merge: resolve feat/auth-credential-broker into auth-gateway after main rebase

Bring the gateway branch onto the conflict-resolved code-yeongyu#193/code-yeongyu#194 stack and keep
auth-gateway review P1/P2 fixes (broker URL validation, CORS preflight order,
verifier evidence, 502 mapping, qualified models).

Author: islee23520

.github/APPROVED_CONTRIBUTORS

@@ -271,3 +271,7 @@ farid-fari pr
 petrroll pr
 
 vibeinging pr
+
+DivineDominion pr
+
+ananthakumaran pr

.github/upstream.json

@@ -1,6 +1,6 @@
 {
 	"repo": "badlogic/pi-mono",
-	"tag": "v0.80.7",
-	"sha": "9d09075c53812f7af955ce4397d0508c4a62efac",
-	"synced_at": "2026-07-14T17:38:55Z"
+	"tag": "v0.80.10",
+	"sha": "216e672e7c9fc65682553394b74e483c0c9e47f7",
+	"synced_at": "2026-07-16T22:29:25Z"
 }

.github/workflows/publish-model-catalog.yml

@@ -0,0 +1,112 @@
+name: Publish Model Catalog
+
+on:
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
+  pull_request:
+    paths:
+      - '.github/workflows/publish-model-catalog.yml'
+      - '.gitignore'
+      - 'package.json'
+      - 'packages/ai/**'
+      - 'scripts/publish-model-catalog.mjs'
+  schedule:
+    - cron: '17 */4 * * *'
+  workflow_dispatch:
+    inputs:
+      source_ref:
+        description: 'Commit, branch, or tag to generate from'
+        required: false
+        default: 'main'
+        type: string
+      publish:
+        description: 'Upload the generated catalog to production R2'
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  generate:
+    if: ${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') }}
+    runs-on: ubuntu-latest
+    env:
+      SOURCE_REF: ${{ github.event.workflow_run.head_sha || github.event.pull_request.head.sha || inputs.source_ref || github.sha }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ env.SOURCE_REF }}
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: '24'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Generate model catalog JSON
+        run: npm run generate:model-catalog
+
+      - name: Validate model catalog JSON
+        run: npm run check:model-catalog
+
+      - name: Upload model catalog JSON
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: model-catalog-json
+          path: .artifacts/model-catalog
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_run' || (github.event_name == 'workflow_dispatch' && inputs.publish) }}
+    needs: generate
+    runs-on: ubuntu-latest
+    environment: pi-model-upload
+    concurrency:
+      group: publish-model-catalog-r2
+      cancel-in-progress: true
+    env:
+      SOURCE_REF: ${{ github.event.workflow_run.head_sha || inputs.source_ref || github.sha }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.PI_ARTIFACTS_R2_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.PI_ARTIFACTS_R2_SECRET_ACCESS_KEY }}
+      AWS_DEFAULT_REGION: auto
+      AWS_EC2_METADATA_DISABLED: 'true'
+      R2_ENDPOINT: https://67c0d357268b0fca6e0b465bb9d01b84.r2.cloudflarestorage.com
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ env.SOURCE_REF }}
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: '24'
+
+      - name: Download model catalog JSON
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: model-catalog-json
+          path: .artifacts/model-catalog
+
+      - name: Verify AWS CLI
+        run: aws --version
+
+      - name: Publish model catalog to R2
+        run: |
+          node scripts/publish-model-catalog.mjs \
+            --input .artifacts/model-catalog \
+            --bucket pi-artifacts \
+            --endpoint "$R2_ENDPOINT" \
+            --source-commit "$(git rev-parse HEAD)"

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+.artifacts/
 *.log
 .DS_Store
 *.tsbuildinfo
@@ -67,10 +68,6 @@ local-ignore/
 .pi/hf-sessions-backup/
 collect.sh
 
-# Ephemeral agent working state (cc-ulw-loop goal/ledger, run continuation).
-# Evidence archives under .omo/evidence are tracked intentionally; runtime
-# state is not, and must never be swept into a release commit.
-.omo/loop/
-.omo/run-continuation/
-.omo/ulw-loop/
-.omo/senpi-task/
+# Ephemeral agent working state. Existing tracked archives remain tracked,
+# but new untracked files must never block a release commit.
+.omo/

AGENTS.md

@@ -1,7 +1,7 @@
 # Senpi Repository Guide
 
-Generated: 2026-07-14
-Commit: `2c3a87858`
+Generated: 2026-07-17
+Commit: `92fc96389`
 Branch: `main`
 
 Metadata above records the source state used for this generation pass.
@@ -38,13 +38,15 @@ Senpi is an extension-first coding-agent monorepo. Keep changes scoped, preserve
 | Add or change extension examples | `packages/coding-agent/examples/` |
 | Change PTY behavior | `packages/pty/` and, for native behavior, `crates/senpi-pty/` |
 | Add provider setup docs | `packages/ai/README.md` and `packages/coding-agent/docs/providers.md` |
+| Change model/provider runtime | `packages/ai/src/models.ts`, `packages/ai/src/auth/`, `packages/ai/src/providers/` |
+| Change eval prompt/rendering | `packages/senpi-codemode/src/prompt/` and `src/tool/` |
 | Audit changelogs | `.github/agent/commands/cl.md` |
 | Prepare a release | `scripts/release.mjs` and `scripts/release-packages.mjs` |
 
 ## CODE MAP
 
 ```text
-Model/auth catalog -> packages/ai/src/providers -> packages/ai/src/api
+Models/auth runtime -> packages/ai/src/models.ts + src/auth/ -> providers -> api
                                          |
 Agent state -> packages/agent/src/agent-loop.ts
                                          |