Module discovery 

Optional, capability-negotiated model discovery: agentd learns what an endpoint serves via a tiny handshake. The rules that keep it harmless are absolute — it runs only when an endpoint looks discovery-capable, stays silent on failure, is never fatal, never sits on the hot path, and never runs at startup ahead of a side effect.

The probe is one hand-rolled HTTP GET /v1/models over the EXISTING intel transport (super::endpoints::Endpoint::discover_models) — no second client, no streaming, no added dependencies. For an OpenAI-compatible endpoint it parses { "data": [ { "id": "…" } ] }. The anthropic dialect has no list endpoint, so it contributes nothing; the configured model is dialed regardless, which is why discovery can be absent without breaking a run.

The surfaces that consume the result — agentd://intelligence and the capabilities manifest’s intelligence.models — are served supervisor-side, which is where a caller is expected to fire the probe: lazily, on a read of the served surface, and behind its own cache. Those reads are infrequent and operator-driven, so a cached probe at that seam costs a run nothing and keeps the discovery field off the control protocol entirely. This module is the pure probe: it holds no cache, no TTL and no state of its own, so every caller is responsible for not re-probing on every read.

Structs

DiscoveryResult

The discovery outcome for the served surface:

Constants

DEFAULT_TIMEOUT

The default per-probe timeout, deliberately short because the probe is best-effort. A slow or wedged endpoint must not stall the operator-driven read that triggered it.

Functions

discover

Probe every OpenAI-compatible endpoint in list for its served models and fold the results into a DiscoveryResult. model is the configured model id and is always unioned in, because it is dialable whether or not any endpoint answered the probe. Every failure mode is silent: a probe that 404s, cannot connect, or returns non-JSON contributes no models and leaves discovery false. It is never fatal and never counts as a failover-class error, so a probe must not be able to trip an endpoint’s circuit breaker.