feat(Claude): ship atomic 5.x request and signed-history safety [P4; depends on #4582, #4576 contract] #4583

🤖 Automated architect agent — this comment was posted by the architect bot from Docker Agentic Platform, not by a human engineer

What

Deliver the atomic Claude 5.x core on the existing Anthropic Messages, native Vertex and Bedrock ConverseStream paths: capabilities, effective request policy, native serialization, exact signed response state, safe replay/lifecycle, UI and auxiliary callers together.

This is the first increment that can claim the bounded new core contract—not a claim that no 5.x behavior exists today. The same delivery must reject unsupported combinations and temporarily reject server fallback involving these models until the separate full-fallback issue is delivered. Do not ship request activation first and signed-history safety later.

Approved scope and client policies

• No native Mantle, InvokeModel, Bedrock Messages, Foundry or Claude Platform on AWS transport is added. Mythos 5/Converse is refused locally before inference when statically identifiable.
• The new 5.x default is append-only / error. drop_block is explicit, diagnosed and never an automatic retry. This deliberately changes today's automatic drop policy; it is not a silent “API default” cleanup.
• Reject nonempty fallbacks when the primary or any explicit target is one of the nine models below. Absent/empty fallback permits ordinary requests. Entirely non-5.x fallback remains unchanged and tested; a legacy primary targeting 5.x is restricted. Do not ignore the option or substitute a client retry. Histories requiring unhandled 5.x fallback boundaries fail intact.
• Custom Messages endpoints / gateway paths receive protocol/data-preservation protections, not presumed first-party capabilities or prices. Keep OpenAI-compatible Claude policy separate.

Why

Model-specific vendor contracts

Official sources audited on 2026-10-13:

• Migration index, Haiku 5.5 migration, Opus 5.5 migration, Sonnet 5.5 migration, Fable/Mythos 5.1 migration, thinking and effort: all nine use adaptive thinking by default, support five adaptive effort levels, reject manual enabled/budget_tokens, and reject final assistant prefill. Disabled, between-tools, forced-tool and prefix behavior differ by model.
• Model IDs: dateless IDs are pinned snapshots, not rolling aliases. Preserve wire/deployment/profile identity separately from lookup identity.
• Preserved thinking: signed blocks, their order and applicable prefix/sequence must survive. It states error is the default and drop_block a stopgap; removal followed by silent reinsertion can invalidate intervening reasoning. New-account enforcement from 2026-08-31 and older-account opt-in differ; Message Batches has a separate unset-field rule that does not define streaming behavior.
• AWS model cards and endpoint availability, specifically Mythos 5 / Mythos 5.1: the former is Mantle-only and not Converse; the latter is runtime-supported and not Mantle. AWS adaptive thinking documents the native fields, not a license to copy Messages beta controls blindly into Converse.
• Google structured outputs: disabled by default through organization policy. Specific 5.x prefill restrictions take precedence over generic examples. Bedrock's general feature guidance does not override model-specific structured-output exclusions.
• Compaction, on-demand compaction and thinking-block/keep-tail conditions: native signed compaction is not ordinary local LLM summarization. On-demand streaming returns a whole block at content_block_start without deltas. AWS compaction explicitly excludes Converse. Google native compaction is documented but is not integrated in the current client; do not expand it here.
• Pricing: Haiku 5.5's 100,000-token threshold includes cache reads/writes and changes the whole request's tier, not only excess tokens. A public Claude API rate is not a custom/cloud endpoint's bill.
• Refusals and server fallback: boundaries, tool projection, sticky routing and per-attempt billing require the separate end-to-end fallback increment. The temporary restriction here is an approved docker-agent rollout policy, not a vendor-wide prohibition.

Existing implementation gaps: immutable code evidence

Static inspection at research revision 49e4ca657fd454e9d46ea258e8cf61c517df9aab (not an implementation-base decision):

• Capability heuristics overgeneralize families, include Mythos 5.1 in prefix checking and omit several 5.5 cases.
• Binding selection auto-selects drop_block and applies native binding to thinking. Preserve the distinction between a documented server control and a local guard.
• Converse adapter flattens reasoning text/signature/redaction; conversion rebuilds thinking/text/tool order and interprets a signature without text as redaction. Signed-empty thinking is not necessarily redacted content.
• Existing Anthropic raw state already captures content and validates flattened descriptions. Extend/reuse it; do not create a parallel persistence mechanism or treat its flattened fallback as certification of a new signed replay.

These source observations are not live signature/endpoint validation.

How — indicative design

Use an explicit capability table keyed by model plus actual transport/host, a pure effective-policy resolver after inheritance/environment expansion and transport selection, and the existing native serializers. Keep capability identity, wire model ID, display alias, response producer/provenance and pricing identity distinct. Unknown future models gain no support via substring or >=5 inference.

Reuse checked reconstruction from its prerequisite and immutable per-stream origin from the external routing/pricing work. Extend existing ProviderState additively/versionedly for ordered raw state and provenance/integrity. Capture effective request history after grouping/filtering/attachment projection; do not put conversational state on shared clients. Validate final SDK wire requests, not constructors alone.

Model/intent matrix

All nine have adaptive low/medium/high/xhigh/max; an unspecified effort stays absent so the server default applies. This table is documentary policy input, not nine successful runtime tests.

Positive numeric thinking budgets map to adaptive at the documented default with a warning that the numeric ceiling is lost; do not inflate max_tokens. This conversion is client policy, not an API token-budget guarantee. none, zero and WithNoThinking mean genuine disabled or an actionable local error, never adaptive-low. Sonnet 5.5 {"type":"between_tools"} is a distinct mode, not off; do not add display/binding/budget fields to it.

Omit incompatible sampling rather than inventing universal range rules. Reject genuine final assistant prefill; accept valid final tool-result turns. Preserve tool schemas, output_config.format, effort and task budget when the combination is supported. Strict schema does not mean forced tool choice. Thinking text may be empty while signed; do not force summarized output to hide that.

Acceptance criteria

A. Capabilities, wire format and real entry points

• Exactly the nine models are represented: Haiku 5.5, Opus 5/5.5, Sonnet 5/5.5, Fable 5/5.1, Mythos 5/5.1. Across native families retain 24 corroborated pairs + 2 Anthropic-announced limited Mythos/Google pairs + 1 unsupported Mythos 5/Converse pair, not 26 PASS results. No Google Mythos entitlement or dedicated Google card is implied.
• Nil/default/explicit adaptive, every explicit effort, positive numeric budget, zero/none, inherited/env values and invalid combinations have positive and negative fixtures independent of the production table. Disabled/between-tools constraints and model-specific forced-tool rules match the matrix; budgets do not increase output limits.
• Direct standard/Beta, Vertex standard/Beta and native Converse final requests are captured through real factories/SDKs against fake servers. Vertex preserves OAuth context, URL model, vertex-2023-10-16, no direct key, deduplicated beta headers. Converse retains its native auth/caching and separate thinking/effort additional fields.
• UI effort cycling, pools, titles, MCP sampling with/without tools, reranking and compaction helpers use the same policy or expose a clear unsupported/error result. Preserve existing Converse rerank limitations; do not substitute a transport or declare false success.
• Structured-output success works initially where supported. If recovery would create forbidden prefill, perform one inference, then a graceful model error. No recovery promise, role rewrite, hidden retry or thinking-disable workaround. Vertex organization policy and Converse strict-output limitations are explicit.

B. Signed history, persistence and actual lifecycle

• Preserve ordered/ indexed thinking, signed-empty thinking, redacted bytes, text, tool IDs/input/results and supported markers. No last-signature-wins collapse. Incomplete/interrupted/invalid/unknown-version state or unverifiable provenance cannot become certified flattened replay.
• Persist and reload through SQLite and JSON with a new runtime/client, then actually continue an unchanged tool conversation. Cover edit, trim, model/transport switch and imported state. Preserve attachment metadata and conversation-update metadata; a mutable URL is not stable content evidence.
• Apply approved append-only/error semantics. Documented adaptive Messages binding uses the native mechanism; do not impose universal local adaptive prefix rejection. Retain conservative effective-prefix guards for between-tools and applicable Converse paths whose mapping is unestablished. No reset, epoch, deletion or retry without signed state. Explicit drop preserves diagnostics and never deletes the persisted original.
• Preserve only the narrow Haiku client exceptions: omit prior reasoning on Direct/Vertex disabled requests; omit prior reasoning on Converse with a warning. They are client compromises, not AWS mandates, and do not extend to the other eight models. Off→on does not silently resurrect previously omitted blocks; originals remain intact.
• Exercise two sessions sharing a client with different attachments, and composed route→rebuild→switch→attachment→reload flows on the three transports, with race coverage. Isolated helper tests or a text-only rejection do not prove compound lifecycle safety or universal cryptographic invalidity.
• Trigger real automatic local LLM compaction by threshold, including its checked clone, persisted summary, reload and first continuation. Refuse unsafe continuation without clearing context; do not claim zero total calls when summarization already ran. A hook-only test is insufficient.
• Existing Direct native on-demand compaction covers whole-block start/no-delta streams, exact signed adoption/reload, iteration usage and refusal/missing-summary cases that leave context intact. Preserve eligible contiguous unchanged keep-tail turns only under the documented lineage/system/tool/role-boundary conditions. Do not conflate on-demand with threshold compaction; retain explicit Vertex integration and Converse service exclusions.

C. Rollout, accounting and compatibility

• Temporary fallback rejection covers 5.x primary and legacy-primary→5.x-target requests, default and named forms where recognized, plus unsafe loaded histories. Absent/empty fallback works normally; entirely non-5.x fallback keeps its existing behavior and control tests. Diagnostics name the follow-up issue. No silently ignored option or unsafe experimental bypass.
• Response origin behind a route is immutable per stream and persists through events/reload. Rule-based routing: routed requests are priced with the router's model, not the model that served them #4576's eventual PR must be reviewed for this prerequisite contract; do not assume its pricing fix already delivers it. Missing coverage is an explicit dependency gap, not permission to modify that workstream.
• Haiku pricing tests cover 99,999 / 100,000 / 100,001 total prompt tokens including cache. Keep configured leaf/endpoint rates for the same producer despite display-alias differences. Unknown producer/endpoint/tariff or inconsistent usage is unpriced, not free; do not borrow the router's or first-party catalog's rate. No global snapshot update is implied.
• Every required scenario records PASS/FAIL/NOT ESTABLISHED/EXPECTED REFUSAL; documentary availability and fake-server success are not live service acceptance, linked-account portability, cryptographic verification or actual billing. Blocked setup/timeouts and earlier failures remain visible.
• Code, tests, docs, schema changes in latest and examples ship together. Frozen numbered configs, legacy models, other providers and existing Preserve Claude prompt caching when changing effort mid-conversation #4116 compositions remain protected. Run task build, task test, task lint, relevant targeted/race/shuffle checks and independent exact-final-head review in the authorized implementation phase. No acceptance gaps are waived by changing the base.
• New state is additive/versioned and non-destructive. If older binaries cannot safely continue it, document downgrade limitations rather than promising transparent rollback. Core completion means the safe bounded core is merged/delivered with the fallback restriction; it does not complete the epic or close fix: make Haiku 5.5 requests compatible across Claude providers #4553.

Dependencies and non-goals

Technical dependencies: checked clones/native dispatch and the required per-stream origin/pricing contract associated with #4576. The latter has a PR being prepared separately; review its coverage later without duplicating or intervening in it. Documentation-first is recommended, not a technical blocker. #4116 is related and independent; no new per-message-effort rollout is added here.

No new transports, client retry engine, global catalog refresh, destructive migration or native Vertex compaction expansion. If this atomic unit cannot be implemented/reviewed within bounded effort, replan complete product increments before execution—do not remove safety acceptance criteria or ship incomplete layers.

Implementation PR linkage: pending. #4553 remains held/open/draft; do not stack on or blindly cherry-pick it, and do not close it with this issue's creation.

External pricing work: PR #4579 — price routed turns using the serving model is now listed as open. Discovery only; not reviewed here. This link does not establish the full per-stream origin/P3 contract or per-attempt fallback accounting. Do not duplicate or intervene in that workstream.

Epic: #4580

Checked-clone prerequisite: #4582
Documentation (recommended first, not technically blocking): #4581

Cross-links

Epic: #4580. Depends on #4582 and the required origin contract associated with #4576 (external #4579, coverage unreviewed). #4581 is recommended documentation, not a technical blocker. #4584 is the follow-up that removes this issue's temporary 5.x fallback gate. Until #4584 is delivered, keep that explicit restriction and its diagnostics. No implementation PR is linked for this issue yet.