Codex/lightgbm model tier policy

.gitattributes

@@ -25,3 +25,9 @@ src/opensquilla/squilla_router/models/v4.2_phase3_inference/*.yaml text eol=lf
 src/opensquilla/squilla_router/models/v4.2_phase3_inference/**/*.json text eol=lf
 src/opensquilla/squilla_router/models/v4.2_phase3_inference/**/*.txt text eol=lf
 src/opensquilla/squilla_router/models/v4.2_phase3_inference/**/*.yaml text eol=lf
+
+# Frozen LightGBM model-policy inference assets.
+src/opensquilla/squilla_router/lightgbm_model/** text eol=lf
+src/opensquilla/squilla_router/lightgbm_model/assets/**/*.joblib filter=lfs diff=lfs merge=lfs -text
+src/opensquilla/squilla_router/lightgbm_model/assets/**/*.pkl filter=lfs diff=lfs merge=lfs -text
+src/opensquilla/squilla_router/lightgbm_model/assets/**/*.gz filter=lfs diff=lfs merge=lfs -text

.github/actions/prepare-router-assets/action.yml

@@ -0,0 +1,16 @@
+name: Prepare router assets
+description: Prepare verified model assets and native dependencies before Gateway startup or packaging.
+runs:
+  using: composite
+  steps:
+    - name: Hydrate and verify router assets
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      run: |
+        set -euo pipefail
+        git lfs pull --include="src/opensquilla/squilla_router/models/**,src/opensquilla/squilla_router/lightgbm_model/assets/**"
+        PYTHONPATH=src python -c "from opensquilla.squilla_router.lightgbm_model import validate_artifacts; print(validate_artifacts())"
+    - name: Install macOS router runtime library
+      if: ${{ runner.os == 'macOS' }}
+      shell: bash
+      run: brew install libomp

.github/ci/suites.v1.json

@@ -56,7 +56,8 @@
     "tests/test_provider_ensemble.py",
     "tests/test_scripts/test_verify_webui_artifact.py",
     "tests/test_scripts/test_stage_webui_artifact.py",
-    "tests/test_packaging/test_webui_build_contract.py"
+    "tests/test_packaging/test_webui_build_contract.py",
+    "tests/test_lightgbm_router_model.py"
   ],
   "baseline_suites": [
     "dependency-audit",
@@ -543,7 +544,9 @@
         "tests/test_provider_ensemble.py",
         "tests/test_scripts/test_verify_webui_artifact.py",
         "tests/test_scripts/test_stage_webui_artifact.py",
-        "tests/test_packaging/test_webui_build_contract.py"
+        "tests/test_packaging/test_webui_build_contract.py",
+        "src/opensquilla/squilla_router/lightgbm_model/**",
+        "tests/test_lightgbm_router_model.py"
       ]
     },
     "release-packaging": {

.github/ci/trust-policy.v1.json

@@ -2,6 +2,7 @@
   "schema_version": 1,
   "merge_critical_inputs": [
     ".github/actions/download-required-artifact/action.yml",
+    ".github/actions/prepare-router-assets/action.yml",
     ".github/ci/dependency-audit.v1.json",
     ".github/ci/suites.v1.json",
     ".github/ci/trust-policy.v1.json",

.github/scripts/wait_ci_candidate.py

@@ -29,6 +29,8 @@ def api_failure(
 ) -> tuple[str, bool]:
     if isinstance(error, subprocess.TimeoutExpired):
         return "command-timeout", True
+    if error.returncode != 1:
+        return f"cli-exit-{error.returncode}", False
     stderr = error.stderr if isinstance(error.stderr, str) else ""
     # HTTP failures take precedence even if their response mentions a timeout.
     status = re.search(r"\bHTTP (\d{3})\b", stderr)
@@ -44,7 +46,13 @@ def api_failure(
                  r"\bClient\.Timeout exceeded while awaiting headers\b|"
                  r"\bnet/http: timeout awaiting response headers\b", stderr, re.IGNORECASE):
         return "network-timeout", True
-    return "unknown-cli-failure", False
+    if re.search(r"\bx509\b|certificate verify failed", stderr, re.IGNORECASE):
+        return "certificate-error", False
+    # gh uses exit 1 for general API failures, including transport errors whose
+    # wording varies across platforms. These are read-only metadata requests:
+    # bound unknown failures by the same retry/deadline limits as named errors.
+    # Other exits (including cancellation and authentication) remain terminal.
+    return "unknown-cli-failure", error.returncode == 1
 
 
 def remaining_wait(deadline: float) -> float:
@@ -77,7 +85,7 @@ def api(endpoint: str, *, pages: bool = False, deadline: float | None = None) ->
         except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as exc:
             reason, retryable = api_failure(exc)
             # This helper only reads Actions metadata. Never echo its captured
-            # response/body or retry authentication, validation or unknown errors.
+            # response/body or retry known authentication/validation failures.
             if attempt == 2 or not retryable:
                 raise MetadataApiError(
                     f"GitHub Actions metadata request failed: {reason}; "

.github/workflows/ci.yml

@@ -908,6 +908,9 @@ jobs:
       - name: Install Gateway dependencies
         run: uv sync --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Validate renderer capacity inventory
         id: capacity-inventory
         # Pure WebUI plans do not select Python shards. Run the existing
@@ -1069,6 +1072,9 @@ jobs:
       - name: Install Gateway dependencies
         run: uv sync --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Validate renderer capacity inventory
         id: capacity-inventory
         # Pure WebUI plans do not select Python shards. Run the existing
@@ -1371,6 +1377,9 @@ jobs:
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Lint
         shell: bash
         run: uv run ruff check src tests
@@ -1389,11 +1398,17 @@ jobs:
           [[ "$TIMING_BASE" =~ ^[0-9a-f]{40}$ ]] || { echo "Expected a full baseline commit SHA" >&2; exit 2; }
           git fetch --no-tags --depth=1 origin "$TIMING_BASE"
           baseline_dir="$(mktemp -d "$(dirname "$GITHUB_WORKSPACE")/gateway-timing-baseline.XXXXXX")"
-          trap 'rm -rf "$baseline_dir"' EXIT
-          git archive "$TIMING_BASE" > "$RUNNER_TEMP/gateway-timing-baseline.tar"
-          git get-tar-commit-id < "$RUNNER_TEMP/gateway-timing-baseline.tar" > "$baseline_dir/.gateway-timing-source-sha"
-          tar -xf "$RUNNER_TEMP/gateway-timing-baseline.tar" -C "$baseline_dir"
+          git worktree add --detach "$baseline_dir" "$TIMING_BASE"
+          trap 'git worktree remove --force "$baseline_dir"' EXIT
+          git -C "$baseline_dir" lfs pull --include="src/opensquilla/squilla_router/models/**,src/opensquilla/squilla_router/lightgbm_model/assets/**"
+          if [[ -f "$baseline_dir/src/opensquilla/squilla_router/lightgbm_model/model.py" ]]; then
+            PYTHONPATH="$baseline_dir/src" python -c "from opensquilla.squilla_router.lightgbm_model import validate_artifacts; print(validate_artifacts())"
+          fi
+          comparison_python="$(uv run --no-sync python -c 'import sys; print(sys._base_executable)')"
+          UV_PROJECT_ENVIRONMENT="$baseline_dir/.venv" uv sync --project "$baseline_dir" \
+            --python "$comparison_python" --extra dev --extra recommended --extra mcp --frozen
           uv run --no-sync python scripts/compare_gateway_timing.py \
+            --baseline-python "$baseline_dir/.venv/bin/python" \
             --baseline-root "$baseline_dir" --candidate-root "$GITHUB_WORKSPACE" \
             --baseline-sha "$TIMING_BASE" --candidate-sha "$(git rev-parse HEAD)" \
             --samples 3 --output "$RUNNER_TEMP/gateway-timing.json"
@@ -1511,6 +1526,9 @@ jobs:
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Preflight offline test environment
         shell: bash
         run: |
@@ -1745,6 +1763,9 @@ jobs:
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Record tool versions
         shell: bash
         run: |
@@ -2017,6 +2038,9 @@ jobs:
       - name: Install dependencies
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
+
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
       - name: Test bundle partition
         shell: bash
         run: |
@@ -2149,10 +2173,14 @@ jobs:
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Preflight offline test environment
         shell: bash
         run: |
           set -euo pipefail
+          uv run python -c "import platform; print('router test architecture:', platform.machine()); assert platform.machine().lower() in {'arm64', 'aarch64'}, 'Router parity must run on Apple Silicon'"
           uv run python -c "import pathlib, subprocess, sys, opensquilla; print('cwd:', pathlib.Path.cwd().resolve()); print('git:', subprocess.check_output(['git', 'rev-parse', '--show-toplevel', 'HEAD'], text=True).strip()); print('python:', sys.executable); print('package:', pathlib.Path(opensquilla.__file__).resolve())"
           uv run pytest \
             tests/test_sandbox/test_trusted_sandbox_execution.py \
@@ -2167,6 +2195,7 @@ jobs:
         run: |
           set -euo pipefail
           pytest_args=(
+            tests/test_lightgbm_router_model.py
             tests/test_recovery
             tests/test_migration/test_opensquilla_home_migration.py
             tests/test_desktop/test_electron_startup_contract.py
@@ -2359,6 +2388,9 @@ jobs:
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Install Desktop dependencies
         working-directory: desktop/electron
         shell: bash
@@ -3055,6 +3087,9 @@ jobs:
       - name: Install test dependencies
         run: uv sync --extra dev --extra recommended --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Run offline Community Skill contracts
         shell: bash
         env:
@@ -3146,6 +3181,9 @@ jobs:
         shell: bash
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Run release packaging contract tests
         shell: bash
         run: |
@@ -3241,6 +3279,9 @@ jobs:
       - name: Install locked development dependencies
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Build production WebUI artifact
         if: ${{ github.event_name == 'push' }}
         working-directory: opensquilla-webui

.github/workflows/desktop-native-probes.yml

@@ -53,6 +53,9 @@ jobs:
         mkdir -p "${RUNNER_TEMP}/desktop-native"
         printf 'CI_REPORT_DIR=%s\n' "${RUNNER_TEMP}/desktop-native" >> "${GITHUB_ENV}"
         uv sync --extra dev --extra recommended --extra mcp --frozen
+    - name: Prepare router assets for Gateway probes
+      if: ${{ matrix.probe != 'pty' }}
+      uses: ./.github/actions/prepare-router-assets
     - name: Verify recommended PTY and managed execution on the native platform
       if: ${{ matrix.probe == 'pty' }}
       shell: bash
@@ -112,7 +115,6 @@ jobs:
       shell: bash
       run: |
         set -euo pipefail
-        git lfs pull --include="src/opensquilla/squilla_router/models/v4.2_phase3_inference/**"
         mcp_image="opensquilla-mcp-ci:${GITHUB_SHA}"
         docker build --file Dockerfile --tag "${mcp_image}" . \
           2>&1 | tee "${CI_REPORT_DIR}/mcp-docker-build.log"

.github/workflows/docker-image.yml

@@ -81,7 +81,13 @@ jobs:
           fi
 
       - name: Hydrate router assets
-        run: git lfs pull --include="src/opensquilla/squilla_router/models/**"
+        run: git lfs pull --include="src/opensquilla/squilla_router/models/**,src/opensquilla/squilla_router/lightgbm_model/assets/**"
+
+      - name: Verify LightGBM router assets
+        run: |
+          if [[ -f src/opensquilla/squilla_router/lightgbm_model/model.py ]]; then
+            PYTHONPATH=src python3 -c "from opensquilla.squilla_router.lightgbm_model import validate_artifacts; print(validate_artifacts())"
+          fi
 
       # The Dockerfile hard-fails on LFS pointer files; failing here first
       # gives a clearer error than a mid-build SystemExit.

.github/workflows/gateway-authorization-timing.yml

@@ -14,7 +14,7 @@ name: Gateway authorization timing
   workflow_dispatch:
     inputs:
       baseline_sha:
-        description: Full baseline commit SHA with identical dependency inputs
+        description: Full baseline commit SHA (uses its own frozen dependency environment)
         required: true
         type: string
 
@@ -47,8 +47,11 @@ jobs:
         with:
           version: "0.12.15"
           enable-cache: true
-      - name: Install identical comparison dependencies
+      - name: Install candidate comparison dependencies
         run: uv sync --extra dev --extra recommended --extra mcp --frozen
+
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
       - name: Compare offline Gateway startup and Default first turn
         shell: bash
         env:
@@ -75,16 +78,32 @@ jobs:
           output = Path(os.environ["RUNNER_TEMP"]) / "gateway-timing" / "timing.json"
           subprocess.run(["git", "worktree", "add", "--detach", str(baseline), baseline_sha], check=True)
           try:
+              subprocess.run([
+                  "git", "-C", str(baseline), "lfs", "pull",
+                  "--include=src/opensquilla/squilla_router/models/**,src/opensquilla/squilla_router/lightgbm_model/assets/**",
+              ], check=True)
+              if (baseline / "src/opensquilla/squilla_router/lightgbm_model/model.py").is_file():
+                  subprocess.run([
+                      sys.executable, "-c",
+                      "from opensquilla.squilla_router.lightgbm_model import validate_artifacts; print(validate_artifacts())",
+                  ], cwd=baseline, env={**os.environ, "PYTHONPATH": str(baseline / "src")}, check=True)
+              subprocess.run([
+                  "uv", "sync", "--project", str(baseline),
+                  "--python", sys._base_executable,
+                  "--extra", "dev", "--extra", "recommended", "--extra", "mcp", "--frozen",
+              ], env={**os.environ, "UV_PROJECT_ENVIRONMENT": str(baseline / ".venv")}, check=True)
+              baseline_python = baseline / ".venv" / ("Scripts/python.exe" if os.name == "nt" else "bin/python")
               subprocess.run([
                   sys.executable, "scripts/compare_gateway_timing.py",
                   "--baseline-root", str(baseline), "--candidate-root", str(candidate),
                   "--baseline-sha", baseline_sha, "--candidate-sha", candidate_sha,
+                  "--baseline-python", str(baseline_python),
                   "--samples", "3", "--output", str(output),
               ], check=True)
               report = json.loads(output.read_text(encoding="utf-8"))
               with Path(os.environ["GITHUB_STEP_SUMMARY"]).open("a", encoding="utf-8") as summary:
                   summary.write("## Offline Gateway timing — " + os.environ["TIMING_PLATFORM"] + "\n\n")
-                  summary.write("Three alternating samples per source; offline provider, not model TTFT.\n\n")
+                  summary.write("Three alternating samples per source; same Python version, each source uses its own frozen dependencies. Includes dependency changes; offline provider, not model TTFT.\n\n")
                   summary.write("| Metric | Baseline median (ms) | Candidate median (ms) | Ratio |\n")
                   summary.write("| --- | ---: | ---: | ---: |\n")
                   for metric, ratio in report["candidate_over_baseline"].items():

.github/workflows/live-release-e2e.yml

@@ -52,6 +52,9 @@ jobs:
       - name: Install dependencies
         run: uv sync --extra dev --extra recommended --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Fail if OpenRouter secret is missing
         shell: bash
         run: |

.github/workflows/webui-browser-smoke.yml

@@ -50,6 +50,9 @@ jobs:
       - name: Install Python dependencies
         run: uv sync --extra dev --frozen
 
+      - name: Prepare router assets
+        uses: ./.github/actions/prepare-router-assets
+
       - name: Install Playwright browser
         run: npx --yes playwright install chromium