Eve provider and subprocessor review — 2026-09

Task 14.2 reviews 103 concrete or explicitly absent routes. The executable decision is posture → capability/quality → price. A key, login, model override, endpoint override, or cheaper global endpoint cannot admit an unreviewed route. The independently maintained production census at docs/audits/eve-sota-provider-subprocessor-review/production-route-census.json defines the route universe; generation cannot silently define its own completeness.

Runtime decisions#

• The repository owner decided on 2026-09-19 (docs/audits/eve-sota-provider-subprocessor-review/owner-attestations/2026-09-19-openrouter-global-route.json) that OpenRouter in-region routing is optional. The turn, embedding, and vision routes use the global API host unless a deployment sets OSHUN_ASSISTANT_OPENROUTER_REGIONAL_ROUTING_ATTESTED=true, which selects the US or EU host; a value that is neither true nor false, or an unknown data region, resolves no route. On either host every request carries exact reviewed model/endpoint pins, data-collection denial, and ZDR. Vision also pins Google Vertex to the selected US or EU data region and disables fallback. Process-wide route overrides are ignored. No regional residency is claimed.
• The escalation registry entry spans eight mutable FP8 downstreams and has no exact provider allowlist. Its runtime binding is therefore absent and the route is not dispatchable.
• The repository owner attested hosted media on 2026-09-15 (docs/audits/eve-sota-provider-subprocessor-review/owner-attestations/2026-09-15-isis-hosted-media.json) for the Isis generation API only: operator tenant, operator-owned non-personal SFW inputs, vendor posture accepted as published with no ZDR, DPA, residency, or negotiated incident terms. The Isis Meshy lane is admitted through its source gate; the planned Isis OpenRouter media lane is attested but not dispatchable until a client is bound and re-reviewed. Oshun BFF OpenRouter media resolvers stay blocked.
• Alternate assistant, Sophia, lecture, autonomy, accessibility, moderation, content-service, Ori, other hosted media, narration, Tara, Aphrodite age verification, artifact-rights transfer, Hathor services, Rail authorities, and signup-email provider composition is source-gated off. Native Anthropic, native OpenAI, Codex transports, OpenRouter audio, Whisper, Cartesia, ElevenLabs, and Telegram-compatible speech remain blocked where their posture is incomplete or their production target is not source-owned.
• Assistant-library vision, web-search, and web-fetch tools are explicitly enumerated; they are not wired into the production BFF. The environment-only signup challenge placeholder was removed because a local identifier cannot prove remote challenge issuance or verification.
• Deepgram STT sends mip_opt_out=true on every request. The lower-level ElevenLabs client sends enable_logging=false, but production selection stays blocked because ZRM alone does not establish its complete posture.
• The only external human-video catalogue route is limited to public provider metadata with no member payload and cannot promote a render route. Local media subprocesses are identified separately; external render providers remain blocked. Reranking is explicitly absent. Computer-use planning is configured-unwired and its cheaper Bedrock global route is not region-admitted.

Route ledger#

Channel boundary#

Channel delivery is not ZDR model inference. Task 14.2 does not claim that payload minimization is complete; Task 14.3 owns that enforcement. No channel has automatic price failover. The production environment composition rejects arbitrary signup email, dynamic SMTP, WhatsApp, and Telegram speech even when credentials or self-declared review ids are present; source-owned reviewed-target registries are required before those routes can dispatch. IMAP/SMTP assistant and Twilio voice are library-only, and recipient-selected Web Push is separately classified. Fixed delivery endpoints retain explicit public-material and deployment-dependent findings rather than being mislabeled as ZDR model routes.

Upstream reconciliation#

Task 14.1 remains an immutable historical snapshot. This review maps every one of its provider targets and implementation legs, supersedes its now-stale active escalation disposition, and adds the alternate text, accessibility, moderation, media, signup delivery, Ori authority, Telegram speech, and Twilio voice surfaces that snapshot omitted.

Evidence boundary#

A reconstructed operator record says a prior synthetic request received HTTP 403 at the US regional host. Because the receipt was reconstructed later and retained no contemporaneous response body or timing, it is an unverified historical observation. On 2026-09-19 the same request was measured contemporaneously: the US regional host answered HTTP 403 "Regional routing not enabled for this account" and the global host answered HTTP 200 on the same key and model, and one completion through the real Eve binding was served inside the response-provider allowlist. That measurement is retained in the owner attestation of that date.

Sources and limitations#

The machine-readable record at docs/audits/eve-sota-provider-subprocessor-review/2026-09-15.json contains all eight independent posture dimensions, explicit per-source dimension applicability, official primary-source URLs, byte-bound implementation sources, controls, decisions, reconciliation, and limitations. This is an engineering review, not legal advice. Public terms cannot prove deployment-specific enterprise settings.