Turn the main model into a dispatcher · Six-lane shell matrix · Deterministic gating × Weighted scoring
The activation matrix rebuilds itself in real time from desktop visible models / TUI favorites / live sessions; six gates and weighted scoring run on their own — you decide, the matrix spends.
You hold Copilot credits, a GLM Coding Plan and a DeepSeek balance — yet you keep flying blind on watermarks and paying full freight at peak hours.
Flagship models running scan-and-count grunt work, tokens spent where they shouldn't be; lightweight models doing architecture design — rework ends up costing the most.
GLM's 5-hour window exhausted yet you keep ramming into it, Copilot credits expiring at month-end unspent, DeepSeek balance drained before you notice.
Review runs in the same model family as the producer, sharing the same blind spots — nothing ever gets caught.
"Hey, take a look at this" delegation is unstructured and unvalidated — sub-agents end up with vague tasks.
The LLM handles cognitive decisions; the plugin handles everything computable deterministically — intelligence and rules, cleanly separated.
The main model (dispatcher) plus the injected dispatcher protocol — profiling tasks in four dimensions and making delegation decisions.
"Model × lane" empty-shell sub-agents, bound only to a model and thinking tier; roles are assigned dynamically by the delegation prompt.
The plugin itself: zero probability, pure rules — every dispatcher decision is held inside hard constraints and explainable scores.
At startup the config hook injects the "model × effort" shell matrix into the agent registry. Desktop visible models and TUI favorites sync both ways with mtime arbitration; any surface change triggers a full probe recomputation immediately, while the 10-minute refresh keeps the matrix self-healing — zero manual upkeep.
Six lanes by cognitive intensity, each backed by an optimal shell chain computed live by the plugin from capability tier / effort fit / health / watermarks / cost / peak windows.
clerk / scouter cheap sweeps — built for context protection.
tester / ops mechanical execution — high-frequency, verifiable.
programmer / uiux / data-analyst, your daily workhorses.
planner load-bearing design — only the strongest models at max tier.
observer reads images — dedicated vision shells for image tasks.
reviewer / expert panel — drop shells sharing the producer's family first, same family counts as self-review.
Four hooks cover the full chain: startup injection → dispatch interception → classified failure accounting → per-turn prompt injection.
Injects the full shell matrix into cfg.agent at opencode startup, and collects credentials across all providers (auth read-only, zero separate storage).
Runs six-gate deterministic validation before the task tool executes; on deny it attaches the reason plus a redirect candidate, and the main model reassigns seamlessly along the chain.
Normalizes rate_limit / quota / auth / not_found / server / network / unknown, trips 600s breakers, and isolates real-dispatch failures for 10–30 minutes.
Injects dispatcher rules plus the four-line banner into every LLM request; every rebuild logs scored candidates to routing-decisions.jsonl.
fail-open law: any hook exception only writes to stderr and never blocks the main flow; unknown quota is never hard-blocked, and breaker + probe back each other up — the plugin never becomes a single point of failure.
When the main model dispatches a sub-agent, the plugin validates deterministically before the task tool executes — order is priority.
Candidate chains are computed live from curated capability tiers and six coefficients — the main model dispatches to the chain head, and the score trail is logged.
S/A/B/CCurated base scores match exact → prefix → family → global fallback. A lower tier can never outrank a higher tier, even with better water or cost.
weightedScore = base × effortFit × health × water × costBias × peak. Probe 429 becomes strained health, not a pool-wide jump to another vendor.
boundedTwo quota windows use the tighter pressure; Copilot surplus near expiry can be boosted; GLM peak is only ×0.93 same-tier yield, never cross-tier exile.
jsonlEvery banner rebuild writes candidates and factor scores into a 200-line routing-decisions.jsonl ring buffer; immediate urgency still sorts by probe latency.
# single-line protocol embedded in the delegation prompt (sample) ROUTE_META { "lane": "main", // one of six lanes "role": "programmer", // one of 14 roles "producer_family": "glm", // true model family "capability": "rw", // rw | ro "modality": "text", // text | image "source": "auto" // auto | user }
The system.transform hook injects into the system prompt every turn — the dispatcher always decides on the freshest facts.
The banner is the "dispatch basis" — routing, watermarks, limits and update status are all line-parsable; the main model never needs to memorize static config.
The data plane runs fully automatically: liveness, quota, pricing, scoring, classified failures and updates — no manual intervention.
Sends real requests to the three quota pools to check liveness. Surface changes trigger a full refresh immediately; the 10-minute cycle keeps temporary failures in the degradation chain.
Failures become rate_limit / quota / auth / not_found / server / network / unknown. Real-dispatch failures isolate a combo for 10–30 minutes; 3 consecutive 404s retire a model.
Startup checks cache for 24h. Production installs expose /switchman-update for silent upgrade plus restart notice; /switchman-ignore is session-scoped and resets on restart.
174 behavior-contract fixtures all green as the safety net · every opencode provider plugs in · glm / deepseek / copilot quota control