fix(management): validate modelSupportsVerbosity record shape

[luvs01]

Summary

• providerManagementConfigError shape-checked sibling capability records (modelSupportsReasoningSummaries, modelSuppressSyntheticMax) but not modelSupportsVerbosity, so an invalid value (array, non-boolean values, empty keys) could persist and reach consumers unchecked.
• Adds the same booleanRecordConfigError validation for modelSupportsVerbosity, plus route-level coverage for accepted/rejected shapes.

Verification

• bun test tests/server/management-provider-verbosity.test.ts - 1 passed; preserves the route-level acceptance, rejection, and persisted-config assertions after moving them out of the capped test file.
• bun test --timeout 60000 tests/ci-workflows/file-size-ratchet.test.ts - 9 passed; file-size caps are unchanged.
• bun test tests/test-layout.test.ts - 2 passed.
• bun test tests/test-layout-tooling.test.ts - 16 passed.
• bun run typecheck - passed.
• Cross-platform CI is running for head 0e97a45452a9fa13df252f0ee9b5802f65d44081; this PR remains draft until that result is checked.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Provider management now validates verbosity capability settings and rejects incorrectly formatted values with a clear error response.

• Tests

  • Added coverage for accepting valid verbosity settings and rejecting invalid values when creating providers.
  • Added the new test to the server test layout and expected test mapping.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1ba01abc-2a9f-4528-8362-332c742d6a9d

📥 Commits

Reviewing files that changed from the base of the PR and between 3f5c4f8 and 0e97a45.

📒 Files selected for processing (3)

• scripts/test-layout/layout.json
• tests/fixtures/test-layout-expected.json
• tests/server/management-provider-verbosity.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The provider management validation now checks modelSupportsVerbosity with booleanRecordConfigError. New tests cover valid persistence and rejection of invalid records. Test-layout mappings classify the new test under server.

Changes

Provider verbosity validation

Layer / File(s)	Summary
Validate and test model verbosity configuration src/server/auth-cors.ts, tests/server/management-provider-verbosity.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json	providerManagementConfigError rejects invalid modelSupportsVerbosity records with a provider-specific error. The test accepts { terse: false }, verifies persistence, and rejects arrays, string values, and empty keys with HTTP 400. Test-layout data maps the new test to server.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 0e97a

The provider-management endpoint rejects malformed verbosity records while preserving valid configurations, with no current merge-blocking risk evidenced.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: validating the shape of the modelSupportsVerbosity record in provider management configuration. This matches the implementation and added r…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/server/auth-cors.ts.

[lidge-jun]

리뷰 · 우선순위 59 / 80

이 PR은 관리 화면에서 제공자 설정을 저장할 때, modelSupportsVerbosity 값의 모양을 검사하지 않던 구멍을 막습니다. 같은 종류의 지도인 modelSupportsReasoningSummaries와 modelSuppressSyntheticMax는 이미 booleanRecordConfigError로 걸렀는데, verbosity만 빠져 있었습니다. 그래서 배열이거나, 값이 불리언이 아니거나, 키 문자열이 비어 있어도 디스크에 남을 수 있었습니다. 이번 변경은 providerManagementConfigError 안에 형제와 같은 검사 두 줄을 넣고, /api/providers POST로 좋은 값·나쁜 값을 받는 테스트를 형제와 같은 꼴로 붙였습니다. 베이스는 dev가 맞습니다. types.ts/config.ts 분할과 무관하고, 같은 주제로 닫을 다른 열린 PR도 없습니다. 본문에 적힌 로컬 테스트·타입체크는 이 원격 머리에서 다시 돌리지 않았습니다. 호스티드 CI는 글을 쓰는 지금 hygiene 실패·label 통과·resolve-pr 대기 상태입니다.

라인 - tests/server/management-provider-validation.test.ts: 이 브랜치 머지 베이스는 5498줄이고, 이 PR이 30줄을 더해 5528줄이 됩니다. 저장소 캡은 tests/fixtures/file-size-baseline.json의 5506입니다. 그대로면 file-size ratchet이 빨개집니다. 예전에도 같은 파일은 형제 파일로 케이스를 옮기는 처방(#5011, #5018 계열)을 썼습니다.

라인 - hygiene / 라벨 intake: hygiene-blocked: 경로가 src/server/auth-cors.ts라 unsponsored_surface로 막혔습니다. 실제 변경은 검증 두 줄뿐이고 CORS·인증 로직을 바꾸지 않지만, 레인은 메인테이너가 보고 maintainer-sponsored를 붙이기 전에는 진행이 안 됩니다.

라인 - PR 본문 체크리스트: 세 칸 모두 비어 있습니다. 범위는 이미 좁고, 문서·릴리즈 노트는 이 구멍 막기에 필수는 아니어 보입니다. 다만 Ready 전에 체크는 채우는 편이 좋습니다.

라인 - supportsVerbosity(제공자 전체 불리언): 에디터 필드로 열려 있지만, 이번 검사와 같은 함수 안에서 typeof === "boolean" 가드가 없습니다. 이번 PR 범위 밖인 형제 구멍입니다. 이번 머지를 막을 이유는 아닙니다.

메인테이너의 판단이 필요한 지점

auth-cors 경로의 검증 한 줄 추가를 보안 표면으로 보고 sponsored를 붙일지, 아니면 검증만의 변경이라 짧은 확인 뒤 바로 붙일지. 테스트 30줄을 같은 파일에 두고 캡을 넘기게 둘지(불가에 가깝다), 형제 파일로 바로 쪼갤지.

너의 추천

코드 방향은 맞고 머지 후보다다. 먼저 verbosity 테스트를 형제 파일로 옮겨 file-size 캡 아래로 맞추고, 메인테이너가 검증-only임을 확인한 뒤 maintainer-sponsored를 붙이세요. 그다음 exact-head에서 해당 server 테스트·래칫이 초록이면 머지하면 됩니다. supportsVerbosity 불리언 가드는 후속 한 줄로 열어도 됩니다. types/config 분할로 닫을 PR이 아니고, 중복 닫기 대상도 없습니다. preview deploy 이야기는 하지 않았습니다.

이 댓글은 grok-bot이 작성했습니다

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[luvs01]

This PR is held at the gate on unsponsored_surface (authentication/workflow/release/dependency surface per MAINTAINERS.md). Requesting maintainer review and the maintainer-sponsored label.

[luvs01]

Consolidated into #5529 in native Stack #5505.

Source head: 0e97a45452a9fa13df252f0ee9b5802f65d44081. Replacement head: d11f35f56f1da8bcf38e9db788d14892a49c31ee.

Source commits match by stable Git patch ID. Follow-up d11f35f fixes case-folded cap handling and moves the unchanged exclusion regression into a registered sibling file. Focused combined-head tests: 44 passed; prepared catalog tests: 515 passed. Full CI, docs build and independent review remain pending.

Closing this duplicate standalone review entry at the author's request after verifying migration. This is not a merge or release claim; remaining integration checks and reviews are tracked on the draft replacement. Original branches are retained.