Paid Inference Is Not a Claude Path
One vendor sells a direct messages API and also ships a CLI that already holds a subscription login. Household policy refuses the paid API as a way to run that brain. The Claude brain therefore rides the vendor's Agent SDK, which spawns the operator's own CLI so the CLI authenticates itself. Firebrand reads no credential to run a turn. Which login it follows is a config slot, not a scavenger hunt through every profile on the machine.
That choice has a price, and the price is named. The SDK owns the wire. The loop records each item as observed and executes none of the vendor's native tools itself. Session fidelity is observed, not owned. A ~six-minute subscription wall can end a heavy turn without a final result message; that end is a cut, not an error you paper over. A retry strategy exists as a research item and is not shipped. The exemption is declared. It does not get to head a cleanroom or a comparison other than track 1 — two-plane Ollama hardening, not vendor observation.
Generic Anthropic-Compatible Servers Stay Separate
A generic messages-API leg exists for other servers that speak that shape. The banned production host is a typed refusal on that leg. Mixing the two — 'just this once, the paid key, we are in a hurry' — is how a policy becomes a comment. The canary test exists so a key in the environment cannot hide in a record line or a child environment and then claim it was never used.
Gemini Parks Until It Earns the Default
A key-auth Gemini leg is built and left disabled by default. Legacy OAuth for that vendor is not built. Disabled-by-default is a product sentence: available when the operator turns it on, not silently sitting in the cleanroom path. Legs remain deletable. The record outlives any one of them.