[vaibhavsrv]

Why this matters

In ods/bin/pixel_provider/runtime_gateway.py, the validate_request routine admits the optional stop generation parameter without validating type or sequence bounds. Callers can submit arbitrary types (e.g., numbers, dictionaries, nulls) or lists exceeding the standard maximum of 4 stop sequences, leading to unhandled downstream serialization errors or backend tokenizer crashes.

This change surgically enforces that stop must be either a single string or a list of at most 4 strings in validate_request, rejecting invalid configurations with invalid-inference-request. Valid string and list sequences remain fully supported.

Validation

• Baseline reproduction: Payloads with stop: 123, stop: ["1","2","3","4","5"], or stop: [None] were accepted by validate_request.
• Post-fix behavior: Malformed stop values or lists containing $>4$ sequences raise RuntimeErrorCode('invalid-inference-request'). Valid stop tokens pass cleanly.
• Telemetry: Pixel gateway suites: 3 passed. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI.

Overlap check

Recent PRs #6332 (presence/frequency penalty bounds in runtime gateway), #6331 (seed integer validation in runtime gateway), and #6330 (temperature bounds in runtime gateway) address independent parameters in runtime_gateway.py. This PR isolates verification to the stop parameter without overlapping with penalty or sampling logic.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens an API validation check, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6332 at a7279ab without conflicts. Production and test diffs passed together; gateway and runtime checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.