From 82fbde8a68fc97134d5af32169b8133e93f7b730 Mon Sep 17 00:00:00 2001
From: Advait Jayant <advait@vannalabs.ai>
Date: Wed, 24 Jun 2026 17:20:14 +0100
Subject: [PATCH] Remove Nous Portal / external-provider options; document
 og-veil-only routing

ghost routes everything through one path (scrubber -> og-veil -> TEE gateway) and
deliberately uses no external provider. The config shipped an upstream fallback-
provider doc block advertising Nous Portal, OpenRouter, Claude, Z.AI, Kimi, etc. as
configurable -- which contradicts that design. Replace it with ghost's actual
single-path policy (no Nous Portal, no OpenRouter, no direct Claude/GPT). Also fix
the stale install message (default is deepseek-v4-pro, not nous/hermes-4-405b).
---
 install.sh          |  4 ++--
 profile/config.yaml | 26 ++++++--------------------
 2 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/install.sh b/install.sh
index 0384a8e..1d30d67 100644
--- a/install.sh
+++ b/install.sh
@@ -231,8 +231,8 @@ say "Smoke test"
 
 say "ghost installed -- run:  ghost"
 case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) echo "   (add ~/.local/bin to your PATH first)";; esac
-echo "   Hosted default = nous/hermes-4-405b via og-veil -> the OpenGradient TEE gateway (OHTTP-private)."
-echo "   Inside ghost, /model switches between hosted models and the local 32B (true incognito)."
+echo "   Hosted default = deepseek/deepseek-v4-pro via og-veil -> the OpenGradient TEE gateway (OHTTP-private)."
+echo "   Inside ghost, /model switches between hosted models and the local model (true incognito)."
 echo "   Personalize $PRIV/pii_denylist.txt with your name/email/handles for the hosted-path scrubber."
 [ -n "$USE_PROXY" ] || echo "   Direct mode (default). For IP-masking from the relay, reinstall with GHOST_PROXY=1."
 echo "   Not connected yet? Run:  ghost-login"
diff --git a/profile/config.yaml b/profile/config.yaml
index 613945c..ffd3773 100644
--- a/profile/config.yaml
+++ b/profile/config.yaml
@@ -666,23 +666,9 @@ known_plugin_toolsets:
   - spotify
 
 # ── Fallback Model ────────────────────────────────────────────────────
-# Automatic provider failover when primary is unavailable.
-# Uncomment and configure to enable. Triggers on rate limits (429),
-# overload (529), service errors (503), or connection failures.
-#
-# Supported providers:
-#   openrouter   (OPENROUTER_API_KEY)  — routes to any model
-#   openai-codex (OAuth — hermes auth) — OpenAI Codex
-#   nous         (OAuth — hermes auth) — Nous Portal
-#   zai          (ZAI_API_KEY)         — Z.AI / GLM
-#   kimi-coding  (KIMI_API_KEY)        — Kimi / Moonshot
-#   kimi-coding-cn (KIMI_CN_API_KEY)   — Kimi / Moonshot (China)
-#   minimax      (MINIMAX_API_KEY)     — MiniMax
-#   minimax-cn   (MINIMAX_CN_API_KEY)  — MiniMax (China)
-#   bedrock      (AWS IAM / boto3)     — AWS Bedrock (Converse API)
-#
-# For custom OpenAI-compatible endpoints, add base_url and key_env.
-#
-# fallback_model:
-#   provider: openrouter
-#   model: anthropic/claude-sonnet-4
+# ghost routes ALL inference through ONE path: the local scrubber -> og-veil -> the
+# OpenGradient TEE gateway. It deliberately does NOT use any external provider --
+# no Nous Portal, no OpenRouter, no direct Claude/GPT/Gemini -- because that would
+# bypass the privacy guarantee (OHTTP + TEE) and the unrestricted-only policy.
+# The fallback is set in `fallback_model` at the top of this file: a hosted
+# unrestricted model via og-veil by default, or a local model with GHOST_LOCAL=1.