Upgrade PromptKit to version 0.5.0

docs/integrations/pkg-promptkit.md

@@ -1,11 +1,11 @@
 # PromptKit Integration
 
 Notarius pins
-[`gitea.maximumdirect.net/eric/promptkit` v0.3.0](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.3.0)
+[`gitea.maximumdirect.net/eric/promptkit` v0.5.0](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.5.0)
 as its in-process prompt engine. The upstream
-[Go package consumer guide](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.3.0/docs/consumers/pkg-promptkit.md)
+[Go package consumer guide](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.5.0/docs/consumers/pkg-promptkit.md)
 owns the public engine API, and the upstream
-[format reference](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.3.0/docs/formats.md)
+[format reference](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.5.0/docs/formats.md)
 owns prompt, profile, and schema file contracts.
 
 ## Supported Boundary
@@ -25,9 +25,15 @@ Notarius relies on the root `promptkit` package to:
   admission exhaustion through `ErrCapacityExceeded`.
 
 The pinned
-[`BackendLocal`, `LocalBackend`, and `WithBackend` API](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.3.0/backends.go)
+[`BackendLocal`, `LocalBackend`, and `WithBackend` API](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.5.0/backends.go)
 owns the registration and backend-capacity contract.
 
+When a PromptKit profile and runtime override leave `temperature`, `max_tokens`,
+or `top_p` unset, Notarius leaves that control unset as well. Compatible
+providers therefore apply their own defaults; an operator that requires a
+specific sampling value must select it explicitly in the profile or runtime
+override.
+
 Notarius does not use PromptKit's optional `ArtifactReader`. It materializes
 source and reference content itself and supplies owned inline artifacts at the
 adapter boundary. It also retains responsibility for pipeline retries,

go.mod

@@ -3,7 +3,7 @@ module gitea.maximumdirect.net/eric/notarius
 go 1.25.5
 
 require (
-	gitea.maximumdirect.net/eric/promptkit v0.3.0
+	gitea.maximumdirect.net/eric/promptkit v0.5.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	gopkg.in/yaml.v3 v3.0.1
 )

go.sum

@@ -1,5 +1,5 @@
-gitea.maximumdirect.net/eric/promptkit v0.3.0 h1:P5/GJ6fVIVsBLJx8NxoaGV34ZWeAkU8lm4Ht6aVMOFg=
-gitea.maximumdirect.net/eric/promptkit v0.3.0/go.mod h1:R95NM6fbMDGDC0/UomgnSBP6ui2ns+8SZb8bESNvrDQ=
+gitea.maximumdirect.net/eric/promptkit v0.5.0 h1:jnpazLyyNhWrB2xzwwtUkNUfktkTdkENTwuSPnKiYrc=
+gitea.maximumdirect.net/eric/promptkit v0.5.0/go.mod h1:R95NM6fbMDGDC0/UomgnSBP6ui2ns+8SZb8bESNvrDQ=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=

internal/framework/llm/promptkit_client_test.go

@@ -253,9 +253,10 @@ func TestNewPromptKitClientReportsAssetAndEngineConstructionFailures(t *testing.
 
 func TestPromptKitClientCheckpointFingerprintTracksProfileSource(t *testing.T) {
 	profilePath := filepath.Join(t.TempDir(), "profiles.yml")
+	const credentialEnvironment = "PROMPTKIT_TEST_API_KEY"
 	writeProfile := func(model string) {
 		t.Helper()
-		content := "id: checkpoint-profile\nendpoint: http://promptkit.test/v1\nmodel: " + model + "\n"
+		content := "id: checkpoint-profile\nendpoint: http://promptkit.test/v1\nmodel: " + model + "\napi_key_env: " + credentialEnvironment + "\n"
 		if err := os.WriteFile(profilePath, []byte(content), 0o600); err != nil {
 			t.Fatal(err)
 		}
@@ -281,12 +282,21 @@ func TestPromptKitClientCheckpointFingerprintTracksProfileSource(t *testing.T) {
 
 	writeProfile("model-one")
 	first := fingerprintFor()
+	repeated := fingerprintFor()
+	if first != repeated {
+		t.Fatalf("profile-source fingerprint = %#v then %#v for unchanged source", first, repeated)
+	}
 	writeProfile("model-two")
 	second := fingerprintFor()
 	if first == second {
 		t.Fatalf("profile-source fingerprint = %#v for both profile models", first)
 	}
-	if strings.Contains(first.Value, profilePath) || strings.Contains(first.Value, "model-one") {
+	if strings.TrimSpace(first.Value) == "" {
+		t.Fatal("profile-source fingerprint is empty")
+	}
+	if strings.Contains(first.Value, profilePath) ||
+		strings.Contains(first.Value, "model-one") ||
+		strings.Contains(first.Value, credentialEnvironment) {
 		t.Fatalf("profile-source fingerprint exposes source details: %#v", first)
 	}
 
@@ -306,9 +316,19 @@ func TestPromptKitClientCheckpointFingerprintTracksProfileSource(t *testing.T) {
 	if fresh[0].Value == "mutated" {
 		t.Fatal("LLMCheckpointFingerprints exposed mutable backing storage")
 	}
-	const wantBuiltinFingerprint = "sha256:5218b1dec48f5fdd46836826e0b25906c33efbdf943c5f18085b8d82467e0276"
-	if fresh[0].Value != wantBuiltinFingerprint {
-		t.Fatalf("built-in profile fingerprint = %q, want %q", fresh[0].Value, wantBuiltinFingerprint)
+	secondClient, err := NewPromptKitClient(PromptKitClientConfig{Assets: newTestPromptKitAssets(t)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	secondBuiltin, err := secondClient.LLMCheckpointFingerprints()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(secondBuiltin) != 1 || fresh[0] != secondBuiltin[0] {
+		t.Fatalf("built-in profile fingerprints = %#v and %#v, want deterministic identity", fresh, secondBuiltin)
+	}
+	if strings.TrimSpace(fresh[0].Value) == "" {
+		t.Fatal("built-in profile fingerprint is empty")
 	}
 }
 

internal/framework/llm/promptkit_profile_fingerprint.go

@@ -17,7 +17,7 @@ const (
 	promptKitLocalBackendMarker          = "notarius:promptkit-local-backend:v1"
 	// The built-in profile catalog is compiled into this pinned PromptKit
 	// release. Update this identity when the dependency is upgraded.
-	promptKitBuiltinProfileCatalogID = "promptkit:v0.3.0:builtin-profiles"
+	promptKitBuiltinProfileCatalogID = "promptkit:v0.5.0:builtin-profiles"
 )
 
 func promptKitProfileFingerprint(profileDir, profileFile string) (CheckpointFingerprint, error) {