[iscekic]

Gateway slice of ADR 0005. Stacked on #7791. The branch also merges #7790, because it reuses that PR's custom router reads.

Gateway path for custom routers

• kilo-auto/custom/<slug> and kilo-auto/custom/org/<slug> are now auto models in the LLM proxy. The proxy resolves them like this:

  • A personal router belongs to the authenticated user. An organization router needs the active organization context.
  • A missing router gets router_not_found (404), using the contract error codes and statuses. The gateway does not check the kilo-auto-custom-routers flag: only flagged owners can create routers, so a router's existence is the gate on both the gateway and CLI paths (ADR 0005).

• The proxy calls the internal /decide with:

  • the customRouter reference,
  • the router's base router,
  • the custom model ID as requestedModel,
  • the organization's denied gateway entries.

  It sends no clientEntries.

• The worker handles null decisions (the default member, or custom_router_unavailable). The gateway serves exactly the gateway entry that the worker returns, with its exact catalog variant. It never falls back outside the pool:

  • A worker that is unreachable, times out, returns a 5xx, or returns an invalid body gets a retryable auto_routing_unavailable (503 with Retry-After).
  • So does a null decision, and so does a pick that is outside the pool, denied by the policy, or a client entry.
  • Worker 4xx rejections pass through with their contract status.

• Usage rows record the custom router model ID as auto_model. Classifier billing stays on the worker-owned path: the decide request names the custom model ID, and the legacy positive-cost fallback is unchanged.

Organization Auto targets

• A kilo-auto/org route or fallback target can name kilo-auto/custom/org/<slug>, but only for a router owned by the same organization. The target is resolved through the custom router path above. Targets that name a personal router are rejected, both by validation and by the stored-settings schema.
• The Organization Auto model pickers list the organization's custom routers.

Decision header

• A request that carries x-kilo-auto-decision is checked with verifyAutoDecision and AUTO_ROUTING_DECISION_SECRET. That secret is a new gateway env var, documented in ENVIRONMENT.md; it must match the worker's secret.
• The token's user, organization, and model must match the request. The gateway then serves the signed variant and sets auto_model to the token's router model ID.
• An invalid token gets a 4xx invalid_auto_decision error with a reason:
  • 400 for a malformed token,
  • 403 for a bad signature, an expired token, or a mismatched user, organization, model, or variant.
• If the header is present and the gateway has no secret, the request gets a 503. The header is never silently ignored.

Organization policy for auto candidates

• Auto Frontier evaluates organization policy against the Frontier routing table. Before this change, the gateway built deniedModelIds from the Efficient table or the custom pool, so Frontier could pick a blocked model that the gateway then rejected.
• The routing table cache keeps separate Efficient and Frontier entries. Only Efficient reads the saved custom pool.
• Settings-based deny lists expand to the exact custom router candidate IDs, so a suffixed variant of a denied model is denied too.
• The final gateway authorization check is unchanged.
• The organization models endpoint lists custom routers owned by the requested organization only, so both Organization Auto pickers show them.

Deploy notes

• Set AUTO_ROUTING_DECISION_SECRET on the kilocode-ai-gateway project with the same value as the worker's AUTO_ROUTING_DECISION_SECRET_PROD, before CLIs send the header.

Verification

On a work VM:

• pnpm typecheck passes in packages/web-shared, packages/db, apps/ai-gateway, and apps/web.
• These Jest suites pass:
  • web-shared auto-model/**, including the new custom-router and auto-decision tests,
  • auto-routing-decision, auto-routing-denied-models, handlers/llm-proxy, llm-proxy-helpers, and handlers/models,
  • apps/web api/auto-routing/custom-routers, organization-modes-router, organization-settings-router, and openrouter-models.
• oxfmt and oxlint pass on the changed files.
• After the policy changes: auto-routing-denied-models, handlers/llm-proxy, auto-routing-models, handlers/models, handlers/organization-models, and organization-settings-router pass; packages/web-shared typecheck and oxlint pass.