Document --config's OAuth-compose behavior, add wiring-level effort rejection test

--config is a general CLI flag, not eval-only: it now composes with
home-level codex/xai OAuth credentials instead of excluding them.
Document that in docs/PRODUCT.md and docs/IMPLEMENTATION.md (prose
and flag table) so an operator relying on --config to pin a
single API-key provider on a shared/CI machine knows OAuth sessions
in ~/.corbits/codex-auth.json / xai-auth.json now apply too when
their config names a codex/* or xai/* provider.

Export validateVariantEfforts and add a wiring-level test exercising
the full parseArgs -> parseMatrix -> validateVariantEfforts path for
an unsupported model/effort matrix cell (grok-composer-2.5-fast:xhigh),
plus the matching accept case.

Author: TheGreatAxios

docs/IMPLEMENTATION.md

@@ -283,6 +283,8 @@ OpenAI-compatible `baseURL` values are normalized during provider resolution. A
 
 `--config <path>` replaces the global settings file as the provider source (useful for CI to inject a provider per run). The per-repo `.corbits/settings.json` selection still applies on top of a `--config` source (definitions come from `--config`, selection from the local file; CLI `--provider`/`--model` override both). A provider must be defined in one of these settings files; there is no environment-variable fallback.
 
+`--config` composes with, rather than replaces, the home-level OAuth profile catalog: codex/xai credentials live in `~/.corbits/codex-auth.json` and `xai-auth.json`, entirely separate from settings.json, and are merged into the resolved provider catalog on every run regardless of `--config` (CL-6973). A `--config` file that names a `codex/*` or `xai/*` provider by ID does not by itself grant that provider's credentials — those come from the OAuth store whenever a matching profile exists there, independent of which settings file supplied the provider definitions. The only way to fully exclude the home OAuth catalog is the programmatic `globalSettingsPath` option to `loadConfig`, used by tests for full isolation; it is not exposed as a CLI flag.
+
 ### Profiles (`src/config/profiles.ts`)
 
 Profiles supply per-project or named-profile overrides for `model`, `maxTurns`, and `systemPromptExtensions` (the only allowed keys; any other key is rejected on load).
@@ -323,7 +325,7 @@ Printed by `corbits --help` / `-h` from `CLI_HELP_TEXT` in `src/config/index.ts`
 | `resume <session-id>`            | —                          | Reopen a specific session                                                                                                                                                                                                                                                    |
 | `resume --pick` / `--list`       | —                          | Interactive session picker                                                                                                                                                                                                                                                   |
 | `--cwd <dir>`                    | `process.cwd()`            | Working directory                                                                                                                                                                                                                                                            |
-| `--config <path>`                | `~/.corbits/settings.json` | Settings file to use                                                                                                                                                                                                                                                         |
+| `--config <path>`                | `~/.corbits/settings.json` | Settings file to use for provider definitions; composes with (does not exclude) home-level codex/xai OAuth credentials                                                                                                                                                       |
 | `--provider <name>`              | from settings              | Select a configured provider                                                                                                                                                                                                                                                 |
 | `--model <id>`                   | provider default           | Select a model for the active provider                                                                                                                                                                                                                                       |
 | `--profile <name>`               | —                          | Settings profile                                                                                                                                                                                                                                                             |

docs/PRODUCT.md

@@ -132,7 +132,7 @@ The exact turn thresholds are model-family-dependent (tighter for models with ob
 
 ## Configuration
 
-Providers and models are configured in `~/.corbits/settings.json` (holds providers + credentials), with a selection-only per-repo `.corbits/settings.json` override. Select at launch with `--provider` / `--model`, or point at an alternate file with `--config <path>`. Credentials are read only from these settings files — there is no environment-variable override and `.env` files are not loaded, so a stale or exported key can't shadow the configured provider. The agent is denied read access to both settings files.
+Providers and models are configured in `~/.corbits/settings.json` (holds providers + credentials), with a selection-only per-repo `.corbits/settings.json` override. Select at launch with `--provider` / `--model`, or point at an alternate file with `--config <path>`. `--config` only overrides where provider _definitions_ come from; it composes with, rather than replaces, credentials for codex/xai OAuth-profile providers, which live in separate home-level auth stores (`~/.corbits/codex-auth.json`, `xai-auth.json`) and are merged into the catalog regardless of `--config`. Credentials are read only from these settings files and the OAuth auth stores — there is no environment-variable override and `.env` files are not loaded, so a stale or exported key can't shadow the configured provider. The agent is denied read access to both settings files.
 
 ## Optional Capabilities (plugins)
 

scripts/eval-capability.test.ts

@@ -5,7 +5,14 @@ import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-import { initEvalGitRepo, mapPool, parseArgs, buildEvalDiagnostics } from "./eval-capability.js";
+import {
+  initEvalGitRepo,
+  mapPool,
+  parseArgs,
+  buildEvalDiagnostics,
+  validateVariantEfforts,
+} from "./eval-capability.js";
+import { parseMatrix } from "../evals/capability/lib.js";
 import type { Config } from "../src/config/index.js";
 
 const execFileAsync = promisify(execFile);
@@ -174,6 +181,35 @@ describe("parseArgs", () => {
   });
 });
 
+describe("validateVariantEfforts", () => {
+  // Wiring-level regression: parseArgs -> parseMatrix -> validateVariantEfforts,
+  // the same path main() runs before any inference. A matrix cell pairing an
+  // effort the model does not accept must fail fast, naming the model and its
+  // accepted levels, rather than silently falling back to the provider default
+  // and poisoning the matrix.
+  test("rejects an unsupported model/effort matrix cell before any inference runs", async () => {
+    const opts = parseArgs(["--matrix", "xai/thegreataxios:grok-composer-2.5-fast:xhigh"]);
+    const variants = parseMatrix(opts.matrix, {
+      ...(opts.provider !== undefined ? { provider: opts.provider } : {}),
+      ...(opts.model !== undefined ? { model: opts.model } : {}),
+      ...(opts.effort !== undefined ? { effort: opts.effort } : {}),
+    });
+    await expect(validateVariantEfforts(variants, opts)).rejects.toThrow(
+      /grok-composer-2\.5-fast.*does not support reasoning effort "xhigh".*supported: low, medium, high/s,
+    );
+  });
+
+  test("accepts a supported model/effort matrix cell", async () => {
+    const opts = parseArgs(["--matrix", "xai/thegreataxios:grok-4.6:xhigh"]);
+    const variants = parseMatrix(opts.matrix, {
+      ...(opts.provider !== undefined ? { provider: opts.provider } : {}),
+      ...(opts.model !== undefined ? { model: opts.model } : {}),
+      ...(opts.effort !== undefined ? { effort: opts.effort } : {}),
+    });
+    await expect(validateVariantEfforts(variants, opts)).resolves.toBeUndefined();
+  });
+});
+
 describe("mapPool", () => {
   test("N overlapping jobs with concurrency N finish in ~one job duration", async () => {
     const jobMs = 80;

scripts/eval-capability.ts

@@ -583,7 +583,7 @@ async function resolveVariantLabels(
  * gpt-5.6 family also takes max/ultra) — silently running at the provider's
  * default instead would poison a matrix without anyone noticing.
  */
-async function validateVariantEfforts(
+export async function validateVariantEfforts(
   variants: readonly EvalVariant[],
   opts: CliOptions,
 ): Promise<void> {