Assistant/docs/OPENAI_ADVISORY_BINDING_PROPOSAL.md

OpenAI advisory binding proposal V1

Status: ACCEPTED by ADR-0007 — not production-enabled

Task: ARCH-000009 revision 1
Parent boundary: ADR-0006

Recommendation

Use OpenAI only as the first replaceable provider behind the existing creator-advisory-v1 Cognitive Gateway boundary:

• fixed origin: https://api.openai.com;
• endpoint: POST /v1/responses;
• model snapshot: gpt-5.4-mini-2026-03-17;
• reasoning effort: low for the initial evaluation and canary;
• store: false, synchronous response only, no background mode;
• no tools, function calls, web/file search, MCP, code interpreter, hosted shell, images, audio, files, conversations or previous_response_id;
• one request produces one ephemeral advisory response and no provider-side memory.

OpenAI's current guidance recommends the Responses API for modern reasoning workflows and describes gpt-5.6-terra as the balance of capability and cost. This proposal nevertheless selects the published immutable gpt-5.4-mini-2026-03-17 snapshot: ADR-0006 requires a model revision not to inherit promotion silently, while the current Terra page does not publish a dated snapshot. A later Terra snapshot requires a new binding revision and evaluation rather than alias drift.

Official sources checked on 2026-08-16:

• OpenAI model guidance
• GPT-5.4 mini model and snapshot
• OpenAI API data controls

Data decision

OpenAI states that API data is not used for training unless the customer opts in. Under default controls, however, abuse-monitoring logs can include prompts and responses and may be retained for up to 30 days. Zero Data Retention and Modified Abuse Monitoring require OpenAI approval. store: false avoids Responses application-state storage but does not by itself remove default abuse-monitoring retention.

Therefore the initial binding has two distinct, non-interchangeable modes:

Mode A — default retention, first canary

Permitted:

• the Creator's text entered explicitly for this single advisory request;
• a fixed system instruction containing no user or project data;
• locale and output-size controls.

Forbidden:

• automatic context excerpts, even when marked PRIVATE_ALLOWED;
• credentials, tokens, passwords, private keys, connection strings or authentication headers;
• Actor, Principal, Scope, session, workspace, Goal, Task, provider-binding or internal request identifiers;
• files, images, database rows, logs, browser history, conversation history and ambient machine context.

The UI must disclose before each request that the explicitly entered text leaves the private network and may be retained by the provider for abuse monitoring for up to 30 days. Submission is the per-request acknowledgement; it is not durable blanket consent.

Mode B — approved ZDR/MAM project

Enabling PRIVATE_ALLOWED context requires separate evidence that the exact OpenAI project has the approved control enabled, a new binding revision, a new evaluation, and explicit Creator promotion. Even then, SECRET and UNKNOWN remain forbidden, and tools/background/conversations remain disabled.

Provider request mapping

The adapter constructs provider JSON itself. Provider-specific types stay under adapters/models; no provider type crosses into contracts or domain packages.

The request contains only:

• fixed snapshot model;
• fixed non-executable system instruction: answer as non-canonical advice, state uncertainty, never claim an action occurred, never request or expose secrets;
• the single Creator message;
• store: false;
• reasoning effort low;
• an output limit consistent with the existing 16 KiB response contract.

The adapter must not serialize trusted routing/authority fields into the provider prompt. Those fields authorize local scope selection only; they are not model context.

Response mapping

The adapter accepts text output only. It rejects:

• tool calls or executable items;
• unknown output item kinds;
• response identifiers offered as future conversation state;
• output larger than the contract limit;
• invalid UTF-8, malformed JSON, redirects or an origin change.

Provider refusal maps to CONTENT_REJECTED; deadline expiry to TIMEOUT; transport or availability failure to PROVIDER_UNAVAILABLE; malformed/forbidden provider output to INVALID_PROVIDER_RESPONSE. No failure is retried automatically and no partial output is shown after a failed validation.

Isolation and transport

• The API key is created in a dedicated OpenAI project and mounted read-only only into cognitive-worker as a Docker secret file.
• The secret is absent from Git, PostgreSQL, image layers, environment variables, logs, health responses, browser storage and other containers.
• Standard-library HTTPS client, normal certificate validation, fixed SNI/Host, disabled redirects and disabled ambient proxy variables.
• Egress is limited operationally to the fixed OpenAI API origin; DNS/IP changes are treated as infrastructure, not browser-controlled routing.
• Request bodies, response bodies, authorization headers and message hashes are not logged. Metrics contain binding revision, latency bucket, finish reason and token counters only.

Limits and cost controls

• 30-second hard deadline inherited from ADR-0006;
• no automatic retry;
• 5 requests per minute and 50 requests per day for the single Creator during canary;
• maximum five simultaneous in-flight requests is reduced to one during canary;
• provider output is capped by both provider token limit and the 16 KiB validated gateway limit;
• OpenAI project spend limit and alert must be configured before the key is mounted;
• any rate, model, prompt or spend-limit change creates a new binding revision.

Official pricing is mutable and is operational metadata rather than architecture. At review time the documented GPT-5.4 mini price is USD 0.75 per million input tokens and USD 4.50 per million output tokens; deployment must re-check the provider dashboard and project limit.

Evaluation and promotion

1. Implement the adapter against an adversarial local fake server; do not add the production key.
2. Test fixed origin, redirect denial, proxy denial, strict JSON, timeout, body limits, forbidden output kinds and log redaction.
3. Run an offline corpus containing only synthetic/public advisory cases. Record exact snapshot, prompt revision, expected safety properties, latency and estimated cost.
4. Mount a dedicated project key only after Mode A disclosure and spend controls exist.
5. Run shadow calls whose results are never shown, using synthetic/public inputs only.
6. Creator explicitly promotes the exact binding revision to a small canary.
7. Canary permits only explicit message text, one in-flight request, no automatic context and immediate rollback.
8. Broader use requires recorded evaluation evidence and a separate promotion decision.

Rollback and degraded operation

Rollback disables/retires the OpenAI binding and restores deterministic-fake as the only active binding. The UI returns explicit PROVIDER_UNAVAILABLE. Creator authentication, Situation, Continuity, Commit, notification delivery and all canonical state remain available. Removing provider cognition never requires a database migration or state repair because advisory requests and responses are not persisted.

Decisions still requiring explicit acceptance

Before implementation:

1. accept OpenAI Responses API as the first provider;
2. accept gpt-5.4-mini-2026-03-17 as the first immutable model snapshot;
3. accept Mode A's possible provider abuse-monitoring retention up to 30 days, or require ZDR approval before any real call;
4. accept the per-request disclosure wording and initial rate/spend policy.

Before production egress, a dedicated OpenAI API project and API key must exist. A ChatGPT/Codex subscription is not evidence that an API key or API billing project is available.