test: reset gateway in afterAll in cli-multimodal-integration — cross-file config leak

Review hardening on #3116: the file resets the gateway in beforeEach but left it configured after the last test, leaking a multimodal gateway config into whatever file runs next in its shard (same class as the adaptive-embed-batch leak fixed on master). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
fix(config): route remaining hand-rolled configureGateway callsites through buildGatewayConfig
2026-08-16 09:52:22 +00:00 · 2026-07-22 12:12:41 -07:00 · 2026-07-21 14:34:19 -07:00
25 changed files with 127 additions and 462 deletions
@@ -79,7 +79,7 @@ per-release `**vX.Y.Z:**` narration — CI enforces this
 - `docs/architecture/RETRIEVAL.md` + `docs/architecture/RETRIEVAL_MAXPOOL_INCIDENT.md` — retrieval-pipeline architecture reference + the named-thing-miss incident write-up (root cause, the five-layer fix, the eval that pins it).
 - `src/core/types.ts` extension + `src/core/operations.ts:search` + `src/core/import-file.ts` + `src/cli.ts` + `src/core/search/telemetry.ts` — the wiring layer for the retrieval cathedral. `SearchResult` gains `evidence`, `create_safety`, `title_match_boost`, `alias_hit` (all optional; evidence/create_safety reference the union types in `evidence.ts`). The `search` MCP op uses a cheap-hybrid path by default and accepts a per-call `mode` (conservative|balanced|tokenmax) honored ONLY for trusted/local callers (`resolvePerCallMode(ctx, ...)` — remote callers use the configured mode so a remote provider can't force tokenmax spend); every search path stamps evidence fail-soft. `importFromContent` projects frontmatter `aliases:` into `page_aliases` via `normalizeAliasList` + `engine.setPageAliases` so new + changed pages register aliases at ingest. `src/cli.ts` adds the `gbrain search diagnose` dispatch (lazy import) and reconciles the `search` CLI path with the cheap-hybrid op. `src/core/search/telemetry.ts` extends the rollup with the rank-1 base_score drift signal (sum/count + 3 coarse buckets, aggregate not per-query), surfaced via `gbrain search stats`, backed by migration v111's `search_telemetry` columns. Tests: `test/cli-search-dispatch.test.ts`, `test/search/per-call-mode.test.ts`, `test/search/telemetry-rank1.test.ts`, `test/search/title-boost-stage.test.ts`, `test/search/alias-hop.test.ts`, `test/search/evidence.test.ts`, `test/search/searchvector-maxpool.test.ts`, `test/search/pre-migration-failopen.test.ts`.
 - `src/commands/eval.ts` — `gbrain eval` command: single-run table + A/B config comparison. Sub-subcommand dispatch on `args[0]` routes `gbrain eval export` + `gbrain eval prune` + `gbrain eval replay` into session-capture handlers; bare `gbrain eval --qrels …` fall-through preserves the legacy IR-metrics flow. `gbrain eval cross-modal` is in the dispatch (the user-facing path is the cli.ts no-DB branch — `src/commands/eval.ts:cross-modal` only fires when callers re-enter with an existing engine).
- `src/commands/eval-cross-modal.ts` — multi-model quality gate. Three different-provider frontier models score the OUTPUT against the TASK on a 5-dim list. Verdict `pass` (exit 0) / `fail` (exit 1) / `inconclusive` (exit 2; <2/3 model successes). Reuses `src/core/ai/gateway.ts:chat()` so config/auth/aliasing comes from the gateway recipe registry — no parallel provider stack. Self-configures the gateway (`configureGateway(loadConfig() + process.env)`) since the cli.ts dispatch bypasses `connectEngine()`. Default cycles 3 in TTY, 1 in non-TTY (partial cost guardrail) via the shared `resolveCycleDefault(explicit, isTty)` in `src/core/eval/cycle-default.ts`; the cost-estimate banner appends `cycleDefaultSuffix(...)` (`for 1 cycle(s) (non-interactive default; --cycles N for more)`) when the value is the silent non-TTY fallback, so the 1-vs-3 difference isn't hidden. Receipts land at `gbrainPath('eval-receipts')/<slug>-<sha8-of-output>.json`. `--batch <jsonl> [--limit N] [--concurrent N] [--max-usd FLOAT] [--yes]` fans out cross-modal scoring across a LongMemEval-shape JSONL; mutually exclusive with `--task` (fail-fast usage error if both set); filters `kind: "by_type_summary"` rows; pre-flight cost estimate refuses if `> --max-usd` without `--yes` (default cap 5.00 USD). Semaphore-bounded fan-out via inline `runWithLimit<T>(items, limit, fn)` (exported for unit tests): max N questions in-flight × 3 model slots = ceiling of 3N parallel API calls (default `--concurrent 3` → 9). Per-question receipts land in a per-batch tempdir and are deleted at end of run; the summary receipt inlines per-question verdicts as JSON, not file paths. Exit precedence (batch-level policy, NOT inherited from aggregate.ts): ERROR > FAIL > INCONCLUSIVE > PASS. DI seam: `runEvalCrossModal(args, opts?: {runEval?: typeof runEval})` mirrors `runEvalLongMemEval(args, {client?})`; tests pass `opts.runEval` to bypass real LLM calls AND the gateway availability check. Pinned by `test/eval-cross-modal-batch.test.ts`.
+- `src/commands/eval-cross-modal.ts` — multi-model quality gate. Three different-provider frontier models score the OUTPUT against the TASK on a 5-dim list. Verdict `pass` (exit 0) / `fail` (exit 1) / `inconclusive` (exit 2; <2/3 model successes). Reuses `src/core/ai/gateway.ts:chat()` so config/auth/aliasing comes from the gateway recipe registry — no parallel provider stack. Self-configures the gateway via `buildGatewayConfig(loadConfig() ?? {})` since the cli.ts dispatch bypasses `connectEngine()`, so file-plane keys, env base URLs, and provider_chat_options follow the same adapter path as runtime. Default cycles 3 in TTY, 1 in non-TTY (partial cost guardrail) via the shared `resolveCycleDefault(explicit, isTty)` in `src/core/eval/cycle-default.ts`; the cost-estimate banner appends `cycleDefaultSuffix(...)` (`for 1 cycle(s) (non-interactive default; --cycles N for more)`) when the value is the silent non-TTY fallback, so the 1-vs-3 difference isn't hidden. Receipts land at `gbrainPath('eval-receipts')/<slug>-<sha8-of-output>.json`. `--batch <jsonl> [--limit N] [--concurrent N] [--max-usd FLOAT] [--yes]` fans out cross-modal scoring across a LongMemEval-shape JSONL; mutually exclusive with `--task` (fail-fast usage error if both set); filters `kind: "by_type_summary"` rows; pre-flight cost estimate refuses if `> --max-usd` without `--yes` (default cap 5.00 USD). Semaphore-bounded fan-out via inline `runWithLimit<T>(items, limit, fn)` (exported for unit tests): max N questions in-flight × 3 model slots = ceiling of 3N parallel API calls (default `--concurrent 3` → 9). Per-question receipts land in a per-batch tempdir and are deleted at end of run; the summary receipt inlines per-question verdicts as JSON, not file paths. Exit precedence (batch-level policy, NOT inherited from aggregate.ts): ERROR > FAIL > INCONCLUSIVE > PASS. DI seam: `runEvalCrossModal(args, opts?: {runEval?: typeof runEval})` mirrors `runEvalLongMemEval(args, {client?})`; tests pass `opts.runEval` to bypass real LLM calls AND the gateway availability check. Pinned by `test/eval-cross-modal-batch.test.ts`.
 - `src/core/eval/cycle-default.ts` — single source of truth for the eval cycle-count default. Exports `DEFAULT_CYCLES_TTY = 3`, `DEFAULT_CYCLES_NONTTY = 1`, `resolveCycleDefault(explicit, isTty): {cycles, usedNonTtyDefault}`, and `cycleDefaultSuffix(r)` (returns ` (non-interactive default; --cycles N for more)` only when the non-TTY default was applied, else `''`). Consumed by `eval-cross-modal.ts`, `eval-takes-quality.ts` (run + regress), and `takes-quality-eval/runner.ts` (core uses only the constant — library stays TTY-agnostic; the CLI owns the TTY=3 upgrade + banner annotation). `eval-suspected-contradictions.ts` applies the same transparency to its `$5`/`$1` budget default via a `budgetUsdExplicit` flag (the budget is overwritten in-place so explicitness can't be inferred post-hoc). Not shared with `resolveWorkersWithClamp` (different domain, no engine, no dedup). Pinned by `test/eval/cycle-default.test.ts`, `test/eval-suspected-contradictions-budget-default.test.ts`.
 - `src/core/cross-modal-eval/json-repair.ts` — `parseModelJSON(raw)` named export with a 4-strategy fallback chain (direct parse → fence-strip → trailing-comma + single-quote + embedded-newline repair → regex nuclear option). Adversarial input throws rather than fabricating scores — the aggregator treats a throw as "this model contributed nothing this cycle" so the gate stays correct at >=2/3 successes.
 - `src/core/cross-modal-eval/aggregate.ts` — pure verdict logic. Pass criterion: `(successes >= 2) AND (every dim mean >= 7) AND (every dim min across models >= 5)`. Inconclusive when <2/3 models returned parseable scores (regression guard for the v1 `Object.values({}).every(...) === true` empty-array PASS bug).
@@ -138,7 +138,7 @@ per-release `**vX.Y.Z:**` narration — CI enforces this
 - `src/core/minions/queue.ts` extension — `MinionQueue.add()` rejects `subagent` jobs whose `data.model` resolves via `isAnthropicProvider()` to a non-Anthropic provider. Lazy-imports `model-config.ts` to avoid pulling engine types into queue's eager-load surface. Layer 1 of the three-layer subagent provider enforcement (layers 2+3: `model-config.ts:enforceSubagentAnthropic` runtime fallback + `src/commands/doctor.ts` `subagent_provider` check). Pinned by `test/agent-cli.test.ts`.
 - `src/commands/models.ts` — `gbrain models [--json]` read-only routing dashboard: prints tier defaults (`utility`/`reasoning`/`deep`/`subagent`), the resolved value for each (re-walking the resolution chain), every per-task override (11 `PER_TASK_KEYS`: `models.dream.synthesize`, `models.dream.patterns`, `models.drift`, `models.auto_think`, `models.think`, `models.subagent`, `facts.extraction_model`, `models.eval.longmemeval`, `models.expansion`, `models.chat`, `models.dream.synthesize_verdict`), the alias map, and a source-of-truth column (`default` / `config: <key>` / `env: <VAR>`). `gbrain models doctor [--skip=<provider>] [--json]` fires a 1-token `gateway.chat()` probe against each configured chat + expansion model and classifies failures into `{model_not_found, auth, rate_limit, network, unknown}`. Wired into `cli.ts` dispatch + `CLI_ONLY` set. A zero-token `embedding_config` probe runs FIRST, before any chat/expansion probes spend money: `probeEmbeddingConfig()` reads `getEmbeddingModel()` + `getEmbeddingDimensions()` and (for Voyage flexible-dim models) checks `isValidVoyageOutputDim(dims)` against `VOYAGE_VALID_OUTPUT_DIMS`. `ProbeStatus` variant `'config'` + optional `fix?: string` on `ProbeResult` surface a paste-ready `gbrain config set ...` line in human + JSON output; touchpoint label `'embedding_config'` joins `'chat'` and `'expansion'`.
 - `src/core/init-embed-check.ts` — embedding-key validation at `gbrain init`. `runInitEmbedCheck(opts)` runs a config-only `diagnoseEmbedding` (catches a missing key for ANY provider) plus a best-effort `liveTestEmbed` (1-token `gateway.embed(['probe'], {inputType:'query', abortSignal})`, 5s `AbortController` timeout, never throws — catches an invalid/expired key). Loud warning to stderr; init still exits 0 (`--no-embedding` is the deferred-setup escape; `--skip-embed-check` / `GBRAIN_INIT_SKIP_EMBED_CHECK=1` skip the check). Builds the effective env (`process.env` + file-plane `openai/anthropic/zeroentropy_api_key` from `loadConfigFileOnly()` + `opts.apiKey`) and configures the gateway via `buildGatewayConfig` before diagnose/probe, so the check sees the same keys AND provider base URLs runtime will (no false "missing key" for config.json-keyed users; the probe hits the right endpoint). Init-specific warning text names `--no-embedding` / `--skip-embed-check`, not the sync-flavored `--no-embed`. Wired into `initPGLite` + `initPostgres` in `src/commands/init.ts`, with the result added to the `--json` envelope as `embedding_check {ok, reason?, live_ok?}`. Pinned by `test/init-embed-check.test.ts` (hermetic via the gateway embed-transport seam + `withEnv`).
- `src/core/ai/build-gateway-config.ts` — `buildGatewayConfig(c: GBrainConfig): AIGatewayConfig`, extracted from `src/cli.ts` (which re-exports it for back-compat). Lets core modules (`init-embed-check.ts`) reuse it without importing the CLI entrypoint. Single owner of folding file-plane API keys (openai/anthropic/zeroentropy) into the gateway env and threading local-server `*_BASE_URL` env vars into base_urls. `process.env` wins EXCEPT empty-string / undefined values are dropped before the merge, so an injected empty `ANTHROPIC_API_KEY=''` (Claude Code neuters subprocess LLM calls this way) can't clobber a valid config-plane key; `'0'` / `'false'` are preserved. Pinned by `test/ai/build-gateway-config.test.ts`.
+- `src/core/ai/build-gateway-config.ts` — `buildGatewayConfig(c: GBrainConfig): AIGatewayConfig`, extracted from `src/cli.ts` (which re-exports it for back-compat). Single owner of translating stored config into gateway config — consumed by CLI runtime, init (`gbrain init`'s three configureGateway sites), `init-embed-check.ts`, the eval commands (cross-modal, takes-quality), provider diagnostics, and the in-process migration path. Folds file-plane API keys (openai/anthropic/zeroentropy/openrouter) into the gateway env and threads local-server `*_BASE_URL` env vars into base_urls; caller-provided `provider_base_urls` config wins over env base URLs. `process.env` wins EXCEPT empty-string / undefined values are dropped before the merge, so an injected empty `ANTHROPIC_API_KEY=''` (Claude Code neuters subprocess LLM calls this way) can't clobber a valid config-plane key; `'0'` / `'false'` are preserved. Pinned by `test/ai/build-gateway-config.test.ts`.
 - `src/commands/doctor.ts` extension — `subagent_provider` check (layer 3 of 3). Warns when `models.tier.subagent` is explicitly set non-Anthropic (message names the bad value + paste-ready fix `gbrain config set models.tier.subagent anthropic:claude-sonnet-4-6`); also warns when `models.default` would sneak `subagent` into a non-Anthropic provider via tier inheritance. OK when subagent tier resolves to Anthropic. Tests in `test/doctor.test.ts`.
 - `src/core/skill-trigger-index.ts` — Shared loader that unions per-skill SKILL.md frontmatter `triggers:` with curated RESOLVER.md / AGENTS.md rows from `skillsDir` AND the parent dir (preserves the OpenClaw workspace-root layout). UNION semantics: explicit RESOLVER.md rows ADD to frontmatter triggers (don't replace). Dedup keyed on `(skillPath, trigger.trim().toLowerCase())`. Three consumers fold through this primitive — `checkResolvable`, `runRoutingEvalCli`, `mounts-cache.composeResolvers` — so fixing frontmatter reaches all of them. Exports `loadSkillTriggerIndex(skillsDir): SkillTriggerEntry[]`, `entriesToResolverContent(entries): string` (synthesizes a markdown-table resolver string for `runRoutingEval`'s string-content API), `findPrimaryResolverPath(skillsDir): string | null`, the `FRONTMATTER_SECTION` constant, and `_resetWarnedSkillsForTests`. Skip rules: non-directory entries, `_*`/`.*` prefixes, `conventions/`+`migrations/` subdirs, skills with no `SKILL.md` (deprecated `install/` graceful-skipped), no `triggers:` array, or malformed YAML (warn-once + skip). Reuses `parseSkillFrontmatter` from `src/core/skill-frontmatter.ts` (regex-based, not full YAML). Pinned by `test/skill-trigger-index.test.ts` (18 hermetic cases). CI gate `bun run check:resolver` (= `bun src/cli.ts check-resolvable --strict --skills-dir skills/`) wired into `bun run verify`.
 - `src/core/skill-catalog.ts` — host-repo skill catalog backing the MCP `list_skills` / `get_skill` ops. Lets a thin MCP client (Codex desktop, Claude Code, Claude Cowork, Perplexity) DISCOVER + FOLLOW the agent repo's fat-markdown skills over `gbrain serve` — a skill is prose, so "using" one = fetching its body then calling the gbrain MCP tools the server already exposes. Read-scope, NOT localOnly (defensible only via the full mitigation stack): (1) **publish gate** — `assertPublishEnabled(ctx, publishSkills)`; remote callers require `mcp.publish_skills === true`, default-OFF so an upgrade never silently grants existing read tokens host-skill read; local callers (`ctx.remote === false`) always pass. (2) **path confinement** — `assertSkillNameShape` rejects separators/`..`/null/space before any FS access; the client `name` is a manifest LOOKUP KEY (via `loadOrDeriveManifest`), never a raw path segment; `confineManifestPath` does realpath + relative-containment + `SKILL.md`-regular-file check on EVERY entry (defeats poisoned manifest.json `path`, symlink/`..` escape). (3) **frontmatter allowlist** — `GetSkillResult.frontmatter` projects a safe subset; private `writes_to` + `sources` dropped. (4) **prose-only + 256KB cap** (`MAX_SKILL_MD_BYTES`, env `GBRAIN_MAX_SKILL_MD_BYTES`), size-checked twice (statSync + UTF-8 byte length). (5) **no install_path serve for remote** — remote callers use `autoDetectSkillsDir` (no install-path tier) so a hosted gbrain with no agent repo returns `storage_error`; local callers use `autoDetectSkillsDirReadOnly`. (6) MCP rate-limiter caps call rate. Config reads honor BOTH planes: `readMcpPublishSkills` / `readMcpSkillsDir` prefer the DB plane (`engine.getConfig`) over the file plane (`ctx.config.mcp`). Tool-honesty: `crossReferenceTools(declared, ctx)` splits a skill's declared `tools:` into `usable_tools` vs `unavailable_tools`; `buildSkillCatalog`'s `instructions` envelope (`SKILL_CATALOG_INSTRUCTIONS`) carries the "these are prose, follow-then-call-tools" protocol. Skills are host-filesystem repo-global — `sourceScopeOpts(ctx)` / `ctx.brainId` deliberately do NOT apply. `buildSkillCatalog` is resilient (one malformed/escaping skill is skipped, never throws). Config keys in `src/core/config.ts`: `GBrainConfig.mcp?: { publish_skills?, skills_dir? }` + `KNOWN_CONFIG_KEYS` entries `mcp.publish_skills`/`mcp.publish_skills_prompted`/`mcp.skills_dir` + `mcp.` prefix in `KNOWN_CONFIG_KEY_PREFIXES`. `src/commands/init.ts` writes `config.mcp = { publish_skills: true, ... }` for new installs (existing config wins on re-init). `src/commands/upgrade.ts:runPostUpgrade` adds a one-time consent prompt (gated by `mcp.publish_skills_prompted`; existing installs stay OFF until owner opts in). Two ops register in `src/core/operations.ts` (`list_skills` with optional `section` filter + `cliHints:{name:'skills'}`; `get_skill` taking `name` + `cliHints:{name:'skill', positional:['name']}`) and dynamically import this module to avoid the import cycle (skill-catalog statically imports the `operations` array). Descriptions in `src/core/operations-descriptions.ts` (`LIST_SKILLS_DESCRIPTION`, `GET_SKILL_DESCRIPTION`, `SKILL_CATALOG_INSTRUCTIONS`, `SKILL_CLIENT_GUIDANCE`), pinned by `test/operations-descriptions.test.ts`. CLI: `gbrain skills` / `gbrain skill <name>`. Pinned by `test/skill-catalog.test.ts`, `test/skill-catalog-security.test.ts` (path-confinement / poisoned-manifest / symlink-escape), `test/skill-catalog-transports.test.ts` (publish-gate + remote-vs-local) over `test/fixtures/skill-catalog/`.
@@ -21,7 +21,8 @@ import { join } from 'path';
 import { tmpdir } from 'os';
 import { createHash } from 'crypto';

-import { gbrainPath, loadConfig } from '../core/config.ts';
+import { gbrainPath, loadConfig, type GBrainConfig } from '../core/config.ts';
+import { buildGatewayConfig } from '../core/ai/build-gateway-config.ts';
 import { configureGateway, isAvailable } from '../core/ai/gateway.ts';
 import { runWithLimit } from '../core/worker-pool.ts';
 import { resolveCycleDefault, cycleDefaultSuffix } from '../core/eval/cycle-default.ts';
@@ -264,32 +265,11 @@ function isTTY(): boolean {
 * Returns true on success; false (and prints a hint) when no config is found.
 */
 function configureGatewayForCli(): boolean {
+  // Route through buildGatewayConfig (the single adapter seam) so file-plane
+  // API keys, env base URLs, and provider_chat_options follow the same
+  // precedence as the runtime path. No config file is fine — env alone serves.
  const config = loadConfig();
-  if (!config) {
-    // No config file is fine for the eval command — env vars alone may serve.
-    // We still call configureGateway so gateway recipes can read the env map.
-    configureGateway({
-      embedding_model: undefined,
-      embedding_dimensions: undefined,
-      expansion_model: undefined,
-      chat_model: undefined,
-      chat_fallback_chain: undefined,
-      base_urls: undefined,
-      provider_chat_options: undefined,
-      env: { ...process.env },
-    });
-    return true;
-  }
-  configureGateway({
-    embedding_model: config.embedding_model,
-    embedding_dimensions: config.embedding_dimensions,
-    expansion_model: config.expansion_model,
-    chat_model: config.chat_model,
-    chat_fallback_chain: config.chat_fallback_chain,
-    base_urls: config.provider_base_urls,
-    provider_chat_options: config.provider_chat_options,
-    env: { ...process.env },
-  });
+  configureGateway(buildGatewayConfig(config ?? ({} as GBrainConfig)));
  return true;
 }

@@ -21,7 +21,8 @@
 */
 import type { BrainEngine } from '../core/engine.ts';
 import { configureGateway } from '../core/ai/gateway.ts';
-import { loadConfig } from '../core/config.ts';
+import { buildGatewayConfig } from '../core/ai/build-gateway-config.ts';
+import { loadConfig, type GBrainConfig } from '../core/config.ts';
 import { runEval, DEFAULT_MODEL_PANEL } from '../core/takes-quality-eval/runner.ts';
 import { resolveCycleDefault, cycleDefaultSuffix } from '../core/eval/cycle-default.ts';
 import { writeReceipt } from '../core/takes-quality-eval/receipt-write.ts';
@@ -127,8 +128,12 @@ export async function runReplayNoBrain(argv: string[]): Promise<number> {
 export async function runEvalTakesQuality(engine: BrainEngine, args: string[]): Promise<void> {
  // Self-configure the AI gateway (mirrors eval-cross-modal pattern). The
  // gateway needs config.ai_gateway + env vars; configureGateway reads both.
+  // Route through buildGatewayConfig: the old `{ ...cfg, ...process.env }`
+  // spread never populated the gateway's `env` field (the gateway NEVER reads
+  // process.env at call time), so availability checks saw no keys at all and
+  // file-plane API keys / provider base URLs were dropped.
  const cfg = loadConfig();
-  configureGateway({ ...cfg, ...(process.env as Record<string, string>) } as any);
+  configureGateway(buildGatewayConfig(cfg ?? ({} as GBrainConfig)));

  const { subcmd, argv, json } = parseSubcmd(args);

@@ -7,6 +7,7 @@ import { homedir } from 'os';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 import { saveConfig, loadConfig, loadConfigFileOnly, toEngineConfig, gbrainPath, configPath, isThinClient, effectiveEnvDatabaseUrl, type GBrainConfig } from '../core/config.ts';
+import { buildGatewayConfig } from '../core/ai/build-gateway-config.ts';
 import { createEngine } from '../core/engine-factory.ts';
 import { discoverOAuth, mintClientCredentialsToken, smokeTestMcp } from '../core/remote-mcp-probe.ts';
 import { runInitEmbedCheck } from '../core/init-embed-check.ts';
@@ -722,7 +723,8 @@ async function configureGatewayWithMergedPrecedence(
  // pollutes config.json.
  const envOverlay = loadConfig() ?? ({} as GBrainConfig);

-  const merged = {
+  const merged: GBrainConfig = {
+    ...envOverlay,
    embedding_model: aiOpts?.embedding_model ?? envOverlay.embedding_model ?? existingFile.embedding_model,
    embedding_dimensions: aiOpts?.embedding_dimensions ?? envOverlay.embedding_dimensions ?? existingFile.embedding_dimensions,
    expansion_model: aiOpts?.expansion_model ?? envOverlay.expansion_model ?? existingFile.expansion_model,
@@ -730,13 +732,9 @@ async function configureGatewayWithMergedPrecedence(
  };

  const { configureGateway, getEmbeddingModel, getEmbeddingDimensions, getExpansionModel, getChatModel } = await import('../core/ai/gateway.ts');
-  configureGateway({
-    embedding_model: merged.embedding_model,
-    embedding_dimensions: merged.embedding_dimensions,
-    expansion_model: merged.expansion_model,
-    chat_model: merged.chat_model,
-    env: { ...process.env },
-  });
+  // buildGatewayConfig (the single adapter seam) so file-plane API keys and
+  // env base URLs reach the gateway — a hand-rolled config here dropped them.
+  configureGateway(buildGatewayConfig(merged));

  // Read back resolved values — gateway applies internal defaults for unset
  // fields, so these are the values that actually shaped the schema.
@@ -831,13 +829,13 @@ async function initPGLite(opts: {
  // resolveAIOptions above: CLI flags > env vars > existing file > gateway
  // defaults.
  const { configureGateway } = await import('../core/ai/gateway.ts');
-  configureGateway({
+  configureGateway(buildGatewayConfig({
+    ...(loadConfig() ?? ({} as GBrainConfig)),
    embedding_model: resolvedModel ?? opts.aiOpts?.embedding_model,
    embedding_dimensions: resolvedDim ?? opts.aiOpts?.embedding_dimensions,
    expansion_model: opts.aiOpts?.expansion_model,
    chat_model: opts.aiOpts?.chat_model,
-    env: { ...process.env },
-  });
+  } as GBrainConfig));
  if (resolvedModel) console.log(`  Embedding: ${resolvedModel} (${resolvedDim}d)`);
  if (opts.aiOpts?.expansion_model) console.log(`  Expansion: ${opts.aiOpts.expansion_model}`);
  if (opts.aiOpts?.chat_model) console.log(`  Chat: ${opts.aiOpts.chat_model}`);
@@ -1046,13 +1044,13 @@ async function initPostgres(opts: {

  // T6: unconditional configureGateway BEFORE initSchema.
  const { configureGateway } = await import('../core/ai/gateway.ts');
-  configureGateway({
+  configureGateway(buildGatewayConfig({
+    ...(loadConfig() ?? ({} as GBrainConfig)),
    embedding_model: resolvedModel ?? opts.aiOpts?.embedding_model,
    embedding_dimensions: resolvedDim ?? opts.aiOpts?.embedding_dimensions,
    expansion_model: opts.aiOpts?.expansion_model,
    chat_model: opts.aiOpts?.chat_model,
-    env: { ...process.env },
-  });
+  } as GBrainConfig));
  if (resolvedModel) console.log(`  Embedding: ${resolvedModel} (${resolvedDim}d)`);
  if (opts.aiOpts?.expansion_model) console.log(`  Expansion: ${opts.aiOpts.expansion_model}`);
  if (opts.aiOpts?.chat_model) console.log(`  Chat: ${opts.aiOpts.chat_model}`);
@@ -66,15 +66,11 @@ export async function runMigrateOnlyCore(opts?: { timeoutMs?: number }): Promise

  // configureGateway BEFORE initSchema (init.ts B.3): a schema bump on a brain
  // whose file config is missing embedding fields must not fall through to
-  // stale hardcoded fallbacks. loadConfig already merged env; propagate it.
+  // stale hardcoded fallbacks. Route through buildGatewayConfig so file-plane
+  // API keys and provider base URLs follow the same precedence as runtime.
  const { configureGateway } = await import('../../core/ai/gateway.ts');
-  configureGateway({
-    embedding_model: config.embedding_model,
-    embedding_dimensions: config.embedding_dimensions,
-    expansion_model: config.expansion_model,
-    chat_model: config.chat_model,
-    env: { ...process.env },
-  });
+  const { buildGatewayConfig } = await import('../../core/ai/build-gateway-config.ts');
+  configureGateway(buildGatewayConfig(config));

  const timeoutMs = opts?.timeoutMs ?? MIGRATE_ONLY_TIMEOUT_MS;
  const engine = await createEngine(toEngineConfig(config));
@@ -50,10 +50,6 @@ const PER_TASK_KEYS: Array<{ key: string; tier: ModelTier; description: string }
  { key: 'models.eval.contradictions_judge', tier: 'utility',  description: 'Contradiction probe judge (v0.34 temporal-aware)' },
  { key: 'models.expansion',                tier: 'utility',   description: 'Query expansion for hybrid search' },
  { key: 'models.chat',                     tier: 'reasoning', description: 'Default `gateway.chat()` model' },
-  { key: 'models.propose_takes',            tier: 'reasoning', description: 'propose_takes claim extractor' },
-  { key: 'models.grade_takes',              tier: 'reasoning', description: 'grade_takes verdict judge' },
-  { key: 'models.calibration_profile',      tier: 'reasoning', description: 'Calibration profile generator' },
-  { key: 'models.brainstorm',               tier: 'reasoning', description: '`gbrain brainstorm` orchestrator' },
 ];

 interface ModelEntry {
@@ -12,8 +12,8 @@ import { parseModelId } from './ai/model-resolver.ts';
 * `resolveKey` closure without re-parsing recipes.
 *
 * Only OPENAI_API_KEY and ZEROENTROPY_API_KEY appear here because those are the
- * only embedding keys `buildGatewayConfig` (src/cli.ts) folds from config into
- * the gateway env. VOYAGE_API_KEY / GOOGLE_GENERATIVE_AI_API_KEY are deliberately
+ * only embedding keys `buildGatewayConfig` (src/core/ai/build-gateway-config.ts)
+ * folds from config into the gateway env. VOYAGE_API_KEY / GOOGLE_GENERATIVE_AI_API_KEY are deliberately
 * absent: their config fields are NOT threaded to the gateway today, so the
 * producer closures fall through to checking `process.env` ONLY for them. That
 * matches what the gateway can actually use (the recipes read those keys from
@@ -61,10 +61,7 @@ export const MAX_OUTPUT_TOKENS_CEIL = 32_000;
 * (with a readable error) instead of the provider's opaque HTTP 400.
 */
 export const ANTHROPIC_OUTPUT_CAPS: Record<string, number> = {
-  'claude-fable-5': 64_000,
-  'claude-opus-4-8': 32_000,
  'claude-opus-4-7': 32_000,
-  'claude-sonnet-5': 64_000,
  'claude-sonnet-4-6': 64_000,
  'claude-haiku-4-5': 64_000,
  'claude-haiku-4-5-20251001': 64_000,
@@ -32,7 +32,6 @@
 */

 import type { BrainEngine } from '../engine.ts';
-import { resolveModel } from '../model-config.ts';
 import { chat as defaultChat, embedQuery, type ChatResult, type ChatOpts } from '../ai/gateway.ts';
 import { hybridSearch, hybridSearchCached } from '../search/hybrid.ts';
 import { fetchFar, type CloseRef, type FarPage } from './domain-bank.ts';
@@ -539,14 +538,7 @@ async function _runBrainstormInner(
  const embedFn = opts.embedQueryFn ?? embedQuery;

  // ---- Phase 0: cost preview + TTY grace ----
-  // Tier-resolved (mirrors the cycle phases): honors models.brainstorm >
-  // models.default > models.tier.reasoning; the fallback keeps stock
-  // behavior identical (reasoning tier default IS claude-sonnet-4-6).
-  const modelStr = opts.modelOverride ?? await resolveModel(engine, {
-    configKey: 'models.brainstorm',
-    tier: 'reasoning',
-    fallback: 'anthropic:claude-sonnet-4-6',
-  });
+  const modelStr = opts.modelOverride ?? 'anthropic:claude-sonnet-4-6';
  const { aborted, estimate } = await previewCostAndWait({
    profile,
    model: modelStr,
@@ -26,8 +26,8 @@
 */

 import { BaseCyclePhase, type ScopedReadOpts, type BasePhaseOpts } from './base-phase.ts';
-import { chat as gatewayChat, getChatModel } from '../ai/gateway.ts';
-import { resolveModel } from '../model-config.ts';
+import { chat as gatewayChat } from '../ai/gateway.ts';
+import { TIER_DEFAULTS } from '../model-config.ts';
 import { gateVoice, type VoiceGateGenerator, type VoiceGateJudge } from '../calibration/voice-gate.ts';
 import { patternStatementTemplate, type PatternStatementSlots } from '../calibration/templates.ts';
 // v0.41 T10 — domain widening. The aggregator module resolves the active
@@ -229,16 +229,7 @@ class CalibrationProfilePhase extends BaseCyclePhase {
  ): Promise<{ summary: string; details: Record<string, unknown>; status?: PhaseStatus }> {
    const holder = opts.holder ?? 'garry';
    const promptVersion = opts.promptVersion ?? CALIBRATION_PROFILE_PROMPT_VERSION;
-    // Resolved once (see propose-takes.ts for the chain): models.calibration_profile
-    // > models.default > env > the gateway's chat model (itself resolved
-    // through models.chat + the reasoning tier). Provider-prefixed per #2451
-    // — a bare id would make gateway.chat() throw "missing a provider
-    // prefix". Drives the generator's chat call, the budget label, and the
-    // persisted model_id, so the three can never disagree.
-    const modelId = opts.model ?? await resolveModel(engine, {
-      configKey: 'models.calibration_profile',
-      fallback: getChatModel(),
-    });
+    const modelId = opts.model ?? TIER_DEFAULTS.reasoning;
    const gradeCompletion = opts.gradeCompletion ?? 1.0;
    const patternsGenerator = opts.patternsGenerator ?? defaultPatternsGenerator;
    const biasTagsGenerator = opts.biasTagsGenerator ?? defaultBiasTagsGenerator;
@@ -274,7 +265,6 @@ class CalibrationProfilePhase extends BaseCyclePhase {
        scorecard,
        holder,
        attempt,
-        modelHint: modelId,
        ...(feedback !== undefined ? { feedback } : {}),
      });
      return lines.join('\n');
@@ -36,9 +36,7 @@

 import { createHash } from 'node:crypto';
 import { BaseCyclePhase, type ScopedReadOpts, type BasePhaseOpts } from './base-phase.ts';
-import { chat as gatewayChat, getChatModel } from '../ai/gateway.ts';
-import { resolveModel } from '../model-config.ts';
-import { splitProviderModelId } from '../model-id.ts';
+import { chat as gatewayChat } from '../ai/gateway.ts';
 import { GBrainError } from '../types.ts';
 import type { OperationContext } from '../operations.ts';
 import type { BrainEngine, Take, TakeResolution } from '../engine.ts';
@@ -397,24 +395,7 @@ class GradeTakesPhase extends BaseCyclePhase {
    const autoResolve = opts.autoResolve ?? false; // D17 default OFF
    const autoResolveThreshold = opts.autoResolveThreshold ?? 0.95; // D12 conservative
    const resolvedByLabel = opts.resolvedByLabel ?? 'gbrain:grade_takes';
-    // Resolve the judge model ONCE (see propose-takes.ts for the chain —
-    // same label-vs-actual split fixed here: the judge call rode the
-    // gateway's chat_model while the grade cache key, evidence signature,
-    // and budget label recorded a hardcoded 4.6).
-    // NOTE: changing the resolved judge model invalidates the grade cache
-    // (judge_model_id is part of its key) — a one-time, budget-capped
-    // re-grade wave that is CORRECT, since the actual judge did change.
-    const judgeModelFull = opts.model ?? await resolveModel(engine, {
-      configKey: 'models.grade_takes',
-      fallback: getChatModel(),
-    });
-    // Bare tail for cache keys / evidence signatures / stored ids — the
-    // grade cache has always been keyed on bare ids; the gateway default
-    // resolves provider-prefixed, and normalizing preserves cache continuity
-    // on stock installs (no spurious re-judge wave from a prefix change). A
-    // genuinely different configured judge still invalidates, which is
-    // correct. The FULL string drives the actual judge call.
-    const judgeModelId = splitProviderModelId(judgeModelFull).model || judgeModelFull;
+    const judgeModelId = opts.model ?? 'claude-sonnet-4-6';

    const useEnsemble = opts.useEnsemble ?? false;
    const ensembleThreshold = opts.ensembleThreshold ?? 0.85;
@@ -487,7 +468,7 @@ class GradeTakesPhase extends BaseCyclePhase {
      // Call the single-model judge. Errors on a single take log warning + continue.
      let verdict: JudgeVerdict;
      try {
-        verdict = await judge({ take, evidence, modelHint: judgeModelFull });
+        verdict = await judge({ take, evidence, modelHint: opts.model });
      } catch (err) {
        const msg = err instanceof Error ? err.message : String(err);
        result.warnings.push(`judge failed on take ${take.id}: ${msg}`);
@@ -5,16 +5,11 @@
 * a tuned LLM extractor, writes the extracted gradeable claims to the
 * `take_proposals` queue. User accepts/rejects via `gbrain takes propose`.
 *
- * Idempotency contract (D17 schema spec; per-claim rows since migration v125):
- *   Every scan of a (source_id, page_slug, content_hash, prompt_version)
- *   tuple leaves at least one row — one per extracted claim, or a single
- *   status='empty' sentinel when extraction yields nothing — so an unchanged
- *   page never re-spends LLM tokens. Pre-v125 only proposal rows were
- *   written: a zero-claim page never entered the cache and was re-extracted
- *   on EVERY cycle (observed live: ~60 such pages × every cycle ≈ 1,400
- *   wasted extractor calls / ~$15 per day — ~90% of total autopilot spend).
- *   Bumping PROPOSE_TAKES_PROMPT_VERSION cleanly invalidates the cache so a
- *   tuned prompt re-runs proposals on every page.
+ * Idempotency contract (D17 schema spec):
+ *   The unique index on (source_id, page_slug, content_hash, prompt_version)
+ *   means an unchanged page never re-spends LLM tokens. Bumping
+ *   PROPOSE_TAKES_PROMPT_VERSION cleanly invalidates the cache so a tuned
+ *   prompt re-runs proposals on every page.
 *
 * F2 fence dedup:
 *   The phase reads the page's existing `<!-- gbrain:takes:begin -->` fence
@@ -45,7 +40,6 @@
 import { randomUUID, createHash } from 'node:crypto';
 import { BaseCyclePhase, type ScopedReadOpts, type BasePhaseOpts } from './base-phase.ts';
 import { chat as gatewayChat, getChatModel } from '../ai/gateway.ts';
-import { resolveModel } from '../model-config.ts';
 import { writeReceipt } from '../extract/receipt-writer.ts';
 import { upsertExtractRollup } from '../extract/rollup-writer.ts';
 import { GBrainError } from '../types.ts';
@@ -313,18 +307,6 @@ class ProposeTakesPhase extends BaseCyclePhase {
    const promptVersion = opts.promptVersion ?? PROPOSE_TAKES_PROMPT_VERSION;
    const pageLimit = opts.pageLimit ?? 100;
    const skipPagesWithFence = opts.skipPagesWithFence ?? false;
-    // Resolve the extractor model ONCE: models.propose_takes >
-    // models.default > GBRAIN_MODEL env > the gateway's chat model (which
-    // reconfigureGatewayWithEngine already resolved through models.chat +
-    // the reasoning tier). One resolved provider-prefixed string drives the
-    // actual chat call, the budget estimate, AND the stored model_id — so
-    // the recorded model can never disagree with the model that ran (#2451
-    // convention: stored ids are provider-prefixed, nested prefixes like
-    // openrouter:anthropic/... stay intact).
-    const extractorModelId = opts.model ?? await resolveModel(engine, {
-      configKey: 'models.propose_takes',
-      fallback: getChatModel(),
-    });
    const proposalRunId = `propose-${new Date().toISOString().slice(0, 19).replace(/[-:T]/g, '')}-${randomUUID().slice(0, 8)}`;

    const result: ProposeTakesResult = {
@@ -348,6 +330,8 @@ class ProposeTakesPhase extends BaseCyclePhase {
      opts.reporter.start('propose_takes.pages' as never, pages.length);
    }

+    const modelId = opts.model ?? getChatModel();
+
    for (const page of pages) {
      result.pages_scanned += 1;
      this.tick(opts);
@@ -377,7 +361,7 @@ class ProposeTakesPhase extends BaseCyclePhase {

      // Budget pre-check before the LLM call. Estimate: ~1500 input tokens + 500 output.
      const budget = this.checkBudget({
-        modelId: extractorModelId,
+        modelId,
        estimatedInputTokens: 1500,
        maxOutputTokens: 500,
      });
@@ -396,7 +380,7 @@ class ProposeTakesPhase extends BaseCyclePhase {
          pagePath: page.slug,
          pageBody: body,
          existingTakes,
-          modelHint: extractorModelId,
+          modelHint: opts.model,
        });
      } catch (err) {
        const msg = err instanceof Error ? err.message : String(err);
@@ -404,42 +388,16 @@ class ProposeTakesPhase extends BaseCyclePhase {
        continue;
      }

-      // Zero-claim scans MUST still enter the idempotency cache. Pre-v125
-      // only proposal rows were written, so a page whose extraction yielded
-      // no gradeable claims never got a row for its (page, content_hash) —
-      // the cache check above missed on every subsequent cycle and the LLM
-      // call was re-spent on the same unchanged page, forever. The sentinel
-      // row (status='empty', empty claim_text) is invisible to the review
-      // queue (pending_idx is partial on status='pending'); it exists only
-      // so the cache check hits.
-      if (proposals.length === 0) {
-        await engine.executeRaw(
-          `INSERT INTO take_proposals
-             (source_id, page_slug, content_hash, prompt_version, proposal_run_id,
-              status, claim_text, kind, holder, weight, domain, dedup_against_fence_rows, model_id)
-           VALUES ($1, $2, $3, $4, $5, 'empty', '', 'none', 'brain', 0, NULL, NULL, $6)
-           ON CONFLICT (source_id, page_slug, content_hash, prompt_version, md5(claim_text)) DO NOTHING`,
-          [sourceId, page.slug, ch, promptVersion, proposalRunId, extractorModelId],
-        );
-        continue;
-      }
-
-      // Write proposals to take_proposals, one row per claim. The v125
-      // idempotency index includes md5(claim_text), so a same-page
-      // multi-claim run keeps EVERY claim — the pre-v125 four-column unique
-      // index made claims 2..N conflict with claim 1 and ON CONFLICT DO
-      // NOTHING silently dropped them (the review queue only ever saw the
-      // first claim of each page version). RETURNING id keeps
-      // proposals_inserted honest: it counts rows that actually landed,
-      // not insert attempts.
+      // Write proposals to take_proposals. Each row is a separate INSERT
+      // because the composite idempotency key is on the per-page tuple — a
+      // bulk UPSERT would collapse a same-page-multi-claim run into one row.
      for (const p of proposals) {
-        const landed = await engine.executeRaw<{ id: number }>(
+        await engine.executeRaw(
          `INSERT INTO take_proposals
             (source_id, page_slug, content_hash, prompt_version, proposal_run_id,
              claim_text, kind, holder, weight, domain, dedup_against_fence_rows, model_id)
           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
-           ON CONFLICT (source_id, page_slug, content_hash, prompt_version, md5(claim_text)) DO NOTHING
-           RETURNING id`,
+           ON CONFLICT (source_id, page_slug, content_hash, prompt_version) DO NOTHING`,
          [
            sourceId,
            page.slug,
@@ -452,10 +410,10 @@ class ProposeTakesPhase extends BaseCyclePhase {
            p.weight,
            p.domain ?? null,
            JSON.stringify(existingTakes),
-            extractorModelId,
+            modelId,
          ],
        );
-        if (landed.length > 0) result.proposals_inserted += 1;
+        result.proposals_inserted += 1;
      }
    }

@@ -58,11 +58,8 @@ const SUMMARY_SLUG_RE = /^[a-z0-9][a-z0-9\-]*(\/[a-z0-9][a-z0-9\-]*)*$/;
 * resolver returns for known Anthropic aliases.
 */
 const MODEL_CONTEXT_TOKENS: Record<string, number> = {
-  'claude-fable-5': 1_000_000,
-  'claude-opus-4-8': 1_000_000,
  'claude-opus-4-7': 1_000_000,
  'claude-opus-4-6': 1_000_000,
-  'claude-sonnet-5': 1_000_000,
  'claude-sonnet-4-6': 200_000,
  'claude-sonnet-4-5': 200_000,
  'claude-haiku-4-5-20251001': 200_000,
@@ -5671,41 +5671,6 @@ export const MIGRATIONS: Migration[] = [
 `);
    },
  },
-  {
-    version: 125,
-    name: 'take_proposals_empty_scan_sentinels_and_per_claim_rows',
-    // v0.42.x — kill the propose_takes rescan loop + stop dropping claims.
-    //
-    // Two defects, one schema touch:
-    //   1. Zero-claim scans never entered the idempotency cache (only
-    //      proposal rows were written), so pages whose extraction yielded
-    //      nothing were re-extracted on EVERY cycle. Observed live: ~60
-    //      such pages per run ≈ 1,400 wasted extractor calls / ~$15 per
-    //      day — ~90% of total autopilot LLM spend. Fix: the phase now
-    //      writes a status='empty' sentinel row per zero-claim scan; the
-    //      status CHECK gains the 'empty' value. Sentinels are excluded
-    //      from the partial pending index, so the review queue never sees
-    //      them.
-    //   2. The 4-column unique index collapsed a same-page multi-claim run
-    //      to its FIRST claim: rows 2..N conflicted and ON CONFLICT DO
-    //      NOTHING silently dropped them (verified live: exactly one row
-    //      per (page, hash) across 3 days of runs). Fix: the idempotency
-    //      index gains md5(claim_text) — per-claim rows, while the
-    //      4-column prefix still serves the per-scan cache lookup.
-    //
-    // Existing data is index-safe by construction: the old index guaranteed
-    // at most one row per 4-tuple, so the widened index has no duplicates
-    // to trip on. The DROP+ADD CONSTRAINT pair is idempotent as a unit.
-    idempotent: true,
-    sql: `
-      ALTER TABLE take_proposals DROP CONSTRAINT IF EXISTS take_proposals_status_check;
-      ALTER TABLE take_proposals ADD CONSTRAINT take_proposals_status_check
-        CHECK (status IN ('pending','accepted','rejected','superseded','empty'));
-      DROP INDEX IF EXISTS take_proposals_idempotency_idx;
-      CREATE UNIQUE INDEX IF NOT EXISTS take_proposals_idempotency_idx
-        ON take_proposals (source_id, page_slug, content_hash, prompt_version, md5(claim_text));
-    `,
-  },
 ];

 export const LATEST_VERSION = MIGRATIONS.length > 0
@@ -762,7 +762,7 @@ CREATE TABLE IF NOT EXISTS take_proposals (
  proposed_at                 TIMESTAMPTZ  NOT NULL DEFAULT now(),
  proposal_run_id             TEXT         NOT NULL,
  status                      TEXT         NOT NULL DEFAULT 'pending'
-                                           CHECK (status IN ('pending','accepted','rejected','superseded','empty')),
+                                           CHECK (status IN ('pending','accepted','rejected','superseded')),
  claim_text                  TEXT         NOT NULL,
  kind                        TEXT         NOT NULL,
  holder                      TEXT         NOT NULL,
@@ -777,7 +777,7 @@ CREATE TABLE IF NOT EXISTS take_proposals (
  predicted_brier_bucket_n    INTEGER
 );
 CREATE UNIQUE INDEX IF NOT EXISTS take_proposals_idempotency_idx
-  ON take_proposals (source_id, page_slug, content_hash, prompt_version, md5(claim_text));
+  ON take_proposals (source_id, page_slug, content_hash, prompt_version);
 CREATE INDEX IF NOT EXISTS take_proposals_pending_idx
  ON take_proposals (source_id, status, proposed_at DESC)
  WHERE status = 'pending';
@@ -1274,14 +1274,8 @@ CREATE INDEX IF NOT EXISTS calibration_profiles_published_idx
  WHERE published = true;

 -- take_proposals: propose_takes phase queue. Idempotency cache via the
-- composite unique index (source_id, page_slug, content_hash, prompt_version,
-- md5(claim_text)) — the 4-column prefix is the per-scan cache key (mirrors
-- v0.23 dream_verdicts); md5(claim_text) makes rows per-claim so multi-claim
-- pages keep every claim (v125). status='empty' rows are zero-claim scan
-- sentinels: they hold the cache slot for a page version whose extraction
-- yielded nothing — the phase never re-spends the LLM call on that page
-- version. Excluded from the partial pending index. proposal_run_id supports
-- --rollback by run.
+-- composite unique index (source_id, page_slug, content_hash, prompt_version)
+-- mirrors v0.23 dream_verdicts. proposal_run_id supports --rollback by run.
 CREATE TABLE IF NOT EXISTS take_proposals (
  id                          BIGSERIAL PRIMARY KEY,
  source_id                   TEXT         NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
@@ -1292,7 +1286,7 @@ CREATE TABLE IF NOT EXISTS take_proposals (
  proposed_at                 TIMESTAMPTZ  NOT NULL DEFAULT now(),
  proposal_run_id             TEXT         NOT NULL,
  status                      TEXT         NOT NULL DEFAULT 'pending'
-                                           CHECK (status IN ('pending','accepted','rejected','superseded','empty')),
+                                           CHECK (status IN ('pending','accepted','rejected','superseded')),
  claim_text                  TEXT         NOT NULL,
  kind                        TEXT         NOT NULL,
  holder                      TEXT         NOT NULL,
@@ -1307,7 +1301,7 @@ CREATE TABLE IF NOT EXISTS take_proposals (
  predicted_brier_bucket_n    INTEGER
 );
 CREATE UNIQUE INDEX IF NOT EXISTS take_proposals_idempotency_idx
-  ON take_proposals (source_id, page_slug, content_hash, prompt_version, md5(claim_text));
+  ON take_proposals (source_id, page_slug, content_hash, prompt_version);
 CREATE INDEX IF NOT EXISTS take_proposals_pending_idx
  ON take_proposals (source_id, status, proposed_at DESC)
  WHERE status = 'pending';
@@ -1270,14 +1270,8 @@ CREATE INDEX IF NOT EXISTS calibration_profiles_published_idx
  WHERE published = true;

 -- take_proposals: propose_takes phase queue. Idempotency cache via the
-- composite unique index (source_id, page_slug, content_hash, prompt_version,
-- md5(claim_text)) — the 4-column prefix is the per-scan cache key (mirrors
-- v0.23 dream_verdicts); md5(claim_text) makes rows per-claim so multi-claim
-- pages keep every claim (v125). status='empty' rows are zero-claim scan
-- sentinels: they hold the cache slot for a page version whose extraction
-- yielded nothing — the phase never re-spends the LLM call on that page
-- version. Excluded from the partial pending index. proposal_run_id supports
-- --rollback by run.
+-- composite unique index (source_id, page_slug, content_hash, prompt_version)
+-- mirrors v0.23 dream_verdicts. proposal_run_id supports --rollback by run.
 CREATE TABLE IF NOT EXISTS take_proposals (
  id                          BIGSERIAL PRIMARY KEY,
  source_id                   TEXT         NOT NULL REFERENCES sources(id) ON DELETE CASCADE,
@@ -1288,7 +1282,7 @@ CREATE TABLE IF NOT EXISTS take_proposals (
  proposed_at                 TIMESTAMPTZ  NOT NULL DEFAULT now(),
  proposal_run_id             TEXT         NOT NULL,
  status                      TEXT         NOT NULL DEFAULT 'pending'
-                                           CHECK (status IN ('pending','accepted','rejected','superseded','empty')),
+                                           CHECK (status IN ('pending','accepted','rejected','superseded')),
  claim_text                  TEXT         NOT NULL,
  kind                        TEXT         NOT NULL,
  holder                      TEXT         NOT NULL,
@@ -1303,7 +1297,7 @@ CREATE TABLE IF NOT EXISTS take_proposals (
  predicted_brier_bucket_n    INTEGER
 );
 CREATE UNIQUE INDEX IF NOT EXISTS take_proposals_idempotency_idx
-  ON take_proposals (source_id, page_slug, content_hash, prompt_version, md5(claim_text));
+  ON take_proposals (source_id, page_slug, content_hash, prompt_version);
 CREATE INDEX IF NOT EXISTS take_proposals_pending_idx
  ON take_proposals (source_id, status, proposed_at DESC)
  WHERE status = 'pending';
@@ -25,6 +25,7 @@ import { withEnv } from '../helpers/with-env.ts';

 const PASSTHROUGHS: Array<{ envVar: string; recipeId: string }> = [
  { envVar: 'LLAMA_SERVER_BASE_URL', recipeId: 'llama-server' },
+  { envVar: 'LLAMA_SERVER_RERANKER_BASE_URL', recipeId: 'llama-server-reranker' },
  { envVar: 'OLLAMA_BASE_URL', recipeId: 'ollama' },
  { envVar: 'LMSTUDIO_BASE_URL', recipeId: 'lmstudio' },
  { envVar: 'LITELLM_BASE_URL', recipeId: 'litellm' },
@@ -38,7 +38,6 @@ function buildMockEngine(opts: { scorecard: TakesScorecard }): {
 } {
  const captured: CapturedSql[] = [];
  const engine = {
-    async getConfig() { return null; },
    kind: 'pglite',
    async getScorecard() {
      return opts.scorecard;
@@ -11,32 +11,13 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'bun:test';
 import { PGLiteEngine } from '../src/core/pglite-engine.ts';
 import { loadConfigWithEngine, type GBrainConfig } from '../src/core/config.ts';
+import { buildGatewayConfig } from '../src/core/ai/build-gateway-config.ts';
 import {
  configureGateway,
  getEmbeddingModel,
  getMultimodalModel,
  resetGateway,
 } from '../src/core/ai/gateway.ts';
-import type { AIGatewayConfig } from '../src/core/ai/types.ts';
-
-// Mirror the cli.ts buildGatewayConfig helper exactly. Keeping a copy here
-// (instead of exporting from cli.ts) is intentional: the test asserts the
-// shape of the contract, not the helper's identity. If cli.ts drifts, the
-// e2e behavior these tests care about (DB-set value lands in gateway) still
-// holds, but a helper-shape test would also catch the drift in PR review.
-function buildGatewayConfig(c: GBrainConfig): AIGatewayConfig {
-  return {
-    embedding_model: c.embedding_model,
-    embedding_dimensions: c.embedding_dimensions,
-    embedding_multimodal_model: c.embedding_multimodal_model,
-    expansion_model: c.expansion_model,
-    chat_model: c.chat_model,
-    chat_fallback_chain: c.chat_fallback_chain,
-    base_urls: c.provider_base_urls,
-    provider_chat_options: c.provider_chat_options,
-    env: { ...process.env },
-  };
-}

 let engine: PGLiteEngine;

@@ -47,6 +28,7 @@ beforeAll(async () => {
 });

 afterAll(async () => {
+  resetGateway(); // don't leak this file's gateway config into shard siblings
  await engine.disconnect();
 });

@@ -0,0 +1,57 @@
+/**
+ * eval-takes-quality gateway self-config — adapter-boundary regression
+ * (takeover of PR #2430).
+ *
+ * The old callsite spread `{ ...cfg, ...process.env }` straight into
+ * configureGateway. The gateway NEVER reads process.env at call time — it
+ * reads `_config.env` — and that spread never populated an `env` field at
+ * all, so every availability/diagnose check dereferenced `undefined.env[k]`
+ * and file-plane API keys (config.json `openai_api_key` etc.) were dropped.
+ * Routing through buildGatewayConfig fixes both. This test fails (throws)
+ * on the old code path.
+ */
+import { afterAll, describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runEvalTakesQuality } from '../src/commands/eval-takes-quality.ts';
+import { isAvailable, resetGateway } from '../src/core/ai/gateway.ts';
+import { withEnv } from './helpers/with-env.ts';
+import type { BrainEngine } from '../src/core/engine.ts';
+
+afterAll(() => {
+  resetGateway();
+});
+
+describe('runEvalTakesQuality — gateway self-config routes through buildGatewayConfig', () => {
+  test('file-plane openai_api_key reaches the gateway env (help path, engine untouched)', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'gbrain-etq-gw-'));
+    try {
+      mkdirSync(join(home, '.gbrain'), { recursive: true });
+      writeFileSync(
+        join(home, '.gbrain', 'config.json'),
+        JSON.stringify({
+          engine: 'pglite',
+          database_path: join(home, '.gbrain', 'brain'),
+          openai_api_key: 'sk-file-plane-test',
+        }),
+      );
+      await withEnv(
+        {
+          GBRAIN_HOME: home,
+          OPENAI_API_KEY: undefined,
+          DATABASE_URL: undefined,
+          GBRAIN_DATABASE_URL: undefined,
+        },
+        async () => {
+          // 'help' returns before touching the engine, but the gateway is
+          // configured first — exactly the seam under test.
+          await runEvalTakesQuality({} as BrainEngine, ['--help']);
+          expect(isAvailable('embedding', 'openai:text-embedding-3-small')).toBe(true);
+        },
+      );
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+});
@@ -47,7 +47,6 @@ function buildMockEngine(opts: { takes: Take[] }): {
  const captured: CapturedSql[] = [];
  const resolves: CapturedResolve[] = [];
  const engine = {
-    async getConfig() { return null; },
    kind: 'pglite',
    async listTakes() {
      return opts.takes;
@@ -46,14 +46,12 @@ interface CapturedResolve {
 function buildMockEngine(opts: {
  takes: Take[];
  cachedGrades?: Set<string>; // composite-key strings already in take_grade_cache
-  config?: Record<string, string>; // engine.getConfig plane (models.grade_takes etc.)
 }): { engine: BrainEngine; captured: CapturedSql[]; resolves: CapturedResolve[] } {
  const captured: CapturedSql[] = [];
  const resolves: CapturedResolve[] = [];
  const cached = opts.cachedGrades ?? new Set<string>();

  const engine = {
-    async getConfig(key: string) { return opts.config?.[key] ?? null; },
    kind: 'pglite',
    async listTakes() {
      return opts.takes;
@@ -226,28 +224,6 @@ describe('runPhaseGradeTakes — phase integration', () => {
    expect(resolves).toHaveLength(0); // no canonical mutation
  });

-  test('models.grade_takes config drives the judge call; cache key stays bare-tailed', async () => {
-    // Pre-fix the judge call rode the gateway's chat_model while the cache
-    // key / budget label recorded a hardcoded 'claude-sonnet-4-6'. The phase
-    // now resolves models.grade_takes; the judge gets the FULL string and
-    // the cache row keys on the bare tail (continuity with historical rows).
-    const takes = [buildTake({ id: 1, sinceDate: '2023-01-01' })];
-    const { engine, captured } = buildMockEngine({
-      takes,
-      config: { 'models.grade_takes': 'anthropic:claude-sonnet-5' },
-    });
-    const hints: Array<string | undefined> = [];
-    const judge: JudgeFn = async ({ modelHint }) => {
-      hints.push(modelHint);
-      return { verdict: 'correct', confidence: 0.9, reasoning: 'held' };
-    };
-    const result = await runPhaseGradeTakes(buildCtx(engine), { judge });
-    expect(result.status).toBe('ok');
-    expect(hints).toEqual(['anthropic:claude-sonnet-5']); // actual call gets the FULL string
-    const inserts = captured.filter(c => c.sql.includes('INSERT INTO take_grade_cache'));
-    expect(inserts[0]!.params[2]).toBe('claude-sonnet-5'); // judge_model_id is the bare tail
-  });
-
  test('D17: auto-resolve OFF by default — even high-confidence verdict does NOT mutate takes', async () => {
    const takes = [buildTake({ id: 1, sinceDate: '2023-01-01' })];
    const { engine, resolves } = buildMockEngine({ takes });
@@ -1,160 +0,0 @@
-/**
- * propose_takes rescan-loop + dropped-claims regression tests (migration v125).
- *
- * Two live-observed defects, both fixed by the v125 schema + phase change:
- *
- *   1. RESCAN LOOP — a page whose extraction yielded zero claims never
- *      entered the idempotency cache (only proposal rows were written), so
- *      every cycle re-spent the extractor call on the same unchanged page.
- *      Live impact: ~60 such pages × every cycle ≈ 1,400 wasted LLM calls
- *      (~$15) per day — ~90% of total autopilot spend. Fix: status='empty'
- *      sentinel row per zero-claim scan.
- *
- *   2. DROPPED CLAIMS — the 4-column unique index collapsed a same-page
- *      multi-claim run to its first claim (rows 2..N conflicted, ON CONFLICT
- *      DO NOTHING dropped them silently; verified live: exactly 1 row per
- *      (page, hash) over 3 days). Fix: idempotency index gains
- *      md5(claim_text).
- *
- * Hermetic: PGLite engine + injected extractor; no gateway, no LLM.
- */
-import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
-import { PGLiteEngine } from '../src/core/pglite-engine.ts';
-import { runPhaseProposeTakes, type ProposeTakesExtractor, type ProposedTake } from '../src/core/cycle/propose-takes.ts';
-import type { OperationContext } from '../src/core/operations.ts';
-
-let engine: PGLiteEngine;
-
-function ctx(): OperationContext {
-  return {
-    engine,
-    remote: false,
-    config: {} as OperationContext['config'],
-    logger: { info() {}, warn() {}, error() {}, debug() {} } as unknown as OperationContext['logger'],
-  } as unknown as OperationContext;
-}
-
-/** Extractor stub that counts invocations per page slug. */
-function countingExtractor(
-  claimsBySlug: Record<string, ProposedTake[]>,
-): { extractor: ProposeTakesExtractor; calls: string[] } {
-  const calls: string[] = [];
-  const extractor: ProposeTakesExtractor = async ({ pagePath }) => {
-    calls.push(pagePath);
-    return claimsBySlug[pagePath] ?? [];
-  };
-  return { extractor, calls };
-}
-
-beforeAll(async () => {
-  engine = new PGLiteEngine();
-  await engine.connect({});
-  await engine.initSchema();
-  await engine.putPage('notes/zero-claims', {
-    type: 'note',
-    title: 'pure narrative',
-    compiled_truth: 'A quiet walk in the park. Nothing opinionated happened at all today.',
-  });
-  await engine.putPage('notes/three-claims', {
-    type: 'note',
-    title: 'opinionated',
-    compiled_truth: 'I bet acme-example wins the market. widget-co will struggle. fund-a is overexposed.',
-  });
-});
-
-afterAll(async () => {
-  await engine.disconnect();
-});
-
-describe('rescan loop — zero-claim scans enter the cache', () => {
-  test('second run cache-hits: extractor is NOT called again on unchanged pages', async () => {
-    const claims = {
-      'notes/three-claims': [
-        { claim_text: 'acme-example wins the market', kind: 'bet' as const, holder: 'brain', weight: 0.7 },
-        { claim_text: 'widget-co will struggle', kind: 'take' as const, holder: 'brain', weight: 0.6 },
-        { claim_text: 'fund-a is overexposed', kind: 'take' as const, holder: 'brain', weight: 0.55 },
-      ],
-    };
-
-    const first = countingExtractor(claims);
-    const r1 = await runPhaseProposeTakes(ctx(), { extractor: first.extractor });
-    expect(r1.status).toBe('ok');
-    // Both pages extracted on the first pass.
-    expect(first.calls).toContain('notes/zero-claims');
-    expect(first.calls).toContain('notes/three-claims');
-
-    const second = countingExtractor(claims);
-    const r2 = await runPhaseProposeTakes(ctx(), { extractor: second.extractor });
-    expect(r2.status).toBe('ok');
-    // THE regression: pre-fix the zero-claim page missed the cache every
-    // run and was re-extracted here. (Run 1's receipt page legitimately
-    // appears once — it's a new page — and its zero-claim scan now caches
-    // too; pre-fix, receipts re-scanned forever as well.)
-    expect(second.calls).not.toContain('notes/zero-claims');
-    expect(second.calls).not.toContain('notes/three-claims');
-
-    // Run 2 inserted nothing, so no new receipt page exists: run 3 must be
-    // fully quiescent — zero extractor calls, zero cache misses.
-    const third = countingExtractor(claims);
-    const r3 = await runPhaseProposeTakes(ctx(), { extractor: third.extractor });
-    expect(r3.status).toBe('ok');
-    expect(third.calls).toEqual([]);
-    expect((r3.details as Record<string, unknown>).cache_misses).toBe(0);
-  });
-
-  test('zero-claim scan wrote an "empty" sentinel invisible to the pending queue', async () => {
-    const sentinel = await engine.executeRaw<{ status: string; claim_text: string }>(
-      `SELECT status, claim_text FROM take_proposals WHERE page_slug = 'notes/zero-claims'`,
-      [],
-    );
-    expect(sentinel.length).toBe(1);
-    expect(sentinel[0].status).toBe('empty');
-    expect(sentinel[0].claim_text).toBe('');
-    const pending = await engine.executeRaw<{ n: number }>(
-      `SELECT COUNT(*)::int AS n FROM take_proposals WHERE page_slug = 'notes/zero-claims' AND status = 'pending'`,
-      [],
-    );
-    expect(Number(pending[0].n)).toBe(0);
-  });
-});
-
-describe('dropped claims — per-claim rows survive the idempotency index', () => {
-  test('a 3-claim page stores 3 rows and reports an honest inserted count', async () => {
-    const rows = await engine.executeRaw<{ claim_text: string }>(
-      `SELECT claim_text FROM take_proposals WHERE page_slug = 'notes/three-claims' AND status = 'pending' ORDER BY id`,
-      [],
-    );
-    // Pre-fix the 4-column unique index kept only the FIRST claim.
-    expect(rows.length).toBe(3);
-    expect(rows.map(r => r.claim_text)).toEqual([
-      'acme-example wins the market',
-      'widget-co will struggle',
-      'fund-a is overexposed',
-    ]);
-  });
-
-  test('content change re-extracts and stores the new version separately', async () => {
-    await engine.putPage('notes/zero-claims', {
-      type: 'note',
-      title: 'pure narrative',
-      compiled_truth: 'Updated: I now believe acme-example is undervalued and will re-rate within a year.',
-    });
-    const claims = {
-      'notes/zero-claims': [
-        { claim_text: 'acme-example is undervalued', kind: 'take' as const, holder: 'brain', weight: 0.6 },
-      ],
-    };
-    const run = countingExtractor(claims);
-    const r = await runPhaseProposeTakes(ctx(), { extractor: run.extractor });
-    expect(r.status).toBe('ok');
-    // Changed page re-extracts; the unchanged 3-claim page stays cached.
-    expect(run.calls).toEqual(['notes/zero-claims']);
-    expect((r.details as Record<string, unknown>).proposals_inserted).toBe(1);
-    const all = await engine.executeRaw<{ status: string }>(
-      `SELECT status FROM take_proposals WHERE page_slug = 'notes/zero-claims' ORDER BY id`,
-      [],
-    );
-    // Old hash's sentinel + new hash's pending claim coexist.
-    expect(all.map(r2 => r2.status).sort()).toEqual(['empty', 'pending']);
-  });
-});
@@ -41,16 +41,12 @@ interface CapturedSql {
 function buildMockEngine(opts: {
  pages: Page[];
  existingProposals?: Set<string>; // composite-key strings already in take_proposals
-  config?: Record<string, string>; // engine.getConfig plane (models.tier.* etc.)
 }): { engine: BrainEngine; captured: CapturedSql[] } {
  const captured: CapturedSql[] = [];
  const existing = opts.existingProposals ?? new Set<string>();

  const engine = {
    kind: 'pglite',
-    async getConfig(key: string) {
-      return opts.config?.[key] ?? null;
-    },
    async listPages() {
      return opts.pages;
    },
@@ -63,12 +59,7 @@ function buildMockEngine(opts: {
        if (existing.has(key)) return [{ id: 1 } as unknown as T];
        return [];
      }
-      // INSERT ... RETURNING id — emulate a successful insert so the
-      // honest proposals_inserted counter (counts RETURNING rows, not
-      // attempts) sees the row land. Conflicted inserts would return [].
-      if (sql.includes('INSERT INTO take_proposals') && sql.includes('RETURNING id')) {
-        return [{ id: 1 } as unknown as T];
-      }
+      // INSERT — return nothing
      return [];
    },
  } as unknown as BrainEngine;
@@ -276,29 +267,6 @@ describe('runPhaseProposeTakes — phase integration', () => {
    expect(inserts[0]!.params[9]).toBe('market'); // domain
  });

-  test('extractor model resolves through models.propose_takes config', async () => {
-    // Pre-fix the phase's only model knob was the gateway chat model — there
-    // was no per-phase config key. The phase now resolves once via
-    // resolveModel(models.propose_takes > models.default > env > gateway
-    // chat model); the extractor hint and the stored model_id must both
-    // reflect the configured override (full provider-prefixed string, #2451).
-    const pages = [buildPage({ slug: 'wiki/concepts/tier-routing', body: 'Tier-routed models will win.' })];
-    const { engine, captured } = buildMockEngine({
-      pages,
-      config: { 'models.propose_takes': 'anthropic:claude-sonnet-5' },
-    });
-    const seen: Array<string | undefined> = [];
-    const extractor: ProposeTakesExtractor = async ({ modelHint }) => {
-      seen.push(modelHint);
-      return [{ claim_text: 'tier-routed models win', kind: 'bet', holder: 'brain', weight: 0.7 }];
-    };
-    const result = await runPhaseProposeTakes(buildCtx(engine), { extractor });
-    expect(result.status).toBe('ok');
-    expect(seen).toEqual(['anthropic:claude-sonnet-5']); // chat call gets the FULL string
-    const inserts = captured.filter(c => c.sql.includes('INSERT INTO take_proposals'));
-    expect(inserts[0]!.params[11]).toBe('anthropic:claude-sonnet-5'); // stored model_id matches the call
-  });
-
  test('cache hit: page already in take_proposals is skipped', async () => {
    const body = 'A page that was already processed.';
    const pages = [buildPage({ slug: 'wiki/old-page', body })];