Model resolution matrix

Every call into the runtime resolves to a concrete model through a (ProviderFamily × CallClass) matrix. The family is locked at session start (it picks tokenizer, prompt-cache key, tool-call dialect, and refusal pattern); the call class is declared per-call by the seam that's invoking the LLM.

This page is the reference table for the routing cluster. The three concepts — CallClass, Seam, family-lock — that decide which model fires for which kind of call are framed in Family-lock → the routing cluster.

The matrix

† Aliased up to that family's synthesize rung because no distinct mid-rung model exists. Moonshot is single-rung today — every call class resolves to the same model id.

‡ mistral is not currently exposed for routing. Its matrix entries are placeholder model ids (mistral-small-latest / mistral-large-latest) that don't resolve at any transport, so the family is excluded from EXPOSED_FAMILIES and a session cannot lock to it today. The row is shown for matrix completeness only.

Call classes

The classes are a downgrade ladder: synthesize → reasoning → converse → utility is the cost-quality direction.

Transports

Family choice fixes the tokenizer; transport choice fixes how the request gets to the provider. Both lock at session start.

Families without a native provider collapse native and byok-native requests to their OpenRouter equivalents at resolve time, rather than dispatching to a transport that doesn't exist. The resulting transport is recorded on the audit row, so the collapse is visible after the fact.

native reaches the provider directly. openrouter routes through OpenRouter — useful for evaluation and for families without a native transport. byok-* variants delegate credentials to the end user's BYOK key rather than the deployment's. Transport is session-scoped, so mid-session escalation across transports doesn't silently happen. A session that starts on anthropic + byok-native and exhausts the user's key surfaces the exhaustion through the ledger as a providerCascade row with outcome.status: "exhausted", not a silent flip to the deployment's own credentials.

Cross-family fallback policy

The runtime does not silently widen across families when the session's locked family is exhausted. Once every in-family rung is tried, the runtime surfaces a family-exhausted state to the host and lets the user pick another family explicitly. The pivot exists because cross-family widening produced a measurable regression class: a session that began on anthropic's tool-call dialect would silently cross to openai's on cascade, and tools whose argument schemas relied on Anthropic's input_schema shape would stop being called correctly — the same agent code, the same session id, two incompatible tool dialects within one conversation. The family lock makes that crossing visible to the host instead of invisible to the runtime.

A narrow legacy carve-out preserves cross-family fallback for models that don't resolve through the matrix at all — BYOK rigs, modal-LLM endpoints, and unrecognized model slugs — because those sessions never had a family lock to honor in the first place.

Where to go next