feat(inference): make endpoint verification explicit

python/openshell/sandbox.py

@@ -398,13 +398,18 @@ class InferenceRouteClient:
         *,
         provider_name: str,
         model_id: str,
+        verify: bool = False,
         no_verify: bool = False,
     ) -> ClusterInferenceConfig:
+        if verify and no_verify:
+            raise ValueError("verify and no_verify are mutually exclusive")
+
         response = self._stub.SetClusterInference(
             inference_pb2.SetClusterInferenceRequest(
                 provider_name=provider_name,
                 model_id=model_id,
-                skip_validation=no_verify,
+                verify=verify,
+                no_verify=no_verify,
             ),
             timeout=self._timeout,
         )

python/openshell/sandbox_test.py

@@ -6,6 +6,8 @@ from __future__ import annotations
 import json
 from typing import TYPE_CHECKING, Any, cast
 
+import pytest
+
 from openshell._proto import openshell_pb2
 from openshell.sandbox import (
     _PYTHON_CLOUDPICKLE_BOOTSTRAP,
@@ -139,7 +141,7 @@ def test_from_active_cluster_prefers_openshell_gateway_env(
         client.close()
 
 
-def test_inference_set_cluster_forwards_no_verify_flag() -> None:
+def test_inference_set_cluster_forwards_verify_flag() -> None:
     stub = _FakeInferenceStub()
     client = cast("InferenceRouteClient", object.__new__(InferenceRouteClient))
     client._timeout = 30.0
@@ -148,9 +150,40 @@ def test_inference_set_cluster_forwards_no_verify_flag() -> None:
     result = client.set_cluster(
         provider_name="openai-dev",
         model_id="gpt-4.1",
-        no_verify=True,
+        verify=True,
     )
 
     assert result.provider_name == "openai-dev"
     assert stub.request is not None
-    assert stub.request.skip_validation is True
+    assert stub.request.verify is True
+
+
+def test_inference_set_cluster_forwards_no_verify_flag() -> None:
+    stub = _FakeInferenceStub()
+    client = cast("InferenceRouteClient", object.__new__(InferenceRouteClient))
+    client._timeout = 30.0
+    client._stub = cast("Any", stub)
+
+    client.set_cluster(
+        provider_name="openai-dev",
+        model_id="gpt-4.1",
+        no_verify=True,
+    )
+
+    assert stub.request is not None
+    assert stub.request.no_verify is True
+
+
+def test_inference_set_cluster_rejects_conflicting_flags() -> None:
+    stub = _FakeInferenceStub()
+    client = cast("InferenceRouteClient", object.__new__(InferenceRouteClient))
+    client._timeout = 30.0
+    client._stub = cast("Any", stub)
+
+    with pytest.raises(ValueError, match="mutually exclusive"):
+        client.set_cluster(
+            provider_name="openai-dev",
+            model_id="gpt-4.1",
+            verify=True,
+            no_verify=True,
+        )