…on (Lock R3-3)

Per Council R3 Lock R3-3 (the cost-ladder FLIP) + build-list
R3-4 #4. The reasoning engine no longer defaults to Opus with
reactive downshift; it defaults to **Haiku 4.5** and escalates
to Opus 4.7 ONLY when an earning signal fires. The existing
cost-ladder rung stays as a Layer 2 defensive backstop:
WARN_75 / DOWNSHIFT_90 force every call to Haiku regardless of
any earning signal; HARD_STOP_100 still fails the call.

# New package: kora_cli/router/

  kora_cli/router/__init__.py        — re-exports
  kora_cli/router/cost_router.py     — RoutingDecision +
    select_model_pre_call + should_escalate_post_call +
    strip_opus_prefix + env-tunable trigger patterns.

# Earning signals (precedence order)

Pre-call (decided BEFORE the first API call):
  1. HARD_STOP_100 rung   → model=None, caller fail-fasts
  2. WARN_75 / DOWNSHIFT_90 → force Haiku (cost backstop wins
     over every earning signal below)
  3. KORA_FORCE_OPUS env  → Opus
  4. iteration ≥ 2        → Opus (tool-loop iteration earning)
  5. /opus prefix         → Opus, prefix stripped from prompt
  6. Decision-language regex → Opus (env-tunable patterns:
     "should I", "do we", "decide", "approve", "go/no-go",
     "is it safe", "plan strategy for", etc.)
  7. Default              → Haiku

Post-call (decided AFTER iteration-1 Haiku, only when
stop_reason == "end_turn"):
  - Low-confidence marker in Haiku response ("I'm not sure",
    "I don't have enough", etc. — env-tunable) → escalate
  - Heuristic: response shorter than 50 chars when input
    longer than 200 chars → escalate

Escalation re-issues iteration 1 to Opus with Haiku's response
woven into the conversation history (assistant turn) + a
follow-up user turn asking Opus to review/improve. Reuses
the same system + tools blocks so the prompt cache stays warm.
BOTH the Haiku attempt + Opus re-issue are billed (the cost
of escalation); telemetry records two separate calls.

# Cost-downshift harmonization

agent/cost_downshift.py is left UNTOUCHED. It governs **Sea_
Ticket queue** decisions (defer vs run; criticality clamping)
which is a separate substrate-side concern. The router runs
on a different code path (engine-side / Joshua-DM reply path)
and reads cost_rung as one of its inputs (the Layer 2 backstop).
Both name "downshift" in different domain contexts; both
co-exist cleanly.

Engine-side: RUNG_MODEL_MAP at anthropic_engine.py:115 is
DEPRECATED — the router now owns model selection. The const
is preserved (mapped uniformly to MODEL_HAIKU) for any
downstream consumer that imports it; the engine no longer
consults it.

# Telemetry wiring (first production record_call call site)

Engine emits ``get_telemetry().record_call(...)`` per API call:
  - iteration 1 → route = source-mapped (slack_dm / email_inbound
    / mcp_tool / unknown)
  - iteration ≥ 2 → route = ROUTE_TOOL_LOOP_ITERATION
  - escalated_to_opus = True for every earning-signal path AND
    every post-call escalation re-issue
Cost-estimate computed per-call via
``agent.usage_pricing.estimate_usage_cost`` with the
canonical PricingEntry rates. Best-effort: any telemetry
failure logs at DEBUG and the hot reasoning path continues.

# Env-tunable triggers

  KORA_FORCE_OPUS              — operator defensive switch
  KORA_OPUS_TRIGGER_PATTERNS   — comma-separated regex list
                                 (overrides DEFAULT_DECISION_
                                 PATTERNS — 7 entries)
  KORA_OPUS_PREFIX             — default "/opus"
  KORA_HAIKU_LOW_CONFIDENCE_PATTERNS — comma-separated regex
                                 (overrides 6-entry default)

# Tests

tests/kora_cli/router/test_cost_router.py — 50 router unit
tests covering every decision-tree branch + every env
override + every precedence boundary (force_opus vs cost_clamp,
iteration_2 vs opus_prefix, etc.).

tests/kora_cli/reasoning/test_anthropic_engine_router.py — 13
engine integration tests:
  - default Haiku on simple message
  - decision-language → Opus
  - /opus prefix → Opus + prefix stripped from SDK messages
  - warn_75 → Haiku (cost clamp)
  - hard_stop → cost_ladder_halted, no SDK call
  - iteration 2 → Opus
  - low-confidence Haiku → Opus re-issue with Haiku response
    in messages array
  - high-confidence Haiku → only 1 SDK call
  - tool_use stop_reason doesn't trigger post-call escalation
  - Opus re-issue reuses identical system + tools blocks (cache
    warmth preserved)
  - telemetry record_call invoked per API call with correct
    route + escalated_to_opus flag

Pre-existing tests updated:
  - test_normal_rung_selects_opus → renamed
    test_normal_rung_defaults_to_haiku (post-flip behavior)
  - test_warn_75_rung_selects_sonnet → renamed
    test_warn_75_rung_clamps_to_haiku
  - test_unknown_rung_defaults_to_opus_and_continues → renamed
    test_unknown_rung_defaults_to_haiku (no more WARN log;
    router treats unknown as no-clamp + falls to default)

Pre-existing test-spy fixtures updated to accept the
``route`` + ``escalated_to_opus`` kwargs that
``holder.record_inference`` gained in #161 (gap from #161 that
landed without test-fixture updates; addressed here to keep
the regression green):
  - tests/kora_cli/handlers/test_slack_dm_reply.py::_spy
  - tests/kora_cli/reasoning/test_anthropic_engine_caching.py
    ::_capture

# Regression

591/591 reasoning + handlers + router + listeners green
serially. Full repo xdist: 9447 passed, 43 failed identical to
baseline (test_anthropic_adapter / test_backup / test_config /
test_gateway_* / test_web_server* / test_kanban_db /
test_list_picker_providers / test_model_switch_* /
test_startup_plugin_gating / test_web_server_cron_profiles).
Zero failures in router, reasoning, or handlers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>