feat: add create_verifiable_program to the authenticated client

[odesenfans]

Summary

• make_verifiable_program_content() in aleph.sdk.utils, mirroring make_program_content / make_instance_content.
• AuthenticatedAlephHttpClient.create_verifiable_program() (plus the abstract signature on AuthenticatedAlephClient) to publish V-PROGRAM messages without going through the generic submit(). Takes the runtime manifest hash, the verity-bound workload (ref, hash_tree, roothash), the expected measurements (registers.launch, optional vcpu_type), the SNP policy, extra verified volumes, resources and host requirements. Accepts either pydantic models or plain mappings.
• Payment defaults to credit on ETH and allow_amend is hard-coded to False; there are no variables / authorized_keys parameters, matching the aleph-message validators (V-Programs are credit-only, immutable, and every guest input is measured or verity-bound).
• The insufficient-funds / rejection handling duplicated from create_program is extracted into _raise_for_rejected_executable and shared.

Depends on #291 (aleph-message >= 1.3.0) for the aleph_message.models.execution.vprogram imports; CI resolves 1.3.0 already since the pin is a floor.

Test plan

• pytest tests/unit (241 passed): happy path, non-credit payment rejected, insufficient funds path
• mypy on the touched modules

🤖 Generated with Claude Code

https://claude.ai/code/session_018hGRkZE1a3i19yrf2uBasD

[github-actions]

Failed to retrieve llama text: POST 502: Bad Gateway

[foxpatch-aleph]

The PR cleanly adds create_verifiable_program mirroring the existing create_program/create_instance pattern, with good test coverage (happy path, non-credit rejection, insufficient funds). The _raise_for_rejected_executable extraction is a welcome refactor. The credit-only and immutability constraints are correctly delegated to the VerifiableProgramContent pydantic validators. The main observation is that create_instance was not updated to use the newly-extracted helper, leaving the duplicated rejection logic inline. Additionally, the aleph-message floor pin in pyproject.toml (1.1.1) should be bumped to 1.3.0 in the same or a tightly-coupled PR, since the new imports will fail on older versions. Neither issue is blocking.

src/aleph/sdk/client/authenticated_http.py (line 630): create_instance still inlines the rejection-handling logic (lines 630-647) that was extracted into _raise_for_rejected_executable for create_program and create_verifiable_program. Consider replacing this block with await self._raise_for_rejected_executable(message.item_hash) for consistency.

pyproject.toml (line 34): The pin is still aleph-message>=1.1.1, but this PR imports from aleph_message.models.execution.vprogram which only exists in >=1.3.0. The floor should be bumped to 1.3.0 (the PR description notes this depends on a separate PR for the bump).

tests/unit/test_asynchronous.py (line 391): assert mock_session_with_post_success.http_session.post.assert_called_once is missing parentheses (), so it asserts the bound method is truthy rather than that post was called once. This is a pre-existing pattern copied from other tests in this file, but the new test inherits the same bug.

[foxpatch-aleph]

Well-structured PR that correctly mirrors the existing create_program/create_instance patterns. Credit-only and immutability constraints are properly delegated to VerifiableProgramContent model validators rather than reimplemented. The _raise_for_rejected_executable extraction is a good DRY improvement but create_instance was not refactored to use it, leaving duplicated code. The abstract method's raise NotImplementedError is missing the helpful 'Did you mean to import' guidance that all sibling methods have. Test coverage is adequate for the three key paths (happy, non-credit rejection, insufficient funds) but could benefit from testing pydantic model inputs and the requirements parameter.

src/aleph/sdk/client/authenticated_http.py (line 630): create_instance still has the full duplicated rejection-handling block (lines 630-647). Now that _raise_for_rejected_executable is extracted, create_instance should be refactored to use it for consistency: replace lines 630-647 with await self._raise_for_rejected_executable(message.item_hash).

src/aleph/sdk/client/abstract.py (line 588): Uses bare raise NotImplementedError while every other abstract method in AuthenticatedAlephClient uses raise NotImplementedError("Did you mean to import AuthenticatedAlephHttpClient?"). Should match the established pattern for a consistent developer experience.

tests/unit/test_asynchronous.py (line 391): assert mock_session_with_post_success.http_session.post.assert_called_once references the attribute instead of calling the method, making it a no-op that always passes. Should be mock_session_with_post_success.http_session.post.assert_called_once(). (Pre-existing pattern copied from other tests, but worth fixing here to avoid propagating it further.)

[foxpatch-aleph]

Clean, well-structured PR that adds create_verifiable_program following the established patterns of create_program and create_instance. The extraction of _raise_for_rejected_executable is a good DRY refactoring shared across all three executable-creation methods. V-Program constraints (credit-only, immutable, no unmeasured inputs) are correctly delegated to the pydantic model validators in aleph-message rather than duplicated in the SDK. Test coverage is solid: happy path, non-credit payment rejection, insufficient funds, and pydantic-model-plus-requirements forwarding. All 41 tests in the affected files pass. No correctness, security, or quality issues found.