feat(providers): dev-only hand-pricing reconciler vs models.dev (Tier-2 T6)

The generator's --check guards only the *generated* fallback catalog. The
small hand-maintained PRICING table Chimera actually bills had no drift guard
and is the one that silently goes stale. scripts/audit_model_pricing.py
reconciles PRICING against the public models.dev catalog and reports where a
billed rate diverges from the first-party figure.

Report-only by design: hand corrections always win over upstream, so it never
rewrites a price. Exits non-zero on drift (CI-able) but is intentionally NOT
wired into ci.yml. Default run is offline (committed model_catalog.py snapshot,
no network) and high-signal (first-party comparison only; reseller markups are
surfaced separately, --include-resellers opts in); --live fetches models.dev
via the generator's stdlib urllib path; --json for machine consumption.

Override convention: a new PRICING_OVERRIDES frozenset in cost.py marks the
prefixes whose divergence from upstream is deliberate (GLM / DeepSeek-SKU
placeholders, cross-endpoint billing nuances, local / open-weight $0 families).
The audit skips them; membership does NOT affect runtime resolution (the hand
table still always wins).

Caught a real in-repo drift on the first run: deepseek-chat ($0.27/$1.10) and
deepseek-reasoner ($0.55/$2.19) disagree with first-party models.dev
($0.14/$0.28).

Dev-only: zero new runtime dependency; nothing under chimera/ imports the
script. Tests reconcile over fixtures (no network) plus a network-free canary
on the committed snapshot. Guide: model-catalog.md (Auditing the hand table).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 0bserver07

CHANGELOG.md

@@ -9,6 +9,33 @@ commit receipts.
 
 ### Added
 
+- **Hand-pricing reconciler — a dev-only drift audit for the billed-price
+  table** (Tier-2 T6): `scripts/audit_model_pricing.py` reconciles the
+  hand-maintained `chimera.providers.cost.PRICING` table against the public
+  models.dev catalog and reports where a billed rate has silently gone stale.
+  It complements the generator's existing `--check`, which guards only the
+  *generated* fallback catalog (`model_catalog.py`) — the small hand table
+  Chimera actually bills had no such guard. **Report-only by design**: hand
+  corrections always win over upstream, so it never rewrites a price; it exits
+  non-zero on drift (CI-able) but is intentionally **not** wired into CI. The
+  default run is offline (reconciles against the committed `model_catalog.py`
+  snapshot, no network) and high-signal — it compares only against
+  **first-party** manufacturer figures, since a hand rate disagreeing with a
+  reseller's markup is margin, not drift; reseller-only ids are surfaced
+  separately (`--include-resellers` opts in). `--live` fetches models.dev via
+  the generator's stdlib `urllib` path; `--json` emits a machine-readable
+  report. The **override convention** is a new `PRICING_OVERRIDES` frozenset in
+  `cost.py` marking prefixes whose divergence from upstream is deliberate
+  (GLM / DeepSeek-SKU placeholders, cross-endpoint billing nuances, local /
+  open-weight `$0` families) — the audit skips them, and membership does **not**
+  affect runtime resolution (the hand table still always wins). It caught a real
+  in-repo drift on the first run: the DeepSeek hand rates (`deepseek-chat`
+  $0.27/$1.10, `deepseek-reasoner` $0.55/$2.19) disagree with the first-party
+  models.dev figure ($0.14/$0.28). Dev-only: **zero new runtime dependency**,
+  and nothing under `chimera/` imports the script. Guide:
+  `site/src/content/docs/guides/model-catalog.md` (new *Auditing the hand table*
+  section).
+
 - **Inline mode — the single-agent transcript in the terminal's native
   scrollback** (R-VIEW-5, opt-in): `chimera code --tui --inline` (or
   `[tui] inline = true`) renders the daily driver's committed transcript into

chimera/providers/cost.py

@@ -106,6 +106,36 @@
     "gemma3-27b-instruct": (0.0, 0.0),
 }
 
+# Prefixes in :data:`PRICING` whose hand rate DELIBERATELY diverges from the
+# public models.dev figure and must never be "corrected" toward upstream. Each
+# is a conscious override, for one of three reasons documented inline above:
+#
+#   * a **placeholder** pending a vendor's public rate sheet (the GLM family,
+#     the DeepSeek V3.1/coder/V4 SKUs, the Kimi preview line);
+#   * a **cross-endpoint billing nuance** upstream can't express (a model whose
+#     true billing depends on which endpoint or local bridge served it);
+#   * a **local / open-weight** family billed at ``$0`` because the serving
+#     daemon surfaces no price field.
+#
+# This is the marker convention consumed by the dev-only reconciler
+# ``scripts/audit_model_pricing.py``: it skips these prefixes so an intentional
+# divergence is never reported as drift, while still flagging a hand rate that
+# has silently gone stale. Membership does **not** affect runtime resolution —
+# :func:`get_model_pricing` always prefers the hand table regardless; hand
+# corrections always win. Removing a prefix here re-arms the audit for it.
+PRICING_OVERRIDES: frozenset[str] = frozenset({
+    # GLM — placeholders + z.ai-vs-Ollama-bridge billing nuance.
+    "glm-5.2", "glm-5.1", "glm-5", "glm-4.6", "glm-4-plus", "glm-4-flash",
+    # DeepSeek V3.1 / coder / V4 — explicit placeholders pending per-SKU rates.
+    "deepseek-v3.1-terminus", "deepseek-coder-v3",
+    "deepseek-v4-pro:cloud", "deepseek-v4-pro", "deepseek-v4",
+    # Kimi (Moonshot) — $0.6/$2.5 placeholder pending per-SKU rates.
+    "kimi-k2-0905-preview", "kimi-k2.5",
+    # Local / open-weight — billed $0 (no price field on the serving daemon).
+    "qwen3-coder-30b", "qwen3-coder", "qwen3-32b",
+    "gpt-oss-120b", "gpt-oss-20b", "mistral-codestral-2511", "gemma3-27b-instruct",
+})
+
 _pricing_lock = threading.Lock()
 
 # --- Generated-catalog fallback -------------------------------------------