feat(control-plane): honor the expanded Admin model waterfall (composed model:effort:fast ids) by lopugit · Pull Request #391 · lopugit/thingtime

lopugit · 2026-08-25T02:36:22Z

What

PR #388 (develop) expanded the Admin AI workflow model waterfall from a closed 3-id list to unlimited composed option ids — <model>[:<effort>][:fast] over a 33-model Claude+OpenAI catalog. Until now, every control-plane loader on this branch failed closed to ["default"] for any such config, so the admin's expanded preference was safely ignored. This PR teaches the control plane the widened grammar without weakening its injection-safety posture.

Grammar (widened but still closed)

jq validation (all three loaders — resolver model_config, the rebase workflow's copy, the all-branch build doctor): unique 1..256 string array, every entry matching ^[a-z0-9][a-z0-9.:-]{0,63}$. An entry can never lead with - or contain a space, so a compromised response still cannot smuggle a CLI flag. Malformed JSON / wrong key / unavailable endpoint fail closed to ["default"] with the existing ::warning:: lines, unchanged.
bash mapping: each entry is re-validated against the same charset, then parsed into base / effort (none|minimal|low|medium|high|xhigh|max|ultra) / fast segments. Duplicate segments, unknown segments, or empty segments (model::x, trailing :) fail the whole mapping closed to [default].
Claude-capable filter: default plus bases re-matched against ^claude-[a-z0-9-]{1,48}$ — the chain is rebuilt from the regex match, never from raw API strings. Other providers' entries (OpenAI ids) are skipped with a log line: they configure those providers' own consumers (e.g. the Codex review backend's repo vars). default is still appended defensively; variants of one base collapse into its single CLI slot; a list with nothing Claude-capable falls back to [default].

Effort now applies (fast is logged)

Claude Code headless supports --effort (verified against the CLI, and this control plane already passed --effort max everywhere). So:

model_args now carries a mandatory --effort <low|medium|high|xhigh|max> — the primary entry's explicit effort, defaulting to max (today's behavior) when the primary has none. Non-CLI tiers on a Claude entry keep max with a note.
The eight fixed --effort max lines (claude_args blocks + exact-session continuations in resolve-pr-conflicts.yml, all-branch.yml, and rebase-conflict-round/action.yml) are removed; the action falls back to --effort max only when its model-args input is empty.
All four downstream MODEL_ARGS regex gates enforce the same widened-but-closed grammar including the --effort tail: ^--model (default|claude-[a-z0-9-]{1,48})( --fallback-model …)? --effort (low|medium|high|xhigh|max)$.
fast has no headless Claude Code flag → logged as recorded-but-not-applied, per the product-side docs.

Graphify primaries

The three PREFERRED_MODEL cases (resolver job, rebase workflow, refresh-promotion-graphify.sh) accept any charset-valid claude-* primary instead of the two hard-coded literals, so a future Claude model flows through with no control-plane edit.

Contracts

workflow-control-plane-contract.mjs and resolve-pr-conflicts-routing-contract.mjs replace the ALLOWED_MODELS includes-loop with pins on the new invariants (charset, effort segment set, Claude base pattern, defensive . + ["default"], --effort $claude_effort in model args). The existing negative pins (no hard-coded model literals, no hard-coded --model, turn budgets) still pass — this change adds no model-name literals anywhere.

Verification

36-case behavioral harness executing the three loaders' run: blocks extracted verbatim from the edited YAML, with a stubbed curl: legacy trio maps unchanged (--model claude-opus-5 --fallback-model claude-fable-5,default --effort max); the real PR feat(admin): unlimited AI model waterfall with full Claude + OpenAI catalog, per-entry effort and fast mode #388 composed config maps to --model claude-opus-5 --fallback-model default,claude-haiku-4-5 --effort high (OpenAI entries skipped, primary effort honored, fast noted); flag injection (--allowedTools=Bash entry), unknown segments, trailing colon, oversized (257) arrays, wrong key, and endpoint-down all fail closed to --model default --effort max; variant dedupe collapses claude-opus-5:xhigh + claude-opus-5:max into one slot keeping xhigh; a future claude-omega-6:low flows through; every emitted model_args passes the downstream gate regex.
Live run of the resolver block against the production endpoint: the currently saved order maps byte-identically to today plus the explicit --effort max.
node .github/scripts/workflow-control-plane-contract.mjs --self-test ✓ and node .github/scripts/resolve-pr-conflicts-routing-contract.mjs --self-test ✓; all four edited YAML files parse.

Rollout notes

Zero behavior change for the currently saved production waterfall.
Backward-compatible in both directions: this control plane accepts legacy bare ids, and the develop app's reads already drop ids it doesn't know.
The product-side TESTING.md bullet describing the old fail-closed behavior flips in a companion develop PR once this merges.

🤖 Generated with Claude Code

PR #388 on develop expanded the Admin AI workflow model waterfall from a closed 3-id list to unlimited composed option ids (`<model>[:<effort>][:fast]`) over a 33-model Claude+OpenAI catalog. Until now every control-plane loader failed closed to ["default"] for any such config, silently ignoring the admin's preference. All three Admin-waterfall loaders (resolver model_config, the rebase workflow's copy, and the all-branch build doctor) now validate the widened-but-still-closed grammar: - jq accepts a unique 1..256 string array whose entries match the closed charset ^[a-z0-9][a-z0-9.:-]{0,63}$ — an entry can never lead with `-` or contain a space, so no CLI flag can be smuggled. - Each entry is re-validated and parsed in bash into base model, effort (none|minimal|low|medium|high|xhigh|max|ultra), and fast segments; duplicate or unknown segments and empty segments fail the whole mapping closed to [default] with the existing warnings. - Claude Code runs Claude-capable entries only: `default` plus bases re-matched against ^claude-[a-z0-9-]{1,48}$ (rebuilt from the match, never interpolated raw). Other providers' entries (OpenAI ids) are skipped with a log line — they configure those providers' own consumers. `default` is still appended defensively, variants of one base collapse into its single CLI slot, and an all-skipped list falls back to [default]. - The primary entry's effort now steers the session: model_args gains a mandatory `--effort <low|medium|high|xhigh|max>` (default max, preserving today's behavior), and the eight fixed `--effort max` lines in claude_args blocks and exact-session continuations are gone. The rebase-conflict-round action falls back to `--effort max` only when no model-args input is supplied. Fast mode has no headless Claude Code flag; it is logged as recorded-but-not-applied. - All four downstream MODEL_ARGS regex gates (three continuation gates in resolve-pr-conflicts.yml plus the action's) enforce the same widened-but-closed grammar including the --effort tail. - Graphify PREFERRED_MODEL cases (resolver, rebase, promotion script) accept any charset-valid claude-* primary instead of two literals. - Both contract self-tests now pin the new invariants (charset, effort segment set, Claude base pattern, defensive default, effort in model_args) and pass. Verified: 36-case behavioral harness executing the extracted loader blocks verbatim (legacy trio unchanged; the real PR #388 composed config maps to `--model claude-opus-5 --fallback-model default,claude-haiku-4-5 --effort high`; injection, malformed-segment, trailing-colon, oversized, wrong-key, and endpoint-down inputs all fail closed; every emitted model_args passes the downstream gate), a live run against the production endpoint (current saved order maps identically plus explicit `--effort max`), YAML parse checks, and both routing/control-plane contract self-tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-08-25T04:38:27Z

Lopu repository review

Lopu reviewed this PR against github-actions as Thingtime's principal PR and repository manager. Using Claude Opus 5.

Lopu found no justified local change to publish from this review pass.

Lopu review — round 4, at the new merged head

Reviewed 2d9a397a against github-actions @ b84a9fc6.

Woken by a conversation comment
(round-3 ack). Since round 3 the head gained two commits — e8bfff82 (my
round-3 assertAdminTransportCap push, which the ack confirms was pulled) and
the merge 2d9a397a, which absorbed +289 lines into
resolve-pr-conflicts.yml from #435's content-addressed Graphify work. The
base also advanced to #437. That merge is the only genuinely new surface on
this head, so it is where I spent the review.

What I compared

b84a9fc6...2d9a397a (merge-base e11ef299) — the PR's own delta: 7 files,
+470/−88, unchanged in shape from what round 3 reviewed.
e8bfff82..2d9a397a — what the merge itself dragged in, to see whether
upstream landed anything the PR's rewrite of effort/model routing had to
absorb.
Live check state via gh pr checks, and the CodeQL snapshot for this head.

Findings

No defects. No changes made.

Checks: all green. 41 checks — 21 pass, 20 skipped, none failing,
cancelled, or timed out. Nothing to diagnose or repair.

CodeQL: zero open alerts on this head (trusted snapshot is []). Nothing
to fix and nothing to dispose; the disposition file is left as [].

The merge is clean, verified mechanically rather than by eye. The
head→base diff is exactly the file-for-file inverse of the three-dot diff
(resolve-pr-conflicts.yml 165/165, all-branch.yml 112/112,
rebase-pr-stacks.yml 110/110, workflow-control-plane-contract.mjs 133/133,
routing contract 11/11, refresh-promotion-graphify.sh 15/15), plus #437's
base-only content. Nothing from either side was dropped in the auto-resolution.

The two ways this merge could have silently broken the PR — both checked,
both clean:

A fifth MODEL_ARGS gate arriving on the old closed grammar. There are
exactly four gates, all carrying the widened pattern including the
--effort tail. The only surviving claude-fable-5/claude-opus-5
literals in the whole of .github/ are two backend_label display arms
with a generic *) fallback — not grammar.
model_config outputs drifting out of sync. The job declares 9 outputs;
the loader emits exactly those 9 keys.

No new or duplicated --effort site appeared: every occurrence in the tree is
either --effort $claude_effort (the three loaders), the action's
empty-input fallback, or a gate regex.

Validation run

All executed in the worktree at 2d9a397a.

Differential harness, 3 loaders × 34 cases, executed not read. The three
run: blocks were extracted verbatim from the edited YAML by indentation
(no ${{ }} interpolation in any of them, so they are pure bash) and run
against a stubbed curl. For every case I checked all three loaders agree and
that the emitted model_args is accepted by the downstream gate regex.

group	result
legacy trio	`--model claude-opus-5 --fallback-model claude-fable-5,default --effort max` — byte-identical to today plus the explicit effort
real #388 composed config	`--model claude-opus-5 --fallback-model default,claude-haiku-4-5 --effort high` (OpenAI skipped, primary effort honored)
future `claude-omega-6:low`	flows through, no control-plane edit
variant dedupe	`:xhigh` + `:max` collapse to one slot, keeping `xhigh`
non-CLI tiers (`none`/`minimal`/`ultra`)	keep the model, pin `--effort max` — documented intent
injection (flag, space, newline, uppercase)	all fail closed to `--model default --effort max`
malformed grammar (`::`, trailing `:`, unknown/duplicate segments)	all fail closed
transport failures (endpoint down, wrong key, `ok:false`, truncated JSON, two top-level values, non-array)	all fail closed
size (256 at the jq cap, 257 over it)	both fail closed, by different gates

Transport-cap boundary is exact in all three copies. Constructed chains
landing on the precise byte:

constructed `model_args`	resolver	rebase	doctor
exactly 2048 chars	passes through, gate accepts	same	same
exactly 2049 chars	collapses to `--model default --effort max` + `::warning::`	same	same

No off-by-one in either direction, and the loaders stay consistent with the
audit gate's <= 2048.

Mutation-tested the pin the ack just pulled — each applied alone, then
reverted:

mutation	result
delete the guard from `all-branch.yml`	caught
widen the rebase copy's cap to 4096	caught
drop `claude_effort="max"` from the resolver fallback body	caught

Repository contract suite: 13/13 pass, including both self-tests the ack
cites. All four edited YAML files parse; bash -n clean on all three loaders
and refresh-promotion-graphify.sh. Worktree verified clean after mutation
testing (git status --porcelain empty).

Answering the open question

The ack asks whether the source= alignment is worth tracking as a tiny
follow-up. It is, and I measured the real scope so it can be written once
rather than twice: it is three stale-on-collapse log signals across two
paths, not two.

Executed evidence:

no-Claude-entries path — logs Model waterfall source: Thingtime admin setting beside a default chain.
transport-cap path — same stale source, and additionally still emits
The primary entry requests fast mode…, because primary_fast is logged
above the cap check and the cap fallback (unlike the other two) does not
reset it.
mapping_failed path — correct (built-in default); useful as the control.

All three are log-only. No output is affected: on every collapse path
model_args, primary_model, and backend_label are all correctly
default, and the ::warning:: makes the collapse discoverable. The
assessment that this is cosmetic holds — and so does the judgment that
half-fixing it would preserve the inconsistency.

I made no change for this, deliberately. It was explicitly ruled out of
this PR by the author, and it is out of scope for a fix pushed to this head.

Verdict

Ready to merge. No defect found on this head, no worktree change made, no
CodeQL disposition written.

View Lopu workflow run

github-actions · 2026-08-25T10:09:03Z