!provider || binding.provider === provider)
+    && (!model || binding.model === model)
+    && (!projection || binding.projection === projection)
+    && (!endpoint || binding.endpoint === endpoint));
+  return candidates.length === 1 ? candidates[0] : null;
+}
+
+export function validateBinding(binding, registries, constraints = {}) {
+  const errors = [];
+  const hostIds = new Set(constraints.hosts ?? (registries?.hosts ?? []).map((entry) => entry.id));
+  const providerIds = new Set(constraints.providers ?? (registries?.providers ?? []).map((entry) => entry.id));
+  const provider = (registries?.providers ?? []).find((entry) => entry.id === binding?.provider);
+  if (!hostIds.has(binding?.host)) errors.push({ path: 'binding.host', code: 'unknown-host', value: binding?.host });
+  if (!providerIds.has(binding?.provider)) errors.push({ path: 'binding.provider', code: 'unknown-provider', value: binding?.provider });
+  const transports = constraints.transports?.[binding?.provider] ?? provider?.transports ?? [];
+  if (!transports.includes(binding?.transport)) errors.push({
+    path: 'binding.transport', code: 'unsupported-transport', value: binding?.transport,
+  });
+  return errors;
+}
+
+export const BUILTIN_BINDINGS = validateBindings([
+  {
+    id: 'ollama-via-claude', host: 'claude', provider: 'ollama',
+    transport: 'anthropic-compatible', endpoint: 'http://127.0.0.1:11434',
+    provenance: 'configured', managedBy: 'external',
+  },
+  {
+    id: 'ollama-via-codex', host: 'codex', provider: 'ollama',
+    transport: 'openai-compatible', endpoint: 'http://127.0.0.1:11434/v1/',
+    provenance: 'configured', managedBy: 'external',
+  },
+]);
diff --git a/src/lib/adapters/config.mjs b/src/lib/adapters/config.mjs
new file mode 100644
index 0000000..3081dfb
--- /dev/null
+++ b/src/lib/adapters/config.mjs
@@ -0,0 +1,50 @@
+import { immutable } from './schema.mjs';
+
+export const CURRENT_INTEGRATIONS_VERSION = 1;
+
+export function validateEndpoint(endpoint) {
+  let parsed;
+  try { parsed = new URL(endpoint); } catch { return { ok: false, reason: 'invalid-url' }; }
+  if (parsed.username || parsed.password) return { ok: false, reason: 'embedded-credentials' };
+  if (parsed.hash) return { ok: false, reason: 'fragment' };
+  const secretParam = /^(?:access_?token|token|key|api_?key|auth|authorization|signature|sig|secret|password)$/i;
+  if ([...parsed.searchParams.keys()].some((name) => secretParam.test(name))) {
+    return { ok: false, reason: 'secret-query' };
+  }
+  if (!['http:', 'https:'].includes(parsed.protocol)) return { ok: false, reason: 'unsupported-protocol' };
+  const loopback = ['127.0.0.1', 'localhost', '[::1]', '::1'].includes(parsed.hostname);
+  if (parsed.protocol === 'http:' && !loopback) return { ok: false, reason: 'remote-http' };
+  return { ok: true, normalized: endpoint };
+}
+
+export function migrateIntegrationConfig(config = {}, _options = {}) {
+  const out = structuredClone(config);
+  const existing = out.integrations ?? {};
+  if (Number.isInteger(existing.version) && existing.version > CURRENT_INTEGRATIONS_VERSION) {
+    return immutable(out);
+  }
+  if (Object.hasOwn(existing, 'bindings') && !Array.isArray(existing.bindings)) {
+    return immutable(out);
+  }
+  const enabled = Object.entries(out.providers?.hosts ?? {}).filter(([, on]) => on).map(([host]) => host);
+  const defaults = { claude: 'anthropic', codex: 'openai' };
+  const priorBindings = Array.isArray(existing.bindings) ? existing.bindings : [];
+  const seenHosts = new Set(priorBindings.map((binding) => binding.host));
+  const inferred = enabled.filter((host) => !seenHosts.has(host)).map((host) => ({
+    id: `${defaults[host] ?? 'unknown'}-via-${host}`,
+    host,
+    provider: defaults[host] ?? null,
+    model: null,
+    transport: 'native',
+    endpoint: null,
+    provenance: defaults[host] ? 'inferred' : 'unknown',
+    managedBy: 'unknown',
+  }));
+  out.integrations = {
+    ...existing,
+    version: CURRENT_INTEGRATIONS_VERSION,
+    hosts: { ...(out.providers?.hosts ?? {}), ...(existing.hosts ?? {}) },
+    bindings: [...priorBindings, ...inferred],
+  };
+  return immutable(out);
+}
diff --git a/src/lib/adapters/facts.mjs b/src/lib/adapters/facts.mjs
new file mode 100644
index 0000000..6941285
--- /dev/null
+++ b/src/lib/adapters/facts.mjs
@@ -0,0 +1,132 @@
+import { BILLING_TYPES, PROVENANCE_TYPES, assertEnum, immutable } from './schema.mjs';
+
+const RANK = Object.freeze({ unknown: 0, inferred: 1, configured: 2, observed: 3 });
+
+export function provenance(value = 'unknown', evidence = []) {
+  assertEnum(value, PROVENANCE_TYPES, 'provenance');
+  if (!Array.isArray(evidence) || evidence.some((item) => typeof item !== 'string')) {
+    throw new TypeError('provenance evidence must be an array of strings');
+  }
+  return immutable({ value, evidence: [...new Set(evidence)] });
+}
+
+export function mergeProvenance(...values) {
+  const normalized = values.filter(Boolean).map((item) =>
+    typeof item === 'string' ? provenance(item) : provenance(item.value, item.evidence));
+  if (!normalized.length) return provenance();
+  const strongest = normalized.reduce((best, item) => RANK[item.value] > RANK[best.value] ? item : best);
+  return provenance(strongest.value, normalized.flatMap(({ evidence }) => evidence));
+}
+
+export function normalizedFacts({
+  hosts = {}, providers = {}, bindings = [], executions = [], observedAt = null,
+} = {}) {
+  const cleanHosts = Object.fromEntries(Object.entries(hosts).map(([id, fact]) => [id, {
+    present: fact?.present ?? null, enabled: fact?.enabled ?? null,
+    version: fact?.version ?? null, installMethod: fact?.installMethod ?? 'unknown',
+    authenticated: fact?.authenticated ?? 'unknown', wired: fact?.wired ?? null,
+    provenance: mergeProvenance(fact?.provenance),
+  }]));
+  const cleanProviders = Object.fromEntries(Object.entries(providers).map(([id, fact]) => {
+    const billing = fact?.billing ?? 'unknown';
+    assertEnum(billing, BILLING_TYPES, `providers.${id}.billing`);
+    return [id, {
+      configured: fact?.configured ?? null, reachable: fact?.reachable ?? null,
+      billing, credential: fact?.credential ?? 'unknown',
+      provenance: mergeProvenance(fact?.provenance),
+    }];
+  }));
+  const cleanBindings = bindings.map((fact) => ({
+    id: fact.id ?? null, host: fact.host, provider: fact.provider,
+    model: fact.model ?? null, transport: fact.transport ?? null,
+    endpoint: fact.endpoint ?? null, reachable: fact.reachable ?? null,
+    provenance: mergeProvenance(fact.provenance),
+  }));
+  const cleanExecutions = executions.map((fact) => ({
+    host: fact.host ?? null, provider: fact.provider ?? null,
+    model: fact.model ?? null, transport: fact.transport ?? null,
+    endpoint: fact.endpoint ?? null, billing: fact.billing ?? 'unknown',
+    provenance: mergeProvenance(fact.provenance),
+  }));
+  for (const fact of cleanExecutions) assertEnum(fact.billing, BILLING_TYPES, 'execution.billing');
+  return immutable({
+    schemaVersion: 1, observedAt,
+    hosts: cleanHosts, providers: cleanProviders,
+    bindings: cleanBindings, executions: cleanExecutions,
+  });
+}
+
+export function mergeFacts(...sets) {
+  const hosts = {}, providers = {}, bindingMap = new Map(), executions = [];
+  let observedAt = null;
+  for (const set of sets.filter(Boolean)) {
+    observedAt = set.observedAt ?? observedAt;
+    for (const [id, fact] of Object.entries(set.hosts ?? {})) {
+      const prior = hosts[id] ?? {};
+      hosts[id] = { ...prior, ...fact, provenance: mergeProvenance(prior.provenance, fact.provenance) };
+    }
+    for (const [id, fact] of Object.entries(set.providers ?? {})) {
+      const prior = providers[id] ?? {};
+      providers[id] = { ...prior, ...fact, provenance: mergeProvenance(prior.provenance, fact.provenance) };
+    }
+    for (const fact of set.bindings ?? []) {
+      const key = fact.id ?? `${fact.host}|${fact.provider}|${fact.transport ?? ''}|${fact.endpoint ?? ''}`;
+      const prior = bindingMap.get(key) ?? {};
+      bindingMap.set(key, { ...prior, ...fact, provenance: mergeProvenance(prior.provenance, fact.provenance) });
+    }
+    executions.push(...(set.executions ?? []));
+  }
+  return normalizedFacts({ hosts, providers, bindings: [...bindingMap.values()], executions, observedAt });
+}
+
+export function normalizeIntegrationFacts(input = {}) {
+  const providers = Object.fromEntries(Object.entries(input.providers ?? {}).map(([id, fact]) => [id, {
+    ...structuredClone(fact),
+    // Credential material is never a fact. Preserve only an explicit boolean
+    // presence signal across collection, JSON output and renderers.
+    keyPresent: fact?.keyPresent === true,
+    credentialPresent: fact?.keyPresent === true || fact?.credentialPresent === true,
+  }]));
+  const bindings = (input.bindings ?? []).map((binding) => {
+    let strength = binding.provenance ?? 'unknown';
+    for (const evidence of binding.evidence ?? []) {
+      if (evidence?.kind === 'provider-response' && evidence.provider === binding.provider
+        && RANK[evidence.provenance] > RANK[strength]) strength = evidence.provenance;
+    }
+    const provider = binding.provider ?? null;
+    const providerFact = provider ? providers[provider] : null;
+    const billing = providerFact?.billing ?? 'unknown';
+    return {
+      host: binding.host ?? null,
+      provider,
+      model: binding.model ?? null,
+      billing,
+      provenance: strength,
+      reachable: binding.reachable ?? providerFact?.reachable ?? null,
+      pricing: billing === 'local' ? 0 : null,
+      quota: null,
+      cacheAccounting: null,
+    };
+  });
+  return immutable({
+    hosts: structuredClone(input.hosts ?? {}),
+    providers: structuredClone(providers),
+    bindings,
+  });
+}
+
+export function groupUsageByIntegrationAxes(rows = []) {
+  const byHost = {}, byProvider = {};
+  const add = (map, key, row) => {
+    const bucket = map[key] ?? (map[key] = { sessions: 0, tokens: 0, cost: 0 });
+    bucket.sessions++;
+    bucket.tokens += Number(row.tokens) || 0;
+    if (row.cost == null || bucket.cost == null) bucket.cost = null;
+    else bucket.cost += Number(row.cost) || 0;
+  };
+  for (const row of rows) {
+    add(byHost, row.host ?? 'unknown', row);
+    add(byProvider, row.provider ?? 'unknown', row);
+  }
+  return immutable({ byHost, byProvider });
+}
diff --git a/src/lib/adapters/index.mjs b/src/lib/adapters/index.mjs
new file mode 100644
index 0000000..0952eaa
--- /dev/null
+++ b/src/lib/adapters/index.mjs
@@ -0,0 +1,8 @@
+export * from './schema.mjs';
+export * from './registries.mjs';
+export * from './bindings.mjs';
+export * from './facts.mjs';
+export * from './migration.mjs';
+export * from './lifecycle.mjs';
+export * from './config.mjs';
+export * from './ownership.mjs';
diff --git a/src/lib/adapters/lifecycle.mjs b/src/lib/adapters/lifecycle.mjs
new file mode 100644
index 0000000..c6bf7c6
--- /dev/null
+++ b/src/lib/adapters/lifecycle.mjs
@@ -0,0 +1,60 @@
+import { OWNERSHIP_TYPES, assertEnum, immutable } from './schema.mjs';
+
+export const LIFECYCLE_OPERATIONS = Object.freeze(['detect', 'plan', 'apply', 'verify', 'undo']);
+
+export function validateLifecycleAdapter(adapter) {
+  if (!adapter || typeof adapter !== 'object') throw new TypeError('lifecycle adapter must be an object');
+  if (typeof adapter.id !== 'string' || !adapter.id) throw new TypeError('lifecycle adapter.id is required');
+  for (const operation of LIFECYCLE_OPERATIONS) {
+    if (typeof adapter[operation] !== 'function') throw new TypeError(`${adapter.id}.${operation} must be a function`);
+  }
+  return adapter;
+}
+
+export function ownership({ owner = 'unknown', prior = null, written = null, surface = null } = {}) {
+  assertEnum(owner, OWNERSHIP_TYPES, 'ownership.owner');
+  return immutable({ owner, prior, written, surface });
+}
+
+export function mayUndo(current, record) {
+  if (!record || record.owner !== 'agentic-kit') return false;
+  return Object.is(current, record.written);
+}
+
+export function lifecycleResult({
+  ok = true, changed = false, facts = null, actions = [], ownership: records = [],
+  warnings = [], errors = [],
+} = {}) {
+  for (const list of [actions, records, warnings, errors]) {
+    if (!Array.isArray(list)) throw new TypeError('lifecycle result collections must be arrays');
+  }
+  return immutable({ ok: !!ok, changed: !!changed, facts, actions, ownership: records, warnings, errors });
+}
+
+async function runLifecycleLegacy(adapter, operation, context = {}) {
+  validateLifecycleAdapter(adapter);
+  if (!LIFECYCLE_OPERATIONS.includes(operation)) throw new TypeError(`unknown lifecycle operation: ${operation}`);
+  if (context.dryRun && operation === 'apply') {
+    const plan = await adapter.plan({ ...context, dryRun: true });
+    return lifecycleResult({ ...plan, changed: false });
+  }
+  return lifecycleResult(await adapter[operation](context));
+}
+
+export async function runLifecycle(adapterOrRequest, operation, context = {}) {
+  if (typeof operation === 'string') return runLifecycleLegacy(adapterOrRequest, operation, context);
+  const request = adapterOrRequest;
+  const { adapter, action, dryRun = false } = request;
+  validateLifecycleAdapter(adapter);
+  if (!LIFECYCLE_OPERATIONS.includes(action)) throw new TypeError(`unknown lifecycle operation: ${action}`);
+  if (action === 'detect') return adapter.detect(request);
+  const facts = request.facts ?? await adapter.detect(request);
+  if (action === 'plan') return adapter.plan({ ...request, facts });
+  if (action === 'apply') {
+    const plan = request.plan ?? await adapter.plan({ ...request, facts });
+    if (dryRun) return { dryRun: true, facts, plan };
+    return adapter.apply({ ...request, facts, plan });
+  }
+  if (action === 'verify') return adapter.verify({ ...request, facts });
+  return adapter.undo({ ...request, facts });
+}
diff --git a/src/lib/adapters/migration.mjs b/src/lib/adapters/migration.mjs
new file mode 100644
index 0000000..2ce4f34
--- /dev/null
+++ b/src/lib/adapters/migration.mjs
@@ -0,0 +1,56 @@
+import { immutable } from './schema.mjs';
+
+export const INTEGRATIONS_SCHEMA_VERSION = 1;
+
+export function normalizeIntegrations(config = {}) {
+  const source = /** @type {any} */ (config && typeof config === 'object' ? config : {});
+  const existing = source.integrations && typeof source.integrations === 'object'
+    ? source.integrations : {};
+  if (Number.isInteger(existing.version) && existing.version > INTEGRATIONS_SCHEMA_VERSION) {
+    return immutable(structuredClone(existing));
+  }
+  if (Object.hasOwn(existing, 'bindings') && !Array.isArray(existing.bindings)) {
+    return immutable(structuredClone(existing));
+  }
+  const legacyHosts = source.providers?.hosts && typeof source.providers.hosts === 'object'
+    ? source.providers.hosts : {};
+  const hosts = { ...legacyHosts, ...(existing.hosts ?? {}) };
+  // Migration preserves user intent byte-for-byte structurally. Validation and
+  // resolution are separate operations; enriching a binding here would make
+  // the two public migration entry points oscillate between shapes.
+  const bindings = structuredClone(existing.bindings ?? source.providers?.bindings ?? []);
+  if (!Array.isArray(bindings)) throw new TypeError('integrations.bindings must be an array');
+  return immutable({
+    version: INTEGRATIONS_SCHEMA_VERSION,
+    hosts,
+    bindings,
+  });
+}
+
+export function migrateConfig(config = {}) {
+  const before = /** @type {any} */ (config && typeof config === 'object' ? config : {});
+  if ((Number.isInteger(before.integrations?.version)
+      && before.integrations.version > INTEGRATIONS_SCHEMA_VERSION)
+    || (Object.hasOwn(before.integrations ?? {}, 'bindings')
+      && !Array.isArray(before.integrations.bindings))) {
+    return immutable({ changed: false, config: structuredClone(before) });
+  }
+  const integrations = normalizeIntegrations(before);
+  const current = before.integrations;
+  const changed = !current || current.version !== integrations.version
+    || Object.hasOwn(current, 'schemaVersion')
+    || JSON.stringify(current.hosts ?? {}) !== JSON.stringify(integrations.hosts)
+    || JSON.stringify(current.bindings ?? []) !== JSON.stringify(integrations.bindings);
+  return immutable({
+    changed,
+    config: changed ? { ...structuredClone(before), integrations } : structuredClone(before),
+  });
+}
+
+export function legacyRouteProvider(route, bindings = []) {
+  if (!route?.host) return { provider: null, provenance: 'unknown', binding: null };
+  const candidates = bindings.filter((binding) => binding.host === route.host
+    && (!route.model || !binding.model || binding.model === route.model));
+  if (candidates.length !== 1) return { provider: null, provenance: 'unknown', binding: null };
+  return immutable({ provider: candidates[0].provider, provenance: 'inferred', binding: candidates[0].id });
+}
diff --git a/src/lib/adapters/ownership.mjs b/src/lib/adapters/ownership.mjs
new file mode 100644
index 0000000..3ea4e36
--- /dev/null
+++ b/src/lib/adapters/ownership.mjs
@@ -0,0 +1,37 @@
+const segments = (path) => String(path).split('.').filter(Boolean);
+
+function readAt(value, path) {
+  let cursor = value;
+  for (const key of segments(path)) {
+    if (!cursor || typeof cursor !== 'object') return undefined;
+    cursor = cursor[key];
+  }
+  return cursor;
+}
+
+function restoreAt(value, path, prior) {
+  const keys = segments(path);
+  let cursor = value;
+  for (const key of keys.slice(0, -1)) {
+    if (!cursor[key] || typeof cursor[key] !== 'object') cursor[key] = {};
+    cursor = cursor[key];
+  }
+  const leaf = keys.at(-1);
+  if (prior === undefined) delete cursor[leaf];
+  else cursor[leaf] = structuredClone(prior);
+}
+
+export function undoOwnedValues(current, operations = []) {
+  const value = structuredClone(current);
+  const preserved = [];
+  let changed = false;
+  for (const operation of operations) {
+    if (!Object.is(readAt(value, operation.path), operation.written)) {
+      preserved.push(operation.path);
+      continue;
+    }
+    restoreAt(value, operation.path, operation.prior);
+    changed = true;
+  }
+  return { value, changed, preserved };
+}
diff --git a/src/lib/adapters/registries.mjs b/src/lib/adapters/registries.mjs
new file mode 100644
index 0000000..eb0c9b2
--- /dev/null
+++ b/src/lib/adapters/registries.mjs
@@ -0,0 +1,267 @@
+import {
+  BILLING_TYPES, CREDENTIAL_KINDS, assertEnum, assertId, assertRecord,
+  assertStringArray, immutable, registryFrom,
+} from './schema.mjs';
+
+const HOST_CAPABILITIES = Object.freeze([
+  'canDriveSession', 'canBePrimary', 'canRouteActivities', 'commandStatusline',
+  'transcripts', 'usage', 'nativeMcpConfig', 'nativeGuidance',
+]);
+const PROVIDER_CAPABILITIES = Object.freeze([
+  'modelDiscovery', 'runtimeDiscovery', 'quota', 'pricing', 'cacheAccounting',
+]);
+
+function validateCapabilities(value, names, field) {
+  assertRecord(value, field);
+  for (const name of names) {
+    if (!(name in value)) throw new TypeError(`${field}.${name} is required`);
+    if (name === 'pricing' || name === 'cacheAccounting') {
+      if (typeof value[name] !== 'string') throw new TypeError(`${field}.${name} must be a string`);
+    } else if (typeof value[name] !== 'boolean') {
+      throw new TypeError(`${field}.${name} must be boolean`);
+    }
+  }
+  return value;
+}
+
+export function validateProjectionAdapter(value) {
+  assertRecord(value, 'projection');
+  assertId(value.id, 'projection.id');
+  if (typeof value.label !== 'string' || !value.label) throw new TypeError('projection.label is required');
+  assertEnum(value.format, ['json', 'toml', 'env', 'cli', 'internal'], 'projection.format');
+  return immutable(structuredClone(value));
+}
+
+export function validateObservabilityAdapter(value) {
+  assertRecord(value, 'observability');
+  assertId(value.id, 'observability.id');
+  assertEnum(value.kind, ['transcript', 'usage', 'quota', 'catalog', 'runtime', 'statusline'], 'observability.kind');
+  assertStringArray(value.evidence, 'observability.evidence', { allowEmpty: false });
+  return immutable(structuredClone(value));
+}
+
+export function validateHostAdapter(value, {
+  projections, observability,
+} = /** @type {any} */ ({})) {
+  assertRecord(value, 'host');
+  assertId(value.id, 'host.id');
+  if (typeof value.label !== 'string' || !value.label) throw new TypeError('host.label is required');
+  assertRecord(value.install, 'host.install');
+  if (typeof value.install.bin !== 'string' || !value.install.bin) throw new TypeError('host.install.bin is required');
+  assertEnum(value.install.externalInstallPolicy,
+    ['detect-never-overwrite', 'managed', 'unmanaged'], 'host.install.externalInstallPolicy');
+  validateCapabilities(value.capabilities, HOST_CAPABILITIES, 'host.capabilities');
+  assertId(value.configProjection, 'host.configProjection');
+  assertStringArray(value.observability, 'host.observability');
+  if (projections && !projections[value.configProjection]) {
+    throw new TypeError(`host ${value.id} references unknown projection ${value.configProjection}`);
+  }
+  for (const id of value.observability) {
+    if (observability && !observability[id]) throw new TypeError(`host ${value.id} references unknown observability ${id}`);
+  }
+  return immutable(structuredClone(value));
+}
+
+export function validateProviderAdapter(value, {
+  projections, observability,
+} = /** @type {any} */ ({})) {
+  assertRecord(value, 'provider');
+  assertId(value.id, 'provider.id');
+  if (typeof value.label !== 'string' || !value.label) throw new TypeError('provider.label is required');
+  assertEnum(value.billing, BILLING_TYPES, 'provider.billing');
+  assertRecord(value.credentials, 'provider.credentials');
+  assertEnum(value.credentials.kind, CREDENTIAL_KINDS, 'provider.credentials.kind');
+  if (value.credentials.kind === 'environment') {
+    assertStringArray(value.credentials.env, 'provider.credentials.env', { allowEmpty: false });
+  }
+  if (value.billing === 'local' && value.credentials.kind !== 'none') {
+    throw new TypeError(`local provider ${value.id} cannot require credentials`);
+  }
+  assertStringArray(value.transports, 'provider.transports', { allowEmpty: false });
+  assertStringArray(value.projections, 'provider.projections');
+  assertStringArray(value.observability, 'provider.observability');
+  validateCapabilities(value.capabilities, PROVIDER_CAPABILITIES, 'provider.capabilities');
+  for (const id of value.projections) {
+    if (projections && !projections[id]) throw new TypeError(`provider ${value.id} references unknown projection ${id}`);
+  }
+  for (const id of value.observability) {
+    if (observability && !observability[id]) throw new TypeError(`provider ${value.id} references unknown observability ${id}`);
+  }
+  return immutable(structuredClone(value));
+}
+
+const PROJECTION_MAP = registryFrom([
+  { id: 'claude', label: 'Claude settings and environment', format: 'json' },
+  { id: 'codex', label: 'Codex configuration and profiles', format: 'toml' },
+  { id: 'opencode', label: 'OpenCode configuration', format: 'json' },
+  { id: 'ruflo', label: 'Ruflo router configuration', format: 'cli' },
+  { id: 'aqe', label: 'Agentic QE router configuration', format: 'json' },
+], validateProjectionAdapter, 'projection');
+
+const OBSERVABILITY_MAP = registryFrom([
+  { id: 'claude-transcripts', kind: 'transcript', evidence: ['host', 'model'] },
+  { id: 'claude-statusline', kind: 'statusline', evidence: ['host', 'quota'] },
+  { id: 'codex-transcripts', kind: 'transcript', evidence: ['host', 'model'] },
+  { id: 'codex-app-server', kind: 'quota', evidence: ['host', 'quota'] },
+  { id: 'opencode-logs', kind: 'transcript', evidence: ['host', 'model'] },
+  { id: 'ollama-catalog', kind: 'catalog', evidence: ['provider', 'model', 'digest'] },
+  { id: 'ollama-runtime', kind: 'runtime', evidence: ['provider', 'endpoint'] },
+  { id: 'openrouter-metadata', kind: 'usage', evidence: ['provider', 'model', 'billing'] },
+], validateObservabilityAdapter, 'observability');
+
+const hostEntries = [
+  {
+    id: 'claude', label: 'Claude Code',
+    install: { bin: 'claude', npmPackage: '@anthropic-ai/claude-code', externalInstallPolicy: 'detect-never-overwrite' },
+    capabilities: { canDriveSession: true, canBePrimary: true, canRouteActivities: true, commandStatusline: true, transcripts: true, usage: true, nativeMcpConfig: true, nativeGuidance: true },
+    auth: { apiKeyEnv: ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'], loginFile: ['.claude', '.credentials.json'], keyOverridesLogin: false },
+    legacy: {
+      guidanceFile: 'claude', configFormat: 'json',
+      statusline: { mode: 'command', scope: 'project', customCommand: true, multiline: true },
+      aqeProvider: 'claude-code', envMarkers: ['CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CLAUDE_CODE_SESSION_ID'],
+      enableEnv: 'ENABLE_CLAUDE_CODE',
+    },
+    configProjection: 'claude', observability: ['claude-transcripts', 'claude-statusline'],
+  },
+  {
+    id: 'codex', label: 'OpenAI Codex',
+    install: { bin: 'codex', npmPackage: '@openai/codex', externalInstallPolicy: 'detect-never-overwrite' },
+    capabilities: { canDriveSession: true, canBePrimary: true, canRouteActivities: true, commandStatusline: false, transcripts: true, usage: true, nativeMcpConfig: true, nativeGuidance: true },
+    auth: { apiKeyEnv: ['OPENAI_API_KEY'], loginFile: ['.codex', 'auth.json'], keyOverridesLogin: true },
+    legacy: {
+      guidanceFile: 'agents', configFormat: 'toml',
+      statusline: { mode: 'builtin', scope: 'user', customCommand: false, multiline: false },
+      aqeProvider: 'codex', envMarkers: ['CODEX_SANDBOX', 'CODEX_HOME', 'CODEX_SESSION_ID'],
+      enableEnv: 'ENABLE_CODEX',
+    },
+    configProjection: 'codex', observability: ['codex-transcripts', 'codex-app-server'],
+  },
+  {
+    id: 'opencode', label: 'OpenCode',
+    install: { bin: 'opencode', externalInstallPolicy: 'detect-never-overwrite' },
+    capabilities: { canDriveSession: true, canBePrimary: false, canRouteActivities: false, commandStatusline: false, transcripts: true, usage: false, nativeMcpConfig: true, nativeGuidance: true },
+    auth: { apiKeyEnv: [], keyOverridesLogin: false },
+    configProjection: 'opencode', observability: ['opencode-logs'],
+  },
+];
+
+const providerEntries = [
+  ['anthropic', 'Anthropic', 'subscription', { kind: 'host-login' }, ['native'], ['claude'], []],
+  ['openai', 'OpenAI', 'subscription', { kind: 'host-login' }, ['native', 'openai-compatible'], ['codex'], []],
+  ['google', 'Google Gemini', 'metered', { kind: 'environment', env: ['GOOGLE_API_KEY', 'GEMINI_API_KEY'] }, ['native'], ['ruflo', 'aqe'], []],
+  ['openrouter', 'OpenRouter', 'metered', { kind: 'environment', env: ['OPENROUTER_API_KEY'] }, ['openai-compatible'], ['ruflo', 'aqe', 'claude', 'codex', 'opencode'], ['openrouter-metadata']],
+  ['ollama', 'Ollama', 'local', { kind: 'none' }, ['native', 'openai-compatible', 'anthropic-compatible'], ['ruflo', 'aqe', 'claude', 'codex', 'opencode'], ['ollama-catalog', 'ollama-runtime']],
+].map(([id, label, billing, credentials, transports, projections, observability]) => ({
+  id, label, billing, credentials, transports, projections, observability,
+  legacy: { apiProvider: id !== 'openrouter' },
+  capabilities: {
+    modelDiscovery: id === 'ollama', runtimeDiscovery: id === 'ollama',
+    pricing: id === 'ollama' ? 'zero' : (id === 'openrouter' ? 'dated-offline' : 'provider-specific'),
+    quota: id === 'anthropic' || id === 'openai',
+    cacheAccounting: id === 'ollama' ? 'unknown' : 'provider-dependent',
+  },
+}));
+
+const HOST_MAP = registryFrom(hostEntries,
+  (entry) => validateHostAdapter(entry, { projections: PROJECTION_MAP, observability: OBSERVABILITY_MAP }), 'host');
+const PROVIDER_MAP = registryFrom(providerEntries,
+  (entry) => validateProviderAdapter(entry, { projections: PROJECTION_MAP, observability: OBSERVABILITY_MAP }), 'provider');
+
+export const PROJECTION_REGISTRY = immutable(Object.values(PROJECTION_MAP));
+export const OBSERVABILITY_REGISTRY = immutable(Object.values(OBSERVABILITY_MAP));
+export const HOST_REGISTRY = immutable(Object.values(HOST_MAP));
+export const PROVIDER_REGISTRY = immutable(Object.values(PROVIDER_MAP));
+
+/** @param {(entry: any) => boolean} [predicate] */
+export const hostIds = (predicate = () => true) => HOST_REGISTRY.filter(predicate).map(({ id }) => id);
+/** @param {(entry: any) => boolean} [predicate] */
+export const providerIds = (predicate = () => true) => PROVIDER_REGISTRY.filter(predicate).map(({ id }) => id);
+export const primaryHostIds = () => hostIds((host) => host.capabilities.canBePrimary);
+export const routableHostIds = () => hostIds((host) => host.capabilities.canRouteActivities);
+export function hostsWithCapability(entriesOrCapability, maybeCapability) {
+  const entries = Array.isArray(entriesOrCapability) ? entriesOrCapability : HOST_REGISTRY;
+  const capability = Array.isArray(entriesOrCapability) ? maybeCapability : entriesOrCapability;
+  return entries.filter((host) => host.capabilities?.[capability] === true);
+}
+export function providersWithCapability(entriesOrCapability, maybeCapability) {
+  const entries = Array.isArray(entriesOrCapability) ? entriesOrCapability : PROVIDER_REGISTRY;
+  const capability = Array.isArray(entriesOrCapability) ? maybeCapability : entriesOrCapability;
+  return entries.filter((provider) => provider.capabilities?.[capability] === true);
+}
+
+export function validatePrimaryHost(id, hosts = HOST_REGISTRY) {
+  const host = hosts.find((entry) => entry.id === id);
+  if (!host) return { ok: false, reason: 'unknown-host' };
+  return host.capabilities.canBePrimary
+    ? { ok: true } : { ok: false, reason: 'capability-canBePrimary-required' };
+}
+
+export function validateActivityHost(id, hosts = HOST_REGISTRY) {
+  const host = hosts.find((entry) => entry.id === id);
+  if (!host) return { ok: false, reason: 'unknown-host' };
+  return host.capabilities.canRouteActivities
+    ? { ok: true } : { ok: false, reason: 'capability-canRouteActivities-required' };
+}
+
+export function deriveCompatibilityExports({
+  hosts = HOST_REGISTRY, providers = PROVIDER_REGISTRY,
+} = {}) {
+  const custom = hosts !== HOST_REGISTRY || providers !== PROVIDER_REGISTRY;
+  return {
+    hostIds: hosts.map(({ id }) => id),
+    managedHostIds: hosts.filter((host) => host.capabilities.canRouteActivities).map(({ id }) => id),
+    primaryHostIds: hosts.filter((host) => host.capabilities.canBePrimary).map(({ id }) => id),
+    routableHostIds: hosts.filter((host) => host.capabilities.canRouteActivities).map(({ id }) => id),
+    apiProviderIds: providers.filter((provider) => custom || provider.legacy?.apiProvider).map(({ id }) => id),
+  };
+}
+
+export function validateRegistries(registries) {
+  const errors = [];
+  const axes = ['hosts', 'providers', 'projections', 'observability'];
+  for (const axis of axes) {
+    const seen = new Set();
+    for (const [index, entry] of (registries?.[axis] ?? []).entries()) {
+      if (seen.has(entry.id)) errors.push({ path: `${axis}[${index}].id`, code: 'duplicate-id', value: entry.id });
+      seen.add(entry.id);
+    }
+  }
+  const projections = new Set((registries?.projections ?? []).map((entry) => entry.id));
+  const observability = new Set((registries?.observability ?? []).map((entry) => entry.id));
+  for (const [index, host] of (registries?.hosts ?? []).entries()) {
+    if (!projections.has(host.configProjection)) errors.push({
+      path: `hosts[${index}].configProjection`, code: 'unknown-projection', value: host.configProjection,
+    });
+    for (const [sourceIndex, source] of (host.observability ?? []).entries()) {
+      if (!observability.has(source)) errors.push({
+        path: `hosts[${index}].observability[${sourceIndex}]`, code: 'unknown-observability', value: source,
+      });
+    }
+    if (!host.capabilities?.canDriveSession) {
+      for (const capability of ['canBePrimary', 'canRouteActivities']) {
+        if (host.capabilities?.[capability]) errors.push({
+          path: `hosts[${index}].capabilities.${capability}`, code: 'requires-canDriveSession', value: true,
+        });
+      }
+    }
+  }
+  const envName = /^[A-Z][A-Z0-9_]*$/;
+  for (const [index, provider] of (registries?.providers ?? []).entries()) {
+    const kind = provider.credentials?.kind;
+    if (provider.billing === 'local' && kind !== 'none') errors.push({
+      path: `providers[${index}].credentials.kind`, code: 'local-credentials-must-be-none', value: kind,
+    });
+    if (provider.billing === 'local' && provider.capabilities?.pricing !== 'zero') errors.push({
+      path: `providers[${index}].capabilities.pricing`, code: 'local-pricing-must-be-zero', value: provider.capabilities?.pricing,
+    });
+    if (provider.billing === 'metered' && !['env', 'environment'].includes(kind)) errors.push({
+      path: `providers[${index}].credentials.kind`, code: 'metered-credentials-required', value: kind,
+    });
+    for (const [nameIndex, name] of (provider.credentials?.names ?? provider.credentials?.env ?? []).entries()) {
+      if (!envName.test(name)) errors.push({
+        path: `providers[${index}].credentials.names[${nameIndex}]`, code: 'invalid-env-name', value: name,
+      });
+    }
+  }
+  return errors;
+}
diff --git a/src/lib/adapters/schema.mjs b/src/lib/adapters/schema.mjs
new file mode 100644
index 0000000..60340a1
--- /dev/null
+++ b/src/lib/adapters/schema.mjs
@@ -0,0 +1,51 @@
+const ID_RE = /^[a-z][a-z0-9-]*$/;
+
+export const BILLING_TYPES = Object.freeze(['local', 'subscription', 'metered', 'unknown']);
+export const PROVENANCE_TYPES = Object.freeze(['observed', 'configured', 'inferred', 'unknown']);
+export const CREDENTIAL_KINDS = Object.freeze(['none', 'environment', 'host-login', 'unknown']);
+export const OWNERSHIP_TYPES = Object.freeze(['agentic-kit', 'external', 'user', 'unknown']);
+
+const plain = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+export function assertId(value, field = 'id') {
+  if (typeof value !== 'string' || !ID_RE.test(value)) {
+    throw new TypeError(`${field} must match ${ID_RE}`);
+  }
+  return value;
+}
+
+export function assertEnum(value, allowed, field) {
+  if (!allowed.includes(value)) throw new TypeError(`${field} must be one of: ${allowed.join(', ')}`);
+  return value;
+}
+
+export function assertStringArray(value, field, { allowEmpty = true } = {}) {
+  if (!Array.isArray(value) || (!allowEmpty && value.length === 0)
+    || value.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
+    throw new TypeError(`${field} must be an array of non-empty strings`);
+  }
+  if (new Set(value).size !== value.length) throw new TypeError(`${field} contains duplicates`);
+  return value;
+}
+
+export function assertRecord(value, field) {
+  if (!plain(value)) throw new TypeError(`${field} must be an object`);
+  return value;
+}
+
+export function immutable(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+  for (const child of Object.values(value)) immutable(child);
+  return Object.freeze(value);
+}
+
+export function registryFrom(entries, validate, kind) {
+  if (!Array.isArray(entries)) throw new TypeError(`${kind} registry must be an array`);
+  const out = {};
+  for (const raw of entries) {
+    const entry = validate(raw);
+    if (out[entry.id]) throw new TypeError(`duplicate ${kind} id: ${entry.id}`);
+    out[entry.id] = entry;
+  }
+  return immutable(out);
+}
diff --git a/src/lib/config.mjs b/src/lib/config.mjs
index 342300e..b5e2561 100644
--- a/src/lib/config.mjs
+++ b/src/lib/config.mjs
@@ -4,6 +4,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { kitConfigPath, legacyKitConfigPath } from './paths.mjs';
+import { migrateIntegrationConfig } from './adapters/config.mjs';
 
 const DEFAULTS = {
   aqe: true,            // manage agentic-qe alongside ruflo
@@ -37,7 +38,7 @@ export function loadKitConfig(file = kitConfigPath()) {
   for (const cand of file === kitConfigPath() ? [file, legacyKitConfigPath()] : [file]) {
     try {
       const parsed = JSON.parse(fs.readFileSync(cand, 'utf8'));
-      return {
+      const merged = {
         ...structuredClone(DEFAULTS),
         ...parsed,
         health: { ...DEFAULTS.health, ...parsed.health },
@@ -49,12 +50,15 @@ export function loadKitConfig(file = kitConfigPath()) {
         },
         statusline: { ...DEFAULTS.statusline, ...parsed.statusline },
       };
+      // Normalize additively in memory. Loading never writes; the next explicit
+      // save persists the versioned integration view alongside legacy fields.
+      return structuredClone(migrateIntegrationConfig(merged));
     } catch { /* try next */ }
   }
-  return structuredClone(DEFAULTS);
+  return structuredClone(migrateIntegrationConfig(structuredClone(DEFAULTS)));
 }
 
 export function saveKitConfig(cfg, file = kitConfigPath()) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, JSON.stringify(cfg, null, 2) + '\n');
+  fs.writeFileSync(file, JSON.stringify(migrateIntegrationConfig(cfg), null, 2) + '\n');
 }
diff --git a/src/lib/dashboard/client.mjs b/src/lib/dashboard/client.mjs
index 0208906..426877e 100644
--- a/src/lib/dashboard/client.mjs
+++ b/src/lib/dashboard/client.mjs
@@ -662,8 +662,9 @@ export const JS = `
         +'<span class="db-lab">'+esc(x.day.slice(8))+"</span></div>";
     }).join(""):'<div class="empty">no days in window.</div>';
 
-    // by host
-    var prov=d.byProvider||{};
+    // Host and inference-provider are independent axes. Fall back to the
+    // historical byProvider host map only for pre-migration cached payloads.
+    var prov=d.byHost||d.byTranscriptProvider||d.byProvider||{};
     var order=["claude","codex"];
     for(k in prov)if(order.indexOf(k)<0)order.push(k);
     document.getElementById("u-hosts").innerHTML=order.map(function(name){
@@ -921,7 +922,8 @@ export const JS = `
   // block-level sibling inside .pbody, not a grid child of .srow, so it spans
   // the full width without joining the column layout.
   function sessionRow(sx){
-    var host=(sx.provider==="codex")?"codex":"claude";
+    var host=sx.host||sx.transcriptProvider||((sx.provider==="codex")?"codex":"claude");
+    var provider=sx.provider||sx.inferenceProvider||"unknown";
     var cat=sx.category||"Unclassified";
     var uncl=(cat==="Unclassified");
     var weak=(typeof sx.confidence==="number"&&sx.confidence<0.6)?"0":"1";
@@ -934,7 +936,8 @@ export const JS = `
     return '<div class="srow" data-id="'+sid+'" title="open transcript">'
       +'<button class="s-exp" type="button" aria-expanded="false" aria-controls="sd-'+sid+'"'
         +' title="show session detail" aria-label="show session detail">&rsaquo;</button>'
-      +'<span class="s-host s-'+host+'">'+esc(host)+"</span>"
+      +'<span class="s-host s-'+esc(host)+'" title="host: '+esc(host)+' · provider: '+esc(provider)+'">'+esc(host)
+        +'<small class="s-provider">'+esc(provider)+"</small></span>"
       +'<span class="s-title">'+esc(sx.title||"(untitled)")+wt+"</span>"
       +'<span class="cat'+(uncl?" uncl":"")+'" data-w="'+weak+'">'+esc(cat)+"</span>"
       +'<span class="s-when mono">'+esc(whenTxt)+"</span>"
diff --git a/src/lib/hosts.mjs b/src/lib/hosts.mjs
index c70d55b..265b724 100644
--- a/src/lib/hosts.mjs
+++ b/src/lib/hosts.mjs
@@ -23,42 +23,22 @@
 //     ~/.codex/auth.json (key overrides login). claude auth on macOS lives in the
 //     Keychain (no readable file); ANTHROPIC_API_KEY, when used, is not a simple
 //     override of a subscription login, so we label it conservatively.
+import { HOST_REGISTRY } from './adapters/index.mjs';
 
 /** Per-host adapter descriptors. Logical names (`guidanceFile`, `loginFile`
  *  segments) are resolved to real paths by callers so this stays pure. */
-export const HOST_ADAPTERS = {
-  claude: {
-    id: 'claude',
-    label: 'Claude Code',
-    guidanceFile: 'claude', // logical → CLAUDE.md (machine-wide) / project CLAUDE.md
-    configFormat: 'json', // settings.json
-    statusline: { mode: 'command', scope: 'project', customCommand: true, multiline: true },
-    statuslineSupported: true, // compatibility: command-backed renderer support
-    aqeProvider: 'claude-code',
-    // env vars Claude Code sets in a running session — used to detect the driver.
-    envMarkers: ['CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CLAUDE_CODE_SESSION_ID'],
-    auth: {
-      apiKeyEnv: ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'],
-      loginFile: ['.claude', '.credentials.json'], // present on Linux; macOS uses Keychain
-      keyOverridesLogin: false, // claude precedence is not a plain key-over-login
-    },
-  },
-  codex: {
-    id: 'codex',
-    label: 'OpenAI Codex',
-    guidanceFile: 'agents', // logical → AGENTS.md (+ .codex/AGENTS.override.md)
-    configFormat: 'toml', // ~/.codex/config.toml, [mcp_servers.*]
-    statusline: { mode: 'builtin', scope: 'user', customCommand: false, multiline: false },
-    statuslineSupported: false, // compatibility: no command-backed renderer
-    aqeProvider: 'codex',
-    envMarkers: ['CODEX_SANDBOX', 'CODEX_HOME', 'CODEX_SESSION_ID'],
-    auth: {
-      apiKeyEnv: ['OPENAI_API_KEY'],
-      loginFile: ['.codex', 'auth.json'], // ChatGPT login
-      keyOverridesLogin: true, // grounded: OPENAI_API_KEY ⇒ codex ignores login
-    },
-  },
-};
+export const HOST_ADAPTERS = Object.fromEntries(HOST_REGISTRY
+  .filter((host) => host.capabilities.canRouteActivities)
+  .map((host) => [host.id, {
+    id: host.id, label: host.label,
+    guidanceFile: host.legacy.guidanceFile,
+    configFormat: host.legacy.configFormat,
+    statusline: host.legacy.statusline,
+    statuslineSupported: host.capabilities.commandStatusline,
+    aqeProvider: host.legacy.aqeProvider,
+    envMarkers: host.legacy.envMarkers,
+    auth: host.auth,
+  }]));
 
 /** Ordered host ids (claude first = display order, matches routing.HOSTS). */
 export const HOST_IDS = Object.keys(HOST_ADAPTERS);
diff --git a/src/lib/live/event-schema.mjs b/src/lib/live/event-schema.mjs
index 96ddef7..ed02910 100644
--- a/src/lib/live/event-schema.mjs
+++ b/src/lib/live/event-schema.mjs
@@ -2,8 +2,9 @@ export const LIVE_SCHEMA_VERSION = 1;
 
 const HOSTS = new Set(['claude', 'codex', 'internal']);
 const SURFACES = new Set(['native', 'ruflo', 'aqe', 'plugin', 'skill', 'dual-run']);
-const CONFIDENCE = new Set(['observed', 'correlated', 'inferred', 'assumed', 'planned']);
-const EVIDENCE_FIELDS = ['project', 'provider', 'model', 'status', 'hierarchy'];
+const CONFIDENCE = new Set(['observed', 'configured', 'correlated', 'inferred', 'unknown', 'assumed', 'planned']);
+const PROVIDER_PROVENANCE = new Set(['observed', 'configured', 'inferred', 'unknown']);
+const EVIDENCE_FIELDS = ['host', 'project', 'provider', 'model', 'status', 'hierarchy'];
 const STATUS = new Set([
   'queued', 'running', 'quiescent', 'expired', 'blocked',
   'completed', 'failed', 'cancelled', 'unknown',
@@ -35,6 +36,15 @@ export function createLiveEvent(input, { now = () => new Date().toISOString() }
     throw new TypeError('live event requires sessionId, action and actor.id');
   }
   const host = HOSTS.has(input.host) ? input.host : 'internal';
+  // Preserve the historical actor-level identity accepted from adapters while
+  // exposing the axes at the event level. Provider intentionally has no host
+  // fallback: a transcript proves its host, not which provider served it.
+  const provider = text(input.provider, 96) ?? text(input.actor?.provider, 96);
+  const model = text(input.model, 128) ?? text(input.actor?.model, 128);
+  const providerProvenance = PROVIDER_PROVENANCE.has(input.providerProvenance)
+    ? input.providerProvenance
+    : (PROVIDER_PROVENANCE.has(input.source?.fields?.provider)
+        ? input.source.fields.provider : 'unknown');
   const project = safeProjectLabel(input.project);
   const surface = SURFACES.has(input.surface) ? input.surface : 'native';
   const actorKind = ACTOR_KINDS.has(input.actor?.kind) ? input.actor.kind : 'agent';
@@ -52,6 +62,9 @@ export function createLiveEvent(input, { now = () => new Date().toISOString() }
     spanId: text(input.spanId, 128),
     parentSpanId: text(input.parentSpanId, 128),
     host,
+    provider,
+    model,
+    providerProvenance,
     surface,
     project,
     projectKey: stableProjectKey(project),
@@ -60,8 +73,8 @@ export function createLiveEvent(input, { now = () => new Date().toISOString() }
       kind: actorKind,
       label: text(input.actor?.label, 96),
       role: text(input.actor?.role, 96),
-      provider: text(input.actor?.provider, 96),
-      model: text(input.actor?.model, 128),
+      provider,
+      model,
     },
     action,
     target: input.target?.id ? {
diff --git a/src/lib/providers.mjs b/src/lib/providers.mjs
index f255575..595ee9c 100644
--- a/src/lib/providers.mjs
+++ b/src/lib/providers.mjs
@@ -33,6 +33,9 @@ import * as paths from './paths.mjs';
 import { bold, dim, cyan } from './output.mjs';
 import { policyToAgentOverrides, seedDualRouting, resolveRoutes, routingSummary, divergedRoutes, ACTIVITIES, DEFAULT_PRIMARY_HOST, PRIMARY_HOSTS } from './routing.mjs';
 import { HOST_ADAPTERS } from './hosts.mjs';
+import {
+  HOST_REGISTRY, PROVIDER_REGISTRY, normalizeIntegrationFacts,
+} from './adapters/index.mjs';
 
 /** Frontier agent-CLI hosts. `pkg` is the npm global package; `enableEnv` is
  *  ruflo's ADR-034 backend flag; `aqe` is the AQE_LLM_PROVIDER value (null when
@@ -43,17 +46,25 @@ import { HOST_ADAPTERS } from './hosts.mjs';
  *  only when codex is opted-in AND the codex CLI is detected). */
 export const CODEX_ADAPTER_PKG = '@claude-flow/codex';
 
-export const HOSTS = [
-  { id: 'claude', bin: 'claude', pkg: '@anthropic-ai/claude-code', enableEnv: 'ENABLE_CLAUDE_CODE', aqe: 'claude-code' },
-  { id: 'codex', bin: 'codex', pkg: '@openai/codex', enableEnv: 'ENABLE_CODEX', aqe: null, adapterPkg: CODEX_ADAPTER_PKG },
-];
+export const HOSTS = HOST_REGISTRY
+  .filter((host) => host.capabilities.canRouteActivities)
+  .map((host) => ({
+    id: host.id, bin: host.install.bin, pkg: host.install.npmPackage,
+    enableEnv: host.legacy.enableEnv,
+    aqe: host.id === 'claude' ? host.legacy.aqeProvider : null,
+    ...(host.id === 'codex' ? { adapterPkg: CODEX_ADAPTER_PKG } : {}),
+  }));
 
 /** API-key LLM providers ruflo's router understands (`ruflo providers`). */
+const apiProvider = (id, keyEnv) => {
+  const provider = PROVIDER_REGISTRY.find((entry) => entry.id === id);
+  return { id: provider?.id ?? id, keyEnv };
+};
 export const API_PROVIDERS = [
-  { id: 'anthropic', keyEnv: ['ANTHROPIC_API_KEY'] },
-  { id: 'openai', keyEnv: ['OPENAI_API_KEY'] },
+  apiProvider('anthropic', ['ANTHROPIC_API_KEY']),
+  apiProvider('openai', ['OPENAI_API_KEY']),
   { id: 'google', keyEnv: ['GOOGLE_API_KEY', 'GEMINI_API_KEY'] },
-  { id: 'ollama', keyEnv: [] }, // local; presence = reachable daemon (not checked here)
+  apiProvider('ollama', []), // local; presence = reachable daemon (not checked here)
 ];
 
 /** Valid `AQE_LLM_PROVIDER` values (grounded: aqe ALL_PROVIDER_TYPES in
@@ -74,6 +85,14 @@ export const AQE_PROVIDER_TYPES = [
  *    local — runs locally, no credential ($0)
  *  Keyed by provider id so AQE_PROVIDER_TYPES and this map cannot diverge silently
  *  (a test asserts the two cover exactly the same set). */
+const registryCredential = (id) => {
+  const provider = PROVIDER_REGISTRY.find((entry) => entry.id === id);
+  if (provider?.billing === 'local') return { local: true, billing: 'local' };
+  if (provider?.credentials.kind === 'environment') {
+    return { keyEnv: [...provider.credentials.env], billing: provider.billing };
+  }
+  return null;
+};
 export const AQE_PROVIDER_CREDENTIALS = {
   'claude-code': { host: 'claude', billing: 'subscription' },
   // `codex` is deliberately absent from AQE_PROVIDER_TYPES (that list also gates
@@ -85,11 +104,11 @@ export const AQE_PROVIDER_CREDENTIALS = {
   claude: { keyEnv: ['ANTHROPIC_API_KEY'], billing: 'metered' },
   openai: { keyEnv: ['OPENAI_API_KEY'], billing: 'metered' },
   gemini: { keyEnv: ['GOOGLE_AI_API_KEY', 'GEMINI_API_KEY', 'GOOGLE_API_KEY'], billing: 'metered' },
-  openrouter: { keyEnv: ['OPENROUTER_API_KEY'], billing: 'metered' },
+  openrouter: registryCredential('openrouter'),
   'azure-openai': { keyEnv: ['AZURE_OPENAI_API_KEY'], also: ['AZURE_OPENAI_ENDPOINT'], billing: 'metered' },
   bedrock: { keyEnv: ['AWS_ACCESS_KEY_ID'], also: ['AWS_SECRET_ACCESS_KEY'], billing: 'metered' },
   cognitum: { keyEnv: ['COGNITUM_API_KEY'], billing: 'metered' },
-  ollama: { local: true, billing: 'local' },
+  ollama: registryCredential('ollama'),
   onnx: { local: true, billing: 'local' },
 };
 
@@ -232,14 +251,51 @@ export async function detectHosts(cwd = process.cwd()) {
 }
 
 /** Detect which API providers have credentials available. */
-export function detectProviders() {
+export function detectProviders({ env = process.env } = {}) {
   const out = {};
   for (const p of API_PROVIDERS) {
-    out[p.id] = { keyPresent: p.keyEnv.some((k) => !!process.env[k]) };
+    out[p.id] = { keyPresent: p.keyEnv.some((k) => !!env[k]) };
   }
   return out;
 }
 
+/** One immutable command-facing snapshot of host, provider and binding truth. */
+export async function collectIntegrationFacts({
+  cwd = process.cwd(), cfg = null, env = process.env,
+} = {}) {
+  const detectedHosts = await detectHosts(cwd);
+  const detectedProviders = detectProviders({ env });
+  for (const adapter of PROVIDER_REGISTRY) {
+    if (detectedProviders[adapter.id]) continue;
+    const names = adapter.credentials?.kind === 'environment' ? adapter.credentials.env : [];
+    detectedProviders[adapter.id] = { keyPresent: names.some((name) => !!env[name]) };
+  }
+  const hosts = Object.fromEntries(Object.entries(detectedHosts).map(([id, fact]) => [id, {
+    ...fact,
+    enabled: cfg?.providers?.hosts?.[id] ?? null,
+  }]));
+  const providers = Object.fromEntries(Object.entries(detectedProviders).map(([id, fact]) => {
+    const adapter = PROVIDER_REGISTRY.find((entry) => entry.id === id);
+    return [id, {
+      ...fact,
+      configured: fact.keyPresent || adapter?.billing === 'local',
+      reachable: null,
+      // An API key is metered even when the same vendor also offers a
+      // subscription-backed host login.
+      billing: fact.keyPresent ? 'metered' : (adapter?.billing ?? 'unknown'),
+    }];
+  }));
+  return normalizeIntegrationFacts({
+    hosts,
+    providers,
+    bindings: cfg?.integrations?.bindings ?? cfg?.providers?.bindings ?? [],
+  });
+}
+
+/** Hosts eligible for legacy setup/sync installation and teardown loops. */
+export const commandHosts = () => HOSTS.filter((host) =>
+  HOST_REGISTRY.find((entry) => entry.id === host.id)?.capabilities.canRouteActivities);
+
 /** Where host-enable env lands: project settings.local.json inside a repo (same
  *  seam as CLAUDE_FLOW_DB_PATH), else the user settings.json. Repo membership
  *  is resolved by WALKING UP to .git (paths.repoRoot) and the project file is
@@ -494,7 +550,7 @@ export function formatRoutingTable(cfg) {
     lines.push(`  ${act.padEnd(18)} ${r.host.padEnd(7)} ${(r.model ?? '').padEnd(24)} ${src}${tag}${esc}${div}`);
   }
   if (Object.keys(diverged).length) {
-    lines.push(dim(`  ${Object.keys(diverged).length} seeded route(s) diverge from current defaults — review with: ak x provider refresh`));
+    lines.push(dim(`  ${Object.keys(diverged).length} seeded route(s) diverge from current defaults — review with: ak host refresh`));
   }
   return lines.join('\n');
 }
diff --git a/src/lib/routing.mjs b/src/lib/routing.mjs
index 0e6f047..51b3370 100644
--- a/src/lib/routing.mjs
+++ b/src/lib/routing.mjs
@@ -6,6 +6,7 @@
 // (no I/O) so the projectors and defaults are unit-testable in isolation; the
 // writers/UX that consume it live in providers.mjs / the commands.
 import { vendorOf } from './qeCourt.mjs';
+import { routableHostIds, primaryHostIds } from './adapters/index.mjs';
 
 // ── Vocabulary ───────────────────────────────────────────────────────────────
 // Canonical development activities ak routes (ADR-0002). Array order = display order.
@@ -20,7 +21,7 @@ export const AK_ORIGINATED = new Set(['packaging', 'release']);
 
 // Host → aqe/router provider type. Both are subscription-billed ($0 marginal).
 export const HOST_PROVIDER = { claude: 'claude-code', codex: 'codex' };
-export const HOSTS = Object.keys(HOST_PROVIDER);
+export const HOSTS = routableHostIds();
 
 // Providers aqe's ProviderManager can construct — grounded in agentic-qe 3.13.1
 // RUNTIME_CONSTRUCTIBLE_PROVIDERS ∩ ALL_PROVIDER_TYPES (now includes `codex`,
@@ -109,7 +110,7 @@ export function formatModelHelp() {
 // reasoning roles). When codex is chosen as PRIMARY, we mirror each default route
 // to the opposite host so codex takes the lead and claude becomes the alternate —
 // a defaults/policy change only (DualModeOrchestrator workers are symmetric).
-export const PRIMARY_HOSTS = HOSTS; // both hosts may be primary
+export const PRIMARY_HOSTS = primaryHostIds();
 export const DEFAULT_PRIMARY_HOST = 'claude';
 
 // Model id → tier, so a host swap can pick the counterpart's tier-equivalent.
diff --git a/src/lib/usage-index.mjs b/src/lib/usage-index.mjs
index a9f62bd..29b8a99 100644
--- a/src/lib/usage-index.mjs
+++ b/src/lib/usage-index.mjs
@@ -289,6 +289,26 @@ function applyProject(rec, res) {
   if (res.worktree) rec.worktree = res.worktree;
 }
 
+/**
+ * Split the historical transcript-source `provider` field into an explicit host
+ * and independently evidenced inference provider. The legacy field used
+ * `claude`/`codex` to mean transcript host; those values therefore cannot prove
+ * Anthropic/OpenAI provider identity.
+ */
+export function normalizeSessionIdentity(record = {}) {
+  const legacyHost = !record.host && ['claude', 'codex'].includes(record.provider)
+    ? record.provider : null;
+  const host = record.host ?? legacyHost ?? null;
+  const provider = legacyHost ? null : (record.provider ?? null);
+  return {
+    ...record,
+    host,
+    provider,
+    model: record.model ?? null,
+    providerProvenance: provider ? (record.providerProvenance ?? 'unknown') : 'unknown',
+  };
+}
+
 // ── transcript parsing ──────────────────────────────────────────────────────
 
 /** Split JSONL into parsed objects, skipping anything that will not parse. */
@@ -305,7 +325,8 @@ function* jsonLines(raw) {
  *  and byModel can both be derived without re-reading the transcript. */
 function blankSession(id, provider) {
   return {
-    id, provider, title: '', project: 'unknown', start: null, end: null,
+    id, provider, host: provider, inferenceProvider: null, providerProvenance: 'unknown',
+    title: '', project: 'unknown', start: null, end: null,
     prompts: 0, responses: 0, exceptions: 0, sidechain: false, threadSource: null, models: [], tools: {},
     skill: null, plugin: null, worktree: null, usage: [], punchcard: {}, active: [], stamps: [],
     // Codex-only detail (v6): reasoning tokens inside output, and the last
@@ -889,7 +910,12 @@ function aggregate(records, { days, now, cutoff, deps }) {
     }) ?? {};
 
     sessions.push({
-      id: rec.id, provider: rec.provider, title: rec.title, project: rec.project,
+      id: rec.id, host: rec.host ?? rec.provider,
+      provider: rec.inferenceProvider ?? null,
+      transcriptProvider: rec.provider,
+      inferenceProvider: rec.inferenceProvider ?? null, // compatibility alias
+      providerProvenance: rec.providerProvenance ?? 'unknown',
+      title: rec.title, project: rec.project,
       worktree: rec.worktree ?? null,
       start: new Date(rec.start ?? rec.end).toISOString(),
       minutes: Math.round(((rec.end - (rec.start ?? rec.end)) / 60_000) * 10) / 10,
@@ -927,7 +953,8 @@ function aggregate(records, { days, now, cutoff, deps }) {
     cacheRead: 0, cacheWrite: 0, tokens: 0, cost: 0,
     spanMinutes: 0, spanUnionSeconds: 0, engagedSeconds: 0,
   };
-  const byProvider = Object.create(null), byProject = Object.create(null);
+  const byHost = Object.create(null), byProvider = Object.create(null);
+  const byProject = Object.create(null);
   const byCategory = Object.create(null), punchcard = Object.create(null);
   const tree = new Map();
   let spanMs = 0;
@@ -939,7 +966,8 @@ function aggregate(records, { days, now, cutoff, deps }) {
     totals.tokens += s.tokens; totals.cost += s.cost;
     spanMs += s._span[1] - s._span[0];
 
-    addTo(bucket(byProvider, s.provider), s);
+    addTo(bucket(byHost, s.host ?? 'unknown'), s);
+    addTo(bucket(byProvider, s.provider ?? 'unknown'), s);
     addTo(bucket(byProject, s.project), s);
     addTo(bucket(byCategory, s.category), s);
     // A session that used two models counts once under EACH — the token and
@@ -972,7 +1000,7 @@ function aggregate(records, { days, now, cutoff, deps }) {
   //   spanUnionSeconds — union of whole spans: wall-clock with a session open
   //   spanMinutes      — sum of spans: the double-counting figure, kept as the
   //                      clearly-labelled secondary the ADR asks the UI to show
-  sealBuckets(byProvider, byProject, byCategory, byModel);
+  sealBuckets(byHost, byProvider, byProject, byCategory, byModel);
 
   totals.spanMinutes = Math.round((spanMs / 60_000) * 10) / 10;
   totals.spanUnionSeconds = mergeIntervals(sessions.map((s) => s._span));
@@ -994,7 +1022,7 @@ function aggregate(records, { days, now, cutoff, deps }) {
   // snapshot), oldest first. Claude has no local analogue (its quota arrives
   // via the statusline push — see quota.mjs), hence codex-prefixed.
   const codexRateLimits = sessions
-    .filter((s) => s.provider === 'codex' && s.rateLimits && Number.isFinite(s.rateLimits.at))
+    .filter((s) => s.host === 'codex' && s.rateLimits && Number.isFinite(s.rateLimits.at))
     .map((s) => s.rateLimits)
     .sort((x, y) => x.at - y.at);
 
@@ -1002,7 +1030,9 @@ function aggregate(records, { days, now, cutoff, deps }) {
     generatedAt: new Date(now).toISOString(),
     windowDays: days,
     pricesAsOf: deps.pricesAsOf ?? null,
-    totals, byDay, byModel, byProvider, byProject, byCategory,
+    totals, byDay, byModel, byHost, byProvider,
+    byTranscriptProvider: byHost, // compatibility alias for the historical map
+    byProject, byCategory,
     punchcard, projectTree, sessions, codexRateLimits, insights: [],
   };
   agg.insights = deps.detectInsights(agg) ?? [];
@@ -1286,7 +1316,12 @@ export async function readSession(id, o = {}) {
 
   return {
     meta: {
-      id: rec.id, provider: rec.provider, title: rec.title, project: rec.project,
+      id: rec.id, host: rec.host ?? rec.provider,
+      provider: rec.inferenceProvider ?? null,
+      transcriptProvider: rec.provider,
+      inferenceProvider: rec.inferenceProvider ?? null, // compatibility alias
+      providerProvenance: rec.providerProvenance ?? 'unknown',
+      title: rec.title, project: rec.project,
       worktree: rec.worktree ?? null,
       start: rec.start === null ? null : new Date(rec.start).toISOString(),
       end: rec.end === null ? null : new Date(rec.end).toISOString(),
diff --git a/src/lib/usage-insights.mjs b/src/lib/usage-insights.mjs
index 5f33b0e..1878184 100644
--- a/src/lib/usage-insights.mjs
+++ b/src/lib/usage-insights.mjs
@@ -283,7 +283,7 @@ export function detectInsights(agg) {
           + `${TIER_SAVING_RATIO}.`,
         action: 'Route quick and mechanical activities to the balanced tier in your per-activity '
           + 'policy. Reasoning-heavy activities stay where they are.',
-        command: 'ak x provider pick',
+        command: 'ak host pick',
         impact: round2(saving),
       });
     }
@@ -449,7 +449,7 @@ export function detectInsights(agg) {
         action: 'Route by task complexity: keep routine activities on the cheaper tier and reserve '
           + 'the newest model for genuinely hard work. Confirm against your own workload before '
           + 'changing anything.',
-        command: 'ak x provider pick',
+        command: 'ak host pick',
         sources: MODEL_ROUTING_SOURCES,
       });
     }
@@ -534,7 +534,7 @@ export function detectInsights(agg) {
           + 'consumes the same allowance faster; queueing spreads it more evenly.',
         action: 'Keep parallelism for genuinely independent work; queue the rest, or route some '
           + 'lanes to the other host so the two pools share the load.',
-        command: 'ak x provider pick',
+        command: 'ak host pick',
       });
     }
   }
@@ -654,7 +654,7 @@ export function detectLimitInsights(limits, agg) { // eslint-disable-line no-unu
         + `${Math.round(r.usedPercent)}% consumed vs ${pct(elapsedShare)} elapsed.`,
       action: 'Front-load what matters before the cap, shift routine work to the other host or a '
         + 'cheaper lane, and let non-urgent automation wait for the reset.',
-      command: 'ak x provider pick',
+      command: 'ak host pick',
     });
   }
 
@@ -675,7 +675,7 @@ export function detectLimitInsights(limits, agg) { // eslint-disable-line no-unu
         + 'work routed to the idle pool costs nothing against the strained one.',
       action: 'Shift routine and mechanical activities to the host with headroom in the '
         + 'per-activity routing policy; reasoning-critical work can stay put.',
-      command: 'ak x provider pick',
+      command: 'ak host pick',
     });
     break; // one arbitrage finding is guidance; one per hot window is nagging
   }
diff --git a/tests/dashboard.test.cjs b/tests/dashboard.test.cjs
index 4f44a30..8459c2b 100644
--- a/tests/dashboard.test.cjs
+++ b/tests/dashboard.test.cjs
@@ -353,7 +353,18 @@ async function main() {
     totals: { sessions: 2, responses: 9, input: 100, output: 200, cacheRead: 900, cacheWrite: 50, tokens: 1250, cost: 12.5, spanMinutes: 90, engagedSeconds: 3600 },
     byDay: { '2026-07-24': { tokens: 1000, cost: 10, sessions: 1 } },
     byModel: { 'claude-opus-5': { cost: 12.5, tokens: 1250, responses: 9 } },
-    byProvider: { claude: { cost: 12.5, sessions: 2 } },
+    byHost: {
+      claude: { cost: 10, sessions: 1, tokens: 1000 },
+      codex: { cost: 2.5, sessions: 1, tokens: 250 },
+    },
+    byProvider: {
+      anthropic: { cost: 10, sessions: 1, tokens: 1000 },
+      unknown: { cost: null, sessions: 1, tokens: 250 },
+    },
+    byTranscriptProvider: {
+      claude: { cost: 10, sessions: 1, tokens: 1000 },
+      codex: { cost: 2.5, sessions: 1, tokens: 250 },
+    },
     byProject: { demo: { cost: 12.5, sessions: 2 } },
     byCategory: { 'Security review': { cost: 12.5, sessions: 2, confidence: 0.8 } },
     punchcard: { '0-13': 4 },
@@ -365,13 +376,17 @@ async function main() {
       project: 'demo', sessions: 40, cost: 12.5, tokens: 1250, minutes: 90,
       categories: [{ category: 'Security review', sessions: 2, cost: 12.5 }],
       rows: Array.from({ length: 40 }, (_, i) => ({
-        id: `row-${i}`, provider: 'claude', title: `session ${i}`, project: 'demo',
+        id: `row-${i}`, host: 'claude', provider: i ? 'anthropic' : null,
+        providerProvenance: i ? 'observed' : 'unknown',
+        transcriptProvider: 'claude', title: `session ${i}`, project: 'demo',
         category: 'Security review', cost: 0.25, minutes: 2, tokens: 100,
       })),
     }],
     sessions: [
-      { id: 'aaa', provider: 'claude', title: 'one', project: 'demo', category: 'Security review', cost: 10 },
-      { id: 'bbb', provider: 'codex', title: 'two', project: 'other', category: 'Refactor', cost: 2.5 },
+      { id: 'aaa', host: 'claude', provider: 'anthropic', providerProvenance: 'observed',
+        transcriptProvider: 'claude', title: 'one', project: 'demo', category: 'Security review', cost: 10 },
+      { id: 'bbb', host: 'codex', provider: null, providerProvenance: 'unknown',
+        transcriptProvider: 'codex', title: 'two', project: 'other', category: 'Refactor', cost: 2.5 },
     ],
     insights: [{ id: 'context-tax', kind: 'coach', severity: 'warn', title: 't', finding: 'f', evidence: 'e', action: 'a', command: null, impact: 3.5 }],
   };
@@ -533,6 +548,15 @@ async function main() {
       }
     });
 
+    await test('Usage rendering treats host and inference provider as independent axes', async () => {
+      const r = await get(uiSrv.url);
+      contains(r.body, 'd.byHost||d.byTranscriptProvider||d.byProvider');
+      contains(r.body, 'var host=sx.host||sx.transcriptProvider');
+      contains(r.body, 'var provider=sx.provider||sx.inferenceProvider||"unknown"');
+      contains(r.body, 'title="host: ');
+      contains(r.body, 'class="s-provider"');
+    });
+
     await test('served HTML carries the read-only Live Sessions surface', async () => {
       const r = await get(uiSrv.url);
       for (const marker of [
@@ -1219,7 +1243,7 @@ async function main() {
   // is the suite where it matters most — the traversal-guard and credential-
   // leak tests live here and were the reviewer's cited example of a block
   // that could silently vanish with the old harness never noticing.
-  const EXPECTED = 56;
+  const EXPECTED = 57;
   if (passed + failed !== EXPECTED) {
     console.error(`\nPLAN MISMATCH: expected ${EXPECTED} tests, ran ${passed + failed}`);
     process.exit(1);
diff --git a/tests/kit/adapter-lifecycle-conformance.test.mjs b/tests/kit/adapter-lifecycle-conformance.test.mjs
new file mode 100644
index 0000000..b05be7d
--- /dev/null
+++ b/tests/kit/adapter-lifecycle-conformance.test.mjs
@@ -0,0 +1,99 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { runLifecycle } from '../../src/lib/adapters/lifecycle.mjs';
+import { undoOwnedValues } from '../../src/lib/adapters/ownership.mjs';
+import {
+  assertNoWrites, fakeLifecycleAdapter, fakeSurface,
+} from './helpers/lifecycle-harness.mjs';
+
+test('detect is read-only and returns observed facts', async () => {
+  const surface = fakeSurface({ enabled: false, user: 'keep' });
+  const before = surface.snapshot();
+  const result = await runLifecycle({
+    adapter: fakeLifecycleAdapter(surface),
+    action: 'detect',
+  });
+  assert.deepEqual(result, { observed: { enabled: false, user: 'keep' } });
+  assertNoWrites(surface, before, 'detect must not write');
+});
+
+test('planning is deterministic, read-only, and does not mutate detected facts', async () => {
+  const surface = fakeSurface({ enabled: false });
+  const adapter = fakeLifecycleAdapter(surface);
+  const facts = { observed: { enabled: false } };
+  const original = structuredClone(facts);
+  const first = await runLifecycle({ adapter, action: 'plan', facts });
+  const second = await runLifecycle({ adapter, action: 'plan', facts });
+  assert.deepEqual(second, first);
+  assert.deepEqual(facts, original);
+  assert.deepEqual(first.operations, [{ path: 'enabled', prior: false, written: true }]);
+  assertNoWrites(surface, { enabled: false }, 'plan must not write');
+});
+
+test('dry-run detects and plans but never calls apply', async () => {
+  const surface = fakeSurface({ enabled: false });
+  const adapter = fakeLifecycleAdapter(surface);
+  let applyCalls = 0;
+  const realApply = adapter.apply;
+  adapter.apply = (context) => {
+    applyCalls++;
+    return realApply(context);
+  };
+  const result = await runLifecycle({ adapter, action: 'apply', dryRun: true });
+  assert.equal(result.dryRun, true);
+  assert.equal(result.plan.changed, true);
+  assert.equal(applyCalls, 0);
+  assertNoWrites(surface, { enabled: false }, 'dry-run must not write');
+});
+
+test('apply is idempotent after the desired state is reached', async () => {
+  const surface = fakeSurface({ enabled: false, user: 'keep' });
+  const adapter = fakeLifecycleAdapter(surface);
+  const first = await runLifecycle({ adapter, action: 'apply' });
+  const second = await runLifecycle({ adapter, action: 'apply' });
+  assert.equal(first.changed, true);
+  assert.equal(second.changed, false);
+  assert.deepEqual(surface.snapshot(), { enabled: true, user: 'keep' });
+});
+
+test('verify reports observed truth rather than the planned value', async () => {
+  const surface = fakeSurface({ enabled: false });
+  const adapter = fakeLifecycleAdapter(surface);
+  const plan = await runLifecycle({ adapter, action: 'plan' });
+  surface.replace({ enabled: 'externally-changed' });
+  const verified = await runLifecycle({ adapter, action: 'verify', plan });
+  assert.deepEqual(verified, { observed: { enabled: 'externally-changed' } });
+});
+
+test('undo restores only a value still equal to the value ak wrote', () => {
+  assert.deepEqual(undoOwnedValues(
+    { enabled: true, user: 'keep' },
+    [{ path: 'enabled', prior: false, written: true }],
+  ), {
+    value: { enabled: false, user: 'keep' },
+    changed: true,
+    preserved: [],
+  });
+});
+
+test('undo preserves a user value changed after apply', () => {
+  assert.deepEqual(undoOwnedValues(
+    { enabled: 'user-choice', user: 'keep' },
+    [{ path: 'enabled', prior: false, written: true }],
+  ), {
+    value: { enabled: 'user-choice', user: 'keep' },
+    changed: false,
+    preserved: ['enabled'],
+  });
+});
+
+test('undo removes an ak-created value while preserving sibling configuration', () => {
+  assert.deepEqual(undoOwnedValues(
+    { env: { AK_MANAGED: 'yes', USER_KEY: 'keep' } },
+    [{ path: 'env.AK_MANAGED', prior: undefined, written: 'yes' }],
+  ), {
+    value: { env: { USER_KEY: 'keep' } },
+    changed: true,
+    preserved: [],
+  });
+});
diff --git a/tests/kit/adapter-registries.test.mjs b/tests/kit/adapter-registries.test.mjs
new file mode 100644
index 0000000..d349a8e
--- /dev/null
+++ b/tests/kit/adapter-registries.test.mjs
@@ -0,0 +1,103 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  HOST_REGISTRY,
+  PROVIDER_REGISTRY,
+  PROJECTION_REGISTRY,
+  OBSERVABILITY_REGISTRY,
+  validateRegistries,
+} from '../../src/lib/adapters/index.mjs';
+import {
+  validHost, validProvider, validRegistries,
+} from './helpers/integration-builders.mjs';
+
+test('the built-in registries satisfy their own contract', () => {
+  assert.deepEqual(validateRegistries({
+    hosts: HOST_REGISTRY,
+    providers: PROVIDER_REGISTRY,
+    projections: PROJECTION_REGISTRY,
+    observability: OBSERVABILITY_REGISTRY,
+  }), []);
+});
+
+test('built-in ids are unique within each registry and host/provider axes stay distinct', () => {
+  for (const [axis, entries] of Object.entries({
+    hosts: HOST_REGISTRY,
+    providers: PROVIDER_REGISTRY,
+    projections: PROJECTION_REGISTRY,
+    observability: OBSERVABILITY_REGISTRY,
+  })) {
+    const ids = entries.map((entry) => entry.id);
+    assert.equal(new Set(ids).size, ids.length, `${axis} ids must be unique`);
+  }
+  const hostIds = new Set(HOST_REGISTRY.map((entry) => entry.id));
+  for (const provider of PROVIDER_REGISTRY) {
+    assert.equal(hostIds.has(provider.id), false, `${provider.id} must not also be a host`);
+  }
+});
+
+test('registry validation reports duplicate ids with a deterministic field path', () => {
+  const registries = validRegistries({
+    hosts: [validHost(), validHost({ label: 'Duplicate host' })],
+  });
+  assert.deepEqual(validateRegistries(registries), [
+    { path: 'hosts[1].id', code: 'duplicate-id', value: 'test-host' },
+  ]);
+});
+
+test('registry validation rejects dangling projection and observability references', () => {
+  const registries = validRegistries({
+    hosts: [validHost({
+      configProjection: 'missing-projection',
+      observability: ['missing-source'],
+    })],
+  });
+  assert.deepEqual(validateRegistries(registries), [
+    { path: 'hosts[0].configProjection', code: 'unknown-projection', value: 'missing-projection' },
+    { path: 'hosts[0].observability[0]', code: 'unknown-observability', value: 'missing-source' },
+  ]);
+});
+
+test('routing and primary capabilities require a session-driving host', () => {
+  const registries = validRegistries({
+    hosts: [validHost({ capabilities: {
+      ...validHost().capabilities,
+      canDriveSession: false,
+      canBePrimary: true,
+      canRouteActivities: true,
+    } })],
+  });
+  assert.deepEqual(validateRegistries(registries), [
+    { path: 'hosts[0].capabilities.canBePrimary', code: 'requires-canDriveSession', value: true },
+    { path: 'hosts[0].capabilities.canRouteActivities', code: 'requires-canDriveSession', value: true },
+  ]);
+});
+
+test('billing and credential combinations reject fabricated local and metered semantics', () => {
+  const localWithKey = validProvider({
+    id: 'bad-local',
+    billing: 'local',
+    credentials: { kind: 'env', names: ['LOCAL_API_KEY'] },
+    capabilities: { ...validProvider().capabilities, pricing: 'dated-offline' },
+  });
+  const meteredWithoutKey = validProvider({
+    id: 'bad-metered',
+    billing: 'metered',
+    credentials: { kind: 'none' },
+  });
+  const errors = validateRegistries(validRegistries({ providers: [localWithKey, meteredWithoutKey] }));
+  assert.deepEqual(errors, [
+    { path: 'providers[0].credentials.kind', code: 'local-credentials-must-be-none', value: 'env' },
+    { path: 'providers[0].capabilities.pricing', code: 'local-pricing-must-be-zero', value: 'dated-offline' },
+    { path: 'providers[1].credentials.kind', code: 'metered-credentials-required', value: 'none' },
+  ]);
+});
+
+test('credential descriptors contain environment variable names, never credential values', () => {
+  const provider = validProvider({
+    credentials: { kind: 'env', names: ['sk-secret-value'] },
+  });
+  assert.deepEqual(validateRegistries(validRegistries({ providers: [provider] })), [
+    { path: 'providers[0].credentials.names[0]', code: 'invalid-env-name', value: 'sk-secret-value' },
+  ]);
+});
diff --git a/tests/kit/capability-derived.test.mjs b/tests/kit/capability-derived.test.mjs
new file mode 100644
index 0000000..671960c
--- /dev/null
+++ b/tests/kit/capability-derived.test.mjs
@@ -0,0 +1,88 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  hostsWithCapability,
+  providersWithCapability,
+  deriveCompatibilityExports,
+  validatePrimaryHost,
+  validateActivityHost,
+} from '../../src/lib/adapters/index.mjs';
+import { HOSTS as LEGACY_PROVIDER_HOSTS, API_PROVIDERS } from '../../src/lib/providers.mjs';
+import {
+  HOSTS as LEGACY_ROUTING_HOSTS,
+  PRIMARY_HOSTS,
+  isRoutableHost,
+} from '../../src/lib/routing.mjs';
+import { validHost, validProvider } from './helpers/integration-builders.mjs';
+
+const hosts = [
+  validHost({ id: 'claude', label: 'Claude Code' }),
+  validHost({ id: 'codex', label: 'Codex CLI' }),
+  validHost({
+    id: 'future-host',
+    label: 'Future Host',
+    capabilities: {
+      ...validHost().capabilities,
+      canBePrimary: false,
+      canRouteActivities: false,
+      transcripts: false,
+    },
+  }),
+];
+
+const providers = [
+  validProvider({ id: 'anthropic' }),
+  validProvider({ id: 'openai' }),
+  validProvider({
+    id: 'future-provider',
+    capabilities: {
+      ...validProvider().capabilities,
+      modelDiscovery: true,
+    },
+  }),
+];
+
+test('host selectors derive behavior solely from capability flags', () => {
+  assert.deepEqual(hostsWithCapability(hosts, 'canDriveSession').map(({ id }) => id),
+    ['claude', 'codex', 'future-host']);
+  assert.deepEqual(hostsWithCapability(hosts, 'canBePrimary').map(({ id }) => id),
+    ['claude', 'codex']);
+  assert.deepEqual(hostsWithCapability(hosts, 'canRouteActivities').map(({ id }) => id),
+    ['claude', 'codex']);
+  assert.deepEqual(hostsWithCapability(hosts, 'transcripts').map(({ id }) => id),
+    ['claude', 'codex']);
+});
+
+test('a managed future host can participate in lifecycle without becoming routable', () => {
+  assert.deepEqual(validatePrimaryHost('future-host', hosts), {
+    ok: false, reason: 'capability-canBePrimary-required',
+  });
+  assert.deepEqual(validateActivityHost('future-host', hosts), {
+    ok: false, reason: 'capability-canRouteActivities-required',
+  });
+  assert.deepEqual(validatePrimaryHost('claude', hosts), { ok: true });
+  assert.deepEqual(validateActivityHost('codex', hosts), { ok: true });
+});
+
+test('provider selectors add a future provider without adding a host', () => {
+  assert.deepEqual(providersWithCapability(providers, 'modelDiscovery').map(({ id }) => id),
+    ['future-provider']);
+  assert.equal(hosts.some(({ id }) => id === 'future-provider'), false);
+});
+
+test('compatibility exports are derived views of registries', () => {
+  const compatibility = deriveCompatibilityExports({ hosts, providers });
+  assert.deepEqual(compatibility.hostIds, ['claude', 'codex', 'future-host']);
+  assert.deepEqual(compatibility.primaryHostIds, ['claude', 'codex']);
+  assert.deepEqual(compatibility.routableHostIds, ['claude', 'codex']);
+  assert.deepEqual(compatibility.apiProviderIds, ['anthropic', 'openai', 'future-provider']);
+});
+
+test('current compatibility exports remain aligned with built-in registry views', () => {
+  const compatibility = deriveCompatibilityExports();
+  assert.deepEqual(LEGACY_ROUTING_HOSTS, compatibility.routableHostIds);
+  assert.deepEqual(PRIMARY_HOSTS, compatibility.primaryHostIds);
+  assert.deepEqual(LEGACY_PROVIDER_HOSTS.map(({ id }) => id), compatibility.managedHostIds);
+  assert.deepEqual(API_PROVIDERS.map(({ id }) => id), compatibility.apiProviderIds);
+  for (const id of compatibility.routableHostIds) assert.equal(isRoutableHost(id), true);
+});
diff --git a/tests/kit/cli-help.test.mjs b/tests/kit/cli-help.test.mjs
index a6801a0..ed5a159 100644
--- a/tests/kit/cli-help.test.mjs
+++ b/tests/kit/cli-help.test.mjs
@@ -31,7 +31,8 @@ test('mutating commands intercept both --help and -h before running', () => {
 
 test('every command exposes an Examples section in its help', () => {
   for (const cmd of [['setup'], ['status'], ['sync'], ['dual'], ['dashboard'], ['uninstall'],
-    ['x', 'mcp'], ['x', 'provider'], ['x', 'verify'], ['x', 'reference'], ['x', 'daemon-gc']]) {
+    ['host'], ['provider'], ['x', 'mcp'], ['x', 'host'], ['x', 'provider'],
+    ['x', 'verify'], ['x', 'reference'], ['x', 'daemon-gc']]) {
     const r = ak(...cmd, '--help');
     assert.equal(r.status, 0, `${cmd.join(' ')} exit`);
     assert.match(r.stdout, /Examples:/, `${cmd.join(' ')} examples`);
diff --git a/tests/kit/dispatch-surface.test.mjs b/tests/kit/dispatch-surface.test.mjs
index a765229..8e93ede 100644
--- a/tests/kit/dispatch-surface.test.mjs
+++ b/tests/kit/dispatch-surface.test.mjs
@@ -41,6 +41,8 @@ test('dispatch table parses and covers the previously-omitted commands', () => {
   assert.ok(table.size >= 6, `expected several commands, parsed ${table.size}`);
   assert.ok(table.has('dual'), 'dual must be in the dispatch table');
   assert.ok(table.has('dashboard'), 'dashboard must be in the dispatch table');
+  assert.ok(table.has('host'), 'canonical host management must be in the dispatch table');
+  assert.ok(table.has('provider'), 'deprecated provider shim must remain in the dispatch table');
 });
 
 // One test per command: loads, and exposes a complete help surface.
diff --git a/tests/kit/helpers/integration-builders.mjs b/tests/kit/helpers/integration-builders.mjs
new file mode 100644
index 0000000..ceb9d44
--- /dev/null
+++ b/tests/kit/helpers/integration-builders.mjs
@@ -0,0 +1,84 @@
+export function validHost(overrides = {}) {
+  return {
+    id: 'test-host',
+    label: 'Test Host',
+    install: { bin: 'test-host', externalInstallPolicy: 'detect-never-overwrite' },
+    capabilities: {
+      canDriveSession: true,
+      canBePrimary: true,
+      canRouteActivities: true,
+      transcripts: true,
+      usage: true,
+      nativeMcpConfig: true,
+      nativeGuidance: true,
+    },
+    auth: { apiKeyEnv: ['TEST_HOST_API_KEY'], keyOverridesLogin: false },
+    configProjection: 'test-projection',
+    observability: ['test-transcripts'],
+    ...overrides,
+  };
+}
+
+export function validProvider(overrides = {}) {
+  return {
+    id: 'test-provider',
+    label: 'Test Provider',
+    billing: 'metered',
+    credentials: { kind: 'env', names: ['TEST_PROVIDER_API_KEY'] },
+    transports: ['openai-compatible'],
+    capabilities: {
+      modelDiscovery: false,
+      runtimeDiscovery: false,
+      pricing: 'dated-offline',
+      quota: false,
+      cacheAccounting: 'unknown',
+    },
+    projections: ['test-projection'],
+    observability: ['test-provider-metadata'],
+    ...overrides,
+  };
+}
+
+export function validProjection(overrides = {}) {
+  return {
+    id: 'test-projection',
+    format: 'json',
+    lifecycle: ['detect', 'plan', 'apply', 'verify', 'undo'],
+    ...overrides,
+  };
+}
+
+export function validObservability(overrides = {}) {
+  return {
+    id: 'test-transcripts',
+    kinds: ['transcript'],
+    ...overrides,
+  };
+}
+
+export function validBinding(overrides = {}) {
+  return {
+    id: 'test-provider-via-test-host',
+    host: 'test-host',
+    provider: 'test-provider',
+    transport: 'openai-compatible',
+    endpoint: 'https://inference.example.test/v1',
+    model: 'test/model',
+    source: 'user',
+    managedBy: 'agentic-kit',
+    ...overrides,
+  };
+}
+
+export function validRegistries(overrides = {}) {
+  return {
+    hosts: [validHost()],
+    providers: [validProvider()],
+    projections: [validProjection()],
+    observability: [
+      validObservability(),
+      validObservability({ id: 'test-provider-metadata', kinds: ['provider-metadata'] }),
+    ],
+    ...overrides,
+  };
+}
diff --git a/tests/kit/helpers/lifecycle-harness.mjs b/tests/kit/helpers/lifecycle-harness.mjs
new file mode 100644
index 0000000..7c53cee
--- /dev/null
+++ b/tests/kit/helpers/lifecycle-harness.mjs
@@ -0,0 +1,65 @@
+import assert from 'node:assert/strict';
+
+export function fakeSurface(initial = {}) {
+  let state = structuredClone(initial);
+  const calls = [];
+  return {
+    calls,
+    read() {
+      calls.push(['read']);
+      return structuredClone(state);
+    },
+    write(next) {
+      calls.push(['write', structuredClone(next)]);
+      state = structuredClone(next);
+    },
+    snapshot() {
+      return structuredClone(state);
+    },
+    replace(next) {
+      state = structuredClone(next);
+    },
+  };
+}
+
+export function fakeLifecycleAdapter(surface, desired = { enabled: true }) {
+  return {
+    id: 'fake-projection',
+    detect() {
+      return { observed: surface.read() };
+    },
+    plan({ facts }) {
+      const prior = facts.observed.enabled;
+      return {
+        changed: prior !== desired.enabled,
+        operations: prior === desired.enabled ? [] : [{
+          path: 'enabled', prior, written: desired.enabled,
+        }],
+      };
+    },
+    apply({ plan }) {
+      if (!plan.changed) return { changed: false };
+      const next = surface.read();
+      next.enabled = desired.enabled;
+      surface.write(next);
+      return { changed: true };
+    },
+    verify() {
+      return { observed: surface.read() };
+    },
+    undo({ ownership }) {
+      const next = surface.read();
+      const owned = ownership.operations[0];
+      if (next.enabled !== owned.written) return { changed: false, preservedUserValue: true };
+      if (owned.prior === undefined) delete next.enabled;
+      else next.enabled = owned.prior;
+      surface.write(next);
+      return { changed: true };
+    },
+  };
+}
+
+export function assertNoWrites(surface, before, message) {
+  assert.deepEqual(surface.snapshot(), before, message);
+  assert.equal(surface.calls.some(([kind]) => kind === 'write'), false, message);
+}
diff --git a/tests/kit/host-cli-migration.test.mjs b/tests/kit/host-cli-migration.test.mjs
new file mode 100644
index 0000000..9084059
--- /dev/null
+++ b/tests/kit/host-cli-migration.test.mjs
@@ -0,0 +1,117 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const BIN = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../bin/agentic-kit.mjs');
+
+function sandbox() {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'ak-host-cli-'));
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'ak-host-project-'));
+  fs.mkdirSync(path.join(project, '.git'));
+  const config = path.join(home, '.config');
+  return {
+    home,
+    project,
+    env: {
+      ...process.env,
+      NO_COLOR: '1',
+      HOME: home,
+      USERPROFILE: home,
+      XDG_CONFIG_HOME: config,
+      APPDATA: config,
+      PATH: path.join(home, 'no-such-bin'),
+    },
+  };
+}
+
+function ak(sb, ...args) {
+  return spawnSync(process.execPath, [BIN, ...args], {
+    cwd: sb.project,
+    env: sb.env,
+    encoding: 'utf8',
+  });
+}
+
+const output = (result) => `${result.stdout}\n${result.stderr}`;
+
+test('top-level ak host is the canonical management command', () => {
+  const sb = sandbox();
+  const result = ak(sb, 'host', '--help');
+  assert.equal(result.status, 0, output(result));
+  assert.match(result.stdout, /^ak host — /);
+  assert.match(result.stdout, /status\s+\(default\)/);
+  assert.match(result.stdout, /pick\s+/);
+  assert.match(result.stdout, /refresh\s+/);
+  assert.match(result.stdout, /off\s+/);
+  assert.doesNotMatch(output(result), /deprecated/i);
+});
+
+test('ak host status dispatches the existing read-only status semantics', () => {
+  const sb = sandbox();
+  const result = ak(sb, 'host', 'status', '--json');
+  assert.equal(result.status, 0, output(result));
+  const payload = JSON.parse(result.stdout);
+  assert.equal(typeof payload.hosts, 'object');
+  assert.equal(typeof payload.providers, 'object',
+    'host management retains the existing host/provider fact payload during migration');
+});
+
+test('ak host preserves pick option parsing without performing an interactive run', () => {
+  const sb = sandbox();
+  const result = ak(sb, 'host', 'pick', '--help');
+  assert.equal(result.status, 0, output(result));
+  assert.match(result.stdout, /--host claude,codex/);
+  assert.match(result.stdout, /--primary-host claude\|codex/);
+  assert.match(result.stdout, /--aqe-provider/);
+  assert.match(result.stdout, /--provider <csv>/);
+});
+
+test('legacy top-level ak provider remains a functional deprecation shim', () => {
+  const sb = sandbox();
+  const result = ak(sb, 'provider', '--help');
+  assert.equal(result.status, 0, output(result));
+  assert.match(result.stdout, /status\s+\(default\)/);
+  assert.match(output(result), /ak provider is deprecated/i);
+  assert.match(output(result), /use `?ak host`?/i);
+  assert.match(output(result), /removed before (?:the )?stable release/i);
+});
+
+test('legacy provider shim delegates status and warns exactly once', () => {
+  const sb = sandbox();
+  const result = ak(sb, 'provider', 'status', '--json');
+  assert.equal(result.status, 0, output(result));
+  assert.doesNotThrow(() => JSON.parse(result.stdout));
+  const warnings = output(result).match(/ak provider is deprecated/gi) ?? [];
+  assert.equal(warnings.length, 1);
+});
+
+test('plumbing host and provider aliases remain available during migration', () => {
+  const sb = sandbox();
+  for (const name of ['host', 'provider']) {
+    const result = ak(sb, 'x', name, '--help');
+    assert.equal(result.status, 0, `${name}\n${output(result)}`);
+    assert.match(result.stdout, /status\s+\(default\)/);
+  }
+});
+
+test('top-level help advertises host canonically and labels provider deprecated', () => {
+  const sb = sandbox();
+  const result = ak(sb, '--help');
+  assert.equal(result.status, 0, output(result));
+  assert.match(result.stdout, /^\s+ak host\s+/m);
+  assert.match(result.stdout, /^\s+ak provider\s+.*deprecated/im);
+  assert.ok(result.stdout.indexOf('ak host') < result.stdout.indexOf('ak provider'),
+    'canonical host command should be listed before its legacy shim');
+});
+
+test('plumbing index advertises x host canonically and marks x provider deprecated', () => {
+  const sb = sandbox();
+  const result = ak(sb, '--help', '--all');
+  assert.equal(result.status, 0, output(result));
+  assert.match(result.stdout, /^\s+ak x host\s+/m);
+  assert.match(result.stdout, /^\s+ak x provider\s+.*deprecated/im);
+});
diff --git a/tests/kit/integration-command-facts.test.mjs b/tests/kit/integration-command-facts.test.mjs
new file mode 100644
index 0000000..daae584
--- /dev/null
+++ b/tests/kit/integration-command-facts.test.mjs
@@ -0,0 +1,33 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { collectIntegrationFacts, commandHosts } from '../../src/lib/providers.mjs';
+import { HOST_REGISTRY } from '../../src/lib/adapters/index.mjs';
+
+test('commands share one immutable normalized integration snapshot', async () => {
+  const cfg = {
+    providers: { hosts: { claude: true, codex: false } },
+    integrations: {
+      bindings: [{
+        host: 'claude', provider: 'ollama', model: 'qwen3.6:latest',
+        provenance: 'configured',
+      }],
+    },
+  };
+  const facts = await collectIntegrationFacts({
+    cwd: process.cwd(), cfg, env: { OPENROUTER_API_KEY: 'present-only-in-memory' },
+  });
+  assert.equal(Object.isFrozen(facts), true);
+  assert.equal(facts.hosts.claude.enabled, true);
+  assert.equal(facts.providers.openrouter.keyPresent, true);
+  assert.equal(facts.bindings[0].host, 'claude');
+  assert.equal(facts.bindings[0].provider, 'ollama');
+  assert.equal(JSON.stringify(facts).includes('present-only-in-memory'), false);
+});
+
+test('managed but non-routable OpenCode never enters legacy install/routing loops', () => {
+  const opencode = HOST_REGISTRY.find(({ id }) => id === 'opencode');
+  assert.ok(opencode);
+  assert.equal(opencode.capabilities.canDriveSession, true);
+  assert.equal(opencode.capabilities.canRouteActivities, false);
+  assert.equal(commandHosts().some(({ id }) => id === 'opencode'), false);
+});
diff --git a/tests/kit/integration-config.test.mjs b/tests/kit/integration-config.test.mjs
new file mode 100644
index 0000000..0fd8b3a
--- /dev/null
+++ b/tests/kit/integration-config.test.mjs
@@ -0,0 +1,120 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  CURRENT_INTEGRATIONS_VERSION,
+  migrateIntegrationConfig,
+  validateEndpoint,
+} from '../../src/lib/adapters/config.mjs';
+import { migrateConfig } from '../../src/lib/adapters/migration.mjs';
+
+const legacyDual = {
+  providers: {
+    hosts: { claude: true, codex: true },
+    aqeProvider: null,
+    dualRouting: {
+      implementation: {
+        host: 'codex', model: 'gpt-5.4', source: 'user',
+        escalate: [{ host: 'claude', model: 'claude-opus-5' }],
+      },
+    },
+    customUserField: { preserve: true },
+  },
+  unrelated: 'keep-me',
+};
+
+test('legacy migration is additive, versioned, deterministic, and idempotent', () => {
+  const input = structuredClone(legacyDual);
+  const first = migrateIntegrationConfig(input);
+  const second = migrateIntegrationConfig(structuredClone(first));
+  assert.equal(first.integrations.version, CURRENT_INTEGRATIONS_VERSION);
+  assert.deepEqual(second, first);
+  assert.deepEqual(input, legacyDual, 'migration must not mutate its input');
+  assert.equal(first.unrelated, 'keep-me');
+  assert.deepEqual(first.providers.customUserField, { preserve: true });
+  assert.deepEqual(first.providers.dualRouting, legacyDual.providers.dualRouting,
+    'legacy routing intent must survive byte-for-byte structurally');
+});
+
+test('public migration helpers converge on one canonical integrations.version field', () => {
+  const first = migrateIntegrationConfig(structuredClone(legacyDual));
+  const middle = migrateConfig(structuredClone(first)).config;
+  const final = migrateIntegrationConfig(structuredClone(middle));
+  assert.deepEqual(final, first);
+  assert.equal(final.integrations.version, CURRENT_INTEGRATIONS_VERSION);
+  assert.equal(Object.hasOwn(final.integrations, 'schemaVersion'), false);
+});
+
+test('future integration versions are preserved opaquely and never downgraded', () => {
+  const future = {
+    unrelated: 'keep',
+    integrations: {
+      version: CURRENT_INTEGRATIONS_VERSION + 10,
+      bindings: { futureShape: ['opaque', 'intent'] },
+      futureField: { preserve: true },
+    },
+  };
+  assert.deepEqual(migrateIntegrationConfig(structuredClone(future)), future);
+  assert.deepEqual(migrateConfig(structuredClone(future)).config, future);
+});
+
+test('malformed current-version bindings are preserved rather than silently dropped', () => {
+  const malformed = {
+    integrations: {
+      version: CURRENT_INTEGRATIONS_VERSION,
+      bindings: { not: 'an array' },
+    },
+  };
+  assert.deepEqual(migrateIntegrationConfig(structuredClone(malformed)), malformed);
+  assert.deepEqual(migrateConfig(structuredClone(malformed)).config, malformed);
+});
+
+test('legacy host routes never manufacture observed provider provenance', () => {
+  const migrated = migrateIntegrationConfig(structuredClone(legacyDual));
+  const route = migrated.integrations.bindings.find((binding) => binding.host === 'codex');
+  assert.ok(route, 'migration should expose a normalized binding for an enabled legacy host');
+  assert.ok(['inferred', 'unknown'].includes(route.provenance));
+  assert.notEqual(route.provenance, 'observed');
+});
+
+test('migration never persists API keys found in process environment', () => {
+  const migrated = migrateIntegrationConfig(structuredClone(legacyDual), {
+    env: {
+      ANTHROPIC_API_KEY: 'anthropic-secret',
+      OPENAI_API_KEY: 'openai-secret',
+      OPENROUTER_API_KEY: 'openrouter-secret',
+    },
+  });
+  const serialized = JSON.stringify(migrated);
+  for (const secret of ['anthropic-secret', 'openai-secret', 'openrouter-secret']) {
+    assert.equal(serialized.includes(secret), false);
+  }
+});
+
+test('endpoint validation accepts loopback HTTP and remote HTTPS', () => {
+  for (const endpoint of [
+    'http://127.0.0.1:11434',
+    'http://localhost:11434/v1/',
+    'http://[::1]:11434/v1',
+    'https://openrouter.ai/api/v1',
+  ]) {
+    assert.deepEqual(validateEndpoint(endpoint), { ok: true, normalized: endpoint },
+      `expected valid endpoint: ${endpoint}`);
+  }
+});
+
+test('endpoint validation rejects unsafe or ambiguous endpoints', () => {
+  const cases = new Map([
+    ['http://inference.example.test/v1', 'remote-http'],
+    ['https://user:secret@example.test/v1', 'embedded-credentials'],
+    ['https://example.test/v1#token', 'fragment'],
+    ['file:///tmp/socket', 'unsupported-protocol'],
+    ['http://localhost.example.test:11434', 'remote-http'],
+    ['https://example.test/v1?api_key=secret', 'secret-query'],
+    ['https://example.test/v1?signature=secret', 'secret-query'],
+    ['not a url', 'invalid-url'],
+  ]);
+  for (const [endpoint, reason] of cases) {
+    assert.deepEqual(validateEndpoint(endpoint), { ok: false, reason },
+      `expected ${reason}: ${endpoint}`);
+  }
+});
diff --git a/tests/kit/integration-facts.test.mjs b/tests/kit/integration-facts.test.mjs
new file mode 100644
index 0000000..6d04872
--- /dev/null
+++ b/tests/kit/integration-facts.test.mjs
@@ -0,0 +1,140 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  normalizeIntegrationFacts,
+  resolveBinding,
+  validateBinding,
+  assertValidBinding,
+} from '../../src/lib/adapters/index.mjs';
+import {
+  validBinding, validRegistries,
+} from './helpers/integration-builders.mjs';
+
+test('one provider binds independently to multiple hosts', () => {
+  const registries = validRegistries();
+  const claude = validBinding({
+    id: 'ollama-via-claude', host: 'claude', provider: 'ollama',
+    transport: 'anthropic-compatible', endpoint: 'http://127.0.0.1:11434',
+    model: 'qwen3.6:latest',
+  });
+  const codex = validBinding({
+    id: 'ollama-via-codex', host: 'codex', provider: 'ollama',
+    transport: 'openai-compatible', endpoint: 'http://127.0.0.1:11434/v1/',
+    model: 'qwen3-coder:30b',
+  });
+  const bindings = [claude, codex];
+  assert.notEqual(bindings[0].id, bindings[1].id);
+  assert.equal(bindings[0].provider, bindings[1].provider);
+  assert.equal(resolveBinding(bindings, { host: 'claude', provider: 'ollama' }).id, claude.id);
+  assert.equal(resolveBinding(bindings, { host: 'codex', provider: 'ollama' }).id, codex.id);
+  assert.deepEqual(validateBinding(claude, registries, {
+    hosts: ['claude'], providers: ['ollama'],
+    transports: { ollama: ['anthropic-compatible', 'openai-compatible'] },
+  }), []);
+});
+
+test('binding validation rejects dangling axes and unsupported transports', () => {
+  const binding = validBinding({
+    host: 'missing-host', provider: 'missing-provider', transport: 'native',
+  });
+  assert.deepEqual(validateBinding(binding, validRegistries()), [
+    { path: 'binding.host', code: 'unknown-host', value: 'missing-host' },
+    { path: 'binding.provider', code: 'unknown-provider', value: 'missing-provider' },
+    { path: 'binding.transport', code: 'unsupported-transport', value: 'native' },
+  ]);
+});
+
+test('strict binding validation rejects credential-bearing endpoints', () => {
+  const registries = validRegistries();
+  for (const endpoint of [
+    'https://user:secret@inference.example.test/v1',
+    'https://inference.example.test/v1#secret',
+    'https://inference.example.test/v1?token=secret',
+    'http://inference.example.test/v1',
+  ]) {
+    assert.throws(() => assertValidBinding(validBinding({ endpoint }), registries),
+      /invalid endpoint/);
+  }
+});
+
+test('ambiguous matching bindings remain unresolved', () => {
+  const bindings = [
+    validBinding({ id: 'first', endpoint: 'https://one.example.test/v1' }),
+    validBinding({ id: 'second', endpoint: 'https://two.example.test/v1' }),
+  ];
+  assert.equal(resolveBinding(bindings, {
+    host: 'test-host', provider: 'test-provider',
+  }), null);
+  assert.equal(resolveBinding(bindings, {
+    host: 'test-host', provider: 'test-provider',
+    endpoint: 'https://two.example.test/v1',
+  }).id, 'second');
+});
+
+test('normalized facts keep host, provider, model, billing, and provenance separate', () => {
+  const facts = normalizeIntegrationFacts({
+    hosts: { claude: { present: true, enabled: true } },
+    providers: { ollama: { configured: true, reachable: true, billing: 'local' } },
+    bindings: [{
+      host: 'claude', provider: 'ollama', model: 'qwen3.6:latest',
+      provenance: 'configured', reachable: true,
+    }],
+  });
+  assert.equal(facts.hosts.claude.present, true);
+  assert.equal(facts.providers.ollama.billing, 'local');
+  assert.deepEqual(facts.bindings[0], {
+    host: 'claude',
+    provider: 'ollama',
+    model: 'qwen3.6:latest',
+    billing: 'local',
+    provenance: 'configured',
+    reachable: true,
+    pricing: 0,
+    quota: null,
+    cacheAccounting: null,
+  });
+});
+
+test('unknown facts remain unknown rather than becoming free or subscription defaults', () => {
+  const facts = normalizeIntegrationFacts({
+    hosts: { claude: { present: true } },
+    bindings: [{ host: 'claude', model: 'unidentified-model', provenance: 'unknown' }],
+  });
+  assert.deepEqual(facts.bindings[0], {
+    host: 'claude',
+    provider: null,
+    model: 'unidentified-model',
+    billing: 'unknown',
+    provenance: 'unknown',
+    reachable: null,
+    pricing: null,
+    quota: null,
+    cacheAccounting: null,
+  });
+});
+
+test('host transcript evidence alone cannot upgrade provider provenance to observed', () => {
+  const facts = normalizeIntegrationFacts({
+    hosts: { claude: { present: true } },
+    bindings: [{
+      host: 'claude', provider: 'ollama', provenance: 'configured',
+      evidence: [{ kind: 'host-transcript', host: 'claude' }],
+    }],
+  });
+  assert.equal(facts.bindings[0].provenance, 'configured');
+});
+
+test('observed provider evidence outranks configured and inferred evidence', () => {
+  const facts = normalizeIntegrationFacts({
+    bindings: [{
+      host: 'codex', provider: 'openrouter', model: 'z-ai/glm-5.2',
+      provenance: 'configured',
+      evidence: [
+        { kind: 'legacy-route', provenance: 'inferred' },
+        { kind: 'provider-response', provider: 'openrouter', provenance: 'observed' },
+      ],
+    }],
+  });
+  assert.equal(facts.bindings[0].provenance, 'observed');
+  assert.equal(facts.bindings[0].provider, 'openrouter');
+});
diff --git a/tests/kit/live-qe-contract.test.mjs b/tests/kit/live-qe-contract.test.mjs
index 0f429ed..35045cd 100644
--- a/tests/kit/live-qe-contract.test.mjs
+++ b/tests/kit/live-qe-contract.test.mjs
@@ -13,7 +13,8 @@ const observedAt = '2026-07-27T12:00:00Z';
 test('canonical event serialization is a closed allowlist under arbitrary extra fields', () => {
   const allowedTop = new Set([
     'schemaVersion', 'observedAt', 'sourceTimestamp', 'sessionId', 'sessionKey',
-    'parentSessionId', 'traceId', 'spanId', 'parentSpanId', 'host', 'surface',
+    'parentSessionId', 'traceId', 'spanId', 'parentSpanId', 'host',
+    'provider', 'model', 'providerProvenance', 'surface',
     'project', 'projectKey', 'actor',
     'action', 'target', 'status', 'source', 'attributes',
   ]);
diff --git a/tests/kit/observability-identity.test.mjs b/tests/kit/observability-identity.test.mjs
new file mode 100644
index 0000000..e13c60b
--- /dev/null
+++ b/tests/kit/observability-identity.test.mjs
@@ -0,0 +1,113 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { normalizeSessionIdentity } from '../../src/lib/usage-index.mjs';
+import { createLiveEvent } from '../../src/lib/live/index.mjs';
+import { groupUsageByIntegrationAxes } from '../../src/lib/adapters/facts.mjs';
+
+test('legacy usage records gain an explicit host without claiming an observed provider', () => {
+  assert.deepEqual(normalizeSessionIdentity({
+    id: 'legacy-claude',
+    provider: 'claude',
+    model: 'claude-opus-5',
+  }), {
+    id: 'legacy-claude',
+    host: 'claude',
+    provider: null,
+    model: 'claude-opus-5',
+    providerProvenance: 'unknown',
+  });
+  assert.deepEqual(normalizeSessionIdentity({
+    id: 'legacy-codex',
+    provider: 'codex',
+  }), {
+    id: 'legacy-codex',
+    host: 'codex',
+    provider: null,
+    model: null,
+    providerProvenance: 'unknown',
+  });
+});
+
+test('new usage records retain independently observed host and provider identity', () => {
+  assert.deepEqual(normalizeSessionIdentity({
+    id: 'r1',
+    host: 'claude',
+    provider: 'ollama',
+    model: 'qwen3.6:latest',
+    providerProvenance: 'observed',
+  }), {
+    id: 'r1',
+    host: 'claude',
+    provider: 'ollama',
+    model: 'qwen3.6:latest',
+    providerProvenance: 'observed',
+  });
+});
+
+test('a host transcript with configured provider evidence does not become observed', () => {
+  const event = createLiveEvent({
+    sessionId: 's1',
+    observedAt: '2026-07-28T12:00:00.000Z',
+    host: 'claude',
+    provider: 'ollama',
+    providerProvenance: 'configured',
+    model: 'qwen3.6:latest',
+    surface: 'native',
+    actor: { id: 's1', kind: 'session' },
+    action: 'session.started',
+    status: 'running',
+    source: {
+      adapter: 'claude-transcript',
+      confidence: 'observed',
+      fields: { host: 'observed', provider: 'configured', model: 'configured' },
+    },
+  });
+  assert.equal(event.host, 'claude');
+  assert.equal(event.provider, 'ollama');
+  assert.equal(event.model, 'qwen3.6:latest');
+  assert.equal(event.providerProvenance, 'configured');
+  assert.equal(event.source.fields.host, 'observed');
+  assert.equal(event.source.fields.provider, 'configured');
+});
+
+test('live events preserve unknown provider identity rather than defaulting from host', () => {
+  const event = createLiveEvent({
+    sessionId: 's2',
+    observedAt: '2026-07-28T12:00:00.000Z',
+    host: 'codex',
+    surface: 'native',
+    actor: { id: 's2', kind: 'session' },
+    action: 'session.started',
+    status: 'running',
+    source: { adapter: 'codex-transcript', confidence: 'observed' },
+  });
+  assert.equal(event.host, 'codex');
+  assert.equal(event.provider, null);
+  assert.equal(event.providerProvenance, 'unknown');
+});
+
+test('dashboard facts group host and provider axes independently', () => {
+  const grouped = groupUsageByIntegrationAxes([
+    { host: 'claude', provider: 'anthropic', tokens: 10, cost: 1 },
+    { host: 'claude', provider: 'ollama', tokens: 20, cost: 0 },
+    { host: 'codex', provider: 'ollama', tokens: 30, cost: 0 },
+    { host: 'codex', provider: null, tokens: 40, cost: null },
+  ]);
+  assert.deepEqual(grouped.byHost, {
+    claude: { sessions: 2, tokens: 30, cost: 1 },
+    codex: { sessions: 2, tokens: 70, cost: null },
+  });
+  assert.deepEqual(grouped.byProvider, {
+    anthropic: { sessions: 1, tokens: 10, cost: 1 },
+    ollama: { sessions: 2, tokens: 50, cost: 0 },
+    unknown: { sessions: 1, tokens: 40, cost: null },
+  });
+});
+
+test('dashboard grouping never turns unknown price into zero', () => {
+  const grouped = groupUsageByIntegrationAxes([
+    { host: 'claude', provider: 'openrouter', tokens: 100, cost: null },
+  ]);
+  assert.equal(grouped.byProvider.openrouter.cost, null);
+  assert.equal(grouped.byHost.claude.cost, null);
+});
diff --git a/tests/kit/provider-cli.test.mjs b/tests/kit/provider-cli.test.mjs
index f9c6984..0f290f9 100644
--- a/tests/kit/provider-cli.test.mjs
+++ b/tests/kit/provider-cli.test.mjs
@@ -30,7 +30,7 @@ function rm(...dirs) {
   for (const d of dirs) fs.rmSync(d, { recursive: true, force: true });
 }
 
-function ak(args, { cwd, home }) {
+function ak(args, { cwd, home, env = {} }) {
   const cfgDir = path.join(home, '.config');
   return spawnSync(process.execPath, [BIN, ...args], {
     encoding: 'utf8',
@@ -42,10 +42,32 @@ function ak(args, { cwd, home }) {
       USERPROFILE: home, // Windows os.homedir() reads USERPROFILE, not HOME
       XDG_CONFIG_HOME: cfgDir,
       APPDATA: cfgDir, // Windows configBase() reads APPDATA, not XDG_CONFIG_HOME
+      ...env,
     },
   });
 }
 
+test('ak host status preserves key presence without exposing the key value', () => {
+  const { home, project } = sandbox({ hosts: { claude: true, codex: false } });
+  const secret = 'openai-secret-must-never-serialize';
+  const human = ak(['host', 'status'], {
+    cwd: project, home, env: { OPENAI_API_KEY: secret },
+  });
+  assert.equal(human.status, 0, human.stderr);
+  assert.match(human.stdout, /openai\s+key present/);
+  assert.equal(human.stdout.includes(secret), false);
+
+  const json = ak(['host', 'status', '--json'], {
+    cwd: project, home, env: { OPENAI_API_KEY: secret },
+  });
+  assert.equal(json.status, 0, json.stderr);
+  const payload = JSON.parse(json.stdout);
+  assert.equal(payload.providers.openai.keyPresent, true);
+  assert.equal(payload.providers.openai.credentialPresent, true);
+  assert.equal(json.stdout.includes(secret), false);
+  rm(home, project);
+});
+
 test('ak x provider status prints the dual-host guidance tips once both hosts are enabled', () => {
   const { home, project } = sandbox({ hosts: { claude: true, codex: true } });
   const r = ak(['x', 'provider', 'status'], { cwd: project, home });
diff --git a/tests/kit/provider-credentials.test.mjs b/tests/kit/provider-credentials.test.mjs
index b699191..7ee4fc9 100644
--- a/tests/kit/provider-credentials.test.mjs
+++ b/tests/kit/provider-credentials.test.mjs
@@ -15,7 +15,7 @@ import { AQE_CONSTRUCTIBLE_PROVIDERS } from '../../src/lib/routing.mjs';
 import {
   AQE_PROVIDER_TYPES, AQE_PROVIDER_CREDENTIALS, aqeProviderCredential,
   credentialGaps, detectAqeProviders, fallbackSource,
-  applyAqeRouter, aqeRouterFile,
+  applyAqeRouter, aqeRouterFile, collectIntegrationFacts,
 } from '../../src/lib/providers.mjs';
 
 // An env with NO provider credentials at all — the baseline every "absent" case
@@ -283,6 +283,39 @@ test('detectAqeProviders shows openrouter as present when OPENROUTER_API_KEY is
   assert.equal(got.openai.present, false, 'and a keyless provider must not read as configured');
 });
 
+test('collectIntegrationFacts bills Anthropic/OpenAI API-key configurations as metered', async () => {
+  const keyedDir = tmpProject();
+  const keylessDir = tmpProject();
+  try {
+    const keyed = await collectIntegrationFacts({
+      cwd: keyedDir,
+      cfg: defaultCfg(),
+      env: {
+        ANTHROPIC_API_KEY: 'anthropic-test-key',
+        OPENAI_API_KEY: 'openai-test-key',
+      },
+    });
+    for (const id of ['anthropic', 'openai']) {
+      assert.equal(keyed.providers[id].configured, true, `${id} key is configured`);
+      assert.equal(keyed.providers[id].billing, 'metered',
+        `${id} API-key inference is metered, regardless of the registry's host-login default`);
+    }
+
+    const keyless = await collectIntegrationFacts({
+      cwd: keylessDir,
+      cfg: defaultCfg(),
+      env: BARE_ENV,
+    });
+    assert.equal(keyless.providers.anthropic.configured, false);
+    assert.equal(keyless.providers.anthropic.billing, 'subscription');
+    assert.equal(keyless.providers.openai.configured, false);
+    assert.equal(keyless.providers.openai.billing, 'subscription');
+  } finally {
+    rm(keyedDir);
+    rm(keylessDir);
+  }
+});
+
 // ── fallbackSource (provenance stamping, #55 item 4) ───────────────────────
 
 test('fallbackSource treats a legacy unstamped chain entry as a deliberate user pin', () => {
diff --git a/tests/kit/provider-proving-integrations.test.mjs b/tests/kit/provider-proving-integrations.test.mjs
new file mode 100644
index 0000000..00e0ef6
--- /dev/null
+++ b/tests/kit/provider-proving-integrations.test.mjs
@@ -0,0 +1,72 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  BUILTIN_BINDINGS,
+  HOST_REGISTRY,
+  PROVIDER_REGISTRY,
+  resolveBinding,
+} from '../../src/lib/adapters/index.mjs';
+
+const provider = (id) => PROVIDER_REGISTRY.find((entry) => entry.id === id);
+
+test('Ollama is one local provider with truthful bounded capabilities', () => {
+  const ollama = provider('ollama');
+  assert.ok(ollama);
+  assert.equal(ollama.billing, 'local');
+  assert.deepEqual(ollama.credentials, { kind: 'none' });
+  assert.equal(ollama.capabilities.modelDiscovery, true);
+  assert.equal(ollama.capabilities.runtimeDiscovery, true);
+  assert.equal(ollama.capabilities.pricing, 'zero');
+  assert.equal(ollama.capabilities.quota, false);
+  assert.equal(ollama.capabilities.cacheAccounting, 'unknown');
+});
+
+test('Ollama has independent Claude and Codex bindings to the same provider', () => {
+  const claude = resolveBinding(BUILTIN_BINDINGS, { host: 'claude', provider: 'ollama' });
+  const codex = resolveBinding(BUILTIN_BINDINGS, { host: 'codex', provider: 'ollama' });
+  assert.ok(claude);
+  assert.ok(codex);
+  assert.notEqual(claude.id, codex.id);
+  assert.equal(claude.transport, 'anthropic-compatible');
+  assert.equal(codex.transport, 'openai-compatible');
+  assert.equal(claude.endpoint, 'http://127.0.0.1:11434');
+  assert.equal(codex.endpoint, 'http://127.0.0.1:11434/v1/');
+  assert.equal(claude.managedBy, 'external');
+  assert.equal(codex.managedBy, 'external');
+});
+
+test('removing one Ollama binding does not alter or disable the other', () => {
+  const withoutClaude = BUILTIN_BINDINGS.filter(({ id }) => id !== 'ollama-via-claude');
+  assert.equal(resolveBinding(withoutClaude, { host: 'claude', provider: 'ollama' }), null);
+  assert.equal(resolveBinding(withoutClaude, { host: 'codex', provider: 'ollama' }).id,
+    'ollama-via-codex');
+});
+
+test('OpenRouter is a provider only and never becomes a transcript or routing host', () => {
+  const openrouter = provider('openrouter');
+  assert.ok(openrouter);
+  assert.equal(openrouter.billing, 'metered');
+  assert.equal(HOST_REGISTRY.some(({ id }) => id === 'openrouter'), false);
+  assert.equal(BUILTIN_BINDINGS.some(({ host }) => host === 'openrouter'), false);
+  assert.deepEqual(openrouter.transports, ['openai-compatible']);
+  assert.equal(openrouter.capabilities.pricing, 'dated-offline');
+});
+
+test('OpenRouter identity stores only an environment variable name', () => {
+  const openrouter = provider('openrouter');
+  assert.deepEqual(openrouter.credentials, {
+    kind: 'environment',
+    env: ['OPENROUTER_API_KEY'],
+  });
+  const serialized = JSON.stringify(openrouter);
+  assert.equal(serialized.includes('sk-or-'), false);
+  assert.equal(serialized.includes('apiKey'), false);
+});
+
+test('OpenRouter observability is provider evidence, not host evidence', () => {
+  const openrouter = provider('openrouter');
+  assert.deepEqual(openrouter.observability, ['openrouter-metadata']);
+  for (const host of HOST_REGISTRY) {
+    assert.equal(host.observability.includes('openrouter-metadata'), false);
+  }
+});
diff --git a/tests/kit/usage-index.test.mjs b/tests/kit/usage-index.test.mjs
index 1919441..a6a0ae1 100644
--- a/tests/kit/usage-index.test.mjs
+++ b/tests/kit/usage-index.test.mjs
@@ -280,7 +280,9 @@ test('buildIndex parses a Claude session into the Session contract', async () =>
   const s = byId(agg, 'aaaa1111');
 
   assert.ok(s, 'session present');
-  assert.equal(s.provider, 'claude');
+  assert.equal(s.host, 'claude');
+  assert.equal(s.provider, null);
+  assert.equal(s.transcriptProvider, 'claude');
   assert.equal(s.title, 'Add rate limiting to the API');
   assert.equal(s.project, 'proj');
   assert.equal(s.start, '2026-07-24T10:00:00.000Z');
@@ -360,7 +362,9 @@ test('Codex tokens come from the LAST token_count event, never the sum', async (
   const s = byId(agg, 'dddd4444');
 
   assert.ok(s, 'codex session present');
-  assert.equal(s.provider, 'codex');
+  assert.equal(s.host, 'codex');
+  assert.equal(s.provider, null);
+  assert.equal(s.transcriptProvider, 'codex');
   // Last event: input_tokens 3000, cached_input_tokens 1200, output 300.
   // Summing the two events would give 4000/1600/400 — that is the bug this guards.
   assert.equal(s.input, 1800, 'input excludes cached_input_tokens');
@@ -446,7 +450,8 @@ test('buildIndex emits the documented Aggregate shape', async () => {
   const agg = await buildIndex(opts(sb));
 
   for (const k of ['generatedAt', 'windowDays', 'pricesAsOf', 'totals', 'byDay', 'byModel',
-    'byProvider', 'byProject', 'byCategory', 'punchcard', 'projectTree', 'sessions', 'insights']) {
+    'byHost', 'byProvider', 'byTranscriptProvider', 'byProject', 'byCategory',
+    'punchcard', 'projectTree', 'sessions', 'insights']) {
     assert.ok(k in agg, `missing ${k}`);
   }
   assert.equal(agg.windowDays, 14);
@@ -587,7 +592,7 @@ test('engaged time unions across sessions, not just within one', async () => {
   assert.equal(agg.totals.spanMinutes, 20, 'the summed figure still double-counts, by design');
 });
 
-test('byDay, byModel, byProvider, byProject and byCategory partition the same spend', async () => {
+test('byDay, byModel, byHost, byProvider, byProject and byCategory partition the same spend', async () => {
   _resetForTest();
   const sb = sandbox();
   const agg = await buildIndex(opts(sb));
@@ -595,10 +600,13 @@ test('byDay, byModel, byProvider, byProject and byCategory partition the same sp
 
   assert.equal(sum(agg.byDay), agg.totals.tokens);
   assert.equal(sum(agg.byModel), agg.totals.tokens);
+  assert.equal(sum(agg.byHost), agg.totals.tokens);
   assert.equal(sum(agg.byProvider), agg.totals.tokens);
   assert.equal(sum(agg.byProject), agg.totals.tokens);
   assert.equal(sum(agg.byCategory), agg.totals.tokens);
-  assert.deepEqual(Object.keys(agg.byProvider).sort(), ['claude', 'codex']);
+  assert.deepEqual(Object.keys(agg.byHost).sort(), ['claude', 'codex']);
+  assert.deepEqual(Object.keys(agg.byProvider), ['unknown']);
+  assert.deepEqual(agg.byTranscriptProvider, agg.byHost);
   // byDay keys are LOCAL calendar days, so a far-eastern tz may split the
   // fixtures' 09:00–12:00Z across two adjacent days. Both are in-window.
   for (const day of Object.keys(agg.byDay)) {
@@ -613,6 +621,7 @@ test('session counts are attributable in every keyed map', async () => {
   const agg = await buildIndex(opts(sb));
   const count = (m) => Object.values(m).reduce((a, v) => a + v.sessions, 0);
 
+  assert.equal(count(agg.byHost), agg.totals.sessions);
   assert.equal(count(agg.byProvider), agg.totals.sessions);
   assert.equal(count(agg.byProject), agg.totals.sessions);
   assert.equal(count(agg.byCategory), agg.totals.sessions);
@@ -951,7 +960,9 @@ test('readSession returns meta + turns for a Claude session', async () => {
   const { meta, turns } = await readSession('aaaa1111', opts(sb));
 
   assert.equal(meta.id, 'aaaa1111');
-  assert.equal(meta.provider, 'claude');
+  assert.equal(meta.host, 'claude');
+  assert.equal(meta.provider, null);
+  assert.equal(meta.transcriptProvider, 'claude');
   assert.equal(meta.title, 'Add rate limiting to the API');
   assert.ok(turns.length >= 5);
   assert.equal(turns[0].role, 'user');
@@ -975,7 +986,9 @@ test('readSession works without a prior buildIndex (no cache to consult)', async
   const sb = sandbox();
   const { meta } = await readSession('dddd4444', opts(sb));
   assert.equal(meta.id, 'dddd4444');
-  assert.equal(meta.provider, 'codex');
+  assert.equal(meta.host, 'codex');
+  assert.equal(meta.provider, null);
+  assert.equal(meta.transcriptProvider, 'codex');
 });
 
 // code-quality Finding 5 regressions: readCache()/locate() are now memoized
diff --git a/tests/kit/usage-limit-insights.test.mjs b/tests/kit/usage-limit-insights.test.mjs
index a6e6462..bea2dc6 100644
--- a/tests/kit/usage-limit-insights.test.mjs
+++ b/tests/kit/usage-limit-insights.test.mjs
@@ -78,7 +78,7 @@ test('cross-host-arbitrage fires when one host is hot and the other idle', () =>
   });
   const f = byId(detectLimitInsights(l, null), 'cross-host-arbitrage-claude');
   assert.ok(f, 'expected an arbitrage finding');
-  assert.equal(f.command, 'ak x provider pick');
+  assert.equal(f.command, 'ak host pick');
   assert.match(f.title, /89%/);
   assert.match(f.title, /3%/);
 });

From f58a379527fa4a45ec12096ac53513808031fdf1 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 21:25:04 -0700
Subject: [PATCH 2/6] docs: define domain language and context map

---
 README.md                             |   7 ++
 docs/ddd/README.md                    |  37 +++++++
 docs/ddd/context-map.md               |  99 +++++++++++++++++
 docs/ddd/integration-management.md    | 147 ++++++++++++++++++++++++++
 docs/ddd/live-sessions.md             |  40 ++++---
 docs/ddd/routing-and-orchestration.md | 109 +++++++++++++++++++
 docs/ddd/ubiquitous-language.md       |  83 +++++++++++++++
 7 files changed, 507 insertions(+), 15 deletions(-)
 create mode 100644 docs/ddd/README.md
 create mode 100644 docs/ddd/context-map.md
 create mode 100644 docs/ddd/integration-management.md
 create mode 100644 docs/ddd/routing-and-orchestration.md
 create mode 100644 docs/ddd/ubiquitous-language.md

diff --git a/README.md b/README.md
index 89c7947..278d0a6 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,13 @@ managed tool follows (release-pinned installs, sync as the single updater,
 disk-first version truth, one drift story across status/statusline/dashboard),
 with the per-tool table and the checklist for adding a new tool.
 
+## Domain design
+
+[docs/ddd/](docs/ddd/) defines the shared language, bounded contexts, and invariants behind hosts,
+inference providers, bindings, routing, orchestration, evidence, usage, and Live Sessions. ADRs
+explain why decisions were made; the domain documents define what those concepts mean across the
+codebase.
+
 ## Credits
 
 ruflo/claude-flow by ruvnet · agentic-qe by proffesor-for-testing · prior art:
diff --git a/docs/ddd/README.md b/docs/ddd/README.md
new file mode 100644
index 0000000..4414374
--- /dev/null
+++ b/docs/ddd/README.md
@@ -0,0 +1,37 @@
+# Domain Design
+
+These documents define agentic-kit's shared language, domain boundaries, and invariants. They
+describe the current system unless a section is explicitly marked as future work.
+
+## Documents
+
+| Document | Purpose |
+|----------|---------|
+| [Ubiquitous language](ubiquitous-language.md) | Canonical meanings used across code, CLI, ADRs, and documentation |
+| [Context map](context-map.md) | Bounded contexts, ownership, and relationships |
+| [Integration management](integration-management.md) | Hosts, inference providers, bindings, capabilities, lifecycle, facts, and ownership |
+| [Routing and orchestration](routing-and-orchestration.md) | Activities, routes, leadership, escalation, projections, and dual runs |
+| [Live Sessions](live-sessions.md) | Evidence acquisition, live-session aggregates, replay, and dashboard delivery |
+
+## Relationship to other documentation
+
+- Domain documents define stable terms, boundaries, state, and invariants.
+- [Architecture decision records](../adr/README.md) explain why consequential decisions were made.
+- User guides such as [Providers and hosts](../PROVIDERS.md) explain how to operate the CLI.
+- Source and tests enforce the model. When documentation and behavior disagree, treat that as drift
+  to resolve rather than silently redefining a term.
+
+## Change rule
+
+A change that introduces or changes a domain concept should:
+
+1. name its owning bounded context;
+2. use or extend the ubiquitous language;
+3. preserve the context's invariants, or add an ADR explaining the change;
+4. add executable coverage for new invariants; and
+5. update operational documentation when user-visible behavior changes.
+
+Transitional implementation names remain documented until migration completes. In particular,
+`kit.json.providers` still contains both historical host settings and provider settings, and the
+deprecated `ak provider` aliases remain available during alpha. These names do not change the
+canonical distinction between a host and an inference provider.
diff --git a/docs/ddd/context-map.md b/docs/ddd/context-map.md
new file mode 100644
index 0000000..250ecf5
--- /dev/null
+++ b/docs/ddd/context-map.md
@@ -0,0 +1,99 @@
+# Context Map
+
+Agentic-kit is a zero-runtime-dependency CLI with several bounded contexts. The boundaries below
+identify who owns each decision and where translation is required.
+
+```text
+Configuration Intent
+        |
+        +----> Integration Management ----> Native Configuration Surfaces
+        |                 |
+        |                 +----> Routing and Orchestration
+        |
+Native Evidence ----> Evidence Acquisition ----> Canonical Evidence
+                                                   |
+                         +-------------------------+----------------------+
+                         |                                                |
+                         v                                                v
+                  Live Sessions                                  Historical Usage
+                         |                                                |
+                         +-----------------> Dashboard Delivery <---------+
+
+Maintainer Administration is a separate, deliberately-egressing context.
+```
+
+## Bounded contexts
+
+### Configuration intent
+
+Owns the user's persisted desired state in `kit.json`, including enabled hosts, primary-host
+choice, routing policy, provider fallback configuration, and versioned integration bindings. It
+does not prove that an executable, credential, or endpoint is usable.
+
+### Integration management
+
+Owns the registries, capabilities, binding validation, normalized integration facts, managed
+projection lifecycle, config migration, and value-precise ownership. Native JSON, TOML, environment,
+and CLI surfaces are downstream representations.
+
+See [Integration management](integration-management.md).
+
+### Routing and orchestration
+
+Owns activities, routes, defaults, route provenance, primary-host mirroring, escalation, worker
+materialization, and execution of Claude/Codex collaboration pipelines. It consumes routable-host
+capabilities and configuration intent. It does not decide inference-provider identity.
+
+See [Routing and orchestration](routing-and-orchestration.md).
+
+### Evidence acquisition
+
+Owns discovery, parsing, checkpoints, and translation of host- or provider-native evidence.
+Source adapters form an anti-corruption layer: native transcript, quota, catalog, runtime, and
+metadata shapes do not cross into the domain unchanged.
+
+### Live Sessions
+
+Owns canonical live events, session identity, lifecycle, topology, evidence confidence, and live
+aggregates. It consumes canonical evidence and publishes read-model projections.
+
+See [Live Sessions](live-sessions.md).
+
+### Historical usage
+
+Owns transcript indexing, session history, token and cost aggregation, classification, and usage
+findings. It may share a host-qualified session identity with Live Sessions, but its aggregate and
+cache are separate from the live event store.
+
+### Dashboard delivery
+
+Owns protected HTTP/SSE delivery, browser DTOs, filters, presentation, and interaction state. It
+may combine read models from Live Sessions, Historical Usage, routing, and integration facts. It
+cannot manufacture or strengthen domain facts.
+
+### Maintainer administration
+
+Owns deliberately-egressing repository, release, package, CI, and security telemetry. Its network
+and credential policy is distinct from the offline-first dashboard and integration config loader.
+
+## Relationships and translation
+
+| Upstream | Downstream | Relationship |
+|----------|------------|--------------|
+| Configuration intent | Integration management | Desired state; detection and verification remain independent |
+| Integration management | Native surfaces | Configuration projections with ownership receipts |
+| Integration management | Routing and orchestration | Capability-qualified host and binding facts |
+| Native evidence | Evidence acquisition | Source-specific anti-corruption adapters |
+| Evidence acquisition | Live Sessions | Versioned canonical events |
+| Evidence acquisition | Historical usage | Normalized transcript and provider evidence |
+| Live Sessions | Dashboard delivery | Read-model snapshots, deltas, and selected evidence |
+| Historical usage | Dashboard delivery | Historical aggregates and findings |
+
+## Boundary rules
+
+- Native configuration and evidence schemas never become the canonical model by accident.
+- User intent does not establish observed reality.
+- A host observation does not establish inference-provider identity.
+- Dashboard presentation cannot upgrade provenance.
+- Historical usage and live topology share identifiers, not aggregate ownership.
+- Network egress occurs only in commands and contexts whose contract explicitly permits it.
diff --git a/docs/ddd/integration-management.md b/docs/ddd/integration-management.md
new file mode 100644
index 0000000..a1bbc11
--- /dev/null
+++ b/docs/ddd/integration-management.md
@@ -0,0 +1,147 @@
+# Integration Management Domain
+
+This document describes the integration model implemented by
+[ADR-0016](../adr/0016-capability-driven-integration-adapters.md) and `src/lib/adapters/`.
+
+## Purpose
+
+Integration management turns user intent and bounded observations into safe configuration actions
+and honest facts. It keeps execution hosts, inference providers, configuration projections, and
+observability sources independent so that adding one integration cannot accidentally grant
+unrelated behavior.
+
+The shared terms in [Ubiquitous language](ubiquitous-language.md) are normative.
+
+## Model
+
+```text
+Host -------- ProviderBinding -------- InferenceProvider
+  |                 |                         |
+  |                 +-- transport             +-- billing/credentials
+  |                 +-- model                 +-- provider capabilities
+  |                 +-- endpoint
+  |                 +-- provenance
+  |
+  +-- ConfigurationProjection
+  +-- ObservabilitySource(s)
+  +-- host capabilities
+```
+
+The four adapter registries are closed, validated, built-in code. A provider binding is persisted
+relationship data, not a fifth executable adapter family.
+
+### Host
+
+A host describes an execution driver, install surface, native configuration projection,
+observability sources, authentication hints, and explicit capabilities. Capabilities decide
+whether it may drive a session, become primary, receive activity routes, expose transcripts, or
+participate in other workflows.
+
+### Inference provider
+
+An inference provider describes credentials, transports, projections, observability sources, and
+bounded capabilities such as discovery, quota, pricing, and cache accounting. Provider identity
+does not imply a host or routing capability.
+
+### Provider binding
+
+A binding connects exactly one known host and one known provider. It names a supported transport,
+configuration projection, optional model and endpoint, provenance, and ownership. Resolution
+returns a binding only when the supplied criteria identify exactly one candidate.
+
+Endpoints reject embedded credentials, fragments, secret-bearing query parameters, unsupported
+protocols, and non-loopback plaintext HTTP.
+
+## Capability rules
+
+- Primary and activity-routing capabilities require session-driving capability.
+- Commands select adapters by capability rather than recognized ID.
+- Adding OpenCode does not make it primary or routable.
+- Adding OpenRouter does not make it a host.
+- Provider claims are rendered only when the provider declares and evidence supports them.
+- Compatibility collections are derived from registries.
+
+## Integration facts
+
+Facts keep the axes separate:
+
+```text
+HostFact       = present + enabled + version + auth/wiring evidence
+ProviderFact   = configured + reachable + billing + credential presence
+BindingFact    = host + provider + model + billing + provenance + reachability
+ExecutionFact  = observed host + provider + model + transport + billing
+```
+
+Presence, enablement, authentication, configuration, and reachability are independent. Missing
+evidence produces `unknown` or `null`; it never produces a fabricated success, failure, cost, or
+provider.
+
+Provenance strength is `unknown < inferred < configured < observed`. Host transcripts prove host
+and model fields they actually carry. Provider identity becomes observed only through
+provider-specific evidence, such as response metadata or a bounded local runtime/catalog lookup.
+
+Billing follows the access path. Anthropic or OpenAI host login may be subscription-backed, while
+their API keys are metered. Ollama is local and may be priced at exact zero only after provider
+identity is established.
+
+## Managed projection lifecycle
+
+Every managed configuration projection follows:
+
+```text
+detect -> plan -> apply -> verify -> undo
+```
+
+- `detect` is read-only and reports observed state.
+- `plan` is deterministic for the same intent and facts.
+- dry-run detects and plans but does not apply.
+- repeated apply converges without additional writes.
+- `verify` observes the target independently of the plan.
+- `undo` reverses only values still equal to values written by `ak`.
+
+Malformed, unavailable, or unsupported surfaces yield diagnostics and unknown facts rather than
+guessed success.
+
+## Ownership and drift
+
+Presence is not ownership. External installations and pre-existing configuration remain usable but
+unmanaged. An ownership receipt records the exact prior and written value for one surface or key
+path. Undo restores that prior value only if the current value still equals the written value.
+User or external drift is preserved.
+
+Receipts never authorize deletion of sibling keys, containing tables, external executables, or
+credential values.
+
+## Configuration migration
+
+`integrations.version` identifies the canonical integration envelope. Loading configuration
+normalizes legacy state in memory without writing. An explicit save persists the current envelope.
+Migration is additive, preserves existing bindings, and infers legacy default bindings with
+`inferred` provenance.
+
+Future schema versions and malformed binding collections are preserved opaquely rather than
+downgraded or rewritten.
+
+Historical paths under `kit.json.providers` remain compatibility surfaces during alpha. Their name
+does not collapse the host and provider domains.
+
+## Proving integrations
+
+| Case | What it proves |
+|------|----------------|
+| OpenCode host | A host can be managed and observed without becoming primary or routable |
+| OpenRouter provider | A provider can serve existing hosts without becoming a host |
+| Ollama via Claude and Codex | One provider can have independent bindings to multiple hosts |
+
+## Invariants
+
+1. Host and provider namespaces are distinct.
+2. Identity never grants an undeclared capability.
+3. A host observation alone never proves an inference provider.
+4. Unknown never silently becomes free, subscription-backed, reachable, or absent.
+5. Credential values never enter registries, normalized facts, receipts, or output.
+6. Loading and normalization do not mutate external state.
+7. Apply is idempotent and dry-run is non-mutating.
+8. Undo cannot overwrite drift.
+9. Existing and future configuration survives additive migration.
+10. Status, setup, sync, verify, and uninstall consume the same normalized model.
diff --git a/docs/ddd/live-sessions.md b/docs/ddd/live-sessions.md
index a473222..addf2e1 100644
--- a/docs/ddd/live-sessions.md
+++ b/docs/ddd/live-sessions.md
@@ -5,6 +5,10 @@ This document specifies the domain model behind
 architecture, refinement, and completion stages; implementation pseudocode appears at the relevant
 boundaries.
 
+The shared [ubiquitous language](ubiquitous-language.md) and
+[context map](context-map.md) are normative. Terms defined below refine the Live Sessions context
+without redefining shared integration concepts.
+
 ## Ubiquitous language
 
 | Term | Meaning |
@@ -24,7 +28,7 @@ boundaries.
 | Evidence | A source record supporting a domain fact |
 | Field provenance | Evidence and confidence attached to one fact, not the whole record |
 | Confidence | `observed`, `correlated`, `inferred`, `assumed`, or `planned` |
-| Projection | The current read model derived from canonical events |
+| Read-model projection | The current query/UI state derived from canonical events |
 | Topology | Nodes and typed relationships visible for a session |
 | Execution canvas | Spatial view of agents, owned tools, and causal flow for one session |
 | Evidence rail | Selected-session transcript synchronized with canvas selection |
@@ -47,7 +51,7 @@ Owns source discovery, append-aware reading, schema-specific parsing, and source
 language is transcripts, ledgers, registries, hooks, offsets, rotation, and freshness. It does not
 decide graph layout or emit browser DTOs.
 
-Adapters are anti-corruption layers for:
+Source adapters are anti-corruption layers for:
 
 - Claude session and delegated-agent artifacts;
 - Codex rollouts and state-ledger spawn edges;
@@ -61,7 +65,7 @@ Adapters are anti-corruption layers for:
 Owns canonical events, identity correlation, lifecycle transitions, evidence confidence, aggregates,
 and invariants. Host-specific record shapes do not cross this boundary.
 
-### Projection and replay
+### Read-model projection and replay
 
 Owns materialized session graphs, bounded retention, cursor replay, snapshots, and idempotent
 reduction. It is optimized for current state, not historical cost analytics.
@@ -88,13 +92,14 @@ ak ─────┘
           ↓
 canonical event normalizer
           ↓
-LiveSession aggregate → projection/replay → snapshot + SSE → dashboard
+LiveSession aggregate → read-model projection/replay → snapshot + SSE → dashboard
           │
           └── session-id link ──→ historical usage context
 ```
 
-Evidence acquisition is upstream of the live domain. Projection/replay consumes canonical domain
-events. Dashboard delivery consumes projection DTOs. Historical usage shares identifiers only.
+Evidence acquisition is upstream of the live domain. Read-model projection/replay consumes
+canonical domain events. Dashboard delivery consumes projection DTOs. Historical usage shares
+identifiers only.
 
 Discovery is newest-first. Before following append-only changes, acquisition reads a bounded
 metadata prefix and Codex ledger state so stable identity is available on first paint. Bootstrap
@@ -134,7 +139,7 @@ Project {
   id, label, updatedAt,
   sessionKeys[],
   sessionCount, childSessionCount, liveCount, completedCount,
-  providerCounts
+  providers
 }
 ```
 
@@ -143,6 +148,11 @@ navigation roots only; `childSessionCount` reports descendant threads without pr
 peer work. Sessions are ordered live first and then by most recent evidence. A project ID is opaque
 and safe for DOM/routing; it never contains the raw working directory.
 
+`providers` is a transitional presentation field. It counts node-level provider identities when
+available, but the current reducer falls back to the session host when none are present. Consumers
+must not treat a fallback label as observed inference-provider evidence. A future schema should
+separate host counts from evidence-backed provider counts rather than preserve that fallback.
+
 Project identity means the owning repository, not the current branch or linked-worktree directory.
 For a live local worktree, the `.git` ownership pointer resolves the repository. Known nested
 worktree layouts provide a privacy-safe fallback for retained paths that no longer exist. Only the
@@ -334,7 +344,7 @@ projection lifecycle: active → quiescent → expired
 19. Content streams are keyed by host and session ID, server-masked, bounded, ephemeral, and
     destroyed after the last subscriber.
 
-## Ports and adapters
+## Ports and source adapters
 
 ### Inbound ports
 
@@ -346,7 +356,7 @@ createLiveEvent(candidate)
 reduceLiveEvent(projection, event, bounds)
 ```
 
-Each adapter owns checkpoint serialization and validates file containment before opening an
+Each source adapter owns checkpoint serialization and validates file containment before opening an
 artifact. Filesystem watch notifications trigger reconciliation; they are not treated as complete
 event delivery.
 
@@ -507,8 +517,8 @@ Tests are written against ports and fixtures before each adapter or lifecycle tr
 1. **Contract tests:** event schema, action vocabulary, privacy allowlist, confidence ordering.
 2. **Tailer tests:** append, partial record, duplicate notification, rotation, truncation, checkpoint
    restart, and symlink/containment rejection.
-3. **Adapter fixtures:** known Claude, Codex, ruflo, agentic-qe, dual-run, skill, plugin, and MCP
-   records; unknown fields and schema generations.
+3. **Source-adapter fixtures:** known Claude, Codex, ruflo, agentic-qe, dual-run, skill, plugin,
+   and MCP records; unknown fields and schema generations.
 4. **Aggregate tests:** child-before-parent, conflict, terminal-state monotonicity, expiry, and
    idempotency.
 5. **Projection tests:** snapshot-plus-replay equivalence, bounded retention, late parent
@@ -575,9 +585,9 @@ process memory limits.
 ### Milestone 5: Ecosystem enrichment
 
 - Add dual-run planned topology and execution updates.
-- Add ruflo swarm/agent/hook/daemon adapters.
-- Add agentic-qe task/evaluation/verdict adapters.
-- Add explicit skill, plugin, MCP, and tool activity adapters.
+- Add ruflo swarm/agent/hook/daemon source adapters.
+- Add agentic-qe task/evaluation/verdict source adapters.
+- Add explicit skill, plugin, MCP, and tool activity source adapters.
 
 ### Milestone 6: Hardening and scale
 
@@ -639,7 +649,7 @@ closing the snapshot-to-subscribe race. A slow-client queue overflow discards qu
 sends a reset snapshot after drain.
 
 The default command discovers Claude/Codex transcripts and reads Codex ledger edges. Ruflo,
-agentic-qe, and dual-run adapters require explicit, repeatable `--live-source 'surface=path'`
+agentic-qe, and dual-run source adapters require explicit, repeatable `--live-source 'surface=path'`
 registration, where `surface` is `ruflo`, `aqe`, or `dual-run`. Explicit sources consume tailer
 capacity before Claude/Codex discovery. Paths resolve against the startup working directory and are
 not confined to the project, so registration is an operator authorization to read that file.
diff --git a/docs/ddd/routing-and-orchestration.md b/docs/ddd/routing-and-orchestration.md
new file mode 100644
index 0000000..906a6a3
--- /dev/null
+++ b/docs/ddd/routing-and-orchestration.md
@@ -0,0 +1,109 @@
+# Routing and Orchestration Domain
+
+This document consolidates the routing model established by ADRs
+[0001](../adr/0001-one-routing-policy-many-projections.md) through
+[0006](../adr/0006-primary-host-and-ambidextrous-mirroring.md).
+
+## Purpose
+
+Routing assigns development activities to capable execution hosts and models. Orchestration
+materializes those assignments into worker configurations and runs collaboration pipelines.
+Inference-provider resolution remains a separate integration-binding concern.
+
+## Model
+
+```text
+RoutingPolicy
+  activity -> Route
+                host
+                model
+                provenance
+                escalation rungs[]
+
+RoutingPolicy -> configuration projections -> AQE / dual-run / MCP surfaces
+RoutingPolicy + template + task -> materialized workers -> dual run
+```
+
+### Activity
+
+The canonical activity vocabulary is specification, architecture, design, implementation, testing,
+review, security scan, security analysis, documentation, debugging, packaging, and release.
+Activities describe work, not agent implementation names.
+
+### Route
+
+A route selects a routable host and a model for one activity. It may include ordered escalation
+rungs. The host must declare `canRouteActivities`; a provider ID cannot satisfy a host reference.
+
+Route provenance is:
+
+- `default`: effective built-in behavior with no persisted entry;
+- `seeded`: persisted by `ak` from current defaults; or
+- `user`: deliberately pinned or hand-authored intent.
+
+Refresh may update diverged seeded routes. It does not overwrite user routes.
+
+### Primary host
+
+The primary host determines which peer leads the default table and how missing-host status is
+classified. It is separate from enablement and from the host driving the current interactive
+session.
+
+Selecting Codex as primary mirrors the default host/model assignments and escalation ladder so
+Codex leads and Claude becomes the alternate. It does not disable Claude or introduce a separate
+orchestrator.
+
+### Escalation
+
+An escalation rung is an alternate host and model attempted after failure only when escalation is
+requested. The ladder is per route and may cross vendors. It is not a retry budget and does not
+change the persisted base route.
+
+## One policy, several configuration projections
+
+`kit.json.providers.dualRouting` is the current persisted compatibility path for routing intent.
+Pure projectors materialize that policy into:
+
+- AQE `agentOverrides`;
+- dual-run worker configuration; and
+- Codex MCP availability/configuration.
+
+These are configuration projections, not independent routing policies. Native surfaces must not
+be edited back into domain truth without an explicit import or reconciliation design.
+
+## Meaning of dual
+
+`ak dual run` names the current Claude-and-Codex peer-host collaboration substrate. Workers in a
+single pipeline may reach different inference providers through their bindings, but provider
+cardinality does not change the number of execution hosts.
+
+Therefore:
+
+- two hosts with three or more providers remain a dual run;
+- OpenRouter does not create a third orchestration host;
+- two Ollama bindings do not create two Ollama providers; and
+- OpenCode does not join routing until its host adapter explicitly gains the required capability.
+
+If agentic-kit later supports three or more routable peer hosts, that is a new generalized
+orchestration concept. It should receive explicit vocabulary, command design, migration behavior,
+and an ADR rather than silently changing `dual`.
+
+## Cost safety
+
+Automatic seeding targets only known subscription-backed or local execution paths. Metered
+providers may be selected deliberately through provider/fallback configuration, but are not
+silently introduced into default activity routes.
+
+Model catalogs are curated recommendations, not hard allowlists. Pricing and performance notes
+must distinguish per-token price from measured or expected per-task cost.
+
+## Invariants
+
+1. Only capability-qualified hosts receive activity routes.
+2. Routing host and inference provider are separate axes.
+3. One canonical policy feeds all downstream configuration projections.
+4. User-pinned routes are not overwritten by default refresh.
+5. Primary-host selection changes leadership defaults, not host enablement symmetry.
+6. Escalation is explicit, ordered, and per route.
+7. Automatic seeding cannot introduce a metered provider path.
+8. `dual` continues to mean two peer execution hosts.
diff --git a/docs/ddd/ubiquitous-language.md b/docs/ddd/ubiquitous-language.md
new file mode 100644
index 0000000..54982fa
--- /dev/null
+++ b/docs/ddd/ubiquitous-language.md
@@ -0,0 +1,83 @@
+# Ubiquitous Language
+
+This glossary is normative for agentic-kit code, CLI help, ADRs, tests, and documentation. A
+bounded-context document may refine a term but should link back here rather than assign a
+contradictory meaning.
+
+## Integration language
+
+| Term | Meaning |
+|------|---------|
+| Host | CLI or runtime that drives an agent session, such as Claude Code, Codex, or OpenCode |
+| Inference provider | Service or local runtime that performs model inference, such as Anthropic, OpenAI, OpenRouter, or Ollama |
+| Model | Provider-addressable inference target used for an execution |
+| Provider binding | Persisted intent connecting one host to one inference provider through a transport and configuration projection |
+| Transport | Protocol used by a binding, such as native, OpenAI-compatible, or Anthropic-compatible |
+| Integration adapter | Built-in descriptor and behavior for one host, provider, configuration projection, or observability source |
+| Configuration projection | Native configuration surface derived from canonical intent, such as Claude JSON, Codex TOML, or an AQE router file |
+| Observability source | Bounded evidence channel that may establish specific facts |
+| Source adapter | Anti-corruption layer that translates native evidence into canonical facts or events |
+| Capability | Explicit behavior supported by an adapter; identity alone never implies it |
+| Integration intent | Desired, persisted host and binding configuration |
+| Integration facts | Immutable normalized observations about hosts, providers, and bindings |
+
+## State and evidence language
+
+| Term | Meaning |
+|------|---------|
+| Present | An executable, file, endpoint, or other surface was detected |
+| Enabled | Persisted user intent permits a host or integration to be used |
+| Authenticated | A host login or credential mechanism is known to be usable |
+| Configured | Required provider or projection configuration is present |
+| Reachable | A bounded probe successfully contacted its target |
+| Routable host | Host whose capabilities permit assignment of development activities |
+| Primary host | Routable host selected to lead defaults and determine missing-host severity |
+| Evidence | Observation supporting a fact |
+| Provenance | Strength and origin of a fact: `observed`, `configured`, `inferred`, or `unknown` |
+| Unknown | The available evidence cannot establish a value; it does not mean false, zero, free, absent, or unreachable |
+| Ownership receipt | Exact record of a value written by `ak`, permitting narrow undo only while that value is unchanged |
+| Drift | Current state differs from the last value written or expected by `ak` |
+
+Billing is a fact about a credentialed access path or observed execution, not an immutable vendor
+identity. A vendor may support subscription-backed host login and metered API-key use. Local
+billing means inference is performed by a local runtime; it does not follow merely from a zero or
+missing price.
+
+## Routing and observability language
+
+| Term | Meaning |
+|------|---------|
+| Activity | Canonical category of development work, such as architecture, implementation, testing, or review |
+| Route | Activity assignment to a host and model, optionally followed by escalation rungs |
+| Routing policy | Persisted activity-to-route intent |
+| Route provenance | Whether a route is a default, seeded by `ak`, or deliberately set by the user |
+| Escalation rung | Alternate host and model tried after failure when escalation is requested |
+| Dual run | Claude-and-Codex collaboration pipeline materialized from the routing policy |
+| Read-model projection | Derived query or UI state, distinct from a configuration projection |
+| Transcript host | Host whose native artifact supplied a transcript |
+| Inference identity | Provider and model supported by provider-specific or out-of-band evidence |
+
+`Dual` describes the two peer execution hosts in the current collaboration substrate. The number
+of inference providers behind those hosts does not change a dual run into a three-host
+orchestration.
+
+## Usage rules
+
+- Say **host** when referring to Claude Code, Codex, OpenCode, session drivers, leadership, or
+  activity routing.
+- Say **inference provider** when referring to Anthropic, OpenAI, OpenRouter, Ollama, billing,
+  provider credentials, or inference endpoints.
+- Qualify **projection** as configuration projection or read-model projection when ambiguity is
+  possible.
+- Qualify **adapter** as integration adapter or source adapter when ambiguity is possible.
+- Do not infer an inference provider from a transcript host alone.
+- Do not replace an unknown fact with a convenient default.
+
+## Transitional names
+
+- `ak host` and `ak x host` are canonical. `ak provider` and `ak x provider` are deprecated alpha
+  aliases scheduled for removal before stable.
+- `kit.json.providers.hosts`, `providers.primaryHost`, and `providers.dualRouting` are historical
+  persisted paths. They remain compatibility surfaces, not permission to call hosts providers.
+- Compatibility exports in `hosts.mjs`, `providers.mjs`, and `routing.mjs` are derived views, not
+  independent domain registries.

From ee86f98addfe2fd2075fe23ab7d227b3b3aeec58 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 21:33:27 -0700
Subject: [PATCH 3/6] fix: separate dashboard host and provider identity

---
 README.md                                     |  2 +-
 docs/LIVE-SESSIONS.md                         | 22 ++++++++-------
 docs/ddd/live-sessions.md                     | 18 ++++++------
 src/lib/dashboard-server.mjs                  |  7 ++---
 src/lib/dashboard/client.mjs                  |  4 +--
 src/lib/dashboard/live/client.mjs             | 27 ++++++++++--------
 src/lib/dashboard/live/styles.mjs             |  8 +++---
 src/lib/dashboard/live/template.mjs           |  2 +-
 src/lib/dashboard/page.mjs                    | 15 +++++-----
 src/lib/live/projection.mjs                   |  7 +++--
 tests/dashboard.test.cjs                      | 12 +++++++-
 .../dashboard-integration-identity.test.mjs   | 28 +++++++++++++++++++
 tests/kit/live-core.test.mjs                  | 19 +++++++++++++
 tests/kit/live-qe-contract.test.mjs           | 11 ++++++++
 tests/ui/dashboard-ui.mjs                     | 13 ++++++---
 15 files changed, 137 insertions(+), 58 deletions(-)
 create mode 100644 tests/kit/dashboard-integration-identity.test.mjs

diff --git a/README.md b/README.md
index 278d0a6..b020a78 100644
--- a/README.md
+++ b/README.md
@@ -88,7 +88,7 @@ What the verbs cover:
 | **setup** | Installs/updates ruflo + agentic-qe + the **agentdb** CLI globally (handling npm ≥11.17's `allow-scripts` so natives build; agentdb is pinned to ruflo's bundled version so the shared learning store stays coherent), installs the **RuvNet Brain** (an offline knowledge base over the rUv stack, powering the `search_ruvnet` MCP — a ~2 GB one-time download, prompted; skip with `--no-ruvnet-brain`), deploys the token-audit skill, merges the managed guidance blocks into the machine-wide guidance files (`~/.claude/CLAUDE.md`, plus `~/.codex/AGENTS.md` on codex machines), offers one-time MCP registration (user scope, with a tool-family picker), and — inside a repo — initializes the project: sanitized `ruflo init`, absolute memory-path pin, a **verified** store→disk write, statusline footer, and a background daemon with **local-only ($0) workers** (token-spending AI workers stay opt-in behind upstream's machine-wide budget). Project scope triggers on a `.git` directory in the current folder; without one it's skipped with a note. `--project` forces it anyway (e.g. a not-yet-`git init`-ed folder), `--minimal` skips it, `--yes` accepts all prompts (non-interactive), `--no-aqe` / `--no-ruvnet-brain` / `--no-security` disable those subsystems, and `--reconfigure` re-offers MCP registration. `--codex` enables + installs the Codex host during setup (dual-mode; both hosts then run at once), and `--primary-host claude\|codex` picks which host leads (codex implies `--codex`). |
 | **status** | Per-subsystem ✓/⚠/✗ (versions, the kit's own version, **ruvnet-brain** (present + release drift, or "not installed"), natives (agentdb copies **and** ruflo's own memory runtime — the one `npx ruflo memory` loads — load-tested for a native better-sqlite3, not just the agentdb dirs), **memory-pin** (warns when `CLAUDE_FLOW_DB_PATH` points off the live DB), security, learning, aqe/RVF, **agentdb** (CLI present + coherent with ruflo's bundled version, or a store-skew warning), MCP, **hosts** (claude/codex — version + install method + **auth mode** (subscription $0 vs metered api-key), with the **primary** host marked and a *fail* when the primary host is absent), **providers** (host wiring + aqe fallback chain, or "drifted"/claude-only default), **routing** (per-activity Claude/Codex host+model policy, when dual-host — with drift vs the on-disk `agentOverrides`), daemons, guidance-file blocks (`~/.claude/CLAUDE.md`, project `AGENTS.md`, and `~/.codex/AGENTS.md` on codex machines), statusline), each drift row naming what `sync` would do about it — plus a **health-history** line that flags regressions since the last sync (learning shrank, native slots dropped, drift/security backslid). |
 | **sync** | The one convergence verb: upgrades first when a new release exists, then re-heals everything an upgrade wipes, then re-checks and reports. Included in that heal: it **installs any enabled frontier host** (claude/codex) that's entirely absent — never touching an external (mise/brew/native) install — and **re-applies provider wiring** (the `ENABLE_*` host env, the aqe fallback chain, and ruflo API providers) whenever it has drifted — and, on a dual-host project, **seeds/heals the per-activity routing policy** (materializing it into agentic-qe's `agentOverrides`, e.g. after an aqe upgrade first makes it eligible). It also **installs/repins the standalone `agentdb` CLI** to ruflo's bundled version (keeping the shared cognitive store coherent) and appends a **health-history snapshot** so `status` can flag regressions across syncs. It also **re-runs the RuvNet Brain installer** to pull the latest release when the on-disk KB has drifted (or installs it if absent, when enabled). It also **self-updates the kit**: when a newer `@pacphi/agentic-kit` exists it installs it as the *last* step (the new code applies from the next `ak` run, never mid-sync). Prerelease installs (`4.0.0-alpha.*`) track the `next` npm dist-tag as well as `latest`, so alphas see their successors; stable installs only ever follow `latest`. `--no-upgrade` skips the self-update along with the package upgrades. |
-| **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) with seven tabs: **Overview · Hosts & Routing · Providers · Runtime · Intelligence · Usage · Live**. The first five render `ak status` health and routing; Usage indexes local Claude/Codex transcripts on demand. Live groups work by project, then provider-branded root sessions with nested agent/worker threads, and pairs an interactive agent/tool execution canvas with a rich, server-masked transcript stream. Active sessions can be followed live or reviewed with synchronized play/pause/seek; completed sessions remain available for bounded playback. Live contains no chat or control plane. Ruflo, agentic-qe, and dual-run stores are not auto-discovered; register each trusted structured JSONL file with repeatable `--live-source 'surface=path'` (`surface` is `ruflo`, `aqe`, or `dual-run`). The page is self-contained and offline-first (no internet fetches; local files and loopback subprocesses/endpoints only). A fresh **per-session token** is minted at startup and required by every `/api/*` route (`x-dash-token` header; the launch URL carries it in the `#` fragment, same contract as `ak admin` — ADR-0007, ADR-0014) — this page serves full transcript text, so it is gated the same way admin already gated GitHub/npm stats. See [Live Sessions](docs/LIVE-SESSIONS.md) for coverage, syntax, and privacy limits. **Auto-opens your browser** (`--no-open` for headless/SSH); `--port N` changes the port; tabs deep-link (`#live`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
+| **dashboard** | Opens a read-only local web dashboard (`127.0.0.1:7431`, localhost-only, never detaches) with seven tabs: **Overview · Hosts & Routing · Providers · Runtime · Intelligence · Usage · Live**. The first five render `ak status` health and routing; Usage indexes local Claude/Codex transcripts on demand. Live groups work by project, then host-branded root sessions with nested agent/worker threads and independently evidenced provider/model metadata, and pairs an interactive agent/tool execution canvas with a rich, server-masked transcript stream. Active sessions can be followed live or reviewed with synchronized play/pause/seek; completed sessions remain available for bounded playback. Live contains no chat or control plane. Ruflo, agentic-qe, and dual-run stores are not auto-discovered; register each trusted structured JSONL file with repeatable `--live-source 'surface=path'` (`surface` is `ruflo`, `aqe`, or `dual-run`). The page is self-contained and offline-first (no internet fetches; local files and loopback subprocesses/endpoints only). A fresh **per-session token** is minted at startup and required by every `/api/*` route (`x-dash-token` header; the launch URL carries it in the `#` fragment, same contract as `ak admin` — ADR-0007, ADR-0014) — this page serves full transcript text, so it is gated the same way admin already gated GitHub/npm stats. See [Live Sessions](docs/LIVE-SESSIONS.md) for coverage, syntax, and privacy limits. **Auto-opens your browser** (`--no-open` for headless/SSH); `--port N` changes the port; tabs deep-link (`#live`) and persist. Stop with Ctrl-C. (Also available as `ak x dashboard`.) |
 | **admin** | Opens the **maintainer admin** (`127.0.0.1:7432`, localhost-only, foreground) — the project-telemetry sibling of `dashboard`, with the same dark/light visual theme and persisted theme preference: unique repo visitors and cloners (GitHub traffic API, needs a push-access token via `GITHUB_TOKEN`/`GH_TOKEN`/`gh auth token` — panels degrade honestly without one), contributors and watchers, npm download momentum (last 7d vs prior 7d, sparklines — shown as trend only, never an absolute reach number, since mirrors/CI inflate the raw count), latest CI run status and open Dependabot alerts, a **"since you last looked"** delta strip over a local baseline, open issues/PRs from others (oldest first), and external humans ranked by recency (bots excluded). Access is gated by a **per-session token** carried in the URL fragment and sent header-only; the page makes **zero external fetches** (the server proxies GitHub/npm; your credential never reaches the page or the payload — ADR-0007, ADR-0013). Where `dashboard` is offline-first, `admin` does deliberate GitHub/npm egress — that contract split is why they're siblings, not tabs. `--port N`, `--no-open`; Ctrl-C stops. (Also available as `ak x admin`.) |
 | **dual** | Runs a **Claude + Codex collaboration swarm** using your per-activity routing policy: `ak dual run <template> "<task>"` materializes a dual-run config (each pipeline step assigned to the host + model your policy chose) and drives it via `claude-flow-codex`. Templates: `feature`, `security`, `refactor`, `packaging`, `release`. `--dry-run` prints the plan + config without running; `--route 'activity:host[:model]'` overrides one step for that run; `--escalate` retries once up the cross-vendor ladder on failure. Requires dual-host enabled (`ak setup --codex`, or `ak host pick --host claude,codex`). **Pre-flight refusal:** before spawning a worker, `dual run` refuses to start when ruflo's memory runtime lacks a native better-sqlite3 binding **and** the shared DB has an active native WAL (`-wal`/`-shm` sidecars) — the native WAL writer and the WASM `ruflo memory store` cannot share that DB without corrupting it; the fix is `ak sync` (builds the native binding), then retry. |
 | **host** | Canonical alpha namespace for execution-host status, selection, primary-host choice, activity routing, and reversible teardown: `ak host status\|pick\|refresh\|off`. The plumbing spelling is `ak x host`. `ak provider` and `ak x provider` are deprecated compatibility aliases that warn on stderr and will be removed before the stable release. |
diff --git a/docs/LIVE-SESSIONS.md b/docs/LIVE-SESSIONS.md
index eae7405..cb69beb 100644
--- a/docs/LIVE-SESSIONS.md
+++ b/docs/LIVE-SESSIONS.md
@@ -34,14 +34,15 @@ request. Stopping the dashboard closes the live service and all clients.
 
 - Claude and Codex sessions discovered newest-first from their local JSONL
   stores and bootstrapped from bounded, metadata-only records.
-- Project-first session cards with a provider glyph and text, model when
-  reported, lifecycle, freshness, and a concise operational summary.
+- Project-first session cards with a host glyph and name, independently
+  evidenced inference provider/model when reported, lifecycle, freshness, and
+  a concise operational summary.
 - Session, agent, sub-agent, tool, skill, plugin, MCP, and gate entities when a
   supported source record identifies them.
 - Authoritative Codex parent/child edges from the Codex state ledger.
 - Human-readable identity and current work: resolved agent or capability name,
-  host/model, lifecycle, elapsed time, latest safe operation summary, and
-  evidence confidence.
+  host, provider/model, lifecycle, elapsed time, latest safe operation summary,
+  and evidence confidence.
 - Typed relationships whose accessible titles use verbs such as **spawned**,
   **delegated**, **invoked**, **returned**, **evaluated**, and **gated**.
 - A semantic execution canvas with stable agent anchors and bounded tool,
@@ -57,8 +58,9 @@ request. Stopping the dashboard closes the live service and all clients.
   actor-specific geometry, and a **Pause live** control.
 - Sanitized adapter health showing status and aggregate file/event/error counts.
 
-The overview answers which project/provider is involved, whether the evidence
-is current, who is active, and what operation is happening now. Selecting a
+The overview answers which project and host are involved, which inference
+provider is evidenced, whether the evidence is current, who is active, and
+what operation is happening now. Selecting a
 node highlights adjacent relationships, focuses its work, and synchronizes the
 transcript. Search filters the current stream. Auto-follow yields when the
 reader scrolls away and reports unread activity until following resumes. The
@@ -67,7 +69,7 @@ flow downward. Follow anchors to the top; playback remains chronologically
 ordered internally.
 
 Projects are the durable top-level grouping. Select a project first, then one
-of its provider-qualified root sessions; currently active sessions appear
+of its host-qualified root sessions; currently active sessions appear
 before recent completed sessions. Selecting a root reveals its agent/worker
 threads as an indented hierarchy. Those child threads remain selectable for
 their own map, transcript, and playback, but do not inflate the project's
@@ -195,13 +197,13 @@ that the dashboard has inspected an agent's private reasoning.
 
 The topology plane is constructed from an allowlist and contains no transcript
 bodies. The separately selected content plane intentionally carries rich local
-evidence. It parses provider records into a bounded DTO, masks every emitted
+evidence. It parses source records into a bounded DTO, masks every emitted
 string server-side, and never emits Codex `encrypted_content`. Secret masking
 is best effort, not a guarantee; only run the dashboard where its local
 transcripts may be viewed.
 
 Transcript lookup validates both host and session ID, resolves the real file
-beneath the configured provider root, rejects symlink escapes, and rechecks
+beneath the configured host transcript root, rejects symlink escapes, and rechecks
 containment after replacement. Content responses are `no-store`, same-origin,
 bounded, and destroyed after their last subscriber.
 
@@ -246,7 +248,7 @@ unbounded content snapshot.
 | Symptom | Explanation |
 |---------|-------------|
 | No sessions | No supported metadata was found within the bounded newest-first discovery set |
-| Many identical provider session rows | Refresh after the current snapshot reconciles ledger hierarchy; root sessions and nested worker threads are counted separately |
+| Many identical host session rows | Refresh after the current snapshot reconciles ledger hierarchy; root sessions and nested worker threads are counted separately |
 | Worker thread appears at top level | Its declared parent is not currently retained, so it remains navigable as an orphan rather than hiding evidence |
 | Ruflo or AQE absent | Their stores are not auto-discovered; register each JSONL file with `--live-source` |
 | Project name not reported | No supported metadata supplied a working directory; raw paths are never sent to the browser |
diff --git a/docs/ddd/live-sessions.md b/docs/ddd/live-sessions.md
index addf2e1..10bdb63 100644
--- a/docs/ddd/live-sessions.md
+++ b/docs/ddd/live-sessions.md
@@ -139,7 +139,7 @@ Project {
   id, label, updatedAt,
   sessionKeys[],
   sessionCount, childSessionCount, liveCount, completedCount,
-  providers
+  hosts, providers
 }
 ```
 
@@ -148,10 +148,9 @@ navigation roots only; `childSessionCount` reports descendant threads without pr
 peer work. Sessions are ordered live first and then by most recent evidence. A project ID is opaque
 and safe for DOM/routing; it never contains the raw working directory.
 
-`providers` is a transitional presentation field. It counts node-level provider identities when
-available, but the current reducer falls back to the session host when none are present. Consumers
-must not treat a fallback label as observed inference-provider evidence. A future schema should
-separate host counts from evidence-backed provider counts rather than preserve that fallback.
+`hosts` counts execution hosts independently. `providers` counts evidence-backed inference
+providers and uses an explicit `unknown` bucket when no provider evidence exists; it never
+substitutes the session host.
 
 Project identity means the owning repository, not the current branch or linked-worktree directory.
 For a live local worktree, the `.git` ownership pointer resolves the repository. Known nested
@@ -467,8 +466,8 @@ Direct manipulation follows a slippy-map interaction contract:
 
 The execution canvas and transcript rail share one selection model. Selecting an agent focuses its
 subtree and transcript; selecting a tool shows its safe summary; selecting evidence highlights and
-centers its owner. The initial overview shows project/provider identity, lifecycle, current work,
-and critical failures; metadata and evidence are details on demand
+centers its owner. The initial overview shows project, host, evidence-backed provider identity,
+lifecycle, current work, and critical failures; metadata and evidence are details on demand
 ([Shneiderman][eyes-have-it]).
 
 The right rail is persistent and subscribes only to the selected `{host, sessionId}`. It carries
@@ -565,9 +564,10 @@ process memory limits.
 
 ### Milestone 2: Operational shell
 
-- Lead with project/provider identity, model, lifecycle, freshness, and a safe summary.
+- Lead with project and host identity, evidence-backed provider/model identity, lifecycle,
+  freshness, and a safe summary.
 - Replace bare unknowns with evidence-specific missing-data language.
-- Provide a project-first browser with live-first, provider-qualified sessions and a
+- Provide a project-first browser with live-first, host-qualified sessions and a
   selected-session execution canvas.
 
 ### Milestone 3: Execution workspace
diff --git a/src/lib/dashboard-server.mjs b/src/lib/dashboard-server.mjs
index f6914fc..fdc28e7 100644
--- a/src/lib/dashboard-server.mjs
+++ b/src/lib/dashboard-server.mjs
@@ -29,7 +29,7 @@ import { driftReport, selfDrift } from './versions.mjs';
 import { drift as ruvnetBrainDrift } from './ruvnet-brain.mjs';
 import { drift as ruvectorDrift, managed as ruvectorManaged } from './ruvector.mjs';
 import { loadKitConfig } from './config.mjs';
-import { resolveRoutes, routingSummary, ACTIVITIES, HOST_PROVIDER } from './routing.mjs';
+import { resolveRoutes, routingSummary, ACTIVITIES } from './routing.mjs';
 import { renderPage } from './dashboard/page.mjs';
 import { requestRejection } from './dashboard/request-security.mjs';
 import { tokenMatches } from './admin-server.mjs';
@@ -147,9 +147,8 @@ async function collectData({ cwd, fetchStatus }) {
 
 /** The per-activity routing matrix for the dashboard (ADR-0005). Null unless a
  *  dualRouting policy is set, so single-host projects render nothing new. */
-function routingPayload() {
+export function routingPayload(cfg = loadKitConfig()) {
   try {
-    const cfg = loadKitConfig();
     const policy = cfg.providers?.dualRouting ?? {};
     if (!Object.keys(policy).length) return null;
     const routes = resolveRoutes(policy);
@@ -159,7 +158,7 @@ function routingPayload() {
       routes: ACTIVITIES.map((activity) => {
         const r = routes[activity];
         return {
-          activity, host: r.host, provider: HOST_PROVIDER[r.host], model: r.model ?? '',
+          activity, host: r.host, model: r.model ?? '',
           source: r.source, akOriginated: !!r.akOriginated,
           escalate: (r.escalate ?? []).map((e) => e.host),
         };
diff --git a/src/lib/dashboard/client.mjs b/src/lib/dashboard/client.mjs
index 426877e..3dda81a 100644
--- a/src/lib/dashboard/client.mjs
+++ b/src/lib/dashboard/client.mjs
@@ -357,8 +357,8 @@ export const JS = `
     document.getElementById("route-matrix").innerHTML=html;
   }
 
-  // Providers tab: the distinct host+model pairs the routing policy puts in
-  // play, with how many activities each covers. Hidden without a dual policy.
+  // Hosts & Routing tab: the distinct host+model pairs the routing policy puts
+  // in play, with how many activities each covers. Hidden without a dual policy.
   function renderModels(rt){
     var strip=document.getElementById("models");
     if(!rt||!rt.routes||!rt.routes.length){strip.hidden=true;return;}
diff --git a/src/lib/dashboard/live/client.mjs b/src/lib/dashboard/live/client.mjs
index 9e99f23..1c2f8af 100644
--- a/src/lib/dashboard/live/client.mjs
+++ b/src/lib/dashboard/live/client.mjs
@@ -25,16 +25,19 @@ export const LIVE_JS = `
   function short(s,n){s=String(s||"");return s.length>n?s.slice(0,n-1)+"…":s;}
   function title(s){return String(s||"activity").replace(/[._-]+/g," ").replace(/\\b\\w/g,function(c){return c.toUpperCase();});}
   function ago(v){var at=Date.parse(v||""),ms=Date.now()-at;if(!Number.isFinite(ms))return"";var s=Math.max(0,Math.round(ms/1000));if(s<5)return"just now";if(s<60)return s+"s ago";var m=Math.round(s/60);return m<60?m+"m ago":Math.round(m/60)+"h ago";}
-  function providerOf(v){var p=String(v&&v.provider||v&&v.host||"").toLowerCase();if(p.includes("claude")||p.includes("anthropic"))return"claude";if(p.includes("codex")||p.includes("openai"))return"codex";if(p.includes("ruflo"))return"ruflo";if(p.includes("aqe"))return"aqe";return"local";}
-  function providerName(v){return{claude:"Claude",codex:"Codex",ruflo:"ruflo",aqe:"Agentic QE",local:"Local"}[providerOf(v)];}
-  function providerGlyph(v){return{claude:"✳",codex:"◉",ruflo:"R",aqe:"Q",local:"⌁"}[providerOf(v)];}
+  function hostOf(v){return String(v&&v.host||"internal").toLowerCase();}
+  function hostName(v){var h=hostOf(v);return{claude:"Claude Code",codex:"Codex",internal:"Internal"}[h]||title(h);}
+  function hostGlyph(v){return{claude:"✳",codex:"◉",internal:"⌁"}[hostOf(v)]||"⌁";}
+  function inferenceProviderOf(v){if(v&&v.provider)return String(v.provider);var nodes=v&&v.nodes||[],session=nodes.find(function(n){return n.kind==="session"&&n.provider;});return session&&session.provider||null;}
+  function inferenceProviderName(v){var p=inferenceProviderOf(v);if(!p)return"Provider not established";return{anthropic:"Anthropic",openai:"OpenAI",openrouter:"OpenRouter",ollama:"Ollama",google:"Google Gemini"}[String(p).toLowerCase()]||title(p);}
+  function providerEvidence(v){var p=v&&v.providerProvenance;if(!p&&v&&v.nodes){var n=v.nodes.find(function(x){return x.kind==="session"&&x.provider;});p=n&&n.providerProvenance;}return p||"unknown";}
   function kindName(k){return{session:"Coordinator",agent:"Agent",subagent:"Worker",tool:"Tool",skill:"Skill",plugin:"Plugin",mcp:"MCP tool",gate:"Quality gate"}[k]||title(k||"agent");}
   function statusText(v){return{running:"Working",queued:"Queued",quiescent:"Waiting",expired:"No recent activity",blocked:"Blocked",completed:"Completed",failed:"Failed",cancelled:"Cancelled",idle:"Waiting"}[v]||"Outcome unavailable";}
   function label(n){return n&&(n.toolName||n.label||n.toolCategory||n.role&&title(n.role)||kindName(n.kind))||"Activity";}
   function actionText(a,n,s){if(a==="tool.started")return label(n)+" started";if(a==="tool.completed")return label(n)+(s==="failed"?" failed":" completed");return{"session.started":"Session started","session.input":"New input","agent.output":"Response produced","agent.spawned":"Worker dispatched","agent.planned":"Agent scheduled","session.completed":"Session completed","session.failed":"Session failed"}[a]||title(a);}
   function sessionsOf(v){var x=v&&v.snapshot?v.snapshot:v;return x&&Array.isArray(x.sessions)?x:{schemaVersion:1,cursor:null,projects:[],sessions:[]};}
   function setConnection(k,t){el("live-state-dot").dataset.state=k;el("live-state-text").textContent=t;el("live-browser-state-dot").dataset.state=k;el("live-browser-state").textContent=t;}
-  function sessionKey(s){return String(s&&s.key||((s&&s.host||providerOf(s))+":"+(s&&s.id||"")));}
+  function sessionKey(s){return String(s&&s.key||(hostOf(s)+":"+(s&&s.id||"")));}
   function isLiveSession(s){return!!s&&s.status==="running"&&s.lifecycle==="active";}
   function sessionState(s){var key=s&&s.status||"unknown",life=s&&s.lifecycle||"historical";if(key==="failed"||key==="cancelled"||key==="completed"||key==="blocked"||key==="queued")return{key:key,label:statusText(key)};if(life==="active"&&key==="running")return{key:"working",label:"Working now"};if(life==="quiescent")return{key:"waiting",label:"Waiting for activity"};if(life==="expired")return{key:"stale",label:"No recent activity"};if(life==="historical"&&key==="running")return{key:"stale",label:"Last seen working"};return{key:"historical",label:"Last active"};}
   function entityState(n,s){var key=n&&n.status||"unknown";if(key==="failed"||key==="cancelled"||key==="completed"||key==="blocked"||key==="queued")return{key:key,label:statusText(key)};if(key==="running"&&isLiveSession(s))return{key:"working",label:n&&({tool:1,skill:1,plugin:1,mcp:1})[n.kind]?"Running":"Working"};if(key==="running")return{key:"stale",label:"Last seen working"};if(key==="quiescent")return{key:"waiting",label:"Waiting"};if(key==="expired")return{key:"stale",label:"No recent activity"};return{key:"historical",label:"Activity recorded"};}
@@ -49,7 +52,7 @@ export const LIVE_JS = `
     if(!ev||!ev.sessionId||!ev.actor||!ev.actor.id)return;if(ev.eventId&&state.seen[ev.eventId])return;
     var sessions=state.snapshot.sessions.slice(),evKey=String(ev.sessionKey||ev.host+":"+ev.sessionId),i=sessions.findIndex(function(s){return sessionKey(s)===evKey;}),s=i>=0?Object.assign({},sessions[i]):{id:ev.sessionId,key:evKey,project:ev.project,projectKey:ev.projectKey,host:ev.host,status:"unknown",nodes:[],edges:[]};if(ev.parentSessionId)s.parentSessionId=ev.parentSessionId;
     s.nodes=(s.nodes||[]).slice();s.edges=(s.edges||[]).slice();var targetTerminal=!!ev.target&&/\\.(completed|failed|cancelled)$/.test(ev.action||""),priorActor=s.nodes.find(function(n){return n.id===ev.actor.id;});
-    function upsert(a,status){var at=s.nodes.findIndex(function(n){return n.id===a.id;}),old=at>=0?s.nodes[at]:{},next=Object.assign({},old,{id:a.id,kind:a.kind||old.kind,role:a.role||old.role,provider:a.provider||old.provider,model:a.model||old.model,label:a.label||old.label,toolName:a.toolName||old.toolName,host:ev.host||old.host,surface:ev.surface||old.surface,status:status||old.status,observedAt:ev.observedAt,confidence:ev.source&&ev.source.confidence||old.confidence,lastAction:ev.action,durationMs:ev.attributes&&ev.attributes.durationMs||old.durationMs});if(TERMINAL[old.status]&&!TERMINAL[next.status])next.status=old.status;if(at>=0)s.nodes[at]=next;else s.nodes.push(next);}
+    function upsert(a,status){var at=s.nodes.findIndex(function(n){return n.id===a.id;}),old=at>=0?s.nodes[at]:{},provider=a.provider||old.provider||null,next=Object.assign({},old,{id:a.id,kind:a.kind||old.kind,role:a.role||old.role,provider:provider,providerProvenance:provider?(ev.providerProvenance||old.providerProvenance||"unknown"):"unknown",model:a.model||old.model,label:a.label||old.label,toolName:a.toolName||old.toolName,host:ev.host||old.host,surface:ev.surface||old.surface,status:status||old.status,observedAt:ev.observedAt,confidence:ev.source&&ev.source.confidence||old.confidence,lastAction:ev.action,durationMs:ev.attributes&&ev.attributes.durationMs||old.durationMs});if(TERMINAL[old.status]&&!TERMINAL[next.status])next.status=old.status;if(at>=0)s.nodes[at]=next;else s.nodes.push(next);}
     upsert(ev.actor,targetTerminal?priorActor&&priorActor.status||"running":ev.status);if(ev.target&&ev.target.id){upsert(Object.assign({},ev.target,{label:ev.attributes&&(ev.attributes.toolName||ev.attributes.toolCategory)||ev.target.label,toolName:ev.attributes&&ev.attributes.toolName}),targetTerminal?ev.status:"running");var eid=ev.actor.id+"|"+ev.action+"|"+ev.target.id,edge={id:eid,source:ev.actor.id,target:ev.target.id,action:ev.action,confidence:ev.source&&ev.source.confidence},ei=s.edges.findIndex(function(x){return x.id===eid;});if(ei>=0)s.edges[ei]=edge;else s.edges.push(edge);}
     if(ev.actor.kind==="session"&&/^session\\./.test(ev.action||""))s.status=ev.status;if(ev.status==="running"&&(!ev.source||ev.source.adapter!=="codex-state"))s.lifecycle="active";else if(!s.lifecycle)s.lifecycle="historical";s.updatedAt=ev.observedAt;if(i>=0)sessions[i]=s;else sessions.push(s);
     state.snapshot={schemaVersion:state.snapshot.schemaVersion||1,cursor:ev.eventId||state.snapshot.cursor,projects:state.snapshot.projects,sessions:sessions,health:state.snapshot.health};if(ev.eventId)state.seen[ev.eventId]=1;state.events.unshift(ev);state.events=state.events.slice(0,100);state.lastAt=Date.now();if(!state.selected)selectSession(sessionKey(s),false);if(state.playback.mode==="live")render();
@@ -74,7 +77,7 @@ export const LIVE_JS = `
     Object.keys(toolGroups).forEach(function(o){var at=pos[o];if(at)toolGroups[o].forEach(function(t,i){tp[t.id]=toolPosition(at,i,toolGroups[o].length);});});
     var edges=d.edges.map(function(e){var a=pos[e.source],b=pos[e.target];if(!a||!b)return"";var active=isLiveSession(s)&&(s.nodes||[]).some(function(n){return(n.id===e.source||n.id===e.target)&&entityState(n,s).key==="working";}),rel=!selected||e.source===selected||e.target===selected,path=edgePath(a,b);return'<path id="edge-'+esc(e.id)+'" class="live-edge" data-source="'+esc(e.source)+'" data-target="'+esc(e.target)+'" data-active="'+active+'" data-related="'+rel+'" d="'+path+'"></path>'+(active?'<circle class="live-flow-dot" r="2.5"><animateMotion dur="1.5s" repeatCount="indefinite" path="'+path+'"></animateMotion></circle>':"");}).join("");
     Object.keys(toolGroups).forEach(function(o){var a=pos[o];toolGroups[o].forEach(function(t){var b=tp[t.id];if(!a||!b)return;var path="M"+(a.x+28)+" "+a.y+" C"+(a.x+70)+" "+a.y+" "+(b.x-96)+" "+b.y+" "+(b.x-78)+" "+b.y,active=entityState(t,s).key==="working",rel=!selected||selected===o||selected===t.id;edges+='<path class="live-edge live-tool-edge" data-source="'+esc(o)+'" data-target="'+esc(t.id)+'" data-active="'+active+'" data-related="'+rel+'" d="'+path+'"></path>'+(active?'<circle class="live-flow-dot" r="2"><animateMotion dur="1.1s" repeatCount="indefinite" path="'+path+'"></animateMotion></circle>':"");});});
-    var nodes=d.nodes.map(function(n){var p=pos[n.id],sel=selected===n.id,rel=!selected||!!related[n.id],pin=!!state.pinned[(s?s.id:"")+"|"+n.id],view=entityState(n,s),meta=n.model&&n.model!=="unknown"?n.model:view.label,work=view.key==="working"?actionText(n.lastAction,n,n.status):view.label,past=d.history[n.id]||0;return'<g class="live-node" tabindex="0" role="button" data-node="'+esc(n.id)+'" data-kind="'+esc(n.kind||"agent")+'" data-status="'+esc(view.key)+'" data-selected="'+sel+'" data-related="'+rel+'" data-pinned="'+pin+'" aria-label="'+esc(label(n)+", "+kindName(n.kind)+", "+view.label)+'" transform="translate('+p.x+" "+p.y+')"><circle class="node-aura" r="42"></circle>'+kindShape(n.kind)+'<circle class="node-status" cx="25" cy="-22" r="4"></circle><text class="node-name" text-anchor="middle" y="48">'+esc(short(label(n),20))+'</text><text class="node-eyebrow" text-anchor="middle" y="63">'+esc(short((kindName(n.kind)+" · "+providerName(n)).toUpperCase(),26))+'</text><g class="node-work" transform="translate(34 -55)"><rect width="154" height="37" rx="18"></rect><circle cx="14" cy="18.5" r="3"></circle><text x="25" y="16">'+esc(short(work,24))+'</text><text class="node-meta" x="25" y="28">'+esc(short(meta,27))+'</text></g>'+(past?'<g class="node-history" transform="translate(34 76)"><rect width="116" height="24" rx="12"></rect><text x="12" y="16">'+past+' earlier operations</text></g>':"")+"</g>";}).join("");
+    var nodes=d.nodes.map(function(n){var p=pos[n.id],sel=selected===n.id,rel=!selected||!!related[n.id],pin=!!state.pinned[(s?s.id:"")+"|"+n.id],view=entityState(n,s),meta=n.model&&n.model!=="unknown"?n.model:view.label,work=view.key==="working"?actionText(n.lastAction,n,n.status):view.label,past=d.history[n.id]||0;return'<g class="live-node" tabindex="0" role="button" data-node="'+esc(n.id)+'" data-kind="'+esc(n.kind||"agent")+'" data-status="'+esc(view.key)+'" data-selected="'+sel+'" data-related="'+rel+'" data-pinned="'+pin+'" aria-label="'+esc(label(n)+", "+kindName(n.kind)+", "+view.label)+'" transform="translate('+p.x+" "+p.y+')"><circle class="node-aura" r="42"></circle>'+kindShape(n.kind)+'<circle class="node-status" cx="25" cy="-22" r="4"></circle><text class="node-name" text-anchor="middle" y="48">'+esc(short(label(n),20))+'</text><text class="node-eyebrow" text-anchor="middle" y="63">'+esc(short((kindName(n.kind)+" · "+hostName(n)).toUpperCase(),26))+'</text><g class="node-work" transform="translate(34 -55)"><rect width="154" height="37" rx="18"></rect><circle cx="14" cy="18.5" r="3"></circle><text x="25" y="16">'+esc(short(work,24))+'</text><text class="node-meta" x="25" y="28">'+esc(short(meta,27))+'</text></g>'+(past?'<g class="node-history" transform="translate(34 76)"><rect width="116" height="24" rx="12"></rect><text x="12" y="16">'+past+' earlier operations</text></g>':"")+"</g>";}).join("");
     var tools=d.tools.map(function(t){var p=tp[t.id];if(!p)return"";var rel=!selected||selected===t.id||selected===d.owner[t.id],view=entityState(t,s),elapsed=Number.isFinite(t.durationMs)?(t.durationMs<1000?t.durationMs+" ms":(t.durationMs/1000).toFixed(1)+" s"):"";return'<g class="live-tool" tabindex="0" role="button" data-node="'+esc(t.id)+'" data-owner="'+esc(d.owner[t.id]||"")+'" data-kind="'+esc(t.kind||"tool")+'" data-status="'+esc(view.key)+'" data-related="'+rel+'" aria-label="'+esc(label(t)+", "+kindName(t.kind)+", "+view.label)+'" transform="translate('+p.x+" "+p.y+')"><rect class="live-tool-halo" x="-86" y="-21" width="172" height="42" rx="21"></rect><rect class="live-tool-card" x="-80" y="-17" width="160" height="34" rx="17"></rect><path class="live-tool-icon" d="M-66-1L-61-6-56-1-61 4Z"></path><text class="tool-name" x="-48" y="-2">'+esc(short(label(t),20))+'</text><text class="tool-state" x="-48" y="10">'+esc(short(view.label+(elapsed?" · "+elapsed:""),24))+"</text></g>";}).join("");
     el("live-edges").innerHTML=edges;el("live-nodes").innerHTML=nodes;el("live-tools").innerHTML=tools;el("live-empty").hidden=d.nodes.length>0;el("live-graph-summary").textContent=d.nodes.length+" agents · "+d.totalTools+" operations · "+d.edges.length+" handoffs";applyCamera();renderSelection(s,d);
   }
@@ -83,11 +86,11 @@ export const LIVE_JS = `
   function fit(selector){var root=el(selector||"live-viewport"),box;try{box=root.getBBox();}catch(_){return;}if(!box.width&&!box.height)return;var c=el("live-canvas"),p=42,k=Math.max(.25,Math.min(2.5,Math.min((c.clientWidth-p*2)/Math.max(1,box.width),(c.clientHeight-p*2)/Math.max(1,box.height))));state.camera={k:k,x:(c.clientWidth-box.width*k)/2-box.x*k,y:(c.clientHeight-box.height*k)/2-box.y*k};applyCamera();}
   function fitSelection(){if(!state.node){fit();return;}var n=el("live-graph").querySelector('[data-node="'+CSS.escape(state.node)+'"]');if(!n)return;var b=n.getBBox(),c=el("live-canvas"),k=Math.min(2.2,Math.max(1,state.camera.k));state.camera={k:k,x:c.clientWidth/2-(b.x+b.width/2)*k,y:c.clientHeight/2-(b.y+b.height/2)*k};applyCamera();}
   function updateGeometry(id){var s=sessionById(state.selected),p=state.positions[s?s.id:"none"]||{},g=el("live-graph").querySelector('[data-node="'+CSS.escape(id)+'"]');if(g&&p[id])g.setAttribute("transform","translate("+p[id].x+" "+p[id].y+")");renderGraph(s);}
-  function renderSelection(s,d){var value=(d.nodes.concat(d.tools)).find(function(n){return n.id===state.node;}),box=el("live-selection-body");if(!value){box.textContent="Select an agent or tool in the map.";return;}var view=entityState(value,s),elapsed=Number.isFinite(value.durationMs)?(value.durationMs<1000?value.durationMs+" ms":(value.durationMs/1000).toFixed(1)+" s"):"Not available",owner=d.owner[value.id],ownerNode=d.nodes.find(function(n){return n.id===owner;}),fields=[["Type",kindName(value.kind)],["State",view.label],["Provider",providerName(value)],["Owner",ownerNode?label(ownerNode):"Not applicable"],["Elapsed",elapsed],["Current work",view.key==="working"?actionText(value.lastAction,value,value.status):view.label],["Evidence",value.confidence||"not reported"]];box.innerHTML="<strong>"+esc(label(value))+"</strong><dl>"+fields.map(function(x){return"<dt>"+esc(x[0])+"</dt><dd>"+esc(x[1])+"</dd>";}).join("")+"</dl>";}
+  function renderSelection(s,d){var value=(d.nodes.concat(d.tools)).find(function(n){return n.id===state.node;}),box=el("live-selection-body");if(!value){box.textContent="Select an agent or tool in the map.";return;}var view=entityState(value,s),elapsed=Number.isFinite(value.durationMs)?(value.durationMs<1000?value.durationMs+" ms":(value.durationMs/1000).toFixed(1)+" s"):"Not available",owner=d.owner[value.id],ownerNode=d.nodes.find(function(n){return n.id===owner;}),fields=[["Type",kindName(value.kind)],["State",view.label],["Host",hostName(value)],["Provider",inferenceProviderName(value)],["Provider evidence",providerEvidence(value)],["Owner",ownerNode?label(ownerNode):"Not applicable"],["Elapsed",elapsed],["Current work",view.key==="working"?actionText(value.lastAction,value,value.status):view.label],["Evidence",value.confidence||"not reported"]];box.innerHTML="<strong>"+esc(label(value))+"</strong><dl>"+fields.map(function(x){return"<dt>"+esc(x[0])+"</dt><dd>"+esc(x[1])+"</dd>";}).join("")+"</dl>";}
   function projectCatalog(){var given=Array.isArray(state.snapshot.projects)?state.snapshot.projects:[],by={};state.snapshot.sessions.forEach(function(s){var id=String(s.projectKey||projectName(s)),p=by[id]||(by[id]={id:id,name:projectName(s),sessionCount:0,childSessionCount:0,liveCount:0,updatedAt:s.updatedAt});if(isNavigationRoot(s)){p.sessionCount++;if(isLiveSession(s))p.liveCount++;}else p.childSessionCount++;if(Date.parse(s.updatedAt||0)>Date.parse(p.updatedAt||0))p.updatedAt=s.updatedAt;});given.forEach(function(p){var id=String(p.id||p.key||p.projectKey||p.label||p.name),derived=by[id]||{},name=p.label||p.name||p.project||derived.name||"Project not reported";by[id]=Object.assign({},p,derived,{id:id,name:name});});return Object.keys(by).map(function(k){return by[k];}).sort(function(a,b){return Number(b.liveCount||0)-Number(a.liveCount||0)||Date.parse(b.updatedAt||0)-Date.parse(a.updatedAt||0)||a.name.localeCompare(b.name);});}
   function duration(s){var start=s.startedAt||s.createdAt,end=s.endedAt||s.completedAt||((s.status==="completed"||s.status==="failed"||s.status==="cancelled")&&s.updatedAt),a=Date.parse(start||""),b=Date.parse(end||""),ms=b-a;if(!Number.isFinite(a)||!Number.isFinite(b)||ms<=0)return ago(s.updatedAt)||"activity time unavailable";var m=Math.max(1,Math.round(ms/60000));return m<60?m+"m":Math.floor(m/60)+"h "+m%60+"m";}
-  function sessionMarkup(s,child){var live=isLiveSession(s),key=sessionKey(s),view=sessionState(s);return'<button class="live-session'+(child?" live-session-child":"")+'" type="button" role="listitem" data-session="'+esc(s.id)+'" data-key="'+esc(key)+'" data-live="'+live+'" data-state="'+esc(view.key)+'" aria-current="'+(key===state.selected)+'"><span class="live-provider" data-provider="'+esc(providerOf(s))+'" aria-hidden="true">'+esc(child?"↳":providerGlyph(s))+'</span><span class="live-session-main">'+esc(short(s.title||s.summary||(child?"Worker thread":providerName(s)+" session"),31))+'</span><span class="live-session-provider"><i data-status="'+esc(view.key)+'"></i>'+esc(child?"Sub-agent · "+providerName(s):providerName(s))+" · "+esc(view.label)+" · "+esc(duration(s))+"</span></button>";}
-  function renderSessions(){var projects=projectCatalog(),list=visibleSessions(),current=projects.find(function(p){return p.id===state.project;}),selected=sessionById(state.selected),browser=el("live-browser"),liveSessions=state.snapshot.sessions.filter(isLiveSession),liveProjects=projects.filter(function(p){return Number(p.liveCount)>0;});browser.dataset.level=state.browserLevel;el("live-sub").textContent=liveSessions.length?liveSessions.length+" active session"+(liveSessions.length===1?"":"s")+" across "+liveProjects.length+" project"+(liveProjects.length===1?"":"s"):"No active sessions · browse retained local evidence";el("live-browser-kicker").textContent=state.browserLevel==="sessions"?"PROJECT":"WORKSPACES";el("live-browser-title").textContent=state.browserLevel==="sessions"&&current?short(current.name,26):"Projects";el("live-project-count").textContent=String(projects.length);el("live-project-list").innerHTML=projects.map(function(p){var live=Number(p.liveCount||0),workers=Number(p.childSessionCount||0);return'<button class="live-project" type="button" role="listitem" data-project="'+esc(p.id)+'" data-live="'+(live>0)+'" aria-current="'+(p.id===state.project)+'"><span>'+esc(short(p.name,34))+'</span><small>'+(live?'<b>'+live+' WORKING</b> · ':"")+Number(p.sessionCount||0)+" sessions"+(workers?" · "+workers+" workers":"")+" · "+esc(ago(p.updatedAt)||"activity time unavailable")+"</small></button>";}).join("")||'<div class="live-browser-empty">No local projects found yet.</div>';var selectedRoot=rootSession(selected);if(!selectedRoot||!list.some(function(s){return sessionKey(s)===sessionKey(selectedRoot);})){selectSession(list[0]&&sessionKey(list[0]),true);list=visibleSessions();selected=sessionById(state.selected);selectedRoot=rootSession(selected);}el("live-session-heading").textContent=current?short(current.name,36):"Sessions";el("live-count").textContent=String(list.length);el("live-session-list").innerHTML=list.map(function(s){var children=sessionKey(s)===sessionKey(selectedRoot)?childSessions(s):[];return'<div class="live-session-family">'+sessionMarkup(s,false)+(children.length?'<div class="live-session-children" role="group" aria-label="Sub-agent threads">'+children.map(function(child){return sessionMarkup(child,true);}).join("")+"</div>":"")+"</div>";}).join("")||'<div class="live-browser-empty">No retained sessions for this project.</div>';el("live-session-context-provider").textContent=selected?providerName(selected):"—";el("live-session-context-project").textContent=selected?projectName(selected):"Choose a session";var selectedState=sessionState(selected);el("live-session-context-status").textContent=selected?selectedState.label+" · "+duration(selected):"Waiting for local evidence";}
+  function sessionMarkup(s,child){var live=isLiveSession(s),key=sessionKey(s),view=sessionState(s),identity=hostName(s)+" · "+inferenceProviderName(s);return'<button class="live-session'+(child?" live-session-child":"")+'" type="button" role="listitem" data-session="'+esc(s.id)+'" data-key="'+esc(key)+'" data-live="'+live+'" data-state="'+esc(view.key)+'" aria-current="'+(key===state.selected)+'"><span class="live-host" data-host="'+esc(hostOf(s))+'" aria-hidden="true">'+esc(child?"↳":hostGlyph(s))+'</span><span class="live-session-main">'+esc(short(s.title||s.summary||(child?"Worker thread":hostName(s)+" session"),31))+'</span><span class="live-session-identity"><i data-status="'+esc(view.key)+'"></i>'+esc(child?"Sub-agent · "+identity:identity)+" · "+esc(view.label)+" · "+esc(duration(s))+"</span></button>";}
+  function renderSessions(){var projects=projectCatalog(),list=visibleSessions(),current=projects.find(function(p){return p.id===state.project;}),selected=sessionById(state.selected),browser=el("live-browser"),liveSessions=state.snapshot.sessions.filter(isLiveSession),liveProjects=projects.filter(function(p){return Number(p.liveCount)>0;});browser.dataset.level=state.browserLevel;el("live-sub").textContent=liveSessions.length?liveSessions.length+" active session"+(liveSessions.length===1?"":"s")+" across "+liveProjects.length+" project"+(liveProjects.length===1?"":"s"):"No active sessions · browse retained local evidence";el("live-browser-kicker").textContent=state.browserLevel==="sessions"?"PROJECT":"WORKSPACES";el("live-browser-title").textContent=state.browserLevel==="sessions"&&current?short(current.name,26):"Projects";el("live-project-count").textContent=String(projects.length);el("live-project-list").innerHTML=projects.map(function(p){var live=Number(p.liveCount||0),workers=Number(p.childSessionCount||0);return'<button class="live-project" type="button" role="listitem" data-project="'+esc(p.id)+'" data-live="'+(live>0)+'" aria-current="'+(p.id===state.project)+'"><span>'+esc(short(p.name,34))+'</span><small>'+(live?'<b>'+live+' WORKING</b> · ':"")+Number(p.sessionCount||0)+" sessions"+(workers?" · "+workers+" workers":"")+" · "+esc(ago(p.updatedAt)||"activity time unavailable")+"</small></button>";}).join("")||'<div class="live-browser-empty">No local projects found yet.</div>';var selectedRoot=rootSession(selected);if(!selectedRoot||!list.some(function(s){return sessionKey(s)===sessionKey(selectedRoot);})){selectSession(list[0]&&sessionKey(list[0]),true);list=visibleSessions();selected=sessionById(state.selected);selectedRoot=rootSession(selected);}el("live-session-heading").textContent=current?short(current.name,36):"Sessions";el("live-count").textContent=String(list.length);el("live-session-list").innerHTML=list.map(function(s){var children=sessionKey(s)===sessionKey(selectedRoot)?childSessions(s):[];return'<div class="live-session-family">'+sessionMarkup(s,false)+(children.length?'<div class="live-session-children" role="group" aria-label="Sub-agent threads">'+children.map(function(child){return sessionMarkup(child,true);}).join("")+"</div>":"")+"</div>";}).join("")||'<div class="live-browser-empty">No retained sessions for this project.</div>';el("live-session-context-identity").textContent=selected?hostName(selected)+" · "+inferenceProviderName(selected):"—";el("live-session-context-project").textContent=selected?projectName(selected):"Choose a session";var selectedState=sessionState(selected);el("live-session-context-status").textContent=selected?selectedState.label+" · "+duration(selected):"Waiting for local evidence";}
   function renderHealth(){var h=state.snapshot.health||{},bad=0;el("live-health").innerHTML=Object.keys(h).sort().map(function(n){var v=h[n]||{};if(v.status==="error")bad++;return'<span class="live-health-item" data-status="'+esc(v.status||"unknown")+'"><b>'+esc(n)+'</b> · '+esc(v.status||"unknown")+" · "+Number(v.files||0)+" files · "+Number(v.events||0)+" events · "+Number(v.errors||0)+" errors</span>";}).join("");el("live-health-toggle").textContent=bad?bad+" source issue"+(bad===1?"":"s"):"Sources";}
   function render(){renderSessions();renderHealth();el("live-cursor").textContent=state.snapshot.cursor||"";var source=sessionById(state.selected),s=state.playback.mode==="review"&&state.playback.session||source;renderGraph(s);renderPlayback();if(s&&state.fitFor!==sessionKey(s)){state.fitFor=sessionKey(s);(window.requestAnimationFrame||setTimeout)(function(){fit();});}}
   function closeTranscript(){if(state.transcript.source)state.transcript.source.close();state.transcript.source=null;state.transcript.status="idle";}
@@ -98,14 +101,14 @@ export const LIVE_JS = `
     part("",v.content??v.text??v.message??v.body??v.summary);part("Details",v.details);part("Reasoning",v.reasoning);part("Command",v.command);part("Arguments",v.arguments??v.args??v.input);part("Patch",v.patch??v.diff);part("Result",v.result??v.output);part("Error",v.error??v.errorMessage);
     var tool=v.tool||{},toolLabel=tool.name||tool.category,content=parts.map(function(p){return(p.name?p.name+"\\n":"")+p.text;}).join("\\n\\n");if(!content&&toolLabel)content=statusText(tool.status);return{id:String(v.id||v.eventId||tool.callId||[v.timestamp||v.observedAt||"",role,agent,content.slice(0,80)].join("|")),role:role,content:content,agent:agent,label:String(v.label||v.toolName||v.name||toolLabel||role),at:v.timestamp||v.observedAt||v.at||"",tool:tool};}
   function addTranscript(v,reset){if(reset){state.transcript.turns=[];state.transcript.seen={};}transcriptItems(v).forEach(function(raw){var t=normalizeTurn(raw);if(!t.content||state.transcript.seen[t.id])return;state.transcript.seen[t.id]=1;state.transcript.turns.push(t);});if(state.transcript.turns.length>MAX_TURNS)state.transcript.turns=state.transcript.turns.slice(-MAX_TURNS);renderTranscript(true);}
-  function openTranscript(s){closeTranscript();state.transcript.session=s&&sessionKey(s);state.transcript.turns=[];state.transcript.seen={};state.transcript.unread=0;renderTranscript();if(!s||!window.EventSource)return;var url="/api/live/transcripts/"+encodeURIComponent(s.host||providerOf(s))+"/"+encodeURIComponent(s.id)+"/events",src=new EventSource(dashSseUrl(url));state.transcript.source=src;transcriptStatus("connecting","Connecting");src.onopen=function(){transcriptStatus("live","Live");};src.onmessage=function(e){try{addTranscript(JSON.parse(e.data));}catch(_){}};["init","reset","turn","message","delta"].forEach(function(k){src.addEventListener(k,function(e){try{var d=JSON.parse(e.data);addTranscript(d,k==="reset"||!!d.reset);}catch(_){}});});src.onerror=function(){transcriptStatus("error","Unavailable");};}
-  function renderTranscript(arrived){var s=sessionById(state.selected),q=state.transcript.query.toLowerCase(),agent=state.node,items=state.transcript.turns.filter(function(t){return(!q||(t.content+" "+t.label).toLowerCase().includes(q))&&(!agent||!t.agent||t.agent===agent);}).slice().reverse(),list=el("live-transcript-list"),oldHeight=list.scrollHeight,oldTop=list.scrollTop,nearTop=oldTop<56;el("live-transcript-context").textContent=s?(s.project&&s.project!=="unknown"?s.project:"Project not reported")+" · "+providerName(s):"Select a session to follow";el("live-transcript-clear-filter").hidden=!agent;if(agent)el("live-transcript-clear-filter").textContent="All agents";if(!items.length)list.innerHTML='<div class="live-transcript-empty">'+esc(q?"No matching transcript activity":agent?"No transcript activity attributed to this selection yet.":"Transcript content stays local and appears here as the selected session runs.")+"</div>";else list.innerHTML=items.map(function(t){var fold=t.role==="thinking"||t.role==="tool"||t.role==="tool_result"||t.role==="error",body='<div class="live-turn-body">'+esc(t.content)+"</div>";return'<article class="live-turn" data-turn="'+esc(t.id)+'" data-role="'+esc(t.role)+'" data-agent="'+esc(t.agent)+'"><div class="live-turn-head"><span>'+esc(t.label||t.role)+'</span><time>'+esc(ago(t.at)||"now")+"</time></div>"+(fold?"<details><summary>Show "+esc(t.role.replace("_"," "))+"</summary>"+body+"</details>":body)+"</article>";}).join("");if(arrived){if(state.transcript.follow||nearTop){list.scrollTop=0;state.transcript.unread=0;}else{list.scrollTop=oldTop+Math.max(0,list.scrollHeight-oldHeight);state.transcript.unread++;}}el("live-transcript-new").hidden=!state.transcript.unread;el("live-transcript-new").textContent=state.transcript.unread+" new activit"+(state.transcript.unread===1?"y":"ies")+" ↑";}
+  function openTranscript(s){closeTranscript();state.transcript.session=s&&sessionKey(s);state.transcript.turns=[];state.transcript.seen={};state.transcript.unread=0;renderTranscript();if(!s||!s.host||!window.EventSource)return;var url="/api/live/transcripts/"+encodeURIComponent(s.host)+"/"+encodeURIComponent(s.id)+"/events",src=new EventSource(dashSseUrl(url));state.transcript.source=src;transcriptStatus("connecting","Connecting");src.onopen=function(){transcriptStatus("live","Live");};src.onmessage=function(e){try{addTranscript(JSON.parse(e.data));}catch(_){}};["init","reset","turn","message","delta"].forEach(function(k){src.addEventListener(k,function(e){try{var d=JSON.parse(e.data);addTranscript(d,k==="reset"||!!d.reset);}catch(_){}});});src.onerror=function(){transcriptStatus("error","Unavailable");};}
+  function renderTranscript(arrived){var s=sessionById(state.selected),q=state.transcript.query.toLowerCase(),agent=state.node,items=state.transcript.turns.filter(function(t){return(!q||(t.content+" "+t.label).toLowerCase().includes(q))&&(!agent||!t.agent||t.agent===agent);}).slice().reverse(),list=el("live-transcript-list"),oldHeight=list.scrollHeight,oldTop=list.scrollTop,nearTop=oldTop<56;el("live-transcript-context").textContent=s?(s.project&&s.project!=="unknown"?s.project:"Project not reported")+" · "+hostName(s)+" · "+inferenceProviderName(s):"Select a session to follow";el("live-transcript-clear-filter").hidden=!agent;if(agent)el("live-transcript-clear-filter").textContent="All agents";if(!items.length)list.innerHTML='<div class="live-transcript-empty">'+esc(q?"No matching transcript activity":agent?"No transcript activity attributed to this selection yet.":"Transcript content stays local and appears here as the selected session runs.")+"</div>";else list.innerHTML=items.map(function(t){var fold=t.role==="thinking"||t.role==="tool"||t.role==="tool_result"||t.role==="error",body='<div class="live-turn-body">'+esc(t.content)+"</div>";return'<article class="live-turn" data-turn="'+esc(t.id)+'" data-role="'+esc(t.role)+'" data-agent="'+esc(t.agent)+'"><div class="live-turn-head"><span>'+esc(t.label||t.role)+'</span><time>'+esc(ago(t.at)||"now")+"</time></div>"+(fold?"<details><summary>Show "+esc(t.role.replace("_"," "))+"</summary>"+body+"</details>":body)+"</article>";}).join("");if(arrived){if(state.transcript.follow||nearTop){list.scrollTop=0;state.transcript.unread=0;}else{list.scrollTop=oldTop+Math.max(0,list.scrollHeight-oldHeight);state.transcript.unread++;}}el("live-transcript-new").hidden=!state.transcript.unread;el("live-transcript-new").textContent=state.transcript.unread+" new activit"+(state.transcript.unread===1?"y":"ies")+" ↑";}
   function stopPlayback(){if(state.playback.timer)clearInterval(state.playback.timer);state.playback.timer=null;state.playback.playing=false;}
   function playbackRecords(){return state.playback.events.length?state.playback.events:state.playback.items;}
   function reviewSession(index){var source=sessionById(state.selected),events=state.playback.events.slice(0,index+1),nodes={},edges={};if(source)nodes[source.id]={id:source.id,kind:"session",host:source.host,status:"running",label:source.title};events.forEach(function(ev){var a=ev.actor||{},t=ev.target||{},tool=ev.tool||{},aid=a.id||source&&source.id,tid=t.id||tool.callId;if(aid){var priorActor=nodes[aid]||{};nodes[aid]=Object.assign({},priorActor,{id:aid,kind:a.kind||(a.role==="tool"?"tool":aid===source.id?"session":"agent"),role:a.role||priorActor.role,label:a.label||priorActor.label,host:source&&source.host,status:ev.status||priorActor.status||"running",observedAt:ev.at});}if(tid){var prior=nodes[tid]||{},nextLabel=t.label||tool.name||tool.category||prior.label;nodes[tid]=Object.assign({},prior,{id:tid,kind:tool.callId?"tool":t.kind||prior.kind||"agent",role:t.role||prior.role,label:nextLabel,toolName:tool.name||prior.toolName,status:tool.status||ev.status||prior.status||"running",durationMs:tool.durationMs||prior.durationMs,observedAt:ev.at});var eid=String(aid+"|"+(tool.callId||tid));edges[eid]={id:eid,source:aid,target:tid,action:ev.relation||ev.kind||"activity"};}});return Object.assign({},source||{},{nodes:Object.keys(nodes).map(function(k){return nodes[k];}),edges:Object.keys(edges).map(function(k){return edges[k];})});}
   function setReviewIndex(index){var p=state.playback,records=playbackRecords(),max=Math.max(0,records.length-1);p.index=Math.max(0,Math.min(max,Number(index)||0));p.session=reviewSession(p.index);var cutoff=records[p.index]&&(records[p.index].at||records[p.index].observedAt||records[p.index].timestamp),items=p.items.filter(function(item,i){var at=item.at||item.observedAt||item.timestamp;return cutoff&&at?Date.parse(at)<=Date.parse(cutoff):i<=Math.round(p.index/Math.max(1,records.length-1)*Math.max(0,p.items.length-1));});addTranscript(items.length?items:records.slice(0,p.index+1),true);renderGraph(p.session);renderPlayback();}
   function renderPlayback(){var p=state.playback,review=p.mode==="review",selected=sessionById(state.selected),active=isLiveSession(selected),records=playbackRecords(),range=el("live-playback-range"),mode=el("live-mode");mode.dataset.mode=review?"review":"live";mode.textContent=review?"REVIEW":"LIVE";el("live-playback").dataset.mode=review?"review":"live";range.disabled=!review||!records.length;range.max=String(Math.max(0,records.length-1));range.value=String(review?p.index:Math.max(0,records.length-1));el("live-playback-toggle").disabled=!review||!records.length;el("live-playback-toggle").innerHTML=p.playing?"&#9208;":"&#9654;";el("live-playback-toggle").setAttribute("aria-label",p.playing?"Pause session review":"Play session review");el("live-enter-review").hidden=review||!active;el("live-resume-live").hidden=!review||!active;var at=records[p.index]&&(records[p.index].observedAt||records[p.index].timestamp||records[p.index].at),stamp=at?new Date(at).toLocaleTimeString([], {hour:"2-digit",minute:"2-digit",second:"2-digit"}):"";el("live-playback-time").textContent=review?(stamp||String(Math.min(p.index+1,records.length))+" / "+String(records.length)):"Live now";}
-  function loadPlayback(s){closeTranscript();stopPlayback();state.playback={mode:"review",events:[],items:[],index:0,playing:false,speed:state.playback.speed||1,timer:null,startAt:null,endAt:null,session:null,truncated:false,gap:false};transcriptStatus("connecting","Loading review");renderPlayback();fetch("/api/live/playback/"+encodeURIComponent(s.host||providerOf(s))+"/"+encodeURIComponent(s.id),{cache:"no-store",headers:{"x-dash-token":DASH_TOKEN}}).then(function(r){if(!r.ok)throw Error();return r.json();}).then(function(v){state.playback.events=Array.isArray(v.events)?v.events:[];state.playback.items=transcriptItems(v.transcript||v.items||[]);state.playback.startAt=v.startAt||null;state.playback.endAt=v.endAt||null;state.playback.truncated=!!v.truncated;state.playback.gap=!!v.gap;var notice=el("live-replay-notice");notice.hidden=!state.playback.truncated&&!state.playback.gap;notice.textContent=state.playback.gap?"Some source events are unavailable; this replay contains an evidence gap.":state.playback.truncated?"Replay begins at the earliest retained local evidence.":"";var records=playbackRecords();setReviewIndex(Math.max(0,records.length-1));transcriptStatus("review","Review");}).catch(function(){state.playback.items=[];state.playback.events=[];state.transcript.turns=[];renderTranscript();transcriptStatus("error","Review unavailable");renderPlayback();});}
+  function loadPlayback(s){closeTranscript();stopPlayback();state.playback={mode:"review",events:[],items:[],index:0,playing:false,speed:state.playback.speed||1,timer:null,startAt:null,endAt:null,session:null,truncated:false,gap:false};transcriptStatus("connecting","Loading review");renderPlayback();if(!s.host){transcriptStatus("error","Review unavailable");return;}fetch("/api/live/playback/"+encodeURIComponent(s.host)+"/"+encodeURIComponent(s.id),{cache:"no-store",headers:{"x-dash-token":DASH_TOKEN}}).then(function(r){if(!r.ok)throw Error();return r.json();}).then(function(v){state.playback.events=Array.isArray(v.events)?v.events:[];state.playback.items=transcriptItems(v.transcript||v.items||[]);state.playback.startAt=v.startAt||null;state.playback.endAt=v.endAt||null;state.playback.truncated=!!v.truncated;state.playback.gap=!!v.gap;var notice=el("live-replay-notice");notice.hidden=!state.playback.truncated&&!state.playback.gap;notice.textContent=state.playback.gap?"Some source events are unavailable; this replay contains an evidence gap.":state.playback.truncated?"Replay begins at the earliest retained local evidence.":"";var records=playbackRecords();setReviewIndex(Math.max(0,records.length-1));transcriptStatus("review","Review");}).catch(function(){state.playback.items=[];state.playback.events=[];state.transcript.turns=[];renderTranscript();transcriptStatus("error","Review unavailable");renderPlayback();});}
   function resumeLive(){var s=sessionById(state.selected);stopPlayback();state.playback.mode="live";state.playback.events=[];state.playback.items=[];state.playback.session=null;if(isLiveSession(s))openTranscript(s);else if(s)loadPlayback(s);render();}
   function selectSession(id,open){var s=sessionById(id),key=s?sessionKey(s):id;if(state.selected===key&&state.transcript.session===key)return;stopPlayback();state.selected=key||null;state.node=null;state.fitFor=null;state.camera={x:24,y:24,k:1};if(open!==false){if(isLiveSession(s)){state.playback.mode="live";openTranscript(s);}else if(s)loadPlayback(s);}}
   function selectNode(id){state.node=id||null;render();renderTranscript();}
diff --git a/src/lib/dashboard/live/styles.mjs b/src/lib/dashboard/live/styles.mjs
index 3f6960d..5337129 100644
--- a/src/lib/dashboard/live/styles.mjs
+++ b/src/lib/dashboard/live/styles.mjs
@@ -5,19 +5,19 @@ export const LIVE_CSS = `
 .live-pause:focus-visible,.live-health-summary:focus-visible,.live-view-tools button:focus-visible,.live-transcript-tools button:focus-visible,.live-search input:focus-visible,.live-node:focus-visible,.live-tool:focus-visible{outline:2px solid var(--accent);outline-offset:3px}.live-pause[aria-pressed=true]{color:var(--warn)}
 .live-mode{border:1px solid color-mix(in srgb,var(--ok) 55%,var(--line));border-radius:999px;padding:5px 9px;color:var(--ok);font:800 9px/1 ui-monospace,monospace;letter-spacing:.14em}.live-mode[data-mode=review]{color:var(--warn);border-color:color-mix(in srgb,var(--warn) 55%,var(--line))}
 .live-state{min-height:20px;display:flex;align-items:center;gap:7px;color:var(--ink-2);font-size:10px;margin:0 1px 6px}.live-state-dot{width:7px;height:7px;border-radius:50%;background:var(--ink-2)}.live-state-dot[data-state=live]{background:var(--ok);box-shadow:0 0 12px var(--ok)}.live-state-dot[data-state=paused],.live-state-dot[data-state=stale]{background:var(--warn)}.live-state-dot[data-state=offline]{background:var(--fail)}.live-health-summary{padding:3px 8px;font-size:9px;margin-left:auto}.live-cursor{font-size:8px;color:var(--ink-dim)}.live-health{position:fixed;z-index:100;display:flex;max-height:min(420px,calc(100vh - 24px));overflow:auto;flex-direction:column;gap:2px;padding:8px;border:1px solid var(--line);border-radius:13px;background:color-mix(in srgb,var(--panel) 97%,transparent);box-shadow:0 18px 55px #0009;backdrop-filter:blur(22px)}.live-health[hidden],.live-health:empty{display:none}.live-health-item{display:grid;grid-template-columns:minmax(76px,1fr) auto;padding:7px 8px;border-radius:8px;color:var(--ink-2);font-size:8px}.live-health-item b{color:var(--ink)}.live-health-item[data-status=error]{color:var(--fail);background:color-mix(in srgb,var(--fail) 7%,transparent)}
-.live-workspace{height:calc(100vh - 164px);min-height:540px;display:grid;grid-template-columns:minmax(245px,19vw) minmax(440px,1fr) minmax(310px,26vw);gap:8px}.live-browser,.live-canvas-card,.live-transcript{background:color-mix(in srgb,var(--panel) 92%,transparent);border:1px solid var(--line);border-radius:14px;min-width:0;overflow:hidden;box-shadow:var(--shadow);backdrop-filter:blur(18px)}.live-browser{display:flex;flex-direction:column}.live-browser-top{height:64px;flex:0 0 64px;display:grid;grid-template-columns:auto 1fr auto;align-items:center;gap:8px;padding:8px 11px;border-bottom:1px solid var(--line)}.live-browser-top h3{margin:2px 0 0;font-size:14px;letter-spacing:-.02em}.live-browser-top output{grid-column:3;grid-row:1/3;color:var(--ink-dim);font:9px ui-monospace,monospace}.live-browser-top #live-count{display:none}.live-browser[data-level=sessions] .live-browser-top #live-project-count{display:none}.live-browser[data-level=sessions] .live-browser-top #live-count{display:block}.live-browser-back{display:none;width:28px;height:28px;border:0;border-radius:50%;background:transparent;color:var(--ink);font:24px/1 sans-serif;cursor:pointer}.live-browser-back:hover{background:var(--bg)}.live-browser[data-level=sessions] .live-browser-back{display:grid;place-items:center}.live-browser-stack{position:relative;flex:1;min-height:0;overflow:hidden}.live-projects,.live-project-sessions{position:absolute;inset:0;display:flex;flex-direction:column;padding:8px;transition:transform .3s cubic-bezier(.2,.8,.2,1),opacity .22s ease}.live-projects{transform:translateX(0)}.live-project-sessions{transform:translateX(102%);opacity:.35}.live-browser[data-level=sessions] .live-projects{transform:translateX(-24%);opacity:0;pointer-events:none}.live-browser[data-level=sessions] .live-project-sessions{transform:translateX(0);opacity:1}.live-browser-caption{padding:2px 6px 9px;color:var(--ink-dim);font-size:8px}.live-project-list,.live-session-list{display:flex;flex-direction:column;gap:3px;overflow-y:auto;overscroll-behavior:contain;scrollbar-width:thin;min-height:0}.live-project,.live-session{width:100%;min-height:62px;text-align:left;border:1px solid transparent;border-radius:11px;background:transparent;color:var(--ink);padding:9px 10px;cursor:pointer}.live-project{position:relative;display:flex;flex-direction:column;justify-content:center;gap:5px;padding-right:27px}.live-project::after{content:"›";position:absolute;right:10px;top:19px;color:var(--ink-dim);font-size:18px}.live-project:hover,.live-session:hover{background:color-mix(in srgb,var(--bg) 75%,transparent)}.live-project[aria-current=true],.live-session[aria-current=true]{border-color:color-mix(in srgb,var(--accent) 52%,transparent);background:color-mix(in srgb,var(--accent) 10%,var(--panel))}.live-project span{font-size:11px;font-weight:760;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.live-project small{font-size:8px;color:var(--ink-dim)}.live-project small b{color:var(--ok)}.live-browser-empty{padding:20px 8px;text-align:center;color:var(--ink-dim);font-size:9px}.live-session{display:grid;grid-template-columns:34px minmax(0,1fr);grid-template-rows:auto auto;column-gap:9px}.live-provider{grid-row:1/3;width:32px;height:32px;display:grid;place-items:center;border-radius:50%;background:var(--bg);border:1px solid var(--line);font-weight:800}.live-provider[data-provider=claude]{color:#e28b6c}.live-provider[data-provider=codex]{color:#69a8ff}.live-provider[data-provider=ruflo]{color:#ae8dff}.live-session-main{align-self:end;font-size:10px;font-weight:720;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.live-session-provider{align-self:start;margin-top:4px;font-size:7px;color:var(--ink-2);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.live-session-provider i{display:inline-block;width:6px;height:6px;border-radius:50%;background:var(--ink-dim);margin-right:5px}.live-session-provider i[data-status=running]{background:var(--ok);box-shadow:0 0 9px var(--ok);animation:live-pulse 1.4s ease-in-out infinite}.live-browser-foot{height:36px;flex:0 0 36px;display:flex;align-items:center;gap:7px;padding:0 12px;border-top:1px solid var(--line);color:var(--ink-dim);font-size:8px}.live-canvas-card{display:flex;flex-direction:column}.live-pane-head{min-height:57px;padding:8px 11px;border-bottom:1px solid color-mix(in srgb,var(--line) 70%,transparent);display:flex;align-items:center;justify-content:space-between;gap:10px}.live-pane-head h3{font-size:12px;margin:2px 0}.live-kicker{font:700 7px/1 ui-monospace,monospace;letter-spacing:.14em;color:var(--accent)}.live-graph-summary,.live-transcript-head span:last-child{font-size:8px;color:var(--ink-2)}.live-view-tools{display:flex;align-items:center;gap:3px}.live-view-tools button{padding:4px 7px;font-size:8px}.live-view-tools output{font:8px ui-monospace,monospace;color:var(--ink-2);min-width:31px;text-align:center}.live-session-context{min-height:32px;display:flex;align-items:center;gap:7px;padding:5px 11px;border-bottom:1px solid color-mix(in srgb,var(--line) 65%,transparent);color:var(--ink-2);font-size:8px}.live-session-context-provider{padding:3px 6px;border-radius:999px;background:var(--bg);color:var(--accent);font-weight:750}.live-session-context-status{margin-left:auto;color:var(--ink-dim)}
+.live-workspace{height:calc(100vh - 164px);min-height:540px;display:grid;grid-template-columns:minmax(245px,19vw) minmax(440px,1fr) minmax(310px,26vw);gap:8px}.live-browser,.live-canvas-card,.live-transcript{background:color-mix(in srgb,var(--panel) 92%,transparent);border:1px solid var(--line);border-radius:14px;min-width:0;overflow:hidden;box-shadow:var(--shadow);backdrop-filter:blur(18px)}.live-browser{display:flex;flex-direction:column}.live-browser-top{height:64px;flex:0 0 64px;display:grid;grid-template-columns:auto 1fr auto;align-items:center;gap:8px;padding:8px 11px;border-bottom:1px solid var(--line)}.live-browser-top h3{margin:2px 0 0;font-size:14px;letter-spacing:-.02em}.live-browser-top output{grid-column:3;grid-row:1/3;color:var(--ink-dim);font:9px ui-monospace,monospace}.live-browser-top #live-count{display:none}.live-browser[data-level=sessions] .live-browser-top #live-project-count{display:none}.live-browser[data-level=sessions] .live-browser-top #live-count{display:block}.live-browser-back{display:none;width:28px;height:28px;border:0;border-radius:50%;background:transparent;color:var(--ink);font:24px/1 sans-serif;cursor:pointer}.live-browser-back:hover{background:var(--bg)}.live-browser[data-level=sessions] .live-browser-back{display:grid;place-items:center}.live-browser-stack{position:relative;flex:1;min-height:0;overflow:hidden}.live-projects,.live-project-sessions{position:absolute;inset:0;display:flex;flex-direction:column;padding:8px;transition:transform .3s cubic-bezier(.2,.8,.2,1),opacity .22s ease}.live-projects{transform:translateX(0)}.live-project-sessions{transform:translateX(102%);opacity:.35}.live-browser[data-level=sessions] .live-projects{transform:translateX(-24%);opacity:0;pointer-events:none}.live-browser[data-level=sessions] .live-project-sessions{transform:translateX(0);opacity:1}.live-browser-caption{padding:2px 6px 9px;color:var(--ink-dim);font-size:8px}.live-project-list,.live-session-list{display:flex;flex-direction:column;gap:3px;overflow-y:auto;overscroll-behavior:contain;scrollbar-width:thin;min-height:0}.live-project,.live-session{width:100%;min-height:62px;text-align:left;border:1px solid transparent;border-radius:11px;background:transparent;color:var(--ink);padding:9px 10px;cursor:pointer}.live-project{position:relative;display:flex;flex-direction:column;justify-content:center;gap:5px;padding-right:27px}.live-project::after{content:"›";position:absolute;right:10px;top:19px;color:var(--ink-dim);font-size:18px}.live-project:hover,.live-session:hover{background:color-mix(in srgb,var(--bg) 75%,transparent)}.live-project[aria-current=true],.live-session[aria-current=true]{border-color:color-mix(in srgb,var(--accent) 52%,transparent);background:color-mix(in srgb,var(--accent) 10%,var(--panel))}.live-project span{font-size:11px;font-weight:760;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.live-project small{font-size:8px;color:var(--ink-dim)}.live-project small b{color:var(--ok)}.live-browser-empty{padding:20px 8px;text-align:center;color:var(--ink-dim);font-size:9px}.live-session{display:grid;grid-template-columns:34px minmax(0,1fr);grid-template-rows:auto auto;column-gap:9px}.live-host{grid-row:1/3;width:32px;height:32px;display:grid;place-items:center;border-radius:50%;background:var(--bg);border:1px solid var(--line);font-weight:800}.live-host[data-host=claude]{color:#e28b6c}.live-host[data-host=codex]{color:#69a8ff}.live-host[data-host=ruflo]{color:#ae8dff}.live-session-main{align-self:end;font-size:10px;font-weight:720;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.live-session-identity{align-self:start;margin-top:4px;font-size:7px;color:var(--ink-2);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.live-session-identity i{display:inline-block;width:6px;height:6px;border-radius:50%;background:var(--ink-dim);margin-right:5px}.live-session-identity i[data-status=running]{background:var(--ok);box-shadow:0 0 9px var(--ok);animation:live-pulse 1.4s ease-in-out infinite}.live-browser-foot{height:36px;flex:0 0 36px;display:flex;align-items:center;gap:7px;padding:0 12px;border-top:1px solid var(--line);color:var(--ink-dim);font-size:8px}.live-canvas-card{display:flex;flex-direction:column}.live-pane-head{min-height:57px;padding:8px 11px;border-bottom:1px solid color-mix(in srgb,var(--line) 70%,transparent);display:flex;align-items:center;justify-content:space-between;gap:10px}.live-pane-head h3{font-size:12px;margin:2px 0}.live-kicker{font:700 7px/1 ui-monospace,monospace;letter-spacing:.14em;color:var(--accent)}.live-graph-summary,.live-transcript-head span:last-child{font-size:8px;color:var(--ink-2)}.live-view-tools{display:flex;align-items:center;gap:3px}.live-view-tools button{padding:4px 7px;font-size:8px}.live-view-tools output{font:8px ui-monospace,monospace;color:var(--ink-2);min-width:31px;text-align:center}.live-session-context{min-height:32px;display:flex;align-items:center;gap:7px;padding:5px 11px;border-bottom:1px solid color-mix(in srgb,var(--line) 65%,transparent);color:var(--ink-2);font-size:8px}.live-session-context-identity{padding:3px 6px;border-radius:999px;background:var(--bg);color:var(--accent);font-weight:750}.live-session-context-status{margin-left:auto;color:var(--ink-dim)}
 .live-project[data-live=true],.live-session[data-live=true]{box-shadow:inset 2px 0 var(--ok)}.live-project[data-live=true]::before{content:"";position:absolute;right:29px;top:27px;width:5px;height:5px;border-radius:50%;background:var(--ok);box-shadow:0 0 10px var(--ok);animation:live-pulse 1.5s ease-in-out infinite}
-.live-session-provider i[data-status=working]{background:var(--ok);box-shadow:0 0 9px var(--ok);animation:live-pulse 1.4s ease-in-out infinite}.live-session-provider i[data-status=waiting],.live-session-provider i[data-status=stale],.live-session-provider i[data-status=queued]{background:var(--warn)}.live-session-provider i[data-status=blocked],.live-session-provider i[data-status=failed]{background:var(--fail)}.live-session[data-state=blocked],.live-session[data-state=failed]{box-shadow:inset 2px 0 var(--fail)}.live-session[data-state=waiting],.live-session[data-state=stale]{box-shadow:inset 2px 0 color-mix(in srgb,var(--warn) 55%,transparent)}
+.live-session-identity i[data-status=working]{background:var(--ok);box-shadow:0 0 9px var(--ok);animation:live-pulse 1.4s ease-in-out infinite}.live-session-identity i[data-status=waiting],.live-session-identity i[data-status=stale],.live-session-identity i[data-status=queued]{background:var(--warn)}.live-session-identity i[data-status=blocked],.live-session-identity i[data-status=failed]{background:var(--fail)}.live-session[data-state=blocked],.live-session[data-state=failed]{box-shadow:inset 2px 0 var(--fail)}.live-session[data-state=waiting],.live-session[data-state=stale]{box-shadow:inset 2px 0 color-mix(in srgb,var(--warn) 55%,transparent)}
 .live-canvas{position:relative;flex:1;min-height:0;overflow:hidden;touch-action:none;cursor:grab;background:radial-gradient(circle at 47% 48%,color-mix(in srgb,var(--accent) 8%,transparent),transparent 38%),radial-gradient(circle at 47% 48%,transparent 0 46%,color-mix(in srgb,var(--bg) 60%,transparent) 75%),linear-gradient(color-mix(in srgb,var(--line) 15%,transparent) 1px,transparent 1px),linear-gradient(90deg,color-mix(in srgb,var(--line) 15%,transparent) 1px,transparent 1px);background-size:auto,auto,48px 48px,48px 48px}.live-canvas[data-panning=true]{cursor:grabbing}.live-canvas svg{display:block;width:100%;height:100%}.live-map-help{position:absolute;left:12px;bottom:11px;padding:4px 8px;border:1px solid var(--line);border-radius:999px;background:var(--live-glass);font-size:8px;color:var(--ink-dim);pointer-events:none}.live-empty{position:absolute;inset:0;display:grid;place-items:center;color:var(--ink-dim);font-size:11px;pointer-events:none}.live-empty[hidden]{display:none}
 .live-edge{fill:none;stroke:color-mix(in srgb,var(--ink-2) 27%,transparent);stroke-width:1.15;marker-end:url(#live-arrow)}.live-edge[data-active=true]{stroke:var(--accent);stroke-width:1.7;stroke-dasharray:7 7;animation:live-flow 1.15s linear infinite;filter:url(#live-glow)}.live-node,.live-tool{cursor:pointer}.live-node{pointer-events:bounding-box}.live-node[data-related=false],.live-tool[data-related=false],.live-edge[data-related=false]{opacity:.16}.node-aura{fill:color-mix(in srgb,var(--accent) 4%,transparent);stroke:color-mix(in srgb,var(--accent) 13%,transparent);stroke-width:1}.node-core{fill:color-mix(in srgb,var(--panel) 75%,var(--bg));stroke:var(--ink-2);stroke-width:1.5}.node-core-ring{fill:none;stroke-width:2}.node-core-dot{fill:var(--accent);filter:url(#live-glow)}.node-core-mark{fill:none;stroke:var(--ink);stroke-width:2}.live-node[data-selected=true] .node-aura,.live-node:hover .node-aura{fill:color-mix(in srgb,var(--accent) 12%,transparent);stroke:var(--accent);stroke-width:1.5}.live-node[data-selected=true] .node-core{stroke:var(--accent);stroke-width:2}.live-node[data-pinned=true] .node-aura{stroke-dasharray:4 3}.node-status{fill:var(--ink-dim)}.live-node[data-status=running] .node-status{fill:var(--ok);filter:url(#live-glow);animation:live-pulse 1.4s ease-in-out infinite}.live-node[data-status=failed] .node-status{fill:var(--fail)}.live-node text{fill:var(--ink);font:600 10px ui-sans-serif,sans-serif}.live-node .node-name{font-size:11px;font-weight:750}.live-node .node-eyebrow{fill:var(--ink-dim);font:700 6px ui-monospace,monospace;letter-spacing:.1em}.node-work{opacity:.18;transition:opacity .18s}.live-node[data-status=running] .node-work,.live-node[data-selected=true] .node-work,.live-node:hover .node-work{opacity:1}.node-work rect{fill:color-mix(in srgb,var(--panel) 91%,transparent);stroke:var(--line)}.node-work circle{fill:var(--ok)}.node-work text{fill:var(--ink);font:7px ui-monospace,monospace}.node-work .node-meta{fill:var(--ink-dim);font-size:6px}.live-tool-halo{fill:color-mix(in srgb,var(--accent) 5%,transparent);stroke:color-mix(in srgb,var(--accent) 16%,transparent)}.live-tool-card{fill:color-mix(in srgb,var(--bg) 76%,var(--panel));stroke:var(--line)}.live-tool[data-status=running] .live-tool-halo{filter:url(#live-glow);animation:live-pulse 1.4s ease-in-out infinite}.live-tool[data-status=running] .live-tool-card{stroke:var(--accent)}.live-tool text{fill:var(--ink-2);font:6px ui-monospace,monospace}.live-tool .tool-name{fill:var(--ink);font-size:7px;font-weight:700}.live-tool-icon{fill:var(--accent)}.node-history rect{fill:color-mix(in srgb,var(--panel) 86%,transparent);stroke:var(--line)}.node-history text{fill:var(--ink-dim);font:6px ui-monospace,monospace}.live-flow-dot{fill:var(--accent);filter:url(#live-glow);pointer-events:none}
 .live-node[data-status=blocked] .node-status,.live-node[data-status=failed] .node-status{fill:var(--fail)}.live-node[data-status=queued] .node-status,.live-node[data-status=quiescent] .node-status,.live-node[data-status=expired] .node-status{fill:var(--warn)}.live-tool[data-status=blocked] .live-tool-card,.live-tool[data-status=failed] .live-tool-card{stroke:var(--fail)}.live-tool[data-status=queued] .live-tool-card,.live-tool[data-status=quiescent] .live-tool-card,.live-tool[data-status=expired] .live-tool-card{stroke:var(--warn)}
 .live-node[data-status=working] .node-status{fill:var(--ok);filter:url(#live-glow);animation:live-pulse 1.4s ease-in-out infinite}.live-node[data-status=working] .node-work{opacity:1}.live-tool[data-status=working] .live-tool-halo{filter:url(#live-glow);animation:live-pulse 1.4s ease-in-out infinite}.live-tool[data-status=working] .live-tool-card{stroke:var(--accent)}
 .live-transcript{display:flex;flex-direction:column;position:relative}.live-transcript-head{flex:0 0 auto}.live-transcript-state{border:1px solid var(--line);border-radius:999px;padding:4px 7px;font:7px ui-monospace,monospace;text-transform:uppercase}.live-transcript-state[data-state=live]{color:var(--ok)}.live-transcript-state[data-state=error]{color:var(--fail)}.live-transcript-tools{display:flex;gap:5px;padding:6px;border-bottom:1px solid var(--line)}.live-search{flex:1}.live-search input{width:100%;color:var(--ink);background:var(--bg);border:1px solid var(--line);border-radius:999px;padding:6px 10px;font:8px ui-monospace,monospace}.live-transcript-tools button{padding:5px 8px;font-size:8px}.live-transcript-tools button[aria-pressed=true]{color:var(--ok)}.live-transcript-list{flex:1;overflow:auto;padding:9px;scrollbar-width:thin;overscroll-behavior:contain}.live-transcript-empty{display:grid;min-height:180px;place-items:center;text-align:center;color:var(--ink-dim);font-size:9px;padding:24px}.live-turn{margin:0 0 8px;border-left:2px solid var(--line);padding:7px 9px;background:color-mix(in srgb,var(--bg) 52%,transparent);border-radius:0 8px 8px 0}.live-turn[data-role=user]{border-left-color:var(--accent)}.live-turn[data-role=assistant]{border-left-color:var(--ok)}.live-turn[data-role=thinking]{border-left-color:var(--warn)}.live-turn[data-role=error]{border-left-color:var(--fail)}.live-turn[data-selected=false]{display:none}.live-turn-head{display:flex;justify-content:space-between;gap:8px;margin-bottom:5px;color:var(--ink-dim);font:700 7px ui-monospace,monospace;text-transform:uppercase}.live-turn-body{white-space:pre-wrap;overflow-wrap:anywhere;color:var(--ink-2);font:9px/1.55 ui-monospace,monospace}.live-turn details summary{cursor:pointer;color:var(--ink-2);font:8px ui-monospace,monospace}.live-transcript-new{position:absolute;right:16px;bottom:64px;border:1px solid var(--accent);border-radius:999px;background:var(--panel);color:var(--accent);padding:5px 9px;font-size:8px}.live-selection{flex:0 0 auto;border-top:1px solid var(--line);padding:7px 10px;color:var(--ink-2);font-size:8px}.live-selection summary{cursor:pointer;color:var(--ink)}.live-selection dl{display:grid;grid-template-columns:65px 1fr;gap:3px;margin:7px 0 0}.live-selection dd{margin:0}
 .live-replay-notice{flex:0 0 auto;padding:6px 10px;border-top:1px solid color-mix(in srgb,var(--warn) 45%,var(--line));background:color-mix(in srgb,var(--warn) 7%,transparent);color:var(--warn);font-size:8px}.live-playback{position:absolute;z-index:20;left:calc(19vw + 32px);right:calc(26vw + 32px);bottom:10px;height:47px;display:grid;grid-template-columns:auto minmax(160px,1fr) auto auto auto auto;align-items:center;gap:8px;border:1px solid color-mix(in srgb,var(--line) 85%,transparent);border-radius:16px;padding:5px 9px;background:color-mix(in srgb,var(--panel) 91%,transparent);box-shadow:0 12px 40px #0008;backdrop-filter:blur(20px)}.live-playback[data-mode=review]{border-color:color-mix(in srgb,var(--warn) 42%,var(--line))}.live-playback button,.live-playback select{color:var(--ink);background:var(--bg);border:1px solid var(--line);border-radius:999px;padding:5px 9px;font:8px ui-monospace,monospace;cursor:pointer}.live-playback input{width:100%;accent-color:var(--accent)}.live-playback output{min-width:62px;color:var(--ink-2);font:8px ui-monospace,monospace}.live-playback #live-resume-live{color:var(--ok)}.live-playback #live-enter-review{color:var(--warn)}.live-panel>.foot{display:none}
-.live-session-family{display:flex;flex-direction:column}.live-session-children{position:relative;margin:0 0 4px 17px;padding-left:9px;border-left:1px solid color-mix(in srgb,var(--accent) 28%,var(--line))}.live-session-child{min-height:51px;border-radius:8px}.live-session-child .live-provider{width:25px;height:25px;font-size:11px;color:var(--accent)}.live-session-child .live-session-main{font-size:9px}.live-session-child .live-session-provider{font-size:7px}
+.live-session-family{display:flex;flex-direction:column}.live-session-children{position:relative;margin:0 0 4px 17px;padding-left:9px;border-left:1px solid color-mix(in srgb,var(--accent) 28%,var(--line))}.live-session-child{min-height:51px;border-radius:8px}.live-session-child .live-host{width:25px;height:25px;font-size:11px;color:var(--accent)}.live-session-child .live-session-main{font-size:9px}.live-session-child .live-session-identity{font-size:7px}
 @keyframes live-flow{to{stroke-dashoffset:-28}}@keyframes live-pulse{50%{opacity:.35}}
 @media(max-width:1180px){.live-workspace{grid-template-columns:230px minmax(390px,1fr) minmax(285px,31vw)}.live-playback{left:252px;right:calc(31vw + 30px)}}
 @media(max-width:900px){.live-panel{height:auto;min-height:calc(100vh - 58px);margin:0;padding:12px 8px 72px;overflow:visible}.live-workspace{height:auto;grid-template-columns:230px minmax(0,1fr)}.live-browser{height:570px}.live-canvas-card{height:570px}.live-transcript{grid-column:1/3;height:520px}.live-playback{position:fixed;left:10px;right:10px;bottom:8px}.live-toolbar{position:sticky;top:0;z-index:30}}
 @media(max-width:760px){.live-workspace{grid-template-columns:minmax(0,1fr)}.live-browser,.live-canvas-card{height:520px}.live-transcript{grid-column:1;height:500px}.live-view-tools button:nth-last-child(-n+2){display:none}.live-playback{grid-template-columns:auto 1fr auto}.live-playback select,.live-playback #live-resume-live{grid-row:2}}
-@media(prefers-reduced-motion:reduce){.live-edge,.live-node .node-status,.live-tool-card,.live-tool-halo,.live-session-provider i,.live-project::before{animation:none!important}.live-flow-dot{display:none}}
+@media(prefers-reduced-motion:reduce){.live-edge,.live-node .node-status,.live-tool-card,.live-tool-halo,.live-session-identity i,.live-project::before{animation:none!important}.live-flow-dot{display:none}}
 `;
diff --git a/src/lib/dashboard/live/template.mjs b/src/lib/dashboard/live/template.mjs
index a969dc1..74d4f9b 100644
--- a/src/lib/dashboard/live/template.mjs
+++ b/src/lib/dashboard/live/template.mjs
@@ -65,7 +65,7 @@ export const LIVE_HTML = `
           </div>
         </div>
         <div class="live-session-context" id="live-session-context">
-          <span class="live-session-context-provider" id="live-session-context-provider">—</span>
+          <span class="live-session-context-identity" id="live-session-context-identity">—</span>
           <span id="live-session-context-project">Choose a session</span>
           <span id="live-session-context-status">Waiting for local evidence</span>
         </div>
diff --git a/src/lib/dashboard/page.mjs b/src/lib/dashboard/page.mjs
index eb9b8f7..ece2bc8 100644
--- a/src/lib/dashboard/page.mjs
+++ b/src/lib/dashboard/page.mjs
@@ -101,26 +101,25 @@ export function renderPage({ name, version }) {
       </div>
       <div class="route-matrix" id="route-matrix"></div>
     </section>
-  </section>
-
-  <section class="panel" id="panel-providers" role="tabpanel" aria-labelledby="tab-providers" hidden>
-    <div id="cards-providers"></div>
     <section class="strip" id="models" hidden>
       <div class="strip-head">
-        <h2 class="strip-title">routed models</h2>
+        <h2 class="strip-title">routed host models</h2>
         <span class="mono strip-note" id="models-note"></span>
       </div>
       <div class="note"><span class="i">&#8505;</span><span>This is your <b>per-activity routing policy</b> &mdash;
         which host and model ak <i>assigns</i> to each kind of work. It is projected into
         <b>agentic-qe</b> agent overrides and <b>ak dual run</b> pipelines; agentic-qe also has its own
         model router, so a route here is the assignment, not a guarantee.
-        It does <b>not</b> govern the model an interactive Claude Code or codex CLI session uses &mdash;
-        you choose that per session with <span class="mono">/model</span>.
-        For the models that <b>actually ran</b>, see <b>Usage &rarr; Scorecard</b>.</span></div>
+        It does <b>not</b> establish which inference provider served a session.
+        For the models and providers that <b>actually ran</b>, see <b>Usage &rarr; Scorecard</b>.</span></div>
       <div class="model-list" id="model-list"></div>
     </section>
   </section>
 
+  <section class="panel" id="panel-providers" role="tabpanel" aria-labelledby="tab-providers" hidden>
+    <div id="cards-providers"></div>
+  </section>
+
   <section class="panel" id="panel-runtime" role="tabpanel" aria-labelledby="tab-runtime" hidden>
     <div id="cards-runtime"></div>
   </section>
diff --git a/src/lib/live/projection.mjs b/src/lib/live/projection.mjs
index 2ae027c..dc610db 100644
--- a/src/lib/live/projection.mjs
+++ b/src/lib/live/projection.mjs
@@ -1,6 +1,7 @@
 function nodeFrom(actor, event) {
   return {
     id: actor.id, kind: actor.kind, label: actor.label, role: actor.role, provider: actor.provider,
+    providerProvenance: actor.provider ? event.providerProvenance : 'unknown',
     model: actor.model, host: event.host, surface: event.surface,
     status: event.status, lastEventId: event.eventId ?? null,
     observedAt: event.observedAt, confidence: event.source.confidence,
@@ -231,14 +232,15 @@ function projectCatalog(sessions) {
     const project = projects.get(key) ?? {
       id: key, label: session.project, sessions: [], sessionCount: 0,
       childSessionCount: 0, liveCount: 0, completedCount: 0,
-      providers: {}, updatedAt: session.updatedAt,
+      hosts: {}, providers: {}, updatedAt: session.updatedAt,
     };
     project.sessions.push(session.key);
     project.sessionCount++;
     if (TERMINAL.has(session.status)) project.completedCount++;
     else if (session.status === 'running' && session.lifecycle === 'active') project.liveCount++;
+    project.hosts[session.host] = (project.hosts[session.host] ?? 0) + 1;
     const providers = new Set(session.nodes.map((node) => node.provider).filter(Boolean));
-    if (providers.size === 0) providers.add(session.host);
+    if (providers.size === 0) providers.add('unknown');
     for (const provider of providers) {
       project.providers[provider] = (project.providers[provider] ?? 0) + 1;
     }
@@ -262,6 +264,7 @@ function projectCatalog(sessions) {
         || Date.parse(right.updatedAt) - Date.parse(left.updatedAt)
         || a.localeCompare(b);
     });
+    project.hosts = Object.fromEntries(Object.entries(project.hosts).sort());
     project.providers = Object.fromEntries(Object.entries(project.providers).sort());
   }
   return [...projects.values()].sort((a, b) => (
diff --git a/tests/dashboard.test.cjs b/tests/dashboard.test.cjs
index 8459c2b..975cb3d 100644
--- a/tests/dashboard.test.cjs
+++ b/tests/dashboard.test.cjs
@@ -557,6 +557,16 @@ async function main() {
       contains(r.body, 'class="s-provider"');
     });
 
+    await test('Live rendering never derives host identity from inference provider', async () => {
+      const r = await get(uiSrv.url);
+      contains(r.body, 'function hostOf');
+      contains(r.body, 'function inferenceProviderName');
+      contains(r.body, 'Provider not established');
+      assert(!r.body.includes('function providerOf'), 'legacy host/provider branding helper remains');
+      assert(!r.body.includes('v&&v.provider||v&&v.host'),
+        'Live presentation still falls back from provider to host');
+    });
+
     await test('served HTML carries the read-only Live Sessions surface', async () => {
       const r = await get(uiSrv.url);
       for (const marker of [
@@ -1243,7 +1253,7 @@ async function main() {
   // is the suite where it matters most — the traversal-guard and credential-
   // leak tests live here and were the reviewer's cited example of a block
   // that could silently vanish with the old harness never noticing.
-  const EXPECTED = 57;
+  const EXPECTED = 58;
   if (passed + failed !== EXPECTED) {
     console.error(`\nPLAN MISMATCH: expected ${EXPECTED} tests, ran ${passed + failed}`);
     process.exit(1);
diff --git a/tests/kit/dashboard-integration-identity.test.mjs b/tests/kit/dashboard-integration-identity.test.mjs
new file mode 100644
index 0000000..76c8ec7
--- /dev/null
+++ b/tests/kit/dashboard-integration-identity.test.mjs
@@ -0,0 +1,28 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { routingPayload } from '../../src/lib/dashboard-server.mjs';
+
+test('dashboard routing describes host assignment without manufacturing a provider', () => {
+  const payload = routingPayload({
+    providers: {
+      primaryHost: 'claude',
+      dualRouting: {
+        implementation: {
+          host: 'codex',
+          model: 'gpt-5.4',
+          source: 'user',
+        },
+      },
+    },
+  });
+  const route = payload.routes.find((entry) => entry.activity === 'implementation');
+  assert.deepEqual(route, {
+    activity: 'implementation',
+    host: 'codex',
+    model: 'gpt-5.4',
+    source: 'user',
+    akOriginated: false,
+    escalate: ['claude'],
+  });
+  assert.equal(Object.hasOwn(route, 'provider'), false);
+});
diff --git a/tests/kit/live-core.test.mjs b/tests/kit/live-core.test.mjs
index c868680..3f4f6a0 100644
--- a/tests/kit/live-core.test.mjs
+++ b/tests/kit/live-core.test.mjs
@@ -112,7 +112,10 @@ test('projection preserves safe display metadata and event provenance on resourc
     })), eventId: 'ak:2',
   };
   const projection = reduceLiveEvent(reduceLiveEvent(emptyLiveProjection(), started), completed);
+  const actor = projection.sessions.get('claude:s1').nodes.get('s1');
   const node = projection.sessions.get('claude:s1').nodes.get('call-1');
+  assert.equal(actor.provider, 'anthropic');
+  assert.equal(actor.providerProvenance, 'unknown');
   assert.equal(node.label, 'Read');
   assert.equal(node.status, 'completed');
   assert.equal(node.lastAction, 'tool.completed');
@@ -357,11 +360,27 @@ test('projection keeps identical provider session IDs distinct and catalogs them
     childSessionCount: 0,
     liveCount: 1,
     completedCount: 1,
+    hosts: { claude: 1, codex: 1 },
     providers: { anthropic: 1, openai: 1 },
     updatedAt: '2026-07-27T12:01:00.000Z',
   });
 });
 
+test('project catalog keeps unknown inference providers separate from observed hosts', () => {
+  const event = {
+    ...createLiveEvent(base({
+      sessionId: 'unknown-provider', host: 'claude',
+      provider: null, providerProvenance: 'unknown',
+      actor: { id: 'unknown-provider', kind: 'session', provider: null },
+    })), eventId: 'ak:unknown-provider',
+  };
+  const snapshot = serializeLiveProjection(reduceLiveEvent(emptyLiveProjection(), event));
+  assert.deepEqual(snapshot.projects[0].hosts, { claude: 1 });
+  assert.deepEqual(snapshot.projects[0].providers, { unknown: 1 });
+  assert.equal(snapshot.sessions[0].nodes[0].provider, null);
+  assert.equal(snapshot.sessions[0].nodes[0].providerProvenance, 'unknown');
+});
+
 test('projection reconciles late parentage and catalogs only root sessions', () => {
   const childDiscovered = {
     ...createLiveEvent(base({
diff --git a/tests/kit/live-qe-contract.test.mjs b/tests/kit/live-qe-contract.test.mjs
index 35045cd..e5e462c 100644
--- a/tests/kit/live-qe-contract.test.mjs
+++ b/tests/kit/live-qe-contract.test.mjs
@@ -88,3 +88,14 @@ test('browser delta reducer carries the server resource-completion invariants',
   assert.match(LIVE_JS, /targetTerminal\?ev\.status:["']running["']/);
   assert.match(LIVE_JS, /TERMINAL/);
 });
+
+test('browser presentation keeps execution host and inference provider independent', () => {
+  assert.match(LIVE_JS, /function hostOf/);
+  assert.match(LIVE_JS, /function hostName/);
+  assert.match(LIVE_JS, /function inferenceProviderName/);
+  assert.doesNotMatch(LIVE_JS, /function providerOf/);
+  assert.doesNotMatch(LIVE_JS, /v&&v\.provider\|\|v&&v\.host/);
+  assert.match(LIVE_JS, /providerProvenance/);
+  assert.match(LIVE_JS, /Provider not established/);
+  assert.match(LIVE_JS, /s\.host/);
+});
diff --git a/tests/ui/dashboard-ui.mjs b/tests/ui/dashboard-ui.mjs
index 7566528..c4a2409 100644
--- a/tests/ui/dashboard-ui.mjs
+++ b/tests/ui/dashboard-ui.mjs
@@ -246,7 +246,8 @@ const LIVE_SNAPSHOT = {
     id: 'project:agentic-kit', label: 'agentic-kit',
     sessions: ['codex:ui-live-session', 'claude:ui-review-session'],
     sessionCount: 2, childSessionCount: 1, liveCount: 1, completedCount: 1,
-    providers: { codex: 1, claude: 1 }, updatedAt: new Date().toISOString(),
+    hosts: { codex: 1, claude: 1 },
+    providers: { openai: 1, anthropic: 1 }, updatedAt: new Date().toISOString(),
   }],
   health: {
     claude: { status: 'ok', files: 2, events: 8, errors: 0, lastError: null },
@@ -257,7 +258,9 @@ const LIVE_SNAPSHOT = {
     projectKey: 'project:agentic-kit', host: 'codex', status: 'running', lifecycle: 'active',
     updatedAt: new Date().toISOString(),
     nodes: [
-      { id: 'ui-live-session', kind: 'session', role: 'primary', host: 'codex', surface: 'native', status: 'running', confidence: 'observed' },
+      { id: 'ui-live-session', kind: 'session', role: 'primary', host: 'codex',
+        provider: 'openai', providerProvenance: 'observed',
+        surface: 'native', status: 'running', confidence: 'observed' },
       { id: 'ui-live-agent', kind: 'subagent', label: 'Bohr', role: 'tester', host: 'codex', surface: 'ruflo', status: 'running', confidence: 'observed', lastAction: 'agent.output', observedAt: new Date().toISOString(), sourceAdapter: 'codex-state' },
       { id: 'ui-live-tool', kind: 'tool', label: 'Read', host: 'codex', surface: 'native', status: 'running', confidence: 'observed', lastAction: 'tool.started', observedAt: new Date().toISOString(), sourceAdapter: 'codex-rollout' },
       { id: 'ui-live-gate', kind: 'gate', role: 'qe-court', host: 'internal', surface: 'aqe', status: 'queued', confidence: 'planned' },
@@ -273,14 +276,16 @@ const LIVE_SNAPSHOT = {
     hierarchyState: 'child', navigationRoot: false,
     project: 'agentic-kit', projectKey: 'project:agentic-kit', host: 'codex',
     status: 'running', lifecycle: 'active', updatedAt: new Date().toISOString(),
-    nodes: [{ id: 'ui-live-agent', kind: 'session', role: 'tester', host: 'codex', status: 'running' }],
+    nodes: [{ id: 'ui-live-agent', kind: 'session', role: 'tester', host: 'codex',
+      provider: 'openai', providerProvenance: 'observed', status: 'running' }],
     edges: [],
   }, {
     id: 'ui-review-session', key: 'claude:ui-review-session', project: 'agentic-kit',
     projectKey: 'project:agentic-kit', host: 'claude', status: 'completed',
     startedAt: new Date(Date.now() - 180_000).toISOString(),
     updatedAt: new Date(Date.now() - 60_000).toISOString(),
-    nodes: [{ id: 'ui-review-session', kind: 'session', host: 'claude', status: 'completed' }],
+    nodes: [{ id: 'ui-review-session', kind: 'session', host: 'claude',
+      provider: 'anthropic', providerProvenance: 'observed', status: 'completed' }],
     edges: [],
   }],
 };

From 388ec47ac476a7f5b723dd29a1663b2bd09968f0 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 21:39:37 -0700
Subject: [PATCH 4/6] docs: clarify ADR 0011 and 0016 boundary

---
 ...-capability-driven-integration-adapters.md | 36 +++++++++++++++----
 docs/adr/README.md                            |  6 ++--
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/docs/adr/0016-capability-driven-integration-adapters.md b/docs/adr/0016-capability-driven-integration-adapters.md
index 0a86802..919f1e3 100644
--- a/docs/adr/0016-capability-driven-integration-adapters.md
+++ b/docs/adr/0016-capability-driven-integration-adapters.md
@@ -1,6 +1,6 @@
 # ADR-0016 — Capability-driven host, provider, binding, projection, and observability adapters
 
-- **Status:** Proposed
+- **Status:** Accepted
 - **Date:** 2026-07-28
 - **Deciders:** agentic-kit maintainers
 - **Related:** [ADR-0001](0001-one-routing-policy-many-projections.md),
@@ -330,6 +330,28 @@ does. Exact model digest and local `$0` claims remain gated by ADR-0011 and
 does not claim that compatibility-layer behavior has been observed. Each binding has independent
 ownership and teardown.
 
+This is a **structural proof**, not a runtime-local-model proof. It establishes that one provider
+can be represented behind two hosts without collapsing their identities, configuration,
+ownership, or teardown. It does not establish that an Ollama-backed session ran, that its
+transcript semantics match a compatibility specification, or that usage may be classified and
+priced as local.
+
+#### Dependency boundary with ADR-0011
+
+ADR-0016 owns the general integration architecture: adapter axes, capabilities, bindings,
+lifecycle, migration, ownership, normalized facts, and provenance. Its acceptance depends on
+those contracts being implemented and tested.
+
+ADR-0011 independently owns evidence-backed local-model usage behavior: Ollama catalogue reads,
+digest identity, index-time local provenance, alias ambiguity, local/unpriced cost states,
+metered/local token splits, and transcript-fidelity notes. ADR-0011 remains Proposed until its
+validation sessions and implementation are complete.
+
+Therefore ADR-0011 does **not** block acceptance of ADR-0016. It blocks only claims that an actual
+Ollama-backed execution has been observed, identified, priced, or characterized. The Ollama
+catalogue/runtime descriptors and bindings introduced here are extension seams for ADR-0011, not
+evidence that ADR-0011 has been implemented.
+
 #### OpenRouter behind a host
 
 OpenRouter is a metered provider/gateway with environment-only credentials and compatible
@@ -385,7 +407,8 @@ not write real home/global configuration.
 - It does not claim provider provenance from host evidence alone.
 - It does not add dashboard writes or controls.
 - It does not silently adopt or overwrite externally managed configuration.
-- It does not make unverified Ollama compatibility claims; ADR-0011's validation gate remains.
+- It does not implement or make unverified Ollama execution, usage-pricing, catalogue-metadata, or
+  transcript-fidelity claims; those remain gated independently by ADR-0011.
 
 ## Consequences
 
@@ -409,7 +432,7 @@ but less truthful.
 | Lifecycle commands derive behavior from capabilities | Sections 2, 3, and 9 |
 | Primary/activity routing is capability-limited | Section 2; OpenCode negative test |
 | One provider binds to multiple hosts | Section 8; two Ollama bindings |
-| Ollama through Claude and Codex is represented | Section 8, subject to ADR-0011 evidence |
+| Ollama through Claude and Codex is represented | Section 8 structural binding proof; runtime and usage claims remain ADR-0011 scope |
 | OpenRouter is a provider behind a host | Section 8; typed registry rejection as host |
 | Status/dashboard separate host, provider, model, billing, provenance | Section 5 |
 | npm-managed vs external ownership is truthful | Section 4 |
@@ -418,6 +441,7 @@ but less truthful.
 | Issue #59 can consume the abstraction without being subsumed | Sections 5 and 8 |
 | Documentation uses one vocabulary | Section 9 |
 
-This ADR remains **Proposed** until the registries, lifecycle conformance suite, compatibility
-fixtures, consumer migration, and proving integrations are implemented, and until Ollama claims
-requiring runtime evidence satisfy ADR-0011's validation requirements.
+The registries, lifecycle conformance suite, compatibility fixtures, consumer migration, and
+structural proving integrations are implemented and tested, so this ADR is **Accepted**. That
+status does not advance ADR-0011: local-model runtime evidence and usage behavior remain Proposed
+work under ADR-0011's own validation requirements.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index eb4fb82..4eff1d5 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -24,7 +24,7 @@ Consequences**, and cites the grounded source it rests on where relevant.
 | [0013](0013-admin-build-security-signals-and-honest-reach.md) | Admin: build/security signals, an honest Reach panel, and a pagination fix | Accepted |
 | [0014](0014-dashboard-auth-and-remediation.md) | Dashboard auth token, plus a security/quality remediation pass | Accepted |
 | [0015](0015-managed-codex-native-statusline.md) | Manage Codex's native user-wide status line without claiming rich-renderer parity | Accepted |
-| [0016](0016-capability-driven-integration-adapters.md) | Capability-driven host, provider, binding, projection, and observability adapters | Proposed |
+| [0016](0016-capability-driven-integration-adapters.md) | Capability-driven host, provider, binding, projection, and observability adapters | Accepted |
 
 Theme: ADRs **0001–0006** define **dual-host LLM routing and leadership** — how `ak` lets ruflo route
 each development activity (architecture, implementation, testing, review, …) to the right host (Claude
@@ -76,4 +76,6 @@ observability sources into validated capability registries, with provider bindin
 intent between them. It standardizes detect/plan/apply/verify/undo, value-precise ownership, and
 field-level provenance; preserves legacy Claude/Codex routing; and proves the shape with one Ollama
 provider behind two hosts, OpenRouter behind an existing host, and OpenCode managed without becoming
-routable by accident.
+routable by accident. Its Ollama bindings are a structural multi-host proof; ADR-0011 remains the
+independent Proposed decision for observed local execution, catalogue-backed identity, usage
+pricing, and transcript fidelity.

From 620fe22a64d167017abee00ab7d4144e254c4986 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 21:50:09 -0700
Subject: [PATCH 5/6] fix: cascade dashboard relative-time labels beyond hours

The Live Sessions project list showed raw hour counts (e.g. "999h ago")
with no upper bound. Roll over into days past 24h, weeks past 7d, and
years past 52w so long-idle projects read as "41d 15h ago" instead.
---
 src/lib/dashboard/live/client.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/dashboard/live/client.mjs b/src/lib/dashboard/live/client.mjs
index 1c2f8af..16261d5 100644
--- a/src/lib/dashboard/live/client.mjs
+++ b/src/lib/dashboard/live/client.mjs
@@ -24,7 +24,7 @@ export const LIVE_JS = `
   function esc(s){return String(s==null?"":s).replace(/[&<>"']/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[c];});}
   function short(s,n){s=String(s||"");return s.length>n?s.slice(0,n-1)+"…":s;}
   function title(s){return String(s||"activity").replace(/[._-]+/g," ").replace(/\\b\\w/g,function(c){return c.toUpperCase();});}
-  function ago(v){var at=Date.parse(v||""),ms=Date.now()-at;if(!Number.isFinite(ms))return"";var s=Math.max(0,Math.round(ms/1000));if(s<5)return"just now";if(s<60)return s+"s ago";var m=Math.round(s/60);return m<60?m+"m ago":Math.round(m/60)+"h ago";}
+  function ago(v){var at=Date.parse(v||""),ms=Date.now()-at;if(!Number.isFinite(ms))return"";var s=Math.max(0,Math.round(ms/1000));if(s<5)return"just now";if(s<60)return s+"s ago";var m=Math.round(s/60);if(m<60)return m+"m ago";var h=Math.round(m/60);if(h<24)return h+"h ago";var d=Math.floor(h/24),rh=h%24;if(d<7)return d+"d "+rh+"h ago";var w=Math.floor(d/7),rd=d%7;if(w<52)return w+"w "+rd+"d ago";var y=Math.floor(w/52),rw=w%52;return y+"y "+rw+"w ago";}
   function hostOf(v){return String(v&&v.host||"internal").toLowerCase();}
   function hostName(v){var h=hostOf(v);return{claude:"Claude Code",codex:"Codex",internal:"Internal"}[h]||title(h);}
   function hostGlyph(v){return{claude:"✳",codex:"◉",internal:"⌁"}[hostOf(v)]||"⌁";}

From bbb17c8bc6e3ea671b7b44167e7c02743b0fb3b8 Mon Sep 17 00:00:00 2001
From: Chris Phillipson <christopher.a.phillipson@gmail.com>
Date: Tue, 28 Jul 2026 22:03:16 -0700
Subject: [PATCH 6/6] Revert "fix: cascade dashboard relative-time labels
 beyond hours"

This reverts commit 620fe22a64d167017abee00ab7d4144e254c4986.
---
 src/lib/dashboard/live/client.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/dashboard/live/client.mjs b/src/lib/dashboard/live/client.mjs
index 16261d5..1c2f8af 100644
--- a/src/lib/dashboard/live/client.mjs
+++ b/src/lib/dashboard/live/client.mjs
@@ -24,7 +24,7 @@ export const LIVE_JS = `
   function esc(s){return String(s==null?"":s).replace(/[&<>"']/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[c];});}
   function short(s,n){s=String(s||"");return s.length>n?s.slice(0,n-1)+"…":s;}
   function title(s){return String(s||"activity").replace(/[._-]+/g," ").replace(/\\b\\w/g,function(c){return c.toUpperCase();});}
-  function ago(v){var at=Date.parse(v||""),ms=Date.now()-at;if(!Number.isFinite(ms))return"";var s=Math.max(0,Math.round(ms/1000));if(s<5)return"just now";if(s<60)return s+"s ago";var m=Math.round(s/60);if(m<60)return m+"m ago";var h=Math.round(m/60);if(h<24)return h+"h ago";var d=Math.floor(h/24),rh=h%24;if(d<7)return d+"d "+rh+"h ago";var w=Math.floor(d/7),rd=d%7;if(w<52)return w+"w "+rd+"d ago";var y=Math.floor(w/52),rw=w%52;return y+"y "+rw+"w ago";}
+  function ago(v){var at=Date.parse(v||""),ms=Date.now()-at;if(!Number.isFinite(ms))return"";var s=Math.max(0,Math.round(ms/1000));if(s<5)return"just now";if(s<60)return s+"s ago";var m=Math.round(s/60);return m<60?m+"m ago":Math.round(m/60)+"h ago";}
   function hostOf(v){return String(v&&v.host||"internal").toLowerCase();}
   function hostName(v){var h=hostOf(v);return{claude:"Claude Code",codex:"Codex",internal:"Internal"}[h]||title(h);}
   function hostGlyph(v){return{claude:"✳",codex:"◉",internal:"⌁"}[hostOf(v)]||"⌁";}