GitHub Copilot: removed (kn16x, 2026-10-25)

Cyberine has no OAuth provider any more. The GitHub Copilot device flow and the loop-copilot-build worker were removed: they reused the VS Code Copilot OAuth client id to call the Copilot API outside VS Code, which .claude/rules/tos-subscription-oauth.md forbids (verdict and sources in docs/providers/cli-agents.md, section "GitHub Copilot"). The compliant alternative is GitHub's own Copilot CLI, run yourself under your own login (copilot -p "<task>"), or any other worker Cyberine supports.

cyberine auth login copilot   # refused (exit 1) with the reason and the compliant alternative
cyberine auth logout copilot  # says whether ~/.cyberine/copilot.json is still on disk; never deletes it
cyberine auth status          # adds one line while ~/.cyberine/copilot.json exists: no longer read, safe to delete
cyberine doctor               # [WARN] for the same file, and for loop-copilot-build in CYBERINE_BUILD_FLEET
CYBERINE_BUILD_FLEET=loop-copilot-build cyberine run "..."   # skipped with a note naming the change; no GitHub call

If you logged in before, ~/.cyberine/copilot.json (or a legacy .local/auth/copilot.json in a repo) is left in place: Cyberine never reads it again, and you may delete it. Also revoke the GitHub OAuth grant at https://github.com/settings/connections/applications. A fleet.json provider whose workerId is loop-copilot-build gets a validation warning naming the change, and is skipped at routing time with the same note.

Known limitations: there is no Copilot worker of any kind. A CLI worker that spawns GitHub's own copilot binary is the sanctioned shape, but it is not added until the binary can be installed and measured here (its JSONL output, a login check and its sandbox needs). npm run selftest:copilot-auth still exercises the old flow and now fails until the operator retires or rewrites it.

The gateway is an ON-DEMAND dev dependency: restart: "no" means it never comes back after a machine reboot or Docker restart, and it publishes the uncommon host port 41400 (CYBERINE_GATEWAY_PORT) so it rarely collides. Drive it with the cyberine-project-devstack project skill instead of raw docker compose — it frees the port (stopping our container, then killing any foreign holder) and waits until the gateway answers:

.claude/skills/cyberine-project-devstack/scripts/devstack.sh up        # free port + start, wait for HTTP 200
.claude/skills/cyberine-project-devstack/scripts/devstack.sh status    # gateway + ContextQ state, port, health
.claude/skills/cyberine-project-devstack/scripts/devstack.sh down      # stop (or just leave it — it won't survive a reboot)
.claude/skills/cyberine-project-devstack/scripts/devstack.sh up --with-contextq   # also bring up the ContextQ memory stack

Setting any GATEWAY_* / LOOP_MODEL_* env var (even to the documented defaults) opts the gateway adapters in — a live local gateway at http://localhost:41400/v1 with the matching master key and the anthropic/claude + openai/gpt aliases now registers loop-gateway-a / loop-gateway-b instead of being read as "unconfigured". To put Claude/GPT into the WRITING fleet too, add the gateway-backed implementers to CYBERINE_BUILD_FLEET (they also need the gateway up):

docker compose up -d
CYBERINE_TASK="<your task>" CYBERINE_BUILD_FLEET="loop-deepseek-build,loop-claude-build,loop-gpt-build" \
  npm run wf -- src/engine/implementTaskWorkflow.ts   # races DeepSeek vs Claude vs GPT, DiffJudge picks the winner