manage-providers

name	manage-providers
description	Inherit the provider catalog from the locked runtime dependency while keeping availability separate from real certification. Use when creating, changing, reviewing, or diagnosing the providers and models capability in a CoreMind project.

Providers and Models

1. Read the module contract and the language-matched guide only when implementation details are needed.
2. Identify the business owner, accepted inputs and outputs, failure conditions, permission mode, and quality profile.
3. Follow the SOP in order. Do not invent unresolved business rules or broaden the requested architecture.
4. Add or update a failing test before implementation, then make the smallest change that passes it.
5. Inspect RunOutcome, Trace, budgets, approvals, and checkpoints. Treat a fluent answer without evidence as unverified.
6. Obtain explicit data-egress and cost approval before live certification. Require streaming, tool call, structured result, multi-turn, abort, error mapping, and long-context evidence from the same version/provider/model.
7. Bind certification to the full Git commit and Runtime artifact SHA-256 that were actually tested.
8. Treat the caller-injected environment as authoritative. Test conflicting and empty environments; never fall back to host variables or credential files after apiKeyEnv is selected.
9. Keep incomplete or older evidence configurable and unverified; regenerate the matrix and inspect certification gaps.
10. Run the tests listed in module.yaml and npm run check:modules.
11. Stop on a security failure or non-reversible action that lacks explicit user authorization. Never push, tag, or publish implicitly.

中文执行原则：先确认业务规则，再按 SOP 实现；失败不得伪装成成功；full 只改变审批强度，不得关闭显式 deny、审计、checkpoint 和恢复。路径感知文件工具与 shell 的平台边界必须分别验证。