Step 3 · Operations evidence · Operations evidence · Public surface and models PT-BREN
CLIProxyAPI 7.2.70 · kimi-k3 · Visual course

Public surface and models

The public surface is an exact list: retain 12 allowed routes, add kimi-k3, and hide Grok/Composer without deleting credentials.

Read first (primary source)
CONFIG-MODEL-POLICY-EVIDENCE.md

A redacted local record for the running gateway and the kimi-k3 example.

Read the simple version or open technical detail in any section.
1

Big idea

The public surface is an exact list: retain 12 allowed routes, add kimi-k3, and hide Grok/Composer without deleting credentials.

Think of it as… It is like removing signs from a shop window, not destroying stock in the warehouse. The analogy breaks because an exclusion rule can also affect wildcards..

Under the hood

The live endpoint listed 13 IDs. The xAI exclusion is reversible through exact and wildcard entries; Grok/Composer payload overrides were removed.

2

In one picture

01 · pre-change model snapshotpre-change model snapshotgovernsexact public ID listThe public list contains exactly 13 IDs.
pre-change model snapshot — governs — The public list contains exactly 13 IDs.
3

In the code

This is the real local path and a safe read-only command.

oauth-excluded-models.xai 
# trecho real, não editado
node -e "const p=require('./max-token-policy.json'); console.log(Object.keys(p.models||{}))"
# compare the authenticated live model snapshot in smoke-model-routes.json

Open it yourself

node -e "const p=require('./max-token-policy.json'); console.log(Object.keys(p.models||{}))" # compare the authenticated live model snapshot in smoke-model-routes.json

4

Try it

Use the controls to retrieve the evidence before reading the explanation.

02 · exact public ID listexact public ID listmatchesGrok exclusion ruleGrok and Composer do not appear at the endpoint.
exact public ID list — matches — Grok and Composer do not appear at the endpoint.
03 · Grok exclusion ruleGrok exclusion ruleroutes toComposer exclusion rulexAI credentials remain preserved.
Grok exclusion rule — routes to — xAI credentials remain preserved.
04 · Composer exclusion ruleComposer exclusion ruleexcludesxAI credential retainedThe public list contains exactly 13 IDs.
Composer exclusion rule — excludes — The public list contains exactly 13 IDs.
05 · xAI credential retainedxAI credential retainedprovespayload override removalGrok and Composer do not appear at the endpoint.
xAI credential retained — proves — Grok and Composer do not appear at the endpoint.
06 · payload override removalpayload override removalboundsK2.7 retained routexAI credentials remain preserved.
payload override removal — bounds — xAI credentials remain preserved.
07 · K2.7 retained routeK2.7 retained routemaps tokimi-k3 added routeThe public list contains exactly 13 IDs.
K2.7 retained route — maps to — The public list contains exactly 13 IDs.
08 · kimi-k3 added routekimi-k3 added routerestarts asimage route retainedGrok and Composer do not appear at the endpoint.
kimi-k3 added route — restarts as — Grok and Composer do not appear at the endpoint.
09 · image route retainedimage route retainedpreserveszero Grok resultxAI credentials remain preserved.
image route retained — preserves — xAI credentials remain preserved.
10 · zero Grok resultzero Grok resultcompares withzero Composer resultThe public list contains exactly 13 IDs.
zero Grok result — compares with — The public list contains exactly 13 IDs.
11 · zero Composer resultzero Composer resultreturnsreversible restore pathGrok and Composer do not appear at the endpoint.
zero Composer result — returns — Grok and Composer do not appear at the endpoint.
12 · reversible restore pathreversible restore pathconfirmspost-restart model comparisonxAI credentials remain preserved.
reversible restore path — confirms — xAI credentials remain preserved.
13 · post-restart model comparisonpost-restart model comparisonqualifiespre-change model snapshot verification recordThe public list contains exactly 13 IDs.
post-restart model comparison — qualifies — The public list contains exactly 13 IDs.
14 · pre-change model snapshot verification recordpre-change model snapshot verification recordrecordspre-change model snapshotGrok and Composer do not appear at the endpoint.
pre-change model snapshot verification record — records — Grok and Composer do not appear at the endpoint.

Three-frame summary

1 Snapshot the current surface
2 Apply reversible exclusions
3 Regress the retained K2.7 route
The live endpoint listed 13 IDs. The xAI exclusion is reversible through exact and wildcard entries; Grok/Composer payload overrides were removed.
Record the observation, preserve the exception, and choose the next narrow proof.
retrieve13 published IDsclick to flip
The public list contains exactly 13 IDs.
retrieveReversible exclusionclick to flip
Grok and Composer do not appear at the endpoint.
retrieveK2.7 regressionclick to flip
xAI credentials remain preserved.
Predict before revealing

How is Grok/Composer exposure removed reversibly?

Configuration exclusions preserve the credential and make the public-surface decision reversible.

Worked example
1Read the live 13-ID snapshot.
2Check exact and wildcard xAI exclusions.
3Run the K2.7 sentinel regression after restart.
Retrieval review
How is Grok/Composer exposure removed reversibly?

Configuration exclusions preserve the credential and make the public-surface decision reversible.

Ask which boundary you would prove next; the next lesson narrows a different operational risk.