plans: decision 120 (Q127, #237 proxy, row 96)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2700,3 +2700,24 @@ which stay with him. Each item names who decided it and what happened.
     - Decision 114 still holds: no session traffic goes through
       CLIProxyAPI until Jason rules, and no agent reads its management
       key.
+120. **#237: role sessions through a local proxy, tested first
+    (2026-10-12).** Jason answered "Q127: yes" through Mos (sage-0110)
+    to this reading: role sessions talk only to a local proxy,
+    CLIProxyAPI first, with keys the stack issues and rotates. Upstream
+    tokens and keys stay in the proxy, which is set once for the whole
+    machine, and nobody hand-edits a credential file.
+    - Decision 114's hold on session traffic through CLIProxyAPI is
+      lifted for #237, explicitly. Agents still never read its
+      management key.
+    - Order, as Jason approved: rows 92 and 93, then the redeploy and
+      his re-test, then row 96 (#1590, Researcher, Dewey reviews), the
+      stand-in-key test. It checks streaming, tool use, caching and
+      beta headers for Claude Code and pi, and whether the proxy issues
+      and revokes per-agent keys from the command line. Brief:
+      `docs/plans/2026-10-12_local-model-proxy.md`.
+    - The test runs a second proxy process with made-up config and a
+      stand-in upstream. Any change to the running proxy goes back to
+      Mos first. No real credentials, no spend.
+    - Switching live seats to the proxy and the subscription-terms
+      question go back to Jason after the test. The #237 design row is
+      written from row 96's report.