FEAT: add ScenarioPresetRegistry owning preset storage and validation

[hannahwestra25]

Description

Prerequisite extracted from #2931, which rebases onto it. Durable layer only — no service, routes, or UI.

pyrit.registry.components.ScenarioPresetRegistry owns preset storage, validation, and version-checked resolution. A preset is a stored JSON document or one registered by code; reads merge both, stored wins, and PresetEntry.origin reports which arrived. Saving over a registered name raises ScenarioPresetNameRegisteredError, mapped by type.

It reads through on every call and is not a cache: versions are sha256(stored_bytes), multi-worker is supported, and a cached version checked against itself would launch a configuration nobody confirmed.

One technique-token resolver (pyrit.scenario.core.technique_tokens) collects issues rather than raising, so check_preset reports all at once. Parameters go through resolve_declared_params.

scan_stored_presets is parse-only at boot: building scenario metadata instantiates every scenario class.

Addresses asks 1–4 of the #2931 review.

#2956 and #3143 have since merged, so max_dataset_size is now a deprecated alias for max_total (removed in 1.4.0). ScenarioPreset still persists the pre-#2956 shape and cannot express all; moving it to max_per_dataset/max_total is a follow-up, since #2931 builds routes and UI on the current field names.

Tests and Documentation

scenario_presets_source and its lock files documented in pyrit_conf.md.

pytest tests/unit/common/test_lazy_package_imports.py tests/unit/registry
       tests/unit/models/test_scenario_preset.py tests/unit/backend tests/unit/scenario
5283 passed, 5 skipped

[Richard Lundeen (richlundeen)]

Review summary

Thanks for pulling this out of #2931 — reviewing the storage and lock behaviour on its own was much easier.

What's working

The storage layer fixes the defects from #2931 and I think it's ready as-is:

• _replace_file stages to a temp file, fsyncs, then os.replace, so a failed write keeps the old preset.
• The lock is an OS advisory lock released by the kernel on exit, which replaces the 60-second age heuristic that couldn't prove the first writer had died.
• Names are validated before any read, so one bad file can't stop the listing.
• Blob uses overwrite=False for create and If-Match for update.
• custom_initializer_storage.py drops 137 → 76 lines, so the extraction is real reuse rather than speculative.
• The tests cover the hard cases: lock contention, dead-writer reclaim, partial writes, non-UTF-8 documents, blob preconditions.

I also ran it against a plain local directory to confirm nothing needs blob: save/load/list/delete, version conflicts, hand-edit detection, and the resolve guard all work, and azure.storage.blob is never imported.

Why I'm being picky about [1] and [2]

This isn't only the preset layer. It's the first durable named-configuration layer in the registry, and the intent is to persist target, scorer, and converter configurations the same way. Whatever shape lands here is what the next several registries copy, and #2931 rebases onto it immediately.

That makes two otherwise-minor things worth getting exactly right:

• [1] — TargetRegistry and ScorerRegistry are already Registry subclasses holding instances. Giving them durable configs means adding storage to a Registry, which is exactly what [1] asks for. If presets land as a bespoke class, the pattern doesn't transfer and the next registry reinvents it.
• [2] — "resolve through the real path, report advisorily" is the validation model every stored config needs, and it's what keeps a config portable between deployments. A second implementation here becomes a second implementation everywhere.

The rest is ordinary and can be taken or left on its merits.

The items

I've left these as separate inline threads so we can discuss and resolve them individually.

#	Item	Priority
1	Subclass Registry; add a registration surface	Blocks merge
2	check_preset should use the registry's resolution	Blocks merge
3	Blob error on a missing container	Blocks merge (small)
4	PR description fixes	Blocks merge (small)
5	Two method names that mislead	Cheap
6	Documentation	Cheap
7	Document conventions to settle now	Cheap
8	Optional version check on delete	Follow-up

[4] PR description fixes

No code to anchor this to, so putting it here.

• scenario_preset.py moved into this PR, so the #2956 ask moved with it. Suggest adding: "Related to #2956. Prefer to merge #2956 first. Then update presets to use the same dataset-limit normalization and GUI controls, including all." #2956 is still open, so merging this first is fine.
• "check_preset is the single validation path, replacing the service's ad-hoc _unknown_* helpers" — scenario_preset_service.py doesn't exist on main, so nothing was replaced; the helpers came over from #2931 largely unchanged. That line becomes true after [2].

---

Drafted with GitHub Copilot; reviewed and posted by me.