|
| 1 | +# PR #611 Volcengine Ark — credential-destination evidence ledger |
| 2 | + |
| 3 | +Research record for the `MAINTAINERS.md` evidence gate on PR #611. Sources were |
| 4 | +opened, not read from search snippets. Verification date: **2026-08-01**. |
| 5 | + |
| 6 | +## Why this unit exists |
| 7 | + |
| 8 | +PR #611 adds three canonical presets (`volcengine`, `volcengine-coding-plan`, |
| 9 | +`volcengine-agent-plan`). A new preset is a credential-destination change, so |
| 10 | +`MAINTAINERS.md` requires five evidence items before merge. A maintainer security |
| 11 | +review (Ingwannu, on `bdfc05c23`) blocked on that gate with "Do not merge the |
| 12 | +current head as a canonical preset". This ledger settles each item. |
| 13 | + |
| 14 | +## Claim ledger |
| 15 | + |
| 16 | +| # | Claim | Status | Primary source | Date | |
| 17 | +|---|-------|--------|----------------|------| |
| 18 | +| 1 | Pay-as-you-go base URL is `https://ark.cn-beijing.volces.com/api/v3` | verified | docs.volcengine.com/docs/82379/1494384 | — | |
| 19 | +| 2 | Coding Plan base URL is `.../api/coding/v3` | verified | docs.volcengine.com/docs/82379/1528783 | 2026-07-07 | |
| 20 | +| 3 | Agent Plan base URL is `.../api/plan/v3`, native Responses | verified | docs.volcengine.com/docs/82379/2165245 | 2026-05-28 | |
| 21 | +| 4 | Operating legal entity is 北京火山引擎科技有限公司 | verified | volcengine.com/docs/6256/64903 | pub 2024-06-14, eff 2024-06-21 | |
| 22 | +| 5 | Platform ToS URL and ICP filing (京ICP备20018813号-3) | verified | volcengine.com/docs/6256/64903 | 2024-06-14 | |
| 23 | +| 6 | Volcengine officially documents **Codex CLI** on Coding Plan | verified | docs.volcengine.com/docs/82379/2556056 | — | |
| 24 | +| 7 | Officially supported clients include Claude Code, Codex CLI, OpenCode, OpenClaw, Cline, Cursor, Kilo/Roo Code, TRAE | verified | docs.volcengine.com/docs/82379/2188957 | — | |
| 25 | +| 8 | Plan quota is valid **only** in designated AI coding tools; non-tool use of the Base URL / API key may cause 订阅停用 / 账号封禁 | verified | volcengine.com/article/37156 | 2026-04-09 | |
| 26 | +| 9 | `curl`, Postman, and Dify are named as excluded clients | verified | volcengine.com/article/37935 | — | |
| 27 | +| 10 | No public report of a plan key revoked for proxy routing | unreachable (negative) | 10 query families: V2EX/掘金/CSDN/Zhihu/GitHub/Reddit/HN | 2026-08-01 | |
| 28 | +| 11 | MiniMax terms forbid sublicensing/reselling outside an integrated application | verified | platform.minimax.io/protocol/terms-of-service | crawled 2026-08-01 | |
| 29 | + |
| 30 | +`liveModels: false` on all three entries, so the gate's authenticated |
| 31 | +`GET /v1/models` clause does not apply. |
| 32 | + |
| 33 | +## Routing-authorization finding |
| 34 | + |
| 35 | +The gate asks for "resale or routing authorization for aggregators". Two facts |
| 36 | +decide it, and they point the same way: |
| 37 | + |
| 38 | +1. Volcengine publishes a **Codex CLI integration guide** for Coding Plan |
| 39 | + (`82379/2556056`) instructing users to put a plan key in `~/.codex/config.toml`. |
| 40 | + Claude Code, OpenCode, and OpenClaw appear in the same supported-client list. |
| 41 | + opencodex exists to attach exactly those clients to a provider, so this is the |
| 42 | + vendor's own documented use, not an inferred permission. |
| 43 | +2. opencodex does **not** resell. Each user supplies their own plan key, and the |
| 44 | + credential never leaves that user's machine. The gate's "resale/aggregator" |
| 45 | + concern targets a service reselling pooled third-party capacity; this preset |
| 46 | + only points a first-party client at a first-party endpoint. |
| 47 | + |
| 48 | +The counter-evidence is real and must ship with the preset: plan quota is |
| 49 | +restricted to designated coding tools, and misuse of the Base URL or key is |
| 50 | +documented as grounds for subscription suspension or account ban. `curl`, |
| 51 | +Postman, and **Dify** are named exclusions — Dify being middleware is the closest |
| 52 | +adverse analogue to a proxy. No enforcement incident against a proxy was found, |
| 53 | +but absence of a reported ban is not authorization. |
| 54 | + |
| 55 | +**Disposition:** authorization is established for the documented coding-tool use, |
| 56 | +and the user-facing risk must be disclosed in the preset `note`, matching the |
| 57 | +`tencent-coding-plan` precedent at `src/providers/registry.ts`. |
| 58 | + |
| 59 | +## Gate result |
| 60 | + |
| 61 | +| Requirement | Result | |
| 62 | +|---|---| |
| 63 | +| Documented OpenAI-compatible endpoints | satisfied (claims 1-3) | |
| 64 | +| Terms of service + operating legal entity | satisfied (claims 4-5) | |
| 65 | +| Resale / routing authorization | satisfied for coding-tool use (claims 6-7), with disclosure required (claims 8-9) | |
| 66 | +| Named maintenance owner | satisfied — **@lidge-jun**, recorded in `src/providers/registry.ts` above the Volcengine block | |
| 67 | +| Citable verification date | satisfied by this ledger: 2026-08-01 | |
| 68 | + |
| 69 | +## Maintenance ownership |
| 70 | + |
| 71 | +The contributor did not name an owner, and a canonical preset without one is a route |
| 72 | +nobody has agreed to keep true. Rather than leave the gate open on a merged entry, the |
| 73 | +project owner (**@lidge-jun**) takes it. |
| 74 | + |
| 75 | +What that means concretely: |
| 76 | + |
| 77 | +- **What rots first.** Both Plan entries are `liveModels: false`, so a stale model id |
| 78 | + cannot self-heal through discovery and surfaces to the user as an upstream model error |
| 79 | + (`glm-5.1` was already one such case, corrected to `glm-5.2` during review). The base |
| 80 | + URLs and the Plan usage terms are the other two moving parts. |
| 81 | +- **How a break is reported.** Open an issue tagging the owner. A user-visible symptom is |
| 82 | + usually an upstream "unknown model" error or a 4xx from a moved base URL. |
| 83 | +- **What must be updated together.** The `note` strings on both Plan entries and the |
| 84 | + restriction blockquote in `docs-site/src/content/docs/guides/providers.md` are the two |
| 85 | + places that state the vendor's usage boundary. If Volcengine changes those terms, both |
| 86 | + change or neither is true. |
0 commit comments