auto-model-router 0.4.12 → 0.4.14

package/.omp-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "auto-model-router: a local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
-    "version": "0.4.12",
+    "version": "0.4.14",
     "pluginRoot": "."
   },
   "plugins": [
     {
       "name": "auto-model-router",
       "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter. Runs in-process, routes per turn by price and task complexity, with budget caps, mid-stream escalation, and cache-aware hysteresis.",
-      "version": "0.4.12",
+      "version": "0.4.14",
       "author": {
         "name": "drewappling",
         "email": "drewappling@gmail.com"

package/README.md

@@ -706,6 +706,12 @@ escalation signal, error. Three views aggregate it, all from the same
   transcript. Falls back to reading the ledger directly if the router is
   unreachable.
 - `auto-model-router report --days 7 [--harness <id>] [--json]` on the terminal.
+- `auto-model-router export --days 30 [--harness a,b] [--json]`: one row per day, harness
+  and model (dispatches, tokens, spend, escalations, errors) as CSV. Also
+  `GET /v1/router/export?days=&harness=[&format=json]`; `GET /v1/router/spend?sinceMs=&harness=`
+  gives spend over a harness set since an instant, and `GET /v1/router/feedback?days=&harness=`
+  lists verdicts by model and the recent ones with the harness that gave them. These are what
+  a front door such as the team edition reads instead of the ledger file.
 - `GET /v1/router/report?days=7&harness=<id>` for dashboards (`harness` may be
   a comma-separated set of ids, for a group).
 - `GET /v1/router/summary?harness=<id>` — the daily summary as JSON (`auto=1`
@@ -1178,6 +1184,24 @@ text, not the conversation, so a hard task that only becomes hard three tool
 calls in stays on the router (the router's own escalation still applies
 there); and the switch happens at prompt boundaries, never mid-turn.
 
+## Per-request routing policy
+
+A front door in front of the router (the team edition, or any proxy that
+knows who is calling) can constrain one turn with an `X-Omp-Policy` header
+carrying JSON:
+
+```json
+{ "allow": ["anthropic/*", "google/*"], "deny": ["openai/gpt-5-pro"], "minTier": "simple", "maxTier": "moderate", "pin": "anthropic/claude-sonnet-5" }
+```
+
+`allow` and `deny` are slug globs like `filters.allow`/`filters.deny`: a
+request allow list replaces the configured one, a deny list adds to it.
+`minTier`/`maxTier` narrow the requested profile's tier envelope and never
+widen it. `pin` forces one model the way `/router pin` does, unless a session
+override already pinned one. Every field is optional; a malformed header is
+ignored rather than failing the turn. The decision trail records what the
+policy changed (`policy: …`).
+
 ## Multiple coding harnesses, one router
 
 **One router process for everything.** omp's embed extension binds a private

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/cli/args.ts

@@ -30,6 +30,7 @@ const COMMANDS: Record<string, true> = {
 	serve: true,
 	stats: true,
 	report: true,
+	export: true,
 	models: true,
 	explain: true,
 	config: true,

package/src/cli/export.ts

@@ -0,0 +1,29 @@
+/**
+ * `auto-model-router export`: the ledger as one row per day, harness and
+ * model (dispatches, tokens, spend, escalations, errors), CSV by default or
+ * `--json`. The same rows back `GET /v1/router/export`.
+ */
+
+import { existsSync } from "node:fs";
+import { Database } from "bun:sqlite";
+import { loadConfig } from "../config/load.ts";
+import { exportCsv, exportRows } from "../cost/views.ts";
+import { configOpts, flagInt, flagString, type CliArgs } from "./args.ts";
+
+export async function exportCommand(args: CliArgs): Promise<void> {
+	const days = flagInt(args, "days") ?? 30;
+	const harness = flagString(args, "harness") ?? "";
+	const cfg = loadConfig(configOpts(args));
+	if (!existsSync(cfg.ledger.path)) {
+		process.stdout.write(args.flags.has("json") ? "[]\n" : exportCsv([]));
+		return;
+	}
+	// Read-only: an export must never create or migrate the ledger.
+	const db = new Database(cfg.ledger.path, { readonly: true });
+	try {
+		const rows = exportRows(db, Date.now() - days * 86_400_000, harness === "" ? null : harness.split(",").map((s) => s.trim()).filter((s) => s !== ""));
+		process.stdout.write(args.flags.has("json") ? `${JSON.stringify(rows, null, 2)}\n` : exportCsv(rows));
+	} finally {
+		db.close();
+	}
+}

package/src/cost/views.ts

@@ -0,0 +1,153 @@
+/**
+ * Ledger views that a front door (the team edition, a dashboard, a script)
+ * needs at a scope the report does not offer: spend since an instant over a
+ * set of harnesses, feedback verdicts with the harness that gave them, and a
+ * cost export by day, harness and model. Served by `/v1/router/spend`,
+ * `GET /v1/router/feedback` and `/v1/router/export`, exported from lib.ts, and
+ * behind `auto-model-router export`. All of them read only long-stable ledger
+ * columns and accept a read-only database handle.
+ */
+
+import type { Database } from "bun:sqlite";
+import { harnessFilter } from "./report.ts";
+
+/** `null` means every harness; an empty set matches nothing. */
+export type HarnessScope = readonly string[] | null;
+
+export interface FeedbackRow {
+	atMs: number;
+	slug: string;
+	tier: string;
+	verdict: "good" | "bad";
+	note: string;
+	/** The harness id of the judged turn (a team user id), or empty. */
+	harnessId: string;
+}
+
+export interface FeedbackByModel {
+	slug: string;
+	good: number;
+	bad: number;
+	/** Distinct harness ids that judged this model. */
+	judges: number;
+}
+
+export interface FeedbackView {
+	byModel: FeedbackByModel[];
+	recent: FeedbackRow[];
+}
+
+export interface ExportRow {
+	day: string;
+	harnessId: string;
+	slug: string;
+	provider: string;
+	dispatches: number;
+	promptTokens: number;
+	cachedTokens: number;
+	completionTokens: number;
+	spendUsd: number;
+	escalations: number;
+	errors: number;
+}
+
+const USD = "COALESCE(reported_usd, predicted_usd)";
+
+function scope(harness: HarnessScope, column: string): { sql: string[]; bind: Record<string, string> } | null {
+	if (harness === null) return { sql: [], bind: {} };
+	if (harness.length === 0) return null;
+	const f = harnessFilter(harness.join(","));
+	return { sql: f.sql.map((s) => s.replace(/^harness_id/, column)), bind: f.bind };
+}
+
+/** Spend (reported where present, predicted otherwise) since `sinceMs`, digest calls included as the ledger counts them. */
+export function spendUsdSince(db: Database, sinceMs: number, harness: HarnessScope): number {
+	const s = scope(harness, "harness_id");
+	if (s === null) return 0;
+	const where = ["created_at_ms >= $since", ...s.sql].join(" AND ");
+	const row = db.query(`SELECT COALESCE(SUM(${USD}), 0) AS usd FROM ledger WHERE ${where}`).get({ $since: sinceMs, ...s.bind }) as { usd: number };
+	return row.usd;
+}
+
+/** Verdicts since `sinceMs`, by model and the most recent 200, joined to the ledger for the judging harness. */
+export function feedbackView(db: Database, sinceMs: number, harness: HarnessScope): FeedbackView {
+	const exists = (db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'feedback'").get() as { name: string } | null) !== null;
+	if (!exists) return { byModel: [], recent: [] };
+	const s = scope(harness, "l.harness_id");
+	if (s === null) return { byModel: [], recent: [] };
+	const where = ["f.created_at_ms >= $since", ...s.sql].join(" AND ");
+	const bind = { $since: sinceMs, ...s.bind };
+	const recent = (
+		db.query(`SELECT f.created_at_ms AS at_ms, f.slug, f.tier, f.verdict, f.note, COALESCE(l.harness_id, '') AS harness_id FROM feedback f LEFT JOIN ledger l ON l.id = f.ledger_id WHERE ${where} ORDER BY f.created_at_ms DESC LIMIT 200`).all(bind) as {
+			at_ms: number;
+			slug: string;
+			tier: string;
+			verdict: string;
+			note: string;
+			harness_id: string;
+		}[]
+	).map((r) => ({ atMs: r.at_ms, slug: r.slug, tier: r.tier, verdict: (r.verdict === "good" ? "good" : "bad") as "good" | "bad", note: r.note, harnessId: r.harness_id }));
+	const byModel = (
+		db
+			.query(
+				`SELECT f.slug, SUM(CASE WHEN f.verdict = 'good' THEN 1 ELSE 0 END) AS good, SUM(CASE WHEN f.verdict = 'bad' THEN 1 ELSE 0 END) AS bad, COUNT(DISTINCT COALESCE(l.harness_id, '')) AS judges
+				 FROM feedback f LEFT JOIN ledger l ON l.id = f.ledger_id WHERE ${where} GROUP BY f.slug ORDER BY bad DESC, good DESC, f.slug ASC`,
+			)
+			.all(bind) as { slug: string; good: number; bad: number; judges: number }[]
+	).map((r) => ({ slug: r.slug, good: r.good, bad: r.bad, judges: r.judges }));
+	return { byModel, recent };
+}
+
+/** One row per UTC day, harness and served model since `sinceMs`; digest calls are excluded as in the report. */
+export function exportRows(db: Database, sinceMs: number, harness: HarnessScope): ExportRow[] {
+	const s = scope(harness, "harness_id");
+	if (s === null) return [];
+	const where = ["created_at_ms >= $since", "requested_model <> 'digest'", ...s.sql].join(" AND ");
+	const rows = db
+		.query(
+			`SELECT strftime('%Y-%m-%d', created_at_ms / 1000, 'unixepoch') AS day, harness_id, COALESCE(served_slug, slug) AS slug,
+				COUNT(*) AS dispatches,
+				COALESCE(SUM(json_extract(usage, '$.promptTokens')), 0) AS prompt_tokens,
+				COALESCE(SUM(json_extract(usage, '$.cachedTokens')), 0) AS cached_tokens,
+				COALESCE(SUM(json_extract(usage, '$.completionTokens')), 0) AS completion_tokens,
+				COALESCE(SUM(${USD}), 0) AS spend,
+				SUM(CASE WHEN escalation_signal IS NOT NULL THEN 1 ELSE 0 END) AS escalations,
+				SUM(CASE WHEN error IS NOT NULL THEN 1 ELSE 0 END) AS errors
+			 FROM ledger WHERE ${where} GROUP BY day, harness_id, slug ORDER BY day ASC, harness_id ASC, spend DESC`,
+		)
+		.all({ $since: sinceMs, ...s.bind }) as { day: string; harness_id: string; slug: string; dispatches: number; prompt_tokens: number; cached_tokens: number; completion_tokens: number; spend: number; escalations: number; errors: number }[];
+	return rows.map((r) => ({
+		day: r.day,
+		harnessId: r.harness_id,
+		slug: r.slug,
+		provider: r.slug.startsWith("ollama/") ? "ollama" : "openrouter",
+		dispatches: r.dispatches,
+		promptTokens: r.prompt_tokens,
+		cachedTokens: r.cached_tokens,
+		completionTokens: r.completion_tokens,
+		spendUsd: r.spend,
+		escalations: r.escalations,
+		errors: r.errors,
+	}));
+}
+
+export const EXPORT_COLUMNS = ["day", "harness", "model", "provider", "dispatches", "prompt_tokens", "cached_tokens", "completion_tokens", "spend_usd", "escalations", "errors"] as const;
+
+export function csvCell(v: string | number): string {
+	const s = String(v);
+	return /[",\n\r]/.test(s) ? `"${s.replaceAll('"', '""')}"` : s;
+}
+
+/** CSV of export rows; spend to 6 decimals so sub-cent rows survive. */
+export function exportCsv(rows: readonly ExportRow[]): string {
+	const lines = [EXPORT_COLUMNS.join(",")];
+	for (const r of rows) lines.push([r.day, r.harnessId, r.slug, r.provider, r.dispatches, r.promptTokens, r.cachedTokens, r.completionTokens, r.spendUsd.toFixed(6), r.escalations, r.errors].map(csvCell).join(","));
+	return `${lines.join("\n")}\n`;
+}
+
+/** `?harness=a,b` → scope; absent or empty → everything. */
+export function harnessScopeParam(raw: string | null): HarnessScope {
+	if (raw === null) return null;
+	const ids = raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
+	return ids.length === 0 ? null : ids;
+}

package/src/index.ts

@@ -11,6 +11,7 @@ import { join } from "node:path";
 import { parseArgv } from "./cli/args.ts";
 import { configCommand } from "./cli/config-cmd.ts";
 import { explainCommand } from "./cli/explain.ts";
+import { exportCommand } from "./cli/export.ts";
 import { modelsCommand } from "./cli/models.ts";
 import { reportCommand } from "./cli/report.ts";
 import { serveCommand } from "./cli/serve.ts";
@@ -23,6 +24,7 @@ Usage: auto-model-router <command> [options]
   serve      Run the router as a standalone process (for non-omp harnesses)
   stats      Show routed spend, per-model share, and escalation rates
   report     Usage analytics: providers, models, tiers, cost, speed, cache hit rate
+  export     One row per day, harness and model as CSV (--json for rows)
   models     Show what each complexity tier would consider, and why
   explain    Route a saved request without dispatching it, and explain the decision
   config     Interactive wizard over the router's own config.yml
@@ -73,6 +75,9 @@ async function main(): Promise<number> {
 		case "report":
 			await reportCommand(args);
 			return 0;
+		case "export":
+			await exportCommand(args);
+			return 0;
 		case "models":
 			await modelsCommand(args);
 			return 0;

package/src/lib.ts

@@ -19,5 +19,8 @@ export type { RouterConfig } from "./config/types.ts";
 export { buildUsageReport, renderUsageReport, type UsageReport, type ReportTotals } from "./cost/report.ts";
 export { buildDailySummary, renderDailySummary, type DailySummary } from "./cost/summary.ts";
 export { openDb } from "./util/sqlite.ts";
+export { spendUsdSince, feedbackView, exportRows, exportCsv, harnessScopeParam, type HarnessScope, type ExportRow, type FeedbackRow, type FeedbackByModel, type FeedbackView } from "./cost/views.ts";
 export { createLedger } from "./cost/ledger.ts";
+export { createFeedbackStore, type FeedbackStore, type FeedbackRecord } from "./cost/feedback.ts";
+export type { RequestPolicy } from "./wire/types.ts";
 export type { Ledger, LedgerEntry } from "./cost/types.ts";

package/src/router/index.ts

@@ -15,7 +15,7 @@ import type { ProfileConfig, RouterConfig } from "../config/types.ts";
 import type { Ledger } from "../cost/types.ts";
 import { estimatePromptTokens } from "../tokens/estimate.ts";
 import type { UpstreamClient } from "../upstream/types.ts";
-import type { NormRequest } from "../wire/types.ts";
+import type { NormRequest, RequestPolicy } from "../wire/types.ts";
 import { classify, classifyTask } from "./classify.ts";
 import { extractFeatures } from "./features.ts";
 import { select } from "./select.ts";
@@ -38,6 +38,43 @@ export interface RouterDeps {
  */
 const NEUTRAL_TOKENIZER = "gpt";
 
+const TIER_RANK: Record<string, number> = { trivial: 0, simple: 1, moderate: 2, hard: 3 };
+
+/**
+ * Applies a request policy on top of the resolved profile and config: the
+ * tier envelope is narrowed (never widened), a request allow list replaces
+ * the configured one, a request deny list adds to it, and a pin becomes a
+ * forced slug unless a session override already forced one.
+ */
+export function applyRequestPolicy(
+	profile: ProfileConfig,
+	cfg: RouterConfig,
+	policy: RequestPolicy | undefined,
+	forceSlug: string | undefined,
+): { profile: ProfileConfig; cfg: RouterConfig; forceSlug: string | undefined; reasons: string[] } {
+	if (policy === undefined) return { profile, cfg, forceSlug, reasons: [] };
+	const reasons: string[] = [];
+	let minTier = profile.minTier;
+	let maxTier = profile.maxTier;
+	if (policy.minTier !== undefined && TIER_RANK[policy.minTier]! > TIER_RANK[minTier]!) minTier = policy.minTier;
+	if (policy.maxTier !== undefined && TIER_RANK[policy.maxTier]! < TIER_RANK[maxTier]!) maxTier = policy.maxTier;
+	if (TIER_RANK[minTier]! > TIER_RANK[maxTier]!) minTier = maxTier;
+	const narrowed = minTier !== profile.minTier || maxTier !== profile.maxTier;
+	const outProfile = narrowed ? { ...profile, id: `${profile.id}+policy`, minTier, maxTier } : profile;
+	if (narrowed) reasons.push(`policy: tiers narrowed to [${minTier}..${maxTier}]`);
+	let outCfg = cfg;
+	if (policy.allow !== undefined || policy.deny !== undefined) {
+		outCfg = { ...cfg, filters: { ...cfg.filters, ...(policy.allow === undefined ? {} : { allow: policy.allow }), ...(policy.deny === undefined ? {} : { deny: [...cfg.filters.deny, ...policy.deny] }) } };
+		reasons.push(`policy: ${policy.allow === undefined ? "" : `allow ${policy.allow.join("|")} `}${policy.deny === undefined ? "" : `deny ${policy.deny.join("|")}`}`.trim());
+	}
+	let outForce = forceSlug;
+	if (forceSlug === undefined && policy.pin !== undefined) {
+		outForce = policy.pin;
+		reasons.push(`policy: pinned to ${policy.pin}`);
+	}
+	return { profile: outProfile, cfg: outCfg, forceSlug: outForce, reasons };
+}
+
 export function resolveProfile(cfg: RouterConfig, requestedModel: string, isSubagent = false): ProfileConfig {
 	const fallback = cfg.profiles[0];
 	if (fallback === undefined) throw new Error("no router profiles configured");
@@ -99,19 +136,22 @@ export function createRouter(deps: RouterDeps): Router {
 				classification = await classify(req, features, config, { upstream, ledger, catalog });
 			}
 
-			return select({
+			const policed = applyRequestPolicy(resolveProfile(config, req.requestedModel, req.isSubagent), config, req.policy, opts.forceSlug);
+			const decision = select({
 				req,
 				features,
 				classification,
-				profile: resolveProfile(config, req.requestedModel, req.isSubagent),
+				profile: policed.profile,
 				state,
 				snapshot,
 				ledger,
-				cfg: config,
+				cfg: policed.cfg,
 				nowMs: Date.now(),
 				...(opts.excludeSlugs === undefined ? {} : { excludeSlugs: opts.excludeSlugs }),
-				...(opts.forceSlug === undefined ? {} : { forceSlug: opts.forceSlug }),
+				...(policed.forceSlug === undefined ? {} : { forceSlug: policed.forceSlug }),
 			});
+			if (policed.reasons.length > 0) decision.reasons.unshift(...policed.reasons);
+			return decision;
 		},
 	};
 }

package/src/server/http.ts

@@ -10,6 +10,7 @@ import { createDigester } from "./digest.ts";
 import { advise } from "./advise.ts";
 import { TIER_ORDER, type Tier } from "../router/types.ts";
 import { baselinePrices, buildUsageReport, renderUsageReport } from "../cost/report.ts";
+import { exportCsv, exportRows, feedbackView, harnessScopeParam, spendUsdSince } from "../cost/views.ts";
 import { buildDailySummary, createKv, markSummaryShown, renderDailySummary, summaryDue, summaryHasNews, type SummaryOllama } from "../cost/summary.ts";
 import type { Ledger, ModelTrust } from "../cost/types.ts";
 import { createRouter } from "../router/index.ts";
@@ -186,6 +187,12 @@ function isLoopbackHostHeader(hostHeader: string | null): boolean {
 	return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
 }
 
+/** `?days=` bounded to [1, 365], `dflt` when absent or unparsable. */
+function clampDays(raw: string | null, dflt: number): number {
+	const n = raw === null ? dflt : Number.parseInt(raw, 10);
+	return Number.isInteger(n) ? Math.min(Math.max(n, 1), 365) : dflt;
+}
+
 export function startServer(cfg: RouterConfig): StartedServer {
 	const log = createLogger(cfg.logLevel);
 
@@ -422,12 +429,27 @@ export function startServer(cfg: RouterConfig): StartedServer {
 				if (req.method === "GET" && url.pathname === "/v1/router/stats") {
 					return json(computeStats(ledger));
 				}
+				if (req.method === "GET" && url.pathname === "/v1/router/spend") {
+					// Spend since an instant over a harness set: what a front door's
+					// budget check needs when it cannot read the ledger file.
+					const since = Number.parseInt(url.searchParams.get("sinceMs") ?? "", 10);
+					if (!Number.isFinite(since)) return wireErrorResponse({ status: 400, code: "invalid_request_error", message: "sinceMs required" });
+					return json({ sinceMs: since, usd: spendUsdSince(db, since, harnessScopeParam(url.searchParams.get("harness"))) });
+				}
+				if (req.method === "GET" && url.pathname === "/v1/router/feedback") {
+					const days = clampDays(url.searchParams.get("days"), 30);
+					return json({ days, ...feedbackView(db, Date.now() - days * 86_400_000, harnessScopeParam(url.searchParams.get("harness"))) });
+				}
+				if (req.method === "GET" && url.pathname === "/v1/router/export") {
+					const days = clampDays(url.searchParams.get("days"), 30);
+					const rows = exportRows(db, Date.now() - days * 86_400_000, harnessScopeParam(url.searchParams.get("harness")));
+					if (url.searchParams.get("format") === "json") return json({ days, rows });
+					return new Response(exportCsv(rows), { headers: { "content-type": "text/csv; charset=utf-8", "content-disposition": `attachment; filename="auto-model-router-export-${new Date().toISOString().slice(0, 10)}.csv"` } });
+				}
 				if (req.method === "GET" && url.pathname === "/v1/router/report") {
 					// Usage analytics for `/router report` and the CLI: bounded window,
 					// optional harness scope (the X-Omp-Harness header value).
-					const rawDays = url.searchParams.get("days");
-					const parsedDays = rawDays === null ? 7 : Number.parseInt(rawDays, 10);
-					const windowDays = Number.isInteger(parsedDays) ? Math.min(Math.max(parsedDays, 1), 365) : 7;
+					const windowDays = clampDays(url.searchParams.get("days"), 7);
 					const harnessId = url.searchParams.get("harness") ?? "";
 					const report = buildUsageReport(db, { windowDays, harnessId, baselines: baselinePrices(cfg.report.baselines, (s) => catalog.find(s)) });
 					// ?format=text: the rendered report for harnesses without a renderer of their own (the Hermes plugin).

package/src/wire/openai/request.ts

@@ -1,4 +1,5 @@
 import type {
+	RequestPolicy,
 	CompactionEdit,
 	NormMessage,
 	NormRequest,
@@ -285,6 +286,34 @@ function renderUpstreamBody(
 	return body;
 }
 
+const TIER_NAMES = new Set(["trivial", "simple", "moderate", "hard"]);
+
+/** Parses the X-Omp-Policy header; malformed or empty ⇒ no policy (never a rejected turn). */
+export function parsePolicyHeader(raw: string | null): RequestPolicy | undefined {
+	if (raw === null || raw.trim() === "") return undefined;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return undefined;
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+	const p = parsed as Record<string, unknown>;
+	const strs = (v: unknown): string[] | undefined => (Array.isArray(v) ? v.filter((s): s is string => typeof s === "string" && s.trim() !== "").map((s) => s.trim()) : undefined);
+	const tier = (v: unknown): RequestPolicy["minTier"] => (typeof v === "string" && TIER_NAMES.has(v) ? (v as RequestPolicy["minTier"]) : undefined);
+	const out: RequestPolicy = {};
+	const allow = strs(p.allow);
+	const deny = strs(p.deny);
+	if (allow !== undefined && allow.length > 0) out.allow = allow;
+	if (deny !== undefined && deny.length > 0) out.deny = deny;
+	const min = tier(p.minTier);
+	const max = tier(p.maxTier);
+	if (min !== undefined) out.minTier = min;
+	if (max !== undefined) out.maxTier = max;
+	if (typeof p.pin === "string" && p.pin.trim() !== "") out.pin = p.pin.trim();
+	return Object.keys(out).length === 0 ? undefined : out;
+}
+
 export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 	if (typeof body !== "object" || body === null || Array.isArray(body)) {
 		throw invalidRequest("Request body must be a JSON object");
@@ -306,6 +335,9 @@ export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 	// Subagent marker from the embed extension (sessions without a UI).
 	const isSubagent = (headers.get("x-omp-subagent") ?? "").trim() === "1";
 
+	// Per-request routing policy (team edition): JSON in X-Omp-Policy.
+	const policy = parsePolicyHeader(headers.get("x-omp-policy"));
+
 	if (typeof b.model !== "string" || b.model.length === 0) {
 		throw invalidRequest("model must be a non-empty string");
 	}
@@ -367,6 +399,7 @@ export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 		ompSessionId,
 		agentdoxScope,
 		isSubagent,
+		...(policy === undefined ? {} : { policy }),
 		requestedModel,
 		messages,
 		tools,

package/src/wire/types.ts

@@ -12,6 +12,20 @@ import type { UsageCounts } from "../cost/types.ts";
 
 export type WireProtocol = "openai-chat" | "openai-responses" | "pi-native";
 
+/**
+ * A routing policy attached to one request. `allow`/`deny` are slug globs
+ * like `filters.allow`/`filters.deny` (a request allow list replaces the
+ * configured one; a deny list adds to it); `minTier`/`maxTier` narrow the
+ * profile's tier envelope; `pin` forces one slug, like `/router pin`.
+ */
+export interface RequestPolicy {
+	allow?: string[];
+	deny?: string[];
+	minTier?: "trivial" | "simple" | "moderate" | "hard";
+	maxTier?: "trivial" | "simple" | "moderate" | "hard";
+	pin?: string;
+}
+
 export type Role = "system" | "developer" | "user" | "assistant" | "tool";
 
 /** One tool call requested by an assistant turn. */
@@ -84,6 +98,12 @@ export interface NormRequest {
 	agentdoxScope: string;
 	/** `X-Omp-Subagent: 1`: the caller is an omp subagent (a session without a UI). */
 	isSubagent: boolean;
+	/**
+	 * Per-request routing policy from the `X-Omp-Policy` header (JSON), set by
+	 * a front door such as the team edition: narrows what this turn may route
+	 * to. Absent ⇒ the configured profile and filters alone.
+	 */
+	policy?: RequestPolicy;
 	/** Virtual model the client selected, e.g. `auto`, `auto-cheap`, `auto-max`. */
 	requestedModel: string;
 	messages: NormMessage[];

package/test/policy.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { applyRequestPolicy, resolveProfile } from "../src/router/index.ts";
+import { parseChatRequest, parsePolicyHeader } from "../src/wire/openai/request.ts";
+
+/**
+ * The per-request routing policy (X-Omp-Policy): parsed defensively from the
+ * header, then applied on top of the profile and filters — tiers only narrow,
+ * an allow list replaces the configured one, a deny list adds to it, and a
+ * pin forces a slug unless a session override already did.
+ */
+
+describe("parsePolicyHeader", () => {
+	test("accepts the documented fields, drops junk, and never rejects a turn", () => {
+		expect(parsePolicyHeader(null)).toBeUndefined();
+		expect(parsePolicyHeader("not json")).toBeUndefined();
+		expect(parsePolicyHeader("[]")).toBeUndefined();
+		expect(parsePolicyHeader("{}")).toBeUndefined();
+		expect(parsePolicyHeader(JSON.stringify({ allow: ["anthropic/*", " x/y "], deny: [1, "", "openai/*"], minTier: "simple", maxTier: "nope", pin: " z/w " }))).toEqual({ allow: ["anthropic/*", "x/y"], deny: ["openai/*"], minTier: "simple", pin: "z/w" });
+		const req = parseChatRequest({ model: "auto", messages: [{ role: "user", content: "hi" }] }, new Headers({ "X-Omp-Policy": '{"maxTier":"moderate"}' }));
+		expect(req.policy).toEqual({ maxTier: "moderate" });
+		expect("policy" in parseChatRequest({ model: "auto", messages: [{ role: "user", content: "hi" }] }, new Headers())).toBe(false);
+	});
+});
+
+describe("applyRequestPolicy", () => {
+	const cfg = DEFAULT_CONFIG;
+	const profile = resolveProfile(cfg, "auto");
+
+	test("narrows the tier envelope, never widens it", () => {
+		const r = applyRequestPolicy(profile, cfg, { maxTier: "moderate", minTier: "trivial" }, undefined);
+		expect(r.profile.maxTier).toBe("moderate");
+		expect(r.profile.minTier).toBe(profile.minTier);
+		expect(r.profile.id).toBe(`${profile.id}+policy`);
+		expect(r.reasons[0]).toContain("tiers narrowed");
+		// A cheap profile cannot be raised past its own ceiling.
+		const cheap = resolveProfile(cfg, "auto-cheap");
+		const up = applyRequestPolicy(cheap, cfg, { minTier: "hard" }, undefined);
+		expect(up.profile.minTier).toBe(cheap.maxTier);
+		expect(up.profile.maxTier).toBe(cheap.maxTier);
+	});
+
+	test("allow replaces, deny adds, and a pin forces unless a session override already did", () => {
+		const base = { ...cfg, filters: { ...cfg.filters, allow: ["x/*"], deny: ["bad/*"] } };
+		const r = applyRequestPolicy(profile, base, { allow: ["anthropic/*"], deny: ["openai/*"], pin: "anthropic/claude-sonnet-5" }, undefined);
+		expect(r.cfg.filters.allow).toEqual(["anthropic/*"]);
+		expect(r.cfg.filters.deny).toEqual(["bad/*", "openai/*"]);
+		expect(r.forceSlug).toBe("anthropic/claude-sonnet-5");
+		expect(r.profile).toBe(profile); // tiers untouched ⇒ same object
+		expect(applyRequestPolicy(profile, base, { pin: "a/b" }, "session/pin").forceSlug).toBe("session/pin");
+		expect(applyRequestPolicy(profile, base, undefined, undefined)).toEqual({ profile, cfg: base, forceSlug: undefined, reasons: [] });
+		// Untouched config object when the policy carries no filters.
+		expect(applyRequestPolicy(profile, base, { maxTier: "hard" }, undefined).cfg).toBe(base);
+	});
+});

package/test/views.test.ts

@@ -0,0 +1,161 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { createFeedbackStore } from "../src/cost/feedback.ts";
+import { createLedger } from "../src/cost/ledger.ts";
+import type { LedgerEntry } from "../src/cost/types.ts";
+import { exportCsv, exportRows, feedbackView, harnessScopeParam, spendUsdSince } from "../src/cost/views.ts";
+import { startServer, type StartedServer } from "../src/server/http.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * The ledger views a front door reads instead of the ledger file: spend over
+ * a harness set, feedback with the judging harness, and the day × harness ×
+ * model export. Pinned over the public functions and over the HTTP routes.
+ */
+
+const DAY = 86_400_000;
+const NOW = Date.UTC(2026, 8, 7, 12, 0, 0);
+
+function entry(over: Partial<LedgerEntry>): LedgerEntry {
+	return {
+		id: crypto.randomUUID(),
+		createdAtMs: NOW - 3_600_000,
+		conversationKey: "k",
+		sessionId: "s",
+		turn: 1,
+		requestedModel: "auto",
+		harnessId: "",
+		ompSessionId: "",
+		slug: "vendor/model",
+		servedSlug: "vendor/model",
+		tier: "simple",
+		classificationSource: "heuristic",
+		reasons: [],
+		features: null,
+		score: null,
+		confidence: null,
+		task: null,
+		classifierReasons: null,
+		exploredFrom: null,
+		holdArm: null,
+		predictedUsd: 0.001,
+		reportedUsd: 0.001,
+		usage: { promptTokens: 1000, cachedTokens: 400, cacheWriteTokens: 0, completionTokens: 50, reasoningTokens: 0, images: 0 },
+		attempt: 0,
+		escalationSignal: null,
+		latencyMs: 1_100,
+		ttftMs: 100,
+		finishReason: "stop",
+		wasted: false,
+		upstreamGenerationId: null,
+		error: null,
+		promptTokensSaved: null,
+		...over,
+	} as LedgerEntry;
+}
+
+function seeded() {
+	const cfg = structuredClone(DEFAULT_CONFIG);
+	cfg.ledger.path = ":memory:";
+	const db = openDb(":memory:");
+	const ledger = createLedger(db, cfg);
+	const feedback = createFeedbackStore(db);
+	ledger.record(entry({ id: "l1", harnessId: "u_ada", slug: "anthropic/claude-sonnet-5", servedSlug: "anthropic/claude-sonnet-5", predictedUsd: 0.01, reportedUsd: 0.012 }));
+	ledger.record(entry({ id: "l2", harnessId: "u_ada", slug: "anthropic/claude-sonnet-5", servedSlug: null, predictedUsd: 0.01, reportedUsd: null, escalationSignal: "circular" }));
+	ledger.record(entry({ id: "l3", harnessId: "u_bob", slug: "ollama/glm-5.3-flash", servedSlug: "ollama/glm-5.3-flash", predictedUsd: 0.001, reportedUsd: 0.001, error: "boom" }));
+	ledger.record(entry({ id: "l4", harnessId: "u_bob", requestedModel: "digest", slug: "ollama/glm-5.3-flash", servedSlug: "ollama/glm-5.3-flash", predictedUsd: 0.5, reportedUsd: 0.5 }));
+	ledger.record(entry({ id: "l5", harnessId: "u_bob", createdAtMs: NOW - 40 * DAY, slug: "ollama/glm-5.3-flash", predictedUsd: 5, reportedUsd: 5 }));
+	feedback.record({ ledgerId: "l1", ompSessionId: "s", slug: "anthropic/claude-sonnet-5", tier: "simple", verdict: "good", note: "" }, NOW - 1000);
+	feedback.record({ ledgerId: "l2", ompSessionId: "s", slug: "anthropic/claude-sonnet-5", tier: "simple", verdict: "bad", note: "" }, NOW - 900);
+	feedback.record({ ledgerId: "l3", ompSessionId: "s", slug: "ollama/glm-5.3-flash", tier: "simple", verdict: "bad", note: "looped" }, NOW - 800);
+	return db;
+}
+
+describe("ledger views", () => {
+	const db = seeded();
+	const since = NOW - DAY;
+
+	test("spend over a harness set, everything, or nothing", () => {
+		expect(spendUsdSince(db, since, ["u_ada"])).toBeCloseTo(0.022, 6); // reported where present, predicted otherwise
+		expect(spendUsdSince(db, since, ["u_ada", "u_bob"])).toBeCloseTo(0.523, 6); // the digest row counts as spend
+		expect(spendUsdSince(db, since, null)).toBeCloseTo(0.523, 6);
+		expect(spendUsdSince(db, NOW - 60 * DAY, null)).toBeCloseTo(5.523, 6);
+		expect(spendUsdSince(db, since, [])).toBe(0);
+	});
+
+	test("feedback by model with distinct judges, scoped by harness", () => {
+		const all = feedbackView(db, since, null);
+		expect(all.byModel).toEqual([
+			{ slug: "anthropic/claude-sonnet-5", good: 1, bad: 1, judges: 1 },
+			{ slug: "ollama/glm-5.3-flash", good: 0, bad: 1, judges: 1 },
+		]);
+		expect(all.recent.map((r) => [r.harnessId, r.verdict, r.note])).toEqual([
+			["u_bob", "bad", "looped"],
+			["u_ada", "bad", ""],
+			["u_ada", "good", ""],
+		]);
+		expect(feedbackView(db, since, ["u_bob"]).byModel).toEqual([{ slug: "ollama/glm-5.3-flash", good: 0, bad: 1, judges: 1 }]);
+		expect(feedbackView(db, since, []).recent).toEqual([]);
+	});
+
+	test("export rows by day, harness and served model; digest and old rows out; CSV quoting", () => {
+		const rows = exportRows(db, since, null);
+		expect(rows).toHaveLength(2);
+		expect(rows[0]).toMatchObject({ day: "2026-09-07", harnessId: "u_ada", slug: "anthropic/claude-sonnet-5", provider: "openrouter", dispatches: 2, promptTokens: 2000, cachedTokens: 800, completionTokens: 100, escalations: 1, errors: 0 });
+		expect(rows[0]!.spendUsd).toBeCloseTo(0.022, 6);
+		expect(rows[1]).toMatchObject({ harnessId: "u_bob", provider: "ollama", dispatches: 1, errors: 1 });
+		expect(exportRows(db, since, ["u_bob"])).toHaveLength(1);
+		expect(exportRows(db, since, [])).toEqual([]);
+		const csv = exportCsv([{ ...rows[0]!, harnessId: 'ada, "L"' }]);
+		expect(csv.split("\n")[0]).toBe("day,harness,model,provider,dispatches,prompt_tokens,cached_tokens,completion_tokens,spend_usd,escalations,errors");
+		expect(csv.split("\n")[1]).toBe('2026-09-07,"ada, ""L""",anthropic/claude-sonnet-5,openrouter,2,2000,800,100,0.022000,1,0');
+		expect(harnessScopeParam(null)).toBeNull();
+		expect(harnessScopeParam(" , ")).toBeNull();
+		expect(harnessScopeParam("a, b")).toEqual(["a", "b"]);
+	});
+});
+
+describe("view routes", () => {
+	let handle: StartedServer;
+	const dir = mkdtempSync(join(tmpdir(), "amr-views-"));
+	beforeAll(() => {
+		const cfg = structuredClone(DEFAULT_CONFIG);
+		cfg.server.host = "127.0.0.1";
+		cfg.server.port = 0;
+		cfg.server.apiKey = "k";
+		cfg.ledger.path = join(dir, "router.db");
+		// Seed through the ledger on the same file before the server opens it.
+		const db = openDb(cfg.ledger.path);
+		createLedger(db, cfg).record(entry({ id: "r1", createdAtMs: Date.now() - 1000, harnessId: "u_x", predictedUsd: 0.2, reportedUsd: 0.25 }));
+		db.close();
+		handle = startServer(cfg);
+	});
+	afterAll(async () => {
+		await handle.stop();
+		try {
+			rmSync(dir, { recursive: true, force: true });
+		} catch {
+			/* Windows may hold the WAL briefly */
+		}
+	});
+	const get = (path: string) => fetch(`http://127.0.0.1:${handle.server.port}${path}`, { headers: { authorization: "Bearer k" } });
+
+	test("spend, feedback and export answer with the auth every router route needs", async () => {
+		expect((await fetch(`http://127.0.0.1:${handle.server.port}/v1/router/spend?sinceMs=0`)).status).toBe(401);
+		expect((await get("/v1/router/spend")).status).toBe(400);
+		expect(((await (await get(`/v1/router/spend?sinceMs=${Date.now() - DAY}&harness=u_x`)).json()) as { usd: number }).usd).toBeCloseTo(0.25, 6);
+		expect(((await (await get(`/v1/router/spend?sinceMs=${Date.now() - DAY}&harness=u_other`)).json()) as { usd: number }).usd).toBe(0);
+		const fb = (await (await get("/v1/router/feedback?days=7")).json()) as { days: number; byModel: unknown[]; recent: unknown[] };
+		expect(fb).toEqual({ days: 7, byModel: [], recent: [] });
+		const csv = await get("/v1/router/export?days=1");
+		expect(csv.headers.get("content-type")).toContain("text/csv");
+		expect((await csv.text()).split("\n")[1]).toContain("u_x,vendor/model,openrouter,1,1000,400,50,0.250000,0,0");
+		const js = (await (await get("/v1/router/export?days=1&format=json&harness=u_x")).json()) as { days: number; rows: { harnessId: string }[] };
+		expect(js.days).toBe(1);
+		expect(js.rows[0]?.harnessId).toBe("u_x");
+	});
+});