fix: align validate endpoint and list filters with unrendered templates

- Make /controls/validate mirror create: incomplete template values
  validate structure only (returns 200) instead of forcing a full render
  that rejects missing params. Use the render preview endpoint to check
  renderability.
- Exclude unrendered templates from list filters that reference
  rendered-only fields (execution, step_type, stage, tag). Unrendered
  templates still appear in unfiltered listings and template_backed
  filter.
- Update validate test to expect 200 for incomplete values
- Add test: validate rejects structurally invalid unrendered templates
- Add test: unrendered templates excluded from rendered-field filters
  but included in unfiltered listings

Author: lan17

server/src/agent_control_server/endpoints/controls.py

@@ -683,12 +683,9 @@ async def validate_control_data(
     Returns:
         ValidateControlDataResponse with success=True if valid
     """
-    if isinstance(request.data, TemplateControlInput):
-        # Validate always attempts full rendering, even if values are incomplete.
-        # This differs from create/update which allow unrendered storage.
-        await _render_and_validate_template_input(request.data, db=db, enabled=True)
-    else:
-        await _validate_control_definition(request.data, db)
+    # Validate mirrors create: complete template values trigger a full render,
+    # incomplete values validate structure only (matching unrendered create).
+    await _materialize_control_input(request.data, db=db)
     return ValidateControlDataResponse(success=True)
 
 
@@ -769,6 +766,12 @@ async def list_controls(
         else:
             query = query.where(~Control.data.has_key("template"))
 
+    # Filters that reference rendered-only fields exclude unrendered templates
+    # (which lack condition/execution/scope/tags).
+    has_rendered_filter = any(f is not None for f in (step_type, stage, execution, tag))
+    if has_rendered_filter:
+        query = query.where(Control.data.has_key("condition"))
+
     if step_type is not None:
         query = query.where(
             or_(
@@ -817,6 +820,8 @@ async def list_controls(
             total_query = total_query.where(Control.data.has_key("template"))
         else:
             total_query = total_query.where(~Control.data.has_key("template"))
+    if has_rendered_filter:
+        total_query = total_query.where(Control.data.has_key("condition"))
     if step_type is not None:
         total_query = total_query.where(
             or_(

server/tests/test_control_templates.py

@@ -995,23 +995,38 @@ def test_template_update_defaults_enabled_to_true_when_stored_key_is_missing(
     }
 
 
-def test_template_validate_maps_missing_parameter_error(client: TestClient) -> None:
-    # Given: a template-backed control payload missing a required parameter value
+def test_template_validate_accepts_incomplete_values_as_unrendered(
+    client: TestClient,
+) -> None:
+    # Given: a template payload with empty values (would be stored as unrendered)
+    payload = _template_payload()
+    payload["template_values"] = {}
+
+    # When: validating the payload
+    response = client.post("/api/v1/controls/validate", json={"data": payload})
+
+    # Then: validation succeeds (mirrors create behavior for unrendered templates)
+    assert response.status_code == 200, response.text
+    assert response.json()["success"] is True
+
+
+def test_template_validate_rejects_structurally_invalid_unrendered(
+    client: TestClient,
+) -> None:
+    # Given: a template with an undefined $param reference and empty values
     payload = _template_payload()
     payload["template_values"] = {}
+    payload["template"]["definition_template"]["condition"]["evaluator"]["config"]["extra"] = {  # type: ignore[index]
+        "$param": "nonexistent",
+    }
 
-    # When: validating the payload through the public API
+    # When: validating the payload
     response = client.post("/api/v1/controls/validate", json={"data": payload})
 
-    # Then: the error is remapped back to the missing template parameter
+    # Then: structural validation catches the error even without values
     assert response.status_code == 422
     body = response.json()
-    assert body["error_code"] == "TEMPLATE_PARAMETER_INVALID"
-    assert any(
-        err.get("field") == "template_values.pattern"
-        and err.get("parameter") == "pattern"
-        for err in body.get("errors", [])
-    )
+    assert body["error_code"] == "TEMPLATE_RENDER_ERROR"
 
 
 def test_template_validate_succeeds_with_defaults_only_payload(client: TestClient) -> None:
@@ -1738,6 +1753,37 @@ def test_unrendered_template_shows_in_list_with_correct_flags(client: TestClient
     assert unrendered["template_rendered"] is False
 
 
+def test_unrendered_template_excluded_from_rendered_field_filters(
+    client: TestClient,
+) -> None:
+    # Given: an unrendered template control
+    control_id, _ = _create_unrendered_control(client)
+
+    # When: filtering by execution (a rendered-only field)
+    exec_response = client.get("/api/v1/controls", params={"execution": "server"})
+    assert exec_response.status_code == 200
+    exec_ids = {c["id"] for c in exec_response.json()["controls"]}
+
+    # Then: unrendered template is excluded
+    assert control_id not in exec_ids
+
+    # When: filtering by step_type
+    step_response = client.get("/api/v1/controls", params={"step_type": "llm"})
+    assert step_response.status_code == 200
+    step_ids = {c["id"] for c in step_response.json()["controls"]}
+
+    # Then: unrendered template is excluded
+    assert control_id not in step_ids
+
+    # When: listing without rendered-field filters
+    all_response = client.get("/api/v1/controls")
+    assert all_response.status_code == 200
+    all_ids = {c["id"] for c in all_response.json()["controls"]}
+
+    # Then: unrendered template IS included in the unfiltered listing
+    assert control_id in all_ids
+
+
 def test_unrendered_template_can_be_deleted(client: TestClient) -> None:
     # Given: an unrendered template control
     control_id, _ = _create_unrendered_control(client)