[PanAchy]

Summary

• Add built-in OpenAI Decisions (gpt-6-luna) and experimental Microsoft-Decision-1 choices to configuration and assisted setup. OpenAI translates predicates to keyed probability answers; Microsoft uses the configured Foundry deployment with Azure API-key authentication over HTTPS.
• Share HTTP failure handling without conflating the two API formats. Keep Jev's existing questions, thresholds, dependency pins, and host permission behavior unchanged.
• Add a searchable provider picker. Keep the README changes conservative: one table grouped by API format, existing presentation preserved, and separate OpenAI and Microsoft setup guides.
• Make the default lint command apply fixes; retain read-only lint in npm run check.

Verification

• Added deterministic HTTP contract, configuration, provider-to-permission-engine, and terminal setup tests
• npm run check: passed, including 453 tests in 38 files, typechecking, read-only lint, and build
• npm run lint: passed with automatic fixes enabled
• npm run smoke: passed sequential package, OpenCode, and Claude smokes; packed setup passed 12 scenarios without provider calls
• git diff --check: passed
• Added a changeset for the new integrations and setup behavior

GitHub CI passed on 0cbd63b: Check, OpenCode and Claude host smokes, and all six Linux/Windows/macOS x64/arm64 package jobs. The one-shot matrix label was removed after completion.

Verification limits

• Microsoft is explicitly experimental. The Foundry guide documents the request and authentication, but does not publish an exact Noul response fixture. Tests use synthetic standard System One responses, not captured Foundry responses. Live Foundry compatibility remains unverified.
• Microsoft supports API keys only here. Azure CLI / Microsoft Entra authentication was researched but is not implemented in this PR.
• Follow-up assessment found a calibration limitation: the current analyzer compares the requested deployment name with the reported model name. A valid Microsoft response with different names will fail that gate even if all behavioral checks pass. This is reproduced with a synthetic fixture; the identity contract needs review before claiming that arbitrary deployment names can complete calibration.
• No paid/live OpenAI or Microsoft inference, Azure login, or account creation was performed. API compatibility does not transfer Jev's calibration evidence to another model; users must calibrate their policy for that model.
• No merge, version bump, or publication is included. Release PR chore: version packages #49 remains outside this work.

Permission contract

• Uses the existing host shell approval boundary rather than a general pre-tool event
• Preserves host allow and deny decisions finalized before Jevvy
• Requires every inquiry to allow every resource and the complete command
• Leaves the host's remaining permission flow unchanged on uncertainty or failure
• Keeps credentials and policy outside repositories