feat(routing): add cheapest-capable local worker routing

[Nobodyworld]

Summary

Implements issue #134: deterministic cheapest-capable routing among trusted actively polling local workers, with server-owned integer cost/quota profiles and atomic quota lifecycle.

base / merge base: 7587a77a32e07f180d21cec65881c7868afa0e4d
branch: feat/cheapest-capable-local-routing
current head: 49b96ea361c9532d60eaf031582a8f55c52f228a
ahead of main: 4
behind main: 0
state: implementation complete; one narrow connector correction required; draft and unmerged

Delivered behavior

• first_available remains the omitted-policy compatibility default.
• cheapest_capable selects the deterministic best fully eligible actively polling local worker.
• Ranking uses integer cost, post-reservation quota headroom, integer-safe load ratio, operator priority, and lexical worker ID.
• Worker routing profiles and quota state are privileged server-owned records.
• Explicit worker pins remain hard pins but bypass no health, polling, capability, capacity, budget, quota, network, read-only, approval, lease, reuse, or evidence check.
• Capacity, quota, work-order claim, run creation, lease creation, and route provenance are transactional.
• Quota reserve, consume, release, reset, and retry behavior is revision-safe and idempotent.
• Route provenance and assessment APIs are bounded and do not expose paths, commands, credentials, environment dumps, machine identity, or candidate lists.
• This slice does not execute a paid provider or coding agent.

Implementation scope

30 files changed across the living ExecPlan, execution persistence/service/API, routing/scoring, settings, worker response parsing, concurrency and lifecycle tests, and operator documentation.

Connector-observed diff:

4 commits
30 files
4,257 additions
76 deletions

Implementation commits:

• 2e9b38c02099c1435517daba69d582342eb479ee — feat(routing): add cheapest capable local checkout
• 95515bbc96bd872f727146988a7e90697a182d40 — test(routing): prove atomic quota lifecycle
• 49b96ea361c9532d60eaf031582a8f55c52f228a — docs(routing): document local cost-aware routing

Current validation

Local evidence reported for the exact head:

• focused server: 88 passed;
• focused worker: 42 passed;
• full pytest: 570 passed, 5 platform-conditional skips;
• strict browser: 2 passed, zero skips;
• coverage: 93% aggregate; all 16 configured thresholds passed;
• pip check in the repository environment, pre-commit, TODO policy, Ruff, Black, Mypy, Bandit under compatible Python 3.13, pip-audit, Gitleaks, Lychee, public hygiene, clean tree, and git diff --check passed;
• no known dependency vulnerabilities and no secret leaks.

Hosted exact head:

• Commitlint 30718472333 — success;
• CI 30718472369 — success;
• lint, typecheck, test, security, Secrets audit, Link check, Coverage, and Browser UI tests all succeeded.

Connector review

Connector review 4835888072 found one restart-compatibility blocker:

• CommandManifest now maps a non-null updated_at column, but the additive startup compatibility routine does not add/backfill that column on the existing execution_command_manifests table from current main. create_all() will not alter the table, and startup immediately selects the full manifest ORM model. Existing databases may therefore fail during upgrade.

Required narrow correction:

1. remove the unused manifest updated_at field or migrate/backfill it idempotently;
2. add a prior-schema manifest-table startup regression that runs lifespan twice and proves manifest resolution/read succeeds;
3. rerun focused startup/routing tests and the complete local/hosted matrix.

No routing, quota, scoring, API, worker, or product redesign is requested.

Keep PR #135 draft and unmerged until the correction and connector re-review pass.

Closes #134 only after explicit owner-authorized merge.

[Nobodyworld]

Issue #134 final-head validation

• Head: 49b96ea361c9532d60eaf031582a8f55c52f228a
• Commitlint workflow: 30718472333 — success
• CI workflow: 30718472369 — success
• Required checks: Commitlint, lint, typecheck, test, security, Secrets audit, Link check, Coverage, and Browser UI tests all passed.
• Local complete pytest: 570 passed, 5 skipped.
• Local strict browser: 2 passed with strict skip enforcement.
• Local configured coverage: 93% aggregate; all 16 module thresholds passed.

The PR remains draft, open, and unmerged.

[Nobodyworld]

Connector review found one release-blocking restart-compatibility gap.

CommandManifest now maps a new non-null updated_at column, but the additive startup compatibility routine does not add or backfill updated_at on an existing execution_command_manifests table. The base main schema has only created_at; Base.metadata.create_all() does not alter existing tables; and startup immediately calls ensure_manifests(), which selects the full ORM model. A repository database created by current main can therefore fail with a missing-column error during upgrade.

Correct this narrowly by either removing the unused manifest updated_at field or adding an idempotent additive migration/backfill. Add a regression that creates the prior manifest table shape, seeds or resolves a trusted manifest, runs lifespan startup twice, and proves manifest reads still work. Re-run the focused startup/routing suites and complete protected matrix. Keep PR #135 draft and unmerged until re-review.

No redesign of routing, scoring, quota, APIs, or worker behavior is requested.