feat(routing): add cheapest-capable local worker routing

[Nobodyworld]

Completed

Issue #134 was completed by owner-authorized squash merge of this PR.

final PR head: bdc083446e3c3791be54fbfdc13e8d4a720f2812
squash merge / main: 223df7752716dd6ad35e75ba7613eeb03cfb2887
base: 7587a77a32e07f180d21cec65881c7868afa0e4d
Commitlint: 31241470808 — success
CI: 31241470807 — success
connector re-review: 4888283390 — no remaining blocker

Delivered behavior

• first_available remains the omitted-policy compatibility default.
• cheapest_capable deterministically selects the best fully eligible actively polling local worker.
• Worker routing profiles and quota state are privileged, server-owned, integer-based records.
• Ranking uses cost, post-reservation quota headroom, integer-safe load ratio, priority, and lexical worker ID.
• Hard worker pins bypass no health, polling, capability, capacity, budget, quota, network, read-only, approval, lease, reuse, or evidence check.
• Capacity, quota, work-order claim, run, lease, and route provenance are transactional.
• Quota reserve, consume, release, reset, retry, and requeue behavior is revision-safe and idempotent.
• Route assessment and provenance are bounded and redacted.
• Result-affecting routing inputs are bound into execution/reuse policy identity.
• No paid provider or coding agent is executed.

Final evidence

• focused correction groups: 89 passed and 52 passed;
• full pytest: 571 passed, 5 platform-conditional skips;
• strict browser: 2 passed, zero skips;
• aggregate coverage: 93%; all 16 configured thresholds passed;
• pip check, pre-commit, TODO policy, Ruff, Black, Mypy, Bandit, pip-audit, Gitleaks, Lychee, git diff --check, cleanup, and public hygiene passed;
• no known dependency vulnerabilities and no secret leaks across 247 commits;
• all required hosted lint, typecheck, test, security, Secrets audit, Link check, Coverage, and Browser UI jobs succeeded.

Review correction

The initial review found an existing-database restart incompatibility caused by an unused CommandManifest.updated_at mapping. The final correction removed that field and added a file-backed prior-schema regression proving two successful startups, stable manifest identity/digest, no duplication, and preserved routing schema.

This merge does not add paid-provider execution, MCP, browser/RPA workers, automatic approval, automatic merge, repository writes, or actual financial accounting.

[Nobodyworld]

Issue #134 final-head validation

• Head: 49b96ea361c9532d60eaf031582a8f55c52f228a
• Commitlint workflow: 30718472333 — success
• CI workflow: 30718472369 — success
• Required checks: Commitlint, lint, typecheck, test, security, Secrets audit, Link check, Coverage, and Browser UI tests all passed.
• Local complete pytest: 570 passed, 5 skipped.
• Local strict browser: 2 passed with strict skip enforcement.
• Local configured coverage: 93% aggregate; all 16 module thresholds passed.

The PR remains draft, open, and unmerged.

[Nobodyworld]

Connector review found one release-blocking restart-compatibility gap.

CommandManifest now maps a new non-null updated_at column, but the additive startup compatibility routine does not add or backfill updated_at on an existing execution_command_manifests table. The base main schema has only created_at; Base.metadata.create_all() does not alter existing tables; and startup immediately calls ensure_manifests(), which selects the full ORM model. A repository database created by current main can therefore fail with a missing-column error during upgrade.

Correct this narrowly by either removing the unused manifest updated_at field or adding an idempotent additive migration/backfill. Add a regression that creates the prior manifest table shape, seeds or resolves a trusted manifest, runs lifespan startup twice, and proves manifest reads still work. Re-run the focused startup/routing suites and complete protected matrix. Keep PR #135 draft and unmerged until re-review.

No redesign of routing, scoring, quota, APIs, or worker behavior is requested.

[Nobodyworld]

Connector correction final-head validation

• Connector review: 4835888072.
• Starting head: 49b96ea361c9532d60eaf031582a8f55c52f228a.
• Corrected head: bdc083446e3c3791be54fbfdc13e8d4a720f2812.
• Focused commit: fix(execution): preserve manifest schema upgrades.
• Correction: removed the unused CommandManifest.updated_at ORM field, preserving the immutable current-main manifest schema without adding mutable timestamp behavior.
• Prior-schema regression: file-backed SQLite table with the current-main manifest columns and no updated_at; first lifespan startup inserted/resolved the trusted manifest, second startup resolved/listed the same identity, no duplicate identity was created, and routing table/columns remained present.
• Focused validation: 89 passed and 52 passed.
• Complete pytest: 571 passed, 5 skipped.
• Strict browser: 2 passed, zero skips.
• Coverage: 93% aggregate; all 16 configured module thresholds passed.
• Local gates: clean-environment pip check, pre-commit, TODO policy, pinned Ruff/Black, Mypy, Bandit 1.8.6 under Python 3.13.7, pip-audit, Gitleaks, Lychee, diff check, artifact cleanup, and public hygiene passed.
• Commitlint workflow 31241470808 — success.
• CI workflow 31241470807 — success.
• Required CI jobs: lint, typecheck, test, security, Secrets audit, Link check, Coverage, and Browser UI tests — all succeeded.
• Local and remote branch SHAs match; the isolated worktree is clean.

PR #135 remains draft, open, and unmerged.

[Nobodyworld]

Final connector re-review of exact head bdc083446e3c3791be54fbfdc13e8d4a720f2812 found no remaining technical, security, migration, documentation, public-hygiene, or validation blocker.

The prior-schema blocker from review 4835888072 is resolved narrowly and correctly:

• the unused CommandManifest.updated_at ORM field was removed rather than inventing mutable timestamp semantics for immutable trusted manifests;
• a file-backed current-main manifest schema regression now runs lifespan twice, proves trusted-manifest insertion/lookup/listing, preserves one identity, and confirms routing tables/columns survive the upgrade;
• the correction is limited to the living ExecPlan, server/models.py, and server/tests/test_execution_startup.py.

Exact-head hosted evidence is green: Commitlint 31241470808 and CI 31241470807; lint, typecheck, test, security, Secrets audit, Link check, Coverage, and strict Browser UI jobs all succeeded. Local evidence reports 571 passed, 5 platform-conditional skips, strict browser 2 passed with zero skips, 93% aggregate coverage with all 16 thresholds, and all quality/security/public-hygiene gates passing.

No review threads remain. GitHub does not permit self-approval by the PR author, so this verdict is recorded as a COMMENT review. PR #135 is ready for owner merge gating at this exact head but must remain unmerged until explicit authorization.