[SaladDay]

Deployment defaults and public Agent/Session inputs now resolve one model configuration: provider connection, model and adapter-owned native parameters. Sessions freeze the result; changing a model or provider clears inherited native parameters unless explicitly supplied. Self-hosted Sessions never read deployment defaults.

Harness declarations drive both Core admission and Runtime preparation. Native parameters reach the SDK or native Turn settings, while unqualified conversion requirements are rejected before submission or upstream forwarding. Provider credentials remain encrypted and write-only. The Web form uses the shared declarations.

The Core administration resource is now /core/v1/harnesses/{harness}/model-configuration; the old /model-provider route is removed.

Validation:

• Full make check in CI, including browser acceptance; official-client and Linux/macOS/Windows native checks.
• Integrated TypeScript checks and all 753 client tests; focused inheritance, immutable snapshot, converted-route and native adapter regressions.
• One real Claude Anthropic run with effort: low: parameter snapshot, function results, cancellation, continuation and Runtime restart recovery passed. This does not claim that the model precisely obeyed the requested effort.
• Pinned Codex 0.153.4 with a local synthetic provider confirmed the configured effort reaches upstream requests; adapter tests cover new, reused and resumed Turns.
• Final independent blind review found no substantiated in-scope issues.