diff --git a/main.ts b/main.ts
index 62f9930..dbc66a1 100644
--- a/main.ts
+++ b/main.ts
@@ -163,7 +163,6 @@ export async function main(): Promise<MainResult> {
   await runProxyResolution({
     payload,
     oss: runContext.oss,
-    plan: runContext.plan,
     proxyModel: runContext.proxyModel,
     oidcCredentials,
     repo: runContext.repo,
diff --git a/mcp/server.ts b/mcp/server.ts
index 26705d9..c622721 100644
--- a/mcp/server.ts
+++ b/mcp/server.ts
@@ -63,10 +63,10 @@ export interface ToolContext {
   mcpServerUrl: string;
   tmpdir: string;
   // repo-level OSS flag + account-level billing plan. together they decide
-  // whether pullfrog is paying for marginal infra — see isInfraCovered in
-  // utils/runContext.ts. plan gating for endpoints like the learnings PATCH
-  // is enforced server-side via 402, so we pass plan along mostly for future
-  // use / observability. see wiki/pricing.md.
+  // whether pullfrog is paying for marginal infra — see `isInfraCovered` in
+  // the server's `utils/billing.ts`. plan gating for endpoints like the
+  // learnings PATCH is enforced server-side via 402, so we pass plan along
+  // mostly for future use / observability. see wiki/pricing.md.
   oss: boolean;
   plan: AccountPlan;
   // resolved upstream model specifier (e.g. "google/gemini-3.1-pro-preview").
diff --git a/utils/proxy.ts b/utils/proxy.ts
index b0fe2fb..9833007 100644
--- a/utils/proxy.ts
+++ b/utils/proxy.ts
@@ -30,7 +30,6 @@ import {
 import { log, writeSummary } from "./cli.ts";
 import { reportErrorToComment } from "./errorReport.ts";
 import type { ResolvedPayload } from "./payload.ts";
-import { type AccountPlan, isInfraCovered } from "./runContext.ts";
 
 export interface OidcCredentials {
   requestUrl: string;
@@ -129,9 +128,16 @@ async function buildProxyTokenHeaders(ctx: {
  * Decide whether this run needs a minted proxy key and, if so, mint and
  * inject it as `OPENROUTER_API_KEY`. Mutates `payload.proxyModel` on success.
  *
+ * `ctx.proxyModel` IS the signal — the server (`run-context/route.ts`) is
+ * the authority on "should this run use the Router". It already knows the
+ * full picture (OSS, plan, wallet balance, modelAccessMode) and only sets
+ * `proxyModel` when the gate passes. The action just trusts that signal
+ * and mints. Re-deriving the gate locally was redundant and was strictly
+ * more restrictive (no balance check), which made signup-credit runs on
+ * no-card private repos silently fall through to BYOK.
+ *
  * Skipped when:
  *   - `PULLFROG_MODEL` env override is set (BYOK escape hatch)
- *   - `isInfraCovered({ oss, plan })` is false (BYOK account on a paid run)
  *   - `proxyModel` is not set on the run context
  *   - no OIDC credentials available and not talking to a localhost API
  *
@@ -140,7 +146,6 @@ async function buildProxyTokenHeaders(ctx: {
 async function resolveProxyModel(ctx: {
   payload: ResolvedPayload;
   oss: boolean;
-  plan: AccountPlan;
   proxyModel?: string | undefined;
   oidcCredentials: OidcCredentials | null;
   repo: { owner: string; name: string };
@@ -148,8 +153,7 @@ async function resolveProxyModel(ctx: {
   // env override = BYOK escape hatch, don't proxy
   if (process.env.PULLFROG_MODEL?.trim()) return;
 
-  const needsProxy = isInfraCovered({ isOss: ctx.oss, plan: ctx.plan }) && ctx.proxyModel;
-  if (!needsProxy) return;
+  if (!ctx.proxyModel) return;
 
   // dev affordance: when talking to a localhost API, the server-side
   // x-dev-repo bypass replaces OIDC verification, so a play run can
@@ -184,7 +188,6 @@ async function resolveProxyModel(ctx: {
 export async function runProxyResolution(ctx: {
   payload: ResolvedPayload;
   oss: boolean;
-  plan: AccountPlan;
   proxyModel?: string | undefined;
   oidcCredentials: OidcCredentials | null;
   repo: { owner: string; name: string };
@@ -194,7 +197,6 @@ export async function runProxyResolution(ctx: {
     await resolveProxyModel({
       payload: ctx.payload,
       oss: ctx.oss,
-      plan: ctx.plan,
       proxyModel: ctx.proxyModel,
       oidcCredentials: ctx.oidcCredentials,
       repo: ctx.repo,
diff --git a/utils/runContext.ts b/utils/runContext.ts
index ffb7fae..8d15b65 100644
--- a/utils/runContext.ts
+++ b/utils/runContext.ts
@@ -48,15 +48,6 @@ export interface RepoSettings {
  */
 export type AccountPlan = "none" | "payg";
 
-/**
- * "Is Pullfrog absorbing marginal infra cost for this repo?" — composite
- * predicate over the two orthogonal dimensions (repo-level OSS, account-level
- * plan). Mirrors `isInfraCovered` in the server's `utils/billing.ts`.
- */
-export function isInfraCovered(params: { isOss: boolean; plan: AccountPlan }): boolean {
-  return params.isOss || params.plan === "payg";
-}
-
 export interface RunContext {
   settings: RepoSettings;
   apiToken: string;