Where Should This Query Run? Cost-, Privacy-, and Verifiability-Aware Model Routing for Personal AI Systems (DeeWaanAI OS Layer 5)

Every assistant now routes: a request is classified, a model is chosen, and the choice is explained by code nobody can re-run. We argue that the routing layer itself should be the auditable object, and we build one. The policy — gate order, thresholds, prices, allowed data loci — lives in bound datasets, not code; every decision is written as one record carrying its classifier output, the full gate trace, the feasible set with its cost for each candidate, and a claim binding whose sources resolve. A replay audit rebuilds the registry as it stood at each decision’s timestamp and recomputes the trace, the winner and its cost; 263 checks pass on 414 recorded decisions across eight runs, including every decision that spent money. Because eligibility is a measurement, we freeze a capability matrix from frozen runs and show that moving two thresholds changes which model answers and what it costs, with no code change: on six computation items the same frozen measurements route to a free 3B model (measured accuracy 0.00), a free 8B (0.67), a $1.04/Mtok model (0.83) or a $2/$6 model (1.00) depending only on the policy. On the task that motivated the design, four of five models compute an 800-row total exactly when they write and run code, and none of those that can fit the rows in context compute it there. We are equally explicit about what the layer cannot promise: privacy is a user-declared policy, not a property of the architecture; with 6 items per capability cell one correct answer flips a verdict; and our own answer-key defect was found by the audit, not by the experiment. We test the audit itself by injecting seven corruptions, six of them written through the store with a valid hash chain; all seven are caught on the check that should catch them, with no false alarms on clean copies. Against five fixed strategies the router is not dominated: a free local model reaches 0.73 accuracy at $0, the most expensive arm reaches 1.00 for 4.8× what the router pays for the same score, and one tie-break defect — found by the baseline, not by inspection — silently selected an unmeasured model at identical cost. The contribution is not a better router — it is a router whose every claim, including the uncomfortable ones, can be recomputed, and whose audit has been shown to fail when it should. Code: https://github.com/DeeWaanAI/model-router (tag paper-v1.0, AGPL-3.0).