[JasonW404]

GitHub native stack

Stack #4080 targets develop, in order: #4072 → #4074 → #4076 → #4078 → #4079. All five PRs remain Draft. The stack is registered with GitHub, not represented only by titles or description links.

#4072 combines the contracts formerly split into #4071 with the TOML catalog/reader. #4071 is closed as superseded; its commits remain in #4072. No product commits were rewritten for this consolidation.

Changes

• Include the strict model-profile contract primitives previously reviewed in [WIP] Model profile contracts — stack 1 #4071: context limits, reasoning controls and atomic source references, with 65 contract unit tests. [WIP] Model profile contracts — stack 1 #4071 is superseded by this combined PR.

• Copy 45 authored TOML files from models.dev commit e69e1844210e5cfe7c7e7f68d57328bc7451a51c: 21 models, 21 provider-model entries, 3 China-region providers.

• Preserve original bytes, paths and full MIT license; add scope/update README and a manifest with source kinds and per-file SHA-256.

• Include source files, manifest and notices in the SDK wheel.

• Add controlled source reading with strict manifest/reference checks, path containment, digest validation, duplicate detection and deeply read-only documents. Fail the whole inventory on errors.

• Retain nested request IDs such as alibaba-cn/MiniMax/MiniMax-M2.7.

Verification

• 133 targeted UT passed: contract 65, inventory 47, source reader 21. Contract and reader coverage 100%; Ruff and strict implementation asset validation passed.
• SDK wheel retains all 48 source/manifest/notice resources with identical bytes; final wheel also includes the reader.
• VM restored clean v2-6-1-docker-cache, this worktree mounted natively; main/web/mcp built and infrastructure/application/Supabase deployed via repository scripts.
• Installed Linux image and deployed config service read all 45 sources, preserve nested identity and reject mutation/invalid manifest/malformed TOML.
• Required test tenant/account hierarchy initialized; authentication health and in-app browser homepage verified. Super-admin credentials unchanged.

Boundaries and next steps

This slice supplies source inventory and controlled reading. It does not claim semantic normalization, model support, endpoint verification, outlet migration or NativeAgent integration. Versioned field mapping, inheritance/omit, supplemental API bindings and resolved outlet persistence remain subsequent slices. Source atom updates will not recompose saved outlets.

No TypeScript/npm runtime dependency, upstream auto-sync or pricing estimator is introduced. AgentScope evaluation stays before NativeAgent kernel development.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[JasonW404]

Superseded by #4078 to reduce review overhead. All commits are already present in that consolidated Draft PR; no code or verification evidence has been discarded. Native GitHub Stack #4086 now contains #4078 → #4082 → #4083.