Capability routing plans each step around what must be done—then selects the best available, compatible execution target underneath.
Most systems bind a conversation to one model, add fallback, and call it routing. That leaves the agent trapped inside one model’s strengths, outages, modalities, and blind spots.
One architecture unifies per-step fitness, hard eligibility, disjoint failover, and multi-model panels.
Every step inherits the same model—even when another is materially better.
Fallback is usually provider-shaped, not deployment- or failure-domain-aware.
One model’s blind spot remains the system’s blind spot.
Target identity becomes an output of routing—not an input to the whole conversation.
Adding a tool means adding a capability—not inventing another routing stack.
Logical model references plus hard compatibility requirements and effort policy.
Every capability has a safe base route; selections override only what they own.
The stable, user-facing identity: facts, family, modality, context, tools, reasoning.
release gate ∩ target readiness ∩ request policy
Scoped to a concrete deployment—not a vague provider status.
Capability
Turn footprint
Attachments
Availability snapshot
expand + filter + floor + intent
Pinned logical model has an eligible deployment. The pin is honored.
Pinned model is gone or incompatible; another candidate in the owned route wins.
The whole owned route is empty; the SystemPlan is tried through the same gate.
Selection outcome and route tier stay orthogonal: pin_displaced + menu_sibling can both be true.
Lock the logical model at the head if any deployment is eligible. Policy may reorder only the tail.
No locked head. Policy is free to rank the entire eligible set using task context.
Preserve declared tier menus and today’s effort semantics while moving onto the new engine.
Pin / Auto / Legacy intent applies.
Inherited route. No user intent. Outcome: system_owned.
Invariant: at least one target. Otherwise resolution returns typed Unavailable.
“Why did this model answer?” becomes a deterministic query.
The plan records inputs and intermediate sets; runtime outcomes are linked separately by PlanID.
Classify the failure, then choose the eligible target sharing the fewest implicated domains: maximally disjoint.
Stay on the pinned model. Change deployment.
Avoid the implicated quota pool—even inside the same provider.
Cross providers because same-provider alternatives share the failed domain.
A single-model blind spot becomes a visible divergence signal.
Parallel calls with per-leg budget shares.
Synthesize only when perspectives can be reconciled.
Return directly; no fake synthesis from one source.
Reserved budget, failed-target exclusion, then typed runtime failure.
Diversity-preserving failover: if a replacement duplicates another leg’s family, drop the leg instead.
Once every frontier model is available, advantage shifts from access to orchestration: hard eligibility, stable intent, deployment-aware resilience, family-diverse perspectives, typed multimodal dispatch, and auditable decisions—per step.
