Extend prompt execution contract

internal/promptexec/promptexec.go

@@ -51,6 +51,7 @@ type OutputContract struct {
 	Format         string
 	ValidationMode string
 	SchemaPath     string
+	RepairAttempts int
 }
 
 // ProfileInspection describes the safe, selected execution identity for one profile.
@@ -141,19 +142,21 @@ type TokenUsage struct {
 
 // Validation records a completed output validation check.
 type Validation struct {
-	Status      ValidationStatus
-	Mode        string
-	SchemaPath  string
-	Diagnostics []string
+	Status         ValidationStatus
+	Mode           string
+	SchemaPath     string
+	RepairAttempts int
+	Diagnostics    []string
 }
 
 // NewValidation returns a completed validation value with bounded diagnostics.
-func NewValidation(status ValidationStatus, mode string, schemaPath string, diagnostics []string) Validation {
+func NewValidation(status ValidationStatus, mode string, schemaPath string, repairAttempts int, diagnostics []string) Validation {
 	return Validation{
-		Status:      status,
-		Mode:        mode,
-		SchemaPath:  schemaPath,
-		Diagnostics: boundDiagnostics(diagnostics),
+		Status:         status,
+		Mode:           mode,
+		SchemaPath:     schemaPath,
+		RepairAttempts: repairAttempts,
+		Diagnostics:    boundDiagnostics(diagnostics),
 	}
 }
 
@@ -235,6 +238,86 @@ func (e *Error) Category() ErrorCategory {
 	return e.category
 }
 
+// GenerationError retains provider failure details for programmatic handling
+// without exposing them through routine formatting or serialization.
+type GenerationError struct {
+	statusCode      int
+	providerCode    string
+	providerType    string
+	providerMessage string
+	err             *Error
+}
+
+// NewGenerationError returns a classified generation failure with bounded
+// provider details. The dependency cause remains reachable through err only.
+func NewGenerationError(statusCode int, providerCode string, providerType string, providerMessage string, cause error) *GenerationError {
+	return &GenerationError{
+		statusCode:      statusCode,
+		providerCode:    boundCodePoints(providerCode, 256),
+		providerType:    boundCodePoints(providerType, 256),
+		providerMessage: boundCodePoints(providerMessage, 4096),
+		err:             NewError(Generation, "provider generation failed", cause),
+	}
+}
+
+// StatusCode returns the provider HTTP status when one was available.
+func (e *GenerationError) StatusCode() int {
+	if e == nil {
+		return 0
+	}
+	return e.statusCode
+}
+
+// ProviderCode returns the bounded provider error code.
+func (e *GenerationError) ProviderCode() string {
+	if e == nil {
+		return ""
+	}
+	return e.providerCode
+}
+
+// ProviderType returns the bounded provider error type.
+func (e *GenerationError) ProviderType() string {
+	if e == nil {
+		return ""
+	}
+	return e.providerType
+}
+
+// ProviderMessage returns the bounded provider error message.
+func (e *GenerationError) ProviderMessage() string {
+	if e == nil {
+		return ""
+	}
+	return e.providerMessage
+}
+
+// Category returns Generation for every generation failure.
+func (e *GenerationError) Category() ErrorCategory { return Generation }
+
+// Error intentionally excludes provider details from ordinary error text.
+func (e *GenerationError) Error() string {
+	if e == nil {
+		return ""
+	}
+	message := NewError(Generation, "provider generation failed", nil).Error()
+	if e.statusCode == 0 {
+		return message
+	}
+	return fmt.Sprintf("%s (HTTP %d)", message, e.statusCode)
+}
+
+// GoString keeps %#v formatting as safe as ordinary error formatting.
+func (e *GenerationError) GoString() string { return e.Error() }
+
+// Unwrap preserves the project-owned classified error and its hidden cause.
+func (e *GenerationError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	return e.err
+}
+
 // CapacityError adds the safe backend identity to a capacity failure.
 type CapacityError struct {
 	BackendID string