fix(auto-routing): address custom router review follow-ups

packages/auto-routing-contracts/src/custom-router.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
   AUTO_DECISION_HEADER,
+  AUTO_DECISION_TTL_MS,
   CUSTOM_ROUTER_ERROR_HTTP_STATUS,
   ClientCustomRouterEntrySchema,
   ClientEvalPlanResponseSchema,
@@ -279,6 +280,23 @@ describe('public decide API', () => {
     ).toBe(true);
   });
 
+  it('keeps the classification on a fallback decision', () => {
+    const decision = {
+      entry: { kind: 'gateway', model: 'anthropic/claude-sonnet-4' },
+      model: 'anthropic/claude-sonnet-4',
+      variant: null,
+      stale: false,
+      fallback: true,
+      sticky: false,
+      taskType: 'debugging',
+      subtaskType: 'bug_fixing',
+      tableVersion: null,
+    };
+    expect(
+      CustomRouterDecideResponseSchema.parse({ decision, decisionId: 'v1.abc.def' }).decision
+    ).toMatchObject({ fallback: true, taskType: 'debugging', subtaskType: 'bug_fixing' });
+  });
+
   it('maps every error code to a status', () => {
     for (const code of CustomRouterErrorCodeSchema.options) {
       expect(CUSTOM_ROUTER_ERROR_HTTP_STATUS[code]).toBeGreaterThanOrEqual(400);
@@ -340,6 +358,25 @@ describe('auto decision tokens', () => {
     });
   });
 
+  it('rejects a token whose expiry exceeds the decision lifetime', async () => {
+    const nowMs = 1_000;
+    const longLived = await signAutoDecision(
+      { ...decisionPayload, expiresAt: nowMs + AUTO_DECISION_TTL_MS + 60_000 },
+      DECISION_SECRET
+    );
+    await expect(verifyAutoDecision(longLived, DECISION_SECRET, nowMs)).resolves.toEqual({
+      ok: false,
+      reason: 'malformed',
+    });
+    const fullLifetime = await signAutoDecision(
+      { ...decisionPayload, expiresAt: nowMs + AUTO_DECISION_TTL_MS },
+      DECISION_SECRET
+    );
+    await expect(verifyAutoDecision(fullLifetime, DECISION_SECRET, nowMs)).resolves.toMatchObject({
+      ok: true,
+    });
+  });
+
   it('rejects expired and malformed tokens', async () => {
     const expired = await signAutoDecision(
       { ...decisionPayload, expiresAt: 1_000 },

packages/auto-routing-contracts/src/custom-router.ts

@@ -271,7 +271,8 @@ export const CustomRouterDecisionSchema = z
     model: z.string().min(1),
     variant: z.string().trim().min(1).nullable(),
     stale: z.boolean(),
-    // True when the classifier produced no decision and the default or first servable entry was used.
+    // True when no routing decision named a servable entry, so the default or first servable
+    // entry was used. taskType and subtaskType still report the classification, if any.
     fallback: z.boolean(),
     sticky: z.boolean(),
     taskType: ClassifierTaskTypeSchema.nullable(),
@@ -296,6 +297,7 @@ export type CustomRouterDecideResponse = z.infer<typeof CustomRouterDecideRespon
 
 export const AUTO_DECISION_HEADER = 'x-kilo-auto-decision';
 export const AUTO_DECISION_TTL_MS = 5 * 60 * 1000;
+const AUTO_DECISION_CLOCK_SKEW_MS = 30 * 1000;
 const AUTO_DECISION_TOKEN_VERSION = 'v1';
 
 export const AutoDecisionPayloadSchema = z.object({
@@ -389,6 +391,11 @@ export async function verifyAutoDecision(
   const payload = AutoDecisionPayloadSchema.safeParse(json);
   if (!payload.success) return { ok: false, reason: 'malformed' };
   if (payload.data.expiresAt <= nowMs) return { ok: false, reason: 'expired' };
+  // The signer never issues a longer lifetime; the margin covers clock skew between the
+  // signing worker and the verifying gateway.
+  if (payload.data.expiresAt > nowMs + AUTO_DECISION_TTL_MS + AUTO_DECISION_CLOCK_SKEW_MS) {
+    return { ok: false, reason: 'malformed' };
+  }
   return { ok: true, payload: payload.data };
 }
 

services/auto-routing-benchmark/migrations/0026_complete_triton.sql

@@ -0,0 +1 @@
+ALTER TABLE `client_case_results` ADD `pending_grader_usage` text;