From f8ced9c6297d3f3fd3c0a26c5a9793195dedad01 Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Wed, 12 Aug 2026 16:57:33 -0400 Subject: [PATCH] docs(progress): describe the shape this PR actually landed in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The progress entry was written before four review rounds reshaped the change: it credited openaiCompatScheme alone, listed the tests as six per-provider cases, and mentioned a captureRT detail that has since moved. Rewritten to match what merges — registerOpenAICompatBuiltin owning both halves, envKeyForProvider as the single LLM_ definition, and the shared table that every OpenAI-compat built-in is now checked against. Co-Authored-By: Claude Opus 5 (1M context) --- progress.md | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/progress.md b/progress.md index df2331a..e69f874 100644 --- a/progress.md +++ b/progress.md @@ -302,15 +302,22 @@ tests flush out. `output_config.format` (which the shim does not implement), and cached-token accounting reads Anthropic-only usage fields. The shim is still reachable ad hoc via an `anthropic://` DSN. -- kimi and qwen DSN factories were byte-identical, so they now share one - `openaiCompatScheme` helper — the credential + key-hint rules come by - construction, not by copy. -- Hermetic tests: built-in base URL + bearer, missing key names QWEN_API_KEY - with no OPENAI fallthrough and no network hit, the reverse leak (a visible - QWEN_API_KEY must not authenticate the openai built-in), `qwen://` round-trip - against the China host, its keyless hint naming LLM_QCN, and - `reasoning_effort` asserted on the wire body (the ADR's load-bearing claim). - captureRT now records the request body; all six break-checked. +- `registerOpenAICompatBuiltin` installs BOTH halves of an OpenAI-compat + built-in (eager provider + `name://` DSN scheme via the shared + `openaiCompatScheme`), so the two credential rules — unconditional + `WithAPIKey`, and `WithAPIKeyName` naming that same variable — hold by + construction. kimi and qwen are one line each. +- `envKeyForProvider` is the single definition of the `LLM_` form, + shared by lazy resolution (`registry.go`) and the DSN missing-key hint. They + were separate copies with a comment asserting they matched. +- The shared contract is ONE table (`builtin_openaicompat_test.go`), run + identically for every OpenAI-compat built-in: endpoint + bearer, missing key + fails closed naming its own variable with no network hit, the `name://` DSN + reaching another host, and a keyless DSN naming `LLM_` rather than the + built-in's key. Adding a built-in is a table row that immediately owes all + four; `builtin_kimi_test.go` was retired into it. Qwen-only tests: the + reverse credential leak, and `reasoning_effort` asserted on the wire body + (the ADR's load-bearing claim). - Docs in sync: README built-in table + Qwen paragraph + DSN scheme list + support matrix (footnote ⁴), `.env.example`, ADR-0027 (+ index). - Consumer: mort wants Qwen as a failover tier.