Add in-app Malibu model switching - #956
Merged
Merged
Conversation
Align the general installed-only manual check with the product trust contract by requiring scope, no-download disclosure, load/benchmark impact, duration, and provider confirmation before work begins. Carry the same contract into acceptance and test requirements.\n\nConstraint: Installed-only checks may load and benchmark local weights while the provider continues serving, so the UI must disclose non-download cost without implying a free spinner.\nRejected: Leave cost disclosure targeted-only | it contradicts the broad evaluation guard and hides material work behind the installed-model affordance.\nConfidence: high\nScope-risk: narrow\nDirective: Keep manual and background recommendation paths distinct; background checks remain installed-only and scheduler-gated.\nTested: git diff --check; targeted spec review against the prior M1 evidence.\nNot-tested: Product and adversarial re-review still running.
Expose provider-owned model inventory and a fail-closed Malibu control surface for switching the active runtime model, including signed authority, lifecycle progress, rollback, and revert behavior. Constraint: Malibu must rely on the launchd provider's signed model authority and versioned control protocol. Rejected: client-side model readiness and unsigned target selection | they would allow UI state to diverge from provider reality. Confidence: high Scope-risk: broad Directive: Preserve the provider-owned authority boundary when extending model management. Tested: 107 targeted Swift tests, 11 Malibu model-management tests, JSON validation, and diff checks. Not-tested: full repository test suite and release packaging verification.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
antfleet-ops
previously approved these changes
Aug 9, 2026
antfleet-ops
left a comment
antfleet-ops
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed by antfleet-ops after the audited implementation and targeted test evidence. The provider-owned authority boundary, fail-closed swap preflight, and Malibu control path are acceptable.
Place the product build artifact under the design-support tree so the repository's canonical-spec index gate can distinguish it from normative SPEC-NNN documents. Constraint: CI treats tracked specs/ root files as canonical unless they have a normative header. Rejected: adding a synthetic normative SPEC header | the document is a build artifact, not a canonical contract. Confidence: high Scope-risk: narrow Directive: Keep future BUILD_SPEC and audit artifacts under supporting spec subdirectories. Tested: gen_spec_index.py --lint, gen_spec_index.py --check, and git diff --check.
antfleet-ops
approved these changes
Aug 9, 2026
antfleet-ops
left a comment
antfleet-ops
left a comment
Collaborator
There was a problem hiding this comment.
Re-approved by antfleet-ops for the latest PR head after the supporting BUILD SPEC relocation. The audited implementation remains unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Issue #953 identifies Terminal-only model selection as a provider UX barrier. This PR delivers the safe in-app switching slice while preserving the provider CLI as the runtime authority.
Validation
SPEC-GOVERNANCE-DECLARATION-BEGIN
{
"schema_version": "spec-pr-governance-v1",
"behavior_change": "yes",
"contract_change": "none",
"specs": ["SPEC-010", "SPEC-011"],
"requirements": ["SPEC-010-R006"],
"authority_domains": ["operator-pushed-warm-swap"],
"arbitration": ["CODE_BUG"],
"tests": ["targeted SwiftPM model-switching suite", "Malibu model-management test suite"],
"journeys": ["not-required"],
"issue": "#953"
}
SPEC-GOVERNANCE-DECLARATION-END