.solos/core/config/ — OWNER: MIRA (business & finance)

Status: DESIGN. No code. No credentials. No values. Authority: Young, 2026-10-10 — the provider and workspace ruling, restated verbatim in §1 because every rule below derives from it.

My lane: cost posture and provider policy (SolOSV2/05-operations/layer-ownership.md). I write core/config/. I do not write anyone else's directory.

1. Young's ruling — the input to every rule in this file

"Providers: Opencode. workspace: SolOS Go / Zen.Go $10 package. Zen $40/mth credit.Optimise free models on both Go/Zen then selected paid models.Use native A2A V1.0."

Four facts, each of which carries a consequence:

2. The ladder — free on both workspaces, then selected paid

Two workspaces are already funded. So "free" is not one tier — it is two independent free pools, and the second one is the redundancy.

Why 1b matters more than it looks. V2 measured all 10 Zen free models returning 429 Rate limit exceeded, twice, hours apart. That reads as "Zen is dead" — and a dead pool is a candidate for deletion. But it is the only pool independent of GO. If GO's windows tighten or GO degrades, Zen free is the only escape. Dropping it because it looked idle is the v1 mistake this vault keeps recording: removing a fallback right when it becomes load-bearing.

The rule: a pool is retired on evidence that it is not needed, never on evidence that it is empty. Empty today is not evidence about tomorrow.

Young's ruling already decides the question I raised earlier — "keep Zen $40" is now settled by "Zen $40/mth credit" in the brief. Recording it so the recommendation is not re-litigated as open.

3. The finding that sets the order — V2, measured

SolOSV2/05-operations/costing-decision-2026-10-07.md. One day:

The free model did 9× the tokens for nothing. In a correctness-controlled comparison all four models answered correctly; the paid model's whole justification was 4 seconds faster.

Therefore: tier 1a is the default lane, and tier 2 requires a reason. Not a preference — the measured ratio is roughly 9× work at zero cost.

4. Why there is no dollar cap

monthly_cap_usd stays 0.0, and the reason is arithmetic, not policy:

• Go is a $10/month subscription with per-model allowances, windowed 5-hour 20% · weekly 50% · monthly 100%, and the windows stack.
• Zen is $40/month of credit — a float against those same windows.

A monthly dollar cap cannot represent a windowed allowance, and setting one authorises spending already ruled out. Worse, it reads green up to the halt: Qwen's 5-hour ceiling is 5,400 requests — about a day and a half of fleet work — and hitting it blocks the model, not the bill.

Budget enforcement prices windows, not months. That is the requirement this lane carries into V3.

5. Retention posture outranks cost

From SolOSV2/05-operations/free-model-reality-check.md. This is the rule I enforce, and it is not negotiable by tier:

The rule. Anything touching vault content, credentials, task text or the registry routes only to a zero-retention model, or to none at all.

A model that may train on our task text is not free. It is an undisclosed disclosure.

Note the tension with §3 and it is deliberate: the cheapest model is also the zero-retention one, so the cost ladder and the privacy ladder currently agree. The moment they disagree, §5 wins.

6. "Free" is four states — a boolean was always wrong

A catalogue listing is a claim, not a measurement. V2 measured:

Consequence for V3: the catalogue must be probed, not read. opencode models lists models that return Endpoint is unavailable. Availability is a measurement. This is true for both workspaces, separately — Go free working says nothing about Zen free.

7. The cost ledger — V2 recorded nothing

V2 recorded zero cost across 30,721 attempts. The $10/day was only visible because opencode stats exists as an external tool. A month could have passed. The ledger is not reporting; it is the instrument that makes every number in this file re-measurable.

Per attempt it records:

That last row closes V2's other defect: a prose refusal sets no failure signal, so a task can read completed while nothing was produced. The ledger must disaggregate or it is a cost tool that hides defects.

Proof of done for this lane

1. grep -r for a key pattern in core/config/ returns nothing.
2. The ledger disaggregates refusal / empty / error from success.
3. A tier-2 choice cannot be recorded without a reason.
4. Window exhaustion is recorded as model-blocked, not as spend.
5. Go and Zen are separately attributable — never one merged "spend" figure.
6. Every claim traces to a probe, not a catalogue listing.

8. A gap this ruling exposes — and it is not in my lane

The V3 registry declares no model.

I checked cortex/registry/agents.yaml (218 lines, 11 agents): it carries id, name, plane, role, pronouns, host, port, endpoint, capabilities, boundaries — and no model field anywhere. In V2 the model lived in the personas (echo.md:13 → model: opencode-go/gpt-6-luna).

This is exactly the defect class V3 exists to prevent, and it is currently live: the single most expensive fact in the system — what each agent talks to — has no home in the one registry. V2's personas were generated from AGENT_IDENTITIES, so the model id will vanish in the projection unless the registry captures it.

It is Min's lane, so I am reporting it, not fixing it. Per layer-ownership.md: a finding in another lane goes to the owner, and that is a complete contribution.

Recommendation to Min: add model (and, given Young's two-workspace ruling, a workspace field) to cortex/registry/agents.yaml, so the projection and my tier ladder read one fact instead of two.

9. Not mine, and stays open

Resolved by Young's ruling (recorded so it is not re-asked): Zen $40 stays. Still open, and mine: the exact per-model tier membership — that requires a live probe of both workspaces against both pools, which I cannot complete until the fleet is running. I will not write a model list from the V2 catalogue; see §6.