Dynamic model selection

The execution-path optimizer is the strategy authority. It qualifies offers against the candidate pool and hard exclusions before selection. An authoritative decision returns from IntelligenceService before the legacy gate/ranker branch. That branch is a feed or explicit compatibility path, not the literal sequence for every request.

The legacy EligibilityGate uses allow, deny, and unknown; only allow passes. Its named drop reasons include the following. The optimizer also records offer-specific rejection reasons, so this is not a universal receipt schema:

Live preparation runs only for an execution-path request without a supplied pool receipt and with an available live snapshot. It requires Core metadata and passes the task profile's spend policy into admission. Existing pool receipts are not rebuilt; an absent snapshot leaves the request unchanged. Production defaults to requiring execution-path authority, but explicit context, configuration, or environment settings can permit compatibility.

Unknown is not healthy

• Status: Shipped
  Explicit freshness

  Availability is cached with a documented freshness window. Entries are keyed by provider, model, and policy version, so one source cannot contaminate another. An expired entry or a failed refresh becomes an explicit unknown or error state.

• Status: Shipped
  Protected work fails closed

  For protected work, an absent or stale health signal excludes the candidate. A degraded probe is not ready, and a catalog timeout is blocked rather than treated as success.

• Status: Shipped
  Capability passports

  Qualification is a versioned passport for one exact route. A hard requirement is met only by a fresh observed supported value; missing, expired, or claim-only evidence resolves to unknown.

Proving routes against a live gateway

• Status: Experimental
  Prove at rest, confirm at request time

  A background process proves only free-tier models on active providers. Paid models are never probed. At request time a small, budgeted confirm probe runs, and only confirmed identities may be selected.

• Status: Experimental
  Consent and budget for probes

  Live probes that could spend money require explicit operator consent and a spend budget.

Spend policy bounds admission. Worthiness is one input to live preparation, not a promise that every task follows a local/free/paid order. The optimizer compares complete strategies by expected cost with free_first=False.

• free_only excludes paid identities. frontier_required admits only frontier-class paid identities.
• Free status is observed, never inferred. A model is free, paid, or UNKNOWN, and a missing price never counts as free.
• free_preferred prefers a surviving free identity in the admission receipt. That feed does not replace the optimizer as strategy authority.
• An authoritative session decision can restrict selection to its still-qualified route and defer other qualified offers. This is not a universal cheapest-model guarantee.

For autonomous sessions, Verdict selects the exact controller before the session launches: provider, model, and reasoning setting. The supervisor executes that decision. It never ranks, substitutes, or falls back.

• In automatic mode, the decision comes from live eligibility, a context plan for each candidate, and the execution-path optimizer. A routing receipt is persisted before anything launches.
• An operator override must name both provider and model. One-sided flags, auto/*, and default are rejected, and the override must still be in the live eligible set.
• After launch, the observed identity must exactly match the approved one. On a mismatch, Verdict stops only the process it owns and fences the attempt.
• Continuity is explicit: a healthy current route stays, an ineligible one switches, and no eligible route means blocked.

These rules are covered by unit tests. End-to-end operation depends on a live gateway and the Prime agent runtime, which is why the section is labeled Experimental.

A blocked result is still a result: it comes with a receipt that names every candidate and why it was dropped, so the operator can fix the cause rather than guess at it.