feat: add StepFun Global Step Plan support

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable

[Astro-Han]

Summary

• Add StepFun Step Plan (Global) as the independent persisted provider stepfun-ai-step-plan.
• Wire its official Global endpoint, snapshot model catalog, reasoning efforts, deterministic tool-call path, credentials, persistence, CLI/headless, and Desktop catalog/brand seams.
• Reuse the existing byte-identical StepFun SVG, shared ProviderAssetMask, and third-party notice without vendoring another asset.

Why

Issue #860 Phase 4 needs a Global Step Plan slice that remains distinct from the China Step Plan and both direct API providers. The Global plan uses its own .ai account, key namespace, and https://api.stepfun.ai/step_plan/v1 endpoint. Its public contract does not promise a /models endpoint, so this change uses an explicit snapshot allowlist instead of guessing discovery parity with another StepFun product.

Refs #860.

Scope

This PR adds only stepfun-ai-step-plan. It does not change stepfun-step-plan, stepfun-ai, stepfun, any other provider, or Phase 7 behavior. The allowlist is exactly step-3.7-flash, step-3.5-flash-2603, and step-3.5-flash; Global Step Plan is the unique ready/catalog order 32 after Vercel order 31.

Verification

• npm run test:scripts — 58/58 passed.
• npm --workspace @maka/core test — 906/906 passed.
• npm --workspace @maka/runtime test — 1,516 passed, 0 failed, 7 skipped.
• npm --workspace @maka/storage test — 255/255 passed.
• npm --workspace @maka/headless test — 886/886 passed.
• npm --workspace maka-agent test — 326/326 passed.
• npm --workspace @maka/desktop test — 2,471/2,471 passed.
• Targeted stable-ID, model-effort, provider-options, and deterministic two-stage tool-call tests — 4/4 passed.
• npm run typecheck passed for every workspace.
• npm --workspace @maka/desktop run build:renderer passed; the third-party-notice checker confirmed a byte-identical public notice.
• npm run check:stale and git diff --check origin/main...HEAD passed.
• git merge-tree --write-tree HEAD origin/main passed against test(cu): extend real AX provider evidence #924 with no conflict.
• Existing StepFun SVG matches origin/main and its recorded provenance at SHA-256 f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c; neither the SVG nor THIRD_PARTY_LICENSES.txt is in this diff.
• Named reviewer audited the final SHA and reported 0 findings.

No real-provider smoke was run: no authorized StepFun Global Step Plan credential was available, and the subscription is documented for interactive coding/agent use. The runtime behavior is covered by a local deterministic two-request mock server that asserts Bearer auth, the exact /step_plan/v1/chat/completions path, reasoning wire data, tool execution, and tool-result round-trip without logging secrets or raw responses.

Static screenshots are not applicable: this adds a provider entry while deliberately reusing the already-shipped StepFun mark and existing catalog/detail components. Desktop provider E2E coverage and the shared-brand governance contract are the substitute UI evidence.

Impact

Users can configure and persist a StepFun Global Step Plan connection across Desktop, CLI, storage, and headless integrations. Headless callers may use the independent STEPFUN_AI_STEP_PLAN_API_KEY, STEPFUN_AI_STEP_PLAN_API_KEY_FILE, and STEPFUN_AI_STEP_PLAN_BASE_URL variables. There is no migration: existing provider IDs and connections remain unchanged. Release notes should mention the new provider option; no separate documentation change is required because the catalog exposes the official signup and model facts.

Reviewer notes

Please focus on the independent provider boundary, the honest snapshot fallback, and the shared-brand route. The four commits are independently revertible by intent: registry/facts, runtime/thinking, host/persistence, and Desktop brand wiring.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable