ReadonlyExecutionWhether this operation is a plain Sync request/response or a LongRunning run.
ReadonlyOperationStable registry key and wire token for this operation (e.g. RecordProcess.RunNow).
ReadonlyRequiredOptional API-key scope string (e.g. recordprocess:execute) enforced for API-key / MCP
callers by the server resolver. undefined means no scope gate; interactive users remain
bounded by their entity permissions. Informational here — the server applies it.
ReadonlyRequiresWhen true, the server only permits the system user to invoke this operation.
ProtectedAuthorizePer-operation authorization hook, composed with (and applied after) the framework gates that the server resolver runs. Returns true by default. Override to enforce operation-specific rules against the input and acting user.
The typed input payload.
The acting user.
True if the operation may proceed.
The universal entry point — identical on client and server. Routes the operation through the active (or explicitly supplied) provider's IRemoteOperationProvider.RouteOperation.
The typed input payload.
Optionaloptions: RemoteOpInvokeOptionsOptional invocation options (mode, progress callback, explicit provider/user).
The result; never throws for logical failures — inspect Success / ErrorMessage.
Server-side execution entry point, invoked in-process by a server provider / resolver after it has resolved this operation by key and applied the framework authorization gates (scope / system-user / entity permissions). It runs the per-operation Authorize hook and then InternalExecute, wrapping the outcome in a RemoteOpResult.
The typed input payload.
The server execution context (provider, acting user, progress emitter).
The wrapped result; logical failures are returned, not thrown.
ProtectedgateThe promotion gate to delegate to. Overridable so unit tests inject a mock with no live DB. The production default (ProductionModelPromotionGate) is the SAME gate the Promote action uses.
ProtectedInternalThe operation's server-side work. The default throws — a routable operation must supply a
body (CodeGen-emitted AI/default plumbing, or a hand-authored override). Implementations must
use context.provider / context.user for data access (never new Metadata()), per the
multi-provider rule.
The typed input payload.
The owning provider for data access.
The acting user.
The typed output payload.
ProtectedleakagePlain-language refusal message for a leakage-flagged model (mirrors the Action).
ProtectedsignMessage when a sign-off override was requested without a justification reason.
ProtectedtoMap the gate outcome onto the operation's typed output. The single happy path
(promoted) returns { promoted: true, status: newStatus }; every refusal /
failure throws with the plain-language detail so the framework surfaces it as a
clean error (rather than silently returning promoted: false).
Server implementation of
PredictiveStudio.PromoteModel. Extends the CodeGen-emitted PredictiveStudioPromoteModelOperation base (ExecutionMode='Sync',RequiredScope='predictive:execute') and supplies only the body; registered last so it wins server-side dispatch.