v0.8.65: Split config modules around provider/model/catalog boundaries

[Hmbown]

Goal

Split the large config modules without creating another pile of synchronized provider lookup tables.

This is an implementation slice of #2608. The purpose is to move config code toward the same provider/model/offering/route boundaries used by the rest of v0.8.65, not to centralize every provider-specific branch into one bigger table.

Architecture Contract

Config should store user intent and overrides. It should not own provider behavior or model behavior.

Use this ownership split:

• Provider/catalog layer (v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608): provider descriptors, model profiles, provider model offerings, capabilities, pricing, provenance, alias/deprecation rules.
• User config layer (this issue): selected provider/model intent, custom base URLs, credentials/auth mode references, fallback chain, custom model ids, explicit overrides, routing preferences, and cost mode.
• Route layer (v0.8.65: Resolve every provider/model switch through a ReadyRouteCandidate #3384): combines catalog facts, user config, auth, endpoint/base URL, validation, and capability requirements into a ready route.

Do not add:

• new provider/model compatibility match tables in config;
• naked global model strings detached from provider scope;
• model routing logic in TOML migration code;
• prompt or docs files as a source of route truth.

Current Problem

The TUI config layer and shared config crate have large provider/config monoliths:

• crates/tui/src/config.rs
• crates/config/src/lib.rs

Provider defaults, env vars, model aliases, validation, base URL cleanup, completion names, capability reporting, and migration compatibility are interleaved. Adding or fixing a provider currently risks touching unrelated surfaces.

Proposed Module Split

For crates/tui/src/config.rs, split only where the boundary is real:

• config/types.rs: user config schema and serde compatibility.
• config/loading.rs: load, merge, and migration flow.
• config/credentials.rs: credential references and env/auth preference resolution, without storing secrets in logs or prompts.
• config/paths.rs: config/cache/workspace paths.
• config/env_override.rs: environment overrides.
• config/workspace_trust.rs: trust/sandbox config.
• config/provider_user_config.rs: per-provider user intent and overrides.
• legacy wrappers that delegate to catalog/route modules until callers migrate.

Provider descriptors, model profiles, provider model offerings, capability profiles, and pricing should live in catalog/routing modules or crates, not in config migration code.

Migration Strategy

1. Add focused modules and move schema/loading code first.
2. Keep compatibility wrappers for existing callers.
3. Move provider facts to v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608 catalog descriptors.
4. Move route validation and executable candidate construction to v0.8.65: Resolve every provider/model switch through a ReadyRouteCandidate #3384.
5. Delete obsolete wrappers only after all call sites use the catalog/route APIs.

When editing becomes more confusing than replacing a file, remake the file/module around the new contract and migrate callers/tests. Preserve behavior, migrations, tests, and contributor credit; do not preserve accidental file shape.

Acceptance Criteria

• Config modules separate schema/loading/credentials/paths/user intent from provider/model catalog facts.
• Existing TOML compatibility and env override behavior remain compatible.
• Provider-scoped selections are preserved; no new naked global model state is introduced.
• Existing helper functions either delegate to catalog/route APIs or are marked as temporary legacy wrappers with migration targets.
• Config serde round-trip and migration tests cover all provider variants and custom providers/endpoints.
• No provider route/model compatibility regression.

Verification

cargo test -p codewhale-tui config --locked
cargo test -p codewhale-config --locked
cargo test -p codewhale-tui route_resolver --locked
python3 scripts/check-provider-registry.py

Required tests:

• Config round-trip for direct, hosted aggregator, local runtime, and custom endpoint providers.
• Saved provider-scoped model survives load/save without becoming a global default.
• Custom base URL and custom model id remain provider-scoped.
• Legacy config migrates into the new structures without mutating provider/model semantics.

Related

• v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608 canonical provider/model/offering/catalog architecture.
• v0.8.65: Resolve every provider/model switch through a ReadyRouteCandidate #3384 atomic ReadyRouteCandidate route resolution.
• v0.8.65: Provider descriptors, wire protocol adapters, and conformance tests #3084 provider adapter contracts.
• v0.8.65: Provider-owned live catalogs and secret-free model cache #3385 provider-owned live model catalogs.
• v0.8.65: Provider/offering usage and PricingSku engine with provenance #3085 provider/offering-scoped pricing.