feat(auto): surface routing scope and per-turn receipts

[Hmbown]

Summary

• record a typed Auto routing receipt with the effective provider-safe strong/fast pair, selected tier, source/reason, selection scope, and routing data path
• carry the receipt from accepted dispatch through the authoritative turn route and retain it for the completed-turn inspector
• redact the complete classifier prompt after recent tool results have been flattened, using the same exact configured-secret boundary as model-bound tool output
• derive receipt pairs from a runnable pair that actually contains the selected model, so non-default OpenRouter families cannot be reported as the provider's default DeepSeek pair
• persist the latest provider identity, model, and receipt atomically across automatic snapshots, /save, fork, rename, and session restore while keeping older session JSON loadable
• replace the vague select per turn picker hint with localized disclosure of local vs. DeepSeek classifier behavior and the last resolved provider/model
• show the exact resolved route, pair, tier, reason, scope, and classifier data path in Ctrl+O Turn Inspector output

Why

Auto routing can select across the runnable provider inventory and send the latest request plus bounded recent context to DeepSeek / deepseek-v4-flash. Before this lane, the picker did not disclose that behavior and the decision metadata was not attached to the exact turn. The initial implementation also exposed two release blockers: flattened tool results could bypass structured tool-result redaction, and a non-default OpenRouter model could inherit the provider default's unrelated pair in its receipt.

This makes the existing behavior observable, auditable, secret-safe, model-family-correct, and durable across TUI session lifecycle operations without copying credentials, endpoints, provider failure text, or raw classifier errors into diagnostics.

User impact

The model picker now states whether a routing request may be sent and shows the last resolved route. After dispatch, the localized toast identifies the concrete route and source. The Turn Inspector keeps the detailed receipt aligned with the authoritative runtime route, including classifier-fallback cases where data was sent before the local heuristic took over. The latest receipt remains available after saving and resuming the session.

Verification

Exact tested head: e6215f6a354ee9764a81bdddada728cf3d5455ca
Rebased base: 8ab67a0bc03ac78406677339f3e4e3714e138885

• cargo fmt --all -- --check
• git diff --check origin/main...HEAD
• cargo clippy -p codewhale-tui --bin codewhale-tui --locked -- -D warnings
• cargo test -p codewhale-tui --bin codewhale-tui --locked model_routing — 27 passed
• cargo test -p codewhale-tui --bin codewhale-tui --locked model_inventory — 10 passed
• cargo test -p codewhale-tui --bin codewhale-tui --locked localization::tests:: — 17 passed
• cargo test -p codewhale-tui --bin codewhale-tui --locked model_bound_request_ — 3 passed
• cargo test -p codewhale-tui --bin codewhale-tui --locked commands::groups::session::session::tests — 31 passed
• cargo test -p codewhale-tui --bin codewhale-tui --locked auto_route_receipt — 2 passed

Deliberate residual scope

• This PR does not change the product policy to provider-scoped Auto by default or add an across-provider opt-in. That decision remains open in Define a provider-scoped default and consent flow for cross-provider Auto routing #4411.
• This PR does not add user-configurable strong/fast provider-pair overrides. Existing validated provider pairs remain the source of truth.
• Session persistence retains the latest interactive TUI receipt; a historical receipt ledger, runtime-thread API exposure, and dedicated sub-agent receipt UI remain follow-up scope.
• Existing provider-aware child routing and [auto] cost_saving behavior from fix(auto): honor cost_saving in inventory routing #4486 are preserved.

Refs #4405
Refs #4411

[Hmbown]

Release-blocker fixes are pushed at exact head e6215f6a354ee9764a81bdddada728cf3d5455ca, rebased on current main 8ab67a0bc03ac78406677339f3e4e3714e138885.

Resolved in this head:

• classifier prompts now pass through exact configured-secret redaction after tool results are flattened into bounded routing context
• receipt pairs are derived from the selected runnable model family, so a non-default OpenRouter route cannot be labeled with the provider default DeepSeek pair
• the latest Auto provider identity, model, and receipt persist atomically across automatic snapshots, /save, fork, rename, and resume; legacy session JSON still loads without migration

Exact-head local gates are green: fmt, diff check, bin clippy with warnings denied, 27 routing tests, 10 inventory tests, 17 localization tests, 3 model-bound redaction tests, 31 session lifecycle tests, and 2 receipt persistence tests. Hosted CI restarted for the rebased head and is currently queued/running.

The PR body now reflects the corrected durability claim and the remaining scope: latest TUI receipt persistence is included; a historical receipt ledger and runtime-thread/sub-agent receipt surfaces are not. The release changelog lane in #4487 should list this PR after merge. Contributor credit is unchanged; no external contributor material was added by this fix.

[Hmbown]

Rebased cleanly onto exact main 0c6109cfb56f058bee75e76f885a04ac644f284b (including #4498's hook EOF fix) and force-pushed with an exact lease.

New exact head: 1e7c0164499c6890cfe26bbd83dc940c00501e79

Local exact-head verification passed:

• cargo fmt --all -- --check
• git diff --check origin/main...HEAD
• TUI model_routing (27), model_inventory (10), localization (17), model-bound request (3), session (31), and auto-route receipt (2) tests
• cargo clippy -p codewhale-tui --bin codewhale-tui --locked -- -D warnings

Fresh exact-head CI and CodeQL are running now; I will not mark ready or merge until the platform matrix is green.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.