Advertise model.use independently of provisioned_credentials (§6.2, §9.7)

[nficano]

Category: spec-conformance Severity: minor
Location: lib/arcp/runtime/runtime.rb:74-88
Spec: ARCP v1.1 §6.2, §9.7

What

local_capabilities strips both MODEL_USE and PROVISIONED_CREDENTIALS from the advertised feature set whenever no credential_registry is configured. model.use (§9.7) is an independent lease capability with its own enforcement (LeaseManager#check_model!, enforce_model_use:) and is unrelated to credential provisioning. A runtime constructed without a credential_provisioner — the default in the README quick-start and most samples — therefore silently fails to negotiate model.use, so the intersection drops it and require_feature! would reject model.use-dependent client paths. README/CONFORMANCE claim model.use is supported.

Evidence

# lib/arcp/runtime/runtime.rb:75-88
def local_capabilities(agents_inventory: false)
  features = Arcp::Session::Feature::ALL.dup
  unless @credential_registry
    features -= [
      Arcp::Session::Feature::MODEL_USE,            # model.use does not depend on credentials
      Arcp::Session::Feature::PROVISIONED_CREDENTIALS
    ]
  end
  # ...
end

Proposed fix

Only remove PROVISIONED_CREDENTIALS when there is no credential registry. Gate MODEL_USE on the model-enforcement configuration instead (e.g. always advertise it, or tie it to enforce_model_use/registered agent capability), independent of credentials. Add a test that a runtime without a provisioner still advertises model.use and negotiates it with a client.

Acceptance criteria

• A runtime with no credential provisioner advertises model.use.
• provisioned_credentials is still withheld when no registry is present.
• Capability-negotiation test asserts the split.