Summary

Closes #469.

The typed Responses executor now accepts a user-message input_file when its file_data carries an inline UTF-8 text
file, and sends it to the model as text. Until now every message input_file got a 400 (#256/#258). That meant a
text-only model behind the gateway could not read a .txt, .md, .json or .yaml attachment a client sent inline.

What is accepted:

• a base64 data URL with a text media type (text/*, application/json, application/xml, application/yaml).
  Parameters such as charset are ignored, and an explicit media type takes precedence over the filename;
• raw base64, or application/octet-stream / an empty media type, with a filename that has a common text extension.

How it works:

• Validation (types/io/input/validation.rs, new types/io/input/file_text.rs). The existing validation runs on
  new input, rehydrated previous_response_id/conversation history and every upstream build (including the
  compaction summary). It now decodes the file (base64 crate, already a dependency, then strict UTF-8). Each other
  case gets a specific 400 reason: file_id (no Files API), file_url (no fetching), missing file_data, non-text or
  PDF data, a non-base64 data URL, invalid base64, non-UTF-8. The input[i].content[j]: prefix is kept, and no reason
  echoes the file data, URL or media type.
• Model-facing copy only (normalized_model_input). The file becomes an input_text part in the same position,
  prefixed with File: <filename>\n when a filename is set. This is the same presentation proposed in vLLM #62676, so
  both paths would give the model the same prompt.
• Storage is unchanged. Stored history and compacted windows keep the client's original input_file, and the text
  is re-inlined on each continuation. This follows the fix: preserve and verify image input through Responses #263 rule: never persist content the client did not send.
• Routing. A store: false request with an inline text file goes to the executor instead of the raw proxy, so
  stateless and stored requests give the model the same input. store: false requests with file_id, file_url or
  PDF files are still raw-proxied byte for byte. The predicate (ResponsesInput::has_inline_text_file) only classifies
  the reference fields and the media type, without decoding. It is checked in the HTTP routing decision next to the
  tool-search state, not in in_process_feature(). in_process_feature() also gates split execution in
  agentic-llm-d, and split execution already builds its upstream body through to_upstream_request, so it can serve
  these files.
• Compaction (executor/compaction/context.rs). An inline file counts as meaningful context, so a compaction whose
  input is only a file no longer fails with "requires non-empty input".
• Docs/CHANGELOG. Rewrote "File inputs" in docs/guides/responses-compaction.md. The section appeared twice, so
  this also removes the duplicate. Added an [Unreleased] entry.

Not in scope: file_id resolution (#356), fetching file_url, PDF/DOCX extraction, Chat Completions file parts
(that route is a passthrough), and a separate decoded-size limit. Inline files are bounded by the existing
max_request_body_size_bytes, and the body shrinks after decoding. No new dependencies, no I/O. No changes to
events/, the ingestion state machine, the relay or engine.rs.

Open questions for reviewers:

1. Should store: false text-file requests go through the executor, as here, or should the raw proxy stay
   byte-transparent for them? Dropping the routing change is a two-line revert in the HTTP handler.
2. Is the File: <filename> header the format you want?
3. Do you want an explicit decoded-size cap in ResponsesConfig? Adding a field would break struct literals, so it is
   left out here.
4. Should the compaction token estimate count the decoded size (about 3/4 of the base64 length) instead of the base64
   length? It is unchanged here, which overestimates.

Test Plan

Unit tests (agentic-server-core):

• file_text.rs: accepted media types (including charset parameters and uppercase types), an
  application/octet-stream or empty media type falling back to the filename, raw base64 with .yaml/.YML, empty
  and multi-byte UTF-8 files, a PDF rejected by media type (even with a .txt filename) and by filename, file_id,
  file_url, missing data, a non-base64 data URL, invalid base64, non-UTF-8, and routing classification (text
  files are detected without decoding; references, PDFs, images and tool-output files are not).
• validation.rs: file errors keep their input[i].content[j] position and never echo the URL. Inline text files pass
  in new input and in restored history. The previous input_file case in the position test now uses an unknown part
  type, and file_url is covered by its own test.
• conversions.rs: the model copy has input_text with the header in the original order. Canonical items keep
  input_file. Input with no files stays Cow::Borrowed.

Integration tests (crates/agentic-server/tests/input_file_repro.rs, mock upstream and in-memory SQLite). All 30
existing tests still pass unchanged. They use a file_url PDF, which is still rejected before inference and before
persistence, and the raw-proxy byte-for-byte controls still hold. 9 new tests:

• store: true with a data URL: 200. The upstream gets input_text "File: notes.txt\n..." with no file_data, and
  the stored item is the original input_file;
• raw base64 with filename: config.yaml is inlined;
• streaming HTTP gives the same upstream body;
• a previous_response_id follow-up re-inlines the stored file, and storage still holds the single original input_file;
• WebSocket response.create is accepted and inlined;
• store: false with a text file runs through the executor: inlined, nothing persisted;
• store: false with invalid base64 gets a 400 from the gateway instead of being proxied;
• /v1/responses/compact with a message containing only a file succeeds. The summary request has the text, and the
  returned window keeps input_file;
• each rejection reason (file_id, file_url, missing data, PDF data URL, PDF filename, non-base64 data URL, invalid
  base64, non-UTF-8) gives a 400 with the specific message: no inference, nothing persisted.

Commands, all run in WSL Ubuntu-22.04 with Rust 1.98.1:

• cargo fmt --all --check: pass
• cargo clippy --all-targets -- -D warnings: pass
• cargo test -p agentic-server --test input_file_repro: 39 passed, 0 failed
• cargo test -p agentic-server: 710 passed, 0 failed (42 test binaries)
• cargo test -p agentic-server-core: 1776 passed, 1 failed, 17 ignored. The failure is
  tool_search_characterization_test::provider_parity_recorder_generated_matrix_has_one_semantic_flow, which asserts
  that checked-in cassettes are not executable. It fails only because the checkout is on a Windows drive mounted in WSL
  (/mnt/c), where every file reports mode 0777. This change touches no cassettes.
• python scripts/check_rust_file_sizes.py (the rust-file-sizes hook): pass, 291 production files checked. The new
  file_text.rs has 155 production lines. types/io/input.rs has 485 production lines, plus one mod line.
• git diff --check: clean