Provider switching

2 min readReferenceUpdated 2026-05-19

What you'll find here

The craik provider CLI surface — list, show, select. Output is metadata-only and never contacts providers or loads secrets.

Selection is metadata, not authority.

The CLI prints redacted payloads. It does not contact providers, load secrets, or grant execution authority.

Commands

Command

Output

Notes

craik provider list

JSON metadata

Provider ids · supported modes · capabilities · trust boundaries · config references · secret reference names. Secret values are not printed.

craik provider show <id>

one record

Prints one provider by stable id.

craik provider select <id> --mode runner --policy-envelope-id <id>

redacted payload

Selection payload. Unsupported modes are rejected before output.

Selection payload

Provider id

Provider family

Selected mode

Trust boundary

Runtime path

Config references

Secret reference names

Budget & quota refs

Policy envelope id

Linked receipt ids

Compose with budgets and failover.

Provider routing should check budget and quota status before dispatch. Provider routing may fall back to another provider only through an explicit failover policy that preserves policy envelope boundaries and records the failover decision for audit.

What's next

ReferenceModel providersThe provider metadata catalog plus budget/quota gating.ReferenceProvider failoverThe explicit fallback rules.GuideProvider routing & sandboxesEnd-to-end provider routing.