From ddb6e293b220e5ea8d69606ab0067151f00597ef Mon Sep 17 00:00:00 2001
From: agent-exec-transport <agent-exec-transport@localhost.invalid>
Date: Tue, 20 Oct 2026 12:01:33 +0000
Subject: [PATCH] agent-exec transport
 8b42e6435f6b297a2cdf67ab43c40db3/a83f1be549ed

---
 ...ork_checkpoint_eval_route_contract_test.go | 46 +++++++++++++++++++
 internal/server/work_checkpoint_eval_test.go  | 18 +++++++-
 2 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/internal/server/work_checkpoint_eval_route_contract_test.go b/internal/server/work_checkpoint_eval_route_contract_test.go
index f1b2fae..b9cf7bc 100644
--- a/internal/server/work_checkpoint_eval_route_contract_test.go
+++ b/internal/server/work_checkpoint_eval_route_contract_test.go
@@ -160,6 +160,52 @@ func TestEvalRouteContractAttachedOnlyWhenProductionRuleAdmits(t *testing.T) {
 	}
 }
 
+func evalRouteContractModels(t *testing.T, contract any) map[string]any {
+	t.Helper()
+	route := map[string]any{"model": evalRouteContractModel, "baseUrl": evalRouteContractBase, "apiKey": "fixture-key"}
+	if contract != nil {
+		route["routeContractEOF"] = contract
+	}
+	models, ok := evalModelSettings(route)
+	if !ok {
+		t.Fatal("route file rejected")
+	}
+	return models
+}
+
+func TestEvalRouteContractFailFastWhenConfiguredButNotAttached(t *testing.T) {
+	digest := agentllm.RouteContractIdentity(evalRouteContractModel, evalRouteContractBase)
+	matching := map[string]any{"model": evalRouteContractModel, "baseUrl": evalRouteContractBase, "identitySha256": digest}
+	client, _ := evalRouteContractClient(t, matching)
+	if !evalRouteContractAttached(evalRouteContractModels(t, matching), client) {
+		t.Fatal("matching route contract must be reported attached")
+	}
+
+	for name, contract := range map[string]map[string]any{
+		"digest mismatch": {"model": evalRouteContractModel, "baseUrl": evalRouteContractBase, "identitySha256": strings.Repeat("0", 64)},
+		"other model":     {"model": "other-model", "baseUrl": evalRouteContractBase, "identitySha256": agentllm.RouteContractIdentity("other-model", evalRouteContractBase)},
+		"other base":      {"model": evalRouteContractModel, "baseUrl": "https://other.example.com/v1", "identitySha256": agentllm.RouteContractIdentity(evalRouteContractModel, "https://other.example.com/v1")},
+		"missing digest":  {"model": evalRouteContractModel, "baseUrl": evalRouteContractBase},
+		"empty object":    {},
+	} {
+		client, _ := evalRouteContractClient(t, contract)
+		if evalRouteContractAttached(evalRouteContractModels(t, contract), client) {
+			t.Fatalf("%s: configured but unattached route contract must fail fast", name)
+		}
+	}
+
+	client, _ = evalRouteContractClient(t, nil)
+	if !evalRouteContractAttached(evalRouteContractModels(t, nil), client) {
+		t.Fatal("route without routeContractEOF must keep running without a contract")
+	}
+	if !evalRouteContractAttached(map[string]any{"chat": map[string]any{}}, nil) {
+		t.Fatal("absent routeContractEOF must not depend on the client")
+	}
+	if evalRouteContractAttached(map[string]any{"routeContractEOF": map[string]any{}}, nil) {
+		t.Fatal("configured routeContractEOF without a client must fail fast")
+	}
+}
+
 func TestEvalRouteContractRejectsMalformedRouteFileContract(t *testing.T) {
 	for _, contract := range []any{"text", map[string]any{"model": 1, "baseUrl": evalRouteContractBase, "identitySha256": "x"}} {
 		route := map[string]any{"model": evalRouteContractModel, "baseUrl": evalRouteContractBase, "routeContractEOF": contract}
diff --git a/internal/server/work_checkpoint_eval_test.go b/internal/server/work_checkpoint_eval_test.go
index 24c4274..f7af0cd 100644
--- a/internal/server/work_checkpoint_eval_test.go
+++ b/internal/server/work_checkpoint_eval_test.go
@@ -194,7 +194,7 @@ func TestServeWorkCheckpointEval(t *testing.T) {
 	}
 	defer st.Close()
 	config := evalFixtureSettings()
-	var modelRoute map[string]any
+	var modelRoute, modelSettings map[string]any
 	if mode == "model" {
 		raw, e := os.ReadFile(os.Getenv("WORK_CHECKPOINT_ROUTE_FILE"))
 		if e != nil {
@@ -212,6 +212,7 @@ func TestServeWorkCheckpointEval(t *testing.T) {
 		route["fallbacks"] = ""
 		config["models"] = models
 		modelRoute = route
+		modelSettings = models
 	}
 	// The isolated fixture owns its startup configuration; managed model/mock
 	// settings use the same trusted system layer as production bootstrap.
@@ -245,7 +246,11 @@ func TestServeWorkCheckpointEval(t *testing.T) {
 	front := &runtime.LLMRunner{Prompts: promptSvc}
 	sub := &runtime.SubLLMRunner{Prompts: promptSvc}
 	if mode == "model" {
-		stream := evalProviderStreamWithSettings(modelRoute, settingSvc.Effective(store.OwnerDefault, ""), dir)
+		client := evalProviderClient(modelRoute, settingSvc.Effective(store.OwnerDefault, ""))
+		if !evalRouteContractAttached(modelSettings, client) {
+			t.Fatal("route contract configured but not attached")
+		}
+		stream := evalProviderStreamWithProvider(client.Stream, dir)
 		if guardedA01 {
 			stream = limitExtraA01Runs(st, stream)
 		}
@@ -467,6 +472,15 @@ func evalProviderClient(route map[string]any, eff core.EffectiveSettings) *agent
 	return client
 }
 
+// evalRouteContractAttached reports false when the route file configured a
+// routeContractEOF object that production's rule did not attach to the client.
+func evalRouteContractAttached(models map[string]any, client *agentllm.Client) bool {
+	if _, configured := models["routeContractEOF"]; !configured {
+		return true
+	}
+	return client != nil && client.RouteContract != nil
+}
+
 func evalProviderStream(route map[string]any, dir string) agentllm.StreamFunc {
 	return evalProviderStreamWithSettings(route, core.EffectiveSettings{}, dir)
 }
-- 
2.54.0