cross-vendor delegation — execute the routed winner, not just advise

[aktasbatuhan]

Summary

When routing picks a winner from another vendor (switch-harness, or any model the source harness can't run natively), watchmen today only writes an advisory sentence — it makes the decision but never executes it (route_rewrite.py:129 cross_runtime guard, PR #92). This issue tracks turning that advice into actual cross-vendor delegation: run the chosen model, return the result — invisibly and safely.

Today

• In-vendor routing writes a runnable artifact (CC subagent model:, Codex profile model =) and the host self-delegates.
• Cross-vendor falls back to text: "For the X skill, run it on Codex — Claude Code can't run gpt-5.5 natively." (_advisory_sentence, route_rewrite.py:190). The hands stop at a sentence.

Proposed design — a DelegationExecutor seam

One interface, pluggable backends: (task_context, target={harness, model}) -> result + cost + signals.

• Headless backend (build first; no AX dependency). A router subagent / dispatch block shells codex exec --json or claude -p --output-format stream-json as a worker and returns structured output. The AX spike already proved the cross-vendor handoff (CC↔Codex with structured history) works using exactly these CLIs — no external runtime required.
• AX backend (future / optional). Same interface, dispatch via AX. Adopt only when AX clears a concrete bar: a real HarnessService protocol (currently a literal "Hello world" placeholder), controller2 dispatch-to-named-agent + resume (both TODO today), observable trace (it currently drops tool calls), and detached execution. AX is also still entirely cost-agnostic, and upstream contributions are paused — so it's a backend we plug in later, not a dependency. Keep the ax_dispatch.py experiment as the stub behind this interface.

Guardrails (must-have before any auto-execution)

• Consent + allowlist (per project). Silently sending proprietary code to a "cheaper" third-party vendor is a data-governance problem. Cross-vendor delegation must be explicit opt-in per project.
• Budget caps. Token + delegation-depth limits (cf. opencode's task_budget / depth caps) to prevent runaway cost.
• Execution-grounded validation. Prefer signals like tests-pass / diff-applies over judge opinion when accepting delegated work.

Note on AX's real fit

AX's strongest near-term value for us is not live cross-vendor delegation — it's the offline fork-and-race compare harness (same starting state → two divergent trajectories, both captured), which is the natural substrate for watchmen's blind-compare. Worth tracking separately; it still needs the trace fix to harvest tool-call signals.

Dependencies

• Builds on the routing decisions produced by the engine (PR feat(route): harness-aware skill-bucket model routing #85) and the Gap 1 work. This is the execution layer beneath an already-working brain.

Acceptance (phase 1, headless)

• DelegationExecutor interface with a headless backend (codex exec / claude -p).
• A switch-harness decision can, when the project has opted in, actually run the foreign model and return the result — instead of only advising.
• Per-project opt-in + token/depth budget enforced; off by default.

[aktasbatuhan]

Decision recorded (2026-06-05): how we build this, and where AX fits

Call: build headless now; AX-native delegation is a later upgrade, not a gate. This matches the Kai Roadmap. July (M1) ships the headless DelegationExecutor backend (codex exec / claude -p); August (M2/M3) takes routing + delegation live on headless backends. The roadmap is explicit: "AX-native delegation backend remains a later upgrade when google/ax#19 and the harness refactor land; the headless path does not block on it."

The real use cases (a continuously changing model/harness landscape)

1. Rate-limit / budget hit -> continue the same task on another model or harness (e.g. a Claude Pro weekly-cap 429 with no retry-after).
2. Second opinion / help from another agent.
3. Fork-and-race -> snapshot at a point, run two paths in parallel, keep the winner, kill the loser.

All three are coding scenarios where the working tree on disk is the source of truth. They need continuation, not bit-faithful latent-state resume. On-disk repo state transfers for free; only the conversation / latent state is lost on a headless switch, and watchmen already captures the transcripts needed to engineer a continuation seed. Fork-and-race is git worktrees (which watchmen already uses) + parallel headless agents + an execution-grounded judge (tests pass / diff applies, not opinion).

The crux is context engineering, not plumbing

The part that makes or breaks all three is the handoff distiller: turning an in-flight session into a seed that lets a cold harness continue competently (active goal, recent decisions, working-set files, relevant skill, what was already tried). The plumbing (worktrees, headless dispatch, a 429/budget trigger, a test-based judge) is easy. The distiller is the moat and where the effort goes.

Hard guardrail: transcripts never leave the machine

This is the roadmap privacy boundary ("distilled learnings, never transcripts"). Context-engineered handoff is a local-only operation. Local harness-to-harness replay is fine; any cloud-bound delegation (to Kai Agent) carries only the task spec + workspace context, never the transcript. The DelegationExecutor seam must enforce this: local backends may use transcripts, cloud backends may not.

AX status update (corrects the "Hello world placeholder" note in the issue body)

On google/ax origin/main the refactor has moved well past that snapshot: real harness interfaces exist (Handler / Harness / Execution, #16) on the Substrate refactor (#17), controller2 is wired and working (#33, #35), and there is a real gRPC harness service (#34, #42, #46) with ResumeActor + TLS working end to end (#49). Still open, and exactly the bits we would depend on: bringing a remote harness that implements HarnessService (TODO in controller2/controller.go), controller-level resume of an incomplete execution, and tool-call capture in the trace (it replays messages, no distinct tool-call events yet). External contributions remain paused (#31). google/ax#19 (filed by us: internal_only messages are not replayed across executions) is the precise session-continuity blocker for AX-native faithful switching.

Net

DelegationExecutor seam with local headless backends now; the handoff distiller is the real work; fork-and-race on worktrees with an execution-grounded judge; AX as a swap-in backend behind the same seam, triggered by google/ax#19 + the harness refactor landing, for faithful trajectory resume and richer fork traces.