Routing to the cheapest model that might work is easy. Routing without leaking sensitive context, changing models halfway through a tool loop, or granting a weaker backend authority it should not have is a different problem.

I kept the hard decisions deterministic. Privacy rules, backend health, measured capability, tool authority, and session affinity take precedence over the learned classifier. A small local embedding model only advises on ambiguous requests; it cannot override those boundaries.

What the evidence says

In one clean five-repeat experiment, the aggressive policy sent 81.15% of requests to local inference, up from a 22.82% conservative baseline. It also completed 10 of 10 authorized write/execute tasks without transport failures or unexpected side effects.

That did not settle the larger question. Quality remained inconclusive, and the latency and remote-token gates failed. The result supports the routing architecture and its authority model, not a claim that local-first routing is automatically faster, cheaper, or production-ready.

Read the evidence

• Experiment log
• Aggressive-local policy and tool authority
• Five-repeat execution result

This started with a concrete failure: a local model expressed a tool call as JSON inside ordinary response text, while the client expected an OpenAI-style structured tool call.

The proxy repairs only a narrow class of responses. It checks the requested name and arguments against the tools declared by the client, then abstains when intent is unclear. On the companion 117-case raw-output corpus, version 0.1.0 reached 87.5% precision and 38.2% recall on recoverable cases, with two unsafe false positives. Real OpenCode samples still failed the final task-level check even when the protocol shape improved.

Later endpoint-controlled testing explained why. Current parsed chat endpoints already returned clean tool calls, including for the seed model. The proxy is therefore relevant mainly to raw-completion consumers and older or misconfigured serving stacks. It is archived because that scope is too narrow to justify an active compatibility layer.

Read the evidence

• Experiment log and failed task verification
• Where protocol repair stops helping
• Serving-stack scope correction