feat(pi): preserve the credential catalog in model projection

[luokerenx4]

A credential may already expose several models in OpenAlice's catalog, but Pi receives only the selected model and cannot switch to its siblings through the managed provider. This Draft addresses that remaining projection part of #703. Per-Issue execution budgets and credential catalogs already exist; this does not add a workflow engine or finalizer.

flowchart LR
  A[One credential and its local catalog] --> B[Existing Session model selection]
  B --> C[Before: register only selected model]
  C --> D[FAIL: sibling models absent in Pi]
  A --> E[After: reuse validated local catalog]
  E --> F[Existing Pi provider registers model list]
  B --> F
  F --> G[Scalar default plus available sibling models]
  H[Workspace reconciliation] --> I[Preserve siblings when adding missing selection]
  I --> F

Loading

The existing catalog reader now exposes the full local list; single-model lookup reuses it. Pi receives only model IDs and its existing context/reasoning registration fields. Each model's known facts use the existing semantic projection. Only the selected model gets explicit Session overrides. A manually selected ID remains available even when absent from the catalog; successful empty catalogs do not acquire guessed siblings.

The existing Pi provider builder, Workspace readback and reconciliation preserve those rows. Credentials remain one provider-level secret and one endpoint/wire binding; defaults remain scalar. Other runtime adapters retain scalar injection. No new provider registry, discovery request at launch, stored credential schema, migration, permission policy or user-managed provider rewrite.

Tradeoffs: catalog membership is advisory and can be stale; this projects the existing local snapshot, not a promise that every endpoint supports every catalog ID on every configured wire. Pi's native model switch does not rewrite OpenAlice's saved Session default. Large native-process environment payloads and native Windows/macOS packaging remain acceptance risks pending native runtime checks. The change does not introduce a second catalog store to solve those boundaries.

Validation:

• 195 targeted tests passed: credential projection, provider catalog, native config lifecycle and Session bindings; root TypeScript and diff check passed.
• Broader related closure: 686 passed, six Workspace-absorb tests failed because bundled Git could not download. Those same six passed using Dugite's supported LOCAL_GIT_DIRECTORY=/usr override. No product changes were made for the environment failure.
• Temporary Workspace tests verify write/read/reconciliation and per-process Pi projection retain sibling models, selected overrides do not leak to siblings, unrelated providers survive, and foreign credential caches/empty lists do not seed the wrong catalog.
• Actual packaged Pi/Electron smoke is unavailable: this environment has neither a Pi runtime nor the managed payload, and native binary downloads failed. No live model calls were made. Native model-picker and large-catalog acceptance remain required before acceptance.

Deferred part of #703: an always-finalizer needs explicit ownership of retries, failure status and reserved budgets. The maintainer's current issue discussion leaves workflow control open; this PR deliberately makes no workflow abstraction or guarantee. Open #1728 owns UI model identity/revalidation and does not change this Pi backend projection; its owner-guide edit overlaps this guide.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Oct 2, 2026 10:39am UTC