0.1.8 Beta2 prerequisite: Fail closed on model identity mismatches instead of alias or catalog fallback #274

This was generated by AI during triage.

Parent

#318 (part of #248)

Problem

A model identity must not be resolved by display name or silently fall back across official and CodexHub catalogs. Duplicate or stale metadata can otherwise bind a visible choice to a different model slug and capability contract.

The July 31 incident selected codex-auto-review rather than Terra and polluted history with reviewer-only namespace data. #302 prevents incompatible third-party reasoning IDs from poisoning an Official continuation; this issue prevents identity mismatch or fallback from selecting the wrong route in the first place.

Required invariant

The routable identity is the exact provider/model slug pair. Display names, ordering, aliases, and nearest catalog matches are presentation data and never choose a route. Missing, internal, ambiguous, stale, or inconsistent identities fail before upstream I/O without substituting another model or mutating session/catalog state.

Acceptance criteria

• Route planning and materialization preserve the exact requested provider ID and model slug.
• No display-name, duplicate-name, prefix, suffix, priority, or cross-catalog fallback can map codex-auto-review to gpt-5.6-terra or the reverse.
• Unsupported/internal/missing identities fail before upstream I/O with a stable non-secret classification.
• Failed resolution persists no alternate binding and mutates no generated catalog/session state.
• Duplicate-Terra fixtures select only by exact slug and reject codex-auto-review.
• Incompatible reviewer history is never forwarded through a fallback generation route.
• Direct to Gateway to Direct and stale-session cases preserve exact provider/model identity.
• Diagnostics distinguish upstream catalog inconsistency from CodexHub resolution failure.

Blocked by

• 0.1.8 Beta2 prerequisite: Honor Codex visibility and keep internal reviewer models out of managed catalogs #273