fix(providers): complete live Zen chat and tool round trips

Share the persisted provider credential namespace across setup and daemon requests. Accept absent nullable Chat delta fields, negotiate usage consistently, and retain bounded assistant reasoning through local transcript recovery.

Add sanitized live Zen canary fixtures and regression coverage. Verified 716 tests, strict Clippy, formatting, standard repository checks, optimized packaging, and live chat, tool-result replay, and model refresh.

Author: dollspace-gay

crates/app/peritus-daemon/src/component/connection.rs

@@ -17,8 +17,7 @@ pub async fn test_provider_connection(
 ) -> Result<ConnectionReport, DaemonError> {
     let declaration = route.declaration()?;
     let id = declaration.profile().profile_id();
-    let broker = PlatformCredentialSource::new("org.corvidae-coding.peritus.providers")
-        .map_err(connection_error)?;
+    let broker = PlatformCredentialSource::providers();
     let registry = ProviderRegistry::build(
         vec![declaration],
         ProviderRegistryLimits::PRODUCTION,

crates/app/peritus-daemon/src/component/credentials.rs

@@ -10,15 +10,10 @@ pub struct PlatformCredentialSource {
 }
 
 impl PlatformCredentialSource {
-    /// Opens the platform credential namespace without reading any secret material.
-    ///
-    /// # Errors
-    ///
-    /// Rejects an invalid service namespace.
-    pub fn new(service: &str) -> Result<Self, ProviderCoreError> {
-        let store = PlatformCredentialStore::new(service.to_owned())
-            .map_err(|_| credential_error("platform credential namespace is invalid"))?;
-        Ok(Self { store })
+    /// Opens the same provider namespace used by setup without reading any secret material.
+    #[must_use]
+    pub fn providers() -> Self {
+        Self { store: PlatformCredentialStore::providers() }
     }
 
     /// Reports whether the current platform credential adapter is available.

crates/app/peritus-daemon/src/component/inventory.rs

@@ -27,7 +27,7 @@ impl DaemonComponents {
     pub fn build(config: &DaemonConfig) -> Result<Self, DaemonError> {
         let direct =
             config.providers().iter().any(crate::ProviderRoute::requires_credential_broker);
-        let credential_source = PlatformCredentialSource::new("peritus").map_err(provider_error)?;
+        let credential_source = PlatformCredentialSource::providers();
         if direct && !credential_source.available() {
             return Err(DaemonError::new(
                 DaemonErrorCode::RecoveryRequired,
@@ -111,13 +111,3 @@ fn tool_error(error: ToolComponentError) -> DaemonError {
         error,
     )
 }
-
-fn provider_error(error: peritus_provider_core::ProviderCoreError) -> DaemonError {
-    DaemonError::with_source(
-        DaemonErrorCode::InvalidInput,
-        DaemonRecovery::CorrectRequest,
-        "construct credential broker",
-        error.to_string(),
-        error,
-    )
-}

crates/app/peritus-product-runner/src/local_context/memory/ingestion.rs

@@ -79,8 +79,12 @@ impl LocalMemory {
         &mut self,
         message: &Message,
     ) -> Result<u64, DeveloperLoopError> {
+        // Assistant reasoning is bounded protocol replay, retained exactly with its exchange.
+        // It is never projected into authoritative instructions or derived working entries.
         if message.content().iter().any(|block| {
-            matches!(block, ContentBlock::Reasoning(_) | ContentBlock::ProviderExtension(_))
+            matches!(block, ContentBlock::ProviderExtension(_))
+                || (matches!(block, ContentBlock::Reasoning(_))
+                    && message.role() != Role::Assistant)
         }) {
             return Err(error("opaque provider content is not local working memory"));
         }

crates/app/peritus-product-runner/src/local_context/tests.rs

@@ -5,6 +5,7 @@ mod capacity;
 mod folder;
 mod inspection;
 mod invocation;
+mod reasoning;
 mod recovery;
 mod retrieval;
 mod reviewer;

crates/app/peritus-product-runner/src/local_context/tests/reasoning.rs

@@ -0,0 +1,75 @@
+//! Exact assistant reasoning replay stays separate from authoritative working entries.
+
+use super::support::*;
+use peritus_agent::DeveloperToolObservation;
+use peritus_model_protocol::{
+    ContentBlock, Message, ProtocolLimits, ReasoningReplay, Role, ToolResult,
+};
+
+#[test]
+fn assistant_reasoning_survives_local_archive_and_recovery_without_becoming_instructions() {
+    let fixture = Fixture::new();
+    let mut memory = fixture.open();
+    begin(&mut memory, "reasoning");
+    let limits = ProtocolLimits::PRODUCTION;
+    let replay = ContentBlock::Reasoning(
+        ReasoningReplay::new(
+            None,
+            br#"{"service":"opencode-zen","fields":{"reasoning_content":"untrusted opaque note"}}"#
+                .to_vec(),
+            limits,
+        )
+        .unwrap(),
+    );
+    let mut blocks = message(Role::Assistant, "visible answer").content().to_vec();
+    blocks.insert(0, replay.clone());
+    let assistant = Message::new(Role::Assistant, blocks, limits).unwrap();
+    memory.observe_message(&assistant).expect("assistant replay can be archived");
+    let tool = call("reasoning-call");
+    let proposal = Message::new(
+        Role::Assistant,
+        vec![replay.clone(), ContentBlock::ToolCall(tool.clone())],
+        limits,
+    )
+    .unwrap();
+    memory.observe_message(&proposal).unwrap();
+    let output = canonical(&serde_json::json!({"content":"observed"}));
+    memory
+        .observe_tool(&tool, &DeveloperToolObservation { output: output.clone(), is_error: false })
+        .unwrap();
+    let result = Message::new(
+        Role::Tool,
+        vec![ContentBlock::ToolResult(ToolResult::new(tool.id().clone(), output, false))],
+        limits,
+    )
+    .unwrap();
+    memory.observe_message(&result).unwrap();
+    let view = memory.prepare_view(&profile(32_768), &[]).unwrap();
+    assert!(view.contains(&assistant));
+    let position = view.iter().position(|message| message == &proposal).unwrap();
+    assert_eq!(view.get(position + 1), Some(&result));
+    assert!(!render(&view).contains("untrusted opaque note"));
+    assert!(memory.state.entries(memory.state.binding()).unwrap().is_empty());
+    memory.publish(&view).unwrap();
+    drop(memory);
+
+    let mut memory = fixture.open();
+    let recovered = memory.prepare_view(&profile(32_768), &[]).unwrap();
+    assert!(recovered.contains(&assistant));
+    let position = recovered.iter().position(|message| message == &proposal).unwrap();
+    assert_eq!(recovered.get(position + 1), Some(&result));
+    for role in [Role::System, Role::Developer, Role::User, Role::Tool] {
+        assert!(
+            Message::new(role, vec![replay.clone()], limits).is_err(),
+            "opaque content from {role:?}"
+        );
+    }
+    begin(&mut memory, "next-invocation");
+    let fresh = memory.prepare_view(&profile(32_768), &[]).unwrap();
+    assert!(
+        !fresh
+            .iter()
+            .flat_map(Message::content)
+            .any(|block| matches!(block, ContentBlock::Reasoning(_)))
+    );
+}

crates/app/peritus-provider-onboarding/src/direct.rs

@@ -11,8 +11,6 @@ use peritus_types::ResourceId;
 
 use crate::OnboardingError;
 
-const SERVICE: &str = "org.corvidae-coding.peritus.providers";
-
 /// Sensitive provider material that zeroizes its allocation on drop.
 pub struct DirectCredential(SecretMaterial);
 
@@ -96,7 +94,7 @@ impl DirectProviderDraft {
         credential: &DirectCredential,
     ) -> Result<DirectProviderProfile, OnboardingError> {
         let resource_id = random_resource_id()?;
-        let store = PlatformCredentialStore::new(SERVICE.to_owned())?;
+        let store = PlatformCredentialStore::providers();
         let reference = store.store(resource_id, &credential.0)?;
         let profile = DirectProviderProfile::new(
             self.kind,
@@ -123,7 +121,7 @@ impl DirectProviderDraft {
 /// Returns a malformed-reference or credential-store removal failure.
 pub fn remove_direct_credential(profile: &DirectProviderProfile) -> Result<(), OnboardingError> {
     let reference = parse_credential_reference(profile.credential_reference())?;
-    PlatformCredentialStore::new(SERVICE.to_owned())?.remove(reference.resource_id())?;
+    PlatformCredentialStore::providers().remove(reference.resource_id())?;
     Ok(())
 }
 

crates/model/peritus-provider-compatible/fixtures/v1/MANIFEST

@@ -23,3 +23,6 @@ responses-unknown-ancillary.sse
 responses-unknown-critical.sse
 SHA256SUMS
 transient-error.json
+zen-deepseek-live-1.sse
+zen-deepseek-live-2.sse
+zen-deepseek-live-3.sse

crates/model/peritus-provider-compatible/fixtures/v1/SHA256SUMS

@@ -1,3 +1,4 @@
+553fe57de7657b0aa2e4203a95824bb27c34f2d0021c51c8f95c7f240b9f92ef  MANIFEST
 5fee750e7d57cc3f3d75b662a094b6f5b915411ad83b4024d0ba0b227f48cfab  auth-error.json
 7a561dfb21a3d8a193a5ad4fda3a76c791f67498ba99f35dba670aea00d110f5  chat-corrupt.sse
 0b5cfa9147ebbb11f6d5ebfc8feb42d36663b6d7bdf804bf07b3c092e769a070  chat-error-after-http-success.sse
@@ -7,9 +8,8 @@ f80c44a65eedaf084447e562188874e0a202cb64fab8e71a3a6a42aa252b33a2  chat-refusal.s
 a4d884cd2c75ab8fa44bb9090d20447fd4bf3e007f6beb6edc5d865df314821d  chat-tool.sse
 8e25be29faa22810440a78ec2fef2ebf6e445f2cc00ab18bee394239cd4270db  chat-unknown-ancillary.sse
 fc21fcead6ee0cb09352bec149f7e270f9f8e72fc6779d1658ec1455af983f61  chat-unknown-critical.sse
-022e388dc79e961ae8fcad33bbc707bad7d4bfab8bd01b7b3397c46f0b2063a9  golden-chat-request.json
+fb6f24452b7eeb2a7cca8cf04da811648da988fb9e5c71b0092ced52046f7e88  golden-chat-request.json
 6a271bb917f1360c3b8f611f9706c8ae07d8749c19f9cdc530f5c161735e2068  golden-responses-request.json
-d769cb9dc66a01cb4a011018996acc69f81c62cc6164ed57f6be612c5be79055  MANIFEST
 11148a3362043bdeedcf5f05c11276d54fd5bbb2b460d9874c36624ec20842b9  rate-error.json
 7222e84d43ffc1aa2b7d38ece9566b585dd220ca337b2f7bc28a9f603b293cda  responses-corrupt.sse
 285096508f979169cdc7fa615ba9d560304aa02ef3ddb3e8df866aa4e1615bd4  responses-error-after-http-success.sse
@@ -21,3 +21,6 @@ d769cb9dc66a01cb4a011018996acc69f81c62cc6164ed57f6be612c5be79055  MANIFEST
 a7fcc2b50259ca602672970adda7fd235a828040e5574daa43fa887ad4062d23  responses-unknown-ancillary.sse
 379b59d8c02973bfa9b8c75ac056534d0fedbfdf32385607d3987d0f312bb8d8  responses-unknown-critical.sse
 557b4eb7efa5b6847c431483b307d878617617fff5be7a87801fbc7431ecae52  transient-error.json
+3bf111bb39490d83e9be1343e58b5602b81b6f2f40f9094a14d1c753c78eb256  zen-deepseek-live-1.sse
+a73b65f2cd38dd1b81607d2a96cf0852bd661b5aba24f455238a2264da8f45b7  zen-deepseek-live-2.sse
+90698be3fb77bed28cc75a37b9cd8bf66a98800d66c249a2ea4ee6fa98fb730a  zen-deepseek-live-3.sse

crates/model/peritus-provider-compatible/fixtures/v1/golden-chat-request.json

@@ -1 +1 @@
-{"max_completion_tokens":64,"messages":[{"content":[{"text":"hello","type":"text"}],"role":"user"}],"model":"model-test","parallel_tool_calls":false,"response_format":{"type":"text"},"stream":true,"stream_options":{"include_usage":true}}
+{"max_completion_tokens":64,"messages":[{"content":[{"text":"hello","type":"text"}],"role":"user"}],"model":"model-test","parallel_tool_calls":false,"response_format":{"type":"text"},"stream":true,"stream_options":{"include_usage":false}}