feat(api): adaptive orchestration router selects modes under budget

CHANGELOG.md

@@ -6,8 +6,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target.
 - `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure.
-- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).
 - `persistence_postgres` concurrent document-write stress: atomic revise `DO` block that requires exactly one open `system_to` close, SQLSTATE mapping onto `ConcurrentWriteConflict` / `DuplicateDocumentRecord`, and live multi-session insert/revise/append-only proofs. No new migration number.
 - `tepp_api` naruon HTTP interchange: versioned `https` POST contracts for analysis-run create and modular export authorization that refuse table-access URLs, review/Copilot credential headers, reserved standard-header redefinition, principal-only export idempotency keys, and lexical inference claims (ADR 0011).

DOCUMENTATION.md

@@ -35,6 +35,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Actions fleet research doctoring | [`docs/research/actions-workflow-fleet.md`](docs/research/actions-workflow-fleet.md) |
 | Retention/deletion/legal-hold doctoring | [`docs/research/retention-deletion-legal-hold.md`](docs/research/retention-deletion-legal-hold.md) |
 | Provider-payload minimization doctoring | [`docs/research/provider-payload-minimization.md`](docs/research/provider-payload-minimization.md) |
+| Adaptive orchestration router doctoring | [`docs/research/adaptive-orchestration-router.md`](docs/research/adaptive-orchestration-router.md) |
 | Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |
 

crates/tepp_api/src/lib.rs

@@ -15,6 +15,7 @@ mod envelope;
 mod error;
 mod export;
 mod naruon_http;
+mod orchestration;
 mod provider_payload;
 mod wire;
 
@@ -67,6 +68,42 @@ pub use naruon_http::naruon_analysis_run_exchange_with_headers;
 pub use naruon_http::naruon_export_exchange;
 /// Refuse lexical heuristics as TEPP inference claims.
 pub use naruon_http::naruon_may_claim_tepp_inference;
+/// Comparable-budget ablation record.
+pub use orchestration::BudgetAblationRecord;
+/// Credential-free contextual-orchestrator binding.
+pub use orchestration::ContextualOrchestratorBinding;
+/// Document attempt to override TEPP orchestration authority.
+pub use orchestration::DocumentControlAttempt;
+/// Bounded interpretation task kind.
+pub use orchestration::InterpretationTaskKind;
+/// Maximum access capabilities on one orchestration request.
+pub use orchestration::MAX_ORCHESTRATION_ACCESS_ENTRIES;
+/// Maximum UTF-8 bytes in one orchestration access token.
+pub use orchestration::MAX_ORCHESTRATION_ACCESS_TOKEN_BYTES;
+/// Maximum billable token budget on one orchestration request.
+pub use orchestration::MAX_ORCHESTRATION_TOKEN_BUDGET;
+/// Orchestration contract version for contextual-orchestrator bindings.
+pub use orchestration::ORCHESTRATION_CONTRACT_VERSION;
+/// Versioned TEPP orchestration policy identity.
+pub use orchestration::ORCHESTRATION_POLICY_VERSION;
+/// Versioned orchestration mode.
+pub use orchestration::OrchestrationMode;
+/// Governed orchestration plan.
+pub use orchestration::OrchestrationPlan;
+/// Orchestration router request.
+pub use orchestration::OrchestrationRequest;
+/// Orchestration role identity.
+pub use orchestration::OrchestrationRole;
+/// Role-specific reasoning effort.
+pub use orchestration::ReasoningEffort;
+/// Role plus recorded reasoning effort.
+pub use orchestration::RoleAssignment;
+/// Bind a plan for contextual-orchestrator execution.
+pub use orchestration::bind_contextual_orchestrator;
+/// Record a comparable-budget ablation against a direct baseline.
+pub use orchestration::record_budget_ablation;
+/// Route a task onto a versioned orchestration plan.
+pub use orchestration::route_orchestration;
 /// Elevated re-identification result.
 pub use provider_payload::DisclosedIdentityMapping;
 /// Separately protected identity mapping.