Thanks for this targeted reliability fix, @franksong2702! The cache metadata preservation problem is real — a groups-only cache hit silently breaking active_provider and default_model for the frontend is exactly the kind of subtle state drift that causes hard-to-reproduce model picker issues.

The approach looks correct:

Cache schema validation
Requiring all three keys (active_provider, default_model, groups) before a cache file is considered valid, and rejecting legacy groups-only files for rebuild, is the right call. Better to do a cold rebuild than serve a partially valid payload.

A few things to confirm before merge:

TTL cache interaction
get_available_models() uses a TTL in-memory cache alongside the disk cache. When a legacy disk cache is rejected and a rebuild is triggered, does the TTL in-memory cache also get invalidated/refreshed? Or could the rebuilt disk cache be correct while the in-memory TTL cache still holds the old groups-only shape for the duration of the TTL window?

Cache invalidation on active_provider change
If the user switches providers (updating config.yaml), the disk cache now stores active_provider. When they switch back or change provider, is the old cached active_provider value detected as stale, or does the cache only get invalidated based on TTL/file age? A cache hit with a stale active_provider would re-introduce the same class of bug this PR is fixing.

Test coverage for partial metadata
The PR covers the groups-only legacy case. Is there test coverage for a disk cache that has active_provider and groups but is missing default_model (or vice versa)? The validation should reject any partial combination.

Changelog entry
The Unreleased entry is appreciated. Confirming it's under the correct section and doesn't duplicate an existing entry.

The test file looks focused and the change to api/config.py is appropriately scoped. This looks close to ready — the TTL cache interaction question is the main thing worth confirming before merge. Thanks for the detailed Thinking Path!

🤖 Automated triage via nesquena-hermes

Addressed the cache-shape and invalidation edge cases from review in f3babd1.

What changed:

• TTL memory cache now goes through the same shape validation before being served. If a legacy groups-only payload or partial metadata payload is still in memory, WebUI discards it and rebuilds instead of serving it for the 24h TTL window.
• Config mtime changes now also discard any disk payload that was preloaded before the config reload path, so stale active_provider / default_model metadata cannot be served after config.yaml changes.
• Added regression coverage for partial metadata payloads: missing active_provider, missing default_model, missing groups, and invalid field types.
• Left the changelog entry under [Unreleased] / Fixed, which matches this patch as a user-visible bug fix.

Verification:

• uv run --with pytest --with pyyaml python -m pytest tests/test_model_cache_metadata.py -> 6 passed
• uv run --with pytest --with pyyaml python -m pytest tests/test_model_cache_metadata.py tests/test_sprint11.py tests/test_ttl_cache.py tests/test_profile_switch_1200.py -> 28 passed
• python3 -m py_compile api/config.py
• git diff --check

Thanks for the follow-up commit f3babd1, @franksong2702 — this directly addresses all three open questions from the previous review.

Confirming the resolutions:

• ✅ TTL memory cache shape validation — in-memory cache now validates the full three-key shape before serving. A groups-only payload in memory is discarded and rebuilt rather than served for the TTL window. This closes the race between disk cache rebuild and in-memory TTL.
• ✅ Config mtime invalidation — config.yaml changes now also discard disk-preloaded payloads with stale active_provider / default_model. The class of bug this PR is fixing cannot re-enter through a provider switch.
• ✅ Partial metadata regression coverage — four new cases: missing active_provider, missing default_model, missing groups, invalid field types. The validation rejects all partial combinations correctly.
• ✅ Changelog — [Unreleased] / Fixed is the correct section for a user-visible bug fix.

The 28-test pass across test_model_cache_metadata.py, test_sprint11.py, test_ttl_cache.py, and test_profile_switch_1200.py is a solid cross-suite confirmation that the fix doesn't regress the surrounding model cache behavior.

This looks ready for merge. The implementation is clean and the test coverage is thorough.

🤖 Automated triage via nesquena-hermes

Merged in v0.50.237 via #1243. Thank you @franksong2702! 🎉