fix: AQE project-scope and route projections make ak sync report permanent drift

[adrianco]

Summary

ak sync can report success while leaving AQE configuration warnings that it
cannot resolve. The writer and status checker use different project-scope and
routing projections.

Defect 1: non-Git directories never converge

applyAqeRouter() resolves paths.repoRoot(cwd) and returns not a project — aqe router unmanaged when there is no Git root. The status path nevertheless
expects the project-scoped router file and reports provider/router drift on
every run.

Expected: outside a Git project, either do not report project-router drift or
offer/use an explicit supported project root. ak sync should not report
convergence while leaving an actionable warning it cannot repair.

Defect 2: writer and status checker disagree on agent overrides

In a Git project with dual-host activity routing:

• applyAqeRouter() writes
  configuredPolicyToAgentOverrides(policy), intentionally projecting only
  explicitly persisted routes.
• status.mjs compares disk state to policyToAgentOverrides(policy), which
  calls resolveRoutes() and fills omitted routes from defaults.

Status therefore expects override entries that sync deliberately never writes,
so it reports llm-config.json out of sync after a successful sync.

Expected: status and writer must compare the same projection. The minimal fix
is to use configuredPolicyToAgentOverrides() for the status comparison.

Impact

These warnings make a healthy AQE setup look broken and instruct users to run
a sync that cannot resolve the reported drift. They also obscure real provider
or routing drift.

Related

• Surface ruflo dual-mode role delegation + agentic-qe agent-type routing in ak's provider UX #36: broader AQE agent-type routing feature
• aqe fallback chain is never credential-checked — ak writes and reports dead rungs as healthy #54: fallback credential viability
• x provider pick: excluding a routing host (codex) leaves seeded routes, agentOverrides, and MCP bridges live — one disable semantics for all hosts #73: stale overrides when disabling a host

This report is distinct: it concerns a status/write projection mismatch during
normal setup and sync.

[pacphi]

Verified both defects against main with executable repros — excellent report, every claim held up.

• Defect 1: reproduced live. From a non-git directory, ak status emits both ⚠ providers … drifted → sync re-applies provider env + aqe router and ⚠ routing … llm-config.json out of sync → sync re-applies agentOverrides, while applyAqeRouter returns ok, unchanged, "not a project — aqe router unmanaged" — which sync doesn't even print, so sync looks fully successful. The chain check additionally reads the file at raw cwd (no repoRoot walk at all), so it also false-warned from any subdirectory of a real project.
• Defect 2: reproduced deterministically. With a single-route policy, policyToAgentOverrides (status) demands 12 override entries while configuredPolicyToAgentOverrides (writer) emits 0 — permanent out of sync immediately after a flawless sync. A second axis beyond holes: resolveRoutes substitutes retired models, so a user pin on gpt-5.4 drifts forever (status wants gpt-5.6-terra; sync honors the pin, deliberately).

Two more latent false-drift bugs of the same class, found while verifying — the whole-object JSON.stringify comparison also false-warns on:

1. foreign agentOverrides entries (aqe's own defaults or a hand-added agent), which the writer deliberately preserves via merge; and
2. JSON key order, which the writer's merge-don't-replace can permute even when every value matches.

Fix in #133 takes your suggested minimal shape, status-side only: same repoRoot scope gate as the writer (routing row becomes info outside a project; chain check anchored at the root), same configured projection, and a key-wise comparison restricted to ak-managed agent keys — with regression tests covering all four axes plus guards that genuine drift (hand-edited managed entry, missing file in a managed project) still warns.