The evidence,
in full.

Read the five lines first. Every appendix opens with the same card: the question it answers, the answer, the numbers the answer turns on with their fact est unknown grades, what the plan does about it, and what is still unknown. Read those five lines, and open the tables under them only where you want to check the work.

No public UVU survey reports AI use by college unknown — so receptivity here measures visible behavior: AI courses in the 2026–27 catalog, named faculty leads, college policies, Kahlert curriculum grants, training completions, and applied projects. That evidence, college by college — cross-checked against what deans and faculty have said in public (Appendix J) — produces the scores below. The scoring rule is printed with the table so it can be argued with: priority = 2×receptivity + demand + story value − complexity est.

A score is not a place in the queue. The score says how ready a college looks. The wave says when the service can actually be built for it, and only two colleges can be stood up at once. Education scores level with Engineering and Business and still opens wave two; Health & Public Service scores above Science and still runs on a lane of its own, because its safety controls have to exist first. The sequence the plan follows is the one in §07 of the guide and on the campus map: wave one Engineering & Technology and Woodbury Business, wave two Education and Humanities & Social Sciences, Science following with the shared research service, Health & Public Service on the safety lane, Arts later once rights controls exist. est sequence

How to read "story": the Utah-facing narrative each college can carry. Education ranks first there — "UVU prepares Utah teachers to use AI safely before they enter classrooms" lands statewide while HB 273 and the state's Gemini rollout are live. Engineering's NVIDIA-agreement story and Woodbury's employer-evidence story follow. Sources: UVU 2026–27 catalog, Kahlert Institute pages, UNESCO Chair rosters, Ethics Awareness Week programs, college policy documents, Utah HB 273, the June 2026 Google–USBE announcement — full URL log in the working papers fact (behaviors) / est (scores).

These rates are not interchangeable — "use" ranges from daily coursework habit to once-a-semester. Read the measure column before comparing rows. The pattern that survives across all of them: business, technology, and engineering lead student frequency; faculty use is above 70% in every field; writing-heavy disciplines feel the most assessment strain.

What this means for the plan: capacity follows the frequency leaders — Engineering & Technology and Woodbury Business take wave 1 and its hardware — but service design cannot skip the "low" fields. Humanities' 43% weekly is still nearly half the college, and its faculty carry the heaviest redesign load. That is why wave 2 brings Humanities & Social Sciences in with citation-verification and writing-process tooling rather than raw capacity, and why how often a field uses AI does not by itself set its place in the queue (Appendix A). Sources linked by name; the two large gated datasets (CSU's 94,060-respondent survey, Digital Education Council) publish no open field tables unknown and are logged as checked-but-unusable.

"What is in a school stays with that school" is a budget rule and a design rule. Money and use cases stay local; security, identity, and data rules stay central. This table is the design contract per college est, with the binding compliance anchors fact.

The college is the budget unit; the department is where work actually differs. This appendix maps every unit in UVU's 2026–27 catalog — four colleges and three schools, 51 child units fact — to a demand tier, its highest-value uses, a model route, and the constraint that must be honored. Tiers rest on the strongest available evidence per field (a mechanical-engineering cohort study, a 91%-use mathematics sample, clinical-placement rates by health profession, the 38.6% computer-science share of academic AI conversations) and are graded est where triangulated. Notably: no family lands in a LOW tier — every department shows enough recurring task overlap to need access, guidance, and a course-level policy.

The ten routes

Which models fit which family — and when frontier is genuinely needed

Model names reflect the current local portfolio (the Qwen, Mistral, and GLM classes the guide's §11 details) and current frontier services. Benchmark caution carried from the working papers: providers publish their own numbers under different scaffolds — no clean cross-vendor ranking exists, and a declared million-token context is a ceiling, not a promise fact. The upgrade rule stands: models are the cartridge, not the console — routes persist while names change quarterly.

Relative compute load per family

For capacity planning: relative text-token load per active user against a mixed-campus average of 1.0×, with practical working-context ranges est. Vision and speech are flagged separately — token counts understate their compute.

The master table — all 51 units

Unit names and college placement are fact from the 2026–27 catalog (each unit links to its catalog page); tier-basis links go to the underlying study. Two structural notes from the catalog sweep: Dental Hygiene and Respiratory Therapy nest under Allied Health; the ROTC unit's organizational type is partly unknown. Sequencing among colleges stays in Appendix A — this table is about what to build for whom, not who goes first.

Before this plan recommends a single purchase, it inventories everything UVU already owns, licenses, runs, or can reach — from board minutes, budget documents, IT service pages, procurement postings, and vendor announcements. The plan's stance toward all of it: assume none of it is available. Every existing system, seat, compute node, and staff hour is already allocated to the people using it today, so the service is designed to stand entirely on its own. This inventory exists so we know what we are building on top of — the integration surfaces (identity, LMS, device management, network, data rules) — and what we must never needlessly duplicate. It is a map of the house, not a list of things to borrow. This is a public-web inventory fact — it cannot see inside UVU's contract ledger, which is exactly why the ask-once packet at the end exists.

The headline assets

• An employee AI Gateway is already live — launched July 1, 2026 after a 360-person pilot: ChatGPT, Claude, Gemini, and local open-source models behind one door, about $5 in tokens per employee per week. Students not yet included. Our service keeps its own front door for its own users and can offer the Gateway a local-engine hook — a connection point, not a dependency, and never a competing campus-wide portal pitch.
• Paid seats already exist and are the experiment — 154 Copilot and 51 ChatGPT licenses deployed January 2026. Their usage data should decide seat expansion, not vendor pitches.
• Wilson, UVU's own course assistant — 44 courses and ~2,000 students by February 2026, funded ($163k donated services + $96k Academic Affairs). Our service is not a course chatbot and does not replace it; a Wilson-style assistant can call our engine if UVU chooses.
• The management layer is done — Jamf Pro already auto-enrolls every university Apple device. The Mac fleet this plan proposes needs zero new management software.
• Compute today is CPU-shaped — three UVU-owned Notchpeak nodes (~224 cores, 680 GB RAM, no disclosed GPU) plus guest routes to shared Utah GPU systems (80 H200s on One-U, preemptible; the Redtail supercomputer exists but no UVU allocation is public). Shared, preemptible access is not the same as owned capacity — and none of it is assumed available to this plan, which is exactly why the plan owns its floor.
• The program office exists and is funded — the Kahlert Applied AI Institute ($5.2M gift), AI Academy (120 completers), twice-monthly Power Hours, a faculty coaching pilot, curriculum grants, and a paid AI apprenticeship. New work routes through it.

Full inventory

Canvas: what the LMS tier already includes

Instructure moved every current customer to Canvas Core, which includes five AI functions at no extra cost — but inclusion is not enablement, and the free preview of the premium tier ended June 30, 2026. First move: turn on and test what's already paid for.

The gap ledger — "already have, therefore…"

Read the "therefore" column as a duplication guard, not a borrowing plan: it says what we must not pitch or buy twice. The service still brings its own front door, engine, operations, and budget.

The full data ledger — deferred diligence, not a precondition

The twelve items below were the original public-record gaps. A second public sweep (Appendix K) closed most of what matters for building and reduced the real ask to five interface questions. This ledger is kept for later commercial diligence — request it as an export when useful, never as a gate on the pilot.

1. Software and spend: Export UVU’s current AI-relevant license ledger with product, SKU, vendor and reseller, contract/PO, owner, funding unit, term, renewal, purchased seats, assigned seats, 30/90-day active users, and annual cost. Include OpenAI, Anthropic, Microsoft, Google, Adobe, Instructure, Copyleaks, Grammarly, Turnitin, Zoom, Qualtrics, Kaltura, Honorlock, LinkedIn Learning, Pluralsight, Tableau, Civitas, ServiceNow, Salesforce, AWS, Azure, GCP, Databricks, and Snowflake.
2. Microsoft: Confirm the current student and employee A1/A3/A5 mix; the exact 154 Copilot SKU; the 51-seat ChatGPT tier; Power BI Pro/Premium capacity; Copilot Studio/Azure OpenAI access; and the outcome of the October 2024 $600,000 M365 request.
3. Gateway: Provide its current model/provider list, hosting diagram, API contracts, weekly-budget rule, total and per-model spend, paid-tenant rules, active users, student-launch decision, retention, provider-training terms, logging, data classes, and approved connectors.
4. Wilson AI: Confirm the 2026-09-03 course and section count, unique students, active users, current name, models/providers, retrieval and Kaltura design, hosting, cost, retention, provider-training terms, assessment results, and whether the Faculty Senate oversight group was formed.
5. Canvas: Confirm Core/Plus/Next contract status, term and cost; current feature flags for all IgniteAI functions; data-processing terms; Wilson, Copyleaks, Honorlock, Kaltura, and publisher LTI status; and whether Khanmigo or another tutoring pilot exists.
6. Compute: Confirm all three UVU Notchpeak nodes are online and provide CPU model, hostnames, usable cores/RAM, storage, partition/QoS, priority terms, and FY2026 use. Confirm UVU eligibility and limits for general GPUs, One-U H200 priority, and any Redtail allocation.
7. Campus hardware: Supply the current Jamf and IT asset export for Macs, GPU workstations, servers, Citrix GPU profiles, Smith Building AI/VR/drone/robotics rooms, SCaFL servers, DGM/XR equipment, and any surviving departmental GPU servers. Include model, count, room, owner, access rule, and operational state.
8. NVIDIA: Provide the executed or redacted MOU, exact term, activated deliverables, current ambassadors, completed certifications/workshops, learner counts, cloud tenant, instance type, GPU hours, dollar credits, expiry, and any donated equipment.
9. People and funding: Give one dated roster for AI Academy, Advanced AI, Power Hours, coaching, Summer Institute, curriculum grants, and apprenticeships. Include unique people, completions, outcomes, every grant/project/amount, apprenticeship employers and participants, credentials, placements, and the committed versus uncommitted Kahlert budget.
10. Data and agreements: Confirm the warehouse/data-lake architecture and current roles of Collibra, Power BI, Tableau, Business Objects, MyDataHub, Civitas, Databricks, and Snowflake. List all executed AI MOUs, DPAs, DUAs, and data-sharing agreements with data classes, processors, retention, model-training use, IP, and expiry.
11. State and UNESCO: Confirm whether the AI Workforce Credential actually launched, who owns the platform, UVU’s delivery role, enrollment/completions, and RFP status. Provide the current UNESCO Chair and committee charter, funding, partner agreements, and AI/data projects.
12. Public-payment reconciliation: Produce UVU vendor payments for FY2024–FY2026 for the named vendors, including payments through VLCM, CDW, SHI, Carahsoft, cooperative contracts, marketplaces, and other resellers. Reconcile them to contracts and the license ledger.

Search coverage note: procurement search fields showed no events for the major AI vendors — which proves only that the searchable fields are empty, not that no purchases exist (reseller, cooperative, and low-value purchases don't appear there). The state transparency portal's vendor search loads through a client-side form that automated public access could not operate; the reconciliation request above covers it fact.

Education and research programs — the wider sweep

A second pass on September 3 checked every education-specific program a campus could claim, including several missed above. Personal benefits (a student's own Azure credit, a verified student's free GitHub Copilot) are real and worth publicizing; none is campus capacity.

Order of operations: claim the $0 rows first (they kill the "we can't afford anything" objection and generate the adoption data every later decision needs), quote the seat benchmarks in week 1, and let the measured pilot decide how much owned floor to build. The research-grant rows fund scale, not the pilot — the pilot is deliberately small enough to need no grant.

The architecture dossier carries a full branch matrix: eight bureaucratic (B1–B8), seven technical (T1–T7), four financial (F1–F4), five demand (D1–D5), and four external (E1–E4) branches, each with a trigger, a pre-decided response, and an owner. Eight weekly tripwires watch the triggers. The three highest-leverage pre-decisions, in full:

Five decision memos are pre-written for the slower-burning cases: a major model release, a central-IT takeover offer, agent/automation traffic growth, retrieval workloads crushing prefill, and one department dominating usage. The full matrix travels with the architecture dossier rather than this page — it is an operating document, not a pitch.

A plan that hides its unknowns isn't one. These are the items public evidence could not settle unknown, each with its next action and its owner-to-be. Nothing on this list blocks the validation pilot; several block campus scale.

The four decisions only Dr. Burns can make — asked once, here, so no one asks twice (the five technical questions for UVU's IT side are in Appendix K):

1. Was a Moonshot or research-fund notice of intent filed before the August 28 deadline?
2. Is there a budget number — or should the simulator's dial stay the planning instrument?
3. Which college sponsors the pilot, and does Dx co-sponsor identity and security review from day one?
4. If a seat vendor beats $30 per user per year all-in (branch F1), should the flip be taken automatically or brought back for a decision?

The planning map plots colleges on real overhead imagery. This appendix is its ground truth: every building pin on UVU's live campus map, the verified college→building mapping, every UVU location beyond the Orem core, and the licensing that makes the imagery reusable. Coordinates are UVU's own map pins rounded to four decimals — label and entrance points, not surveyed centroids (a footprint cross-check put the median offset near 19 meters) fact.

Where each college lives

Verified against deans' offices, advising pages, and department locations — not assumed from building names. Two findings worth pinning: the engineering core moved to the new Smith building in January 2026 (older maps still label the CS building as its home), and Health & Public Service is genuinely split — administration in the Losee Center, health teaching across the pedestrian bridge on West Campus, public safety in EN.

Every UVU location beyond the Orem core

No current official source publishes campus-by-campus enrollment — UVU's Fall 2025 total of 48,669 is institution-wide and is not assigned to any location here fact. The Lehi program pages override the older CHPS location list (dental hygiene and respiratory therapy now teach at Thanksgiving Point).

The full building roster — all 53 pins

Source: UVU's live interactive campus map, accessed September 3, 2026, cross-checked against the Fall 2025 printable map and a 2023 building directory. Known name drift preserved in the working papers (Gunther "Technology" vs "Trades"; the CS building's pre-Smith label). One pin — H4, Army ROTC — sits ~880 m from its mapped footprint and is flagged rather than silently corrected fact.

Imagery rights

The map's aerial layer is NAIP imagery (USDA Farm Service Agency) served through the U.S. Geological Survey's National Map — U.S. public domain, with the credit line printed on the map page. UVU's own campus-map artwork is not an open layer (personal, non-commercial terms): it is used here as a factual reference for codes, names, and pin locations, and its artwork is not reproduced. Building-footprint data, if ever added, would come from OpenStreetMap under ODbL with its own credit fact.

Adoption is the sponsor's first concern, so this appendix answers a plain question from public sources only: who at UVU has already said, in public, what they think and what they've built? Every row is a professional statement its author published — a news interview, a faculty profile, a conference program, a Senate minute — with the link beside it. Nothing here infers a private view; "silent" means the public record is silent, not that a person has no opinion. Sweep date: September 3, 2026.

What leadership has said

Continuity is strong: the institute was launched under the previous president with the stance that everyone, regardless of major, should engage with the technology; the current president championed AI integration at his prior institution. Four deans are publicly silent while their colleges are visibly active — an invitation to bring them in, not evidence against.

Faculty champions and skeptics, by college

No named faculty member was found publicly advocating a blanket AI ban. The common design choice among the people who have built something — a revision coach that refuses to draft, a marketing "boss" that challenges strategy, virtual patients, a course bot with disclosure and verification controls — is guardrails, verification, and human judgment. That is also the design of this plan, which is why these people are its natural first cohort.

About 37 faculty joined the May 2026 AI Summer Institute; six are publicly profiled. The behavioral program in the guide (§07) starts from peer nomination, not this list — but the list shows every college already has someone to nominate.

The friction people describe in public — and what the plan does about each

The most telling pair: employee AI use rose from 61% to 76% in a year while "very satisfied" fell from 23% to 15% and 75% expressed caution. Access is not the bottleneck; trust and fit are. That is the case for a service designed around guardrails, predictable quotas, a real non-AI path, and no detector-as-proof — the rights charter in §07.

Student voice

Adjunct facts

Most UVU instructors work part-time. The public record on their AI access is thin, and thin in a specific way:

Service implication: paid, short, asynchronous training; accounts and course agents that survive the semester boundary; eligibility stated in plain language; an adjunct advisory seat before any policy or detector rule changes. The plan's artifact-gated stipend and adjunct-first design (§07) already assume this — the public record confirms why.

Does the public voice change the sequencing?

One change carried into Appendix A: Health & Public Service moves to HIGH (controlled) — named nursing champions with built virtual-patient bots filled the local-evidence gap. The controls do not move: synthetic cases first, human review always.

The service stands on its own; this appendix maps the house it stands in. Every surface below was established from public sources — UVU's own pages, job postings, policy documents, network registries, and a handful of passive checks any browser performs on first visit — so that the questions we finally ask UVU are few, precise, and cannot be answered from outside. Sweep date: September 3, 2026.

Integration surfaces

Reading it together: a Microsoft-shaped house (the CIO's own words: "We're kind of a Microsoft shop. We have an A5 license"), Canvas with Banner-fed roles, a portal moving to Pathify this fall, Jira Service Management with PagerDuty on-call, CrowdStrike on managed devices, Splunk available, and Policies 445/446/447 as the written rulebook. Everything our design already assumed — now sourced.

The house's compute and network, as publicly known

Gateway and Wilson: what is actually known

Treat the employee Gateway, the public-website Wilson, and the in-course Wilson as three separate services until UVU shares an as-built diagram. The only safe shared assumption is Microsoft identity and governed UVU content — not a shared model layer. Notably, the public-website Wilson runs on a vendor platform inside UVU's own cloud tenant with a named UVU engineer operating it; whether the Canvas Wilson shares that backend is not public.

The twelve-item data request, after the public sweep

None of the twelve could be fully closed from outside — each bundles public facts with private contracts or configuration — but most no longer need answering before we build. The service brings its own compute, front door, and operations; only the interface details block integration.

The five questions that genuinely require UVU

Asked once, together, of the technical side of the house:

1. Identity and application interface pack: What Entra registration, protocol, issuer/tenant, claims, groups, MFA/Conditional Access rules, test accounts, Canvas LTI 1.3 deployment details, Canvas API scopes, Banner-fed role source, Pathify placement, and UVU API Management route must the service use?
2. Gateway/Wilson as-built boundary: Please provide one current data-flow diagram for Gateway, public Wilson, and course Wilson showing platform/version, hosting, models/providers, routing, retrieval sources, Canvas/Kaltura interfaces, and whether any components or stores are shared. Must our service hand off through any of them?
3. Approved data and control envelope: Which Policy 445 data classes may enter the service; what are the required retention, deletion, legal-hold, logging, no-training, subprocessor, region, encryption, accessibility, privacy-notice, security-review, and final Policy 441 requirements?
4. Network and facilities handoff: For owner-supplied hardware, what rack location, power/cooling, physical access, VLANs, firewall/egress rules, DNS/TLS, load-balancing, UETN/Internet2 path, private-cloud links, remote administration, monitoring, backup, and disaster-recovery rules apply?
5. Operating contract and rollout: Who owns product approval, data stewardship, Canvas administration, security, networking, support, change control, incident response/JSM/PagerDuty, and service-level decisions; what pilot users/courses and current Wilson/Gateway rollout constraints must we plan around?

Everything else in the twelve-item ledger is commercial diligence that can be requested later as an export, or never. The four decisions that belong to Dr. Burns rather than to IT stay in Appendix H: whether a Moonshot or research-fund notice of intent was filed, whether a budget number exists or the dial stays the instrument, which college sponsors the pilot and how Dx co-sponsors, and whether a seat quote under $30 per user per year should flip the plan automatically.

A fair challenge was put to this plan: before buying anything, have we exhausted the free options? Free tiers exist from a dozen providers, and as of this week Meta's newest model is free through a coding gateway. This appendix takes that path seriously, on the providers' own published terms, and shows exactly where it holds and where it breaks for 36,000 people. Verified directly on September 3, 2026, then extended by a full provider survey the same day.

Meta Muse Spark 1.3 — the fact sheet

OpenRouter's free models — the limits, from the source

The arithmetic at university scale

What free tiers are genuinely good for

• Sandboxes with no UVU data — a CS student trying a new model on their own code; a faculty member evaluating a release before the fleet qualifies it.
• Model evaluation — free tiers are the cheapest way to benchmark a candidate against the fleet's current model before pulling its weights.
• Teaching the routing lesson — the plan's data-class rules (§08) are exactly the discipline that makes free tiers safe: Public-class work may burst to labeled outside routes; nothing Sensitive ever does.
• Never the floor. No published free tier offers institutional terms, an admin plane, an SLA, or a promise to exist next semester. The owned floor is what makes the free options safe to use at all.

Sources verified directly: Meta's model page and September 2 announcement; Artificial Analysis, September 2; OpenCode Zen documentation; OpenRouter's rate-limit documentation and Terms of Service (updated August 31, 2026).

Every route to Muse Spark 1.3 — and its terms

Prices are per million tokens: input / cache read / output. The pattern to notice: the same model is sold at two prices, and the cheap one is paid for with your data.

Two more cautions from the survey: independent Terminal-Bench runs score Spark at 85–86 rather than Meta's 88.8, and most of Meta's launch comparisons used a "max" reasoning mode that was not generally available. And an instructive earlier incident: a misconfigured third-party test of Spark 1.1 gave the model internet access to a real target, and it changed real data — not a jailbreak, but proof that isolation and target validation are the harness's job, not the model's.

Longevity — the dated record behind the "free" offer

The harness landscape — what a university could actually stand on

A harness is the software people touch: the chat front door, the coding agent, the research tool. A powerful harness does not make a model smarter; it gives the model context, memory, tools, and authority — which is exactly why the choice matters for a campus. Snapshot September 3, 2026. Controls legend: I identity/SSO, B enforceable per-user budget, A audit/admin policy; Y verified, N absent, U not publicly proved. No product published a current accessibility conformance report — "a11y U" means unproven, not unusable.

Chat and assistant front doors

Coding and agent harnesses

Research, retrieval, and workflow harnesses

Lifecycle matters more than popularity: Roo Code was discontinued in May 2026, Continue's repository is read-only, and Khoj's hosted direction is shrinking. Open WebUI, LobeHub, Dify, and n8n carry licenses that are not ordinary permissive open source and should not be presented as such.

What an agentic harness buys — and risks — in a classroom

The controls that make it safe — each one is already a design commitment of this plan:

• Treat repository text, web pages, documents, issues, and MCP output as untrusted input. Prompt injection can become shell execution.
• Run every student or researcher agent in an ephemeral container/VM. Do not mount the home directory or credential stores.
• Deny outbound network access by default; allow only named package registries and approved endpoints.
• Use short-lived, task-scoped credentials. Default repository access to read-only; deny deploy, publish, push, billing, and production tools.
• Require a person to approve file writes outside the workspace, shell/network actions, package installation, and consequential tool calls.
• Put all model traffic through LiteLLM for identity, model allowlists, per-user budgets, cost alarms, and emergency shutoff.
• Keep FERPA, HR, finance, security, unpublished research, controlled data, credentials, and proprietary partner material out of contributor/free-training routes.
• Set course-level rules for disclosure, allowed tools, retained work logs, individual contribution, and assessment design.
• OpenCode’s current permission system supports allow/ask/deny rules, but most ordinary actions are permissive by default. UVU must ship its own deny-first profile. Permissions
• The UnderSpecBench study found that agents guess action boundaries when operational tasks are underspecified. Assignment and run instructions must explicitly define allowed targets and actions. Paper

Three tiers, one router

The layers stay separate on purpose: a broad chat portal, a shell-capable coding agent, and a credentialed workflow engine do not belong inside one permission boundary.

Verdict on Spark

Muse Spark 1.3 changes the frontier-pool candidate list, not the architecture.

The paid pilot should not start until Meta's or the gateway's current terms confirm, in writing: no training, retention period, geography, incident handling, rate limits, and permitted educational use. Survey: working paper 34, September 3, 2026.

Every provider with free access — the inventory

Twenty-eight providers checked on their own pricing, limit, and terms pages on September 3, 2026. "Free" turns out to mean six different things: a renewable allowance, a one-time signup credit, a thirty-day trial, a limited-time promotion, a data-for-discount trade, or nothing at all. The survey's headline: OpenAI, Anthropic, xAI, Together, DeepInfra, and Meta's own API have no recurring free generation tier; GitHub Models — the most generous free gateway of 2025 — was fully retired on July 30, 2026, after about 23 months.

Data terms and account rules — in the providers' own words

The capacity math, done properly

One "turn" below is one prompt-and-response of 700 input and 300 output tokens; a four-turn chat is four turns. Phase-1 demand: 36,600 people × 2.15 turns per day ≈ 78,690 turns per day; exam-week stress ≈ 708,000. The three most generous recurring, publicly measurable free offers, combined:

The answer in one sentence: free tiers cover about 1.4% of the campus's base day as a centrally operated service; the only way to 100% is to centralize thousands of personal accounts, which the providers' terms forbid — and the daily numbers are generous, because the same providers cap requests per minute at 20–30 with no promise of burst capacity against a base of ~53 simultaneous conversations and an exam-week peak near 474. Separately, a real person's own free account can cover that person's own demand — a genuine personal benefit, but not campus infrastructure UVU can promise, audit, or revoke.

What breaks at university scale

1. Account farming is not a lawful architecture. Groq expressly prohibits orchestrating usage across multiple organizations. Cloudflare prohibits scripted multi-account creation and quota circumvention. OpenRouter and OpenCode prohibit multiple accounts used to bypass limits.
2. A real person’s account is not UVU capacity. The person controls consent, settings, deletion, model selection, and account continuity. UVU cannot promise access, audit activity, revoke all access centrally, or move unused personal quota into a campus pool.
3. 36,600 credentials become a security system of their own. Providers say keys must remain confidential and must not be embedded client-side. Central collection would create a high-value credential store; sharing keys often violates the applicable terms.
4. Sensitive data leaves campus under inconsistent terms. Google explicitly warns against confidential, sensitive, or personal information in its unpaid API. Muse Contributor permits training. Cohere trial data may support R&D and safety. NVIDIA trial terms allow some service-improvement use.
5. FERPA needs control, not merely a privacy promise. The FERPA school-official exception requires the institution to exercise direct control over the vendor’s use and maintenance of education records. Personal consumer accounts normally do not create that relationship. U.S. Department of Education FERPA guidance
6. UVU’s own rules follow the data wherever it is stored. UVU classifies grades, schedules, disciplinary, financial, payroll, research and similar data as Sensitive/Confidential, including when a contractor or cloud stores it. UVU data classification · Policy 445, effective 2024-03-28 · Policy 447, effective 2026-08-10
7. Free services lack institutional controls. Some have team dashboards, but personal free accounts generally lack UVU SSO, SCIM, domain claims, legal hold, central retention, eDiscovery, audit export, data-region choice, and contract remedies.
8. Models rotate silently or with short notice. OpenRouter’s router chooses among available models; Mistral Labs permits silent updates; NVIDIA trial endpoints can change; OpenCode says free models are limited-time. GitHub Models demonstrates that an entire service can disappear.
9. No SLA means no floor. Status histories show good averages for several vendors, but free/trial terms do not promise capacity during registration, class-change bursts, finals, or provider-wide shortages.
10. Age and consent complicate rollout. Google’s developer API requires users to be 18+. Groq’s current service agreement is also adult/business focused. UVU still has some under-18 students.

Governance conclusion, not legal advice: Public-class prompts may use personal or free tiers after clear notice; anything Sensitive or Confidential needs an approved institutional service with a data-processing agreement and a reviewed processing chain — which is what the owned floor is.

Free, metered, or owned — the honest three-way comparison

The finding worth sitting with: at the observed prompt rate, a cheap hosted open model can cost less than the machines — roughly $9k–$32k over three years for inference alone against about $80k of owned hardware. The owned floor earns its place through privacy, continuity, and control, not because local inference is always cheaper. The guide has said this since its first version (§12); this survey puts numbers under it from the free-provider side.

Longevity — twenty dated events

Reading the business models: small renewable credits that lead naturally to pay-as-you-go (Vercel, Mistral, Cloudflare, IBM) are the more durable kind; subsidized GPU giveaways to win developers (OpenRouter free routes, NVIDIA's hosted trial, OpenCode promotions) are the less durable kind; one-time signup credits are not capacity at all. GitHub, Chutes, and xAI ended their free offers rather than maintaining them.

Verdict, provider by provider

Survey: working paper 33, September 3, 2026 — every limit read from the provider's own page, every quoted clause from its terms; "unknown" marks where a number lives only behind a login. No accounts were created and no requests were sent; the numbers are what the providers publish, not what they deliver under load.

Appendix L compared twenty-five harnesses in depth. This appendix widens the lens to the whole market as of September 3, 2026: 171 products and projects, each with its form, license and first release, owner or backer, public scale, growth and release cadence, disclosed capital, stability signals, any rating or benchmark placement, provider and local-model support, identity and budget controls, data and telemetry defaults, and a university verdict. Three feeds were merged: a dedicated survey lane over GitHub trending, awesome-lists, marketplaces, package registries, funding announcements, and press; a live pull from the GitHub API for 86 repositories (below); and an X trend scan whose findings appear as their own section below. Every cell carries its grade: fact a source states it, est derived, unknown not independently verified. Stars are an interest signal, never proof of adoption, quality, or safe operation.

The short version

• Reach is concentrated in the big consumer and enterprise assistants — ChatGPT, Gemini, Meta AI, GitHub Copilot, Microsoft 365 Copilot, Replit, Gemini Notebook, Claude. Open-source attention concentrates in Ollama, AutoGPT, Dify, Langflow, Open WebUI, LangChain, llama.cpp, OpenCode, and n8n.
• Funding is concentrating around foundation-model vendors and coding agents: OpenAI, Anthropic, Cognition, Replit, Lovable, Cursor, CodeRabbit, Ollama, Braintrust, Qodo.
• The sharpest new GitHub spikes — DeepSeek Harness, Ponytail, Graphify, Caveman, ECC, Paperclip, OpenMAIC, openclaude — need provenance and real-usage validation before any procurement conversation; several show star patterns no organic project produces.
• Clear retirement or migration risk: Flowise, Roo Code, Continue, OpenAI Swarm, the old AutoGen and Semantic Kernel agent paths, Sourcegraph Cody's retired tiers, Amazon Q CLI, and the consumer Gemini CLI path.
• The plan's base still maps well: LiteLLM as the routing boundary, LibreChat as the front door, llama.cpp as the floor, OpenCode/Cline-class coding, Onyx-class research. The market evidence argues for testing more harnesses around that boundary, not replacing it.

Four rankings — how the market is moving

All four are market-motion scores on a 0–100 scale est, not quality, security, or procurement scores. Method:

• Adoption: 55% active/paid-user evidence, 20% installs or package use, 15% repository reach, 10% organization/revenue evidence. Missing dimensions were renormalized. Vendor claims received a confidence discount.
• Growth: 70% percentile rank of the best recent user, install, download, or star-growth measure; 30% recency and evidence quality. Shorter intervals were annualized only for ranking and are shown explicitly.
• Funding momentum: 65% log-scaled disclosed amount, 20% recency, 15% strategic or revenue evidence. Acquisitions without a disclosed price received no invented amount.
• New and rising: limited to products first released or materially relaunched within nine months; 60% recent velocity, 20% age, 20% release activity.
• These are market-motion scores, not security, quality, accessibility, or procurement scores.

The growth and new-entrant columns deserve special caution: the DeepSeek Harness, Ponytail, ECC, Graphify, Caveman, OpenClaw, and qm star patterns are large enough that stars should not be accepted as adoption without package use, identifiable users, repository provenance, and contribution-distribution checks.

Declining or dead — with dates

Open-source status also needs care:

• Open WebUI’s custom license restricts rebranding for deployments with 50 or more users. License explanation
• Dify’s modified Apache license restricts certain multi-tenant and branding uses. Dify license
• n8n moved to its Sustainable Use License. License announcement
• Crush uses FSL-1.1-MIT, which is source-available rather than immediately permissive.
• Phoenix’s server uses the Elastic License 2.0.
• These are not necessarily blockers for internal university use, but they are procurement and redistribution constraints.

Stability and longevity — the top 40, scored on six axes

L, M, H mean low, medium, or high risk, not product quality. Axes: VD vendor/platform dependence · LIC license or future-use risk · RUN funding/runway · BUS maintainer concentration · GOV governance concentration · BRK breaking-change churn. A dated desk assessment, not a security audit.

Category maps

Fit to this plan — pilot, watch, avoid

The market evidence does not justify replacing the architecture. The smaller, safer move is to keep the router as the boundary and test additional harnesses around it.

Pilot gates that apply to every harness:

1. Route provider calls through LiteLLM unless the pilot requires a documented exception.
2. Use university identity, role separation, audit logs, budget caps and short retention.
3. Test FERPA exposure, accessibility, source attribution, prompt-injection handling, export and deletion.
4. Deny browser/file/shell/network permissions by default; enable only the minimum needed.
5. Record model, harness, version, policy and evaluation set together. A model benchmark is not a harness benchmark.
6. Require an exit path: configuration export, data export, provider substitution and rollback.
7. Run pilots for 90 days before changing the campus standard.

Live GitHub snapshot — 86 repositories, pulled directly from the API

Our own pull on September 3, 2026, independent of the survey: stars, forks, creation and last-push dates, latest release, archive state. Four projects are archived and nine had no code pushed in over 90 days — including two the earlier survey had described as active. This is the check that keeps "popular" and "maintained" from being confused.