feat(audit): log backend routing decisions and fallback events

src/audit/logger.ts

@@ -19,6 +19,8 @@ import type {
   SessionCheckpointEvent,
   SessionAutoCompactEvent,
   UserActionEvent,
+  BackendRouteEvent,
+  BackendFallbackEvent,
   CronTriggerEvent,
   WebhookReceiveEvent,
   HeartbeatCycleEvent,
@@ -192,6 +194,16 @@ export class AuditLogger {
     this.write({ level: 'info', event_type: 'user.action', event: event as unknown as Record<string, unknown> });
   }
 
+  backendRoute(event: BackendRouteEvent): void {
+    if (!this.shouldLog('sessions', 'info')) {return;}
+    this.write({ level: 'info', event_type: 'backend.route', event: event as unknown as Record<string, unknown> });
+  }
+
+  backendFallback(event: BackendFallbackEvent): void {
+    if (!this.shouldLog('sessions', 'warn')) {return;}
+    this.write({ level: 'warn', event_type: 'backend.fallback', event: event as unknown as Record<string, unknown> });
+  }
+
   sessionTransfer(from: string, to: string, messageCount: number): void {
     if (!this.shouldLog('sessions', 'debug')) {return;}
     this.write({

src/audit/types.ts

@@ -11,6 +11,7 @@ export type AuditEventType =
   | 'skills.installer.execution_blocked' | 'skills.installer.command_result' | 'skills.registry_install'
   // Session lifecycle
   | 'session.create' | 'session.message' | 'session.delete' | 'session.transfer' | 'session.compact' | 'session.checkpoint' | 'session.auto_compact' | 'user.action'
+  | 'backend.route' | 'backend.fallback'
   // Automation - Cron
   | 'cron.trigger' | 'cron.sent' | 'cron.add' | 'cron.remove'
   // Automation - Webhook
@@ -209,6 +210,23 @@ export interface UserActionEvent {
   command?: string;
 }
 
+export interface BackendRouteEvent {
+  session_id: string;
+  channel: string;
+  sender: string;
+  selected_backend: 'native' | 'claude_code' | 'opencode' | 'codex' | 'gemini';
+  source: 'agent_override' | 'default_external' | 'native';
+}
+
+export interface BackendFallbackEvent {
+  session_id: string;
+  channel: string;
+  sender: string;
+  from_backend: 'claude_code' | 'opencode' | 'codex' | 'gemini';
+  to_backend: 'native';
+  reason: string;
+}
+
 export interface CronTriggerEvent {
   job_name: string;
   schedule: string;