bug(config): validation misses router.autoOrchestrate main/subagent model refs

[MicroMilo]

UI-related note: this touches the Settings/UI path and may be lower priority during the ongoing frontend refactor.

Summary

UI-side config validation does not check router.autoOrchestrate.mainAgentModel or router.autoOrchestrate.subagentModel, even though the core router parser accepts and strictly validates both fields.

Why it matters

After a provider is deleted or renamed, Settings can still accept stale auto-orchestrate model refs. The saved config then fails during core load with a fatal router diagnostic, turning a successful Settings save into a startup/reload failure.

Evidence

• src/router/config/parseRouterConfig.ts:75 parses raw.autoOrchestrate.
• src/router/config/parseRouterConfig.ts:357 enters parseAutoOrchestrate.
• src/router/config/parseRouterConfig.ts:376 validates raw.mainAgentModel through optionalRef.
• src/router/config/parseRouterConfig.ts:382 validates raw.subagentModel through optionalRef.
• src/router/config/parseRouterConfig.ts:566 converts ref issues into fatal diagnostics.
• src/router/config/schema.ts:229 looks up the referenced provider.
• src/router/config/schema.ts:232 emits ROUTER_REF_PROVIDER_NOT_FOUND for an unknown provider.
• src/router/RouterRuntime.ts:315 consumes autoOrchestrate.mainAgentModel.
• src/router/RouterRuntime.ts:322 consumes autoOrchestrate.subagentModel.
• ui/server/services/pilotdeckConfig.js:191 starts validateRouterModelRefs, but only checks scenarios, fallback, and tokenSaver refs.
• ui/server/services/pilotdeckConfig.js:248 calls that incomplete router ref validator from validatePilotDeckConfig.
• ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:412 rewrites router scenarios on provider rename.
• ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:424 rewrites fallback refs on provider rename.
• ui/src/components/settings/view/tabs/PilotDeckConfigTab.tsx:432 rewrites tokenSaver judge refs, but not auto-orchestrate refs.
• ui/server/services/pilotdeckConfig.js:569 validates before writing config.
• ui/server/routes/config.js:120 and ui/server/routes/config.js:124 route UI saves through the config writer.

Validation

Validation level: dynamic reproduction plus source-control-flow confirmation.

Minimal reproduction:

1. Create a config with a valid agent.model, but set:
   • router.autoOrchestrate.mainAgentModel: old/m
   • router.autoOrchestrate.subagentModel: old/m
2. Ensure model.providers.old does not exist.
3. Run UI validation and then core router parsing on the same config.

Key output:

• validatePilotDeckConfig(...) returns valid: true.
• parseRouterConfig(...) emits fatal diagnostics:
  • router.autoOrchestrate.mainAgentModel references unknown provider old.
  • router.autoOrchestrate.subagentModel references unknown provider old.

Boundary: this did not require a browser click-through. The repro validates the save-time validator and core parser contract directly. It does not test the full gateway reload lifecycle, but the fatal parser diagnostics are on the load path.

Expected behavior

Settings validation, provider rename, and provider deletion cleanup should cover every router model ref that the core parser validates and the runtime consumes. Invalid router.autoOrchestrate.mainAgentModel and router.autoOrchestrate.subagentModel refs should be rejected or repaired before the config is saved.

Existing coverage checked

No matching fix was found.

Checked adjacent work:

• PR fix(config): validate all model providers #185 validates basic model provider shape, but does not validate auto-orchestrate router refs.
• PR fix(config): reject object router model refs #187 rejects object router refs, but does not cover router.autoOrchestrate.mainAgentModel or router.autoOrchestrate.subagentModel.

Search terms checked included router.autoOrchestrate.mainAgentModel, subagentModel references unknown provider, and validateRouterModelRefs autoOrchestrate.

Suggested fix

Add router.autoOrchestrate.mainAgentModel and router.autoOrchestrate.subagentModel to:

• UI/server save-time validation.
• Provider rename rewrite logic.
• Provider deletion/orphan cleanup logic.

The same helper used for scenarios, fallback, and tokenSaver refs should be reused so the UI-side contract stays aligned with the parser contract.

Suggested tests

• UI/server validation rejects router.autoOrchestrate.mainAgentModel: old/m when old is not a configured provider.
• UI/server validation rejects router.autoOrchestrate.subagentModel: old/m when old is not a configured provider.
• Provider rename rewrites both auto-orchestrate refs.
• Provider deletion/orphan cleanup repairs or removes both auto-orchestrate refs.
• A config accepted by UI validation should not produce fatal ROUTER_REF_PROVIDER_NOT_FOUND diagnostics for these fields in the core parser.

---

Submitted with Codex.