@miller-tech/uap 2.11.0 → 2.16.2

package/tools/agents/tests/test_confidence_escalation.py

@@ -372,8 +372,9 @@ class SlotRightSizingTest(unittest.TestCase):
     """
 
     def test_unknown_width_changes_nothing(self):
-        # Not every backend can be probed (ninfer serves no /slots), so silence
-        # is not evidence -- unknown width must leave behaviour identical.
+        # Not every backend can be probed -- some engines serve no /slots, and a
+        # probe can fail -- so silence is not evidence: unknown width must leave
+        # behaviour identical.
         self.assertEqual(ce.select_recipe(body(), S(recipe="fusion"), False), "fusion")
 
     def test_single_slot_downgrades_explicit_fusion(self):

package/tools/agents/tests/test_count_tokens_scale_per_session.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""Compaction forcing must be computed against the SESSION's window, not the rail.
+
+Regression (2026-09-20). The local server moved to `-np 2 -c 229376` with
+`--kv-unified`, which makes 229376 a SHARED pool: /slots reports it for both
+slots and either rail may address all of it. Sessions are therefore capped
+below the detected rail by a model profile's `context_window`.
+
+`_count_tokens_scale()` resolved its window from `_effective_context_window()`
+— the process-wide value detected from /slots — so the two numbers disagreed
+and only one of them actually bounded the session:
+
+    detected rail   229376
+    profile cap     114688   <- the real bound
+    compact fires   123060   computed from the RAIL, so ABOVE the cap
+    prune fires      80282   computed from the CAP
+
+Compaction became unreachable and the pruner permanently replaced it. Those
+are not equivalent: compaction writes an LLM summary, a prune drops the
+messages and leaves a breadcrumb list. The proxy env's own comment states the
+intent — "land compaction just under the pruner trigger so the client compacts
+before the proxy ever prunes (pruner = backstop only)".
+"""
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+PROXY = _load_proxy_module()
+
+# The live geometry this regression came from.
+SHARED_POOL = 229_376
+SESSION_CAP = 114_688
+
+
+class CountTokensScalePerSession(unittest.TestCase):
+    def setUp(self):
+        self._saved = (
+            PROXY.PROXY_COUNT_TOKENS_SCALE,
+            PROXY.PROXY_CLIENT_ASSUMED_WINDOW,
+            PROXY.PROXY_COMPACT_TARGET_FRACTION,
+            PROXY.default_context_window,
+        )
+        PROXY.PROXY_COUNT_TOKENS_SCALE = "auto"
+        PROXY.PROXY_CLIENT_ASSUMED_WINDOW = 200_000
+        PROXY.PROXY_COMPACT_TARGET_FRACTION = 0.58
+        # The process default is the whole shared pool, as /slots reports it.
+        PROXY.default_context_window = SHARED_POOL
+
+    def tearDown(self):
+        (
+            PROXY.PROXY_COUNT_TOKENS_SCALE,
+            PROXY.PROXY_CLIENT_ASSUMED_WINDOW,
+            PROXY.PROXY_COMPACT_TARGET_FRACTION,
+            PROXY.default_context_window,
+        ) = self._saved
+        PROXY.session_monitors.clear()
+
+    def _compact_trigger(self, scale: float) -> float:
+        """Real tokens at which the client's auto-compact fires."""
+        return PROXY.PROXY_CLIENT_ASSUMED_WINDOW * 0.925 / scale
+
+    def test_override_uses_the_session_window_not_the_pool(self):
+        scale = PROXY._count_tokens_scale(SESSION_CAP)
+        pool_scale = PROXY._count_tokens_scale(0)
+        self.assertGreater(
+            scale, pool_scale,
+            "a capped session must be scaled harder than the shared pool",
+        )
+
+    def test_compaction_fires_before_the_pruner_for_a_capped_session(self):
+        """The whole point: compact must precede prune, or prune is all there is."""
+        scale = PROXY._count_tokens_scale(SESSION_CAP)
+        compact_at = self._compact_trigger(scale)
+        prune_at = SESSION_CAP * PROXY.PROXY_CONTEXT_PRUNE_THRESHOLD
+        self.assertLess(
+            compact_at, prune_at,
+            f"compaction at {compact_at:,.0f} must fire before the pruner at "
+            f"{prune_at:,.0f}; the pruner is a backstop, not the mechanism",
+        )
+
+    def test_the_unfixed_behaviour_would_be_unreachable(self):
+        """Pin the bug itself, so a revert to the pool-wide window is loud."""
+        pool_scale = PROXY._count_tokens_scale(0)   # resolves the shared pool
+        compact_at = self._compact_trigger(pool_scale)
+        self.assertGreater(
+            compact_at, SESSION_CAP,
+            "sanity: computed from the pool, the compact point IS above the "
+            "session cap — this is the condition the fix exists to avoid",
+        )
+
+    def test_session_window_is_picked_up_from_the_request_contextvar(self):
+        """Paths with no explicit override still resolve the session's window."""
+        sid = "test-session-capped"
+        monitor = PROXY.SessionMonitor(context_window=SESSION_CAP)
+        PROXY.session_monitors[sid] = monitor
+        token = PROXY._current_request_session.set(sid)
+        try:
+            self.assertEqual(PROXY._scale_window(), SESSION_CAP)
+            scale = PROXY._count_tokens_scale()
+            compact_at = self._compact_trigger(scale)
+            self.assertLess(compact_at, SESSION_CAP * PROXY.PROXY_CONTEXT_PRUNE_THRESHOLD)
+        finally:
+            PROXY._current_request_session.reset(token)
+
+    def test_falls_back_to_the_process_window_with_no_session(self):
+        PROXY.session_monitors.clear()
+        self.assertEqual(PROXY._scale_window(), SHARED_POOL)
+
+    def test_scale_stays_disabled_when_turned_off(self):
+        PROXY.PROXY_COUNT_TOKENS_SCALE = "off"
+        self.assertEqual(PROXY._count_tokens_scale(SESSION_CAP), 1.0)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_expert_review_pr_scope.py

@@ -207,9 +207,8 @@ class TestShipDetectionIsCommandPosition(unittest.TestCase):
     review artifact was refused because the notes described the bug being fixed.
 
     The risk in the fix is UNDER-detection, so the ship cases below matter more
-    than the prose ones. The wrapper cases especially: rtk is no longer
-    integrated in UAP, but the binary can still exist on operator machines, so
-    a verb check that stopped at the wrapper would miss wrapped ship commands.
+    than the prose ones. The wrapper cases especially: a verb check that
+    stopped at the wrapper would miss wrapped ship commands.
     """
 
     def setUp(self):
@@ -246,18 +245,18 @@ class TestShipDetectionIsCommandPosition(unittest.TestCase):
     def test_plain_git_push_is_a_ship_action(self):
         self.assert_ship("git push origin master")
 
-    def test_rtk_wrapped_git_is_a_ship_action(self):
-        # rtk is no longer a UAP integration, but the wrapper unwrap stays as
-        # defense-in-depth for machines where the binary remains installed.
-        self.assert_ship("rtk git push origin master")
+    def test_wrapped_git_is_a_ship_action(self):
+        # Wrapper unwrap: the gate must see through prefix wrappers to the
+        # real verb.
+        self.assert_ship("env git push origin master")
 
-    def test_rtk_wrapped_git_with_value_option_is_a_ship_action(self):
+    def test_wrapped_git_with_value_option_is_a_ship_action(self):
         # The `-C <path>` form needs the wrapper unwrap — the raw prose
         # patterns only catch adjacent `git push`. Regression guard.
-        self.assert_ship("rtk git -C /repo push origin master")
+        self.assert_ship("env git -C /repo push origin master")
 
-    def test_rtk_wrapped_plumbing_is_a_ship_action(self):
-        self.assert_ship("rtk git send-pack origin master")
+    def test_wrapped_plumbing_is_a_ship_action(self):
+        self.assert_ship("env git send-pack origin master")
 
     def test_ship_action_after_a_chained_command(self):
         self.assert_ship("cd sub && git commit -m x")

package/tools/agents/tests/test_lockstep_escalation.py

@@ -0,0 +1,324 @@
+#!/usr/bin/env python3
+"""LOCKSTEP ESCALATION guardrail: the SAME tool call failing with the SAME
+error, over and over. The older guards split this case against themselves --
+DOUBLING-DOWN yielded to ERROR-LOOP, whose re-read remedy assumes a failing
+file and is wrong for tool-misuse loops (observed live 2026-09-25: one ssh
+call re-issued 27 times before the hard stop). Lockstep owns the case with a
+decisive ladder: pivot directive -> final warning -> hard stop + a JSONL
+loop-incident record for `uap loops`.
+"""
+import importlib.util
+import json
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+proxy = _load_proxy_module()
+
+# Built through the production fingerprinter so the tests pin the format the
+# ledger actually sees ("name:md5[:8]"), not a hand-rolled stand-in.
+FP = proxy._tool_call_fingerprint(
+    {"name": "bash", "input": {"command": 'ssh host "docker exec c python3 -c ..."'}}
+)
+ERR = "Traceback (most recent call last):\n  File \"<string>\", line 3\nKeyError: 'x'"
+
+
+def _drive_lockstep(monitor, n):
+    """Feed n consecutive identical-failing-call observations, the way the
+    request path feeds both trackers each turn."""
+    for i in range(n):
+        monitor.note_tool_result_error(ERR)
+        monitor.note_doubling_signal(FP, ERR, msg_count=100 + i, result_error=True)
+
+
+class LockstepKnobGuard(unittest.TestCase):
+    """Module globals are read at call time; restore whatever a test patches."""
+
+    def setUp(self):
+        self._saved = {
+            name: getattr(proxy, name)
+            for name in (
+                "PROXY_LOCKSTEP_BREAK",
+                "PROXY_LOCKSTEP_PIVOT_AT",
+                "PROXY_LOCKSTEP_HARD_AT",
+                "UAP_LOOP_INCIDENTS",
+            )
+        }
+        self._tmp = tempfile.TemporaryDirectory()
+        proxy.UAP_LOOP_INCIDENTS = os.path.join(self._tmp.name, "incidents.jsonl")
+
+    def tearDown(self):
+        for name, value in self._saved.items():
+            setattr(proxy, name, value)
+        self._tmp.cleanup()
+
+    def _records(self):
+        if not os.path.exists(proxy.UAP_LOOP_INCIDENTS):
+            return []
+        with open(proxy.UAP_LOOP_INCIDENTS, encoding="utf-8") as fh:
+            return [json.loads(line) for line in fh if line.strip()]
+
+
+class StreakMathTests(LockstepKnobGuard):
+    def test_single_signal_does_not_arm(self):
+        m = proxy.SessionMonitor()
+        for _ in range(4):
+            m.note_tool_result_error(ERR)
+        self.assertEqual(proxy._lockstep_streak(m), 0)  # error only
+        m2 = proxy.SessionMonitor()
+        for i in range(4):
+            m2.note_doubling_signal(FP, ERR, msg_count=i, result_error=True)
+        self.assertEqual(proxy._lockstep_streak(m2), 0)  # identical call only
+
+    def test_lockstep_is_the_shallower_streak(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, 3)
+        self.assertEqual(proxy._lockstep_streak(m), 3)
+        # a different error restarts the signature streak at 1 -> the lockstep
+        # drops to the shallower side even though the call streak survives
+        m.note_tool_result_error("Error: something else entirely\n at y:9")
+        self.assertEqual(proxy._lockstep_streak(m), 1)
+        # a clean result zeroes the signature side -> lockstep fully broken
+        m.note_tool_result_error("ok, all green")
+        self.assertEqual(proxy._lockstep_streak(m), 0)
+
+    def test_disabled_globally(self):
+        proxy.PROXY_LOCKSTEP_BREAK = False
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, 5)
+        self.assertEqual(proxy._lockstep_streak(m), 0)
+        self.assertFalse(proxy._lockstep_active(m))
+
+
+class LadderTests(LockstepKnobGuard):
+    def _body(self):
+        # Ends in a tool result, the way an unattended tool loop looks on the
+        # wire; a trailing user-text message is the human re-arm signal.
+        return {
+            "messages": [
+                {"role": "user", "content": "fix it"},
+                {"role": "assistant", "content": "retrying"},
+                {"role": "tool", "content": ERR},
+            ],
+            "tool_choice": "auto",
+        }
+
+    def test_pivot_directive_at_threshold(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        body = self._body()
+        proxy._maybe_lockstep_escalate(body, m)
+        sysmsg = body["messages"][0]
+        self.assertEqual(sysmsg["role"], "system")
+        self.assertIn("LOOP-ESCALATE", sysmsg["content"])
+        self.assertIn("different approaches", sysmsg["content"])
+        self.assertEqual(m.lockstep_fires, 1)
+        # advisory: tool_choice untouched
+        self.assertEqual(body["tool_choice"], "auto")
+        recs = self._records()
+        self.assertEqual([r["outcome"] for r in recs], ["pivot"])
+
+    def test_final_warning_on_second_fire(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(self._body(), m)
+        _drive_lockstep(m, 1)
+        body = self._body()
+        proxy._maybe_lockstep_escalate(body, m)
+        self.assertIn("FINAL WARNING", body["messages"][0]["content"])
+        self.assertEqual(m.lockstep_fires, 2)
+        self.assertEqual(
+            [r["outcome"] for r in self._records()], ["pivot", "final_warning"]
+        )
+
+    def test_hard_stop_at_hard_at(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_HARD_AT)
+        m.lockstep_fires = 2  # both directives already ignored
+        with self.assertRaises(proxy.LockstepHardBlock) as ctx:
+            proxy._maybe_lockstep_escalate(self._body(), m)
+        # the distinct subclass still flows through the single 400 handler
+        self.assertIsInstance(ctx.exception, proxy.ErrorLoopHardBlock)
+        self.assertIn("LOOP-ESCALATE hard stop", str(ctx.exception))
+        self.assertIn("uap loops", str(ctx.exception))
+        self.assertEqual(m.lockstep_blocks, 1)
+        recs = self._records()
+        self.assertEqual(recs[-1]["outcome"], "hard_blocked")
+        self.assertEqual(recs[-1]["blocks"], 1)
+
+    def test_hard_stop_requires_ignored_directives(self):
+        # streak deep but directives never injected (e.g. knob flipped on
+        # mid-loop): escalate through the ladder instead of jumping to a 400.
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_HARD_AT + 2)
+        body = self._body()
+        proxy._maybe_lockstep_escalate(body, m)
+        self.assertEqual(m.lockstep_fires, 1)
+        self.assertEqual(m.lockstep_blocks, 0)
+
+    def test_resent_transcript_does_not_refire_or_spam_ledger(self):
+        # A client retry (5xx / stream abort) resends the SAME trailing
+        # transcript: the streak does not advance, so no new directive and no
+        # new ledger record.
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(self._body(), m)
+        self.assertEqual(m.lockstep_fires, 1)
+        proxy._maybe_lockstep_escalate(self._body(), m)  # the retry
+        self.assertEqual(m.lockstep_fires, 1)
+        self.assertEqual(len(self._records()), 1)
+
+    def test_hard_stop_retry_refuses_without_duplicate_record(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_HARD_AT)
+        m.lockstep_fires = 2
+        m.lockstep_last_fire_streak = proxy.PROXY_LOCKSTEP_HARD_AT - 1
+        with self.assertRaises(proxy.ErrorLoopHardBlock):
+            proxy._maybe_lockstep_escalate(self._body(), m)
+        with self.assertRaises(proxy.ErrorLoopHardBlock):
+            proxy._maybe_lockstep_escalate(self._body(), m)  # client retry
+        self.assertEqual(m.lockstep_blocks, 2)  # every retry refused
+        hard = [r for r in self._records() if r["outcome"] == "hard_blocked"]
+        self.assertEqual(len(hard), 1)  # but recorded once
+
+    def test_fresh_user_turn_rearms(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_HARD_AT)
+        m.lockstep_fires = 2
+        m.lockstep_last_fire_streak = proxy.PROXY_LOCKSTEP_HARD_AT
+        body = {
+            "messages": [
+                {"role": "user", "content": "tool result..."},
+                {"role": "user", "content": "human stepping in"},
+            ]
+        }
+        proxy._maybe_lockstep_escalate(body, m)  # must NOT raise
+        self.assertEqual(m.lockstep_fires, 0)
+        self.assertEqual(m.lockstep_last_fire_streak, 0)
+        self.assertEqual(m.lockstep_blocks, 0)
+
+    def test_second_loop_climbs_the_full_ladder(self):
+        # A resolved loop must not leak its ladder position into the next one:
+        # the second loop gets its own pivot and final warning before any stop.
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(self._body(), m)
+        _drive_lockstep(m, 1)
+        proxy._maybe_lockstep_escalate(self._body(), m)
+        self.assertEqual(m.lockstep_fires, 2)
+        # loop A resolves: clean result + a different (or no) call
+        m.note_tool_result_error("ok, all green")
+        m.note_doubling_signal("", "ok, all green", msg_count=900, result_error=False)
+        proxy._maybe_lockstep_escalate(self._body(), m)  # streak 0 -> ladder reset
+        self.assertEqual(m.lockstep_fires, 0)
+        self.assertEqual(m.lockstep_last_fire_streak, 0)
+        # loop B (a different failing call) climbs from the pivot tier again
+        fp_b = proxy._tool_call_fingerprint(
+            {"name": "edit", "input": {"path": "/x.py", "old": "a", "new": "b"}}
+        )
+        for i in range(proxy.PROXY_LOCKSTEP_PIVOT_AT):
+            m.note_tool_result_error("Error: EACCES permission denied\n at x:1")
+            m.note_doubling_signal(fp_b, "Error: EACCES", msg_count=1000 + i, result_error=True)
+        body = self._body()
+        proxy._maybe_lockstep_escalate(body, m)
+        self.assertIn("LOOP-ESCALATE", body["messages"][0]["content"])
+        self.assertNotIn("FINAL WARNING", body["messages"][0]["content"])
+        self.assertEqual(m.lockstep_fires, 1)
+        self.assertEqual(
+            [r["outcome"] for r in self._records()],
+            ["pivot", "final_warning", "pivot"],
+        )
+
+
+class YieldTests(LockstepKnobGuard):
+    def test_error_loop_and_doubling_yield_to_lockstep(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, max(proxy.PROXY_ERROR_LOOP_THRESHOLD, proxy.PROXY_DOUBLING_THRESHOLD))
+        self.assertTrue(proxy._lockstep_active(m))
+        body = {"messages": [{"role": "user", "content": "go"}], "tool_choice": "required"}
+        proxy._maybe_inject_error_loop_break(body, m)
+        proxy._maybe_inject_doubling_break(body, m)
+        self.assertEqual(m.error_loop_fires, 0)
+        self.assertEqual(m.doubling_break_fires, 0)
+        self.assertEqual(len(body["messages"]), 1)  # neither injected
+
+    def test_error_loop_still_fires_off_lockstep(self):
+        # varied edits, same error: doubling streak stays 0, so the lockstep
+        # never arms and ERROR-LOOP keeps owning this shape.
+        m = proxy.SessionMonitor()
+        for _ in range(proxy.PROXY_ERROR_LOOP_THRESHOLD):
+            m.note_tool_result_error(ERR)
+        self.assertFalse(proxy._lockstep_active(m))
+        body = {"messages": [{"role": "user", "content": "go"}]}
+        proxy._maybe_inject_error_loop_break(body, m)
+        self.assertEqual(m.error_loop_fires, 1)
+
+
+class IncidentRecordTests(LockstepKnobGuard):
+    def test_record_shape_and_arg_redaction(self):
+        m = proxy.SessionMonitor()
+        m.session_id = "sess-123"
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(
+            {"messages": [{"role": "user", "content": "go"}]}, m
+        )
+        (rec,) = self._records()
+        self.assertEqual(rec["v"], 1)
+        self.assertEqual(rec["guard"], "lockstep")
+        self.assertEqual(rec["outcome"], "pivot")
+        self.assertEqual(rec["session"], "sess-123")
+        self.assertEqual(rec["tool"], "bash")
+        self.assertTrue(rec["fingerprint"])
+        self.assertNotIn(FP, json.dumps(rec))  # raw args never persisted
+        self.assertNotIn("ssh host", json.dumps(rec))
+        # the persisted signature is the normalized one (literals stripped)
+        self.assertIn("traceback", rec["error_signature"])
+
+    def test_ledger_disabled_by_empty_path(self):
+        proxy.UAP_LOOP_INCIDENTS = ""
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(
+            {"messages": [{"role": "user", "content": "go"}]}, m
+        )
+        self.assertEqual(self._records(), [])
+
+    def test_ledger_created_owner_only(self):
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(
+            {"messages": [{"role": "user", "content": "go"}]}, m
+        )
+        import stat
+
+        mode = stat.S_IMODE(os.stat(proxy.UAP_LOOP_INCIDENTS).st_mode)
+        self.assertEqual(mode, 0o600)
+
+    def test_symlink_ledger_refused(self):
+        target = os.path.join(self._tmp.name, "target.jsonl")
+        link = os.path.join(self._tmp.name, "link.jsonl")
+        with open(target, "w", encoding="utf-8") as fh:
+            fh.write("")
+        os.symlink(target, link)
+        proxy.UAP_LOOP_INCIDENTS = link
+        m = proxy.SessionMonitor()
+        _drive_lockstep(m, proxy.PROXY_LOCKSTEP_PIVOT_AT)
+        proxy._maybe_lockstep_escalate(
+            {"messages": [{"role": "user", "content": "go"}]}, m
+        )
+        with open(target, encoding="utf-8") as fh:
+            self.assertEqual(fh.read(), "")  # untouched
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tools/agents/tests/test_thinking_template_kwargs.py

@@ -447,10 +447,16 @@ class ColdBackendProbeBudgetTest(unittest.TestCase):
 class WireModelReconciliationTest(unittest.TestCase):
     """Send a model the backend answers to, or the turn is lost to a 404.
 
-    llama.cpp ignored the OpenAI `model` field; ninfer validates it. With the
-    local-only sentinel every advertised id is served locally, so the four
-    `claude-*` ids the proxy advertises for SDK compatibility all came back
-    `404 model_not_found` -- measured against the live backend.
+    llama.cpp ignores the OpenAI `model` field; the ninfer-serve backend in
+    place on 2026-08-19 VALIDATED it. With the local-only sentinel every
+    advertised id is served locally, so the four `claude-*` ids the proxy
+    advertises for SDK compatibility all came back `404 model_not_found` --
+    measured against that backend.
+
+    As of 2026-09-21 the backend is llama.cpp again and ignores the field, so
+    this reconciliation is belt-and-braces rather than load-bearing today. The
+    behaviour is still worth pinning: the next engine may validate again, and
+    the cost of being wrong is every turn lost to a 404.
     """
 
     def _ap(self, ids=("qwen3.8-27b",)):