Expand description
Process-wide services-config bootstrap.
Mirrors systemprompt_config::ProfileBootstrap for the services tree: the
merged, validated ServicesConfig — provider catalog, resolved gateway,
agents, MCP servers — is loaded once, right after the profile, and read
through &'static accessors for the life of the process. A load failure is
a boot failure: nothing downstream may run against a catalog that did not
parse.
Provider discovery (ServicesBootstrap::try_init_with_discovery) is
therefore boot-time only. The registry lives behind a OnceLock and
is handed out as &'static ProviderRegistry to ~15 call sites, so there is
no sound way to mutate it after install; a model that appears upstream mid
process is served only after the next restart. The augmentation runs in the
one window where the config is still owned — between ConfigLoader::load
and install — and the config is re-validated afterwards so a discovered
model can never bypass the gateway pricing gate. A second
try_init_with_discovery after any init is a no-op returning the installed
config; the report from the one pass that did run is kept behind
ServicesBootstrap::discovery_report.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.