docs(governance): fold in 6 codex review findings

External Codex CLI review surfaced 6 substantive findings beyond what
the internal opus reviewer caught at D1. All folded in this commit.
Files changed: ALIGNMENT.md, README.md, ADR 0001, ADR 0006, CHANGELOG.

1. Provider Inventory split: Candidate vs Enabled
   - Bootstrap previously listed anthropic/openai/mistral as Tier D
     default-enabled with Authority pins still "TBD at Phase N spawn".
     This violated Rule 1 (Cite First) and Rule 3 (Match Implementation).
   - v0.1 founding now ships 0 Enabled Providers. All 8 are Candidate.
     Enablement requires: authority pin filled + plugin landed + Phase
     audit passed.

2. Antigravity Tier A downgraded to "evidence-backed pending pin"
   - Secondary reports disagree on blast radius (piunikaweb 03-02 says
     AI-tier only; piunikaweb 02-23 + OpenClaw issue + VentureBeat say
     broader). Google FAQ language naming OpenClaw/OpenCode/Claude Code
     is cited from secondary sources only — primary URL not pinned.
   - Exclusion remains active by default; constitutional weight matches
     evidence. Primary-source pinning tracked as one-shot audit task
     with 90-day Tier-reconsideration trigger.

3. ADR 0001 supersession scope narrowed
   - Previous draft claimed OLP is "the structural shape ADR 0005
     endorsed," but ADR 0005's separate-repo recommendation came with
     "BYOK from day one" + "no cli.js spawn" qualifiers OLP rejects.
   - Supersession now narrowly scoped to "single-provider-sufficiency
     premise only"; BYOK + no-spawn parts of ADR 0005 explicitly NOT
     inherited.

4. Anthropic post-2026-06-15 one-shot audit scheduled
   - Annual 14 May audit would leave the Anthropic Tier re-eval almost
     a year late after the 2026-06-15 split.
   - Added one-shot audit for 2026-06-16 (or first billing-cycle close)
     verifying observed behaviour matches spec §2 assumptions.

5. Tier A "permanent" wording unified
   - ALIGNMENT.md and ADR 0006 disagreed (permanent vs amendable).
     Unified as "Excluded by default. Cannot be re-included unless
     ADR 0006 is superseded/amended with new primary-source evidence."

6. OpenAI Tier D wording softened
   - Discussion #8338 was framed as "maintainer confirmed permissive";
     actual quote is a maintainer posture statement with explicit "I'm
     an engineer, not a lawyer" caveat.
   - Now: "maintainer signal indicates low risk; formal ToS pin pending."

Reviewer: OpenAI Codex CLI (external, fresh-context). Iron Rule 10
satisfied — internal opus reviewer was not the source of these
findings; reviewer and maintainer are distinct.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/adr/0001-project-founding.md

@@ -27,12 +27,22 @@ Found OLP (Open LLM Proxy) as a new project, separate from OCP, with the followi
 - A model-capability router. OLP does not auto-route to "the smartest model"; the user picks the model explicitly per chain in `config.routing.chains[]`. Capability routing is a separate problem with separate failure modes and is out of scope for v1.0 and beyond.
 - A conversation-state store. Memory and continuity are client-side concerns (Memory Continuity, Hermes equivalents, IDE-side context). OLP is a pure stateless proxy.
 
-**Supersession of OCP ADR 0005.** OCP ADR 0005 ("No Multi-Provider Refactor") is explicitly superseded by OLP's existence. Specifically:
-- ADR 0005's premise that *single-provider sufficiency* was the right scope for the maintainer's LLM proxy was correct on 2026-05-06 and is wrong on 2026-05-23, because Anthropic changed the underlying contract.
-- ADR 0005's recommendation that "commercial work, if pursued, starts elsewhere" pointed correctly toward "a separate repository, separate name, BYOK from day one, no `cli.js` spawn." OLP is not the commercial work ADR 0005 contemplated, but it is the structural shape ADR 0005 endorsed: a separate repo with multi-provider design baked in from day one.
-- OCP itself is not deleted. Per spec §7, OCP enters maintenance mode when OLP v0.1 ships. The two projects do not parallel-run in production (port-3456 conflict, single launchd service slot, one set of credentials per machine).
+**Supersession of OCP ADR 0005.** OCP ADR 0005 ("No Multi-Provider Refactor") is explicitly superseded by OLP's existence. The supersession is **narrow** and **does not adopt all of ADR 0005's alternative-path suggestions**:
 
-OCP ADR 0005 receives a header amendment on merge of this ADR: *"Superseded by OLP — see [OLP repo URL] ADR 0001."* The body of ADR 0005 is otherwise untouched. Future readers should see the original reasoning intact and the supersession marker explicit.
+What OLP genuinely inherits from ADR 0005:
+1. **Structural separation:** the judgment that if multi-provider becomes needed, the right move is to start a separate project, not retrofit OCP. ✓
+2. **Multi-provider design baked in from day one** (rather than retrofitted onto a single-provider core). ✓
+
+What OLP supersedes in ADR 0005:
+- ADR 0005's premise that *single-provider sufficiency* was the right scope for the maintainer's LLM proxy was correct on 2026-05-06 and is wrong on 2026-05-23, because Anthropic changed the underlying contract. This is the load-bearing supersession.
+
+What OLP **does NOT inherit** from ADR 0005 (and where ADR 0005's reasoning does not apply to OLP):
+- ADR 0005's separate-project recommendation came with two qualifiers that OLP rejects: "BYOK from day one" and "no `cli.js` spawn." Both qualifiers were appropriate for the *commercial* path ADR 0005 was contemplating. OLP is not commercial — it is personal- and family-scale, shares the maintainer's own subscription quota across family clients, and explicitly spawns provider CLIs (it is precisely the spawn-binary architecture that delivers the "subscription quota maximization" value proposition spec §1 names).
+- OLP is therefore not the commercial pivot ADR 0005 endorsed. It is a personal-use re-architecture of the proxy-CLI pattern, which ADR 0005 did not contemplate. The supersession is honest about this gap.
+
+OCP itself is not deleted. Per spec §7, OCP enters maintenance mode when OLP v0.1 ships. The two projects do not parallel-run in production (port-3456 conflict, single launchd service slot, one set of credentials per machine).
+
+OCP ADR 0005 receives a header amendment on merge of this ADR: *"Superseded in part by OLP — see https://github.com/dtzp555-max/olp ADR 0001 for the narrow scope of the supersession (single-provider-sufficiency premise only; ADR 0005's commercial / BYOK / no-spawn recommendations are not adopted)."* The body of ADR 0005 is otherwise untouched. Future readers should see the original reasoning intact and the supersession marker scoped explicitly.
 
 ## Consequences
 

docs/adr/0006-provider-inclusion.md

@@ -26,27 +26,27 @@ One precision point requires emphasis. The Google Antigravity ban is **not** a "
 
 OLP adopts a four-tier provider classification framework per spec §3.1:
 
-**Tier A — Excluded.** Vendor's AI suite (note: scoped to AI services, not always whole account) suspended on enforcement; vendor documentation explicitly names third-party proxy tools as prohibited; subscription price does not differentially advantage the provider over Tier D alternatives. Bar is intentionally narrow: **all three conditions** must hold for Tier A exclusion. Single-signal triggers (e.g., a tightening clause with no enforcement) drop to Tier C, not A.
+**Tier A — Excluded by default.** Vendor's AI suite (note: scoped to AI services, not always whole account) suspended on enforcement; vendor documentation explicitly names third-party proxy tools as prohibited; subscription price does not differentially advantage the provider over Tier D alternatives. Bar is intentionally narrow: **all three conditions** must hold for Tier A exclusion. Single-signal triggers (e.g., a tightening clause with no enforcement) drop to Tier C, not A. **Cannot be re-included unless ADR 0006 is superseded or amended with new primary-source evidence.** "Tier A" is not "permanently and irrevocably excluded" — the project's amendment procedure remains available. What "Tier A" means is "the bar for re-inclusion is a constitutional change with primary-source evidence, not a routine PR."
 
 **Tier B — Optional, default-disabled, explicit consent required.** Service-level key revocation risk; vendor may extend revocation across that vendor's AI surfaces but does not touch non-AI services. ToS contains explicit anti-automation language. Enable requires a one-time consent UX: the consent prompt names the specific provider's policy clause and the realistic outcome (key revocation, not account suspension). Consent is recorded in `~/.olp/config.json` with a timestamp.
 
 **Tier C — Optional, default-disabled, no consent UX.** ToS language has tightened (recent ToS update with anti-third-party direction) but no enforcement history exists. Enable is a config toggle; no consent prompt because the risk is signal-only rather than documented.
 
-**Tier D — Default-enabled.** No anti-third-party clauses in subscription ToS; healthy ecosystem; permissive maintainer posture (where verifiable, e.g., maintainer-confirmed via official channel).
+**Tier D — Eligible for default-enabled.** No anti-third-party clauses in subscription ToS; healthy ecosystem; permissive maintainer posture (where verifiable, e.g., maintainer-confirmed via official channel). **Tier D classification does not automatically enable a provider in OLP**: enablement requires the provider to transition from Candidate to Enabled per ALIGNMENT.md § Provider Inventory (authority pin filled + plugin landed + Phase audit passed). Tier classification is the *eligibility* gate; the Candidate-to-Enabled transition is the *activation* gate.
 
 **Current classification table (v0.1):**
 
 | Provider | Tier | Reason |
 |----------|------|--------|
 | Anthropic (Claude Code) | D | OCP-inherited. Pre-2026-06-15 subscription model was permissive. Post-2026-06-15 the credit-pool-vs-subscription split is a **quota constraint** within OLP's mission (manage it via fallback), not a **third-party prohibition**. ToS does not name third-party tools. |
-| OpenAI Codex | D | Codex maintainer confirmed permissive in Codex GitHub Discussion #8338 (2026 reference). Codex CLI is the official Codex client; subscription auth via ChatGPT account is the intended UX. |
+| OpenAI Codex | D | Codex maintainer signal indicates low risk: GitHub Discussion #8338 confirms the CLI is permissively licensed and that OSS projects doing similar work exist (maintainer also stated "I'm an engineer, not a lawyer," so the signal is a maintainer posture statement, **not** a formal ToS blessing). Codex CLI is the official Codex client; subscription auth via ChatGPT account is the intended UX. Formal ToS pin pending — recorded as a follow-up audit task in ALIGNMENT.md § One-shot Triggered Audits. |
 | Mistral Vibe (Le Chat Pro) | D | Usage Policy contains no anti-third-party / anti-automation clauses. Vibe is the official Mistral CLI; Le Chat Pro subscription explicitly includes Vibe. |
 | xAI Grok Build | C | Jan 2026 ToS tightening introduced more restrictive automation language; no documented enforcement wave; uses API-key auth (not SuperGrok OAuth) to remain in the lower-risk lane. |
 | Moonshot Kimi | C | "3 violations = ban" generic policy; no third-party-CLI-specific enforcement observed; API-key auth (not OAuth). |
 | MiniMax | B | Token Plan policy prohibits automated scripts. Key revocation risk documented. Consent: key may be revoked; account remains usable. |
 | Zhipu GLM | B | Coding Plan restricted to "officially supported tools." Key revocation risk. Consent UX: key may be revoked; account remains usable. |
 | Alibaba Qwen | B | Coding Plan policy prohibits automation. Key revocation risk. Consent UX as above. |
-| Google Antigravity | A | Feb 2026 enforcement wave restricted Antigravity + Gemini CLI + Cloud Code Private APIs for affected accounts. **Important scope correction:** the ban is *Google AI services tier* (not whole Google account); Gmail/Drive/YouTube are unaffected per piunikaweb 2026-03-02 OpenClaw exec confirmation. Excluded on the **combination** of (1) Google FAQ explicitly names OpenClaw/OpenCode/Claude Code as prohibited third-party tools — only provider in this survey with named-tool prohibition; (2) AI Pro $20 / Ultra $200 is not differentially cheap vs OpenAI Codex Plus $20 / Pro $200, so no cost advantage to taking on the risk; (3) reinstatement process exists but is via Google Form with unclear SLA. Any single factor would not justify Tier A; the combination does. |
+| Google Antigravity | A (evidence-backed, pending primary-source pin) | Feb 2026 enforcement wave restricted Antigravity + Gemini CLI + Cloud Code Private APIs for affected accounts. **Blast-radius caveat:** secondary reports disagree — piunikaweb 2026-03-02 cites an OpenClaw exec saying only Antigravity AI surfaces were affected (Gmail/Drive unaffected); other reports (piunikaweb 2026-02-23 itself, OpenClaw issue #14203 framing, VentureBeat, Digital Watch) describe affected users losing "entire Google account access" or "Workspace temporarily affected." The two pictures are not yet reconcilable from secondary sources. Excluded on the **combination** of: (1) Google FAQ reportedly names OpenClaw/OpenCode/Claude Code as prohibited third-party tools — this is the only provider in the survey with named-tool prohibition, **but the FAQ URL or archival snapshot has not been primary-source-pinned** at v0.1 founding; (2) AI Pro $20 / Ultra $200 is not differentially cheap vs OpenAI Codex Plus $20 / Pro $200, so no cost advantage to taking on the risk; (3) reinstatement process exists but is via Google Form with unclear SLA. Any single factor would not justify Tier A; the combination does. **Primary-source pinning is tracked as an open one-shot audit task** in ALIGNMENT.md § One-shot Triggered Audits; if the FAQ language cannot be primary-sourced within 90 days of 2026-05-23, an ADR 0006 amendment must propose a Tier reconsideration (possibly Tier C "evidence-backed signal only" rather than Tier A). |
 
 **Consent UX for Tier B (per spec §3.1).** First-enable triggers a CLI prompt: