NVIDIA API Lifecycle Guard

NVIDIA API Lifecycle Guard is a small, standard-library Python toolkit for auditing and safely validating NVIDIA hosted API or NIM integrations. It keeps model discovery, official evidence, runtime observations, compatibility gates, reasoning-aware response parsing, and fallback evaluation separate.

It deliberately does not maintain a model catalogue or automatically replace a model, provider, embedding dimension, proxy route, or fallback chain.

Why this exists

Hosted model integrations drift over time. A model being listed by /v1/models does not prove that the intended endpoint works or that the observed behavior satisfies a project's request, streaming, reasoning, latency, schema, or fallback contract.

This toolkit therefore keeps three questions separate:

1. Discovered — is the model currently advertised?
2. API-compatible — does the intended endpoint work with the expected request and response shape?
3. Project-compatible — does the observed behavior satisfy this project's actual constraints?

The goal is to gather bounded evidence before changing production model or fallback configuration.

30-second quick start

The static scanner uses only the Python standard library and does not require a live API probe:

python scripts\scan_nvidia_usage.py <repository-path> --json

A shortened synthetic result can look like this:

{
  "summary": {
    "NVIDIA_API_USAGE_FOUND": "YES",
    "CALL_SITES": 3,
    "MODELS_REFERENCED": 1,
    "NETWORK_PROBE": "NOT_RUN",
    "MODEL_DISCOVERY": "NOT_RUN",
    "SECRET_EXPOSURE_RISK": "NO",
    "CONFIG_UPDATE_REQUIRED": "NO",
    "AUTOMATIC_FIX_SAFE": "YES"
  }
}

The scanner reports locations and metadata rather than source snippets or secret values. Static discovery is evidence for the next validation step, not proof that a model is currently reachable or project-compatible.

Install for development

The runtime scripts have no third-party dependencies. The offline test suite requires pytest:

python -m pip install -r requirements-dev.txt
$env:PYTHONDONTWRITEBYTECODE='1'
python -m pytest -q -p no:cacheprovider

Use

Run static scanning locally, then use current official documentation and an explicitly authorized minimal runtime probe when needed:

python scripts\scan_nvidia_usage.py <repository-path> --json
python scripts\probe_nvidia_api.py --repo <repository-path> --mode discovery
python scripts\model_probe_planner.py --model-profile <profile.json> --project-profile <project.json> --json

NVIDIA_API_KEY is read only from the process environment. Do not put a key in source, command-line arguments, reports, or committed configuration. Discovery from /v1/models is not proof of endpoint or project compatibility.

See SKILL.md for the operational workflow and references for compatibility, endpoint, and report schemas.

Safety model

The toolkit is intentionally conservative:

• discovery is not treated as compatibility;
• unknown capability remains unknown rather than being guessed;
• live probes should use synthetic content and the minimum required scope;
• response normalization records schema and metadata rather than retaining answer or reasoning text;
• project configuration changes remain an explicit decision rather than an automatic consequence of a successful probe.

Development checks

python scripts\check_public_safety.py
python -m pytest -q -p no:cacheprovider

The public-safety check rejects machine-specific paths, RFC1918 addresses, credential-shaped literals, and generated artifacts from the intended public tree. It deliberately allows only the documented synthetic key-like test literals required by the regression fixtures.

License

Licensed under the Apache License 2.0. SPDX identifier: Apache-2.0.