Routing Policy
Omegon preserves the operator or caller's selected provider/model intent separately from the serving provider/model that receives a request. They are equal on a direct route and both remain visible when declared fallback compatibility produces a different serving route.
Resolution boundary
- Capture intent - provider-neutral grade/provider policy or an exact concrete model pin.
- Resolve a contribution - require a validated, executable provider declaration and an accepted credential or declared local posture.
- Apply bounded compatibility - exact resolution probes only the selected provider; ordinary resolution may use only a directed, model-family-bounded fallback declared by that contribution.
- Record evidence - persist selected and serving route identity, contribution generation, route policy, tool-schema posture, credential-source/authentication-class evidence, and any bounded fallback reason before dispatch.
Runtime inventory carries endpoint, offering, modality, capability, and provenance evidence. Inventory diagnostics can identify missing evidence, but the current dispatch path does not use those diagnostics as an eligibility gate. Inventory presence alone does not supply a bridge or make a provider executable.
Downgrade Classification
When a model switch would change the context class, the harness classifies the transition:
| Classification | Action | Example |
|---|---|---|
| Compatible | Auto-reroute (silent) | Massive → Extended (1 class, within floor) |
| Compatible with Compaction | Auto-compact if safe | Floor bridgeable, no pin crossed |
| Degrading | Operator confirmation required | Massive → Compact (3-class drop) |
| Ineligible | Excluded from candidates | Grade mismatch, thinking constraint |
Retry, fallback, and unknown completion
Upstream provider-request failures are classified before retry. Transient failures use capped exponential backoff with jitter; bounded runs honor their configured attempt cap, while interactive runs use failure-specific elapsed-time envelopes and can keep retrying Codex overload while cancellation remains available.
- Transient provider or transport failure (overload, 5xx, timeout, selected network/stream failures) retries the request on the captured serving route within the active envelope.
- Fallback is a separate resolution step to a declared-compatible serving provider; retry does not grant fallback permission.
- Auth, quota, invalid request, or context overflow surfaces for explicit remediation or the applicable context policy.
- User abort performs no recovery action and is not a failure.
This retry happens before a completed tool call is dispatched. It is not permission to replay a privileged invocation after owner handoff; unknown mutating completion follows the durable session recovery rules and is not blindly retried.
Route lease durability
Session-backed dispatch appends route.lease_recorded for the active turn before the provider call. The authority stream reduces those facts into snapshot route_leases. Sessionless work records the same lease shape in a versioned step wrapper inruntime/route-leases.jsonl under the Omegon home, with an ephemeral step identity and no fabricated session or turn identity. There is currently no operator command that lists historical route leases; current route and status views are not lease-history projections.