fix: separate canonical model metadata from route policy

[jolestar]

Summary

• store canonical built-in model metadata once and represent endpoint-specific built-ins as sparse route policies
• enforce that route capability policy can only narrow intrinsic model capabilities, with endpoint constraint evidence
• retain a compatibility adapter for unmigrated duplicate provider catalogs
• migrate StepFun default/plan routes to shared canonical metadata without changing refs, aliases, discovery, or models.catalog
• document the resolver and migration contract

This is the first narrow implementation PR for #2363. The remaining provider catalog audit and migration will follow separately, so this PR does not close the issue.

Verification

• cargo fmt --all -- --check
• cargo test model_catalog
• RUSTFLAGS="-D warnings" cargo check --all-targets

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
holon	Ready	Preview, Comment	Jul 21, 2026 11:11pm

[jolestar]

Review by holon-reviewer ✅

Summary

This PR introduces a clean separation between canonical built-in model metadata and endpoint-specific route policy. The design is sound — BuiltInModelRoutePolicy as a sparse overlay that can only narrow (not widen) intrinsic capabilities is the right abstraction.

Code Review

Correctness:

• field_diff + double-Option pattern for nullable sparse fields is clean and correct
• validate_narrowing enforcement at catalog construction (panic on violation) is appropriate for built-in data integrity
• apply_route_capability_constraint correctly handles post-resolution narrowing with proper EndpointPolicy constraint evidence
• resolve_capability_field signature simplified by removing route_builtin — capabilities now resolve from model_builtin only, with route constraints applied separately. Cleaner separation of concerns.
• Legacy adapter path (from_legacy_route_entry) provides smooth migration without breaking existing provider catalogs

Design:

• The sparse policy design (None = inherit, Some(value) = override) is idiomatic and well-documented
• StepFun migration to canonical metadata with empty route policies correctly inherits identical metadata without duplication
• ModelMetadataConstraintSource::EndpointPolicy properly distinguishes route policy constraints from transport constraints in evidence

Tests:

• route_policy_cannot_enable_an_intrinsic_capability — validates narrowing invariant ✅
• capability_precedence_treats_discovered_false_as_unknown_but_preserves_explicit_false — tests new constraint-as-narrowing semantics with evidence ✅
• StepFun registration test verifies default/plan route parity ✅

Documentation:

• Decision doc 099, RFC updates consistent with implementation ✅

Minor observation (non-blocking):

• reasoning_effort_options filtering changed: old code filtered empty lists, new code treats Some(vec![]) as a valid sparse override. Correct for sparse policy semantics but a subtle behavioral change to be aware of.

Verdict: No blocking issues. Ready to merge once CI passes.

[holonbot]

Holon Run Report

• Result: completed
• Target: fix: separate canonical model metadata from route policy #2367
• Workflow run: https://github.com/holon-run/holon/actions/runs/29876337270
• Model: dashscope@token-plan/qwen3.7-max
• Requested model: dashscope@token-plan/qwen3.7-max
• Fallback active: false
• Token usage: input 14045, output 6120, total 20165
• Provider cache: read 140788, created 32232, cacheable 173020, hit rate 81.37%
• Model rounds: 7
• Tool calls: 14