feat(ai): support governed model catalogs under reasoning none

[kl3inIT]

Summary

• allow governed Assistant model catalogs when the organization route uses explicit OpenAI reasoning effort NONE
• propagate the active route's NONE policy into every selected catalog model route
• allow admins to publish, revoke, and re-enable model activations under NONE
• enable the admin catalog editor under NONE; keep all higher reasoning efforts fail-closed
• preserve opaque activation IDs, route-version binding, gateway/profile checks, and no silent fallback
• reconcile the AI control-plane behavior and evidence specs

Why

Luna and Terra complete the production incident Skill workload when OpenAI receives explicit reasoning_effort=none. The existing selector rejected every catalog whenever the route pinned any reasoning effort and reconstructed selected routes without the effort. The control plane and admin UI also blocked catalog management. That forced provider-default behavior, which had produced HTTP 400 during the tool-call workload.

Safety boundary

• browser still submits only modelActivationId / server-owned selectedModelActivationId
• no provider model ID or raw reasoning value is accepted from the composer
• server resolves activation through the organization-scoped enabled registry
• inactive/revoked activations remain rejected
• activation authority remains bound to route version and gateway profile
• LOW through MAX still suppress/reject alternate catalog choices
• no automatic retry, hedging, model fallback, or gateway bypass

Verification

• RED then GREEN: AssistantModelAuthorityServiceTests
• RED then GREEN: AiGatewayAdministrationServiceTests.assistantCatalogSoftDisablesAndReenableCreatesANewOpaqueActivation
• safety regression: control plane rejects catalog under HIGH
• RED then GREEN: Playwright admin catalog enabled under NONE
• focused Assistant composer tests: opaque activation only + persisted governed selection PASS
• focused OpenAI factory/provider reasoning propagation tests PASS
• full backend CI-equivalent build: PASS (115 tasks, BUILD SUCCESSFUL)
• pnpm check:web: PASS (API drift, typecheck, unit tests, production build)
• focused Playwright admin spec: PASS
• pnpm check:docs: PASS (OpenAPI/content/manifest/publication/routes/links)
• git diff --check: PASS
• two-pass independent review: first found and prompted the control-plane/UI blocker fix; second verdict APPROVED — no correctness, security, or production blockers

Production verification after merge

1. wait for immutable API/web images and deployment;
2. set Assistant route to Luna with NONE via authenticated control plane;
3. publish Terra plus already-validated existing models as opaque activations;
4. verify composer shows Luna and Terra;
5. run the exact incident-admin-triage Skill question with each activation;
6. revoke Terra's activation, prove the old ID is rejected, then re-enable and prove a fresh opaque ID is issued;
7. verify request bodies contain no raw model/reasoning parameters and no provider HTTP 400.

[coderabbitai]

📝 Walkthrough

Walkthrough

Assistant model catalogs now support answer routes with provider-default or NONE reasoning. Other explicit reasoning modes remain unsupported. Backend validation, the admin UI, and automated tests use the same eligibility rule.

Changes

Assistant model catalog eligibility

Layer / File(s)	Summary
Backend reasoning eligibility core/src/main/java/com/orgmemory/core/ai/AiGatewayAdministrationService.java, core/src/main/java/com/orgmemory/core/ai/AssistantModelAuthorityService.java, core/src/test/java/com/orgmemory/core/ai/*Tests.java	Backend services accept absent or NONE reasoning, preserve the reasoning setting during revalidation, and reject other explicit modes. Tests cover both supported and unsupported configurations.
UI eligibility and end-to-end coverage apps/web/src/features/admin/components/admin-language-models-page.tsx, apps/web/test/e2e/admin-language-models.spec.ts	The admin UI enables assistant model choices for NONE reasoning and updates the restriction message. The E2E test verifies the enabled control and mocked route configuration.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• kl3inIT/OrgMemory#272: Both changes update reasoning-effort eligibility in the admin UI and gateway administration service.
• kl3inIT/OrgMemory#277: Both changes modify OpenAI reasoning-effort route configuration involving NONE.
• kl3inIT/OrgMemory#308: Both changes update assistant route handling for OpenAiReasoningEffort.NONE.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes support for governed model catalogs when reasoning effort is NONE.
Description check	✅ Passed	The description explains the outcome, safety boundary, verification evidence, and production checks, but omits the required Documentation impact section.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/assistant-model-reasoning

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}