feat(codex): publish verified routed service tiers - #1521

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/server/auth-cors.ts.

⏳ DRAFT

• review readiness checklist open (1/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 1/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

1/4 boxes ticked.

This PR stays in draft until every box above is ticked.

The implementation and focused verification are green. The only blocked gate is the repository security-boundary rule because this PR touches src/server/auth-cors.ts for provider-management validation and the public provider DTO. This does not change request authentication, CORS admission, credentials, or secret handling. Please review this narrow change and apply the maintainer-sponsored label if acceptable; I am intentionally leaving the PR as a draft.

Rebased onto current dev@d5824814853eea68ceb4417403b22000a935cef8; new head is e12d917015c2. Post-rebase local proof is green: typecheck; service-tier/Chat 55 tests; catalog/registry 210 tests; router/policy 27 tests; focused management test 1 test; privacy scan; docs build (265 pages); and diff check. The remaining blocked checks are the repository security sponsorship gate for src/server/auth-cors.ts (provider-management validation/public DTO only). Please review this narrow boundary change and apply maintainer-sponsored if acceptable; I am intentionally keeping the PR Draft.

Rebased and force-with-lease pushed onto current dev@cbbfdd8773e68a5dc2391ddeb32f33a225373c1a; new head is 15e1734. Fresh local proof: capability/catalog/runtime focused suite 309/309, 1167 assertions; typecheck, privacy scan, and diff check passed. The only remaining repository gate is maintainer sponsorship for the narrow provider-management validation/public DTO change in src/server/auth-cors.ts; I am leaving the PR Draft and will not bypass that security-boundary rule.

The security-boundary gate is now addressed by a real scope split, not by weakening validation: commit moves the new service-tier validation and public DTO projection into , removes the two additions from , and keeps POST/PATCH validation plus projection behavior intact. The diff no longer changes the protected auth-cors file. Fresh proof after the split: capability management projection/validation and persistence tests pass; related catalog/runtime/Chat tests 229/229; typecheck, privacy scan, and diff check pass. Please let hygiene/enforce-target rerun and review the new management-only module.

The security-boundary gate is now addressed by a real scope split, not by weakening validation: commit 5224f1a3ff38 moves the new service-tier validation and public DTO projection into src/server/management/provider-capability-config.ts, removes the two additions from src/server/auth-cors.ts, and keeps POST/PATCH validation plus /api/config projection behavior intact. The diff no longer changes the protected auth-cors file.

Fresh proof after the split: capability management projection/validation and persistence tests pass; related catalog/runtime/Chat tests 229/229; typecheck, privacy scan, and diff check pass. Please let hygiene/enforce-target rerun and review the new management-only module.

Initial maintainer review on exact head 5224f1a3ff38e1686c45516ade57ec42b89235af.

The scope split out of auth-cors.ts is the right direction, and the core design is more coherent than landing #1512 alone: one exact provider/model capability decision controls catalog Fast metadata, global Fast injection, caller-selected tier preservation, and unsupported-tier stripping. Exact model IDs remain provider-scoped, and provider-level false remains fail-closed.

I am keeping this draft pending deeper review and executed exact-head CI. Please do not merge yet. The next review must verify at least these boundaries:

• an unclassified route preserves an explicit caller tier but never receives global Fast injection or catalog Fast metadata;
• model adapter overrides cannot publish Fast for a non-OpenAI-compatible wire;
• provider-level false cannot be reopened by an exact-model true;
• management PATCH merge/clear behavior cannot leak a capability across providers or inherited object keys;
• combo intersection and custom-model projection use the same exact resolved model identity;
• a selected Fast tier cannot be advertised without being forwarded by the eventual adapter.

If those checks hold on current dev and full CI is green, this is the preferred integration candidate and #1512 should close as superseded. No maintainer sponsorship label is needed now that the protected auth/CORS file is no longer changed.

Updated exact head: c6c0c9827702ef59b7de4f9c8bc1fd9443823ac6.

The runtime follow-up now uses the same final model/wire capability decision as catalog projection: explicit caller tiers are preserved only when the final adapter can forward them, and stripped fail-closed for provider/model denial or a non-service-tier adapter. Provider-level false remains authoritative.

Fresh local proof on this exact head: 230 focused catalog/runtime/Chat tests passed, 879 assertions; management scope-split proof was 2 tests/26 assertions; typecheck, privacy scan, diff check, and the 265-page docs build passed. The PR remains Draft for exact-head CI and the requested maintainer review.

Superseded by the final current-dev update below. The authoritative candidate is now based on dev@59da369f1aba7996c518a72ff6c3add04aa2cedb at head 2a9c48d21; the earlier 84c012243/fcd912638 note is retained only as historical progress.

Final current-dev rebase completed after correcting the upstream base pointer.

Base: dev@59da369f1aba7996c518a72ff6c3add04aa2cedb
Head: 2a9c48d21
Post-rebase service-tier/OpenAI proof remains 56 passed / 0 failed / 100 assertions; typecheck, privacy scan, and diff check passed. Keeping Draft for the maintainer's six boundary checks and automatic CI.

Current exact-head handoff: rebased onto upstream dev@abe82212a7983cb5b5e97d94e958843068303241 and force-with-lease pushed as 7782d82d8.

Post-rebase proof: service-tier/OpenAI focused tests 56 passed, 0 failed, 100 assertions; typecheck, privacy scan, and diff check passed. Please run exact-head CI and the six requested capability-boundary checks; keeping Draft.

Final exact-head update: upstream dev@4e0ffb2cbef0d3724a3aa9ebef26279aed44b694, fork head 1ed378812.

The final rebase proof is 56/56 service-tier/OpenAI tests, 100 assertions, plus typecheck, privacy scan, and diff check. Please review the six capability boundaries and run exact-head CI; Draft remains intentional.

Final exact-head gate status: 1ed378812 is based on dev@4e0ffb2cbef0d3724a3aa9ebef26279aed44b694; enforce-target, hygiene, label, and resolve-pr all pass. Local service-tier/OpenAI proof remains 56/56 with 100 assertions plus typecheck/privacy/diff. The PR remains Draft pending maintainer review and readiness confirmation.

@lidge-jun Reviewer-request API is unavailable to the fork author (403), so this is the explicit handoff instead. Final head 1ed378812 is based on dev@4e0ffb2cb; enforce-target/hygiene/label/resolve-pr pass, and the service-tier/OpenAI matrix is 56/56. Please review the six capability boundaries and decide readiness.

Current exact-head handoff after the latest upstream rebase:

• Base: dev@567a6d4ffe6a7d7b341b5cc11e736081e1bb4522
• Head: b1bebc059482f06b9e1e8be3aeaf2bb7902b1685
• Service-tier/OpenAI focused matrix: 56 passed, 0 failed, 100 assertions.
• bun run typecheck, bun run privacy:scan, and git diff --check origin/dev...HEAD: passed.
• GitHub enforce-target, hygiene, label, and resolve-pr: passed.

The PR remains Draft because the requested independent maintainer review and readiness confirmation are still pending. Please review this exact head against the six capability boundaries listed in the earlier review; #1512 remains the fallback until this candidate is accepted.