feat: expose safe pi management api

tools/thothctl/internal/pi/update_test.go

@@ -517,6 +517,8 @@ func TestMaintenanceClearAndCompensationFailuresRemainGated(t *testing.T) {
 	}
 }
 
+// Catches maintenance recovery clearing admission after the obsolete composite smoke rather than
+// the same dedicated Pi Management smoke contract used for ordinary image verification.
 func TestRecoverMaintenanceClearsOnlyAfterTerminalStateAndVerifiedSmoke(t *testing.T) {
 	fake := newFakeRunner()
 	fake.maintenance = true
@@ -544,8 +546,7 @@ func TestRecoverMaintenanceClearsOnlyAfterTerminalStateAndVerifiedSmoke(t *testi
 	if selected := readSelectorReference(t, currentImageOverridePath(statePath)); selected != previous.Reference {
 		t.Fatalf("maintenance cleanup changed durable selector to %q", selected)
 	}
-	assertCalled(t, fake.calls, "/models")
-	assertCalled(t, fake.calls, "/settings")
+	assertCalled(t, fake.calls, "/pi-management/test")
 }
 
 func TestRecoverMaintenanceRefusesPendingTransaction(t *testing.T) {
@@ -811,6 +812,8 @@ type fakeRunner struct {
 	backendRestarts               int
 	dropMaintenanceAfterCandidate bool
 	modelsWire                    string
+	piManagementOptionsWire       string
+	piManagementTestWire          string
 	rollbackPrepared              bool
 	coreRunning                   bool
 	execFailuresWhileStopped      int
@@ -867,7 +870,7 @@ func (f *fakeRunner) Run(_ context.Context, args []string, _ io.Reader) (compose
 	if f.fail == "version" && f.built && strings.Contains(call, "pi --version") && strings.Contains(call, "exec") {
 		return compose.Result{ExitCode: 1}, errors.New("version token=secret")
 	}
-	if f.fail == "smoke" && f.built && strings.Contains(call, "127.0.0.1:8787/models") {
+	if f.fail == "smoke" && f.built && strings.Contains(call, "127.0.0.1:8787/pi-management/test") {
 		return compose.Result{ExitCode: 1}, errors.New("smoke token=secret")
 	}
 	switch {
@@ -1016,6 +1019,19 @@ func (f *fakeRunner) Run(_ context.Context, args []string, _ io.Reader) (compose
 		return compose.Result{Stdout: f.version + "\n"}, nil
 	case strings.Contains(call, "PI_VERSION"):
 		return compose.Result{Stdout: f.expectedVersion + "\n"}, nil
+	case strings.Contains(call, "/pi-management/options"):
+		if f.piManagementOptionsWire != "" {
+			return compose.Result{Stdout: f.piManagementOptionsWire}, nil
+		}
+		return compose.Result{Stdout: `{"providers":["provider"],"models":[{"id":"model","provider":"provider"}],"reasoning":["low","medium","high"]}`}, nil
+	case strings.Contains(call, "/pi-management/test"):
+		if f.currentImage == "sha256:old" {
+			f.restoredProofComplete = true
+		}
+		if f.piManagementTestWire != "" {
+			return compose.Result{Stdout: f.piManagementTestWire}, nil
+		}
+		return compose.Result{Stdout: `{"ready":true}`}, nil
 	case strings.Contains(call, "/models"):
 		if f.modelsWire != "" {
 			return compose.Result{Stdout: f.modelsWire}, nil