🔌 fix: Verify Decision Output Bindings by Adapter

[lia-by-librechat]

Stack and scope

Stack 3/3: #561 → #588 → #590. This PR targets #588's lia/rerank-seam branch at base/merge-base 478102c4ef94940f4b119ad8c763804b08493a23. The reranking parent is incorporated with a regular merge, no force push. The PR diff includes the private capability boundary, its contract tests, and the Azure constructor delegate-preservation fix and regression. Merge in stack order; parent #561 and #588 heads are unchanged.

Problem

The one-shot decision coordinator mixed adapter selection with uniform structured-output options. Its openai identifier check excluded the actual Azure adapter identifier, azure_openai, although the docs claimed Azure was supported. Neither the upstream nor LibreChat Azure implementations could reach provider invocation.

Adapter support cannot be established by provider labels, broad profile.structuredOutput metadata, or a successful withStructuredOutput() call. Bedrock's locked adapter ignores strict options, and Anthropic's native-schema transformer moves choice enum constraints into description text. Local answer validation is still required, but does not prove provider enforcement.

Smallest useful change

A private withDecisionStructuredOutput() binding boundary owns the verified adapter/method selection and binding options. The coordinator still owns preparation sanitization, deadline/cancellation, schema construction, local answer validation, usage, and hooks.

Adapter	Native JSON Schema	Function calling
OpenAI / Azure	strict: true	strict: true
Anthropic	Rejected locally	strict: true
Unverified, including Bedrock	Rejected locally	Rejected locally

Azure's distinct identifier is now accepted. Native Anthropic stays disabled. The real locked adapter contract tests demonstrate why: finite choices become an unconstrained string with an enum description. This PR does not silently switch modes or reconstruct/bypass the upstream structured pipeline.

This prevents adapter policy from accumulating in the request coordinator and gives dependency upgrades an explicit provider-request contract test. Compared alternatives: leaving the check inline retains the Azure defect and mixes mode policy into lifecycle code; a general capability registry/profile override adds global state and public API without proving enforcement. The private binding function is the bounded choice. No provider SDK imports are added to runtime code.

Verification and review

Current pushed head: 93c45aa42bcb3a9330718f463f7786673bbc0f1b, based on #588 at merge-base 478102c4ef94940f4b119ad8c763804b08493a23.

Independent review of preceding head ffb4613c found P2 CAP-IR-1: LibreChat Azure's configured Completions/Responses delegates were replaced by upstream delegates when structured/config binding cloned from this.fields. Astra filtering, safety identifiers, and explicit cache forwarding were lost. All six new real-SDK regressions reproduced this behavior before the fix.

Fixed in 93c45aa4: the Azure constructor synchronizes its clone fields with its configured delegates. The fix is five runtime lines at the owning boundary, not a provider workaround in the decision coordinator. Regressions cover native/tool output on both routes, Astra stripping, safety/cache forwarding, and repeated config binding with the endpoint gate disabled. The six regressions now pass.

Verified locally on this exact head:

Check	Result
Combined decision/rerank/search/tracing and focused non-live provider tests	838 passed across 47 suites
Full workspace npx tsc --noEmit	Passed
Zero-warning touched-file ESLint and import order	Passed
New/decision-file Prettier and scoped Azure block formatting	Passed; existing whole-file debt described below
Package build, circular dependencies, diff checks, ESM/CJS exports	Passed

CI for this exact head passed all 13 validation jobs. Independent review of 93c45aa42bcb3a9330718f463f7786673bbc0f1b completed with no new findings. CAP-IR-1 is independently confirmed fixed. The reviewer verified frozen source and locked SDK behavior; its isolated lane did not rerun Jest/typecheck or live providers. The 838 local tests and static/build/export checks above were run separately by the parent task. Earlier reviews are not used as coverage of this head.

New and decision test/source files pass whole-file Prettier. The added Azure constructor block matches Prettier; existing unrelated formatting debt in src/llm/openai/index.ts is unchanged (confirmed against the frozen pre-fix source rather than reformatting the large provider file). That file passes zero-warning lint and import order.

Controlled responses establish SDK forwarding, not universal live endpoint/checkpoint enforcement. No live provider or benchmark claims.

Compatibility and limits

No public registry or capability override. No new root exports. No default changes, dependency upgrades, configuration migration, retry loop, or live provider calls. Chat answers remain unmeasured; scores remain unsupported. Existing HTTP Jev/Laya behavior is untouched. Rollback restores the prior Azure rejection without stored-data changes.

Not run: live Azure/OpenAI/Anthropic endpoint/checkpoint tests, live Jev/Laya evaluations, latency/cost benchmarks, or live Langfuse inspection. These fixtures verify SDK forwarding, not that every configured endpoint or checkpoint supports the requested API.

Final finding ledger

Reviewed head: 93c45aa42bcb3a9330718f463f7786673bbc0f1b, base/merge-base 478102c4ef94940f4b119ad8c763804b08493a23. CAP-IR-1 (P2), LibreChat Azure delegates lost through structured/config binding: fixed in 93c45aa4, reproduced with six real-SDK regressions before the fix, and independently confirmed at this head. No open or rejected findings. Final review: no new findings. Stack remains #561 → #588 → #590. Nothing merged or published.

[lia-by-librechat]

Final review handoff for exact pushed and independently reviewed head 2fe4e1bdebb7cbe553154eec690c6647ca97625d, stacked on #561 at base/merge-base 23cf6d76cf295b0be3af8d671a3f780c5e28f82b.

Independent review complete: no findings. The reviewer inspected the complete four-file diff and locked SDK implementation, including adapter/method policy, Azure forwarding, native enum transformation, failure paths, and retained decision safety/export boundaries. No findings rejected or left open. Its isolated lane did not rerun Jest/typecheck/build; parent-task checks below cover this exact head.

Local check	Result
Decision/tracing tests	316 passed across 15 focused suites
Workspace npx tsc --noEmit	Passed
Touched-file zero-warning ESLint, import order, Prettier, diff	Passed
Circular dependencies and package build	Passed
ESM/CJS root exports, with private binding helper absent	Passed

GitHub CI has no run or checks reported for this head as of 2026-10-01 17:28 UTC. The PR targets feat/classification-port; normal PR CI is filtered to main/dev. No green CI is claimed and no publishing workflow was triggered.

This is a bounded private binding-policy owner, not a public capability registry. Azure's distinct identifier now reaches its verified strict modes. Native Anthropic remains rejected because the locked SDK moves choice enum constraints into description text. Contract tests exercise upstream and LibreChat implementations, including sanitized setup/endpoint rejection with no mode fallback.

Parent #561 and reranking #588 are unchanged. No defaults, dependency upgrades, config migration or retry loops. Not run: live endpoint/checkpoint verification, live Jev/Laya evaluations, latency/cost benchmarks or live Langfuse inspection. Controlled HTTP fixtures prove adapter forwarding, not universal live provider enforcement. Nothing merged or published.

[lia-by-librechat]

Exact-head handoff for ffb4613c62ffa4b25ffa0849293b5da4d9a8bc47, base/merge-base 478102c4ef94940f4b119ad8c763804b08493a23.

Stack is #561 → #588 → #590. PR #590 targets lia/rerank-seam; its diff remains the four capability files. The second PR is incorporated by a regular merge. No force push, parent-head changes, defaults, configuration or dependency upgrades.

Local combined verification passed: 607 tests across 32 focused rerank/search/decision/tracing suites, workspace typecheck, zero-warning touched-file ESLint, import order, Prettier, diff checks, circular dependencies, package build and ESM/CJS exports. Private binding helper remains absent from root exports.

Fresh independent review remains in progress. The earlier clean review of 2fe4e1bd does not cover this new merged head. GitHub CI has no run reported for this exact head. No green CI is claimed and no publishing workflow was dispatched.

Not run: live endpoint/checkpoint or Langfuse validation, Jev/Laya evaluations, latency/cost benchmarks. Controlled HTTP fixtures establish forwarding, not universal live provider enforcement. Nothing merged or published.

[lia-by-librechat]

Final verification for exact pushed and independently reviewed head 93c45aa42bcb3a9330718f463f7786673bbc0f1b, base/merge-base 478102c4ef94940f4b119ad8c763804b08493a23.

Ready in stack order: #561 → #588 → #590. CI for this exact head passed all 13 jobs. Fresh independent review completed with no new findings.

Finding	Severity	Disposition
CAP-IR-1: Azure delegates lost through structured/config binding	P2	Fixed in 93c45aa4, reproduced by six real-SDK regressions before the fix and independently confirmed at this head

No open or rejected findings. The Azure constructor preserves both configured LibreChat delegates in its saved clone fields. Native/tool modes, both routes, Astra filtering, safety identifiers, explicit caching and endpoint opt-out remain intact without a capability-layer workaround.

Local final-head checks passed: 838 tests across 47 focused combined-stack/provider suites, full workspace npx tsc --noEmit, zero-warning touched-file ESLint/import order, new/decision-file Prettier, scoped Azure constructor formatting, package build, circular dependencies, diff checks and ESM/CJS exports. Unrelated whole-file formatting debt in the large provider module is unchanged. The isolated reviewer did not independently rerun Jest/typecheck/build or live provider calls; it verified frozen source and locked SDK behavior.

Parent #561 and reranking #588 are unchanged. No defaults, dependency upgrades, downstream config migration, extra retries, or automatic mode fallback. Native Anthropic remains disabled because its locked SDK weakens choice enums. Not run: live endpoint/checkpoint or Langfuse verification, Jev/Laya evaluations, latency/cost benchmarks. Nothing merged or published.