diff --git a/ALIGNMENT.md b/ALIGNMENT.md index a58e0b4..71e4459 100644 --- a/ALIGNMENT.md +++ b/ALIGNMENT.md @@ -81,29 +81,46 @@ Provider inclusion / exclusion is governed by a four-tier risk model. The full r | Tier | Meaning | OLP treatment | |---|---|---| -| **A** — vendor AI-platform-wide ban + explicit named prohibition + poor cost/benefit | **Permanently excluded.** Not bundled, not pluggable, not added via opt-in. | +| **A** — vendor AI-platform-wide enforcement + explicit named prohibition + poor cost/benefit | **Excluded by default.** Not bundled, not pluggable, not added via opt-in. Cannot be re-included unless ADR 0006 is superseded/amended with new primary-source evidence. | | **B** — service-level key revocation; vendor may extend across AI services | **Optional tier 2.** Default-disabled. Requires one-time explicit consent prompt on enable. README documents the policy clause and realistic revocation outcome. | | **C** — tightening signal; no documented enforcement history | **Optional tier 1.** Default-disabled. Opt-in via config without consent prompt. | -| **D** — permissive / safe | **Default-enabled.** Bundled in default config. | +| **D** — permissive / safe | **Eligible for default-enabled** once the provider transitions from Candidate to Enabled (see Provider Inventory below). | -A vendor's documented ToS, FAQ language naming third-party proxy tools, observable enforcement history, and subscription cost/benefit jointly determine tier. Re-classification requires an ADR 0006 amendment. +A vendor's documented ToS, FAQ language naming third-party proxy tools, observable enforcement history, and subscription cost/benefit jointly determine tier. Re-classification requires an ADR 0006 amendment. **Tier classification alone does not auto-enable a provider** — see the Candidate/Enabled split in Provider Inventory. --- ## Provider Inventory (v1.0) -| Provider key | Tier | Default state | Inclusion source | -|---|---|---|---| -| `anthropic` | D (re-eval post-2026-06-15) | Enabled | ADR 0001 § Mission inheritance; ADR 0006 | -| `openai` | D | Enabled | ADR 0006 | -| `mistral` | D | Enabled | ADR 0006 | -| `grok` | C | Disabled (opt-in) | ADR 0006 | -| `kimi` | C | Disabled (opt-in) | ADR 0006 | -| `minimax` | B | Disabled (consent required) | ADR 0006 | -| `glm` | B | Disabled (consent required) | ADR 0006 | -| `qwen` | B | Disabled (consent required) | ADR 0006 | +OLP distinguishes **Candidate Providers** (declared in this constitution as intended for inclusion, but **not yet authority-pinned**) from **Enabled Providers** (authority pin filled, plugin landed, Phase audit passed; eligible for default-enabled or opt-in installation). -**Excluded permanently (Tier A):** Google Antigravity. See ADR 0006 for the named-prohibition + no-cost-advantage + reinstatement-friction rationale. Re-inclusion requires an ADR 0006 amendment with new evidence of policy change. +The v0.1 founding commit ships **zero Enabled Providers**. This is intentional: a constitution that names a provider as "default-enabled" while its CLI version, output shape, auth artifact, and exit-code semantics are still TBD violates Rules 1 (Cite First) and 3 (Match the Implementation). Enablement is a Phase audit deliverable, not a bootstrap claim. + +### Enabled Providers + +| Provider key | Tier | Default state | Authority pin | Inclusion source | +|---|---|---|---|---| +| _(none at v0.1 founding — populated as Phase audits land)_ | — | — | — | — | + +A provider transitions from Candidate to Enabled only when **all three** of the following hold: +1. Its row in the Authority pin table (Authorities § 1 above) is filled with a real CLI version + observed-behaviour transcript or docs URL — no `TBD`. +2. Its plugin lands in `lib/providers/.mjs` per ADR 0002, conforming to the v1.0 Provider contract. +3. A Phase audit per spec §6 reports passing E2E for that provider (smoke against `/v1/chat/completions` round-trip + cache hit/miss + fallback chain entry). + +### Candidate Providers + +| Provider key | Anticipated Tier | Anticipated Phase | Inclusion source | +|---|---|---|---| +| `anthropic` | D (re-eval post-2026-06-15) | Phase 1 | ADR 0001 § Mission inheritance; ADR 0006 | +| `openai` | D | Phase 2 | ADR 0006 | +| `mistral` | D | Phase 3 | ADR 0006 | +| `grok` | C | Phase 8+ | ADR 0006 | +| `kimi` | C | Phase 8+ | ADR 0006 | +| `minimax` | B | Phase 8+ | ADR 0006 | +| `glm` | B | Phase 8+ | ADR 0006 | +| `qwen` | B | Phase 8+ | ADR 0006 | + +**Excluded by default (Tier A candidate):** Google Antigravity. See ADR 0006 for the rationale, currently classified as **evidence-backed exclusion pending primary-source pin** — the Google FAQ language reportedly naming OpenClaw / OpenCode / Claude Code as prohibited is cited from secondary reports (VentureBeat, piunikaweb, The Register, OpenClaw issue #14203); a primary-source URL or archival snapshot is a follow-up audit task. Until the primary source is pinned, the Tier A classification rests on secondary evidence — sufficient for default-not-bundled, but not yet sufficient for "permanent" in the constitutional sense. Re-inclusion requires an ADR 0006 amendment with primary-source evidence either confirming or contradicting the current secondary picture. --- @@ -123,6 +140,16 @@ If a user workflow appears to depend on an unalignable behaviour, the correct re --- +## One-shot Triggered Audits + +In addition to the recurring 14 May audit below, the following one-shot audits are scheduled and must complete on their named trigger: + +- **2026-06-16 (or first Anthropic Agent SDK Credit billing-cycle close, whichever is later)** — verify the post-2026-06-15 Anthropic billing-split behaviour matches the spec §2 assumption: programmatic `claude -p` traffic is metered against the separate Agent SDK Credit pool, not Plan limits. Update the Anthropic Authority pin row above with the observed behaviour, update ADR 0006 with the post-effective-date Tier re-evaluation, and append a Decision-log entry to the spec §10. If observed behaviour diverges from the spec assumption (e.g., Plan limits still apply, or credit pool meter differs from `$100/Max5x/month`), file a Risk-Tier reclassification per ADR 0006 amendment procedure. + +- **Antigravity primary-source pin (open-ended, no deadline)** — find a primary-source URL or archival snapshot for the Google FAQ language naming OpenClaw / OpenCode / Claude Code as prohibited. Pin the URL + retrieval timestamp into ADR 0006. If the primary source cannot be located within 90 days of this commit and only secondary reports remain, file an ADR 0006 amendment proposing a re-classification (Tier A may need to soften to Tier C "evidence-backed signal only" if the prohibition cannot be primary-sourced). + +--- + ## Annual Alignment Audit - **Date:** 14 May each year (the anniversary of the Anthropic 2026-05-14 announcement, which is the structural trigger for OLP). diff --git a/CHANGELOG.md b/CHANGELOG.md index c029427..875538b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,21 @@ All notable changes to OLP land here. Per `CLAUDE.md` release_kit overlay, this file is the source of truth for GitHub release notes. +## Unreleased — 2026-05-23 (governance amendments per external codex review) + +External AI review (OpenAI Codex CLI) of the bootstrap governance surfaced six substantive findings beyond what the internal opus reviewer caught. All six folded in this turn: + +1. **Provider Inventory split into Candidate vs Enabled** — ALIGNMENT.md previously listed `anthropic` / `openai` / `mistral` as Tier D default-enabled while their Authority pins were still `TBD at Phase N spawn`. This violated Rule 1 (Cite First) and Rule 3 (Match the Implementation). The v0.1 founding commit now ships **zero Enabled Providers**; all 8 providers are Candidate. Enablement is a Phase audit deliverable, not a bootstrap claim. (ALIGNMENT.md § Provider Inventory; README.md § Supported Providers.) +2. **Antigravity Tier A evidence strength downgraded to "evidence-backed, pending primary-source pin"** — ADR 0006 previously framed the Antigravity exclusion as a closed case based on secondary reports. The reports actually disagree on blast radius (piunikaweb 03-02 says AI-tier only; piunikaweb 02-23, OpenClaw issue #14203, VentureBeat say broader). The Google FAQ language naming OpenClaw/OpenCode/Claude Code is cited from secondary sources only; the original FAQ URL or archival snapshot has not been primary-source-pinned. The exclusion is still active by default, but the constitutional weight now matches the evidence: secondary-sourced. Primary-source pinning is tracked as an open one-shot audit task with a 90-day Tier-reconsideration trigger. +3. **ADR 0001 supersession scope honesty** — ADR 0001 previously claimed OLP is "the structural shape ADR 0005 endorsed: a separate repo with multi-provider design baked in from day one." But ADR 0005's separate-repo recommendation came with two qualifiers OLP rejects: "BYOK from day one" and "no `cli.js` spawn." OLP rejects both — it is non-commercial and explicitly spawn-binary. The supersession is now narrowly scoped to "single-provider-sufficiency premise only"; the BYOK / no-spawn parts of ADR 0005 are not inherited. +4. **Anthropic post-2026-06-15 one-shot audit scheduled** — ALIGNMENT.md's annual 14 May audit would have left the Anthropic Tier re-evaluation almost a year late. Added a one-shot audit for 2026-06-16 (or first Anthropic billing-cycle close) that verifies the post-effective-date behaviour and updates ADR 0006 + Authority pin. +5. **Tier A "permanent" language unified across docs** — ALIGNMENT.md and ADR 0006 disagreed: one said "permanently excluded," the other said "amendment-procedure-revisable." Unified as "Excluded by default. Cannot be re-included unless ADR 0006 is superseded or amended with new primary-source evidence." The amendment procedure remains available; "Tier A" sets the bar for re-inclusion at constitutional-amendment level, not at routine PR level. +6. **OpenAI Tier D wording softened** — ADR 0006 previously described Codex Discussion #8338 as "maintainer confirmed permissive." The discussion is actually a maintainer posture statement ("OSS projects like OpenCode are doing things similar") with an explicit "I'm an engineer, not a lawyer" caveat. Now described as "maintainer signal indicates low risk; formal ToS pin pending" with the pin tracked as a follow-up audit task. + +Files changed: `ALIGNMENT.md`, `README.md`, `docs/adr/0001-project-founding.md`, `docs/adr/0006-provider-inclusion.md`. No code, no CI workflow, no PR template change. + +Reviewer for this amendment: OpenAI Codex CLI (external, fresh-context). Iron Rule 10 satisfied — the internal opus reviewer was not the source of the findings, and the maintainer is not the author of the underlying critique. The amendment's substantive changes are direct fold-ins of the reviewer's six findings; the internal opus reviewer's earlier APPROVE_WITH_MINOR verdict is therefore narrowed retroactively to "APPROVE conditional on these amendments" for the purposes of the v0.1 governance bootstrap. + ## v0.1.0-bootstrap — 2026-05-23 ### Phase 0 — Repo bootstrap diff --git a/README.md b/README.md index 43c6e5e..c8c5ad0 100644 --- a/README.md +++ b/README.md @@ -43,20 +43,24 @@ olp start Source of truth: [`models-registry.json`](./models-registry.json). This table is regenerated from the registry per the [`release_kit`](./CLAUDE.md) overlay; do not edit it out of sync. -| Provider key | CLI | Subscription / auth | Risk Tier (per [ADR 0006](./docs/adr/0006-provider-inclusion.md)) | Default state | +OLP distinguishes **Candidate Providers** (declared as intended, not yet pinned) from **Enabled Providers** (authority pin filled + plugin landed + Phase audit passed). The v0.1 founding commit ships **zero Enabled Providers** — enablement is a Phase audit deliverable, not a bootstrap claim. See [`ALIGNMENT.md` § Provider Inventory](./ALIGNMENT.md) for the transition gate. + +### Candidate Providers + +| Provider key | CLI | Subscription / auth | Anticipated Tier | Anticipated Phase | |---|---|---|---|---| -| `anthropic` | `claude -p` | Pro / Max OAuth (pre-2026-06-15); Agent SDK Credit pool after | D (re-eval post-2026-06-15) | Enabled | -| `openai` | `codex exec --json` | ChatGPT Pro OAuth or API key | D | Enabled | -| `mistral` | `vibe --prompt --output json` | Le Chat Pro API key | D | Enabled | -| `grok` | `grok -p --output-format streaming-json` | xAI Build `xai-...` API key | C | Disabled (opt-in) | -| `kimi` | `kimi -p --output-format stream-json` | Moonshot Kimi API key | C | Disabled (opt-in) | -| `minimax` | TBD | MiniMax Token Plan (¥29+/mo) | B | Disabled (consent required) | -| `glm` | TBD | Zhipu Coding Plan ($10+/mo) | B | Disabled (consent required) | -| `qwen` | TBD | Alibaba Coding Plan ($50/mo) | B | Disabled (consent required) | +| `anthropic` | `claude -p` | Pro / Max OAuth (pre-2026-06-15); Agent SDK Credit pool after | D (re-eval post-2026-06-15) | Phase 1 | +| `openai` | `codex exec --json` | ChatGPT Pro OAuth or API key | D | Phase 2 | +| `mistral` | `vibe --prompt --output json` | Le Chat Pro API key | D | Phase 3 | +| `grok` | `grok -p --output-format streaming-json` | xAI Build `xai-...` API key | C | Phase 8+ | +| `kimi` | `kimi -p --output-format stream-json` | Moonshot Kimi API key | C | Phase 8+ | +| `minimax` | TBD | MiniMax Token Plan (¥29+/mo) | B | Phase 8+ | +| `glm` | TBD | Zhipu Coding Plan ($10+/mo) | B | Phase 8+ | +| `qwen` | TBD | Alibaba Coding Plan ($50/mo) | B | Phase 8+ | -**Risk tier guide.** D = permissive / safe; C = tightening signal, no enforcement history; B = service-level key revocation risk, vendor may extend across that vendor's AI services; A = permanently excluded. Tier B providers prompt for explicit consent on first enable and record consent in `~/.olp/config.json`. See [`ALIGNMENT.md` § Risk Tier Framework](./ALIGNMENT.md#risk-tier-framework). +**Risk tier guide.** D = permissive / safe (eligible for default-enabled); C = tightening signal, no enforcement history (opt-in); B = service-level key revocation risk (opt-in + consent); A = excluded by default (cannot be opt-in enabled). Tier B providers prompt for explicit consent on first enable and record consent in `~/.olp/config.json`. See [`ALIGNMENT.md` § Risk Tier Framework](./ALIGNMENT.md#risk-tier-framework). -**Excluded permanently (Tier A).** Google Antigravity. See [ADR 0006](./docs/adr/0006-provider-inclusion.md) for the named-prohibition + no-cost-advantage + reinstatement-friction rationale. +**Excluded by default (Tier A — evidence-backed, pending primary-source pin).** Google Antigravity. See [ADR 0006](./docs/adr/0006-provider-inclusion.md) for the named-prohibition + no-cost-advantage + reinstatement-friction rationale, and for the primary-source pinning follow-up that may force a Tier reconsideration if the Google FAQ language cannot be sourced within 90 days of 2026-05-23. --- diff --git a/docs/adr/0001-project-founding.md b/docs/adr/0001-project-founding.md index 2701b38..7331b2d 100644 --- a/docs/adr/0001-project-founding.md +++ b/docs/adr/0001-project-founding.md @@ -27,12 +27,22 @@ Found OLP (Open LLM Proxy) as a new project, separate from OCP, with the followi - A model-capability router. OLP does not auto-route to "the smartest model"; the user picks the model explicitly per chain in `config.routing.chains[]`. Capability routing is a separate problem with separate failure modes and is out of scope for v1.0 and beyond. - A conversation-state store. Memory and continuity are client-side concerns (Memory Continuity, Hermes equivalents, IDE-side context). OLP is a pure stateless proxy. -**Supersession of OCP ADR 0005.** OCP ADR 0005 ("No Multi-Provider Refactor") is explicitly superseded by OLP's existence. Specifically: -- ADR 0005's premise that *single-provider sufficiency* was the right scope for the maintainer's LLM proxy was correct on 2026-05-06 and is wrong on 2026-05-23, because Anthropic changed the underlying contract. -- ADR 0005's recommendation that "commercial work, if pursued, starts elsewhere" pointed correctly toward "a separate repository, separate name, BYOK from day one, no `cli.js` spawn." OLP is not the commercial work ADR 0005 contemplated, but it is the structural shape ADR 0005 endorsed: a separate repo with multi-provider design baked in from day one. -- OCP itself is not deleted. Per spec §7, OCP enters maintenance mode when OLP v0.1 ships. The two projects do not parallel-run in production (port-3456 conflict, single launchd service slot, one set of credentials per machine). +**Supersession of OCP ADR 0005.** OCP ADR 0005 ("No Multi-Provider Refactor") is explicitly superseded by OLP's existence. The supersession is **narrow** and **does not adopt all of ADR 0005's alternative-path suggestions**: -OCP ADR 0005 receives a header amendment on merge of this ADR: *"Superseded by OLP — see [OLP repo URL] ADR 0001."* The body of ADR 0005 is otherwise untouched. Future readers should see the original reasoning intact and the supersession marker explicit. +What OLP genuinely inherits from ADR 0005: +1. **Structural separation:** the judgment that if multi-provider becomes needed, the right move is to start a separate project, not retrofit OCP. ✓ +2. **Multi-provider design baked in from day one** (rather than retrofitted onto a single-provider core). ✓ + +What OLP supersedes in ADR 0005: +- ADR 0005's premise that *single-provider sufficiency* was the right scope for the maintainer's LLM proxy was correct on 2026-05-06 and is wrong on 2026-05-23, because Anthropic changed the underlying contract. This is the load-bearing supersession. + +What OLP **does NOT inherit** from ADR 0005 (and where ADR 0005's reasoning does not apply to OLP): +- ADR 0005's separate-project recommendation came with two qualifiers that OLP rejects: "BYOK from day one" and "no `cli.js` spawn." Both qualifiers were appropriate for the *commercial* path ADR 0005 was contemplating. OLP is not commercial — it is personal- and family-scale, shares the maintainer's own subscription quota across family clients, and explicitly spawns provider CLIs (it is precisely the spawn-binary architecture that delivers the "subscription quota maximization" value proposition spec §1 names). +- OLP is therefore not the commercial pivot ADR 0005 endorsed. It is a personal-use re-architecture of the proxy-CLI pattern, which ADR 0005 did not contemplate. The supersession is honest about this gap. + +OCP itself is not deleted. Per spec §7, OCP enters maintenance mode when OLP v0.1 ships. The two projects do not parallel-run in production (port-3456 conflict, single launchd service slot, one set of credentials per machine). + +OCP ADR 0005 receives a header amendment on merge of this ADR: *"Superseded in part by OLP — see https://github.com/dtzp555-max/olp ADR 0001 for the narrow scope of the supersession (single-provider-sufficiency premise only; ADR 0005's commercial / BYOK / no-spawn recommendations are not adopted)."* The body of ADR 0005 is otherwise untouched. Future readers should see the original reasoning intact and the supersession marker scoped explicitly. ## Consequences diff --git a/docs/adr/0006-provider-inclusion.md b/docs/adr/0006-provider-inclusion.md index e762900..b235cc1 100644 --- a/docs/adr/0006-provider-inclusion.md +++ b/docs/adr/0006-provider-inclusion.md @@ -26,27 +26,27 @@ One precision point requires emphasis. The Google Antigravity ban is **not** a " OLP adopts a four-tier provider classification framework per spec §3.1: -**Tier A — Excluded.** Vendor's AI suite (note: scoped to AI services, not always whole account) suspended on enforcement; vendor documentation explicitly names third-party proxy tools as prohibited; subscription price does not differentially advantage the provider over Tier D alternatives. Bar is intentionally narrow: **all three conditions** must hold for Tier A exclusion. Single-signal triggers (e.g., a tightening clause with no enforcement) drop to Tier C, not A. +**Tier A — Excluded by default.** Vendor's AI suite (note: scoped to AI services, not always whole account) suspended on enforcement; vendor documentation explicitly names third-party proxy tools as prohibited; subscription price does not differentially advantage the provider over Tier D alternatives. Bar is intentionally narrow: **all three conditions** must hold for Tier A exclusion. Single-signal triggers (e.g., a tightening clause with no enforcement) drop to Tier C, not A. **Cannot be re-included unless ADR 0006 is superseded or amended with new primary-source evidence.** "Tier A" is not "permanently and irrevocably excluded" — the project's amendment procedure remains available. What "Tier A" means is "the bar for re-inclusion is a constitutional change with primary-source evidence, not a routine PR." **Tier B — Optional, default-disabled, explicit consent required.** Service-level key revocation risk; vendor may extend revocation across that vendor's AI surfaces but does not touch non-AI services. ToS contains explicit anti-automation language. Enable requires a one-time consent UX: the consent prompt names the specific provider's policy clause and the realistic outcome (key revocation, not account suspension). Consent is recorded in `~/.olp/config.json` with a timestamp. **Tier C — Optional, default-disabled, no consent UX.** ToS language has tightened (recent ToS update with anti-third-party direction) but no enforcement history exists. Enable is a config toggle; no consent prompt because the risk is signal-only rather than documented. -**Tier D — Default-enabled.** No anti-third-party clauses in subscription ToS; healthy ecosystem; permissive maintainer posture (where verifiable, e.g., maintainer-confirmed via official channel). +**Tier D — Eligible for default-enabled.** No anti-third-party clauses in subscription ToS; healthy ecosystem; permissive maintainer posture (where verifiable, e.g., maintainer-confirmed via official channel). **Tier D classification does not automatically enable a provider in OLP**: enablement requires the provider to transition from Candidate to Enabled per ALIGNMENT.md § Provider Inventory (authority pin filled + plugin landed + Phase audit passed). Tier classification is the *eligibility* gate; the Candidate-to-Enabled transition is the *activation* gate. **Current classification table (v0.1):** | Provider | Tier | Reason | |----------|------|--------| | Anthropic (Claude Code) | D | OCP-inherited. Pre-2026-06-15 subscription model was permissive. Post-2026-06-15 the credit-pool-vs-subscription split is a **quota constraint** within OLP's mission (manage it via fallback), not a **third-party prohibition**. ToS does not name third-party tools. | -| OpenAI Codex | D | Codex maintainer confirmed permissive in Codex GitHub Discussion #8338 (2026 reference). Codex CLI is the official Codex client; subscription auth via ChatGPT account is the intended UX. | +| OpenAI Codex | D | Codex maintainer signal indicates low risk: GitHub Discussion #8338 confirms the CLI is permissively licensed and that OSS projects doing similar work exist (maintainer also stated "I'm an engineer, not a lawyer," so the signal is a maintainer posture statement, **not** a formal ToS blessing). Codex CLI is the official Codex client; subscription auth via ChatGPT account is the intended UX. Formal ToS pin pending — recorded as a follow-up audit task in ALIGNMENT.md § One-shot Triggered Audits. | | Mistral Vibe (Le Chat Pro) | D | Usage Policy contains no anti-third-party / anti-automation clauses. Vibe is the official Mistral CLI; Le Chat Pro subscription explicitly includes Vibe. | | xAI Grok Build | C | Jan 2026 ToS tightening introduced more restrictive automation language; no documented enforcement wave; uses API-key auth (not SuperGrok OAuth) to remain in the lower-risk lane. | | Moonshot Kimi | C | "3 violations = ban" generic policy; no third-party-CLI-specific enforcement observed; API-key auth (not OAuth). | | MiniMax | B | Token Plan policy prohibits automated scripts. Key revocation risk documented. Consent: key may be revoked; account remains usable. | | Zhipu GLM | B | Coding Plan restricted to "officially supported tools." Key revocation risk. Consent UX: key may be revoked; account remains usable. | | Alibaba Qwen | B | Coding Plan policy prohibits automation. Key revocation risk. Consent UX as above. | -| Google Antigravity | A | Feb 2026 enforcement wave restricted Antigravity + Gemini CLI + Cloud Code Private APIs for affected accounts. **Important scope correction:** the ban is *Google AI services tier* (not whole Google account); Gmail/Drive/YouTube are unaffected per piunikaweb 2026-03-02 OpenClaw exec confirmation. Excluded on the **combination** of (1) Google FAQ explicitly names OpenClaw/OpenCode/Claude Code as prohibited third-party tools — only provider in this survey with named-tool prohibition; (2) AI Pro $20 / Ultra $200 is not differentially cheap vs OpenAI Codex Plus $20 / Pro $200, so no cost advantage to taking on the risk; (3) reinstatement process exists but is via Google Form with unclear SLA. Any single factor would not justify Tier A; the combination does. | +| Google Antigravity | A (evidence-backed, pending primary-source pin) | Feb 2026 enforcement wave restricted Antigravity + Gemini CLI + Cloud Code Private APIs for affected accounts. **Blast-radius caveat:** secondary reports disagree — piunikaweb 2026-03-02 cites an OpenClaw exec saying only Antigravity AI surfaces were affected (Gmail/Drive unaffected); other reports (piunikaweb 2026-02-23 itself, OpenClaw issue #14203 framing, VentureBeat, Digital Watch) describe affected users losing "entire Google account access" or "Workspace temporarily affected." The two pictures are not yet reconcilable from secondary sources. Excluded on the **combination** of: (1) Google FAQ reportedly names OpenClaw/OpenCode/Claude Code as prohibited third-party tools — this is the only provider in the survey with named-tool prohibition, **but the FAQ URL or archival snapshot has not been primary-source-pinned** at v0.1 founding; (2) AI Pro $20 / Ultra $200 is not differentially cheap vs OpenAI Codex Plus $20 / Pro $200, so no cost advantage to taking on the risk; (3) reinstatement process exists but is via Google Form with unclear SLA. Any single factor would not justify Tier A; the combination does. **Primary-source pinning is tracked as an open one-shot audit task** in ALIGNMENT.md § One-shot Triggered Audits; if the FAQ language cannot be primary-sourced within 90 days of 2026-05-23, an ADR 0006 amendment must propose a Tier reconsideration (possibly Tier C "evidence-backed signal only" rather than Tier A). | **Consent UX for Tier B (per spec §3.1).** First-enable triggers a CLI prompt: