Summary

First plugin extraction per the KR-PLUGIN-COST-LADDER bucket spec. Sets the template for subsequent extractions (KR-PLUGIN-AUDIT, KR-PLUGIN-CACHING, KR-PLUGIN-CONSTITUTION, …).

• Moves cost-router code from kora_cli/router/cost_router.py into the canonical Hermes plugin tree at kora_cli/reasoning/kora_hermes_plugin/cost_ladder/{constants,selector,plugin}.py
• Adds an orchestrator plugin (kora_hermes_plugin/plugin.py) that delegates to sub-plugins and registers the 6 remaining hooks
• Adds backward-compat shims at the old paths (kora_cli/router/cost_router.py + plugins/kora_hermes/__init__.py) so every existing import keeps working
• Moves 50 behavioral tests 1:1 to mirror the canonical code location; converts the old test file to a 3-test shim-verification suite

Behavior: unchanged. KORA_REASONING_USE_GATEWAY stays default OFF. The bypass path and the route-through path both keep working through the same external API.

File-structure diagram

```
kora_cli/reasoning/kora_hermes_plugin/ ← NEW canonical location
├── init.py re-exports KoraHermesPlugin + register
├── plugin.py orchestrator (6 hooks); delegates to sub-plugins
└── cost_ladder/ ← first extracted sub-plugin
├── init.py re-exports cost-ladder public surface
├── constants.py DEFAULT_HAIKU_MODEL, regex defaults, rungs
├── selector.py RoutingDecision + select_model_pre_call + …
└── plugin.py pre_api_request_mutable hook + register()

kora_cli/router/cost_router.py ← shim (431 → 75 lines)
plugins/kora_hermes/init.py ← shim (527 → 70 lines)

tests/kora_cli/reasoning/kora_hermes_plugin/cost_ladder/test_selector.py
50 behavioral tests moved 1:1; imports now canonical.

tests/kora_cli/router/test_cost_router.py
Converted to 3-test shim-verification suite (identity-against-canonical).
```

Import-path-changes summary

Both old and new paths are valid after this PR. Existing in-tree callers (`kora_cli/snapshot/state_snapshot.py`, `kora_cli/reasoning/anthropic_engine.py`, every `tests/plugins/test_kora_hermes_plugin*.py`) were left untouched and pass; the shim-verification tests in `tests/kora_cli/router/test_cost_router.py` assert the shim stays in sync via identity-against-canonical.

Recommendation for next plugin extraction

KR-PLUGIN-AUDIT — per the spec's closing note. Audit logic (`_emit_audit` + the `post_tool_call` write path inside `_execute_single_tool_block`) is similarly self-contained: pure functions + a single hook handler, no shared mutable state with the rest of the orchestrator. Same shape as cost-ladder — one constants file (audit event types / route literals), one writer module, one hook handler. Should fit the template this PR established with minimal new design work.

After audit: KR-PLUGIN-CACHING is a natural follow-on (lifts `_wrap_system_as_cacheable` + `_wrap_tools_as_cacheable` from `anthropic_engine.py` into `cost_ladder/`'s sibling sub-plugin — currently the hook handler in `cost_ladder/plugin.py` imports them from `anthropic_engine`, which is the next refactor seam).

Test plan

• 50 cost-ladder behavioral tests pass at new location via canonical import
• 3 shim-verification tests pass at old location
• 67 `test_kora_hermes_plugin{,_st2,_st2b}.py` tests stay green (no consumer breakage)
• 60 external-shim-consumer tests pass (`test_state_snapshot.py` + `test_anthropic_engine_router.py`)
• Full xdist regression: 180/180 affected tests passing; remaining failures pre-exist on base branch and do not reference any module changed here
• Manual smoke after merge: slack DM through a kora-runtime deployment with `KORA_FORCE_OPUS=true` to confirm both shim path and canonical path resolve to the same model decision

🤖 Generated with Claude Code