Summary

Adds optional model and provider parameters to delegate_task, both at the top level and per-task inside the tasks array. This unblocks model-routing plugins (per-phase models for SDD-style workflows) without forcing them to monkey-patch delegate_tool.py.

This is a fresh take on #3719 / #3794. #3794 bundled a delegation pool with per-call override; that PR was closed without merge. This PR keeps only the per-call override — the smaller, lower-risk half — so it can land and unblock downstream work. The pool can land as a follow-up.

Why

SDD-style workflows route different phases to different models for cost/quality balance: cheap models for scout/explore, mid-tier for apply, reasoning models for verify/design. delegate_task exposes no way to do that today — delegation.model/delegation.provider are global per-config.

The plumbing already exists: _build_child_agent accepts model / override_provider / override_base_url / override_api_key / override_api_mode natively. This PR wires the public schema → handler → _build_child_agent path.

Evidence

I maintain cobalt-agent, a Hermes plugin that does this routing via a source patch (apply_routing_patch.py injects _routed_* fields into task dicts before _build_child_agent is called). It has been running on two production VPS instances for ~4 weeks. 12 measurement runs, last 6 at 95% routing accuracy (logs in cobalt-agent CHANGELOG.md).

The patch works, but with Hermes shipping weekly the source-level approach is fragile — that's the whole reason for the upstream request. Once this PR lands I can retire the patch in favour of the official schema.

Diff overview

Total: +192 / -7 lines.

API

Top-level (whole batch uses the same model)

{
  "name": "delegate_task",
  "arguments": {
    "goal": "Implement the auth middleware",
    "model": "glm-5.1",
    "provider": "zai"
  }
}

Per-task (different model per task in one call)

{
  "name": "delegate_task",
  "arguments": {
    "tasks": [
      {"goal": "Research competitors", "model": "glm-5",   "provider": "zai"},
      {"goal": "Write integration tests", "model": "glm-5.1"}
    ]
  }
}

Precedence

per-task model/provider > top-level model/provider > delegation.{model,provider} from config

Provider re-resolution

When provider is overridden, _resolve_per_task_creds re-runs _resolve_delegation_credentials with the new provider so base_url / api_key / api_mode match the new provider (instead of dragging the original provider's credentials). The original base_url / api_key are stripped from the override config before resolution — they belong to the old provider.

When only model is overridden, the surrounding credentials are preserved (model and provider often share the same endpoint).

Failure handling

If credential resolution fails for the overridden provider (missing API key, unknown provider, etc.), the task falls back to the configured delegation credentials rather than aborting the batch. The failure is logged at WARN level.

Backwards compatibility

The new params are optional and default to None. Behavior is identical to today when no overrides are supplied — only difference is the schema now advertises the two new properties.

Tests

TestPerTaskCredentialOverride (6 tests):

• test_no_override_returns_default_creds
• test_model_only_top_level_override_swaps_model_keeps_provider
• test_per_task_model_beats_top_level
• test_provider_override_re_resolves_full_bundle (verifies stale base_url/api_key are stripped)
• test_per_task_provider_beats_top_level
• test_provider_resolution_failure_falls_back_to_default

Existing TestDelegationCredentialResolution and TestDelegationProviderIntegration should keep passing unchanged.

Follow-ups (separate PRs)

• Delegation pool with strengths-per-model (the other half of feat(tools): add delegation model pool with per-call model/provider override #3794)
• base_url per-call override for direct endpoints