feat: gate OpenAI advisory runtime

2026-08-16 20:47:01 +03:00
parent 0ee9e4a8a1
commit 417641dbf4
5 changed files with 220 additions and 12 deletions
@@ -32,4 +32,6 @@ DEV-000049 adds and executes a repeatable production audit for that boundary. It

 ADR-0007 accepts OpenAI Responses API with immutable snapshot `gpt-5.4-mini-2026-03-17` and Mode A per-request retention disclosure as the first real provider binding class. DEV-000050 implements its standard-library adapter and adversarial fake-transport tests: fixed origin/payload, message-only egress, no tools or provider memory, redirect/proxy denial, no retry, strict output mapping and fail-closed timeout/refusal/unavailable/invalid states. The adapter is not wired into the runtime; production remains on `deterministic-fake` with no provider credential or egress.

+DEV-000051 adds an optional cognitive-worker runtime gate for that adapter. It is disabled when `OPENAI_API_KEY_FILE` is absent, rejects direct environment credentials, bounds and validates the secret file, and returns 503 before parsing an OpenAI request while disabled. Production configuration and Creator Web routing are unchanged, so the gate is not active and no provider egress occurs.
+
 These are explicit scope decisions, not hidden incomplete steps in DEV-000043. No production secret is stored in the repository.