Registering a component

status  ·  probe  ·  probeInvoked  ·  tools  ·  lastProbedAt  ·  authRef

zModelRegistration + { status: 'available' }     REFUSED
zModelRegistration + { probe: … }                REFUSED
zModelRegistration + { probeInvoked: true }      REFUSED
zModelRegistration + { tools: [ … ] }            REFUSED
zModelRegistration + { authRef: 'secret:…' }     REFUSED
zModelRegistration + { lastProbedAt: '…' }       REFUSED

POST /registries/models { …, apiKey: "…" }
   │
   ├─ parse against zModelRegistration
   ├─ split apiKey OFF the record  ← before anything is stored
   ├─ write it to Secrets Manager as verifi/engine/<stage>/<registry>/<id>
   ├─ store the record with authRef: "secret:verifi/engine/<stage>/<registry>/<id>"
   └─ 201 { entry }                ← carries authRef, NEVER the key

export const zModelRegistration = z.object({
  id: z.string().min(1),
  displayName: z.string().min(1),
  provider: zModelProvider,                    // bedrock | anthropic | openai_compat | nim | vertex | local
  /** The provider's own identifier. */
  modelId: z.string().min(1),
  tier: zModelTier,                            // frontier | balanced | fast | local

  capabilities: z.object({
    maxContextTokens: z.number().int().positive(),
    maxOutputTokens: z.number().int().positive(),
    supportsTools: z.boolean(),
  }).optional(),
  costModel: z.object({
    inputPer1kUsd: z.number().nonnegative(),
    outputPer1kUsd: z.number().nonnegative(),
  }).optional(),

  /** What to actually INVOKE with — a cross-region inference profile id where one is needed. */
  invocationId: z.string().min(1).optional(),

  /** Required for every provider except bedrock. Consumed in flight, never stored. */
  apiKey: zApiKey.optional(),
  /** Required for openai_compat / nim, where there is no safe default host. */
  baseUrl: z.string().url().optional(),
  /** Required for bedrock. */
  region: z.string().min(1).optional(),
}).strict()
  .refine(/* keyed provider ⇒ apiKey */)
  .refine(/* openai_compat | nim ⇒ baseUrl */)
  .refine(/* bedrock ⇒ region */);

export const zMcpRegistration = z.object({
  id: z.string().min(1),
  name: z.string().min(1),
  /** Slot kind this server can fill: 'recon', 'web_proxy', 'cloud', 'exec', 'kb'… */
  kind: z.string().min(1),
  /** An already-running server to probe. */
  endpoint: z.string().url().optional(),
  /** Or an image to trial: start it, probe it, record what it serves, tear it down. */
  image: z.string().min(1).optional(),
  transport: z.enum(['sse', 'http', 'stdio']).default('http'),
  /** ⛔ `shared` is absent from this enum on purpose. */
  concurrencyModel: zConcurrencyModel.exclude(['shared']).default('sidecar'),
}).strict()
  .refine((m) => Boolean(m.endpoint) || Boolean(m.image), …);

{ id, name, kind, endpoint }                       accepted
{ id, name, kind, image }                          accepted
{ id, name, kind }                                 REFUSED  (nothing to probe)
{ …, concurrencyModel: 'shared' }                  REFUSED
{ …, tools: [{ name: 'run_command' }] }            REFUSED  (a tool list is what a probe FOUND)
defaults                                           { transport: 'http', concurrencyModel: 'sidecar' }

export const zHarnessRegistration = z.object({
  id: z.string().min(1),
  name: z.string().min(1),
  /**
   * The ECS task-definition family or image. A harness SERVES NOTHING — it dials out,
   * works and exits — so there is deliberately no endpoint here.
   */
  image: z.string().min(1),
  /** REQUIRED, and a DIGEST, not a tag. */
  imageDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/, 'must be a sha256 digest, not a tag'),
  semver: z.string().min(1).optional(),
}).strict();

imageDigest: 'sha256:' + 64 hex chars   accepted
imageDigest: 'v1.2.0'                   REFUSED  "must be a sha256 digest, not a tag"
imageDigest omitted                      REFUSED

export const zKbRegistration = z.object({
  id: z.string().min(1),
  name: z.string().min(1),
  /** The KB's MCP endpoint. */
  endpoint: z.string().url(),
  /** Consumed in flight; stored as `secret:<id>`. */
  apiKey: zApiKey,
  domain: z.string().min(1).optional(),
}).strict();

POST /registries/:registry        parse → split apiKey → store as `probing` → 201 { entry }
GET  /registries/:registry        { entries }   ?status= to filter
POST /registries/:registry/:id/probe    the ONLY path to `available`
POST /registries/:registry/:id/status   operator change; CANNOT set `available`, needs a reason