feat(models): add Mistral AI as a native LLM provider

[xavierpestel-ai]

Summary

Adds Mistral AI as a first-class LLM provider across the Go controller, Go ADK runtime, Python ADK runtime, and UI. Mistral speaks the OpenAI-compatible wire protocol (POST /chat/completions with a Bearer token at https://api.mistral.ai/v1), so both runtimes reuse the OpenAI SDK client internally — no new HTTP transport, no new SDK dependency.

Changes

CRD (v1alpha2)

• New Mistral provider enum value + MistralConfig struct (baseUrl, temperature, topP, maxTokens, timeout)
• CEL rule enforcing mistral is nil for non-Mistral providers
• Default endpoint https://api.mistral.ai/v1
• Regenerated zz_generated.deepcopy.go and CRD manifests in both go/api/config/crd/bases/ and helm/kagent-crds/templates/

Controller translator

• New Mistral case in translateModel() — injects MISTRAL_API_KEY from Secret into the agent pod

Go ADK runtime

• New adk.Mistral type + models.MistralModel (wraps OpenAIModel internally)
• Wired into CreateLLM() in go/adk/pkg/agent/agent.go

Python ADK runtime

• New KAgentMistralLlm class subclassing BaseOpenAI (hardcodes Mistral base URL + MISTRAL_API_KEY env fallback)
• Registered in the ModelUnion Pydantic discriminator

Env vars, telemetry, catalog

• MISTRAL_API_KEY, MISTRAL_API_BASE
• OpenTelemetry GenAI semconv: gen_ai.provider.name=mistral_ai
• 10 Mistral models in the HTTP model catalog: mistral-large-latest, mistral-medium-latest, mistral-small-latest, magistral-medium-latest, magistral-small-latest, codestral-latest, ministral-8b-latest, ministral-3b-latest, pixtral-large-latest, open-mistral-nemo (all with function calling)

UI

• Mistral added to BackendModelProviderType, modelProviders, PROVIDERS_INFO
• New Mistral SVG icon (ui/src/components/icons/Mistral.tsx)
• Icon wired into both ModelProviderCombobox and ProviderCombobox icon maps

Helm

• providers.mistral entry in values.yaml. Default provider unchanged.

Docs

• New Mistral section in .claude/skills/kagent/references/providers.md (Helm keys, env vars, CLI examples, ModelConfig YAML)

Example ModelConfig

apiVersion: kagent.dev/v1alpha2
kind: ModelConfig
metadata:
  name: mistral-large
  namespace: kagent
spec:
  provider: Mistral
  model: mistral-large-latest
  apiKeySecret: kagent-mistral
  apiKeySecretKey: MISTRAL_API_KEY
  mistral:
    temperature: "0.3"
    maxTokens: 4096
    # baseUrl: https://api.mistral.ai/v1   # optional

Set MISTRAL_API_BASE to point at a self-hosted or regional Mistral endpoint.

Testing

All test suites green (evidence):

Suite	Result
go/api unit tests	121 passed — includes 4 new CEL admission cases for Mistral
go/adk unit tests	539 passed — includes new TestNewMistralModelWithLogger (7 cases) + TestMistralModel_NamePropagatesModelNotProvider
go/core unit tests (non-e2e)	1504 passed — includes new TestGoldenAdkTranslator/mistral_agent golden test
TestCreateLLMConfig_Mistral (agent_test.go)	✅ passes
Python test_mistral.py	10 passed
Python test_mistral.py + test_openai.py + test_anthropic.py	47 passed
E2E TestE2EInvokeWithMistralAgent	Compiles + skips cleanly when MISTRAL_API_KEY unset (verified). Modeled on foundry_test.go, uses a mock OpenAI-compatible server — never contacts the real Mistral API
make -C go generate + make -C go manifests + make controller-manifests	✅ regenerated CRDs
UI npx tsc --noEmit	✅ no new TypeScript errors (fixed 2 real "Property 'Mistral' is missing" errors caught in the combobox icon maps by wiring the new icon)
go vet ./...	✅ clean across the workspace
Local secret scan (gitleaks)	✅ clean, both staged + branch diff

Pre-existing issues observed (not fixed here)

• golangci-lint fails to load bin/kube-api-linter.so due to a Go runtime version drift in the vendored plugin. Unrelated to this PR (go vet is clean).
• 9 Python test_tls_e2e.py failures exist on main (verified via git stash + rerun). Unrelated to Mistral.

Not in this PR

• Embeddings: The Python EmbeddingConfig type does not discriminate on provider the same way Model does. Mistral embeddings (mistral-embed) is a straightforward follow-up but is not scoped here.
• Mistral-specific streaming e2e: Streaming works because the inner OpenAI client handles it; a real streaming e2e against Mistral can be added when a stable mock harness lands.

Type: feat (Conventional Commits).

[EItanya]

First off, thanks so much for the PR :)

If the wire protocol is the same as OpenAI I'm wondering if we really need a whole new API block for this? Typically we allow usage of chat completions compatible APIs via BaseURL.

I definitely see value in adding a mistral block to the UI and website, so it's clearer there that Mistral is supported, but I'm not sure it's worth adding the block to the API.

What do you think?

[xavierpestel-ai]

First off, thanks so much for the PR :)

If the wire protocol is the same as OpenAI I'm wondering if we really need a whole new API block for this? Typically we allow usage of chat completions compatible APIs via BaseURL.

I definitely see value in adding a mistral block to the UI and website, so it's clearer there that Mistral is supported, but I'm not sure it's worth adding the block to the API.

What do you think?

Hi. Yes it's just a proposition. Yes Mistral is openai compatible so it does the job like that (I already did a video to show Mistral Inference with kagent).

We can close the PR no worries.