[gurnben]

What

A provider section in model-registry.yaml may now carry a connection block — the wire it speaks (type), its endpoint (base_url), the harness fronting it (harness) and where its credential lives (credential: source, and for a secret its name and key):

providers:
  rits:
    data_handling: approved
    connection:
      type: openai-compatible
      base_url: https://gateway.example.invalid/v1
      harness: omp
      credential: {source: secret, name: sci-enmaas-model, key: GATEWAY_API_KEY}
    models: {...}

The block is optional — absent keeps the default routing (the Anthropic wire, the environment's credential) — so existing registries load unchanged.

Why

The provider routing and credential configuration for model execution belongs in core's configuration, not in SCI's executor (the SCI-side implementation was closed in SCI #285/#287). The executor should receive the resolved routing from core, the same pattern as {repo_url}. This schema change is the contracts half; traust-core's feat/registry-connections branch consumes it (it pins this branch's head until this merges — retarget its pin to the merge commit afterwards).

Stack

Based on feat/remediation-scheduling-tables (#117, the SHA traust-core currently pins) so the diff shows only this change; retarget to development when #117 merges.

Shape of the change

• The schema checks the block's shape only: type and credential (with credential.source) required, unknown keys rejected, no empty strings.
• Which types, harnesses and credential sources exist, and the cross-field rules (a compatible type requires a base_url, a proprietary one forbids it; a secret credential requires its name and key), stay the consumer's closed set, like tier names: traust-core owns them, rejects an unroutable connection at config load, and serves the resolved routing over GET /v1/registry/resolve.

Testing

• tests/test_model_registry_connections.py: a provider without a block still loads; a full block loads and rides the typed section; malformed blocks (missing type/credential/source, unknown keys, empty strings) are rejected.
• Full suite: 1380 passed, 48 skipped; make lint green.

💘 Generated with Crush

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit 6178d03 ⚖️ Balanced

Results up to commit 6f898ff ⚖️ Balanced

No changes from previous review

Results up to commit f4f783b ⚖️ Balanced

No changes from previous review

Results up to commit a74bdc1 ⚖️ Balanced

No changes from previous review

[qodo-code-review]

Code review by qodo was updated up to the latest commit f4f783b

[gurnben]

/agentic_review

[qodo-code-review]

Code review by qodo was updated up to the latest commit a74bdc1

[qodo-code-review]

Code review by qodo was updated up to the latest commit 6178d03

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka, gurnben

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka,gurnben]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment