feat(tui): checkpoint live provider catalogs and routed usage

[Hmbown]

Status

Draft integration checkpoint. Slice A gate repair (2026-08-30) has landed on this branch; see the receipts below. Remaining red is one founder-gated item (CodeQL dismissal packet posted as a PR comment).

Included

• live catalog plumbing and provider-scoped route identity
• Baseten compatible-host discovery and reviewed pricing path
• immutable routed-usage envelopes through Engine and Runtime storage
• dispatch-origin settlement for subagents crossing session replacement
• durable failed-before-turn classifier settlement
• picker/runtime-web pagination and catalog presentation coverage

Slice A repair receipts (2026-08-30, commits 84d64a8, b6a14d0, 9f381e0)

• Clippy: the real count was 8 findings, not 17 — all fixed (large_enum_variant boxed, needless_return, doc_lazy_continuation, obfuscated_if_else). CI Lint + Check formatting now pass.
• Stack-overflow SIGABRTs (runtime_api x2): oversized debug-build futures on the 2MiB libtest stack; pass with RUST_MIN_STACK=16MiB. Structural note recorded.
• opencode_zen wire-route regression (Responses/AnthropicMessages vs ChatCompletions): fixed via route resolver alignment.
• Guardian/kernel usage-to-cost accounting (2 tests + Safety-gate denial test): fixed; 7/7 guardian family green.
• runtime_web drift guard: realigned to the paginated collectProviderModelPages contract (the rewrite was correct; the guard pinned the old URL shape). node --test 36/36.
• PowerShell-nonportable subagent tests: fixed; Test (windows-latest) passes.
• CodeQL: 14 new high → 2 remaining (both lib.rs session-id display through truncate_id; dismissal packet as PR comment — founder-gated).

Hosted check state (head 9f381e0)

Pass: Lint, Safety gate, Test (ubuntu/windows), Version drift, link, integrations, DCO, npm smoke, ohos check, GitGuardian, all CodeQL Analyze lanes. Pending at last sweep: Test (macos-latest). Fail: CodeQL aggregate (the 2 documented alerts only).

Still true (unchanged scope)

• the Baseten offline seed needs source/provenance review against the authenticated workspace catalog
• no authenticated OpenRouter/Baseten canary, artifact, installed-product smoke, billing proof, or founder acceptance has been supplied
• visible synthetic Failed-turn semantics and the late-usage sidecar namespace still need product/API review

No-Issue: long-lived integration checkpoint tracked in the Ops takeover plan; slice receipts inline above.

[Hmbown]

CodeQL aggregate — per-alert disposition (Slice A)

The 14 new high alerts are handled in two classes:

Fixed in code (9f381e00e + fmt b6a14d0c2) — 12 alerts:

• 10 × runtime_api/tests.rs cleartext-transmission: loopback test servers whose {addr} variable hid the 127.0.0.1 binding from the analyzer. URLs now spell the loopback host literally (http://127.0.0.1:{port}/…). Behavior unchanged — the listeners always bound 127.0.0.1.
• 2 × anti-leak assertions (cost_status.rs, runtime_threads/tests.rs) that interpolated the credential fragment into the assert panic message — the message itself was the logging sink it guarded against. Messages now name the check, not the secret.

Founder-dismissal packet — the remaining 2 (lib.rs:7777, lib.rs:8141, cleartext-logging of validated_session_id):

• Both sites are the CLI session picker / fork output printing the user's own sessions to their own terminal.
• The printed ids pass through truncate_id — the full id never renders.
• Session ids are local file identifiers, not credentials; printing them for resume UX is the product feature (Codex's picker does the same).
• Recommendation: dismiss both as false positive with this reasoning. Dismissal stays founder-gated per the security-surface rule — no unilateral action taken.

No gate weakening: no query config changes, no inline suppressions, no dismissals by the agent.