feat(delegation): dynamic provider-aware subagent model router (default OFF)

[loes5050]

Summary

Adds an optional, provider-aware dynamic model router for subagent delegation (default OFF), plus two reliability fixes on the same path:

1. failed explicit tasks[].provider/model no longer falls back to parent auth with a mismatched model (401),
2. safe upper caps on max_concurrent_children / max_spawn_depth (default ON, byte-stable for normal configs).

Root cause

delegate_task could only inherit the parent model or honor an explicit override — no availability/capability-aware choice and no per-task fallback chain. Separately, a failed explicit override merged the model onto parent credentials (wrong provider auth → 401), and concurrency/depth knobs had no hard ceiling against exponential fan-out.

Fix

• agent/model_router.py: deterministic, stdlib-only router; enabled default false; scores from injected inventory/catalog/pricing/credential gates — no network at import, no fixed model brand names.
• tools/delegate_tool.py: (creds, fallback_chain) with precedence explicit → forced delegation.provider/base_url → router → inherit; schema exposes tasks[].model + tasks[].provider; override_fallback_chain into _build_child_agent.
• 401 fix: explicit provider resolve failure → ValueError → tool_error (model-only override still inherits parent auth).
• Safe caps: delegation.enforce_safe_caps (default true) clamps concurrent children (hard cap 16) and spawn depth (hard cap 3); opt-out via false or higher *_hard_cap.
• hermes_cli/config.py: delegation.model_router block default OFF + cap knobs documented in cli-config.yaml.example.

Footprint

Focused on delegation routing/reliability. Feature off by default for the router; caps only clamp absurd values under default config.

Validation

pytest tests/agent/test_model_router.py \
       tests/tools/test_delegate_model_router_integration.py \
       tests/tools/test_delegate.py -o addopts=
→ 205 passed
Includes REAL end-to-end router test (unmocked select_delegation_model) + 401/caps regressions.
Zero live API calls (inventory/catalog/pricing/bundle mocked at the boundary).

Tests

Unit router suite + integration (schema, override, forced provider, fallback chain, E2E unmocked select) + full test_delegate*.py regression.

[alt-glitch]

This was generated by AI during triage.

Related to the closed #66613 resubmission and the earlier delegation-routing cluster. This is the active branch, not a duplicate of closed predecessors; its routing policy and default cap changes need a maintainer decision.

[teknium1]

Thanks for the careful opt-in implementation and the focused test coverage.

This automated hermes-sweeper review is closing this under the standing delegation-model-routing policy.

• Current main deliberately keeps individual delegate_task calls from selecting subagent models; the live tool contract directs users to delegation.provider / delegation.model in config.yaml (tools/delegate_tool.py:3325).
• The supported configuration-level provider/model resolution is already implemented in tools/delegate_tool.py:3056-3181.
• This PR's tasks[].model / tasks[].provider API and automatic provider-aware router (7592d53babe5) are the policy-prohibited direction, even when default-off.
• The default safe-cap change also reverses the deliberate no-ceiling design adopted in d41427504 (feat(delegation): uncap max_spawn_depth).
• The related resubmission feat(delegation): dynamic provider-aware subagent model router (default OFF) #66613 was closed on the same policy, following the maintainer decision on feat(delegate_task): per-subagent model/provider overrides + model observability plugin #12794.

For globally pinning subagent routing, please use delegation.provider and delegation.model in config.yaml.

---

Closed as not-planned per standing maintainer policy (delegation-model-routing). This is a design-direction decision, not a code-quality judgment.

---

Closed as not-planned per standing maintainer policy (delegation-model-routing). This is a design-direction decision, not a code-quality judgment — see the Contribution Rubric in AGENTS.md for what the project is looking for. If you believe this policy was misapplied to your change, comment here and a maintainer will take a look.