Add validated Pi provider catalog contract

allod-agent commented

2026-08-21 03:03:27 +01:00

Member

This adds the public, data-only contract for custom Pi provider metadata.
The checked-in catalog is empty, so this PR changes no running machine.
Consumers receive one normalized and consumption-time-validated export.
The named check accepts a complete synthetic provider and independently rejects invalid endpoint and empty-name sabotage.
If the contract is wrong, revert this PR before dependent slices are pinned.

What changes

Add the empty pi-providers.json catalog owned by profiles.
Export validated, normalized data as lib.piProviders.
Default an omitted provider api to openai-completions.
Reject unsupported fields, unsafe endpoint URLs, invalid provider IDs, invalid field types, empty model sets, duplicate model IDs, and empty model names.
Document the public/private ownership boundary and catalog shape.

Risk

R3 contract slice: later secrets and archetypes changes consume this cross-repository interface. This PR carries no credentials, targets, recipient keys, or live provider values, and the empty catalog has no generated runtime effect.

Validation

nix eval .#lib.piProviders --json
nix build .#checks.x86_64-linux.pi-provider-catalog --print-build-logs --no-link
nix build .#checks.x86_64-linux.profile-contract-shape --print-build-logs --no-link
nix flake check -L
git diff --check origin/master...HEAD

The Pi catalog check forces the committed export, validates a full synthetic provider including default normalization, and proves the same production validator independently rejects a malformed endpoint port and an explicitly empty model name.

Refs allod/strategy#34

This adds the public, data-only contract for custom Pi provider metadata. The checked-in catalog is empty, so this PR changes no running machine. Consumers receive one normalized and consumption-time-validated export. The named check accepts a complete synthetic provider and independently rejects invalid endpoint and empty-name sabotage. If the contract is wrong, revert this PR before dependent slices are pinned. ## What changes - Add the empty `pi-providers.json` catalog owned by profiles. - Export validated, normalized data as `lib.piProviders`. - Default an omitted provider `api` to `openai-completions`. - Reject unsupported fields, unsafe endpoint URLs, invalid provider IDs, invalid field types, empty model sets, duplicate model IDs, and empty model names. - Document the public/private ownership boundary and catalog shape. ## Risk R3 contract slice: later secrets and archetypes changes consume this cross-repository interface. This PR carries no credentials, targets, recipient keys, or live provider values, and the empty catalog has no generated runtime effect. ## Validation - `nix eval .#lib.piProviders --json` - `nix build .#checks.x86_64-linux.pi-provider-catalog --print-build-logs --no-link` - `nix build .#checks.x86_64-linux.profile-contract-shape --print-build-logs --no-link` - `nix flake check -L` - `git diff --check origin/master...HEAD` The Pi catalog check forces the committed export, validates a full synthetic provider including default normalization, and proves the same production validator independently rejects a malformed endpoint port and an explicitly empty model name. Refs allod/strategy#34

allod-agent added 1 commit

2026-08-21 03:03:27 +01:00

Add validated Pi provider catalog contract f890d1b04e

allod-agent commented

2026-08-21 03:07:55 +01:00

Author

Member

Implementation review found two medium contract defects in f890d1b:

The endpoint regex accepts malformed authorities such as https://: and non-numeric ports, and POSIX whitespace matching does not reject every raw Unicode whitespace character.
The validator adds value constraints not stated by the approved contract: non-empty name and positive maxTokens, instead of checking their declared string/integer types.

I will tighten the URL grammar to an ASCII HTTPS authority/path and relax those two optional fields to type-only validation, then extend the existing valid/sabotage witness through the same production validator.

Implementation review found two medium contract defects in `f890d1b`: - The endpoint regex accepts malformed authorities such as `https://:` and non-numeric ports, and POSIX whitespace matching does not reject every raw Unicode whitespace character. - The validator adds value constraints not stated by the approved contract: non-empty `name` and positive `maxTokens`, instead of checking their declared string/integer types. I will tighten the URL grammar to an ASCII HTTPS authority/path and relax those two optional fields to type-only validation, then extend the existing valid/sabotage witness through the same production validator.

allod-agent added 1 commit

2026-08-21 03:09:36 +01:00

Tighten Pi provider catalog contract 3341a7fc15

allod-agent commented

2026-08-21 03:09:48 +01:00

Author

Member

Addressed both review findings in 3341a7f:

HTTPS endpoints now use an ASCII authority/path grammar with a hostname or bracketed address and an optional numeric port. The sabotage witness now independently rejects a malformed non-numeric port, instead of relying on an unrelated unknown field.
Optional model name and maxTokens now enforce only their approved string/integer types. The valid synthetic fixture exercises the empty-string and zero boundaries.

Revalidated:

nix eval .#lib.piProviders --json
nix build .#checks.x86_64-linux.pi-provider-catalog --print-build-logs
nix build .#checks.x86_64-linux.profile-contract-shape --print-build-logs
git diff --check origin/master...HEAD

Addressed both review findings in `3341a7f`: - HTTPS endpoints now use an ASCII authority/path grammar with a hostname or bracketed address and an optional numeric port. The sabotage witness now independently rejects a malformed non-numeric port, instead of relying on an unrelated unknown field. - Optional model `name` and `maxTokens` now enforce only their approved string/integer types. The valid synthetic fixture exercises the empty-string and zero boundaries. Revalidated: - `nix eval .#lib.piProviders --json` - `nix build .#checks.x86_64-linux.pi-provider-catalog --print-build-logs` - `nix build .#checks.x86_64-linux.profile-contract-shape --print-build-logs` - `git diff --check origin/master...HEAD`

allod-agent referenced this pull request from allod/nexus

2026-08-21 03:24:51 +01:00

Add recoverable Pi provider lifecycle command #26

allod-agent referenced this pull request from allod/archetypes

2026-08-21 03:48:36 +01:00

Add managed Pi provider reconciliation #44

allod-agent commented

2026-08-21 04:05:41 +01:00

Author

Member

Cross-repository review found one medium compatibility defect at 3341a7f: flake.nix accepts models[].name = "", and the positive fixture explicitly depends on that boundary, while Pi 0.84.2's loaded model schema requires a non-empty name. The archetypes consumer projects the catalog value unchanged, so this catalog can pass profiles validation and then fail when Pi loads the generated configuration.

The fix is to keep name optional but require a non-empty string when present, replace the positive empty-name fixture, and add a dedicated empty-name sabotage witness through the production validator so an unrelated invalid field cannot mask a regression.

Cross-repository review found one medium compatibility defect at `3341a7f`: `flake.nix` accepts `models[].name = ""`, and the positive fixture explicitly depends on that boundary, while Pi 0.84.2's loaded model schema requires a non-empty name. The archetypes consumer projects the catalog value unchanged, so this catalog can pass profiles validation and then fail when Pi loads the generated configuration. The fix is to keep `name` optional but require a non-empty string when present, replace the positive empty-name fixture, and add a dedicated empty-name sabotage witness through the production validator so an unrelated invalid field cannot mask a regression.

allod-agent added 1 commit

2026-08-21 04:06:29 +01:00

Require non-empty Pi model names 9d48e438d1

allod-agent commented

2026-08-21 04:07:07 +01:00

Author

Member

Resolved in 9d48e43.

Optional models[].name now rejects the empty string with a contract-specific error while remaining optional.
The positive fixture uses a Pi-loadable non-empty name.
A dedicated empty-name fixture passes through validatePiProviders and must fail independently of the existing malformed-endpoint sabotage.
README contract text and the PR validation description now match the consumer schema.

Revalidated with nix eval .#lib.piProviders --json, both named check builds, nix flake check -L, and git diff --check origin/master...HEAD.

Resolved in `9d48e43`. - Optional `models[].name` now rejects the empty string with a contract-specific error while remaining optional. - The positive fixture uses a Pi-loadable non-empty name. - A dedicated empty-name fixture passes through `validatePiProviders` and must fail independently of the existing malformed-endpoint sabotage. - README contract text and the PR validation description now match the consumer schema. Revalidated with `nix eval .#lib.piProviders --json`, both named check builds, `nix flake check -L`, and `git diff --check origin/master...HEAD`.

allod-agent referenced this pull request from allod/deploy

2026-08-21 04:19:21 +01:00

Compose managed Pi provider lifecycle #4

vnprc merged commit 9d48e438d1 into master

2026-08-22 04:16:07 +01:00

vnprc deleted branch agent/pi-provider-catalog

2026-08-22 04:16:07 +01:00

Rows
Columns

Add validated Pi provider catalog contract #6

What changes

Risk

Validation