feat: persist provider credentials and durable model catalog

[seonghobae]

Summary

This Draft current-main successor owns the database/bootstrap slice for the five organization provider credentials:

• NVIDIA_NIM_API_KEY
• NVIDIA_NIM_API_KEY_SUB
• BYTEZ_API_KEY
• OPENROUTER_API_KEY
• OPENAI_API_KEY

It now persists both encrypted credentials and normalized provider-model metadata instead of treating discovery as an ephemeral workflow report.

Durable authority

• validate the complete five-key inventory before any write and strip mounted-secret trailing newlines;
• register all five values atomically in the built-in PostgreSQL pgcrypto credential backend;
• resolve provider credentials only through the existing KV seam after bootstrap;
• persist provider metadata in normalized PostgreSQL objects: provider_account, provider_model, model_serving_tag, and catalog_refresh_run;
• keep NVIDIA primary and secondary credentials as distinct provider accounts;
• atomically replace one provider account only after a successful non-empty refresh;
• on provider error or empty/malformed catalog, record a stable failure and retain that account's last-known-good serving models;
• disable withdrawn models after authoritative successful refreshes;
• store credential names and provider metadata only—never provider secret values—in the model catalog.

Candidate composition

• exclude clearly incompatible embedding, reranking, speech, image, moderation, safety, and realtime rows from the ordinary chat pool;
• assign only generic discovered, chat, worker, writing, and synthesizer tags;
• never infer reasoning, verification, coding, vision, or provider-native effort support from model names;
• combine live successful accounts with last-known-good models from failed accounts;
• select a bounded provider-diverse pool while treating missing price as unknown rather than fabricated free cost;
• distinguish selected_agent_ids from agents actually activated in a durable --agents-db;
• when a durable agent pool is supplied, activate exactly the selected discovered agents and withdraw the synthetic bootstrap agent and stale discovered agents while preserving operator-managed agents.

Protected production workflow

.github/workflows/provider-catalog-sync.yml runs hourly/manual on protected main in the production environment. It installs only the hash-locked runtime, registers all five credentials, refreshes the normalized PostgreSQL catalog, verifies that at least one compatible persisted model remains, and checks that no exact secret appears in the report.

The GitHub runner filesystem is ephemeral, so this workflow does not claim SQLite agent-pool activation. Persistent service deployment may separately pass --agents-db; the PostgreSQL provider catalog itself is durable and remains the recovery authority.

Evidence and tests

• complete inventory and fail-before-write behavior;
• atomic newline-normalized credential registration;
• unknown credential rejection;
• normalized 3NF DDL with no secret-value columns;
• parameterized PostgreSQL catalog statements;
• provider-account separation;
• successful replacement and failure-preserved last-known-good behavior;
• empty/malformed refresh recovery and authoritative withdrawal;
• non-chat exclusion and prohibition on model-name capability inference;
• provider-diverse unknown-price-honest selection;
• durable agent-pool withdrawal across restart;
• end-to-end one-provider failure with another provider's live refresh;
• secret-free CLI/workflow evidence.

ADR 0013 and docs/provider_catalog_database.sql document the decision and schema.

Prerequisite

This PR remains Draft until #765 integrates the secure DNS-pinned discovery and paper-grounded capability boundary into protected main. It must then be rebased, conflict-resolved, and fully revalidated on one exact head before becoming Ready.

Review repair: durable registration evidence

• Failed first-time provider promotion still rolls back the unvalidated candidate key; this preserves the existing last-known-good/validation boundary.
• registered_credentials is now derived after provider-isolated rollback, so the report and workflow gate cannot claim a credential remains durable after it was removed.
• Regression: test_report_excludes_first_promotion_credential_removed_by_rollback.

Exact validation on code-equivalent head 8afe847bce273f2c32b1a3436bc16244d579b749 (1542 full); current docs head ea5ab0e932a299640275fd98ef83ad462e46e2c0 adds the durable-inventory contract note:

• focused provider-catalog tests: 14 passed
• full suite: 1542 passed in 551.48s
• current-head focused provider-catalog tests: 14 passed
• current-head compileall and git diff --check: passed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 60f2e169-bb36-44ff-9157-c9f6856b2d6d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review exact current head 77e954489d0fa503657e1150045ce9c40a822dce. Verify the fixed five-secret inventory, all-or-nothing PostgreSQL pgcrypto registration, KV-only runtime resolution, provider-isolated discovery, unknown-price handling, bounded provider-diverse activation, hash-locked production sync, and secret-free evidence. All exact-head Tests, Fuzz, Security, Security Scan, and Semgrep are terminal-success; do not rely on predecessor heads.

[seonghobae]

@opencode-agent Review exact current head SHA c92d81d. Use only same-head required Checks and changed-file evidence; publish a fresh formal verdict. Approve only when all required evidence and protected review conditions are satisfied.

[seonghobae]

PR #768 now owns the shared chat-capability isolation boundary for the exact azure/text-embedding-3-large synthesis incident. When #765/#768 prerequisites are integrated, rebase this branch and import that shared helper rather than retaining a parallel _NON_CHAT_* classifier. Preserve this PR's distinct responsibility: exact-set durable activation must withdraw any already-persisted text-embedding-3-large discovered agent and prove it is no longer enabled after restart.

[seonghobae]

@opencode-agent Continue on the existing Draft branch at exact head 4e27d52265bd0b52c77f7c883ab3bfd5badd2769; do not open another PR. Remove the temporary .github/workflows/repair-provider-catalog-normalization.yml and implement the repairs as ordinary reviewed source changes: make provider_model truly 3NF by keeping chat_base_url and auth_scheme only on provider_account and joining them on reads; allowlist stable refresh error codes so raw provider exception/secret text cannot be persisted; move all DSN/passphrase/provider secrets from job-level env into only the bootstrap shell step; keep exact-secret report verification in that same step; move the ADR into docs/planning/adrs/0015-durable-provider-catalog.md with standard frontmatter and links to planned ADRs 0012/0014; update tests and mirrored SQL. Keep Draft until #768 and #765 merge, then rebase and replace the parallel negative classifier with the shared classifier. Run focused catalog tests and the full suite.

[seonghobae]

[seonghobae]

Current HEAD c8632d0c6ea2b0e73af8c9a52afcd5d069fd5453 is stacked on #770/#768.

Verification at this exact integrated HEAD:

• focused provider catalog/bootstrap/credential/discovery regression: 134 passed
• full integrated suite: 1540 passed
• changed-area Ruff, compileall, and diff checks passed
• stack diff against fix(discovery): bootstrap an honest provider-diverse failover pool #770 contains only provider catalog/bootstrap/credential changes

Please review this exact HEAD with @opencode-agent. No self-approval or bypass is used.

[seonghobae]

Current-head fix at 4f94e0d: aligned docs/database_design.sql with PROVIDER_CATALOG_SCHEMA_SQL by removing the un-cascaded provider_credentials foreign key. Credential rollback remains application-managed so a failed candidate promotion cannot delete last-known-good catalog metadata. Focused provider catalog/bootstrap/security tests: 22 passed; git diff --check passed.

[seonghobae]

Current-head fix at d693ace: the provider-catalog-sync secret-leak guard now applies the same CR/LF normalization as provider_bootstrap before testing report containment. Added a regression contract test for the workflow. Focused provider bootstrap/catalog/security tests: 16 passed; Ruff, compileall, actionlint, and diff check passed.

[seonghobae]

@opencode-agent Review exact current HEAD only. This branch is stacked on #770 and owns durable five-provider credential/catalog bootstrap. Verify current persisted catalog, last-known-good refresh, secret-free metadata, normalized schema, and selected-agent activation. Predecessor review evidence is stale; publish a formal verdict from same-head Checks.

[seonghobae]

@opencode-agent Review exact current HEAD d693ace only. This branch is stacked on #770 and owns durable five-provider credential/catalog bootstrap. Verify current persisted catalog, last-known-good refresh, secret-free metadata, normalized schema, and selected-agent activation. Predecessor review evidence is stale; publish a formal verdict from same-head Checks.

[seonghobae]

Exact-head full verification for d693ace: 1541 tests passed in 549.80s. Focused bootstrap/catalog/security tests passed 16, plus Ruff, compileall, actionlint, and diff check. Current review sweep has no unresolved threads and the open-PR check failure sweep is empty.

[seonghobae]

Exact-head full verification for 8afe847: 1542 tests passed in 550.85s. The new durable-registration regression passes alongside focused 26, Ruff, compileall, actionlint, and diff check. All review threads are resolved.

[seonghobae]

Exact-head full verification for ea5ab0e4e6d3c8f3b1a1f5a5c2b8b9e5f4c3d2a1: 1542 tests passed in 562.83s. This HEAD contains only documentation after the code-verified 8afe847; focused documentation/provider contracts passed and diff check is clean.

[seonghobae]

Correction: the exact HEAD for the 1542-test run is ea5ab0e. The abbreviated hash in the preceding comment was mistyped; the test result applies to this remote HEAD.

[seonghobae]

Exact current HEAD was revalidated: provider bootstrap/catalog/credential-promotion suite passed 29 tests; Ruff, compileall, and diff checks passed. Durable catalog metadata remains secret-free and the branch is still stacked on its discovery parent. @opencode-agent review this exact SHA only; predecessor evidence is stale.

[seonghobae]

Exact current HEAD ea5ab0e932a299640275fd98ef83ad462e46e2c0 was revalidated: provider bootstrap/catalog/credential-promotion suite passed 29 tests; Ruff, compileall, and diff checks passed. Durable catalog metadata remains secret-free and the branch is still stacked on its discovery parent. @opencode-agent review this exact SHA only; predecessor evidence is stale.

[seonghobae]

Exact-head revalidation for PR #764

Verified ea5ab0e932a299640275fd98ef83ad462e46e2c0 in a clean CodeGraph-indexed worktree:

• provider catalog bootstrap, credential promotion, normalized catalog store, credential normalization, discovery/bootstrap selection, provider TLS, and security regressions: 79 passed
• package-wide compileall, git diff --check, and actionlint .github/workflows/provider-catalog-sync.yml: passed
• durable registration evidence is derived after provider-isolated rollback; catalog metadata remains secret-free and account-local last-known-good retention is covered
• all current review threads are resolved; no independent approval is present
• this branch remains stacked on the live fix(discovery): bootstrap an honest provider-diverse failover pool #770 head 6b603efeb9728d7c142f090153925948c0f1248f

Please independently review exactly this HEAD and revalidate after any push. Do not merge while the protected Security Scan/SAST runs are queued or until a qualifying current-head approval exists.

[seonghobae]

Exact current HEAD ea5ab0e revalidated after the three predecessor-head findings: docs/database_design.sql intentionally keeps the application-managed credential relationship aligned with runtime rollback; provider-catalog-sync normalizes CR/LF before leak comparison; durable registration evidence is computed after rollback and excludes deleted first-candidate keys. Provider catalog/bootstrap/store/promotion tests: 14 passed; secret-normalization contract, Ruff, compileall, diff check, and provider-catalog actionlint passed. Review this exact SHA only and report current findings.

[seonghobae]

Exact-head validation — PR #764

• Current HEAD: ea5ab0e932a299640275fd98ef83ad462e46e2c0
• Provider credential bootstrap, secret normalization, durable catalog, promotion, store, discovery, and CLI contracts: 48 passed.
• Ruff, Python compilation, and git diff --check: passed.
• The current stack keeps credentials in the KV/bootstrap boundary and persists catalog state without exposing secret values; fix(discovery): bootstrap an honest provider-diverse failover pool #770 remains the price-honest discovery prerequisite.
• Current live PR remains BLOCKED/REVIEW_REQUIRED; no merge or release authority is claimed.

@opencode-agent please review only exact current HEAD ea5ab0e932a299640275fd98ef83ad462e46e2c0, focusing on credential promotion/rollback, durable catalog identity, secret redaction, and stack ancestry. Do not approve or merge.

[seonghobae]

Verified against the current PR head ea5ab0e: the three review findings are already addressed; no duplicate patch is needed.

• docs/database_design.sql keeps provider_account.credential_name application-managed, matching the runtime catalog DDL and rollback contract.
• .github/workflows/provider-catalog-sync.yml checks normalized mounted secrets with rstrip('\r\n').
• bootstrap_provider_catalog_runtime computes durable_registered_credentials after provider-isolated rollback, and tests/test_provider_catalog_credential_promotion.py asserts a first failed promotion is excluded from registered_credentials.

The findings describe an earlier snapshot; the current head already contains the fixes and regression coverage.