Separate provider reachability and model verification

[Open-Squilla]

Scope

Scope boundary: Separate lightweight Provider reachability from explicit streamed model verification. Add an 8-second strict model-list check, a cancellable 60-second Gateway/WebUI model test, distinct verification and failure metadata, old-Gateway fallback, bounded cleanup and admission, and generated contract coverage.

Non-goals: Unknown-model context-window inference and configuration from #1561 remain unchanged. Direct CLI and low-level probe callers retain the existing 30-second legacy default; the Gateway/WebUI explicitly uses the new 60-second model-test limit.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: Refs #1561

If None, reason: N/A

Release Note

Release note: Fix Provider setup verification so endpoint reachability is checked quickly and slow model responses are reported as timed out instead of unreachable.

Tests

Ruff: .venv/bin/ruff check src tests (passed)

Pytest: 718 focused tests passed across Provider probing and model listing, usage accounting, Gateway RPC and concurrency, stream cleanup, and wire contracts.

Build: WebUI npm run test:unit (456 files, 6277 tests), npm run typecheck, and npm run build:artifact passed. Production Gateway contract generation check passed. Full Python mypy passed for 1595 source files.

Regression tests: added

Notes: The full default Python suite was not run because this managed worktree is explicitly rejected by the repository shell-safety tests due to its protected metadata ancestor. Focused tests cover every changed backend surface and remain offline, deterministic, credential-free, and safe for forks.

The default test path remains offline, deterministic, credential-free, and safe for forks.

Maintainer Live Check

Maintainer live check: no

Surface: provider

Maintainer-only note: contributors are not expected to provide secrets or run credentialed live checks. Maintainers may run Live Release E2E for provider, browser, gateway, channel, or release smoke coverage.

Safety

Secrets, local-only artifacts, private prompts/transcripts, channel identifiers, AI session artifacts, non-public fixtures, and tests/_private/ contents are not committed. Candidate credentials remain in memory only, and Provider error bodies are redacted at the adapter boundary. Probe cancellation closes physical streams; slow teardown stays supervised and counted under the bounded global admission limit.

Third-Party Origin

Third-party origin: inspired-by

Details if non-none: Idea-level inspiration from Hermes Agent (MIT) for lightweight HTTP reachability and OpenClaw (MIT) for separate model-probe state. No upstream code, rules, fixtures, or text were copied or adapted; no notice update is required.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.