[jefft72]

Summary

Review size: 457 meaningful changed lines, plus 0 generated lines and 0 documentation lines, counted as additions plus deletions.
Base: main at 6a4091d; head: codex/token-pr-companion-00-catalog-fixtures.
Fixes the typecheck and runtime failures caused by tests assuming deepseek-ai/DeepSeek-V4-Pro always remains in Together's live catalog.
Runs the full existing CI workflow for every pull request, including requests based on prerequisite branches.
Fixes native acceptance fixtures reporting ECONNRESET instead of checksum failure, or cancelling an update before npm reaches the real archive download.

Reasoning

Model availability changes outside the repository, so generator behavior is tested using fixed provider responses while normal builds continue to refresh public catalogs.
The fixtures run the real strict generator in temporary copies, preserving every existing Together metadata, reasoning-control, and compatibility assertion and verifying that absent, deprecated, or tool-incompatible models stay excluded.
This small prerequisite isolates catalog determinism from the dependency security changes in the following PR.
Removing the pull-request base-branch filter verifies each stacked head with the existing build and test shards, retaining all jobs and permissions.

The owned registry fixture closes each connection and declares response sizes to avoid pooled-socket races.
Cancellation has separate bounded startup and shutdown deadlines, observes the real archive request before signalling, and always cleans up the owned process group.
The integrity, installation-preservation, pinned-repair, and archive-download assertions remain strict.

Changes

• Extracts the existing isolated generator test harness with bounded subprocess execution, guaranteed temporary-directory cleanup, and rejection of unexpected fetch URLs.
• Uses fixed Together catalog inputs for all existing Kimi, GPT-OSS, DeepSeek, and MiniMax metadata and reasoning-control assertions.
• Adds regression cases for omitted, deprecated, and non-tool-capable Together models.
• Preserves the existing strict generator failure-before-mutation checks and environment-key coverage.
• Removes only the main base-branch filter from the CI pull-request trigger.
• Uses explicit response lengths and closed connections for the local registry, with separate bounded startup and cancellation deadlines.
• Records actual child completion and requested cancellation, and cleans up the detached fixture group on every exit path.

Testing

• Reproduced the original TypeScript and runtime failures after npm run build using captured public catalog responses with Together's DeepSeek-V4-Pro omitted.
• npm ci --ignore-scripts using this PR's exact main-branch lockfile.
• npm run build, with a Node preload supplying the captured catalog responses after the fix.
• npm run check, including after catalog regeneration.
• From packages/ai: node ../../node_modules/vitest/dist/cli.js --run test/together-models.test.ts test/generate-models-strict.test.ts: 7 tests passed.
• ./test.sh, using the repository's isolated test runner.
• Parsed the CI YAML and verified the only semantic change is removing the pull-request base-branch filter.
• Reproduced the baseline corrupt-download socket race with an 8-second real npm request stall and the premature cancellation with a 35-second real npm startup delay.
• node scripts/npm-lifecycle.mjs REVIEWED_TARBALL EVIDENCE_DIRECTORY passed full npm/Bun lifecycle checks on Linux ARM64 with Node 22.19.0, npm 11.16.0, and Bun 1.3.11 under the controlled stalls, including observed SIGTERM at the archive boundary, strict integrity rejection, prefix preservation, pinned repair, retained data, and cleanup.
• The local lifecycle reproduction used immutable reviewed artifact bytes from the original failed CI run; their embedded runtime source commit is preserved.
  The hosted workflow separately rebuilds the current pull-request artifact.
• Completed an independent review of the complete catalog, CI-trigger, and npm lifecycle fixture diff.