feat: class grants — apps ask for a capability class; grants survive catalog drift (codex-parity slice 5a) - #151
Merged
Conversation
…class, the grant survives catalog drift
Codex-parity slice 5a (daemon side, additive, opt-in). Grants store exact model ids, so an app that
connected for gpt-5.5 was silently bound to a provider's catalog at a point in time: on 2026-09-07 a
Codex CLI upgrade moved the catalog (gpt-5.5 → gpt-6-astra) and only a re-consent could follow it.
- protocol: `ScopeRequest.requirements: [{ class }]` (opt-in), `OriginGrant.classes` + `providers`,
`ModelInfo.classes`; `ModelClass = cloud-coding | cloud-vision | local-text` (a model may satisfy
several; local runners are local-text only).
- registry: `classesOf(model)` from backend capabilities; `modelInfo` advertises classes.
- grant store: stores classes/providers; `allowsModel` also accepts class × provider via a resolver the
broker injects (no coupling to backends); a user override may point at a class-allowed model.
- connect: when an app opts in, classes come from its requirements and providers from the backends of
the models the user actually approved — never widened beyond that consent. Legacy grants unchanged.
- routing: class-eligible models join the in-grant fallback, so a new conversation follows the
provider's current catalog; pinned conversations and explicit requests keep today's rules.
Tests: class app honours the default per provider; a provider excluded at consent is never routed
(explicit request refused); catalog drift → the class app follows the new model while the legacy
id-only app is never widened; override accepts class-allowed models; connect() derives classes +
providers; discovery advertises classes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Codex-parity slice 5a — daemon side, additive, opt-in. A grant is a list of one provider's model ids, so it silently binds an app to that catalog at a point in time (this morning: Codex CLI upgrade →
gpt-5.5gone,gpt-6-astrain; only a re-consent could follow).ScopeRequest.requirements: [{ class }]·OriginGrant.classes/providers·ModelInfo.classes. Classes:cloud-coding,cloud-vision,local-text(a model may satisfy several).scope.modelsgrants: same behaviour, byte for byte.sb.connect({ requirements })sugar, consent card showing classes + the currently-resolved model, migrating wrapps off hard-codedsonnet.Test plan
codex-b, legacy app never widened · override · connect derivation · discovery)🤖 Generated with Claude Code