onto-mcp 0.4.12 → 0.4.13

package/dist/core-runtime/llm/llm-caller.js

@@ -20,6 +20,7 @@ import { DEFAULT_GROK_BASE_URL, DEFAULT_LMSTUDIO_BASE_URL, isExternalOauthWorker
 import { resolveClaudeBin } from "./claude-bin.js";
 import { appendRuntimeModelCallLogFromCurrentContext, appendRuntimeStreamChunkFromCurrentContextSync, } from "../observability/runtime-stream-observation.js";
 import { callReviewMockLlm, isReviewMockLlmRealizationEnabled, } from "./mock-llm-realization.js";
+import { OPENAI_RESPONSES_MAX_OUTPUT_TOKENS_FAILURE_CODE, OpenAIResponsesIncompleteError, resolveOpenAIResponsesOutputBudget, } from "./openai-responses-incomplete-error.js";
 /**
  * Bridge: OntoConfig + CLI overrides → Partial<LlmCallConfig> that callLlm consumes.
  *
@@ -67,11 +68,39 @@ export function resolveLlmProviderConfig(args) {
         out.service_tier = service_tier;
     if (api_key_env)
         out.api_key_env = api_key_env;
+    // Transport timeout carried on the llm block (not a model-switch axis).
+    if (config.llm?.timeout_ms)
+        out.timeout_ms = config.llm.timeout_ms;
     if (Object.keys(models_per_provider).length > 0) {
         out.models_per_provider = models_per_provider;
     }
     return out;
 }
+export function applyOpenAIResponsesOutputHeadroom(args) {
+    if (args.headroomTokens === undefined)
+        return args.config;
+    if (args.selection.model_provider !== "openai" ||
+        args.selection.auth !== "api_key" ||
+        args.selection.execution_route !== "direct_model_call" ||
+        args.selection.execution_adapter !== "openai_sdk" ||
+        args.selection.wire_format !== "native_sdk" ||
+        args.selection.base_url !== undefined) {
+        throw new Error("openai Responses output headroom requires the official openai + api_key + openai_sdk + native_sdk route without a custom base_url.");
+    }
+    if (args.modelMaxOutputTokens === undefined) {
+        throw new Error("openai Responses output headroom requires registered max_output_tokens.");
+    }
+    resolveOpenAIResponsesOutputBudget({
+        baseOutputTokens: args.maxBaseOutputTokens,
+        headroomTokens: args.headroomTokens,
+        modelMaxOutputTokens: args.modelMaxOutputTokens,
+    });
+    return {
+        ...args.config,
+        openai_responses_output_headroom_tokens: args.headroomTokens,
+        openai_responses_model_max_output_tokens: args.modelMaxOutputTokens,
+    };
+}
 // Phase 3 production found 30s too tight for large audit batches (37 items
 // could time out then SDK-retry for 90s total). 120s is generous
 // enough for ~50-item single-batch audits while still failing fast on real
@@ -94,6 +123,20 @@ const WORKER_SIGKILL_GRACE_MS = 5_000;
 // faster (1 retry instead of the default 2) so operators see provider errors
 // within ~2× timeout instead of ~3×.
 const DEFAULT_MAX_RETRIES = 1;
+const OPENAI_RESPONSES_BASE_URL = "https://api.openai.com/v1";
+function sanitizeEffectiveBaseUrl(baseUrl) {
+    try {
+        const sanitized = new URL(baseUrl);
+        sanitized.username = "";
+        sanitized.password = "";
+        sanitized.search = "";
+        sanitized.hash = "";
+        return sanitized.toString();
+    }
+    catch {
+        return "invalid-endpoint:redacted";
+    }
+}
 /**
  * Model-call observability — emits STDERR logs for each LLM API call, covering
  * (a) pre-call model_id + provider + max_tokens, (b) post-call usage on success,
@@ -237,35 +280,47 @@ function assertNoUnsupportedReasoningEffort(provider, reasoningEffort) {
 // ---------------------------------------------------------------------------
 // Anthropic call
 // ---------------------------------------------------------------------------
-async function callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens, reasoningEffort) {
+async function callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens, reasoningEffort, thinkingMode) {
     const { default: Anthropic } = await import("@anthropic-ai/sdk");
     const client = new Anthropic({
         apiKey,
         timeout: DEFAULT_TIMEOUT_MS,
         maxRetries: DEFAULT_MAX_RETRIES,
     });
-    emitModelCallLog(`anthropic call: model="${modelId}" max_tokens=${maxTokens} effort=${reasoningEffort ?? "(unset)"}`);
+    emitModelCallLog(`anthropic call: model="${modelId}" max_tokens=${maxTokens} effort=${reasoningEffort ?? "(unset)"} thinking=${thinkingMode ?? "(default)"}`);
     let response;
     try {
         response = await client.messages.create({
             model: modelId,
             max_tokens: maxTokens,
-            // Reasoning depth is controlled by output_config.effort (GA, no beta
-            // header), but on opus-4.x effort only modulates *thinking* depth when
-            // adaptive thinking is enabled — without it the model runs without
-            // thinking, so configured effort would not be realized on this route.
-            // Pair the two so effort actually engages reasoning (matching the openai
-            // Responses and claude-CLI routes); effort also bounds overall token
-            // spend. The free-form seat string maps onto the API effort enum; absent
-            // → the API default (high) with no thinking (legacy behavior preserved).
-            ...(reasoningEffort
-                ? {
-                    thinking: { type: "adaptive" },
-                    output_config: {
-                        effort: reasoningEffort,
-                    },
-                }
-                : {}),
+            // Thinking configuration is a three-way choice, and every non-default
+            // branch is additive over the legacy no-op tail so an absent opt-in emits
+            // byte-identical request bytes:
+            //   thinking_mode="disabled" → thinking:{type:"disabled"} (explicit no
+            //     extended thinking; accepted on opus-4.7/4.8 and sonnet-5, rejected
+            //     by Fable 5). Takes precedence over effort: effort's only job on this
+            //     route is to modulate *thinking* depth, which is moot once thinking
+            //     is off, so output_config is not paired here.
+            //   reasoningEffort set → adaptive thinking paired with output_config.
+            //     effort (GA, no beta header). On opus-4.x effort only modulates
+            //     thinking depth when adaptive is enabled — without adaptive the model
+            //     runs without thinking, so configured effort would not be realized on
+            //     this route. Pairing the two makes effort actually engage reasoning
+            //     (matching the openai Responses and claude-CLI routes); effort also
+            //     bounds overall token spend. The free-form seat string maps onto the
+            //     API effort enum.
+            //   neither → no thinking block (API default: high, no thinking — legacy
+            //     behavior preserved).
+            ...(thinkingMode === "disabled"
+                ? { thinking: { type: "disabled" } }
+                : reasoningEffort
+                    ? {
+                        thinking: { type: "adaptive" },
+                        output_config: {
+                            effort: reasoningEffort,
+                        },
+                    }
+                    : {}),
             system: systemPrompt,
             messages: [{ role: "user", content: userPrompt }],
         });
@@ -284,11 +339,19 @@ async function callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxToken
         throw err;
     }
     emitModelCallLog(`anthropic success: model_id=${response.model ?? modelId} input_tokens=${response.usage.input_tokens} output_tokens=${response.usage.output_tokens}`);
-    // With adaptive thinking on (effort set), thinking shares the max_tokens
-    // budget; a max_tokens stop means the response was truncated and may carry
-    // partial/empty text. Fail loud rather than record a truncated artifact.
-    if (reasoningEffort && response.stop_reason === "max_tokens") {
-        throw new Error(`anthropic response truncated at max_tokens=${maxTokens} (effort=${reasoningEffort} reasoning exhausted the budget); raise max_tokens`);
+    // A max_tokens stop means the response was truncated and may carry
+    // partial/empty text — fail loud rather than record a truncated artifact.
+    // Both thinking-bearing branches are guarded: with adaptive thinking on
+    // (effort set) thinking shares the max_tokens budget; with thinking disabled
+    // the whole budget is the answer, so a cap still truncates it. The legacy
+    // no-opt path (neither set) stays unguarded, unchanged.
+    if ((reasoningEffort || thinkingMode === "disabled") &&
+        response.stop_reason === "max_tokens") {
+        throw new Error(`anthropic response truncated at max_tokens=${maxTokens}` +
+            (reasoningEffort
+                ? ` (effort=${reasoningEffort} reasoning exhausted the budget)`
+                : " (thinking disabled; answer exceeded the budget)") +
+            "; raise max_tokens");
     }
     const text = response.content
         .filter((block) => block.type === "text")
@@ -364,21 +427,44 @@ async function callOpenAI(systemPrompt, userPrompt, apiKey, modelId, maxTokens,
  * models). grok/lmstudio stay on Chat Completions via `callOpenAI` — they are
  * OpenAI-compatible Chat Completions endpoints with no Responses API.
  */
-async function callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, maxOutputTokens, reasoningEffort) {
+async function callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, baseMaxOutputTokens, reasoningEffort, outputHeadroomTokens, modelMaxOutputTokens) {
+    const budget = resolveOpenAIResponsesOutputBudget({
+        baseOutputTokens: baseMaxOutputTokens,
+        ...(outputHeadroomTokens !== undefined
+            ? { headroomTokens: outputHeadroomTokens }
+            : {}),
+        ...(modelMaxOutputTokens !== undefined
+            ? { modelMaxOutputTokens }
+            : {}),
+    });
     const { default: OpenAI } = await import("openai");
+    const effectiveBaseUrl = sanitizeEffectiveBaseUrl(outputHeadroomTokens === undefined
+        ? process.env.OPENAI_BASE_URL ?? OPENAI_RESPONSES_BASE_URL
+        : OPENAI_RESPONSES_BASE_URL);
+    const noOpLogger = {
+        error: () => { },
+        warn: () => { },
+        info: () => { },
+        debug: () => { },
+    };
     const client = new OpenAI({
         apiKey,
+        ...(outputHeadroomTokens !== undefined
+            ? { baseURL: OPENAI_RESPONSES_BASE_URL }
+            : {}),
         timeout: DEFAULT_TIMEOUT_MS,
         maxRetries: DEFAULT_MAX_RETRIES,
+        logLevel: "off",
+        logger: noOpLogger,
     });
-    emitModelCallLog(`openai call: model="${modelId}" max_output_tokens=${maxOutputTokens} effort=${reasoningEffort ?? "(unset)"}`);
+    emitModelCallLog(`openai call: model="${modelId}" max_output_tokens=${budget.effectiveMaxOutputTokens} effort=${reasoningEffort ?? "(unset)"}`);
     let response;
     try {
         response = await client.responses.create({
             model: modelId,
             instructions: systemPrompt,
             input: userPrompt,
-            max_output_tokens: maxOutputTokens,
+            max_output_tokens: budget.effectiveMaxOutputTokens,
             // Transient single-turn authoring/review calls; the Responses API stores
             // response objects provider-side by default (retrievable for ~30d). Opt
             // out so these prompts/outputs are not persisted — matches the
@@ -406,8 +492,55 @@ async function callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, ma
     // artifacts. Fail loud so the caller retries or surfaces it.
     if (response.status !== "completed") {
         const detail = response.incomplete_details?.reason ?? response.error?.message ?? "no detail";
-        emitModelCallLog(`openai call NOT COMPLETED: model="${modelId}" status=${response.status} detail=${detail} max_output_tokens=${maxOutputTokens}`);
-        throw new Error(`openai response not completed (status=${response.status}: ${detail}) at max_output_tokens=${maxOutputTokens} — raise max_output_tokens if truncated`);
+        emitModelCallLog(`openai call NOT COMPLETED: model="${modelId}" status=${response.status} detail=${detail} max_output_tokens=${budget.effectiveMaxOutputTokens}`);
+        if (response.status === "incomplete" &&
+            response.incomplete_details?.reason === "max_output_tokens") {
+            const usage = response.usage;
+            const inputTokens = typeof usage?.input_tokens === "number"
+                ? usage.input_tokens
+                : null;
+            const cachedInputTokens = typeof usage?.input_tokens_details?.cached_tokens === "number"
+                ? usage.input_tokens_details.cached_tokens
+                : null;
+            const outputTokens = typeof usage?.output_tokens === "number"
+                ? usage.output_tokens
+                : null;
+            const reasoningTokens = typeof usage?.output_tokens_details?.reasoning_tokens === "number"
+                ? usage.output_tokens_details.reasoning_tokens
+                : null;
+            const nonReasoningOutputTokens = outputTokens !== null && reasoningTokens !== null
+                ? Math.max(0, outputTokens - reasoningTokens)
+                : null;
+            const partialOutput = response.output_text ?? "";
+            throw new OpenAIResponsesIncompleteError({
+                failure_code: OPENAI_RESPONSES_MAX_OUTPUT_TOKENS_FAILURE_CODE,
+                provider_status: response.status,
+                incomplete_reason: "max_output_tokens",
+                base_output_ceiling_tokens: budget.baseOutputTokens,
+                configured_output_headroom_tokens: budget.headroomTokens,
+                effective_max_output_tokens: budget.effectiveMaxOutputTokens,
+                input_tokens: inputTokens,
+                cached_input_tokens: cachedInputTokens,
+                output_tokens: outputTokens,
+                reasoning_tokens: reasoningTokens,
+                non_reasoning_output_tokens: nonReasoningOutputTokens,
+                partial_output_chars: partialOutput.length,
+                partial_output_sha256: crypto
+                    .createHash("sha256")
+                    .update(partialOutput, "utf8")
+                    .digest("hex"),
+                provider_model: response.model ?? modelId,
+                provider_response_id: typeof response.id === "string" ? response.id : null,
+                provider_request_id: typeof response._request_id === "string"
+                    ? response._request_id
+                    : null,
+                effective_base_url: effectiveBaseUrl,
+                sdk_max_retries: DEFAULT_MAX_RETRIES,
+                actual_adapter_request_count: null,
+                request_count_observability: "unavailable",
+            });
+        }
+        throw new Error(`openai response not completed (status=${response.status}: ${detail}) at max_output_tokens=${budget.effectiveMaxOutputTokens}`);
     }
     const usage = response.usage;
     emitModelCallLog(`openai success: model_id=${response.model ?? modelId} input_tokens=${usage?.input_tokens ?? 0} output_tokens=${usage?.output_tokens ?? 0}`);
@@ -416,7 +549,7 @@ async function callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, ma
         input_tokens: usage?.input_tokens ?? 0,
         output_tokens: usage?.output_tokens ?? 0,
         model_id: modelId,
-        effective_base_url: "https://api.openai.com/v1",
+        effective_base_url: effectiveBaseUrl,
         declared_billing_mode: "per_token",
     };
 }
@@ -433,8 +566,9 @@ async function callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, ma
  *   --skip-git-repo-check lets the worker run from non-repo cwd. No -C/-s/-o:
  *   this is single-turn, no agentic scaffold.
  */
-async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort, serviceTier) {
+async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort, serviceTier, timeoutMs) {
     const { spawn } = await import("node:child_process");
+    const workerTimeoutMs = timeoutMs ?? DEFAULT_WORKER_TIMEOUT_MS;
     const args = ["exec", "--skip-git-repo-check", "--ephemeral"];
     if (modelId)
         args.push("-m", modelId);
@@ -444,7 +578,7 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
         args.push("-c", `service_tier="${serviceTier}"`);
     args.push("-");
     const combinedPrompt = `${systemPrompt}\n\n---\n\n${userPrompt}`;
-    emitModelCallLog(`codex call: model="${modelId ?? "(codex default)"}" effort="${reasoningEffort ?? "(unset)"}" service_tier="${serviceTier ?? "(unset)"}" timeout_ms=${DEFAULT_WORKER_TIMEOUT_MS}`);
+    emitModelCallLog(`codex call: model="${modelId ?? "(codex default)"}" effort="${reasoningEffort ?? "(unset)"}" service_tier="${serviceTier ?? "(unset)"}" timeout_ms=${workerTimeoutMs}`);
     const child = spawn("codex", args, {
         stdio: ["pipe", "pipe", "pipe"],
     });
@@ -483,7 +617,7 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
             }
             catch { /* already exited */ }
         }, WORKER_SIGKILL_GRACE_MS);
-    }, DEFAULT_WORKER_TIMEOUT_MS);
+    }, workerTimeoutMs);
     const clearTimers = () => {
         clearTimeout(timeoutHandle);
         if (sigkillHandle)
@@ -505,8 +639,8 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
         });
     });
     if (timedOut) {
-        emitModelCallLog(`codex call FAILED: model="${modelId ?? "(codex default)"}" reason=timeout timeout_ms=${DEFAULT_WORKER_TIMEOUT_MS}`);
-        throw new Error(`codex CLI call timed out after ${DEFAULT_WORKER_TIMEOUT_MS}ms`);
+        emitModelCallLog(`codex call FAILED: model="${modelId ?? "(codex default)"}" reason=timeout timeout_ms=${workerTimeoutMs}`);
+        throw new Error(`codex CLI call timed out after ${workerTimeoutMs}ms`);
     }
     if (exitCode !== 0) {
         const combined = [stderr.trim(), stdout.trim()]
@@ -610,8 +744,9 @@ function parseClaudeResultEvent(stdout) {
  * is the positional arg (piped stdin is not treated as the prompt), and no
  * project/user MCP servers are loaded so the worker has no side effects.
  */
-async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort) {
+async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort, timeoutMs) {
     const { spawn } = await import("node:child_process");
+    const workerTimeoutMs = timeoutMs ?? DEFAULT_WORKER_TIMEOUT_MS;
     const combinedPrompt = `${systemPrompt}\n\n---\n\n${userPrompt}`;
     const args = ["-p", combinedPrompt, "--output-format", "json"];
     if (modelId)
@@ -619,7 +754,7 @@ async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort)
     if (reasoningEffort)
         args.push("--effort", reasoningEffort);
     args.push("--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}');
-    emitModelCallLog(`claude call: model="${modelId ?? "(claude default)"}" effort="${reasoningEffort ?? "(unset)"}" timeout_ms=${DEFAULT_WORKER_TIMEOUT_MS}`);
+    emitModelCallLog(`claude call: model="${modelId ?? "(claude default)"}" effort="${reasoningEffort ?? "(unset)"}" timeout_ms=${workerTimeoutMs}`);
     const claudeBin = resolveClaudeBin();
     const child = spawn(claudeBin, args, { stdio: ["ignore", "pipe", "pipe"] });
     const claudeStreamSourceBase = {
@@ -650,7 +785,7 @@ async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort)
             }
             catch { /* already exited */ }
         }, WORKER_SIGKILL_GRACE_MS);
-    }, DEFAULT_WORKER_TIMEOUT_MS);
+    }, workerTimeoutMs);
     const clearTimers = () => {
         clearTimeout(timeoutHandle);
         if (sigkillHandle)
@@ -672,8 +807,8 @@ async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort)
         });
     });
     if (timedOut) {
-        emitModelCallLog(`claude call FAILED: model="${modelId ?? "(claude default)"}" reason=timeout timeout_ms=${DEFAULT_WORKER_TIMEOUT_MS}`);
-        throw new Error(`claude CLI call timed out after ${DEFAULT_WORKER_TIMEOUT_MS}ms`);
+        emitModelCallLog(`claude call FAILED: model="${modelId ?? "(claude default)"}" reason=timeout timeout_ms=${workerTimeoutMs}`);
+        throw new Error(`claude CLI call timed out after ${workerTimeoutMs}ms`);
     }
     if (exitCode !== 0) {
         const combined = [stderr.trim(), stdout.trim()]
@@ -730,7 +865,7 @@ async function dispatchByPlan(systemPrompt, userPrompt, config) {
     const maxTokens = config.max_tokens ?? 1024;
     if (plan.provider_identity === "codex") {
         const modelId = config.model_id ?? plan.model_id ?? config.models_per_provider?.codex;
-        return callCodexCli(systemPrompt, userPrompt, modelId, config.reasoning_effort, config.service_tier);
+        return callCodexCli(systemPrompt, userPrompt, modelId, config.reasoning_effort, config.service_tier, config.timeout_ms);
     }
     if (plan.provider_identity === "anthropic") {
         const apiKey = readEnvApiKey(config.api_key_env ? [config.api_key_env] : ["ANTHROPIC_API_KEY"]);
@@ -740,7 +875,7 @@ async function dispatchByPlan(systemPrompt, userPrompt, config) {
         const modelId = config.model_id ?? plan.model_id ?? config.models_per_provider?.anthropic;
         if (!modelId)
             throw missingModelError("anthropic");
-        return callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens, config.reasoning_effort);
+        return callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens, config.reasoning_effort, config.thinking_mode);
     }
     if (plan.provider_identity === "openai") {
         const apiKey = readOpenAiApiKey(config.api_key_env);
@@ -750,7 +885,7 @@ async function dispatchByPlan(systemPrompt, userPrompt, config) {
         const modelId = config.model_id ?? plan.model_id ?? config.models_per_provider?.openai;
         if (!modelId)
             throw missingModelError("openai");
-        return callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, maxTokens, config.reasoning_effort);
+        return callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, maxTokens, config.reasoning_effort, config.openai_responses_output_headroom_tokens, config.openai_responses_model_max_output_tokens);
     }
     if (plan.provider_identity === "grok") {
         assertNoUnsupportedReasoningEffort("grok", config.reasoning_effort);
@@ -790,11 +925,17 @@ export async function callLlm(systemPrompt, userPrompt, config) {
         config?.artifact_generation_realization === "semantic_mock") {
         return callReviewMockLlm(systemPrompt, userPrompt, config);
     }
+    if (config?.openai_responses_output_headroom_tokens !== undefined &&
+        (config.provider !== "openai" ||
+            config.execution_adapter !== "openai_sdk" ||
+            config.base_url !== undefined)) {
+        throw new Error("openai Responses output headroom reached an unsupported dispatch route.");
+    }
     if (config?.plan) {
         return dispatchByPlan(systemPrompt, userPrompt, config);
     }
     if (isLegacyCodexCliProvider(config)) {
-        return callCodexCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.codex, config.reasoning_effort, config.service_tier);
+        return callCodexCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.codex, config.reasoning_effort, config.service_tier, config.timeout_ms);
     }
     // Anthropic OAuth → Claude Code CLI worker. The model-switcher keeps
     // provider="anthropic" for OAuth (the brand lives in execution_adapter), so
@@ -803,7 +944,7 @@ export async function callLlm(systemPrompt, userPrompt, config) {
     // and the api_key SDK route below (output_config.effort) honor effort.
     if (config?.provider === "anthropic" &&
         config?.execution_adapter === "claude_code") {
-        return callClaudeCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.anthropic, config.reasoning_effort);
+        return callClaudeCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.anthropic, config.reasoning_effort, config.timeout_ms);
     }
     if (config?.provider === "grok") {
         assertNoUnsupportedReasoningEffort("grok", config.reasoning_effort);
@@ -831,19 +972,19 @@ export async function callLlm(systemPrompt, userPrompt, config) {
     switch (resolved.provider) {
         case "codex": {
             const modelId = config?.model_id ?? perProviderModel;
-            return callCodexCli(systemPrompt, userPrompt, modelId, config?.reasoning_effort, config?.service_tier);
+            return callCodexCli(systemPrompt, userPrompt, modelId, config?.reasoning_effort, config?.service_tier, config?.timeout_ms);
         }
         case "anthropic": {
             const modelId = config?.model_id ?? perProviderModel;
             if (!modelId)
                 throw missingModelError("anthropic");
-            return callAnthropic(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, config?.reasoning_effort);
+            return callAnthropic(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, config?.reasoning_effort, config?.thinking_mode);
         }
         case "openai": {
             const modelId = config?.model_id ?? perProviderModel;
             if (!modelId)
                 throw missingModelError("openai");
-            return callOpenAIResponses(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, config?.reasoning_effort);
+            return callOpenAIResponses(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, config?.reasoning_effort, config?.openai_responses_output_headroom_tokens, config?.openai_responses_model_max_output_tokens);
         }
         case "grok": {
             assertNoUnsupportedReasoningEffort("grok", config?.reasoning_effort);

package/dist/core-runtime/llm/mock-llm-realization.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
 import { parseRuntimeIssueDeliberationSchemaContext, parseRuntimeIssueStanceSchemaContext, parseRuntimeIssueSynthesisSchemaContext, parseRuntimeProblemFramingContext, } from "../cli/runtime-submit-context.js";
+import { packetHasResubmitErrorSpec } from "../cli/unit-resubmit.js";
 import { parseParticipatingLensPaths } from "../review/participating-lens-paths.js";
 export const REVIEW_MOCK_REALIZATION_ENV = "ONTO_LLM_MOCK";
 export function isReviewMockLlmRealizationEnabled(env = process.env) {
@@ -432,16 +433,46 @@ function issueArtifactArgs(unitId, packetText, toolCtx) {
             throw new Error(`Unsupported mock issue artifact unit: ${unitId}`);
     }
 }
-function issueStanceArgs(packetText) {
+/**
+ * 설계 A 픽스처 스위치 (F-A1/F-A2): 지정 렌즈의 stance 유닛이 허용 집합 밖
+ * evidence_ref를 제출해 실제 `issue_evidence_refs` 화이트리스트 검증을
+ * 거부당하게 한다.
+ * - `ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_LENSES`: csv 렌즈 id 또는 `*`.
+ * - `ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_MODE`: `persist`(기본, cap 소진
+ *   경로) | `correct_on_resubmit`(packet에 resubmit 오류 명세가 주입되면
+ *   유효 ref로 치유 — 오류 명세 전달의 E2E 증거).
+ */
+function stanceUnsupportedRefTargets(env = process.env) {
+    const raw = env.ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_LENSES;
+    if (!raw)
+        return null;
+    if (raw.trim() === "*")
+        return "*";
+    const lenses = raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    return lenses.length > 0 ? new Set(lenses) : null;
+}
+function issueStanceArgs(unitId, packetText) {
     const context = parseRuntimeIssueStanceSchemaContext(packetText);
+    const lensId = unitId.startsWith("issue-stance:")
+        ? unitId.slice("issue-stance:".length)
+        : unitId;
+    const targets = stanceUnsupportedRefTargets();
+    const healed = process.env.ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_MODE ===
+        "correct_on_resubmit" && packetHasResubmitErrorSpec(packetText);
+    const emitUnsupportedRef = targets !== null && (targets === "*" || targets.has(lensId)) && !healed;
     return {
-        stances: Object.entries(context.issue_evidence_refs).map(([issueId, refs]) => ({
+        stances: Object.entries(context.issue_evidence_refs).map(([issueId, refs], index) => ({
             issue_id: issueId,
             stance: "support",
             rationale: "Mock realization supports the low-severity issue framing.",
             root_hypothesis_position: "accepts",
             severity_position: "keeps",
-            evidence_refs: refs.slice(0, 1),
+            evidence_refs: emitUnsupportedRef && index === 0
+                ? [`mock-unsupported-ref:${lensId}`]
+                : refs.slice(0, 1),
         })),
     };
 }
@@ -502,7 +533,7 @@ async function executeSubmitTool(args) {
             await args.tool.execute(issueArtifactArgs(unitId, args.userPrompt, args.toolCtx), args.toolCtx);
             return;
         case "submit_issue_stance_response":
-            await args.tool.execute(issueStanceArgs(args.userPrompt), args.toolCtx);
+            await args.tool.execute(issueStanceArgs(unitId, args.userPrompt), args.toolCtx);
             return;
         case "submit_issue_deliberation_response":
             await args.tool.execute(issueDeliberationArgs(args.userPrompt), args.toolCtx);

package/dist/core-runtime/llm/model-switcher.js

@@ -31,7 +31,7 @@ export function normalizeLlmModelSwitcher(config) {
         throw new Error("auth=local currently requires provider=lmstudio.");
     }
     if (config.service_tier && !(provider === "openai" && auth === "oauth")) {
-        throw new Error("service_tier requires the external OAuth worker route with auth=oauth and provider=openai.");
+        throw new Error(`service_tier is only valid on the openai + auth=oauth (Codex) route; remove service_tier for provider=${provider} + auth=${auth}.`);
     }
     const model_id = config.model;
     const common = {

package/dist/core-runtime/llm/openai-responses-incomplete-error.js

@@ -0,0 +1,46 @@
+export const OPENAI_RESPONSES_MAX_OUTPUT_TOKENS_FAILURE_CODE = "openai_responses_max_output_tokens";
+export class OpenAIResponsesIncompleteError extends Error {
+    evidence;
+    constructor(evidence) {
+        super(`openai response not completed (status=${evidence.provider_status}: ` +
+            `${evidence.incomplete_reason}) at max_output_tokens=` +
+            `${evidence.effective_max_output_tokens}`);
+        this.name = "OpenAIResponsesIncompleteError";
+        this.evidence = evidence;
+    }
+}
+export function readOpenAIResponsesIncompleteEvidence(error) {
+    return error instanceof OpenAIResponsesIncompleteError
+        ? error.evidence
+        : null;
+}
+export function resolveOpenAIResponsesOutputBudget(args) {
+    if (args.headroomTokens === undefined) {
+        return {
+            baseOutputTokens: args.baseOutputTokens,
+            headroomTokens: 0,
+            effectiveMaxOutputTokens: args.baseOutputTokens,
+        };
+    }
+    if (!Number.isSafeInteger(args.headroomTokens) || args.headroomTokens <= 0) {
+        throw new Error("openai Responses output headroom must be a positive safe integer.");
+    }
+    if (args.modelMaxOutputTokens === undefined ||
+        !Number.isSafeInteger(args.modelMaxOutputTokens) ||
+        args.modelMaxOutputTokens <= 0) {
+        throw new Error("openai Responses output headroom requires a positive model max_output_tokens capability.");
+    }
+    const effective = args.baseOutputTokens + args.headroomTokens;
+    if (!Number.isSafeInteger(effective)) {
+        throw new Error("openai Responses effective max_output_tokens is not a safe integer.");
+    }
+    if (effective > args.modelMaxOutputTokens) {
+        throw new Error(`openai Responses effective max_output_tokens=${effective} exceeds ` +
+            `model max_output_tokens=${args.modelMaxOutputTokens}.`);
+    }
+    return {
+        baseOutputTokens: args.baseOutputTokens,
+        headroomTokens: args.headroomTokens,
+        effectiveMaxOutputTokens: effective,
+    };
+}