Module job_router 

Job routing / placement policy — decide where a curated job is processed.

Given a curated job, this module answers one narrow question: should the work run on the person’s local, in-process inference engine, or be sent to an external provider reached over MCP? It is transport / placement policy only. It performs no I/O, no async work, and no cryptography — it is a pure decision function over a small set of inputs so it is trivially testable and auditable.

Privacy-first, fail-closed ordering

The directive being implemented (Timothy): local inference is PREFERRED when the person can run it; costly external MCP services are used only when wanted/needed and consented; sanctuary/private data must never leave the device.

The rules are therefore evaluated in a deliberate order so that the most protective outcome always wins:

1. Classified / sanctuary data → local only. Such data must never leave the device, regardless of consent or policy. If no local engine is available the job is RoutingDecision::Blocked rather than sent out.
2. Policy forbids external → stay local. If the person’s RoutingPolicy disables external providers, the job runs locally (or is blocked if no local engine exists).
3. Capability gap → external needed. If the job needs a capability the local engine lacks, an external provider is required — but only with explicit consent. Otherwise the caller is told consent is needed (RoutingDecision::NeedsConsent).
4. No local engine → external fallback. For non-classified data, if no local engine is available the job goes external with explicit consent, else consent is requested.
5. Cost ceiling. A remote path that would exceed the policy’s cost ceiling requires consent for the spend. Cost is only meaningful on a remote path — a RoutingDecision::Local decision has no metered cost, so the ceiling is never applied to it.
6. Default → local. With a local engine available and nothing forcing a remote hop, the job runs locally.

Relationship to the authority check

This is placement policy, not an authority check. Whether the requesting agent is permitted to run the job at all is decided separately and complementarily by [qualia_cooperative_core::agency_delegation::delegation_permits] (a fail-closed ABAC evaluator). The caller runs both: delegation_permits answers “is this allowed?”, and route_job answers “where should it run?”. This module deliberately does not reimplement or second-guess that authority decision.

Structs

RoutingInputs

The inputs to a routing decision for a single curated job.

RoutingPolicy

The person’s placement policy — the guard rails route_job evaluates against.

Enums

RoutingDecision

The placement decision for a curated job.

Constants

DEFAULT_COST_CEILING_MICROCENTS

A modest default per-job cost ceiling: 10 US cents expressed in microcents (1 cent = 1_000_000 microcents, so 10 cents = 10_000_000).

Functions

route_job

Decide where a curated job should run.