# providers.toml — reviewed cloud providers gating outbound model calls (PRD §6)
#
# A cloud model call is refused unless its provider is listed here, its review date
# is within the 12-month expiry window, and the payload does not exceed highest_data_class.
#
# Fields:
#   highest_data_class = "c0" | "c1"   # highest data class allowed off-host to this provider
#   reviewed_at        = "YYYY-MM-DD"  # review date; valid for 12 months from this date
#   why                = "..."         # review justification and privacy policy evaluation
#   ring               = "trusted"     # optional; absent means a harness on it runs contained
#   hosts              = ["..."]       # API hosts a contained run's egress proxy admits

[nvidia-nim]
highest_data_class = "c0"
reviewed_at = "2026-08-30"
why = "NVIDIA NIM free-tier hosted inference for public content (c0) and public feed summarization. Evaluated 2026-08-30."
hosts = ["integrate.api.nvidia.com"]

[openai]
highest_data_class = "c1"
reviewed_at = "2026-08-25"
why = "OpenAI API zero-data-retention agreement, approved for pseudonymized c1 derivatives only. Evaluated 2026-08-25. Operator decision 2026-11-04: ring trusted, so Codex and pi on OpenAI read Sjel fully."
hosts = ["api.openai.com"]
ring = "trusted"

[anthropic]
highest_data_class = "c1"
reviewed_at = "2026-11-04"
why = "Claude (Claude Code, API or subscription). Operator decision 2026-11-04: a harness on Anthropic or OpenAI reads Sjel fully; every other provider reaches only the demo node (docs/plans/containment.md). Training opt-out on the account: not recorded here, unverified."
hosts = ["api.anthropic.com"]
ring = "trusted"

[openrouter]
highest_data_class = "c0"
reviewed_at = "2026-08-30"
why = "OpenRouter hosted inference with privacy logging disabled, approved for c0 public content only. Evaluated 2026-08-30."
hosts = ["openrouter.ai"]

[google]
highest_data_class = "c0"
reviewed_at = "2026-08-30"
why = "Google AI Studio / Gemini API free tier, approved for c0 public content only. Evaluated 2026-08-30."
hosts = ["generativelanguage.googleapis.com"]

[deepseek]
highest_data_class = "c0"
reviewed_at = "2026-10-24"
why = "DeepSeek API, approved for c0 public content only: the Pi/Sjel agent comparison on DeepSeek V4.1 Flash (operator decision 2026-10-24, research/benchmarks/agent-harness/README.md). Its privacy policy (last updated 2026-02-10, cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html) states that personal data is collected, processed and stored in the People's Republic of China, kept as long as the account exists, and may be used to train models; the only stated opt-out is an email to privacy@deepseek.com. Nothing above c0 goes to this provider."
hosts = ["api.deepseek.com"]

[some-provider]
highest_data_class = "c1"
reviewed_at = "2026-09-01"
why = "Test fixture provider for test suites."