[Open-Squilla]

Scope

Saving a tier table with TokenRhythm as the primary and OpenRouter on C3 could fail unless a hidden legacy cross-provider flag was already enabled. Explicitly submitting complete provider/model selections now enables execution through those selected providers, including when an upgraded user re-saves an existing mixed table.

Scope boundary: tier-authoring saves in the Web UI and backend, the boolean RPC contract, focused regression tests, and routing documentation. Primary switches, loading saved configuration, mode-only legacy reactivation, and dormant fusion drafts retain their existing protections; an explicit API opt-out remains authoritative. Provider endpoint and credential resolution are unchanged.

Non-goals: changing global configuration defaults or migrating legacy execution merely on startup.

Merge prerequisite: the first CI run found newly reported vulnerabilities in unchanged main dependency locks. A separate security commit updates only the affected packages and their security floors: brotli 1.2.1, brotlicffi 1.2.1.0, filelock 4.2.1, pypdf 6.21.2, setuptools 84.1.0, Electron 42.11.16, fast-uri 3.1.9, undici 6.29.1/7.30.1, and happy-dom 21.0.4. No audit exemptions or CI gates are relaxed.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

If None, reason: maintainer-reported regression introduced by the primary-routing refinement in #1661.

Release Note

Release note: Multi-provider tier routing can be saved directly after selecting each tier's provider and model, including after upgrades.

Tests

Ruff: changed Python files pass; git diff --check passes.

Pytest: 420 existing onboarding/router/primary-profile tests, 20 new persistence/migration/provider-request tests, 9 browser CI inventory/workflow checks, and 9 Electron dependency security checks pass.

Build: npm run build passes, including architecture guards, type checks, production bundling, and artifact verification. Targeted contract generation is reproducible and matches checked-in artifacts; full-tree determinism is gated by CI.

Regression tests: added

Notes:

• 559 affected frontend unit tests pass after the happy-dom upgrade, including the original 380 setup tests and iframe, preview, dialog, and visualization coverage. The safer happy-dom iframe/CSS loading defaults are retained.
• 4 Chromium cases pass: fresh installation, upgraded false/true flags, and rejected-save retry, with retained selections after reload.
• Missing/false/true persisted flags and config-version-1 migrations are covered. Real provider adapters through an offline HTTP transport verify the selected URL, Authorization header, and model after save/reload.
• Contract fixtures accept boolean/null/omitted flags and reject object, array, string, and numeric values. Browser and Windows tests are registered in CI.
• 31 contract metadata/profile tests pass (17 platform-conditional skips), with reproducible generation of the changed contract and unchanged current/frozen samples.
• The default test path remains offline, deterministic, credential-free, and safe for forks. Browser Gateway fixtures and HTTP mock transport do not claim external-provider availability or packaged-app verification.
• Electron build, three routing configuration checks, and three loopback download-proxy checks pass. The repository's complete pinned-tool dependency audit reports 0 errors and 0 vulnerabilities across Python, WebUI, and Electron with complete coverage. CI additionally audits packaged wheelhouses.
• The five patched Python packages pass 12 focused Brotli/PDF tests plus both Brotli implementations and Hugging Face file-lock compatibility checks in an isolated overlay. Pinned UV lock validation passes; no unrelated dependency versions changed.

Maintainer Live Check

Maintainer live check: no

Surface: N/A

Safety

Only synthetic provider endpoints and credentials are used. No real profiles, secrets, private transcripts, or local evidence artifacts are committed.

Third-Party Origin

Third-party origin: none

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.

[github-actions]

Merge queue CI: success — run 40274565284, attempt 1.
Tested queue candidate: b04a8f91d531d0917cfe72d268aae3135667c3c3. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 40275078888, attempt 1.
Tested queue candidate: ede5bec63686e76ba7130cd9815a710949b5deaf. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.