Check the wire against BitRouter's published contract, and gate releases by hand - #7

Two changes, both in service of one rule: a green pull request should be
safe to merge on its own, and the only step a person has to perform is
cutting a release.

The contract check

test/wire.test.ts proves the mapper reads a captured body correctly. It
cannot prove the capture still resembles what the server sends. That gap
is not hypothetical — this package once read context_window, a flat
cost, and a boolean reasoning, none of which BitRouter has ever sent,
so every model sat at its default window priced at zero and no test
minded.

BitRouter Cloud publishes its GET /v1/models response schema, generated
from the Rust types that serialize it, served unauthenticated at
/openapi.json. So there is nothing to guess at and no live API key in
CI. schema/models.schema.json is a vendored copy — vendored rather than
fetched, because the suite that gates merges has to be offline and
deterministic.

The load-bearing assertion is not "does the fixture parse". It is has
the set of fields BitRouter serves changed since somebody last looked.
A new field fails once, and the fix is one line in ACKNOWLEDGED
recording whether it is mapped or ignored and why. A vanished field
fails louder, because that is the direction that goes quietly wrong.

It had already drifted. Production now serves hosted,
open_weights, latency, and throughput — three of them required —
and the fixtures predated all four. Recaptured verbatim here, with
claude-sonnet-5 added for the image_input path and grok-4.3 for
tiered pricing.

That last row documents a real gap rather than fixing it. A model can be
billed at a steeper rate once input crosses a threshold, for the whole
request — grok-4.3 doubles above 200k. toCost reports the base
bracket, so opencode understates a long prompt to a tiered model. An
opencode model entry carries one flat rate per direction and has nowhere
to put a ladder, so closing it needs an opencode-side change. Asserted
here so it stays known rather than being rediscovered.

contract.yml re-vendors the schema on a clock and opens a pull request
carrying the diff, so a contract change arrives as a reviewable change
with the suite's verdict already on it.

The release gate

publish.yml, triggered by a published release and deliberately not by a
push to main. That separation is what makes auto-merge safe rather than
reckless: main may move on its own because main reaches nobody, and
the step that does reach somebody stays manual. It re-runs the build, the
test typecheck, and the suite against the tagged tree, refuses a tag that
disagrees with package.json, publishes with provenance, and routes
prereleases to the next dist-tag.

Before merging

• publish.yml needs an NPM_TOKEN secret and an npm environment.
• contract.yml needs CONTRACT_PR_TOKEN. A pull request opened with
  the default GITHUB_TOKEN does not trigger workflows, which would
  leave it with no checks at all.

63 → 73 tests.