feat: complete evidence restructuring worktree

scripts/secret-file-utils.sh

@@ -1,32 +0,0 @@
-#!/bin/sh
-set -eu
-
-validate_secret_file() {
-  path="$1"
-  label="$2"
-  if [ -L "$path" ] || [ ! -f "$path" ] || [ ! -r "$path" ]; then
-    echo "$label must be a readable regular file, not a symlink: $path" >&2
-    exit 2
-  fi
-  mode=$(stat -c '%a' "$path" 2>/dev/null || stat -f '%Lp' "$path" 2>/dev/null) || {
-    echo "cannot inspect permissions for $label: $path" >&2
-    exit 2
-  }
-  if [ $((0$mode & 077)) -ne 0 ]; then
-    echo "$label must not be readable or writable by group/other users: $path" >&2
-    exit 2
-  fi
-}
-
-read_secret_file() {
-  path="$1"
-  label="$2"
-  validate_secret_file "$path" "$label"
-  value=$(tr -d '\r' <"$path")
-  case "$value" in
-    *'
-'*) echo "$label must contain exactly one line" >&2; exit 2 ;;
-  esac
-  [ -n "$value" ] || { echo "$label must not be empty" >&2; exit 2; }
-  printf '%s' "$value"
-}

scripts/test-pi-user-auth-compose.sh

@@ -58,13 +58,24 @@ from pathlib import Path
 
 settings = json.loads(Path("deploy/pi/settings.json").read_text())
 assert settings["enabledModels"] == [
-    "zai/glm-5.2",
+    "zai/glm-5.3",
     "deepseek/deepseek-v4-flash",
     "deepseek/deepseek-v4-pro",
-    "aritmolab/qwen3.6-35b-a3b",
+    "local-qwen/qwen3.6-35b-a3b",
 ]
+models = json.loads(Path("deploy/pi/models.json").read_text())
+qwen = models["providers"]["local-qwen"]
+assert qwen["api"] == "openai-completions"
+assert qwen["models"][0]["id"] == "qwen3.6-35b-a3b"
+assert qwen["models"][0]["compat"]["maxTokensField"] == "max_tokens"
+assert "aritmolab" not in models["providers"]
 PY
 
+if grep -R -n 'registerProvider' harness/.pi/extensions; then
+  echo "Pi model providers must be declared in deploy/pi/models.json, not in code" >&2
+  exit 1
+fi
+
 grep -q '^ARG PI_VERSION=0.80.3$' docker/core.Dockerfile
 grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/local.env.example
 grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/server.env.example