Provider Policy and Provenance

“Use model X” is a preference. “Private data must remain local and fallback is forbidden” is a policy. CmdForge represents both, checks the latter before execution, and reports what actually happened afterward.

Describe Provider Facts

version: 2
providers:
  - name: local-reasoner
    type: subprocess
    command: ollama run qwen3:8b
    model: qwen3:8b
    locality: local
    capabilities: [text, structured-json, reasoning]
    model_digest: "sha256:..."
    cost_class: free
    latency_class: standard
    max_context_tokens: 32768
    data_policy: private
    tools: [summarize, classify-*]
    mcp_servers: [filesystem]

Provider configuration states facts and limits. The calling application decides which facts are required for a particular packet.

Three Ways to Reach a Model

• subprocess: a CLI receives the prompt on stdin.
• api: an OpenAI-compatible HTTPS endpoint uses model and api_key_env.
• pty: an interactive CLI is driven through a pseudo-terminal; use only when the provider cannot offer a non-interactive mode.

Fallback Is a Data Movement Decision

  - name: primary
    command: provider-a --prompt
    fallback_chain: [local-backup, remote-backup]

Fallback chains are ordered, fully traversed, and cycle-checked. For public text, that may be a useful reliability feature. For private material, crossing from a local provider to a remote one can be a disclosure. Deny it at the tool step with fallback_policy: deny or at runtime:

cmdforge run incident-summary --provider local-reasoner   --no-fallback --require-local --data-classification private

Fail Closed on Missing Capability

cmdforge run extract-facts   --require-capability structured-json   --require-capability reasoning   --require-model-identity   --require-model-digest

An unknown locality does not count as local. An unspecified data policy does not count as private. Missing metadata blocks a strict request instead of being interpreted optimistically.

Ask CmdForge What Actually Ran

cmdforge run extract-facts --result-envelope json

The envelope includes requested provider, actual provider, attempted chain, fallback use, model, digest, locality, and identity source. These are runtime-owned facts. Never ask the model to invent its own provenance fields.

Provider-Level Access Control

tools and mcp_servers constrain delegated capabilities. null means unrestricted for backward compatibility; an empty list means none. Use exact names or reviewed patterns and keep dangerous tools outside broad wildcards.