Intrafere
diff --git a/‎.cursor/rules/api-key-controls.mdc‎
Lines changed: 6 additions & 3 deletions b/‎.cursor/rules/api-key-controls.mdc‎
Lines changed: 6 additions & 3 deletions
@@ -12,9 +12,10 @@ Enables cloud provider access with LM Studio fallback in default mode (OpenRoute
 **Key Features:**
 - **Per-Role Cloud Provider Selection**: Each role independently uses LM Studio, OpenRouter, or a desktop-only OAuth/subscription provider where available (OpenAI Codex OAuth, xAI Grok OAuth, Sakana Fugu API key; default mode); generic mode remains OpenRouter-only.
 - **OpenRouter/OAuth**: Header overlay manages OpenRouter API keys and desktop OAuth/provider logins (OpenAI Codex, xAI Grok/SuperGrok OAuth, Sakana Fugu subscription API key). The post-disclaimer startup wizard requires OpenRouter or LM Studio first and presents OAuth/provider add-ons later. The provider UI is registry-driven (`openai_codex_oauth`, `xai_grok_oauth`, `sakana_fugu`) so future providers can be added without changing saved profile shape. OAuth attribution identifiers must refer to MOTO Autonomous ASI, never the bare nickname `moto`; compact OAuth identifier fields use `moto-autonomous-asi` unless a provider explicitly requires the full display name.
+- **Credential State Refresh**: Adding/removing OpenRouter keys or desktop OAuth/subscription credentials must immediately invalidate mounted settings panels so provider buttons and model lists refresh without tab navigation. Credential presence and model-list loading are distinct: a valid OpenRouter key stays enabled if `/models` transiently fails; failed OAuth/subscription model loads clear stale model lists and show provider-specific errors.
 - **SyntheticLib4 Access**: SyntheticLib4 backend/search scaffolding remains in place, but the user-facing connectivity pill is currently a `Coming soon` explainer rather than a ready/configuration surface. The modal explains the reciprocal proof-contribution/access model until production corpus access is enabled.
 - **Session History Memory**: The connectivity toggle defaults enabled for new users and maps to local MOTO/manual/LeanOJ proof-history memory used by Assistant workflow-memory search during brainstorming, writing, proof work, and LeanOJ solving. It is not raw provider transcript or chain-of-thought storage. Disabling it persists as non-secret runtime state, removes local proof-history corpora from Assistant retrieval, and must not delete proof records or alter internal retry/rejection/prompt memory.
-- **Assistant Role**: Aggregator, Compiler, Autonomous Research, and LeanOJ expose one shared non-blocking Assistant LLM role per workflow surface for verified proof-memory support. Assistant selects up to 7 prior verified proof supports, never replaces validators or submitters, never blocks parent workflows, and is disabled when Session History Memory is disabled. Useful Assistant packs may be reused by two eligible receiver reads before the next refresh. True no-history targets are skipped because Assistant only performs proof-memory retrieval for now. Durable cooldown groups transient task IDs/roles by workflow run while preserving real source/session separation: repeated zero-useful retrieval backs off and may shut down for the run; repeated stagnant same-pack retrieval backs off without shutdown. Stale live packs/state clear only on explicit reset/clear or Session History Memory disable. User live activity should show normal Assistant retrieval result logs only, not skip/backoff/shutdown turns.
+- **Assistant Role**: Aggregator, Compiler, Autonomous Research, and LeanOJ expose one shared non-blocking Assistant LLM role per workflow surface for verified proof-memory support. Assistant selects up to 7 prior verified proof supports, never replaces validators or submitters, never blocks parent workflows, and is disabled when Session History Memory is disabled. Useful Assistant packs may be reused by two eligible receiver reads before the next refresh. True no-history targets are skipped because Assistant only performs proof-memory retrieval for now. Durable cooldown groups transient task IDs/roles by workflow run while preserving real source/session separation: repeated zero-useful retrieval backs off and may shut down for the run; repeated stagnant same-pack retrieval backs off without shutdown. Stale live packs/state clear only on explicit reset/clear or Session History Memory disable. User live activity should show normal Assistant retrieval result logs and explicit Assistant model-output failures, not skip/backoff/shutdown turns.
 - **Startup provider requirement**: OAuth providers are supplementary role providers, not a standalone startup path, because RAG embeddings route through LM Studio, OpenRouter, or generic-mode FastEmbed. First-run startup and workflow start preflights must require OpenRouter, generic FastEmbed, or LM Studio with an embedding model available before OAuth-only role selection is allowed.
 - **OpenRouter Auto-Fill**: OpenRouter selectors fetch provider endpoint metadata and compute host-aware context/output settings from a capable endpoint set. Auto mode ignores known weak hosts (currently Venice) and low/missing-cap outliers before computing context/max-output; manual host selection uses that exact host and its largest exposed endpoint output cap.
 - **OAuth Auto-Fill**: OAuth model selectors auto-fill only from provider model metadata, documented provider-specific limits, or curated provider-backed public aliases. Do not invent generic fallback context windows for unknown OAuth models; preserve current settings when metadata is unknown. GPT-5.5 Codex uses the Codex 400K product window, not the 1M regular API window; Codex Spark high is exposed as a curated alias for Codex Spark with high reasoning and its documented 128K window. Grok/SuperGrok OAuth uses xAI model metadata when available and may expose known Grok subscription limits only for known model IDs; model listings must filter xAI catalog entries that are not accepted by the OAuth chat-completions route, such as multi-agent-only models.
@@ -105,7 +106,7 @@ Enables cloud provider access with LM Studio fallback in default mode (OpenRoute
 - This includes: aggregator submitters/validator/Assistant, compiler Writing/Rigor & Proofs/validator/Assistant, autonomous agents/Assistant, Tier 3 final answer agents, and LeanOJ roles/topic/brainstorm submitters/Assistant
 - Role configs must preserve `supercharge_enabled` when copied into proof snapshots, manual proof helpers, child Aggregator/Compiler coordinators, and LeanOJ grouped roles.
 - **Proof agents (Part 3/manual, optional)** use the visible Rigor & Proofs Submitter settings for proof-solving submitter work. Internal proof role IDs are still configured through `api_client_manager.configure_role()` by copying from the `ProofRuntimeConfigSnapshot` (Rigor & Proofs submitter, validator, optional Assistant) captured by `autonomous_coordinator._build_proof_runtime_config_snapshot()` and persisted via `research_metadata.set_proof_runtime_config()`, or supplied directly on manual `POST /api/proofs/check`. Manual checks require `lean4_enabled=True` and either a stored or request-provided runtime snapshot.
-- Assistant is the preferred owner of routine proof-history memory retrieval for eligible non-validator, non-critique flows. It watches the current prompt/phase/target, searches proactively against verified proof corpora, ranks a diverse up-to-7 memory-support pack with cached target/goal reuse and visit-count exploration, reuses useful packs for two eligible receiver reads before refresh, and never blocks the parent workflow. Run-scoped cooldown prevents repeated empty/stagnant retrieval from calling Assistant every turn; ordinary stop preserves that state, while explicit clear/reset removes it. In-role `search_lean_proofs` calls should be explicit legacy/debug or narrow emergency-repair paths only, not the normal retrieval path.
+- Assistant is the preferred owner of routine proof-history memory retrieval for eligible non-validator, non-critique flows. Assistant proof-memory injection is centralized in `APIClientManager`, optional, budget-bounded, excluded from validators/Assistant-like roles, and consumed only by eligible receiver calls. It watches the current prompt/phase/target, searches proactively against verified proof corpora, ranks a diverse up-to-7 memory-support pack with cached target/goal reuse and visit-count exploration, reuses useful packs for two eligible receiver reads before refresh, and never blocks the parent workflow. Run-scoped cooldown prevents repeated empty/stagnant retrieval from calling Assistant every turn; ordinary stop preserves that state, while explicit clear/reset removes it. In-role `search_lean_proofs` calls should be explicit legacy/debug or narrow emergency-repair paths only, not the normal retrieval path.
 
 **Boost Mode Priority** (`should_use_boost(task_id)`):
 1. Always Prefer Boost: `boost_always_prefer=True` → True
@@ -247,7 +248,9 @@ Workflow, boost, fallback/reset, provider pause/resume, hung-connection, rate-li
 
 **Credit Exhaustion:** HTTP 402 or keywords "credit"/"insufficient"/"balance"/"quota"/"key limit"/"limit exceeded" → `CreditExhaustionError` → default mode: LM Studio fallback for that role when configured; proof workflows with no fallback checkpoint progress and pause, while currently waiting tasks can be woken by `POST /api/openrouter/reset-exhaustion`; ordinary non-proof generic-mode calls still raise provider/config errors when no fallback exists. Fallback state is resettable via `POST /api/openrouter/reset-exhaustion` or by re-setting the API key.
 
-**OAuth provider transient failures:** gateway/timeout/stream disconnect responses use bounded exponential backoff (4 retries) where the provider adapter supports it and must preserve proof checkpoints instead of becoming hard "no fallback configured" stops, `no_candidates`, or proof-attempt exhaustion. Auth/config failures remain hard; when an OAuth model call cannot recover through LM Studio fallback, broadcast a user-visible OAuth reconnect notification with a stable provider/role/reason/model `notification_key` so user-dismissed alerts do not replay after restart.
+**Retryable provider failures:** transient gateway/timeout/stream disconnect responses use provider-adapter retries first, then raise the shared `RetryableProviderError` so workflow loops use one exponential backoff path and preserve checkpoints instead of becoming rejects, `no_candidates`, or stops. Auth/config failures remain hard; when an OAuth model call cannot recover through LM Studio fallback, broadcast a user-visible OAuth reconnect notification with a stable provider/role/reason/model `notification_key` so user-dismissed alerts do not replay after restart.
+
+**Provider Context Limits:** OAuth/provider `context_length_exceeded` / context-window rejections are hard context mismatch failures, not retryable OAuth errors. Try the configured LM Studio fallback once when present; otherwise raise the workflow's context-overflow path and emit that preset live activity notification instead of repeatedly broadcasting OAuth failure events.
 
 **OAuth provider usage limits:** Codex `usage_limit_reached` responses carry `resets_at`/`resets_in_seconds`; `APIClientManager` tracks in-memory provider cooldown, emits one durable `oauth_provider_usage_limited` notification per cooldown window, uses LM Studio fallback when configured, otherwise raises `OAuthProviderCooldownError` so submitter/validator loops wait until reset instead of retry-spamming. Assistant OAuth refreshes reuse the latest cached/deterministic shortlist during cooldown instead of making new OAuth selection calls.