[flujo-app]

Cloud lite workers could only use the subscription login: every Codex configuration was forced to that login, deploy required an auth broker, and repositories were cloned with a GitHub token. This lets them run on a self-hosted OpenAI-compatible model instead, and ships it as 0.4.0.

All new settings are optional; existing plans behave as before (one exception below).

• plan.modelProvider: Codex gets a provider configuration for the Responses API, with the model's real context window and compaction point. Web search, multi-agent, apps, plugins, goals, memories and skill instructions are off, and agent commands inherit only the core environment. The key goes in deploy(plan, { providerKey }) as a staged app secret. It is placed only in the Codex process environment and redacted from journals and traces. Machine i uses baseUrls[i % n], so each machine keeps its prompt cache on one server.
• deploy(plan, { deployKey }): clones over SSH with a read-only deploy key and GitHub's published host key pinned. There is no gh login and agents get no Git credential. The bundle bootstrap adds openssh-client.
• plan.prepare: a hook that runs once per machine after the pinned clone. It returns each agent's folder, writable roots and instructions. A restarted machine reuses the recorded result instead of cloning again.
• plan.supervision: 'operator': agents start idle and every turn comes from fleet.command(...). Also plan.sandbox (workspace-write / read-only) and plan.boardTools: false. Verified workflows refuse operator supervision and disabled board tools, because they need both.
• Traces: streaming deltas are no longer recorded. They are most of all notifications and carry no state; item/completed has the same content. plan.traceDeltas: true restores them; this is the one default change. plan.monitorIntervalMs sets how often machines read operator commands.
• Dependencies: a second commit applies npm audit fix within existing ranges (body-parser, zod, fast-uri, ip-address, qs). Without it, the production audit gate fails on new high-severity advisories, on current main as well.
• Docs: PUBLIC_SDK.md gains a short guide with Qwen3.8-27B (H100) and Nemotron 3.5 Super VL NVFP4 (B300) examples. It covers context window and compaction values and the measured numbers from a 190-agent coding run on one B300.

The same changes have run on real Fly fleets, but no new live cloud or model run was made for this PR.

Fixes #9

Local CI (AGENTS.md)

Same steps as .github/workflows/public-sdk.yml, from a clean tracked-source export of commit 7a36b4f (git archive) with a fresh npm ci:

Platform	Node / npm	npm audit (prod, high)	Focused SDK tests	Packed install + verify-public-sdk	CLI help (factory, factory-lite, factory-evidence)	Installed MCP stdio	Generic evidence regressions
Windows 10 (portable Node)	22.17.0 / 10.9.2	0 vulnerabilities	185/185	ok	ok	1/1	7/7
Windows 10 (portable Node)	24.22.2 / 11.19.1	0 vulnerabilities	185/185	ok	ok	1/1	7/7
Linux (Docker node:22.17.0-bookworm)	22.17.0 / 10.9.2	0 vulnerabilities	185/185	ok	ok	1/1	7/7
Linux (Docker node:24.22.2-bookworm)	24.22.2 / 11.19.1	0 vulnerabilities	185/185	ok	ok	1/1	7/7

The focused list now includes test/cloud-lite-provider.test.mjs (8 new tests), which the workflow also runs. Those tests cover plan validation, the provider Codex configuration and key isolation, sandbox and board-tool settings, delta classification, the prepare hook, provider and deploy-key deploys without a subscription broker, key redaction in uncertain outcomes, and observation without a refresh. scripts/verify-public-sdk.mjs also checks provider plan validation in the packed package.

On Windows the archive-based tests need the system tar.exe ahead of Git's GNU tar on PATH, as on a normal Windows shell.