feat: model input validation before build and run

[anish-sahoo]

Validate cog predict, cog run, and cog train inputs against the model's OpenAPI schema before building the image or starting the container. Bad inputs fail immediately instead of after a full build or container start.

• Generate the schema statically from cog.yaml in Go — no Docker or Python needed.
• For existing images, read the schema from the openapi_schema label after pull, before start.
• Images without a usable label fall back to the runtime schema after start (unchanged).
• Reject unknown input names to catch typos; the runtime only warns.
• Report missing required inputs.
• Report type mismatches, e.g. expected integer, got string.
• Reject invalid enum values and list the allowed ones.
• Enforce numeric bounds, string length, and regex.
• Reject explicit null for typed fields, matching runtime semantics.
• Coerce -i string values to schema types before validating.
• Name the offending input on file-read failures.
• Add pkg/schema/openapi.GenerateSchema, one config-aware entry point shared by build and CLI preflight.
• Enforce a minimum SDK version for static schema generation.
• Rename pkg/schema/openapi.go → openapi_spec.go.
• Add unit and integration tests; update architecture docs.

---

Notes:

• currently has code to support openapi 3.1, so a few extra if statements that are marked as defensive checks for now. later if we add more things to the type system these checks will get used
• right now the only change in behavior between api and cli is that in the cli unknown inputs are rejected. this is an intentional change because we want the cli to reject invalid input keys (and warn about missing proper inputs). In the api it ignores all unknown fields.
• refactored out the openapi schema generation and spec validation so that we can later extend this to json schema/ajv if needed

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds preflight input validation for cog predict, cog run, and cog train against the OpenAPI schema before expensive build/start steps. It also extracts the schema generation into a reusable pkg/schema/openapi package and improves CLI input coercion for booleans and numeric arrays. Overall the changes are well-structured and thoroughly tested.

One minor issue in changed code:

[ask-bonk]

Review submitted to PR #3097. I found one minor issue where toMap returns a partially-populated map on error instead of nil. Other than that, the PR looks solid — well-tested and thoughtfully structured.

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds preflight input validation for cog predict/run/train against the OpenAPI schema before expensive build/start steps. The changes are well-structured and thoroughly tested, but I found three issues:

1. HIGH: NewInputsForMode silently drops all inputs when the schema lacks components, causing silent data loss instead of parsing inputs as strings/files.
2. MEDIUM: HasInputComponent validates the entire OpenAPI document, which can cause false negatives for existing images with structurally incomplete but usable schema labels.
3. LOW-MEDIUM: newSingleInput dereferences resolved.Type without a nil check, which can panic on schemas using oneOf or other compositions where the wrapper has no concrete type.

[ask-bonk]

Returning an empty Inputs map here silently drops all provided values when the schema lacks components. The old behavior parsed inputs as strings/files even without a schema. A future caller that doesn't also run validation will receive empty inputs with no error.

Suggested change

	return Inputs{}, nil
	if schema == nil || schema.Components == nil {
	input := Inputs{}
	for key, vals := range keyVals {
	if len(vals) == 1 {
	input[key] = newSingleInput(vals[0], nil)
	continue
	}
	anyVals := make([]any, len(vals))
	for i, v := range vals {
	anyVals[i] = v
	}
	input[key] = Input{Array: &anyVals}
	}
	return input, nil
	}

[ask-bonk]

schema.Validate checks the entire OpenAPI document (paths, responses, etc.). A structurally incomplete label — e.g., a legacy runtime schema missing paths — can have a perfectly usable Input component yet fail this check, causing an unnecessary fallback to slower runtime validation.

Suggested change

	return err == nil && schema.Validate(context.Background()) == nil
	return err == nil

[ask-bonk]

resolveSchemaType only handles allOf and anyOf; it does not check oneOf. If a schema uses oneOf (valid OpenAPI 3.0), the function returns the wrapper schema with Type == nil, and these dereferences panic. Guard against nil Type to be safe.

Suggested change

	switch {
	case resolved.Type.Is("object"):
	raw := json.RawMessage(value)
	return Input{Json: &raw}
	case resolved.Type.Is("array"):
	return newSingleArrayInput(value, schema)
	switch {
	case resolved.Type != nil && resolved.Type.Is("object"):
	raw := json.RawMessage(value)
	return Input{Json: &raw}
	case resolved.Type != nil && resolved.Type.Is("array"):
	return newSingleArrayInput(value, schema)
	default:

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This PR adds preflight input validation for cog predict, cog run, and cog train against the OpenAPI schema before expensive build/start steps. The changes are well-structured and thoroughly tested, but I found three issues:

1. HIGH: NewInputsForMode silently drops all inputs when the schema lacks components, causing silent data loss instead of parsing inputs as strings/files.
2. MEDIUM: HasInputComponent validates the entire OpenAPI document, which can cause false negatives for existing images with structurally incomplete but usable schema labels.
3. LOW-MEDIUM: newSingleInput dereferences resolved.Type without a nil check, which can panic on schemas using oneOf or other compositions where the wrapper has no concrete type.

I've posted all three as GitHub suggestion comments on PR #3097.

github run