flows: inline named-agent { cli, model } shouldn't require a mandatory external flows.json model allow-list #263

Summary

Defining an agent inline in a flow is the natural, discoverable path — a
top-level agents: map with { cli, model }, exactly parallel to v1's
agents: block. But today that inline declaration is not self-sufficient:
the moment it names a model, preflight refuses the flow unless an external
flows.json also lists that model in a models allow-list.

So a single, self-contained YAML file cannot declare a working named agent. You
always need a second file. That's friction that shouldn't be mandatory for the
simple case, and it's the first thing a new author trips on.

Repro

triage.flow.yaml (no flows.json present):

version: '0.1.0'
name: triage
agents:
  drafter: { cli: claude, model: claude-sonnet-5 }
steps:
  - id: draft
    type: agent
    agent: drafter
    instruction: "..."

flows check triage.flow.yaml

Actual:

REFUSED [model_unknown] Named agent "drafter" declares model "claude-sonnet-5"
for CLI "claude", but it is not listed in the nearest project config (no model
registry was found); add the exact model only after verifying that project is
allowed to use it.

It only passes after adding an external file:

// flows.json
{ "cli": "claude", "models": ["claude-sonnet-5"] }

Expected

A self-contained flow that declares agents: { drafter: { cli, model } } inline
should validate and run without a mandatory external flows.json. The model
allow-list is a reasonable governance feature — it should be opt-in
(enforced when a registry exists, or under an explicit strict/CI mode), not a
precondition for a single-file example to work.

Suggested direction

• When no flows.json model registry is found, treat an inline named-agent
  model as authoritative (still probe CLI + model auth via the adapter), rather
  than refusing with model_unknown.
• Keep model_unknown enforcement when a registry is present (that's the
  point of an allow-list), and/or behind an explicit strict flag for CI.
• Make the error, when it does fire, tell the author the two-line fix (create
  flows.json with "models": ["<model>"]).

Acceptance criteria

• A single *.flow.yaml with an inline { cli, model } named agent passes
  flows check and runs with no flows.json in the tree.
• With a flows.json that has a models allow-list, a model not on the list
  still refuses (governance preserved).
• Tests cover: no-registry (allowed), registry-with-model (allowed),
  registry-without-model (refused).

Related

Extends #132 (v2 authoring ergonomics vs v1). Surfaced while preparing a
first-run example for a prospect (Altek): the split between "define the agent"
(inline) and "allow the model" (external file) read as confusing and
unnecessary for the simple case.