[vaibhavsrv]

Why this matters

In ods/bin/pixel_provider/runtime_gateway.py, the validate_request routine admits the optional presence_penalty and frequency_penalty parameters without verifying range boundaries or types. When callers pass values outside the OpenAI/ODS standard range $[-2.0, 2.0]$ (e.g. $-3.0$ or $5.0$) or pass non-numeric types such as booleans or strings, requests bypass validation and trigger backend runtime errors or severe token repetition distortion.

This change surgically enforces $[-2.0, 2.0]$ boundaries and numeric types (type in (int, float)) for both presence_penalty and frequency_penalty in validate_request, rejecting out-of-bounds or malformed configurations with invalid-inference-request. Valid penalties within the supported range remain unaffected.

Validation

• Baseline reproduction: Payloads specifying presence_penalty: -2.5, frequency_penalty: 3.0, or presence_penalty: True were accepted by validate_request.
• Post-fix behavior: Requests with out-of-bounds or non-numeric penalties raise RuntimeErrorCode('invalid-inference-request'). Valid penalties from -2.0 to 2.0 pass cleanly.
• Telemetry: Pixel gateway suites: 3 passed. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI.

Overlap check

Recent PRs #6331 (seed integer validation in runtime gateway), #6330 (temperature bounds in runtime gateway), and #6329 (top_p bounds in runtime gateway) cover distinct sampling parameters. This PR focuses strictly on presence_penalty and frequency_penalty within ods/bin/pixel_provider/runtime_gateway.py without conflicting with adjacent checks.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens an API validation check, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6331 at 23a92c1 without conflicts. Production and test diffs passed together; gateway and runtime checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.