feat(host-agent): default planner transport to cloud

openspec/changes/cloud-planner-proxy/design.md

@@ -36,8 +36,8 @@ which raises the stakes on where its provider credentials live.
 - Reuse existing Host<->Cloud authentication and existing provider
   wire-format code; add no new auth scope and no duplicated Anthropic/OpenAI
   translation logic.
-- Preserve today's direct-to-provider path as a fully supported, still-default
-  option, so existing Host Agent deployments with local keys are unaffected.
+- Preserve the direct-to-provider path as a fully supported explicit opt-out
+  for Host Agent deployments that require local provider keys.
 
 **Non-Goals:**
 - Not moving prompt construction (`runtime/planner_prompts.py`, Scene
@@ -74,13 +74,12 @@ must stay in lockstep with the Host Agent's local transport as providers'
 APIs evolve.
 
 ### D2: New transport axis, orthogonal to provider selection
-Host Agent config gains `AI_PLANNER_TRANSPORT` (`direct` default | `cloud`),
-independent of `AI_PLANNER_PROVIDER`. `direct` is today's behavior
-unchanged (Host Agent builds the SDK client itself). `cloud` builds a new
+Host Agent config gains `AI_PLANNER_TRANSPORT` (`cloud` default | `direct`),
+independent of `AI_PLANNER_PROVIDER`. `cloud` builds a new
 `CloudProxyToolCallingClient` instead; provider/model selection and
 credentials for that path live in the Cloud API's own
-`AI_PLANNER_PROVIDER`/`AI_PLANNER_MODEL`/`ANTHROPIC_API_KEY`/`OPENAI_API_KEY`
-configuration, not the Host Agent's.
+active Provider profile, not the Host Agent's. `direct` remains an explicit
+opt-out that builds the provider SDK client locally.
 
 Alternative considered: overload `AI_PLANNER_PROVIDER=cloud` as a third
 provider value. Rejected: provider and transport are different axes (a
@@ -158,9 +157,9 @@ proposal does not change that risk profile, only where the call happens.
 ## Risks / Trade-offs
 
 - **[Risk] Cloud Control Plane is now in the hot path of every planning
-  step for hosts on the `cloud` transport** -> Mitigation: `direct`
-  transport remains the default and fully supported; operators who need
-  offline/low-latency operation simply don't opt in. Bounded by the
+  step by default** -> Mitigation: `direct` transport remains fully
+  supported as an explicit opt-out for operators who need offline or
+  low-latency operation. Bounded by the
   existing `AI_PLANNER_TIMEOUT_SECONDS`, same as today.
 - **[Risk] Cloud Control Plane outage now stalls planning (not just new
   task assignment) for opted-in hosts** -> Mitigation: same
@@ -195,20 +194,17 @@ proposal does not change that risk profile, only where the call happens.
 
 ## Migration Plan
 
-1. Add Cloud API configuration (`AI_PLANNER_PROVIDER`/`AI_PLANNER_MODEL`/
-   `AI_PLANNER_TIMEOUT_SECONDS`/provider API keys) and the new internal
-   route, guarded by the existing host-scoped auth. Off by default in the
-   sense that no Host Agent calls it until configured to use `cloud`
-   transport.
-2. Add the Host Agent's `AI_PLANNER_TRANSPORT` setting (default `direct`)
-   and `CloudProxyToolCallingClient`. Existing deployments are unaffected
-   until an operator sets `AI_PLANNER_TRANSPORT=cloud` and removes the
-   local provider key.
+1. Add Cloud API Provider profile management and the new internal route,
+   guarded by the existing host-scoped auth. Configure and activate a
+   Cloud-held Provider key before running a Host Agent.
+2. Add the Host Agent's `AI_PLANNER_TRANSPORT` setting (default `cloud`)
+   and `CloudProxyToolCallingClient`. Existing deployments that require a
+   local provider key set `AI_PLANNER_TRANSPORT=direct` explicitly.
 3. Update `docs/CLOUD_DEPLOYMENT.md` with the proxy configuration path and
    its trade-offs (latency, availability coupling, data-path expansion).
-4. Rollback is setting `AI_PLANNER_TRANSPORT=direct` (or unsetting it) on
-   affected hosts and restoring their local provider key; the Cloud API
-   route can remain deployed but unused.
+4. Rollback is setting `AI_PLANNER_TRANSPORT=direct` on affected Hosts and
+   restoring their local provider key; the Cloud API route can remain
+   deployed but unused.
 
 ## Open Questions