[zzwong]

Summary

Add the openai_decisions provider type to report-identity suites. Use cr benchmark run identity.yml --provider openai --model gpt-6-luna or select a saved candidate. The configured provider supplies the endpoint and credential store; the adapter handles answer arrays, refusals, bounded responses and cache usage.

The provider work from the System One foundation, Clef, shared execution and credential/replay contract fixes is included. The unshipped infer-openai-decisions command is removed without an alias. Live review behavior is unchanged.

Usage is retained on refused or malformed responses when trustworthy. The two-rate estimate applies only when cache reads and writes are explicitly zero; missing or nonzero cache counts keep cost unknown.

Validation

• Full tests, lint, module tidy and build passed. Hermetic provider and command regressions cover refusals, malformed answers, cache-write uncertainty, selected-store credentials and complete replayable inputs.
• Compiled CLI checks cover direct and saved candidates, strict selection errors, empty fixtures, whole-budget rejection, resolved provenance, original retention, independent replay and private artifacts without provider calls.
• Four prepared-request hashes match the preserved Decisions smoke. That historical transport evidence comprises four successful synthetic comparisons, 1,824 input tokens, zero output tokens and an estimated $0.0001824 of usage value; it used the prior command. No new inference calls or full matrix were run.

[zzwong]

Add a command-level regression for nonzero cache-write costs remaining unknown. The adapter handles this case, but the command test does not exercise it.