[wanglongan587]

Summary

frozen modelContext -> one private provider
  exact model ID -> primary + auxiliary model
  token env reference -> no literal in provider configuration
  bundled CLI -> acknowledgement -> prompt
packaging --agent-configuration -> identical target/copy bytes + digest association

Requires desktop#703. Draft dependency: the published SDK is 0.10.0. Update the formal pin and lock after 0.11.0 publication, then rerun ordinary checks before merging. Local preview imports are used only for validation, never committed as runtime dependencies.

Adds OpenAI Chat Completions / Anthropic Messages conversion, private state, disabled project routing, frozen discovery and model/authentication guards. Raw private diagnostics are suppressed with protocol error codes preserved. Default declaration publication remains off; opted-in archives are read back and compared with immutable static-copy bytes.

ADR: plugin-owned-model-adapters remains approved. This delivers the adapter and publication boundary, not host rollout or final production acceptance.

Refs ora-space/circus#336

Evidence

• Before: the plugin had no declared model conversion or bound declaration publication.
  After: full preview source checks, lint and 6 tests pass, covering both protocols, embedded model slashes, error privacy, frozen-model guards and archive digest mismatch.
• Verified pinned OpenCode 1.19.3 artifact checksum. Controlled native CLI runs completed two turns plus a local tool for each of two synthetic Messages bindings. A separate OpenAI run preserved a slash-containing model ID across two turns. All inference requests matched their binding; token scans of ACP, stderr and private HOME were clean.
• Published-SDK checks remain blocked pending 0.11.0. Unit tests are available through deno task test; the existing CI check/lint workflow remains unchanged.

Merge Danger

Door: two-way

No publication is performed. Declaration packaging is an explicit opt-in requiring compatible deployed hosts; universal artifacts cannot claim the bundled model contract.

Blast Radius: opencode-adapter

Keep this draft until SDK pin/lock and normal CI are complete. Connections/defaults remain Cloud-owned; this plugin converts only the frozen binding.

Refs ora-space/circus#354