worker: separate requested, resolved, observed and actually-used model identity

[thegeorgepu]

Subject — AUTHORITATIVE

repo        getsimpledirect/vinci-code-cli
branch      s03/generation-identity
head        534fd26eb6627026002b85c8ba6cba820b739694
base        c7695a7f77a4ee471af5f3e70db21a4997d4b53a
predecessor d6554d34efe2c0a39094b7d4381888ec90f1b0c9   (reviewed; production-equivalent, superseded by tests-only successors)
predecessor b4ac707d5b0c87e1b1db45b9bfaa0cdf96d101a3   (reviewed PASS_WITH_LIMITATIONS by S03-R2; superseded by a comment-only successor)
supersedes  96ebc352404ee70b7b34aee6f7ee37f865eace19   (reviewed NO-GO -- do not review)

🔴 Review 534fd26e only. That is the current head and the only review subject. 96ebc352 was reviewed and returned NO-GO; both of its findings are repaired above it. d6554d34 is the previously reviewed predecessor and is production-equivalent to this head; it was superseded by tests-only successors and is no longer the review subject. b4ac707d was reviewed by S03-R2 (PASS_WITH_LIMITATIONS) and differs from 534fd26e by a single comment-only correction closing that review's RC-2, so no production byte differs between them. 534fd26e itself has not yet been reviewed. See the UPDATE section at the end of this description.

12 commits, 7 files, all inside vinci/worker/**, vinci/extensions/**, vinci/test/**. No packages/** change. vinci/worker/task.mjs untouched, so TRIPLE_KEYS, TERMINAL_STATES, TRANSITIONS and materializeEnvelope's contract are unchanged.

Not to be squashed or rebased: individual commits carry the load-bearing controls, including the one proving the consumption binding itself discriminates.

What this closes

An adoption claim must be impossible when the model that actually served a run is unknown. Three facts were previously fused into one field, in two independent places (usage-accumulator.ts:157 and task-outcome.ts:309, both responseModel ?? model), so a consumer reading usage[].model could not tell an observed agreement from a provider that reported nothing.

buildFallbackModel makes that indistinguishability load-bearing: it returns another model's entire configuration relabelled with the requested id, so downstream resolved == requested and every identity keyed on model.id reports the request back as though it were an observation.

Interface

generation_identity, on the economics summary and carried into the evidence bundle:

field	meaning
observation	observed | unavailable | conflict — three states, never a boolean
requested_provider / requested_model	caller intent
resolved_model / resolved_models	routing decision
observed_provider / observed_model / observed_models	provider/runtime evidence only
observation_source	which channel established identity
used_generation_id / used_generation_ids	immutable generation identity actually consumed
observed_generation_ids	the generations whose identity was machine-observed
model_calls / observed_model_calls / unobserved_model_calls
matches_requested	true / false / null when nothing was measured

observed_model is only ever a value the provider put on the wire. It is never derived from the requested or resolved id. When nothing was observed it is null, observation is unavailable, and matches_requested is null — never false, because we did not measure a mismatch, we failed to measure.

Producer and consumers

Producer: vinci/worker/economics.mjs:observeGeneration.

Two real downstream consumers, both preserving the distinction in emitted evidence:

1. the terminal bus post, as fields (observation=, observation_source=, observed_provider=, requested_model=, resolved_model=, used_model=, used_generation_id[_sha256]=, identity_matches_requested=);
2. result.json inside the evidence bundle.

used_model is emitted only from a machine observation, so an unobservable identity prints unknown and can never be mistaken for the requested string, and identity_matches_requested is omitted rather than guessed when nothing was measured.

Existing structures reused throughout — the economics summary, the task record's record() seam, the evidence bundle, the terminal post. No new generation registry: immutable identity already existed as responseKey (provider\0responseId).

Tests

node vinci/test/worker-generation-identity.mjs            14 checks
node vinci/test/worker-generation-identity-consumer.mjs   17 checks
VINCI_SKIP_SMOKE=1 bash vinci/test/run.sh                  1616 groups pass

Both files are glob-discovered by run.sh and execute inside the canonical suite.

Every control is mutation-proven, each killed for the intended assertion rather than by a crash: observed←resolved (killed at economics and at the wire boundary), used-generation-id←requested identity (at economics and at the post), removed observation yielding UNKNOWN rather than an inferred identity (at session-read and at the post), A→B→C four-stage distinctness, the A→A→A positive control (killed by a report-everything-unknown implementation, so the strictness is not vacuous), and the relabelled-fallback case.

The final binding control was isolated deliberately: a mutation renaming used and observed generation ids consistently keeps the evidence self-consistent, so distinctness, non-model-string and four-stage checks all still pass — and only the binding control fails. It checks result.json's claim against session.jsonl's response keys, both read from the one tarball the worker handed the uploader.

Known bound — please read before treating unavailable as a defect

responseModel is populated only when chunk.model !== model.id (packages/ai/src/api/openai-completions.ts:323, documented at types.ts:389). It is a drift-only signal, so today every compliant call reports observation=unavailable; observed is reachable only when the provider disagrees with the request — which is the fallback case that matters most, but it means agreement is not currently observable.

27 of 28 adapters under packages/ai/src/api/ have no wire observation channel at all (anthropic-messages, bedrock-converse, google-generative-ai, google-vertex, mistral-conversations, openai-responses, openai-codex-responses, azure-openai-responses, cloudflare, openrouter-images). gateway-header (x-vinci-resolved-model) is gated on provider === "vinci" and its own file records that those headers do not exist yet.

The one-condition upstream change that would make agreement observable is in packages/**, which PR #59 also edits. It is proposed, not taken here, and nothing in this branch depends on it.

🤖 Generated with Claude Code

https://claude.ai/code/session_012bNEs7T8pAdT7eJQTDgtkA

---

UPDATE — 96ebc352 was reviewed NO-GO; repaired at d6554d34

An independent exact-head review of 96ebc352 returned NO-GO with two findings. Both are accepted as real and repaired here. The reviewed head 96ebc352 should not be used.

Finding 1 (HIGH) — identity reached the terminal post only on the COMPLETED path

generation_identity travelled to postFinal through lifecycle.record(), which happened on exactly one code path. Every other post-run terminal lost it — including the outer-catch FAILED path, whose own comment notes a session may already have run and spent.

The obvious fix is wrong and harmful. Centralising the write inside emitEconomics (all 14 call sites already receive lifecycle) fails because record() throws once the state is terminal — correctly; terminal task state is immutable — the 13 other call sites transition before emitting economics, and emitEconomics runs inside a try/catch. The throw is swallowed and the function silently returns its degraded summary instead. This was measured as a changed economics_sha256 on an injected-fault run, and is now documented at the site.

Repair: postFinal takes the emitEconomics result { summary, sha256 } whole. The digest and the identity are two projections of one summary, so the post cannot carry a SHA from one and an identity from another, and no lifecycle mutation is needed to tell postFinal something its caller already holds. The lifecycle transport is removed.

Identity is emitted only where a generation could actually have occurred (model_calls > 0 or a generation id): a pre-run refusal asserts nothing, because observation=unavailable there would be a claim about evidence for a generation that never happened.

Finding 2 — observed_provider claimed provenance the data never had

It was set to requestedProvider whenever any model was observed. Every adapter sets a response's provider from model.provider (packages/ai/src/api/*.ts), and no adapter reads a served provider off the wire — so there is no provider evidence at observation strength anywhere in this system.

Repair: observed_provider is now always null — the correct answer, kept present so a consumer can see that provider is never observed — and the routing/runtime value is reported under its own name as runtime_provider / runtime_providers.

Coverage added

11 + 14 checks (was 11 + 8): FAILED after a generation; UNVERIFIED after gh-failure and after no-commit; a postFinal terminal with no generation; a pre-run refusal; and absent provider provenance.

The fixture's runtime provider is deliberately not the requested provider. With both set to openrouter, substituting one for the other was invisible and the provider assertions false-greened — a mutation exposed that, and the fixture now discriminates.

Every new control is mutation-proven and each fails for its intended assertion. The reviewer's injected post-run fault now carries the identity, and stops carrying it the moment the data dependency is reverted.

Local canonical suite: 1616 groups pass.