[Task][AI Proxy] Add schema-validated structured output with bounded opt-in repair #8257

Problem and baseline

An upstream HTTP/Chat envelope can be valid while the generated message is invalid JSON or violates the application's schema. Treat generated-content compliance separately from malformed transport/protocol JSON or SSE. Parent: #8055; reviewed master 8046953ca.

AiProviderCapabilities already distinguishes JSON mode and JSON Schema declarations. AiProxyEngine owns retry/fallback and prohibits switching after visible output. Preserve those foundations rather than classifying every parse failure as a transient network error.

First delivery: explicit policy, supported non-streaming text

1. Prefer provider-native strict/schema-constrained output where the actual provider/model/schema combination supports it. Constrained decoding runs at the provider/model, not in the gateway. JSON mode alone does not prove schema compliance; unsupported requirements cannot be silently removed. Coordinate capability filtering with [Feature][AI] Add capability-aware virtual models and weighted upstream pools #8046.
2. Validate the selected generated content field, not only the outer API envelope. Use a versioned operator-managed schema and bounded payload/depth/validation work. Bound supported schema dialect/keywords and disable arbitrary remote reference fetching; no unconstrained regex/schema execution.
3. Classify invalid JSON, schema mismatch, empty output, truncation, refusal and unsupported capability separately from protocol/transport failure. Schema-valid output is not proof of business correctness or safety.
4. Offer explicitly configured, bounded regeneration/repair prompts for allowed content-validation failures only. Define the repair attempt/token limits and conservative default (no implicit repair), preserve original prompt/schema/model references, and validate the repaired answer again. A refusal/safety decision is not a formatting error to bypass.
5. All additional model work remains inside the same [Task][AI Proxy] Apply a shared request deadline across AI attempts, backoff and fallback #8121 overall deadline and accepted [Enhancement] Bound concurrent AI token-budget overshoot with reservation and reconciliation #7702/[Task] Extend token reservations to identity-scoped token and cost budgets #7958 budget policy, with [Task] Integrate shared per-attempt LLM usage metering across supported protocols #7955 attempt usage, [Feature][AI] Add a usage ledger with versioned pricing and cost attribution #7934 cost attribution and [Task] Add unified AI and MCP invocation auditing #7950 audit. If budget/capability/authorization cannot be established, do not advertise enforced repair-budget guarantees or start unapproved work. The 3-second / 2.8-second fixture cannot launch an independent 5-second repair.
6. No automatic replay of tool-bearing/effectful operations. A repair mechanism cannot execute or repeat tools or restart an application workflow. Once response bytes are committed, do not replace/repair/mix another response. Streaming strict-validation/holdback requires a separate reviewed, bounded release contract; it is not silently converted to full-body buffering.

Acceptance

• A supported provider-native schema fixture and an explicitly unsupported provider/model/schema case prove capability handling without silent downgrade.
• Valid JSON, syntax-invalid generated content, schema mismatch, refusal, empty/truncated content and malformed outer JSON/SSE get distinct documented outcomes.
• Opt-in successful repair, failed repair, maximum attempts/tokens, deadline exhaustion, cancellation and unavailable budget all have deterministic tests and termination.
• Each actual repair generation is correlated billable work with its own attempt identity/reason; validation itself is not recorded as another upstream attempt. Do not duplicate the network retry counter or invent zero usage/cost.
• Response bytes are unchanged when disabled or validation passes; original/repaired sensitive text is excluded from default logs and body-free audit. Invalid model text cannot inject uncontrolled repair instructions or expose credentials.
• Tests prove no side-effecting tool replay and no repair after client-visible output; gateway overhead and additional model latency/cost are reported separately.

Boundaries

#7382 owns wire protocol validation, #8122 owns network replay safety, #7623 semantic safety judgement, #8051 prompt publication and #8052 evaluation gates. This task does not promise semantic correctness, implement model inference/constrained decoding locally, or introduce another provider/ledger/evaluation platform.

Format quality versus protocol reliability metrics (2026-10-30)

Contribute distinct outcomes to #8055: generated-content JSON parsing, JSON Schema mismatch and final format compliance versus malformed outer provider JSON/SSE. The quality format_pass_rate denominator contains only requests with the corresponding output contract and valid inspection coverage; ordinary unconstrained text is not a format failure.

Preserve initial validation failure and post-repair success/failure as separate observations. Repair cannot erase the initial reliability/quality signal, and each actual regeneration still contributes attempts, latency and #7955/#7934 usage/cost. Refusal, truncation, missing output, unsupported schema and uninspected streaming are explicit outcomes, not successful validation or zero-cost repair. Reuse request/attempt identities and schema/repair policy provenance without logging model text or sensitive schema values by default. Tests cover invalid-then-repaired output, malformed envelopes, ordinary text, unsupported capabilities, committed streams and exhausted budget.