fix(assistant): titles and learning use an admin-set utility model (chrono-llm-public / gpt-6-luna) with diagnostics and safe fallback (0.61.3)

[chronoai-kai]

Summary

Fixes automatic conversation titles in production: threads kept the first user message as their title. Per the owner, background generation now uses NyxID's auto-connected chrono-llm-public with a weak model (gpt-6-luna), as admin-editable configuration rather than a hardcoded policy.

Cause (ranked; production had no diagnostics)

one_shot_text tried the first discoverable inference service (platform-available first, then by slug, so Chrono gateways precede llm-openai) and picked any "nano/mini"-style model. Then:

1. a reasoning model could spend the 128-token budget without visible text;
2. a 4xx from an incompatible model or request stopped generation with no fallback;
3. discovery, credential or timeout failures.

Every failure returned None silently.

Changes

• Utility route:
  • An atomic platform setting {service_slug, model} is seeded at startup to chrono-llm-public / gpt-6-luna.
  • GET/PUT /api/v1/admin/settings/utility-inference (admin only, audited). Setting null clears it durably; admin overrides and clears survive restarts via utility_inference_admin_modified.
  • Writes use targeted $set, so old replicas cannot clobber the fields.
• Routing and billing: titles, agent-learning analysis and the voice classifiers resolve the utility service through live platform-key ACLs and are billed to the acting person.
  • Fallback: the best live small chat model on the same service.
  • The person's own services are used only if the utility service is unavailable to them.
• Safety:
  • At most three attempts, never after an ambiguous or paid call; definite refusals settle at zero usage.
  • Retired (shutdown_date) and non-chat models (search, deep-research, codex, computer-use, instruct, -pro and others) are excluded.
  • Reasoning models get minimal effort and an output budget. Unsupported parameters are cached per service/model after a 400.
• Diagnostics: one metadata-only warn log per attempt (caller, service, model, stage), never prompts, inputs, outputs or keys.

Backward compatibility

The new fields are serde-defaulted. Absent configuration keeps legacy selection. Learning stays dormant with the flag off.

Validation

• Implementer, at both default and 1.5 MiB stacks: 91 passed (one-shot 27, titles 7, utility configuration/API 4, learning 15, platform settings 6, voice 32). Rust 1.98.1 clippy --all-targets -D warnings; fmt. No frontend changes; a settings UI can follow.
• Reviewer: checked admin-only access, durable clears, $set writes (rolling-safe), no deny_unknown_fields on PlatformSettings, and that the voice callers only gained a diagnostic label.

[github-actions]

📊 Code coverage

Component	Lines	Threshold	Status	Δ vs base
Backend (nyxid)	87.06%	73%	✅	🔺 +0.12
CLI (nyxid-cli)	69.23%	64%	✅	— 0.00
Frontend (vitest)	72.27%	15%	✅	— 0.00

Gate: line coverage must stay at or above the threshold. Ratchet plan (W21): Backend → 55%, CLI → 50%, Frontend → 30% by quarter end.