fix: close remaining unrendered template validation gaps

- Reject optional params without defaults in unrendered structural
  validation (catches templates that can never render at creation time)
- Fix PATCH rename-only on unrendered templates: detect unrendered state
  before ControlDefinition.model_validate to avoid false CORRUPTED_DATA
- Export UnrenderedTemplateControl from Python SDK
- Strengthen rename test to verify enabled=false in response
- Add test for optional-param-without-default rejection on unrendered create

Author: lan17

sdks/python/src/agent_control/__init__.py

@@ -70,6 +70,7 @@ async def handle_input(user_message: str) -> str:
     TemplateControlInput,
     TemplateDefinition,
     TemplateValue,
+    UnrenderedTemplateControl,
 )
 
 from . import agents, controls, evaluation, evaluators, policies
@@ -1371,6 +1372,7 @@ async def main():
     "ControlDefinition",
     "TemplateControlInput",
     "TemplateDefinition",
+    "UnrenderedTemplateControl",
     "ControlSelector",
     "ControlScope",
     "ControlAction",

server/src/agent_control_server/endpoints/controls.py

@@ -1194,12 +1194,17 @@ async def patch_control(
                 )
     elif control.data:
         # Get current enabled status for response
-        try:
-            ctrl_def = ControlDefinition.model_validate(control.data)
-            current_enabled = ctrl_def.enabled
-        except ValidationError:
-            # Data corrupted, use default enabled=True
-            _logger.warning("Control '%s' has invalid data, using default", control.name)
+        if _is_unrendered_template(control.data):
+            current_enabled = False
+        else:
+            try:
+                ctrl_def = ControlDefinition.model_validate(control.data)
+                current_enabled = ctrl_def.enabled
+            except ValidationError:
+                _logger.warning(
+                    "Control '%s' has invalid data, using default",
+                    control.name,
+                )
 
     # Commit if anything changed
     if updated:

server/src/agent_control_server/services/control_templates.py

@@ -550,6 +550,25 @@ def _collect_param_references(
                     code="undefined_parameter_reference",
                     message=f"Template references undefined parameter '{parameter_name}'.",
                 )
+            # Reject optional params without defaults — they can never render.
+            param_def = template.parameters[parameter_name]
+            if (
+                not param_def.required
+                and _parameter_default(param_def) is _TEMPLATE_VALUE_MISSING
+            ):
+                raise _render_error(
+                    detail=(
+                        f"Template parameter '{parameter_name}' is optional "
+                        "but referenced without a default value"
+                    ),
+                    field=f"template.parameters.{parameter_name}",
+                    code="optional_referenced_parameter_requires_default",
+                    message=(
+                        f"Optional template parameter '{param_def.label}' is "
+                        "referenced in the template and must define a default "
+                        "value or be marked required."
+                    ),
+                )
             referenced.add(parameter_name)
             return
 

server/tests/test_control_templates.py

@@ -1599,7 +1599,9 @@ def test_patch_enable_on_unrendered_template_is_rejected(client: TestClient) ->
     )
 
 
-def test_patch_name_on_unrendered_template_works(client: TestClient) -> None:
+def test_patch_name_on_unrendered_template_returns_correct_enabled(
+    client: TestClient,
+) -> None:
     # Given: an unrendered template control
     control_id, _ = _create_unrendered_control(client)
     new_name = f"renamed-unrendered-{uuid.uuid4()}"
@@ -1610,9 +1612,35 @@ def test_patch_name_on_unrendered_template_works(client: TestClient) -> None:
         json={"name": new_name},
     )
 
-    # Then: the rename succeeds
+    # Then: the rename succeeds and enabled is correctly reported as False
     assert response.status_code == 200, response.text
-    assert response.json()["name"] == new_name
+    body = response.json()
+    assert body["name"] == new_name
+    assert body["enabled"] is False
+
+
+def test_create_unrendered_template_rejects_optional_param_without_default(
+    client: TestClient,
+) -> None:
+    # Given: a template with an optional parameter that has no default but is
+    # referenced in definition_template
+    payload = _unrendered_template_payload()
+    payload["template"]["parameters"]["pattern"]["required"] = False  # type: ignore[index]
+
+    # When: creating an unrendered control
+    response = client.put(
+        "/api/v1/controls",
+        json={"name": f"bad-optional-{uuid.uuid4()}", "data": payload},
+    )
+
+    # Then: the server rejects — this template can never render
+    assert response.status_code == 422
+    body = response.json()
+    assert body["error_code"] == "TEMPLATE_RENDER_ERROR"
+    assert any(
+        err.get("code") == "optional_referenced_parameter_requires_default"
+        for err in body.get("errors", [])
+    )
 
 
 def test_unrendered_template_excluded_from_evaluation(client: TestClient) -> None: