diff --git a/panel/src/components/settings/ai-routing-card.tsx b/panel/src/components/settings/ai-routing-card.tsx
index 1c599d97..568018aa 100644
--- a/panel/src/components/settings/ai-routing-card.tsx
+++ b/panel/src/components/settings/ai-routing-card.tsx
@@ -74,6 +74,11 @@ const AGENTS: { slug: string; label: string }[] = [
   { slug: "ux-dev-1", label: "UX/UI Dev" },
   { slug: "ux-qa", label: "UX/UI QA" },
   { slug: "ux-doc", label: "UX/UI Documenter" },
+  // Interactive (held-open chat) roles. Claude (SDK driver) and Grok (opencode
+  // serve) are the supported runtimes; assigning a Grok model routes them to
+  // the grok-prompter / grok-secretary image.
+  { slug: "intake-1", label: "Intake (Prompter)" },
+  { slug: "secretary-1", label: "Secretary" },
 ];
 
 export function AIRoutingCard() {
diff --git a/roboco/llm/providers/opencode_config.py b/roboco/llm/providers/opencode_config.py
index 6f6ce650..d6db7e70 100644
--- a/roboco/llm/providers/opencode_config.py
+++ b/roboco/llm/providers/opencode_config.py
@@ -20,11 +20,15 @@ Config shape per opencode docs (https://opencode.ai/docs/config):
     idle stream hangs the parent run with no recovery (observed live on a PR
     review). The request/stream timeouts below are the defence-in-depth backstop.
 
-KNOWN PARITY GAP (tracked for the opencode-plugin follow-up with xAI): RoboCo's
-bash-guard (PAT-scrub) and transcript-based usage/cost capture are Claude Code
-hooks; they do not transfer to the opencode runtime. ``bash`` permission is
-operator-tunable (``ROBOCO_GROK_BASH_PERMISSION``) so a deployment can fail
-closed (``deny``/``ask``) until a security-parity opencode plugin lands.
+GUARDRAIL PARITY: the bash-guard (PAT-scrub) deny rules ARE ported to opencode
+via the ``secret-scrub.js`` plugin (``tool.execute.before``), and token
+usage/cost IS captured from opencode's SQLite store at finalize. The remaining
+gap vs Claude Code is the budget / loop-detector / stop-guard / prompt-injection
+hooks — they fire against the SDK ``:9000`` server and have no opencode
+equivalent yet; closing them needs an opencode plugin that POSTs to a sidecar
+(a tracked follow-up / open decision). ``bash`` permission stays operator-tunable
+(``ROBOCO_GROK_BASH_PERMISSION``) so a deployment can fail closed
+(``deny``/``ask``) meanwhile.
 """
 
 from __future__ import annotations