Refactor agent model handling and routing logic

- Updated ExecutabilityVerifier-subagent to remove model declaration.
- Revised NOTES.md to reflect changes in active objectives and evaluation gates.
- Changed Orchestrator's model from Claude Sonnet 4.6 to Claude Opus 4.8 and updated model resolution rules.
- Adjusted Planner agent's model resolution documentation for clarity.
- Removed model declarations from PlatformEngineer, Researcher, TechnicalWriter, and UIImplementer subagents.
- Enhanced README.md to clarify model selection process for agents.
- Updated MODEL-ROUTING.md to reflect new auto selection and pinning strategy.
- Modified drift-checks to enforce model presence rules for pinned and auto agents.
- Changed runtime policy default mode from deterministic to auto.
- Updated tests to validate new model handling rules and ensure compliance.
- Added Visual Studio workspace configuration files for improved development experience.

Author: Smith

.vs/ControlFlow.slnx/v18/DocumentLayout.json

@@ -0,0 +1,12 @@
+{
+  "Version": 1,
+  "WorkspaceRootPath": "E:\\WORK\\Github\\ControlFlow\\",
+  "Documents": [],
+  "DocumentGroupContainers": [
+    {
+      "Orientation": 0,
+      "VerticalTabListWidth": 256,
+      "DocumentGroups": []
+    }
+  ]
+}

.vs/ProjectSettings.json

@@ -0,0 +1,3 @@
+{
+  "CurrentProjectSetting": null
+}

.vs/VSWorkspaceState.json

@@ -0,0 +1,6 @@
+{
+  "ExpandedNodes": [
+    ""
+  ],
+  "PreviewInSolutionExplorer": false
+}

BrowserTester-subagent.agent.md

@@ -1,7 +1,6 @@
 ---
 description: 'Runs E2E browser tests, verifies UI/UX, and checks accessibility compliance'
 tools: ['search', 'usages', 'problems', 'changes', 'edit/createFile', 'fetch', 'runCommands', 'runTasks']
-model: GPT-5.4 mini (copilot)
 model_role: browser-testing
 ---
 You are BrowserTester-subagent, an E2E browser testing and UI verification agent.

CodeMapper-subagent.agent.md

@@ -2,7 +2,6 @@
 description: Explore the codebase to find relevant files, usages, dependencies, and context for a given research goal or problem statement.
 argument-hint: Find files, usages, dependencies, and context related to: <research goal or problem statement>
 tools: ['search', 'usages', 'problems', 'changes', 'testFailure']
-model: Claude Sonnet 4.6 (copilot)
 model_role: fast-readonly
 ---
 You are CodeMapper-subagent, a read-only discovery agent.

CodeReviewer-subagent.agent.md

@@ -1,7 +1,6 @@
 ---
 description: 'Review code changes from a completed implementation phase.'
 tools: ['search', 'usages', 'problems', 'changes', 'runCommands', 'runTasks', 'read/readFile']
-model: Claude Opus 4.8 (copilot)
 model_role: capable-reviewer
 ---
 You are CodeReviewer-subagent, the deterministic verification gate.

CoreImplementer-subagent.agent.md

@@ -1,7 +1,6 @@
 ---
 description: 'Execute implementation tasks delegated by the CONDUCTOR agent.'
 tools: ['edit', 'search', 'runCommands', 'runTasks', 'usages', 'problems', 'changes', 'testFailure', 'fetch', 'githubRepo']
-model: Claude Sonnet 4.6 (copilot)
 model_role: capable-implementer
 ---
 You are CoreImplementer-subagent, a backend/core implementation agent.

ExecutabilityVerifier-subagent.agent.md

@@ -1,7 +1,6 @@
 ---
 description: 'Cold-start plan executability simulator that validates plan tasks are specific enough for zero-context execution'
 tools: [read/readFile, search/codebase, search/fileSearch, search/listDirectory, search/textSearch]
-model: Claude Sonnet 4.6 (copilot)
 model_role: review-readonly
 ---
 You are ExecutabilityVerifier, a cold-start executability simulator for plan verification.

NOTES.md

@@ -2,6 +2,6 @@
 
 Repo-persistent active-objective state only. See `docs/agent-engineering/MEMORY-ARCHITECTURE.md` for the three-layer memory model; task-episodic history lives under `plans/artifacts/<task-slug>/`.
 
-- Active objective: follow-up cleanup complete; full eval gate (`cd evals && npm test`) green (drift-detection 101/101).
+- Active objective: Auto-default + selective pinning complete (4 pinned agents); full eval gate (`cd evals && npm test`) green.
 - Blockers: none.
 - Pending: optional follow-up to investigate pre-existing capability-matrix live-tree drift flags surfaced by the smoke test.

Orchestrator.agent.md

@@ -2,7 +2,7 @@
 description: 'Orchestrates Planning, Implementation, and Review cycle for complex tasks'
 tools: ['vscode/askQuestions', 'execute/testFailure', 'execute/getTerminalOutput', 'execute/awaitTerminal', 'execute/killTerminal', 'execute/createAndRunTask', 'execute/runInTerminal', 'read/problems', 'read/readFile', 'agent', 'edit/createFile', 'edit/editFiles', 'search/changes', 'search/codebase', 'search/fileSearch', 'search/listDirectory', 'search/textSearch', 'search/usages', 'web/fetch', 'web/githubRepo', 'todo']
 agents: ["Planner", "CodeMapper-subagent", "Researcher-subagent", "CoreImplementer-subagent", "UIImplementer-subagent", "PlatformEngineer-subagent", "TechnicalWriter-subagent", "BrowserTester-subagent", "CodeReviewer-subagent", "PlanAuditor-subagent", "AssumptionVerifier-subagent", "ExecutabilityVerifier-subagent"]
-model: Claude Sonnet 4.6 (copilot)
+model: Claude Opus 4.8 (copilot)
 model_role: orchestration-capable
 ---
 You are Orchestrator, the conductor agent for multi-step engineering workflows.
@@ -170,12 +170,12 @@ Reference: `docs/agent-engineering/TOOL-ROUTING.md`
 ### Universal Model Resolution Rule (Mandatory — All Dispatches)
 Before every `agent/runSubagent` call, regardless of dispatch context, apply this rule:
 1. Load `governance/model-routing.json`.
-2. Load `governance/runtime-policy.json` and resolve `runtime_model_mode` from per-dispatch override when present, else `model_dispatch.default_mode` (deterministic default).
+2. Load `governance/runtime-policy.json` and resolve `runtime_model_mode` from per-dispatch override when present, else `model_dispatch.default_mode` (now defaults to `auto`; deterministic is the opt-in mode used for pinned dispatch).
 3. Set payload marker `runtime_model_mode` on every delegation payload for auditability and mode-consistency checks.
 4. Look up the target agent name in the top-level `agent_role_index` map to get its role.
 5. Read `roles[role].by_tier[complexity_tier]`. If the entry is `{ "inherit_from": "default" }`, use the role's top-level `primary` model; otherwise use the tier-specific `primary`.
 6. Pass the exact target as the outer `agentName` parameter to `agent/runSubagent`.
-7. **Deterministic mode (default/backward-compatible):** pass the resolved `primary` model string as the outer `model` parameter to `agent/runSubagent`. Never omit outer `model` in deterministic mode.
+7. **Deterministic mode (opt-in, used for pinned dispatch):** pass the resolved `primary` model string as the outer `model` parameter to `agent/runSubagent`. Never omit outer `model` in deterministic mode.
 8. **Auto mode:** omit the outer `model` parameter so Copilot platform auto-selection can choose the runtime model. Keep payload-level `model` optional in this mode and rely on `runtime_model_mode: auto` marker for contract semantics and audits.
 9. For initial planning dispatches before any plan `complexity_tier` exists: deterministic mode uses the target role's top-level `primary` model; auto mode still omits outer `model`. Missing tier context changes the resolution source (deterministic) or preserves omission (auto), not the mode contract.
 
@@ -185,7 +185,7 @@ This rule covers all dispatch paths without exception: Plan Review Gate reviewer
 
 Every `agent/runSubagent` call must include these outer tool-call fields:
 - **`agentName`** — the verified target-agent field (string). Placing the agent name only inside prompt prose or a delegation payload is non-compliant.
-- **`model`** — mode-conditional outer runtime selector from the Universal Model Resolution Rule. In deterministic mode (default/backward-compatible), pass the resolved primary as the outer `model` field and never omit it. In auto mode, omit the outer `model` field intentionally so Copilot selects the model automatically.
+- **`model`** — mode-conditional outer runtime selector from the Universal Model Resolution Rule. In deterministic mode (opt-in for pinned dispatch), pass the resolved primary as the outer `model` field and never omit it. In auto mode (the default), omit the outer `model` field intentionally so Copilot selects the model automatically.
 - **Prompt/context payload** — scope, deliverables, and relevant context references.
 
 Payload-level `model` remains delegation/audit metadata and does not by itself select runtime execution. It is not a substitute for the outer `model` when deterministic mode is active.
@@ -198,7 +198,7 @@ For `CodeReviewer-subagent`, `PlanAuditor-subagent`, and `AssumptionVerifier-sub
 - **Effective review tier:** For normal plan/code review, use the plan `complexity_tier` as the effective review tier. If a high-impact applicable `risk_review` entry is unresolved and forces the full review pipeline, resolve review-agent models using `LARGE` even if the plan `complexity_tier` is lower.
 - **Primary dispatch:** Resolve the primary model from `governance/model-routing.json` `roles.capable-reviewer.by_tier[<effective_review_tier>]` (or the role default when `inherit_from: "default"`). Do not hardcode a model string; always derive the primary from the governance file by effective review tier.
 - **`model_unavailable` retry:** On `model_unavailable`, retry using the configured `fallbacks` list for the same effective tier in order, within `retry_budgets.model_unavailable_max`. Do not silently substitute the Orchestrator frontmatter model or any unconfigured model; only models in the configured `fallbacks` list for the effective tier are permitted as substitutes. If all configured models for the effective tier are unavailable, escalate to `WAITING_APPROVAL` rather than proceeding.
-- `ExecutabilityVerifier-subagent` is an intentional exception: it resolves through `review-readonly` to `Claude Sonnet 4.6 (copilot)` and is not subject to capable-reviewer fallback routing.
+- `ExecutabilityVerifier-subagent` is an Auto (default) agent: in auto mode the outer `model` is omitted and Copilot's picker selects its model, bounded by the subagent cost-cap to at most the Orchestrator's tier, and it is not subject to capable-reviewer fallback routing. Only under deterministic/pinned dispatch would it resolve through its `review-readonly` role (advisory `primary` `Claude Sonnet 4.6 (copilot)`).
 
 ### Initial Planner Dispatch Gate
 
@@ -207,7 +207,7 @@ For `CodeReviewer-subagent`, `PlanAuditor-subagent`, and `AssumptionVerifier-sub
 **Non-trigger conditions:** Informational questions, status requests, or any request that already includes a `plan_path` or references an active plan. Do not trigger this gate when plan context is already available.
 
 **Dispatch:**
-- Apply the Universal Model Resolution Rule. Before a plan `complexity_tier` exists (no `plan_path` yet), deterministic mode uses Planner's top-level `primary` model; auto mode omits outer `model` intentionally. Deterministic remains the default path.
+- Apply the Universal Model Resolution Rule. Before a plan `complexity_tier` exists (no `plan_path` yet), deterministic mode uses Planner's top-level `primary` model; auto mode omits outer `model` intentionally. Auto is the default path; deterministic applies to pinned dispatch.
 - Dispatch Planner as an **entry-point delegate, not a phase executor**, with:
    - `revision_mode: initial_create` because no active plan exists. Phase 3 keeps the schema field optional for legacy fixture compatibility, but live initial planning dispatch uses this mode.
   - The original user request.