I3660 — A vendor declares its funding sources in the model catalogue, each with dated, quoted vendor evidence

○READY wave 0 · p2 · implementation profile · parallel safe

Part of every-model-call-is-paid-from-a-declared-source — How a model call Majordomus starts can be paid is declared by the vendor with evidence, and each call names the source it was declared to draw on.

Objective

Add a `funding` list to each vendor of share/models.yaml (ADR 0049): each source with an id, a kind (local, credit_grant, subscription or metered), the credential variable that reaches it or a note that a client login does, the period it renews over where the vendor states one, the vendor-domain page where the owner claims it, and evidence (page, day read, the vendor's own words); extend models::Vendor; report a source that cannot be read (no evidence, an unknown kind) as a diagnostic naming the vendor and the source while the rest of the catalogue loads; make reasoning check forbid every declared credential variable in CI, not only the vendor's.

Why

The catalogue knows a vendor's credential variable and nothing about how a call through it is paid, while the vendor's documentation (code.claude.com/docs/en/authentication, read 2026-10-21) shows a subscription seat reached through Claude Code's login or CLAUDE_CODE_OAUTH_TOKEN and API use reached through ANTHROPIC_API_KEY, and the owner's Max plan now includes a monthly credit grant claimed at claude.ai/settings/billing (where clau.de/api-credits redirects, observed 2026-10-21). The grant and metered billing share that one key, so the catalogue names both and states no draw order the vendor does not. reasoning/catalogue.rs loads the same file, so one bad source must not take every advisor down (critique finding new-credential-variables-escape-the-ci-guard).

Current state

share/models.yaml declares id, title, inference and credential_env per vendor; no funding source exists; reasoning check collects CI-forbidden variables from vendor.credential_env only.

Desired state

Every vendor lists its funding sources with vendor evidence, an unreadable source is a diagnostic, models.list shows them, and no field can carry an amount.

Scope

• share/models.yaml
• apps/majordomus-cli/src/models/mod.rs
• apps/majordomus-cli/src/reasoning/check.rs
• docs/generated
• share/schemas/generated

Out of scope

• Which sources the owner holds, any amount, cap, price or balance
• Routing by funding source

Dependencies

None. This issue is a root of the graph.

What waits on this

• I3292✕BLOCKED Reported tokens, a price-list estimate and a billed amount are three fields, and the billing mode says which account paid
• I3661!CANCELLED Which funding sources the owner holds, and their caps, are the owner's local declaration and never projected
• I3662!CANCELLED models.route names the funding source a route would draw on, as an inference with its basis, in the declared source order
• I3665✕BLOCKED A benchmark run and an advisor consultation carry the funding kind the owner declared for them, or unknown
• I3666!CANCELLED Spend against a funding source is observed from a named vendor seam or recorded absent, and no balance is derived from a price

Acceptance criteria

• Anthropic declares subscription, credit_grant and metered sources and OpenAI its own, each with an evidence page, day and quote; Ollama and LM Studio declare local
• The credit grant's claim page is the vendor-domain page clau.de redirects to, not the shortlink
• A source without evidence, or of an unknown kind, is a diagnostic naming the vendor and the source, and the catalogue's other entries still load (test)
• No property of the catalogue schema is named for an amount, price, balance, cost or currency (test)
• reasoning check forbids a source's own credential variable in CI as it forbids the vendor's (test)
• models.list carries the sources, and majordomus generate --check is clean

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib models::
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib reasoning::check
• majordomus generate --check

Evidence required

• test_a_funding_source_without_evidence_is_refused

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3660.yaml. Read it back with majordomus plan show I3660.