Design explicit opt-in automatic local/cloud routing after MVP

Overview

Current routing chooses installed local model then signed-in upstream; found-local failures do not fallback. Automatic hybrid routing was explicitly deferred.

Priority: P2 / post-mvp. Impact: roadmap improvement. Initial planning estimate: Medium; refine after inventory. This issue does not add a release blocker.

Current evidence

Current routing chooses installed local model then signed-in upstream; found-local failures do not fallback. Automatic hybrid routing was explicitly deferred.

• Source: src/harness/opencode.cpp#L191
• Source: src/commands/cmd_harness.cpp#L30

Design and implementation plan

Specify opt-in routing policy, consent/cost/privacy behavior and deterministic fallback; reuse SDK resolution and existing gateway. Historical $10 acquisition credit is not fixed policy.

1. Reconcile the current implementation and any already completed work with the evidence above.
2. Record the owner, selected scope, dependencies and unresolved decisions before implementation.
3. Implement or execute the selected scope using existing components and artifacts.
4. Attach reproducible validation or outcome evidence and record any deferred work.

Acceptance criteria

• Document policy matrix for offline, unavailable model, local failure, cloud auth/credit/capacity failure and user-forced local/cloud.
• Never upload local prompt or incur cloud spend silently.
• Test deterministic selection and expose selected target without secrets.

Related work and deduplication

No existing issue has this acceptance scope; existing release defects remain separate.

No exact existing issue found in the all-state inventory.

Requirement provenance

Reconciled September 13, 2026 against WALLY_CLOUD_PRODUCT_SOURCES.md (SHA-256 e601b7b154b750965fa8d25d4533d3542621bd00b3bb30038c1fae553a549e7b) and the consolidated requirements report. Historical proposals are not evidence of current delivery, customer agreement or approved pricing.

Start by reading the routing logic in src/harness/opencode.cpp around line 191 and src/commands/cmd_harness.cpp around line 30, then reconcile it with the SDK resolution and gateway components. Before implementation, record the owner, scope, dependencies, and unresolved policy decisions. Done means the policy matrix is documented, routing is deterministic and opt-in, no cloud action is silent, and validation exposes the selected target without secrets.