From deea8d95923fba3ce35f6438635c83ba6f6ef011 Mon Sep 17 00:00:00 2001 From: toki Date: Sat, 15 Aug 2026 06:51:03 +0900 Subject: [PATCH] fix(openai): validate stages before caller projection --- .../outer/anthropic-compatible-api.md | 4 ++++ agent-contract/outer/openai-compatible-api.md | 2 +- agent-spec/input/openai-compatible-surface.md | 1 + apps/edge/internal/openai/hot_path_dispatch.go | 18 +++++++++++++----- apps/edge/internal/openai/hot_path_light.go | 10 ++++++---- 5 files changed, 25 insertions(+), 10 deletions(-) diff --git a/agent-contract/outer/anthropic-compatible-api.md b/agent-contract/outer/anthropic-compatible-api.md index 3db20042..5f1b8388 100644 --- a/agent-contract/outer/anthropic-compatible-api.md +++ b/agent-contract/outer/anthropic-compatible-api.md @@ -123,6 +123,10 @@ arguments/input. SDK-added text, thinking, and provider metadata decorations are part of that issue identity; the retained request prefix and exact result IDs remain independently validated. +Work/Review provider deltas are collected through the bounded internal stage before +caller projection. Edge validates and maps canonical operations to the selected caller +binding first, so an internal tool name is never released early on a Messages stream. + A preset marked with `single_request` is excluded from this continuation before caller tool binding. Config validation rejects a preset that declares both `single_request` and `workspace_tools`, so the operator-owned Node workspace and diff --git a/agent-contract/outer/openai-compatible-api.md b/agent-contract/outer/openai-compatible-api.md index 2d1a8e6b..634f0152 100644 --- a/agent-contract/outer/openai-compatible-api.md +++ b/agent-contract/outer/openai-compatible-api.md @@ -267,7 +267,7 @@ Provider-pool raw passthrough route는 위 목록을 provider request allowlist Chat Completions의 실행 경로는 caller가 보낸 `model`의 route/provider capability로 결정한다. - provider-pool model group route(`models[]`)는 candidate를 선택한 뒤 selected provider가 OpenAI-compatible 호출 방식을 지원하면 provider HTTP status/header/body를 Node가 열어 기존 Edge-Node tunnel로 relay하고, Edge가 caller에게 쓴다. 요청 body는 라우팅에 필요한 envelope만 읽고 `model` alias를 selected provider의 served target으로 rewrite하는 것을 기본으로 하며, provider가 지원하는 OpenAI-compatible field와 provider extension field를 보존한다. -- Provider-pool Chat과 unmarked caller-workspace의 selector/Work/Review 요청은 selected protocol profile이 선언한 출력 상한 wire spelling을 사용한다. OpenAI Chat wire는 `max_completion_tokens`, Gemini Chat wire는 `max_tokens`로 정규화한다. 형식이 bounded인 selector PLAN/REVIEW seed는 caller SDK의 큰 기본 completion limit과 분리해 최대 4096 output tokens만 허용한다. Selector provider에는 prepare 단계의 canonical `prepare(path)` 또는 pair-write 단계의 단일 `iop_write_artifact_pair(plan_content,review_content)` schema만 보여준다. Edge는 검증된 atomic pair를 PLAN/REVIEW 두 write로 확장하고 admitted caller tool의 실제 schema(예: `bash(command)`)로 각각 encode해 caller에게 투영한다. 따라서 selector에게 두 parallel tool call 생성을 요구하지 않는다. Work/Review provider가 반환한 canonical reserved-artifact operation 이름도 선택된 caller binding의 실제 tool 이름으로 정규화한 뒤 같은 codec으로 encode한다. Caller continuation은 SDK가 assistant message에 추가·생략하는 content/reasoning/provider metadata가 아니라 발행된 tool-call ID·이름·arguments의 의미 해시로 issue를 결속한다. Unmarked 내부 stage가 function tools와 reasoning effort를 함께 요구하고 selected OpenAI profile의 Chat wire가 이를 지원하지 않으면, 같은 profile의 Responses operation이 두 요구를 보존할 때 내부 wire만 Responses로 전환한다. 이 내부 operation은 body와 tunnel metadata 모두 `stream=false`인 단일 buffered stage이며, provider가 거부하는 generic SDK sampling defaults인 `temperature`와 `top_p`를 전달하지 않고 mapped effort를 generation control로 사용한다. Result decoder는 caller protocol이 아니라 selected operation을 우선하여 Responses JSON을 기존 hot-path 공통 stage shape로 복원하며, caller-visible Chat surface와 caller/agent identity로 분기하지 않는다. +- Provider-pool Chat과 unmarked caller-workspace의 selector/Work/Review 요청은 selected protocol profile이 선언한 출력 상한 wire spelling을 사용한다. OpenAI Chat wire는 `max_completion_tokens`, Gemini Chat wire는 `max_tokens`로 정규화한다. 형식이 bounded인 selector PLAN/REVIEW seed는 caller SDK의 큰 기본 completion limit과 분리해 최대 4096 output tokens만 허용한다. Selector provider에는 prepare 단계의 canonical `prepare(path)` 또는 pair-write 단계의 단일 `iop_write_artifact_pair(plan_content,review_content)` schema만 보여준다. Edge는 검증된 atomic pair를 PLAN/REVIEW 두 write로 확장하고 admitted caller tool의 실제 schema(예: `bash(command)`)로 각각 encode해 caller에게 투영한다. 따라서 selector에게 두 parallel tool call 생성을 요구하지 않는다. Work/Review provider가 반환한 canonical reserved-artifact operation 이름도 선택된 caller binding의 실제 tool 이름으로 정규화한 뒤 같은 codec으로 encode한다. 이 변환이 필요한 내부 stage는 provider delta를 caller에게 선행 방출하지 않고 bounded stage를 수집·검증·매핑한 뒤 endpoint-native 응답으로 한 번 투영한다. Caller continuation은 SDK가 assistant message에 추가·생략하는 content/reasoning/provider metadata가 아니라 발행된 tool-call ID·이름·arguments의 의미 해시로 issue를 결속한다. Unmarked 내부 stage가 function tools와 reasoning effort를 함께 요구하고 selected OpenAI profile의 Chat wire가 이를 지원하지 않으면, 같은 profile의 Responses operation이 두 요구를 보존할 때 내부 wire만 Responses로 전환한다. 이 내부 operation은 body와 tunnel metadata 모두 `stream=false`인 단일 buffered stage이며, provider가 거부하는 generic SDK sampling defaults인 `temperature`와 `top_p`를 전달하지 않고 mapped effort를 generation control로 사용한다. Result decoder는 caller protocol이 아니라 selected operation을 우선하여 Responses JSON을 기존 hot-path 공통 stage shape로 복원하며, caller-visible Chat surface와 caller/agent identity로 분기하지 않는다. - selected provider가 Ollama/native provider처럼 normalized execution을 요구하면 Edge는 normalized `RunRequest` path를 사용한다. 이 경로는 OpenAI-compatible 표면을 입력/출력 compatibility layer로 제공하되, backend 호출은 normalized adapter 계약을 따른다. - `metadata`는 경로 선택자가 아니다. Edge는 route 결정 뒤 인증 principal, usage/observability 등 IOP가 아는 bounded metadata key만 발췌한다. 이 발췌 정보는 provider body를 바꾸는 selector가 아니며, passthrough 응답 body에 IOP marker/event/envelope를 섞지 않는다. - Chat Completions 성공 응답의 top-level `model` echo가 provider-served model이면 caller가 요청한 IOP model alias로 정규화할 수 있다. reasoning/content/tool_calls 같은 provider payload field는 보존한다. diff --git a/agent-spec/input/openai-compatible-surface.md b/agent-spec/input/openai-compatible-surface.md index e3683113..11ee2398 100644 --- a/agent-spec/input/openai-compatible-surface.md +++ b/agent-spec/input/openai-compatible-surface.md @@ -376,6 +376,7 @@ sequenceDiagram - 2026-08-15: Replaced probabilistic parallel PLAN/REVIEW selector calls with one canonical atomic artifact-pair call that Edge deterministically expands into the same two admitted caller writes. - 2026-08-15: Bound continuation issue identity to semantic tool calls so compatible SDK decoration of assistant messages does not break an otherwise exact caller receipt. - 2026-08-15: Normalized Work/Review canonical reserved-artifact operation names through the selected caller binding before encoding them into structured or command-mode caller tools. +- 2026-08-15: Buffered each bounded Work/Review provider stage until canonical operation validation and caller-binding projection complete, preventing internal tool deltas from escaping before normalization. - 2026-08-14: Added the Edge-owned provider-side selector instruction for unmarked caller-workspace initial/resume turns. Actual Chat/Messages bodies now carry the exact request-local relative paths and accepted PLAN/pending REVIEW grammar without changing caller snapshots or public schemas. - 2026-08-14: Added the restored unmarked caller-workspace light route, including template-validated PLAN/pending REVIEW creation, worker-owned completed REVIEW handoff, reviewer reads/result inspection/repair, reviewer-owned non-empty terminal, and strict separation from marked Node-owned `single_request` presets. - 2026-08-14: Added bounded read/list-first workspace analysis inside the marked Plan stage. Successful inspection is required before structured Plan completion, while mutation tools, a separate analysis artifact, and caller-visible schema changes remain absent. diff --git a/apps/edge/internal/openai/hot_path_dispatch.go b/apps/edge/internal/openai/hot_path_dispatch.go index 352dcc22..4f63fecf 100644 --- a/apps/edge/internal/openai/hot_path_dispatch.go +++ b/apps/edge/internal/openai/hot_path_dispatch.go @@ -1316,10 +1316,11 @@ func (s *Server) submitHotPathStage(ctx context.Context, r *http.Request, snapsh if shouldProgressivelyReleaseHotPathStage(snapshot, outer) { return s.runHotPathLiveTunnelStage(ctx, snapshot, outer, handle, dispatch) } - output, collectErr := s.collectHotPathOwnedTunnelStage(ctx, snapshot.StageID, outer, handle, dispatch, "openai") + output, collectErr := s.collectHotPathOwnedTunnelStage(ctx, snapshot.StageID, nil, handle, dispatch, "openai") if collectErr != nil { return normalizedStageOutput{}, hotPathStageCorrelation{}, collectErr } + output.CallerStageOnly = true return output, stageCorrelation(snapshot.StageID, output, dispatch), nil } handle, submitErr := s.service.SubmitRun(ctx, runReq) @@ -1330,10 +1331,11 @@ func (s *Server) submitHotPathStage(ctx context.Context, r *http.Request, snapsh if shouldProgressivelyReleaseHotPathStage(snapshot, outer) { return s.runHotPathLiveNormalizedStage(ctx, snapshot, outer, handle, dispatch) } - output, collectErr := s.collectHotPathOwnedNormalizedStage(ctx, snapshot.StageID, outer, handle, dispatch) + output, collectErr := s.collectHotPathOwnedNormalizedStage(ctx, snapshot.StageID, nil, handle, dispatch) if collectErr != nil { return normalizedStageOutput{}, hotPathStageCorrelation{}, collectErr } + output.CallerStageOnly = true return output, stageCorrelation(snapshot.StageID, output, dispatch), nil } @@ -1384,10 +1386,10 @@ func (s *Server) submitHotPathStage(ctx context.Context, r *http.Request, snapsh } switch result.Path { case edgeservice.ProviderPoolPathNormalized: - output, err = s.collectHotPathOwnedNormalizedStage(ctx, snapshot.StageID, outer, result.Run, result.DispatchInfo) + output, err = s.collectHotPathOwnedNormalizedStage(ctx, snapshot.StageID, nil, result.Run, result.DispatchInfo) case edgeservice.ProviderPoolPathTunnel: output, err = s.collectHotPathOwnedTunnelStage( - ctx, snapshot.StageID, outer, result.Tunnel, result.DispatchInfo, hotPathStageWireProtocol(result.DispatchInfo), + ctx, snapshot.StageID, nil, result.Tunnel, result.DispatchInfo, hotPathStageWireProtocol(result.DispatchInfo), ) default: s.abortHotPathRejectedDispatch(rejection) @@ -1399,6 +1401,7 @@ func (s *Server) submitHotPathStage(ctx context.Context, r *http.Request, snapsh if err != nil { return normalizedStageOutput{}, hotPathStageCorrelation{}, err } + output.CallerStageOnly = true if strings.TrimSpace(output.ResponseID) == "" { return normalizedStageOutput{}, hotPathStageCorrelation{}, fmt.Errorf("hot path stage completion is missing provider identity") } @@ -1406,7 +1409,12 @@ func (s *Server) submitHotPathStage(ctx context.Context, r *http.Request, snapsh } func shouldProgressivelyReleaseHotPathStage(snapshot hotPathDispatchSnapshot, outer *hotPathOuterTurn) bool { - return snapshot.Stream && (snapshot.Protocol == "openai" || snapshot.Protocol == "anthropic") && outer != nil + // Work/Review provider calls use canonical workspace operations that may + // need caller-binding normalization (for example read(path) -> bash(command)). + // Releasing provider deltas before classification would let the caller run + // an unbound internal tool call. Collect the bounded stage first, then project + // only the validated caller-visible output. + return false } // newHotPathRejectedDispatchOwner builds one result-scoped disposal owner for a diff --git a/apps/edge/internal/openai/hot_path_light.go b/apps/edge/internal/openai/hot_path_light.go index 82206e44..4d5b8487 100644 --- a/apps/edge/internal/openai/hot_path_light.go +++ b/apps/edge/internal/openai/hot_path_light.go @@ -468,7 +468,7 @@ func (s *hotPathLightStore) issueTools( stageID = record.reviewStageID } if outer != nil { - if !output.ProgressivelyReleased { + if !output.ProgressivelyReleased && !output.CallerStageOnly { if err := runHotPathCollectedStage(ctx, outer, stageID, mapped); err != nil { return normalizedStageOutput{}, fmt.Errorf("collect light tool outer turn: %w", err) } @@ -478,8 +478,10 @@ func (s *hotPathLightStore) issueTools( outer.commitLengthTerminal() return hotPathCompatibilityOutput(outer, mapped.StageResponseOverlay(visible), record.protocol), nil } - if err := outer.projectToolIdentities(mapped.ToolCalls); err != nil { - return normalizedStageOutput{}, err + if !output.CallerStageOnly { + if err := outer.projectToolIdentities(mapped.ToolCalls); err != nil { + return normalizedStageOutput{}, err + } } } mapped = mapped.StageResponseOverlay(visible) @@ -1015,7 +1017,7 @@ func (s *Server) runHotPathLightStage(w http.ResponseWriter, r *http.Request, di // endpoint codecs consume released deltas directly. Feed the same // output into the sequencer now so its usage and terminal boundary span // local→review transitions in this HTTP turn. - if len(output.ToolCalls) == 0 && !output.ProgressivelyReleased { + if len(output.ToolCalls) == 0 && !output.ProgressivelyReleased && !output.CallerStageOnly { if err := runHotPathCollectedStage(r.Context(), outer, snapshot.StageID, output); err != nil { return s.writeHotPathPrimaryError(w, r, dispatch, protocol, stream, requestID, hotPathLightEndpointError(protocol, http.StatusBadGateway, err.Error()))