[management] Trim the credential-check comments to the repo budget

management/internals/modules/agentnetwork/modeldiscovery/failure.go

@@ -10,18 +10,14 @@ import (
 	"syscall"
 )
 
-// The errors below exist so a caller can tell one discovery failure from
-// another without reading the message. Fetch is used for two jobs now: filling
-// the model picker, which only needs to know that it failed, and checking a
-// provider's credential at save time, which has to tell the operator whether
-// the URL or the key is the problem. A string is the wrong thing to branch on
-// for the second, so each failure carries its own type.
+// Fetch serves two callers with different needs: the model picker, which only
+// needs to know it failed, and the provider credential check, which has to
+// tell an operator whether the URL or the key is at fault. Each failure
+// carries a type so the second does not have to branch on a message.
 
-// VendorStatusError reports that the vendor answered the listing with
-// something other than 200. Status is the vendor's own code: 401 and 403 mean
-// the credential was refused, 404 and 405 mean the URL does not serve this
-// API at all, and 5xx means the vendor is unwell — three different things to
-// tell an operator, and only the number separates them.
+// VendorStatusError reports a listing answered with something other than 200.
+// Only the vendor's own code separates a refused credential (401, 403) from a
+// URL that does not serve this API (404, 405) from an unwell vendor (5xx).
 type VendorStatusError struct {
 	Provider string
 	Status   int
@@ -31,10 +27,9 @@ func (e *VendorStatusError) Error() string {
 	return fmt.Sprintf("%s returned %d for its model listing", e.Provider, e.Status)
 }
 
-// UnreachableError reports that the request never reached the vendor at all:
-// the name did not resolve, the connection was refused, TLS failed, or the
-// attempt timed out. Nothing was authenticated, so the credential is not
-// implicated — only the URL is.
+// UnreachableError reports that the request never reached the vendor: the
+// name did not resolve, the connection was refused, TLS failed, or it timed
+// out. Nothing was authenticated, so only the URL is implicated.
 type UnreachableError struct {
 	Provider string
 	Err      error
@@ -46,12 +41,10 @@ func (e *UnreachableError) Error() string {
 
 func (e *UnreachableError) Unwrap() error { return e.Err }
 
-// Reason names the transport failure in the words an operator can act on.
-// "connection refused" and "no such host" are the difference between a wrong
-// port and a wrong hostname, which is worth the few lines it takes to tell
-// them apart. An empty string means the cause was not one we recognise, and
-// the caller should say only that the host could not be reached rather than
-// paste a Go error into the UI.
+// Reason names the transport failure in words an operator can act on: a wrong
+// port and a wrong hostname fail differently and are worth telling apart.
+// Empty means unrecognised, and the caller should say only that the host could
+// not be reached rather than paste a Go error into the UI.
 func (e *UnreachableError) Reason() string {
 	err := e.Err
 
@@ -93,25 +86,22 @@ func (e *UnreachableError) Reason() string {
 	return ""
 }
 
-// ErrUnparseableListing marks a 200 whose body is not a model listing in the
-// shape the catalog declared. It is a distinct outcome from a status refusal:
-// the host answered and authenticated fine, it just is not the API we were
-// aiming at — a login page or an unrelated service on the configured URL.
+// ErrUnparseableListing marks a 200 whose body is not a listing in the shape
+// the catalog declared. Distinct from a status refusal: the host answered and
+// authenticated fine, it is just not the API — a login page, say.
 var ErrUnparseableListing = errors.New("response is not a model listing")
 
-// ErrNoDiscoveryHost marks a provider whose listing host cannot be worked out
-// from the record. Bedrock's listing lives on a control-plane host derived
-// from the region in the upstream, so an operator pointing the record at a
-// proxied or self-hosted endpoint leaves nowhere to send it. Inventing a host
-// would spend their credential somewhere they never configured.
+// ErrNoDiscoveryHost marks a provider whose listing host cannot be derived
+// from the record: Bedrock's control-plane host comes from the region in the
+// upstream, so a proxied endpoint leaves nowhere to send it, and inventing one
+// would spend the credential somewhere never configured.
 //
-// It wraps ErrInvalidRequest so the discovery endpoint keeps answering 400,
-// while a credential check can recognise it as "cannot be checked" rather
-// than "is broken".
+// Wraps ErrInvalidRequest so the discovery endpoint still answers 400, while a
+// credential check can read it as "cannot be checked" rather than "broken".
 var ErrNoDiscoveryHost = errors.New("provider has no derivable discovery host")
 
-// ErrPrivateHost marks an upstream that resolves somewhere the management
-// server will not dial. A self-hosted vendor endpoint on a private network is
-// a legitimate provider — the proxy reaches it through the tunnel — so this
-// means the check cannot run, not that the record is wrong.
+// ErrPrivateHost marks an upstream resolving somewhere management will not
+// dial. A self-hosted endpoint on a private network is a legitimate provider
+// the proxy reaches through the tunnel, so this means the check cannot run,
+// not that the record is wrong.
 var ErrPrivateHost = errors.New("discovery host is not publicly routable")