@stigmer/server 3.38.2 → 3.38.3

package/src/domain/agentexecution/__tests__/validate-thinking-mode.test.ts

@@ -1,29 +1,38 @@
 /**
- * Pins validate-thinking-mode.ts against Go's
- * validate_thinking_mode_test.go case-for-case: fail-closed create-time
- * validation of ExecutionConfig.thinking_mode (#772) against the BUNDLED
- * registry. Capability-gated and cursor-harness-scoped: claude-opus-4-6
- * declares capabilities.thinking on its cursor entry; composer-2.5's
- * cursor entry declares thinking=false; claude-sonnet-4.6 declares the
- * capability but only on its NATIVE entry, which has no thinking wire
- * mapping in v1 and must refuse.
+ * Pins validate-thinking-mode.ts: fail-closed create-time validation of
+ * ExecutionConfig.thinking_mode (#772) against the BUNDLED registry, judged
+ * on the harness the execution will run on (#1280). The harness comes from
+ * the stored session for a turn on an existing session, else the bootstrap
+ * session_spec, UNSPECIFIED read as native; a real SQLite store holds the
+ * sessions. The bundled rows it leans on: claude-opus-4-6 declares
+ * `thinking` on its cursor entry and composer-2.5 declares none;
+ * claude-sonnet-5 is adaptive on its native entry and claude-haiku-4.5 is
+ * budget-shaped; claude-fable-5's native entry requires thinking.
  */
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
 import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
 import { create } from "@bufbuild/protobuf";
 import type { MessageInitShape } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
-import { describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ServiceTier,
   ThinkingMode,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { ExecutionConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { AgentExecutionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { createLogger } from "../../../boot/logger.js";
 import { RequestContext } from "../../../pipeline/request-context.js";
+import type { Store } from "../../../store/interface.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
 import { bundledModelRegistryDocument } from "../../workflow/registry/bundled.js";
 import { ModelRegistryStore } from "../../workflow/registry/model-registry-store.js";
 import { newValidateThinkingModeStep } from "../validate-thinking-mode.js";
@@ -41,16 +50,31 @@ const registry = new ModelRegistryStore({
   logger: silentLogger,
 });
 
-const step = newValidateThinkingModeStep(registry);
+let dir: string;
+let store: Store;
+
+beforeEach(() => {
+  dir = mkdtempSync(path.join(tmpdir(), "validate-thinking-mode-test-"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+type SpecInit = MessageInitShape<typeof AgentExecutionSpecSchema>;
+type ExecutionConfigInit = NonNullable<SpecInit["executionConfig"]>;
 
 function contextFor(
-  config: MessageInitShape<typeof ExecutionConfigSchema> | undefined,
+  config: ExecutionConfigInit | undefined,
+  target: Pick<SpecInit, "sessionId" | "sessionSpec"> = {},
 ): RequestContext<typeof AgentExecutionSchema> {
   return new RequestContext(
     AgentExecutionSchema,
     create(AgentExecutionSchema, {
       spec: {
         message: "hello",
+        ...target,
         ...(config === undefined ? {} : { executionConfig: config }),
       },
     }),
@@ -59,11 +83,24 @@ function contextFor(
   );
 }
 
-function refusal(
-  config: MessageInitShape<typeof ExecutionConfigSchema>,
-): ConnectError {
+const onCursor = { sessionSpec: { harness: Harness.CURSOR } };
+const onNative = { sessionSpec: { harness: Harness.NATIVE } };
+
+async function passes(
+  config: ExecutionConfigInit | undefined,
+  target: Pick<SpecInit, "sessionId" | "sessionSpec"> = {},
+  onStore: Store = store,
+): Promise<void> {
+  await newValidateThinkingModeStep(registry, onStore).execute(contextFor(config, target));
+}
+
+async function refusal(
+  config: ExecutionConfigInit,
+  target: Pick<SpecInit, "sessionId" | "sessionSpec"> = {},
+  onStore: Store = store,
+): Promise<ConnectError> {
   try {
-    step.execute(contextFor(config));
+    await passes(config, target, onStore);
   } catch (error) {
     expect(error).toBeInstanceOf(ConnectError);
     return error as ConnectError;
@@ -71,73 +108,184 @@ function refusal(
   throw new Error("expected a fail-closed refusal, step passed");
 }
 
-describe("ValidateThinkingMode (#772, bundled registry)", () => {
-  it("no execution_config passes", () => {
-    expect(() => step.execute(contextFor(undefined))).not.toThrow();
+async function storeSession(id: string, harness: Harness): Promise<void> {
+  await store.saveResource(
+    ApiResourceKind.session,
+    id,
+    SessionSchema,
+    create(SessionSchema, { metadata: { id, org: "acme" }, spec: { harness } }),
+  );
+}
+
+describe("ValidateThinkingMode: modes that need no harness", () => {
+  it("no execution_config passes", async () => {
+    await expect(passes(undefined)).resolves.toBeUndefined();
   });
 
-  it("explicit DISABLED passes without a model", () => {
-    expect(() =>
-      step.execute(contextFor({ thinkingMode: ThinkingMode.DISABLED })),
-    ).not.toThrow();
+  it("explicit DISABLED passes without a model", async () => {
+    await expect(passes({ thinkingMode: ThinkingMode.DISABLED })).resolves.toBeUndefined();
   });
+});
 
-  it("ENABLED with a thinking-capable cursor model passes", () => {
-    expect(() =>
-      step.execute(
-        contextFor({
-          modelName: "claude-opus-4-6",
-          thinkingMode: ThinkingMode.ENABLED,
-        }),
-      ),
-    ).not.toThrow();
+describe("ValidateThinkingMode on the cursor harness", () => {
+  it("ENABLED with a thinking-capable cursor model passes", async () => {
+    await expect(
+      passes({ modelName: "claude-opus-4-6", thinkingMode: ThinkingMode.ENABLED }, onCursor),
+    ).resolves.toBeUndefined();
   });
 
-  it("ENABLED combines freely with FAST — the combination bills as the fast variant", () => {
-    expect(() =>
-      step.execute(
-        contextFor({
-          modelName: "claude-opus-4-6",
-          serviceTier: ServiceTier.FAST,
-          thinkingMode: ThinkingMode.ENABLED,
-        }),
+  it("ENABLED combines freely with FAST — the combination bills as the fast variant", async () => {
+    await expect(
+      passes(
+        { modelName: "claude-opus-4-6", serviceTier: ServiceTier.FAST, thinkingMode: ThinkingMode.ENABLED },
+        onCursor,
       ),
-    ).not.toThrow();
+    ).resolves.toBeUndefined();
   });
 
-  it("ENABLED without model_name fails closed (no thinking-on-Auto)", () => {
-    const err = refusal({ thinkingMode: ThinkingMode.ENABLED });
+  it("ENABLED without model_name fails closed, naming the cursor models that think", async () => {
+    const err = await refusal({ thinkingMode: ThinkingMode.ENABLED }, onCursor);
     expect(err.code).toBe(Code.InvalidArgument);
     expect(err.rawMessage).toContain("requires execution_config.model_name");
-    // Thinking-capable suggestions ride along.
     expect(err.rawMessage).toContain("claude-opus-4-6");
   });
 
-  it("ENABLED on a cursor model without the capability fails closed", () => {
-    const err = refusal({
-      modelName: "composer-2.5",
-      thinkingMode: ThinkingMode.ENABLED,
-    });
+  it("ENABLED on a cursor model without the capability fails closed", async () => {
+    const err = await refusal({ modelName: "composer-2.5", thinkingMode: ThinkingMode.ENABLED }, onCursor);
     expect(err.code).toBe(Code.InvalidArgument);
     expect(err.rawMessage).toContain("no thinking capability");
     expect(err.rawMessage).toContain("composer-2.5");
+    expect(err.rawMessage).toContain("cursor harness");
   });
 
-  it("ENABLED on a native-only model fails closed (no native wire mapping in v1)", () => {
-    const err = refusal({
-      modelName: "claude-sonnet-4.6",
-      thinkingMode: ThinkingMode.ENABLED,
-    });
+  it("ENABLED on a native-only model fails closed on cursor: the cursor entry is the one that decides", async () => {
+    const err = await refusal({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED }, onCursor);
     expect(err.code).toBe(Code.InvalidArgument);
-    expect(err.rawMessage).toContain("cursor");
-    expect(err.rawMessage).toContain("claude-sonnet-4.6");
+    expect(err.rawMessage).toContain("cursor harness");
   });
 
-  it("ENABLED on an unknown model fails closed", () => {
-    const err = refusal({
-      modelName: "not-a-model",
-      thinkingMode: ThinkingMode.ENABLED,
-    });
+  it("DISABLED on claude-fable-5 passes on cursor: only its native entry requires thinking", async () => {
+    await expect(
+      passes({ modelName: "claude-fable-5", thinkingMode: ThinkingMode.DISABLED }, onCursor),
+    ).resolves.toBeUndefined();
+  });
+});
+
+describe("ValidateThinkingMode on the native harness (#1280)", () => {
+  it("ENABLED on an adaptive native model passes — the #1280 case, claude-sonnet-5 on a native session", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+
+  it("ENABLED on a budget-shaped native model passes", async () => {
+    await expect(
+      passes({ modelName: "claude-haiku-4.5", thinkingMode: ThinkingMode.ENABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+
+  it("an UNSPECIFIED harness is native", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED }, { sessionSpec: {} }),
+    ).resolves.toBeUndefined();
+    await expect(passes({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED })).resolves.toBeUndefined();
+  });
+
+  it("ENABLED on a model with no native entry fails closed, naming the native models that think", async () => {
+    const err = await refusal({ modelName: "composer-2.5", thinkingMode: ThinkingMode.ENABLED }, onNative);
+    expect(err.code).toBe(Code.InvalidArgument);
+    expect(err.rawMessage).toContain("native harness");
+    expect(err.rawMessage).toContain("claude-sonnet-5");
+    expect(err.rawMessage).toContain("claude-haiku-4.5");
+  });
+
+  it("ENABLED on an unknown model fails closed", async () => {
+    const err = await refusal({ modelName: "not-a-model", thinkingMode: ThinkingMode.ENABLED }, onNative);
+    expect(err.code).toBe(Code.InvalidArgument);
+  });
+
+  it("an explicit DISABLED on a model that requires thinking fails closed", async () => {
+    const err = await refusal({ modelName: "claude-fable-5", thinkingMode: ThinkingMode.DISABLED }, onNative);
     expect(err.code).toBe(Code.InvalidArgument);
+    expect(err.rawMessage).toContain("always thinks");
+    expect(err.rawMessage).toContain("claude-fable-5");
+  });
+
+  it("UNSPECIFIED and ENABLED pass on a model that requires thinking", async () => {
+    await expect(passes({ modelName: "claude-fable-5" }, onNative)).resolves.toBeUndefined();
+    await expect(
+      passes({ modelName: "claude-fable-5", thinkingMode: ThinkingMode.ENABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+
+  it("an explicit DISABLED passes on a model that may turn thinking off", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.DISABLED }, onNative),
+    ).resolves.toBeUndefined();
+  });
+});
+
+describe("ValidateThinkingMode reads a stored session's harness", () => {
+  it("a turn on a stored cursor session is judged on cursor", async () => {
+    await storeSession("ses_cursor", Harness.CURSOR);
+
+    await expect(
+      passes({ modelName: "claude-opus-4-6", thinkingMode: ThinkingMode.ENABLED }, { sessionId: "ses_cursor" }),
+    ).resolves.toBeUndefined();
+    const err = await refusal({ modelName: "claude-sonnet-4.6", thinkingMode: ThinkingMode.ENABLED }, { sessionId: "ses_cursor" });
+    expect(err.rawMessage).toContain("cursor harness");
+  });
+
+  it("a turn on a stored native session is judged on native, whatever the request's session_spec says", async () => {
+    await storeSession("ses_native", Harness.NATIVE);
+
+    await expect(
+      passes(
+        { modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED },
+        { sessionId: "ses_native", sessionSpec: { harness: Harness.CURSOR } },
+      ),
+    ).resolves.toBeUndefined();
+  });
+
+  it("a dangling session id is judged on the default native harness", async () => {
+    await expect(
+      passes({ modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED }, { sessionId: "ses_missing" }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("a store fault is Internal, never a reading of the session", async () => {
+    const faulty = new Proxy(store, {
+      get(target, prop, receiver) {
+        if (prop === "getResource") {
+          return async () => {
+            throw new Error("simulated store fault");
+          };
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+
+    const err = await refusal(
+      { modelName: "claude-sonnet-5", thinkingMode: ThinkingMode.ENABLED },
+      { sessionId: "ses_any" },
+      faulty,
+    );
+    expect(err.code).toBe(Code.Internal);
+  });
+
+  it("a mode that needs no harness never reads the store", async () => {
+    const untouchable = new Proxy(store, {
+      get(target, prop, receiver) {
+        if (prop === "getResource") {
+          throw new Error("the store must not be read");
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+
+    await expect(passes(undefined, { sessionId: "ses_any" }, untouchable)).resolves.toBeUndefined();
+    await expect(
+      passes({ thinkingMode: ThinkingMode.DISABLED }, { sessionId: "ses_any" }, untouchable),
+    ).resolves.toBeUndefined();
   });
 });

package/src/domain/agentexecution/controller.ts

@@ -279,12 +279,16 @@ export function registerAgentExecutionServices(
 
 /**
  * Create — create.go buildCreatePipeline, step-for-step: validation
- * (proto → visibility → tier #357 → thinking #772) → the run gate
+ * (proto → visibility → tier #357) → the run gate
  * (AuthorizeRunTarget, P1 sp.run-gate: asking the target's own permission
  * by request shape — session, instance or blueprint; the all-empty shape
  * is the built-in assistant, admitted by Authorize's organization check
  * and gated on nothing further — before the engine gate so a denied caller
- * learns nothing about engine state, and before every side effect) → the standard build
+ * learns nothing about engine state, and before every side effect) → the
+ * thinking-mode validation (#772), which judges the model on the harness
+ * the execution will run on and so may read the stored session: it runs
+ * behind the run gate, so nothing about a session is read or disclosed
+ * before the caller may add a turn to it (#1280) → the standard build
  * → the engine gate (fail fast BEFORE the first side effect, so a down
  * engine orphans nothing) → the pre-side-effect gate slot (O4; empty in OSS) → the
  * side-effecting steps (default instance, session bootstrap,
@@ -317,10 +321,10 @@ async function createExecution(
     .addStep(newValidateProtoStep())
     .addStep(newValidateVisibilityStep())
     .addStep(newValidateServiceTierStep(deps.modelRegistry))
-    .addStep(newValidateThinkingModeStep(deps.modelRegistry))
     .addStep(
       newAuthorizeRunTargetStep(deps.authorizer, agentExecutionRunTarget),
     )
+    .addStep(newValidateThinkingModeStep(deps.modelRegistry, deps.store))
     .addStep(newResolveSlugStep())
     .addStep(newBuildNewStateStep())
     // Vouches the runner-stamped workflow lineage labels (or refuses a

package/src/domain/agentexecution/update-status.ts

@@ -29,7 +29,11 @@
  * appended and never replaces the transcript, and a PAUSED or CANCELLED
  * execution's stop row stays last across the runner's later writes,
  * because the Pause and Cancel RPCs, the invoke workflow and the runner
- * all write a stopped execution and nothing orders them.
+ * all write a stopped execution and nothing orders them. For the same
+ * reason a PAUSED execution's phase moves only on the platform's own
+ * write (stigmer#1370): the runner learns of a pause on a later heartbeat
+ * and keeps streaming IN_PROGRESS until then, and without the latch its
+ * stragglers un-pause the execution and Resume finds nothing to resume.
  *
  * Broadcast rides in-memory channels (ADR 011).
  */
@@ -66,6 +70,7 @@ import {
 } from "../../pipeline/errors.js";
 import { newPipeline } from "../../pipeline/pipeline.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
@@ -161,7 +166,12 @@ export async function updateStatus(
               oldPhase =
                 execution.status?.phase ??
                 ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
-              applyUpdateStatusMerge(execution, ctx.input, deps.logger);
+              applyUpdateStatusMerge(
+                execution,
+                ctx.input,
+                deps.logger,
+                isServerComposedRequest(identity) ? "platform" : "wire",
+              );
             },
           );
         } catch (error) {
@@ -315,18 +325,27 @@ function mergeTranscript(
   return next;
 }
 
+/**
+ * Who sent a status write: the platform's own (the invoke workflow's
+ * writes, which reach this handler over the in-process transport, the
+ * one origin the wire cannot claim) or the wire (the runner).
+ */
+export type StatusWriter = "platform" | "wire";
+
 /**
  * Merges an incoming status update into the execution in place — the
  * runner-owns-the-transcript merge rules, exactly update_status.go
  * applyUpdateStatusMerge. Runs inside the updateResource closure
  * (synchronous by store contract), so the merge, the approval event
  * authoring, and the pending_approvals projection all see the same
- * snapshot that will be persisted.
+ * snapshot that will be persisted. `writer` defaults to the wire, the
+ * side that grants nothing extra.
  */
 export function applyUpdateStatusMerge(
   execution: AgentExecution,
   input: AgentExecutionUpdateStatusInput,
   logger: Logger,
+  writer: StatusWriter = "wire",
 ): void {
   if (execution.status === undefined) {
     execution.status = create(AgentExecutionStatusSchema);
@@ -415,8 +434,29 @@ export function applyUpdateStatusMerge(
   // re-terminalize it is gone. Recover is the one sanctioned
   // un-terminalizer and runs through its own lifecycle step, never this
   // merge.
+  //
+  // A PAUSED execution is latched the same way against the wire
+  // (stigmer#1370): the runner's straggler persists, sent before its
+  // heartbeat delivers the pause, carry IN_PROGRESS. Resume moves the
+  // phase through its own lifecycle step; through this merge only the
+  // platform's own writes do (the workflow's resume and recovery
+  // re-assertions, which also heal a stale PAUSED over a fast resume,
+  // oss#869). The straggler's transcript still merges, beneath the held
+  // pause row.
   if (requestStatus.phase !== ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED) {
     if (
+      existingPhase === ExecutionPhase.EXECUTION_PAUSED &&
+      writer === "wire" &&
+      requestStatus.phase !== existingPhase
+    ) {
+      logger.warn(
+        "Ignored a wire phase change on a paused execution; Resume or the platform's own write moves it",
+        {
+          executionId: input.executionId,
+          ignoredPhase: ExecutionPhase[requestStatus.phase],
+        },
+      );
+    } else if (
       isTerminalExecutionPhase(existingPhase) &&
       requestStatus.phase !== existingPhase
     ) {

package/src/domain/agentexecution/validate-thinking-mode.ts

@@ -1,88 +1,143 @@
 /**
- * ValidateThinkingMode — ports validate_thinking_mode.go: fail-closed
- * validation of ExecutionConfig.thinking_mode against the model registry
- * (stigmer/stigmer#772) — the sibling of ValidateServiceTier for the
- * second variant dimension.
+ * ValidateThinkingMode — fail-closed validation of
+ * ExecutionConfig.thinking_mode against the model registry
+ * (stigmer/stigmer#772), the sibling of ValidateServiceTier for the second
+ * variant dimension, judged on the harness the execution will run on
+ * (stigmer/stigmer#1280).
  *
  * Unlike the fast tier, thinking is capability-gated, not pricing-gated:
- * thinking variants bill at base per-token rates (ledger-verified), so
- * the registry fact that makes ENABLED selectable is
- * capabilities.thinking on the model's CURSOR-harness entry. The harness
- * scoping is deliberate — native entries truthfully declare the same
- * capability (Anthropic models support extended thinking natively) but no
- * native wire mapping exists in v1, so validating them would accept a
- * config the runner silently cannot honor (the exact silent-no-op class
- * #357 exists to kill; mirrors the #361 FAST-on-native hold).
+ * thinking variants bill at base per-token rates (ledger-verified), so the
+ * registry fact that makes ENABLED selectable is a thinking capability on
+ * the model's entry for the execution's harness — `thinking` (a fixed
+ * budget) or `adaptiveThinking` (depth adapts). Both harnesses translate
+ * the mode: Cursor as its thinking variant, native as Anthropic's
+ * `thinking` parameter in the form the entry declares. The harness scoping
+ * is what keeps a selection honest: an id such as claude-sonnet-5 has an
+ * entry on each harness, and only the entry the execution runs on says
+ * what its model does.
  *
- *   - UNSPECIFIED / DISABLED: always valid — every model has a base
- *     variant, and unset resolves to explicitly-requested DISABLED in the
- *     runner (never the provider account default).
+ *   - UNSPECIFIED: always valid — it resolves to DISABLED in the runner,
+ *     and a model that requires thinking thinks under it.
+ *   - DISABLED: valid, except on a model whose entry declares
+ *     `thinkingRequired` — it always thinks and the provider refuses a
+ *     request to turn thinking off.
  *   - ENABLED: requires model_name to be set (Auto has no variant
- *     dimensions) and that model's cursor-harness registry entry to
- *     declare the thinking capability.
+ *     dimensions) and that model's entry on the harness to declare a
+ *     thinking capability.
  *
- * Positioned beside ValidateServiceTier, before any side-effecting step.
- * Mirrors the cloud Java ValidateThinkingModeStep; all three editions
- * must refuse the same request with the same message.
+ * The harness is the one CreateSessionIfNeeded and dispatch will use: the
+ * stored session's for a turn on an existing session, else the bootstrap
+ * session_spec's, UNSPECIFIED read as native (harnessName; the Cloud
+ * billing gate resolves the same way). Reading a stored session is why the
+ * step runs after the run gate: the caller is authorized to add a turn to
+ * that session before anything about it is read, so a refusal never tells
+ * an unauthorized caller which harness a session uses. It is still a pure
+ * step, before any side effect.
  */
-import type { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecution, AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
-import { invalidArgumentError } from "../../pipeline/errors.js";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
+import { ResourceNotFoundError, type Store } from "../../store/interface.js";
 import type { ModelCatalogProvider } from "../workflow/registry/model-catalog-provider.js";
-import { THINKING_CAPABILITY_KEY } from "../workflow/registry/model-registry-store.js";
-import { HARNESS_NAME_CURSOR } from "../workflow/registry/pin-validation.js";
+import {
+  ADAPTIVE_THINKING_CAPABILITY_KEY,
+  THINKING_CAPABILITY_KEY,
+  THINKING_REQUIRED_CAPABILITY_KEY,
+} from "../workflow/registry/model-registry-store.js";
+import { harnessName } from "../workflow/registry/pin-validation.js";
 
 export function newValidateThinkingModeStep(
   registry: ModelCatalogProvider,
+  store: Store,
 ): PipelineStep<typeof AgentExecutionSchema> {
   return {
     name: "ValidateThinkingMode",
-    execute(ctx) {
+    async execute(ctx) {
       const config = ctx.newState.spec?.executionConfig;
-      if (config?.thinkingMode !== ThinkingMode.ENABLED) {
-        // UNSPECIFIED and DISABLED are always valid; unknown enum numbers
-        // were already refused by proto field validation (defined_only).
+      const mode = config?.thinkingMode ?? ThinkingMode.UNSPECIFIED;
+      const modelName = (config?.modelName ?? "").trim();
+      // UNSPECIFIED is always valid, and so is DISABLED on Auto (no model
+      // to require thinking). Unknown enum numbers were already refused by
+      // proto field validation (defined_only).
+      if (mode === ThinkingMode.UNSPECIFIED || (mode === ThinkingMode.DISABLED && modelName === "")) {
+        return;
+      }
+
+      const harness = await executionHarness(ctx.newState, store);
+
+      if (mode === ThinkingMode.DISABLED) {
+        if (registry.hasCapabilityForHarness(harness, modelName, THINKING_REQUIRED_CAPABILITY_KEY)) {
+          throw invalidArgumentError(
+            `thinking_mode 'disabled' is not available for model '${modelName}': the model always ` +
+              `thinks on the ${harness} harness and refuses a request to turn thinking off. ` +
+              "Leave thinking_mode unset, or set it to 'enabled'.",
+          );
+        }
         return;
       }
 
-      const modelName = (config.modelName ?? "").trim();
       if (modelName === "") {
         throw invalidArgumentError(
           "thinking_mode 'enabled' requires execution_config.model_name: thinking is a " +
             "per-model capability, and Auto (no pinned model) has no variant dimensions. " +
-            `Pin a model that supports it${thinkingCapableSuffix(registry)}.`,
+            `Pin a model that supports it${thinkingCapableSuffix(registry, harness)}.`,
         );
       }
 
-      if (
-        !registry.hasCapabilityForHarness(
-          HARNESS_NAME_CURSOR,
-          modelName,
-          THINKING_CAPABILITY_KEY,
-        )
-      ) {
+      if (!canThink(registry, harness, modelName)) {
         throw invalidArgumentError(
           `thinking_mode 'enabled' is not available for model '${modelName}': the model ` +
-            "registry declares no thinking capability for it on the cursor " +
-            `harness${thinkingCapableSuffix(registry)}.`,
+            `registry declares no thinking capability for it on the ${harness} ` +
+            `harness${thinkingCapableSuffix(registry, harness)}.`,
         );
       }
     },
   };
 }
 
+/** The registry section name of the harness this execution will run on. */
+async function executionHarness(execution: AgentExecution, store: Store): Promise<string> {
+  const sessionId = execution.spec?.sessionId ?? "";
+  if (sessionId === "") {
+    return harnessName(execution.spec?.sessionSpec?.harness ?? Harness.UNSPECIFIED);
+  }
+  try {
+    const session = await store.getResource(ApiResourceKind.session, sessionId, SessionSchema);
+    return harnessName(session.spec?.harness ?? Harness.UNSPECIFIED);
+  } catch (error) {
+    // A dangling session id is the loading steps' refusal to make, with
+    // its own NotFound; judge it on the default harness, as dispatch does.
+    // Any other failure is a store fault, never a reading of the session.
+    if (error instanceof ResourceNotFoundError) {
+      return harnessName(Harness.UNSPECIFIED);
+    }
+    throw internalError(error, "failed to load session for thinking-mode validation");
+  }
+}
+
+function canThink(registry: ModelCatalogProvider, harness: string, modelName: string): boolean {
+  return (
+    registry.hasCapabilityForHarness(harness, modelName, THINKING_CAPABILITY_KEY) ||
+    registry.hasCapabilityForHarness(harness, modelName, ADAPTIVE_THINKING_CAPABILITY_KEY)
+  );
+}
+
 /**
- * "; models with a thinking mode: a, b, c" — actionable refusal detail,
- * sorted (the store keeps the list sorted), empty when the registry
- * declares none.
+ * "; models with a thinking mode: a, b, c" — actionable refusal detail for
+ * the harness, sorted, empty when the registry declares none there.
  */
-function thinkingCapableSuffix(registry: ModelCatalogProvider): string {
-  const capable = registry.canonicalModelsWithCapabilityForHarness(
-    HARNESS_NAME_CURSOR,
-    THINKING_CAPABILITY_KEY,
-  );
+function thinkingCapableSuffix(registry: ModelCatalogProvider, harness: string): string {
+  const capable = [
+    ...new Set([
+      ...registry.canonicalModelsWithCapabilityForHarness(harness, THINKING_CAPABILITY_KEY),
+      ...registry.canonicalModelsWithCapabilityForHarness(harness, ADAPTIVE_THINKING_CAPABILITY_KEY),
+    ]),
+  ].sort();
   if (capable.length === 0) {
     return "";
   }