feature/Strict-method-faults · L-260925-648ee6

[lchoquel]

A run that fails on the caller's own method now reads its reason under STRICT disclosure: a missing required input, a PipeParallel whose branches do not fit the combined concept, and a model that only the method's inline setting names are classified at their raise sites as input-domain and caller-facing, through a new `PipelexError.as_caller_fault()`, so a hosted run answers 422 with the located message instead of "An internal error occurred." A model that the deck itself names but does not serve stays config-domain and redacted, and the failures left unclassified (template renders, function crashes, model output that does not fit its structure) say why at their raise sites.

Closes L-260925-648ee6

🤖 Generated with Claude Code

---

Summary by cubic

A run that fails on the caller's own method now reports its reason under STRICT disclosure instead of An internal error occurred. with a 500.

• New PipelexError.as_caller_fault() lets the raise site classify one error as the caller's own fault (input domain, 422, caller-facing message) even when other instances of the same class are not.
• Classified sites: a PipeParallel whose branch results do not fit its output, a pipe started without a required input, and a model reference that only the method's inline setting can have named.
• A model the deck itself names but does not serve stays config-domain and redacted, including deck defaults and overrides written as settings, matched by the name the lookup receives.
• Unclassified failures (model output that does not fit, PipeFunc crashes, unusable input resources, template renders, working-memory misses) now say why at their raise sites.

Migration

• Raise sites using as_caller_fault() must ensure their message names only the caller's own method and data, since STRICT disclosure will keep it.

Closes L-260925-648ee6.

^{Written for commit 8869d29. Summary will update on new commits.}

[lchoquel]

Review round 3, profile 4, bar necessity, over this PR's diff against feature/Located-run-failure at fb964b2. Reviewers: cubic, codex:review, codex:adversarial, code-review (medium).

Fixed in 8869d29: a deck's handle default or override spelled with the handle: prefix is now recorded by the name the lookup receives, so a deck-named model no longer reads as the caller's fault (cubic, verified; a gap in round 2's own change).

Rejected: the missing-input gate on a nested pipe (code-review), reachable only through a broken runtime invariant, as round 1 verified; the PipeParallel combine disclosing custom-validator text (codex:adversarial), refuted for runs that send only .mthds content, since the combine's one raise path formats pydantic errors through Pipelex's own formatter.

Deferred and handed to the sprint: a stale scalar deck default failing at setting resolution as a caller-facing ModelChoiceNotFoundError (codex:review, unverified, pre-existing and fenced with the deck-side reclassification); a duplicate list of deck-named models beside ModelManager._collect_deck_referenced_handles (cubic, unverified); a deployment's own .py structure class validator text reaching STRICT through the combine (verified residual, not reachable from .mthds content).

round 4 — bar freeze — profile 4 (derived) — the round-3 pass at profile 4 fixed under its bar; the ladder puts this pass at freeze

[lchoquel]

Superseded by #1276, which carries this branch's commits and landed on dev as a7924f6.