Treat Model Routing as Untrusted Request Data

A request-scoped model override is easy to implement as a mutation on a shared adapter. That shortcut works in the happy path and fails under concurrency, cancellation, retries, or a thrown provider error. The next request can inherit the previous request’s route without an explicit decision to do so.

This is the same class of failure as leaked authentication or tenant state: the value is not necessarily secret, but it has authority. It changes where work runs and can change which data leaves a boundary.

Treat provider selection, filesystem paths, model identifiers, and hardware preferences as untrusted inputs until they are validated and bound to one request. A local machine is not automatically a single-user trust domain once multiple tools, workers, or sessions share a process.

This framing also improves AI-assisted development. Ask the model to reason about ownership and cleanup before asking it to add another adapter option. The important question is not whether the override can be set. It is who can observe it after the request ends.

Give the model a small state-isolation brief: identify the mutable object, list every request exit path, define the default path, and write the cross-request test before implementation. Have it explain why the cleanup belongs in a `finally` path and what happens if validation, inference, cancellation, or serialization fails.

The useful boundary is a request envelope that carries the override, a validator that narrows it to an allowed capability, and an adapter call wrapped by guaranteed cleanup. The default path remains the source of truth for ordinary requests; the override is an explicit exception with a bounded lifetime.

That pattern composes well with local-first systems because it keeps routing authority near the operator while preventing a local adapter from becoming an ambient global switch.

The current development record supports the isolation design and its targeted implementation claim. It does not by itself prove every provider path, worker concurrency mode, or production filesystem posture. Those need focused tests and a live runtime receipt on the supported deployment path.