From 42f2fba31e51d08ca540c0d00e6e3da5cb1c7f57 Mon Sep 17 00:00:00 2001
From: Svilen Stefanov <svilen.ks@gmail.com>
Date: Wed, 7 Oct 2026 00:34:42 +0200
Subject: [PATCH 1/2] feat: decide the credential from the inputs that are set,
 and let hosting choose its models

Two rules from the licensing spec that need nothing from the backend.

`llm` becomes optional (spec D-16). Without it, the inputs that are set
decide: none means CodeBoarding hosting, one provider's inputs mean that
provider, and inputs for several providers are refused as
`several_provider_keys`, naming them. A workflow that names a provider is
unchanged: it runs on that provider or fails, so the protected
no-fallback test still holds. The webview's setup dialog is meant to write
either no `with:` block or the one chosen provider's key.

GitHub reads a missing secret as empty, so an unnamed workflow whose only
key is missing runs on hosting. The log's first line and a new "Chosen"
summary row say which source the run got and why, and a hosting run with
no OIDC permission tells the reader to check that their secret exists.

Hosting ignores the model inputs (spec D-13). On CodeBoarding's account
the models are CodeBoarding's choice: `model`, `agent_model`,
`parsing_model` and an inherited AGENT_MODEL or PARSING_MODEL never reach
the engine there, a notice and a "Models" summary row name what was
ignored, and the stored-analysis name leaves them out so it names the
models that actually ran. Own-key runs keep their model inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 AGENTS.md                            |  5 ++
 README.md                            | 50 ++++++++-------
 action.yml                           | 19 +++---
 scripts/action/credential_check.py   | 96 ++++++++++++++++++++++------
 scripts/action/verify-credentials.sh |  3 +
 scripts/action/with-auth.sh          |  5 ++
 tests/test_action_auth.py            | 66 +++++++++++++++++++
 tests/test_action_inputs.py          | 22 ++++++-
 tests/test_llm_contract.py           | 55 ++++++++++++++--
 9 files changed, 264 insertions(+), 57 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index fd9fbbd..3fe11d7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -54,6 +54,11 @@ Protected tests:
   hosted tier, so a repository that had not added its secret yet went green
   while running on another vendor's model and CodeBoarding's money, silently.
   Any change that reintroduces a credential fallback breaks this test.
+  Since 7 October 2026 (licensing spec D-16, Svilen's call), a workflow that
+  names no `llm` is resolved from the provider inputs that are set, and runs on
+  hosting when none is. That covers only workflows that named nothing; a named
+  provider still runs on that provider or fails, and the job summary says which
+  source an unnamed workflow got and why.
 
 ## Releases
 
diff --git a/README.md b/README.md
index 838c669..6df8a57 100644
--- a/README.md
+++ b/README.md
@@ -50,9 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: CodeBoarding/CodeBoarding-action@v1
-        with:
-          llm: hosted   # or a provider name -- see Authentication
+      - uses: CodeBoarding/CodeBoarding-action@v1   # CodeBoarding hosting; to use your own key, see Authentication
 ```
 
 Automatic runs review both draft and non-draft pull requests and update one sticky **CodeBoarding review** comment. Opening, reopening, or pushing a commit runs analysis; changing only the draft state does not. A trusted repository owner, member, or collaborator can comment `/codeboarding` to analyze the current PR head again, including on fork PRs; every command creates a new result comment.
@@ -106,35 +104,39 @@ Every review comment ends with a machine-readable HTML comment, `<!-- codeboardi
 
 ## Authentication and providers
 
-The `llm` input is required and says where analysis credentials come from. There are
-two answers, and the action never picks one for you:
+Wire the key you want to use, and the action uses it. Wire nothing, and it runs on
+CodeBoarding hosting:
 
 ```yaml
-    with:
-      llm: hosted                                        # CodeBoarding's hosted tier, on your plan
+    - uses: CodeBoarding/CodeBoarding-action@v1          # CodeBoarding hosting, on your plan
 ```
 ```yaml
-    with:
-      llm: anthropic                                     # your own provider key
-      anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+    - uses: CodeBoarding/CodeBoarding-action@v1
+      with:
+        anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}   # your own key, called directly
 ```
 
-`hosted` runs through CodeBoarding's proxy and needs `id-token: write`, which
+The optional `llm` input names the source outright: `hosted` or a provider. You need it
+only when inputs for more than one provider are set, or when you want a missing key to
+fail the run rather than fall back to hosting.
+
+Hosting runs through CodeBoarding's proxy and needs `id-token: write`, which
 mints short-lived credentials per request and stores no LLM secret in your repository. A
 provider key is used directly and needs no OIDC permission.
 
-**An empty value is never a fallback.** If you name a provider and its key is missing --
-because the secret does not exist yet, or is misspelt — the run fails in its first
-seconds and says which input and which secret to fix. It does not quietly analyze on
-CodeBoarding's hosted tier instead. That was the old behaviour, and it meant a repository
-could report an Anthropic review that Anthropic never produced.
-
-The same rule makes the combinations explicit rather than order-dependent:
+**Check the first line of the job summary after adding a key.** GitHub reads a secret that
+does not exist, or is misspelt, as an empty string, so a workflow without `llm` whose only
+key is missing runs on hosting. The log's first line and the summary's "Chosen" row say
+which source the run used and why. **A named provider never falls back:** with
+`llm: anthropic` and the key missing, the run fails in its first seconds and says which
+input and which secret to fix.
 
 | Workflow says | Result |
 |---|---|
-| nothing | refused: `llm` is required |
-| `llm: hosted` | CodeBoarding's hosted tier, on the plan of whoever the run is charged to |
+| nothing | CodeBoarding hosting, on the plan of whoever the run is charged to |
+| `anthropic_api_key` only | Anthropic, directly |
+| `anthropic_api_key` + `openai_api_key` | refused: set `llm` to pick one |
+| `llm: hosted` | CodeBoarding hosting |
 | `llm: hosted` + any provider key | refused: pick one |
 | `llm: license` | refused: license keys are retired, use `llm: hosted` |
 | `llm: anthropic` + `anthropic_api_key` | Anthropic, directly |
@@ -253,6 +255,8 @@ Precedence is intentionally simple:
 
 Set only `model` when both jobs should use the same model. Set either specialized input only when that job needs a different model. Model identifiers are not secrets and can be stored in GitHub repository variables.
 
+On CodeBoarding hosting, CodeBoarding pays for the tokens and chooses the models. The three model inputs are ignored there, and so is an `AGENT_MODEL` or `PARSING_MODEL` set in the job's environment; the run's annotations and job summary say which inputs were ignored. They apply when the run uses your own provider key.
+
 ## Keep the baseline current
 
 Sync mode commits only Core's persisted incremental-analysis state under `.codeboarding/`:
@@ -303,7 +307,6 @@ jobs:
       - uses: CodeBoarding/CodeBoarding-action@v1
         with:
           mode: sync
-          llm: hosted
           target_branch: main
           force_full: ${{ inputs.force_full || false }}
 ```
@@ -324,7 +327,6 @@ permissions:
       - uses: CodeBoarding/CodeBoarding-action@v1
         with:
           mode: sync
-          llm: hosted
           target_branch: main
           sync_strategy: pull_request
 ```
@@ -338,11 +340,11 @@ With the default `github.token`, the repository or organization must allow GitHu
 | Input | Mode | Default | Description |
 |---|---|---|---|
 | `mode` | both | `review` | `review` or `sync`. |
-| `llm` | both | **required** | `hosted` or a provider name. No default. |
+| `llm` | both | empty | `hosted` or a provider name. Empty: the provider inputs that are set decide. |
 | `<provider>_api_key` | both | empty | That provider's key, e.g. `anthropic_api_key`. See [Providers](#providers). |
 | `<provider>_base_url` | both | empty | That provider's endpoint, where it has one. |
 | `aws_bedrock_region` | both | empty | Bedrock region. Core defaults to `us-east-1`. |
-| `model` | both | empty | Default model for both analysis and parsing. |
+| `model` | both | empty | Default model for both analysis and parsing. Ignored on CodeBoarding hosting. |
 | `agent_model` | both | empty | Analysis-only override for `model`. |
 | `parsing_model` | both | empty | Parsing-only override for `model`. |
 | `depth_cap` | both | `2` | Positive integer maximum analysis depth, including full-analysis fallbacks, capped by the plan of whoever the run is charged to (3 on Free). Changing it rebuilds incompatible state. |
diff --git a/action.yml b/action.yml
index 2bc66c9..1c4591c 100644
--- a/action.yml
+++ b/action.yml
@@ -10,8 +10,9 @@ inputs:
     required: false
     default: 'review'
   llm:
-    description: 'Required. Where analysis credentials come from: hosted or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel).'
-    required: true
+    description: 'Optional. Where analysis credentials come from: hosted or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel). Without it, the provider inputs that are set decide: none means hosted, one provider means that provider. A named provider never falls back.'
+    required: false
+    default: ''
   # Anthropic - selected by llm: anthropic
   anthropic_api_key:
     description: 'Anthropic API key, used when llm is anthropic. Sets ANTHROPIC_API_KEY.'
@@ -110,15 +111,15 @@ inputs:
     required: false
     default: ''
   model:
-    description: 'Optional model used for both analysis and parsing.'
+    description: 'Optional model used for both analysis and parsing. Ignored on CodeBoarding hosting, where CodeBoarding chooses the models.'
     required: false
     default: ''
   agent_model:
-    description: 'Optional analysis-model override. Takes precedence over model.'
+    description: 'Optional analysis-model override. Takes precedence over model. Ignored on CodeBoarding hosting.'
     required: false
     default: ''
   parsing_model:
-    description: 'Optional parsing-model override. Takes precedence over model.'
+    description: 'Optional parsing-model override. Takes precedence over model. Ignored on CodeBoarding hosting.'
     required: false
     default: ''
   depth_cap:
@@ -398,9 +399,11 @@ runs:
         LLM_PROVIDER: ${{ steps.llm.outputs.provider }}
         BACKEND_ID: ${{ steps.llm.outputs.backend_id }}
         DEPTH_CAP: ${{ steps.preflight.outputs.depth_cap }}
-        MODEL: ${{ inputs.model }}
-        AGENT_MODEL_INPUT: ${{ inputs.agent_model }}
-        PARSING_MODEL_INPUT: ${{ inputs.parsing_model }}
+        # Empty on hosting, where with-auth.sh drops them too: the stored analysis is named
+        # for the models that actually ran.
+        MODEL: ${{ steps.llm.outputs.model_inputs != 'ignored' && inputs.model || '' }}
+        AGENT_MODEL_INPUT: ${{ steps.llm.outputs.model_inputs != 'ignored' && inputs.agent_model || '' }}
+        PARSING_MODEL_INPUT: ${{ steps.llm.outputs.model_inputs != 'ignored' && inputs.parsing_model || '' }}
       run: "$GITHUB_ACTION_PATH/scripts/action/state-names.sh"
 
     # Both lookups are best effort. Without them the run derives the base from
diff --git a/scripts/action/credential_check.py b/scripts/action/credential_check.py
index 1a917de..65a62a7 100755
--- a/scripts/action/credential_check.py
+++ b/scripts/action/credential_check.py
@@ -6,10 +6,11 @@
 that same string as the pull request comment, the error annotation and the job summary --
 so the rule and its explanation are written together and cannot drift apart.
 
-One provider, chosen explicitly by the `llm` input, and nothing is ever reached by an
-empty string falling through to a default. A misconfigured run fails here -- before the
-checkout and the engine install -- naming the input and the secret to fix, rather than
-succeeding on someone else's credentials or failing later inside the engine.
+One provider per run. A workflow that names it with `llm` gets that provider or a refusal,
+never a default. A workflow without `llm` gets whatever its set inputs describe: none means
+CodeBoarding hosting, one provider's inputs mean that provider, several are refused. A
+misconfigured run fails here -- before the checkout and the engine install -- naming the
+input and the secret to fix, rather than failing later inside the engine.
 
 Reads the action's inputs from CB_IN_* environment variables (prefixed so that wiring an
 input can never itself set a provider selection variable), and writes the resolved
@@ -31,6 +32,10 @@
 SETTINGS_HINT = "Settings -> Secrets and variables -> Actions"
 TABLE = Path(__file__).resolve().parent / "supported-providers.json"
 
+#: The action's model inputs. On hosting CodeBoarding pays for the tokens, so it chooses the
+#: models: these inputs apply only where the run's own provider key pays (spec D-13).
+MODEL_INPUTS = ("model", "agent_model", "parsing_model")
+
 
 #: Every reason this module can refuse a configuration.
 #:
@@ -41,7 +46,7 @@
 #: `test_llm_contract.py` asserts every entry here is exercised.
 ERROR_CODES = frozenset(
     {
-        "missing_llm",
+        "several_provider_keys",
         "unknown_llm",
         "missing_provider_key",
         "missing_id_token",
@@ -172,20 +177,29 @@ def _reject_provider_inputs(table: dict, given: dict[str, str]) -> None:
     )
 
 
-def _require_id_token(llm: str, environ: dict[str, str]) -> None:
+def _require_id_token(llm: str, environ: dict[str, str], reason: str = "") -> None:
     # Both, because the relay needs both (oidc_relay.py refuses to start without either)
     # and a runner can expose one without the other. Checking only the URL let that case
     # through preflight and turned it into a generic failure after the engine install,
     # which is the whole thing this check exists to prevent.
     if environ.get("ACTIONS_ID_TOKEN_REQUEST_URL") and environ.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN"):
         return
+    # A run that chose hosting because no key is set may have meant to use a key whose
+    # secret does not exist yet; this is the one refusal that can say so.
+    if reason:
+        problem = (
+            f"This run uses CodeBoarding hosting because {reason}. Hosting authenticates with a "
+            "GitHub OIDC token, which this job cannot mint. If you meant to use your own provider "
+            "key, check that its secret exists."
+        )
+    else:
+        problem = f"`llm: {llm}` authenticates with a GitHub OIDC token, which this job cannot mint."
     raise ConfigError(
         "missing_id_token",
-        f"`llm: {llm}` authenticates with a GitHub OIDC token, which this job cannot mint. "
-        "Add `permissions:` with `id-token: write` to the job that uses this action.",
+        f"{problem} Add `permissions:` with `id-token: write` to the job that uses this action.",
         "\n\n".join(
             [
-                f"`llm: {llm}` authenticates with a GitHub OIDC token, which this job cannot mint.",
+                problem,
                 f"In `{workflow_path(environ)}`, the job running this action needs:",
                 "```yaml\n    permissions:\n      id-token: write\n```",
                 "No secret is involved: the token is minted per request and never stored.",
@@ -246,18 +260,35 @@ def resolve(table: dict, environ: dict[str, str]) -> dict:
     llm = environ.get("CB_IN_LLM", "").strip().lower()
     given = read_inputs(table, environ)
 
+    # Without `llm`, the inputs that are set decide (spec D-16), and the plan carries the
+    # reason so the log and the summary say how the run chose. A named `llm` is never
+    # second-guessed: it takes the strict paths below exactly as written.
+    reason = ""
     if not llm:
-        raise ConfigError(
-            "missing_llm",
-            "The `llm` input is required and has no default. Set it to `hosted` "
-            "(CodeBoarding's hosted tier, on your CodeBoarding plan) or one of: "
-            f"{_provider_list(table)}. See {DOCS}.",
-        )
+        providers = sorted({owner_of(table, i) for i in given})
+        if len(providers) > 1:
+            raise ConfigError(
+                "several_provider_keys",
+                f"Inputs for more than one provider are set ({', '.join(f'`{i}`' for i in sorted(given))}). "
+                f"Set `llm` to the one this run should use: {', '.join(providers)}.",
+            )
+        if providers:
+            llm = providers[0]
+            reason = f"only {table['providers'][llm].get('label', llm)}'s inputs are set"
+        else:
+            llm = "hosted"
+            reason = "no provider key is set"
 
     if llm == "hosted":
         _reject_provider_inputs(table, given)
-        _require_id_token(llm, environ)
-        return {"tier": "hosted", "provider": table["hosted_provider"], "env": {}}
+        _require_id_token(llm, environ, reason)
+        return {
+            "tier": "hosted",
+            "provider": table["hosted_provider"],
+            "env": {},
+            "ignored_model_inputs": [n for n in MODEL_INPUTS if environ.get(f"CB_IN_{n.upper()}", "").strip()],
+            "reason": reason,
+        }
 
     # Keys were retired completely, so the answer that ran on one is refused by name rather
     # than as an unknown value: the fix is one word, and the plan it paid for now follows
@@ -288,7 +319,7 @@ def resolve(table: dict, environ: dict[str, str]) -> dict:
         )
 
     env = _resolve_byok(table, name, given, environ)
-    return {"tier": "byok", "provider": name, "env": env}
+    return {"tier": "byok", "provider": name, "env": env, "reason": reason}
 
 
 def _is_endpoint(var: str) -> bool:
@@ -350,8 +381,28 @@ def reported_provider(plan: dict) -> str:
     return "" if plan["tier"] == "hosted" else plan["provider"]
 
 
+def model_inputs(plan: dict) -> str:
+    """`ignored` on the hosted tier, else `apply`. action.yml and with-auth.sh both key on it."""
+    return "ignored" if plan["tier"] == "hosted" else "apply"
+
+
+def model_notice(plan: dict) -> str:
+    """The sentence for a hosted run whose workflow set model inputs, or empty."""
+    ignored = plan.get("ignored_model_inputs") or []
+    if not ignored:
+        return ""
+    names = ", ".join(f"`{name}`" for name in ignored)
+    verb = "is" if len(ignored) == 1 else "are"
+    return (
+        f"{names} {verb} ignored: on CodeBoarding hosting, CodeBoarding chooses the models. "
+        "Model inputs apply when the run uses your own provider key."
+    )
+
+
 def plan_headline(table: dict, plan: dict) -> str:
     """The one line the log opens with. Same source as the summary, so they cannot drift."""
+    if plan.get("reason"):
+        return f"CodeBoarding is running on {_pays(table, plan)}, because {plan['reason']}."
     return f"CodeBoarding is running on {_pays(table, plan)}."
 
 
@@ -366,6 +417,12 @@ def plan_summary(table: dict, plan: dict) -> list[tuple[str, str]]:
     if shown:
         rows.append(("Provider", f"`{shown}`"))
     rows.append(("Credentials", _pays(table, plan)))
+    # Without `llm`, a secret that does not exist reads as empty and the run goes hosted.
+    # This row is how someone who meant to use their own key finds out.
+    rows.append(("Chosen", f"because {plan['reason']}" if plan.get("reason") else "by `llm`"))
+    if plan.get("ignored_model_inputs"):
+        ignored = ", ".join(f"`{name}`" for name in plan["ignored_model_inputs"])
+        rows.append(("Models", f"chosen by CodeBoarding on hosting; {ignored} ignored"))
     # Only where the run was pointed somewhere other than the default, since that is the
     # setting most likely to be wrong and least likely to be noticed.
     for var, value in sorted(plan["env"].items()):
@@ -381,6 +438,7 @@ def write_auth_dir(table: dict, plan: dict, auth_dir: Path) -> None:
     env_dir.mkdir(parents=True, exist_ok=True)
     (auth_dir / "tier").write_text(plan["tier"], encoding="utf-8")
     (auth_dir / "provider-name").write_text(plan["provider"], encoding="utf-8")
+    (auth_dir / "model-inputs").write_text(model_inputs(plan), encoding="utf-8")
     for var, value in plan["env"].items():
         (env_dir / var).write_text(value, encoding="utf-8")
     # Every variable core knows about, minus the ones this run actually resolved, so
@@ -448,6 +506,8 @@ def main(argv: list[str]) -> int:
             "provider": reported_provider(plan),
             "summary": "\n".join(f"| {k} | {v} |" for k, v in plan_summary(table, plan)),
             "headline": plan_headline(table, plan),
+            "model_inputs": model_inputs(plan),
+            "notice": model_notice(plan),
         },
         sys.stdout,
     )
diff --git a/scripts/action/verify-credentials.sh b/scripts/action/verify-credentials.sh
index 9a7eddc..f537ff1 100755
--- a/scripts/action/verify-credentials.sh
+++ b/scripts/action/verify-credentials.sh
@@ -39,6 +39,7 @@ backend_id=""
   echo "tier=$tier"
   echo "backend_id=$backend_id"
   echo "provider=$provider"
+  echo "model_inputs=$(field model_inputs)"
   echo "error=$error"
   echo "message<<CB_EOF"
   echo "$message"
@@ -80,6 +81,8 @@ fi
 # and the summary cannot end up claiming different things -- which they did: this said
 # "your own openai key" for an endpoint-only run that resolved no key at all.
 field headline
+notice="$(field notice)"
+[ -z "$notice" ] || echo "::notice title=CodeBoarding models::${notice}"
 # The rows come from the check, which is the only thing that knows what it resolved.
 {
   echo "### CodeBoarding configuration"
diff --git a/scripts/action/with-auth.sh b/scripts/action/with-auth.sh
index 0758629..7c76372 100755
--- a/scripts/action/with-auth.sh
+++ b/scripts/action/with-auth.sh
@@ -36,6 +36,11 @@ done
 
 export CODEBOARDING_SOURCE=github_action
 unset ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_ID_TOKEN_REQUEST_TOKEN
+# On the hosted tier CodeBoarding chooses the models. Neither the workflow's model inputs nor
+# a model variable inherited from the job environment may pick one on CodeBoarding's account.
+if [ "$(cat "$AUTH_DIR/model-inputs" 2>/dev/null)" = ignored ]; then
+  unset MODEL AGENT_MODEL_INPUT PARSING_MODEL_INPUT AGENT_MODEL PARSING_MODEL
+fi
 if [ -n "${MODEL:-}" ]; then
   export AGENT_MODEL="$MODEL"
   export PARSING_MODEL="$MODEL"
diff --git a/tests/test_action_auth.py b/tests/test_action_auth.py
index 3ccafc6..bbf29f0 100644
--- a/tests/test_action_auth.py
+++ b/tests/test_action_auth.py
@@ -364,6 +364,72 @@ def test_a_run_the_relay_saw_walled_ends_neutral_and_any_other_failure_does_not(
                 self.assertEqual(scoped.returncode, code, scoped.stderr or scoped.stdout)
                 self.assertEqual("walled=true" in output.read_text(encoding="utf-8"), walled)
 
+    # -- a workflow without `llm` ----------------------------------------------
+
+    def test_an_unnamed_workflow_says_which_source_it_got_and_why(self) -> None:
+        """A secret that does not exist reads as empty, so a workflow meant for its own key
+        can land on hosting. The log's first line and the summary are how anyone finds out."""
+        result, _, outputs = self._preflight(**self._OIDC)
+        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
+        self.assertEqual(outputs["tier"], "hosted")
+        self.assertIn("because no provider key is set", result.stdout)
+        summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
+        self.assertIn("| Chosen | because no provider key is set |", summary)
+
+        self.temp_dir.cleanup()
+        self.temp_dir = tempfile.TemporaryDirectory()
+        _, _, keyed = self._preflight(CB_IN_ANTHROPIC_API_KEY="k")
+        self.assertEqual((keyed["tier"], keyed["provider"]), ("byok", "anthropic"))
+
+    # -- model choice ------------------------------------------------------
+
+    _OIDC = {
+        "ACTIONS_ID_TOKEN_REQUEST_URL": "https://oidc.example/token",
+        "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "request-token",
+    }
+
+    def test_the_hosted_tier_never_lets_the_workflow_pick_a_model(self) -> None:
+        """CodeBoarding pays for hosted tokens, so the model is CodeBoarding's choice.
+
+        Inputs and an inherited variable alike: a job-level `AGENT_MODEL` reaches the engine
+        as surely as the input does.
+        """
+        result, auth_dir, outputs = self._preflight(CB_IN_LLM="hosted", CB_IN_MODEL="big-model", **self._OIDC)
+        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
+        self.assertEqual(outputs["model_inputs"], "ignored")
+        self.assertEqual((auth_dir / "model-inputs").read_text(), "ignored")
+
+        scoped = self._with_auth(
+            'test -z "${AGENT_MODEL:-}" && test -z "${PARSING_MODEL:-}"',
+            MODEL="big-model",
+            AGENT_MODEL_INPUT="analysis-model",
+            PARSING_MODEL_INPUT="parsing-model",
+            AGENT_MODEL="inherited-model",
+            PARSING_MODEL="inherited-model",
+        )
+        self.assertEqual(scoped.returncode, 0, scoped.stderr or scoped.stdout)
+
+    def test_ignored_model_inputs_are_named_in_the_log_and_the_summary(self) -> None:
+        result, _, _ = self._preflight(CB_IN_LLM="hosted", CB_IN_MODEL="m", CB_IN_PARSING_MODEL="p", **self._OIDC)
+        notice = next(
+            line for line in result.stdout.splitlines() if line.startswith("::notice title=CodeBoarding models::")
+        )
+        self.assertIn("`model`, `parsing_model` are ignored", notice)
+        self.assertNotIn("agent_model", notice)
+        summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
+        self.assertIn("| Models |", summary)
+
+    def test_a_hosted_run_without_model_inputs_says_nothing_about_models(self) -> None:
+        result, _, outputs = self._preflight(CB_IN_LLM="hosted", **self._OIDC)
+        self.assertEqual(outputs["model_inputs"], "ignored")
+        self.assertNotIn("::notice title=CodeBoarding models::", result.stdout)
+        summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
+        self.assertNotIn("| Models |", summary)
+
+    def test_your_own_key_keeps_its_model_inputs(self) -> None:
+        _, _, outputs = self._preflight(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_MODEL="m")
+        self.assertEqual(outputs["model_inputs"], "apply")
+
     def test_analysis_refuses_to_run_without_a_resolved_plan(self) -> None:
         scoped = self._with_auth("true")
         self.assertNotEqual(scoped.returncode, 0)
diff --git a/tests/test_action_inputs.py b/tests/test_action_inputs.py
index c1a239b..e2b7ecf 100644
--- a/tests/test_action_inputs.py
+++ b/tests/test_action_inputs.py
@@ -58,10 +58,11 @@ def test_no_declared_provider_input_is_absent_from_the_table(self) -> None:
         declared = {n for n in self.inputs if n.endswith(suffixes) and n != "github_token"}
         self.assertEqual(sorted(declared - table_inputs()), [])
 
-    def test_llm_is_required_and_has_no_default(self) -> None:
+    def test_llm_is_optional_and_empty_by_default(self) -> None:
+        """Empty means "decide from the inputs that are set"; the resolver owns that rule."""
         block = self.inputs["llm"]
-        self.assertIn("required: true", block)
-        self.assertNotIn("default:", block)
+        self.assertIn("required: false", block)
+        self.assertIn("default: ''", block)
 
     def test_depth_is_wired_to_state_identity_and_both_analysis_modes(self) -> None:
         """The workflow's depth_cap is only a request: the preflight's answer, clamped to the
@@ -147,6 +148,21 @@ def test_license_key_is_retired(self) -> None:
         self.assertNotIn("license_key", self.inputs)
         self.assertNotIn("CB_IN_LICENSE_KEY", ACTION)
 
+    def test_hosted_runs_name_their_stored_analysis_without_the_ignored_model_inputs(self) -> None:
+        """with-auth.sh drops the model inputs on the hosted tier; the analysis name must too,
+        or it would claim a model the run never used."""
+        start = ACTION.index("id: state")
+        block = ACTION[start : ACTION.index("\n      run:", start)]
+        for name, var in (
+            ("model", "MODEL"),
+            ("agent_model", "AGENT_MODEL_INPUT"),
+            ("parsing_model", "PARSING_MODEL_INPUT"),
+        ):
+            with self.subTest(input=name):
+                self.assertIn(
+                    f"{var}: ${{{{ steps.llm.outputs.model_inputs != 'ignored' && inputs.{name} || '' }}}}", block
+                )
+
     def test_default_workflow_reviews_drafts_on_open_and_new_commits(self) -> None:
         self.assertNotIn("github.event.pull_request.draft", DOGFOOD)
         start = DOGFOOD.index("types:")
diff --git a/tests/test_llm_contract.py b/tests/test_llm_contract.py
index dfb6e2a..8e90362 100644
--- a/tests/test_llm_contract.py
+++ b/tests/test_llm_contract.py
@@ -97,10 +97,57 @@ def test_endpoint_only_providers_resolve_without_a_key(self) -> None:
 
     # -- refused shapes ----------------------------------------------------
 
-    def test_an_undeclared_workflow_is_refused_rather_than_defaulted(self) -> None:
+    # -- no `llm`: the inputs that are set decide ---------------------------
+
+    def test_a_workflow_with_nothing_set_runs_on_hosting_and_says_why(self) -> None:
+        plan = self.resolve(**OIDC)
+        self.assertEqual(plan["tier"], "hosted")
+        self.assertEqual(plan["reason"], "no provider key is set")
+
+    def test_hosting_without_an_oidc_token_points_at_a_missing_secret(self) -> None:
+        """Someone who meant to use their own key and has no secret yet lands here, with no
+        `id-token: write` either: the refusal is the one place to tell them."""
         error = self.refuse()
-        self.assertEqual(error.code, "missing_llm")
-        self.assertIn("required", error.message)
+        self.assertEqual(error.code, "missing_id_token")
+        self.assertIn("no provider key is set", error.message)
+        self.assertIn("check that its secret exists", error.message)
+
+    def test_one_providers_key_selects_that_provider(self) -> None:
+        plan = self.resolve(CB_IN_ANTHROPIC_API_KEY="k")
+        self.assertEqual((plan["tier"], plan["provider"]), ("byok", "anthropic"))
+        self.assertEqual(plan["env"], {"ANTHROPIC_API_KEY": "k"})
+        self.assertEqual(plan["reason"], "only Anthropic's inputs are set")
+
+    def test_several_inputs_of_one_provider_still_select_it(self) -> None:
+        plan = self.resolve(CB_IN_AWS_BEDROCK_API_KEY="k", CB_IN_AWS_BEDROCK_REGION="eu-west-1")
+        self.assertEqual(plan["provider"], "aws_bedrock")
+        self.assertEqual(plan["env"]["AWS_DEFAULT_REGION"], "eu-west-1")
+
+    def test_an_endpoint_selects_its_provider(self) -> None:
+        plan = self.resolve(CB_IN_OLLAMA_BASE_URL="http://host:11434")
+        self.assertEqual(plan["provider"], "ollama")
+
+    def test_inputs_that_cannot_select_their_provider_are_refused_not_ignored(self) -> None:
+        """A region alone says "Bedrock" but configures nothing; hosting would be a guess."""
+        error = self.refuse(CB_IN_AWS_BEDROCK_REGION="eu-west-1")
+        self.assertEqual(error.code, "missing_provider_key")
+        self.assertIn("aws_bedrock_api_key", error.message)
+
+    def test_two_providers_are_refused_with_the_inputs_named(self) -> None:
+        error = self.refuse(CB_IN_ANTHROPIC_API_KEY="k", CB_IN_OPENAI_API_KEY="o")
+        self.assertEqual(error.code, "several_provider_keys")
+        self.assertIn("anthropic_api_key", error.message)
+        self.assertIn("openai_api_key", error.message)
+        self.assertIn("`llm`", error.message)
+
+    def test_llm_settles_which_of_several_providers_runs(self) -> None:
+        error = self.refuse(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_OPENAI_API_KEY="o")
+        self.assertEqual(error.code, "foreign_provider_key")
+
+    def test_a_named_llm_carries_no_reason(self) -> None:
+        """The workflow said what it wanted; there is nothing to explain."""
+        self.assertEqual(self.resolve(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k")["reason"], "")
+        self.assertEqual(self.resolve(CB_IN_LLM="hosted", **OIDC)["reason"], "")
 
     def test_a_named_provider_without_its_key_names_the_input_and_the_secret(self) -> None:
         error = self.refuse(CB_IN_LLM="anthropic")
@@ -290,7 +337,7 @@ def test_every_declared_refusal_is_exercised_by_this_file(self) -> None:
         it produces is exactly the set the module declares it can raise, so adding a code
         without a case here fails rather than going unnoticed."""
         cases = [
-            {},
+            {"CB_IN_ANTHROPIC_API_KEY": "k", "CB_IN_OPENAI_API_KEY": "o"},
             {"CB_IN_LLM": "not_a_provider"},
             {"CB_IN_LLM": "anthropic"},
             {"CB_IN_LLM": "license", **OIDC},

From 5aa8a9e337bd9562ea5deb636bd143089855f998 Mon Sep 17 00:00:00 2001
From: Svilen Stefanov <svilen.ks@gmail.com>
Date: Wed, 7 Oct 2026 01:18:46 +0200
Subject: [PATCH 2/2] feat: refuse a hosting run that names a model

Hosting runs on CodeBoarding's account, so CodeBoarding chooses the models
(spec D-13). The previous commit ignored a named model with a notice; this
refuses the run instead, as `hosted_with_model`, before the checkout.

A model named on a hosting run usually means the workflow meant to use its
own key and the secret is missing, so when no `llm` is set the refusal says
to check the secret. An AGENT_MODEL or PARSING_MODEL in the job's
environment counts too, since the engine reads them.

It also fixes the previous commit's wiring: the credential check never
received the model inputs, so nothing could see them. With the refusal in
place there is nothing to ignore, so the model-inputs output, the notice,
the summary row and the gated analysis name are gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                            |  5 ++-
 action.yml                           | 17 +++----
 scripts/action/credential_check.py   | 67 ++++++++++++++--------------
 scripts/action/verify-credentials.sh |  3 --
 scripts/action/with-auth.sh          |  5 ---
 tests/test_action_auth.py            | 65 ++++++++++-----------------
 tests/test_action_inputs.py          | 17 ++-----
 tests/test_llm_contract.py           | 16 +++++++
 8 files changed, 89 insertions(+), 106 deletions(-)

diff --git a/README.md b/README.md
index 6df8a57..b6b97ef 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,7 @@ input and which secret to fix.
 | `anthropic_api_key` + `openai_api_key` | refused: set `llm` to pick one |
 | `llm: hosted` | CodeBoarding hosting |
 | `llm: hosted` + any provider key | refused: pick one |
+| hosting + `model`, `agent_model` or `parsing_model` | refused: hosting chooses its own models |
 | `llm: license` | refused: license keys are retired, use `llm: hosted` |
 | `llm: anthropic` + `anthropic_api_key` | Anthropic, directly |
 | `llm: anthropic`, key empty or absent | refused: names the input and the secret |
@@ -255,7 +256,7 @@ Precedence is intentionally simple:
 
 Set only `model` when both jobs should use the same model. Set either specialized input only when that job needs a different model. Model identifiers are not secrets and can be stored in GitHub repository variables.
 
-On CodeBoarding hosting, CodeBoarding pays for the tokens and chooses the models. The three model inputs are ignored there, and so is an `AGENT_MODEL` or `PARSING_MODEL` set in the job's environment; the run's annotations and job summary say which inputs were ignored. They apply when the run uses your own provider key.
+On CodeBoarding hosting, CodeBoarding pays for the tokens and chooses the models. A hosting run that sets any of the three model inputs, or an `AGENT_MODEL` or `PARSING_MODEL` in the job's environment, is refused in its first seconds with the line to remove. A workflow without `llm` that sets a model but whose key secret is missing lands here too, so the refusal also says to check the secret. The model inputs apply when the run uses your own provider key.
 
 ## Keep the baseline current
 
@@ -344,7 +345,7 @@ With the default `github.token`, the repository or organization must allow GitHu
 | `<provider>_api_key` | both | empty | That provider's key, e.g. `anthropic_api_key`. See [Providers](#providers). |
 | `<provider>_base_url` | both | empty | That provider's endpoint, where it has one. |
 | `aws_bedrock_region` | both | empty | Bedrock region. Core defaults to `us-east-1`. |
-| `model` | both | empty | Default model for both analysis and parsing. Ignored on CodeBoarding hosting. |
+| `model` | both | empty | Default model for both analysis and parsing. Own key only: a hosting run that sets it is refused. |
 | `agent_model` | both | empty | Analysis-only override for `model`. |
 | `parsing_model` | both | empty | Parsing-only override for `model`. |
 | `depth_cap` | both | `2` | Positive integer maximum analysis depth, including full-analysis fallbacks, capped by the plan of whoever the run is charged to (3 on Free). Changing it rebuilds incompatible state. |
diff --git a/action.yml b/action.yml
index 1c4591c..75d6481 100644
--- a/action.yml
+++ b/action.yml
@@ -111,15 +111,15 @@ inputs:
     required: false
     default: ''
   model:
-    description: 'Optional model used for both analysis and parsing. Ignored on CodeBoarding hosting, where CodeBoarding chooses the models.'
+    description: 'Optional model used for both analysis and parsing. Not allowed on CodeBoarding hosting, which chooses its own models: the run is refused.'
     required: false
     default: ''
   agent_model:
-    description: 'Optional analysis-model override. Takes precedence over model. Ignored on CodeBoarding hosting.'
+    description: 'Optional analysis-model override. Takes precedence over model. Not allowed on CodeBoarding hosting.'
     required: false
     default: ''
   parsing_model:
-    description: 'Optional parsing-model override. Takes precedence over model. Ignored on CodeBoarding hosting.'
+    description: 'Optional parsing-model override. Takes precedence over model. Not allowed on CodeBoarding hosting.'
     required: false
     default: ''
   depth_cap:
@@ -255,6 +255,9 @@ runs:
       env:
         ACTION_PATH: ${{ github.action_path }}
         CB_IN_LLM: ${{ inputs.llm }}
+        CB_IN_MODEL: ${{ inputs.model }}
+        CB_IN_AGENT_MODEL: ${{ inputs.agent_model }}
+        CB_IN_PARSING_MODEL: ${{ inputs.parsing_model }}
         CB_IN_ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
         CB_IN_AWS_BEDROCK_API_KEY: ${{ inputs.aws_bedrock_api_key }}
         CB_IN_AWS_BEDROCK_REGION: ${{ inputs.aws_bedrock_region }}
@@ -399,11 +402,9 @@ runs:
         LLM_PROVIDER: ${{ steps.llm.outputs.provider }}
         BACKEND_ID: ${{ steps.llm.outputs.backend_id }}
         DEPTH_CAP: ${{ steps.preflight.outputs.depth_cap }}
-        # Empty on hosting, where with-auth.sh drops them too: the stored analysis is named
-        # for the models that actually ran.
-        MODEL: ${{ steps.llm.outputs.model_inputs != 'ignored' && inputs.model || '' }}
-        AGENT_MODEL_INPUT: ${{ steps.llm.outputs.model_inputs != 'ignored' && inputs.agent_model || '' }}
-        PARSING_MODEL_INPUT: ${{ steps.llm.outputs.model_inputs != 'ignored' && inputs.parsing_model || '' }}
+        MODEL: ${{ inputs.model }}
+        AGENT_MODEL_INPUT: ${{ inputs.agent_model }}
+        PARSING_MODEL_INPUT: ${{ inputs.parsing_model }}
       run: "$GITHUB_ACTION_PATH/scripts/action/state-names.sh"
 
     # Both lookups are best effort. Without them the run derives the base from
diff --git a/scripts/action/credential_check.py b/scripts/action/credential_check.py
index 65a62a7..706b89d 100755
--- a/scripts/action/credential_check.py
+++ b/scripts/action/credential_check.py
@@ -32,9 +32,11 @@
 SETTINGS_HINT = "Settings -> Secrets and variables -> Actions"
 TABLE = Path(__file__).resolve().parent / "supported-providers.json"
 
-#: The action's model inputs. On hosting CodeBoarding pays for the tokens, so it chooses the
-#: models: these inputs apply only where the run's own provider key pays (spec D-13).
+#: The action's model inputs, and the variables the engine reads a model from. On hosting
+#: CodeBoarding pays for the tokens, so it chooses the models (spec D-13): a run that names
+#: one there is refused. They apply where the run's own provider key pays.
 MODEL_INPUTS = ("model", "agent_model", "parsing_model")
+MODEL_ENVS = ("AGENT_MODEL", "PARSING_MODEL")
 
 
 #: Every reason this module can refuse a configuration.
@@ -47,6 +49,7 @@
 ERROR_CODES = frozenset(
     {
         "several_provider_keys",
+        "hosted_with_model",
         "unknown_llm",
         "missing_provider_key",
         "missing_id_token",
@@ -177,6 +180,33 @@ def _reject_provider_inputs(table: dict, given: dict[str, str]) -> None:
     )
 
 
+def _reject_model_choice(environ: dict[str, str], reason: str) -> None:
+    """Hosting runs on CodeBoarding's models, so a run there that names one is refused.
+
+    Refused rather than ignored: a model named on a hosting run usually means the workflow
+    meant to use its own key and its secret is missing, and an analysis on a model nobody
+    asked for would hide that. The job environment counts too, since the engine reads it.
+    """
+    chosen = [f"`{n}`" for n in MODEL_INPUTS if environ.get(f"CB_IN_{n.upper()}", "").strip()]
+    chosen += [f"`{v}` in the job's environment" for v in MODEL_ENVS if environ.get(v, "").strip()]
+    if not chosen:
+        return
+    what = ", ".join(chosen)
+    verb = "is" if len(chosen) == 1 else "are"
+    if reason:
+        message = (
+            f"{what} {verb} set, but this run uses CodeBoarding hosting because {reason}, and "
+            "hosting runs on CodeBoarding's models. If you meant to use your own provider key, "
+            f"check that its secret exists; otherwise remove {what}."
+        )
+    else:
+        message = (
+            f"`llm: hosted` runs on CodeBoarding's models, but {what} {verb} set. Remove {what}, "
+            "or set `llm` to your provider and wire its key to choose a model."
+        )
+    raise ConfigError("hosted_with_model", message)
+
+
 def _require_id_token(llm: str, environ: dict[str, str], reason: str = "") -> None:
     # Both, because the relay needs both (oidc_relay.py refuses to start without either)
     # and a runner can expose one without the other. Checking only the URL let that case
@@ -281,14 +311,9 @@ def resolve(table: dict, environ: dict[str, str]) -> dict:
 
     if llm == "hosted":
         _reject_provider_inputs(table, given)
+        _reject_model_choice(environ, reason)
         _require_id_token(llm, environ, reason)
-        return {
-            "tier": "hosted",
-            "provider": table["hosted_provider"],
-            "env": {},
-            "ignored_model_inputs": [n for n in MODEL_INPUTS if environ.get(f"CB_IN_{n.upper()}", "").strip()],
-            "reason": reason,
-        }
+        return {"tier": "hosted", "provider": table["hosted_provider"], "env": {}, "reason": reason}
 
     # Keys were retired completely, so the answer that ran on one is refused by name rather
     # than as an unknown value: the fix is one word, and the plan it paid for now follows
@@ -381,24 +406,6 @@ def reported_provider(plan: dict) -> str:
     return "" if plan["tier"] == "hosted" else plan["provider"]
 
 
-def model_inputs(plan: dict) -> str:
-    """`ignored` on the hosted tier, else `apply`. action.yml and with-auth.sh both key on it."""
-    return "ignored" if plan["tier"] == "hosted" else "apply"
-
-
-def model_notice(plan: dict) -> str:
-    """The sentence for a hosted run whose workflow set model inputs, or empty."""
-    ignored = plan.get("ignored_model_inputs") or []
-    if not ignored:
-        return ""
-    names = ", ".join(f"`{name}`" for name in ignored)
-    verb = "is" if len(ignored) == 1 else "are"
-    return (
-        f"{names} {verb} ignored: on CodeBoarding hosting, CodeBoarding chooses the models. "
-        "Model inputs apply when the run uses your own provider key."
-    )
-
-
 def plan_headline(table: dict, plan: dict) -> str:
     """The one line the log opens with. Same source as the summary, so they cannot drift."""
     if plan.get("reason"):
@@ -420,9 +427,6 @@ def plan_summary(table: dict, plan: dict) -> list[tuple[str, str]]:
     # Without `llm`, a secret that does not exist reads as empty and the run goes hosted.
     # This row is how someone who meant to use their own key finds out.
     rows.append(("Chosen", f"because {plan['reason']}" if plan.get("reason") else "by `llm`"))
-    if plan.get("ignored_model_inputs"):
-        ignored = ", ".join(f"`{name}`" for name in plan["ignored_model_inputs"])
-        rows.append(("Models", f"chosen by CodeBoarding on hosting; {ignored} ignored"))
     # Only where the run was pointed somewhere other than the default, since that is the
     # setting most likely to be wrong and least likely to be noticed.
     for var, value in sorted(plan["env"].items()):
@@ -438,7 +442,6 @@ def write_auth_dir(table: dict, plan: dict, auth_dir: Path) -> None:
     env_dir.mkdir(parents=True, exist_ok=True)
     (auth_dir / "tier").write_text(plan["tier"], encoding="utf-8")
     (auth_dir / "provider-name").write_text(plan["provider"], encoding="utf-8")
-    (auth_dir / "model-inputs").write_text(model_inputs(plan), encoding="utf-8")
     for var, value in plan["env"].items():
         (env_dir / var).write_text(value, encoding="utf-8")
     # Every variable core knows about, minus the ones this run actually resolved, so
@@ -506,8 +509,6 @@ def main(argv: list[str]) -> int:
             "provider": reported_provider(plan),
             "summary": "\n".join(f"| {k} | {v} |" for k, v in plan_summary(table, plan)),
             "headline": plan_headline(table, plan),
-            "model_inputs": model_inputs(plan),
-            "notice": model_notice(plan),
         },
         sys.stdout,
     )
diff --git a/scripts/action/verify-credentials.sh b/scripts/action/verify-credentials.sh
index f537ff1..9a7eddc 100755
--- a/scripts/action/verify-credentials.sh
+++ b/scripts/action/verify-credentials.sh
@@ -39,7 +39,6 @@ backend_id=""
   echo "tier=$tier"
   echo "backend_id=$backend_id"
   echo "provider=$provider"
-  echo "model_inputs=$(field model_inputs)"
   echo "error=$error"
   echo "message<<CB_EOF"
   echo "$message"
@@ -81,8 +80,6 @@ fi
 # and the summary cannot end up claiming different things -- which they did: this said
 # "your own openai key" for an endpoint-only run that resolved no key at all.
 field headline
-notice="$(field notice)"
-[ -z "$notice" ] || echo "::notice title=CodeBoarding models::${notice}"
 # The rows come from the check, which is the only thing that knows what it resolved.
 {
   echo "### CodeBoarding configuration"
diff --git a/scripts/action/with-auth.sh b/scripts/action/with-auth.sh
index 7c76372..0758629 100755
--- a/scripts/action/with-auth.sh
+++ b/scripts/action/with-auth.sh
@@ -36,11 +36,6 @@ done
 
 export CODEBOARDING_SOURCE=github_action
 unset ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_ID_TOKEN_REQUEST_TOKEN
-# On the hosted tier CodeBoarding chooses the models. Neither the workflow's model inputs nor
-# a model variable inherited from the job environment may pick one on CodeBoarding's account.
-if [ "$(cat "$AUTH_DIR/model-inputs" 2>/dev/null)" = ignored ]; then
-  unset MODEL AGENT_MODEL_INPUT PARSING_MODEL_INPUT AGENT_MODEL PARSING_MODEL
-fi
 if [ -n "${MODEL:-}" ]; then
   export AGENT_MODEL="$MODEL"
   export PARSING_MODEL="$MODEL"
diff --git a/tests/test_action_auth.py b/tests/test_action_auth.py
index bbf29f0..ecfcf96 100644
--- a/tests/test_action_auth.py
+++ b/tests/test_action_auth.py
@@ -366,6 +366,11 @@ def test_a_run_the_relay_saw_walled_ends_neutral_and_any_other_failure_does_not(
 
     # -- a workflow without `llm` ----------------------------------------------
 
+    _OIDC = {
+        "ACTIONS_ID_TOKEN_REQUEST_URL": "https://oidc.example/token",
+        "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "request-token",
+    }
+
     def test_an_unnamed_workflow_says_which_source_it_got_and_why(self) -> None:
         """A secret that does not exist reads as empty, so a workflow meant for its own key
         can land on hosting. The log's first line and the summary are how anyone finds out."""
@@ -383,52 +388,28 @@ def test_an_unnamed_workflow_says_which_source_it_got_and_why(self) -> None:
 
     # -- model choice ------------------------------------------------------
 
-    _OIDC = {
-        "ACTIONS_ID_TOKEN_REQUEST_URL": "https://oidc.example/token",
-        "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "request-token",
-    }
-
-    def test_the_hosted_tier_never_lets_the_workflow_pick_a_model(self) -> None:
-        """CodeBoarding pays for hosted tokens, so the model is CodeBoarding's choice.
-
-        Inputs and an inherited variable alike: a job-level `AGENT_MODEL` reaches the engine
-        as surely as the input does.
-        """
-        result, auth_dir, outputs = self._preflight(CB_IN_LLM="hosted", CB_IN_MODEL="big-model", **self._OIDC)
-        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
-        self.assertEqual(outputs["model_inputs"], "ignored")
-        self.assertEqual((auth_dir / "model-inputs").read_text(), "ignored")
-
-        scoped = self._with_auth(
-            'test -z "${AGENT_MODEL:-}" && test -z "${PARSING_MODEL:-}"',
-            MODEL="big-model",
-            AGENT_MODEL_INPUT="analysis-model",
-            PARSING_MODEL_INPUT="parsing-model",
-            AGENT_MODEL="inherited-model",
-            PARSING_MODEL="inherited-model",
-        )
-        self.assertEqual(scoped.returncode, 0, scoped.stderr or scoped.stdout)
-
-    def test_ignored_model_inputs_are_named_in_the_log_and_the_summary(self) -> None:
-        result, _, _ = self._preflight(CB_IN_LLM="hosted", CB_IN_MODEL="m", CB_IN_PARSING_MODEL="p", **self._OIDC)
-        notice = next(
-            line for line in result.stdout.splitlines() if line.startswith("::notice title=CodeBoarding models::")
-        )
-        self.assertIn("`model`, `parsing_model` are ignored", notice)
-        self.assertNotIn("agent_model", notice)
+    def test_a_hosting_run_that_names_a_model_is_refused_before_anything_runs(self) -> None:
+        """Hosting runs on CodeBoarding's models. A model named anyway fails the run in its
+        first seconds, in the log, the summary and the comment's text, and stages nothing."""
+        result, auth_dir, outputs = self._preflight(CB_IN_MODEL="big-model", **self._OIDC)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual(outputs["error"], "hosted_with_model")
+        self.assertIn("check that its secret exists", outputs["message"])
+        self.assertFalse(auth_dir.exists(), "credentials were staged for a refused run")
         summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
-        self.assertIn("| Models |", summary)
+        self.assertIn("CodeBoarding could not start", summary)
 
-    def test_a_hosted_run_without_model_inputs_says_nothing_about_models(self) -> None:
-        result, _, outputs = self._preflight(CB_IN_LLM="hosted", **self._OIDC)
-        self.assertEqual(outputs["model_inputs"], "ignored")
-        self.assertNotIn("::notice title=CodeBoarding models::", result.stdout)
-        summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
-        self.assertNotIn("| Models |", summary)
+    def test_a_model_inherited_from_the_job_counts_as_naming_one(self) -> None:
+        """The engine reads AGENT_MODEL from its environment, so a job-level one would pick a
+        model on CodeBoarding's account as surely as the input."""
+        _, _, outputs = self._preflight(CB_IN_LLM="hosted", AGENT_MODEL="inherited", **self._OIDC)
+        self.assertEqual(outputs["error"], "hosted_with_model")
+        self.assertIn("AGENT_MODEL", outputs["message"])
 
     def test_your_own_key_keeps_its_model_inputs(self) -> None:
-        _, _, outputs = self._preflight(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_MODEL="m")
-        self.assertEqual(outputs["model_inputs"], "apply")
+        result, _, outputs = self._preflight(CB_IN_ANTHROPIC_API_KEY="k", CB_IN_MODEL="m")
+        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
+        self.assertEqual(outputs["provider"], "anthropic")
 
     def test_analysis_refuses_to_run_without_a_resolved_plan(self) -> None:
         scoped = self._with_auth("true")
diff --git a/tests/test_action_inputs.py b/tests/test_action_inputs.py
index e2b7ecf..6d20414 100644
--- a/tests/test_action_inputs.py
+++ b/tests/test_action_inputs.py
@@ -148,20 +148,11 @@ def test_license_key_is_retired(self) -> None:
         self.assertNotIn("license_key", self.inputs)
         self.assertNotIn("CB_IN_LICENSE_KEY", ACTION)
 
-    def test_hosted_runs_name_their_stored_analysis_without_the_ignored_model_inputs(self) -> None:
-        """with-auth.sh drops the model inputs on the hosted tier; the analysis name must too,
-        or it would claim a model the run never used."""
-        start = ACTION.index("id: state")
-        block = ACTION[start : ACTION.index("\n      run:", start)]
-        for name, var in (
-            ("model", "MODEL"),
-            ("agent_model", "AGENT_MODEL_INPUT"),
-            ("parsing_model", "PARSING_MODEL_INPUT"),
-        ):
+    def test_model_inputs_reach_the_resolver(self) -> None:
+        """Hosting refuses a named model, which it can only do if it sees the inputs."""
+        for name in ("model", "agent_model", "parsing_model"):
             with self.subTest(input=name):
-                self.assertIn(
-                    f"{var}: ${{{{ steps.llm.outputs.model_inputs != 'ignored' && inputs.{name} || '' }}}}", block
-                )
+                self.assertIn(f"CB_IN_{name.upper()}: ${{{{ inputs.{name} }}}}", ACTION)
 
     def test_default_workflow_reviews_drafts_on_open_and_new_commits(self) -> None:
         self.assertNotIn("github.event.pull_request.draft", DOGFOOD)
diff --git a/tests/test_llm_contract.py b/tests/test_llm_contract.py
index 8e90362..b414757 100644
--- a/tests/test_llm_contract.py
+++ b/tests/test_llm_contract.py
@@ -144,6 +144,21 @@ def test_llm_settles_which_of_several_providers_runs(self) -> None:
         error = self.refuse(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_OPENAI_API_KEY="o")
         self.assertEqual(error.code, "foreign_provider_key")
 
+    def test_hosting_refuses_a_named_model_whichever_way_it_was_chosen(self) -> None:
+        for environ, hint in (
+            ({"CB_IN_LLM": "hosted", "CB_IN_MODEL": "m"}, "set `llm` to your provider"),
+            ({"CB_IN_AGENT_MODEL": "m"}, "check that its secret exists"),
+            ({"CB_IN_PARSING_MODEL": "m", "PARSING_MODEL": "m"}, "`PARSING_MODEL` in the job's environment"),
+        ):
+            with self.subTest(environ=environ):
+                error = self.refuse(**environ, **OIDC)
+                self.assertEqual(error.code, "hosted_with_model")
+                self.assertIn(hint, error.message)
+
+    def test_own_key_runs_choose_their_model_freely(self) -> None:
+        plan = self.resolve(CB_IN_ANTHROPIC_API_KEY="k", CB_IN_MODEL="m", AGENT_MODEL="a")
+        self.assertEqual(plan["provider"], "anthropic")
+
     def test_a_named_llm_carries_no_reason(self) -> None:
         """The workflow said what it wanted; there is nothing to explain."""
         self.assertEqual(self.resolve(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k")["reason"], "")
@@ -339,6 +354,7 @@ def test_every_declared_refusal_is_exercised_by_this_file(self) -> None:
         cases = [
             {"CB_IN_ANTHROPIC_API_KEY": "k", "CB_IN_OPENAI_API_KEY": "o"},
             {"CB_IN_LLM": "not_a_provider"},
+            {"CB_IN_LLM": "hosted", "CB_IN_MODEL": "m", **OIDC},
             {"CB_IN_LLM": "anthropic"},
             {"CB_IN_LLM": "license", **OIDC},
             {"CB_IN_LLM": "hosted"},