Step 1 · Operations evidence · Operations evidence · Architecture and source truth PT-BREN
CLIProxyAPI 7.2.70 · kimi-k3 · Visual course

Architecture and source truth

Before changing a route, identify the file that actually controls the service and confirm it at the live endpoint.

Read first (primary source)
CONFIG-MODEL-POLICY-EVIDENCE.md

A redacted local record for the running gateway and the kimi-k3 example.

Read the simple version or open technical detail in any section.
1

Big idea

Before changing a route, identify the file that actually controls the service and confirm it at the live endpoint.

Think of it as… The gateway is an airport tower: the configuration mirror is a flight plan, while the departure board is the process on 127.0.0.1:8317. The analogy breaks because software can start from a different file..

Under the hood

Compare the active /opt/homebrew/etc/cliproxyapi.conf, config.yaml, and authenticated GET /v1/models; each has a different role.

2

In one picture

01 · active config pathactive config pathgovernsmirror byte identityThe active configuration is /opt/homebrew/etc/cliproxyapi.conf.
active config path — governs — The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
3

In the code

This is the real local path and a safe read-only command.

/opt/homebrew/etc/cliproxyapi.conf 
# trecho real, não editado
cmp /opt/homebrew/etc/cliproxyapi.conf /Users/acf/.cli-proxy-api/config.yaml
node -e "JSON.parse(require('fs').readFileSync('max-token-policy.json'))"

Open it yourself

cmp /opt/homebrew/etc/cliproxyapi.conf /Users/acf/.cli-proxy-api/config.yaml node -e "JSON.parse(require('fs').readFileSync('max-token-policy.json'))"

4

Try it

Use the controls to retrieve the evidence before reading the explanation.

02 · mirror byte identitymirror byte identitymatchesHomebrew service listenerThe authenticated endpoint returned 13 IDs.
mirror byte identity — matches — The authenticated endpoint returned 13 IDs.
03 · Homebrew service listenerHomebrew service listenerroutes toauthenticated model endpointThe live/mirror hash proves file equality.
Homebrew service listener — routes to — The live/mirror hash proves file equality.
04 · authenticated model endpointauthenticated model endpointexcludesexact 13-model setThe active configuration is /opt/homebrew/etc/cliproxyapi.conf.
authenticated model endpoint — excludes — The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
05 · exact 13-model setexact 13-model setprovespublic alias inventoryThe authenticated endpoint returned 13 IDs.
exact 13-model set — proves — The authenticated endpoint returned 13 IDs.
06 · public alias inventorypublic alias inventoryboundspolicy key coverageThe live/mirror hash proves file equality.
public alias inventory — bounds — The live/mirror hash proves file equality.
07 · policy key coveragepolicy key coveragemaps toconfiguration SHA-256The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
policy key coverage — maps to — The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
08 · configuration SHA-256configuration SHA-256restarts asrestart PID transitionThe authenticated endpoint returned 13 IDs.
configuration SHA-256 — restarts as — The authenticated endpoint returned 13 IDs.
09 · restart PID transitionrestart PID transitionpreserveslocalhost bindThe live/mirror hash proves file equality.
restart PID transition — preserves — The live/mirror hash proves file equality.
10 · localhost bindlocalhost bindcompares withupstream observationThe active configuration is /opt/homebrew/etc/cliproxyapi.conf.
localhost bind — compares with — The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
11 · upstream observationupstream observationreturnssemantic sentinelThe authenticated endpoint returned 13 IDs.
upstream observation — returns — The authenticated endpoint returned 13 IDs.
12 · semantic sentinelsemantic sentinelconfirmsevidence timestampThe live/mirror hash proves file equality.
semantic sentinel — confirms — The live/mirror hash proves file equality.
13 · evidence timestampevidence timestampqualifiesactive config path verification recordThe active configuration is /opt/homebrew/etc/cliproxyapi.conf.
evidence timestamp — qualifies — The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
14 · active config path verification recordactive config path verification recordrecordsactive config pathThe authenticated endpoint returned 13 IDs.
active config path verification record — records — The authenticated endpoint returned 13 IDs.

Three-frame summary

1 Find the active configuration
2 Read the live model list
3 Bind both to a timestamp
Compare the active /opt/homebrew/etc/cliproxyapi.conf, config.yaml, and authenticated GET /v1/models; each has a different role.
Record the observation, preserve the exception, and choose the next narrow proof.
retrieveWhere configuration livesclick to flip
The active configuration is /opt/homebrew/etc/cliproxyapi.conf.
retrieveWhich route the process announcesclick to flip
The authenticated endpoint returned 13 IDs.
retrieveWhich artifact records the momentclick to flip
The live/mirror hash proves file equality.
Predict before revealing

Which source proves a public route exists?

The authenticated model endpoint is the behavior boundary; files and notes only describe intent.

Worked example
1Compare the live config hash with its mirror.
2Read the exact ID set from GET /v1/models.
3Save the timestamped observation before changing anything.
Retrieval review
Which source proves a public route exists?

The authenticated model endpoint is the behavior boundary; files and notes only describe intent.

Ask which boundary you would prove next; the next lesson narrows a different operational risk.