Data egress

Each dispatched CLI sends its task prompt and the code context it is handed to that CLI's model provider. Under the shipped defaults, your code and task context reach Anthropic (Claude), Google (Antigravity, Gemini 3.8 Flash) and OpenAI (Codex) for the core trio. Each optional member you enroll adds its provider: Zhipu / Z.ai for GLM, routed through the OpenRouter intermediary, which also sees the traffic; Moonshot for Kimi; xAI for Grok Build, and for Grok through Cursor; and Cognition for Devin (a model outside Cognition's SWE family also reaches that model's provider). Cognition may train on that data unless the account opts out, so at-setup records your consent before Devin joins the roster.

ops/roster.toml is the control surface: disable a member (enabled = false) or drop a provider's model from every role to take that provider out of the egress set. The core trio always stays.

Credentials never live in the repo. Each adapter reads its own from the OS or vendor store: CLI logins, OPENROUTER_API_KEY, CURSOR_API_KEY, kimi login (OAuth or API key), the devin auth login token in ~/.local/share/devin/, grok login or XAI_API_KEY. The lease environment allowlist scopes them per adapter, and captured output is scrubbed before it lands in ops/. Rotation follows each vendor's own token flow: revoke, log in again or set a new key, then rerun at-setup.