Executive summary
Implemented a separate Hiro development-task router that selects among local Qwen, Luna Low, Terra Medium, Sol Medium, and explicitly approved Sol High without changing Hiro's conversational router.
The policy permits at most one automatic escalation, and only an objective process or operator-supplied validation failure can trigger it. High-consequence work has a Sol capability floor, while Sol High requires explicit approval.
Installed and verified the official standalone Codex CLI because Windows denied child-process execution of the desktop application's packaged binary. A real read-only Luna Low probe completed successfully and returned the exact expected response.