FE-1646: Enable Petrinaut Voice in production

[kostandinang]

🌟 What is the purpose of this PR?

Enable Petrinaut Voice in production when it is explicitly configured on the server. Voice remains unavailable unless both the feature flag and dedicated OpenAI key are present.

🔗 Related links

• FE-1646 (internal)
• Related module-loading fix: #9589

🚫 Blocked by

None.

🔍 What does this change?

• Allow OpenAI Voice in production when PETRINAUT_OPENAI_VOICE_ENABLED=true and OPENAI_VOICE_API_KEY is non-empty.
• Keep Voice unavailable when either server setting is absent or invalid.
• Update the Petrinaut website documentation for the production configuration.
• Add policy, configuration-handler, and UI integration coverage for production availability.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• require changes to docs which are made as part of this PR

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

⚠️ Known issues

None.

🐾 Next steps

None.

🛡 What tests cover this?

• Policy tests cover the exact enabled value, missing or whitespace-only keys, and production availability.
• The /api/voice/config handler test covers the production response contract.
• The production availability integration test covers the Voice entry point appearing when Brunch and server Voice are available.
• mise exec -- turbo run lint:tsc --filter @apps/petrinaut-website
• mise exec -- turbo run test:unit --filter @apps/petrinaut-website (41 files, 365 tests)
• Targeted Voice policy, configuration, and Realtime tests (19 tests)
• oxlint --type-aware on the changed TypeScript files
• oxfmt --check on all changed files

❓ How to test this?

1. Configure PETRINAUT_OPENAI_VOICE_ENABLED=true, OPENAI_VOICE_API_KEY, and a valid Brunch endpoint.
2. Start the Petrinaut website in a production-equivalent environment.
3. Open the AI assistant and confirm that Start voice mode is available.
4. Remove either Voice server setting and confirm that Voice is unavailable.

📹 Demo

Not applicable; this changes server-side availability and configuration behavior without changing the Voice interface.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
petrinaut	Ready	Preview	Sep 9, 2026 3:28pm UTC
petrinaut-docs	Ready	Preview	Sep 9, 2026 3:28pm UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
hash	Ignored	Preview	Sep 9, 2026 3:28pm UTC
hashdotdesign-tokens	Ignored	Preview	Sep 9, 2026 3:28pm UTC

[cursor]

PR Summary

High Risk
Enables billable OpenAI Realtime sessions in production before FE-1622 authentication; same-origin checks do not stop non-browser callers from spoofing Origin.

Overview
Production Brunch Voice is no longer hard-disabled when VERCEL_ENV/NODE_ENV is production. Availability now depends only on PETRINAUT_OPENAI_VOICE_ENABLED === "true" and a non-empty trimmed OPENAI_VOICE_API_KEY, so /api/voice/config and the realtime-call path can report and accept Voice when those secrets are set.

The README is updated to describe production enablement and documents the temporary lack of caller authentication (spoofable Origin, operational kill switch, FE-1622 follow-up). Tests add policy cases for whitespace keys, exact flag casing, production availability, a config-handler check under VERCEL_ENV: production, and an integration test that shows Start voice mode when the config endpoint returns available: true.

^{Reviewed by Cursor Bugbot for commit 5fb9c5e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[lunelson]

Two focused follow-ups before merge:

• The README rollback guidance says to disable PETRINAUT_OPENAI_VOICE_ENABLED, but the issue/PR operating plan also calls for rotating the dedicated key when abuse is suspected. Please include that key-rotation/revocation step in the README.
• Please cover the production microphone path from configured Brunch plus an available /api/voice/config response through to the rendered microphone action. The policy tests should also pin the fail-closed edge cases: enabled flag with a missing or whitespace-only key, and non-exact flag values such as TRUE.

The policy implementation itself looks correct; these are documentation and proof gaps.

[lunelson]

The requested documentation and coverage gaps are resolved. The production Voice rollback guidance now includes key revocation/rotation, and tests cover the configured microphone path plus fail-closed key and flag edge cases.