[WRONG BRANCH] feat(provider-security): ChefVault client + in-memory slots (PSP-008)

[OnlineChef]

Summary

• Add ChefVault provider-security client (CHEF_PROVIDER_SECURITY_URL, default http://127.0.0.1:8323) with workload headers X-Chef-Workload-Id / X-Chef-Host-Id / X-Chef-Actor.
• Implement in-memory credential slot model (active / next / retiring / revoked), immutable per-request snapshots, renewal jitter, redacted doctor/status output, and explicit error taxonomy including stale_fencing_token.
• Stub PSP-011 degraded mode: when ChefVault is unavailable, allow bounded use of valid in-memory leases only; deny new resolution until authority recovers.
• Wire minimal chefvault:// credentialRef integration for provider doctor/status and models auth resolution.

Stacks on #36 (feat/all-provider-account-management).

Test plan

• bun test tests/provider-security.test.ts — slot transitions, stale fencing, degraded deny-new-resolve, no secret in status serialization
• bun run typecheck
• ChefVault authority endpoint smoke when PSP-006 lands on vault-api

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Greptile Summary

This change adds ChefVault-backed provider credential resolution, in-memory lease rotation, degraded-mode handling, and provider-security status reporting.

Two blocking failures were reproduced:

• A valid ChefVault response placed in a non-active slot can either fail immediately or pair one lease's secret with another lease's metadata.
• A ChefVault resolution failure during model discovery is converted into missing credentials, allowing an unauthenticated upstream /models request instead of surfacing the authority failure.

Confidence Score: 4/5

Not safe to merge until ChefVault failures stop falling back to unauthenticated model discovery and lease-slot resolution returns consistent credential material and metadata.

The reproduced failures affect core provider authentication behavior: valid rotated credentials can be unusable or internally inconsistent, and authority failures can be silently bypassed for model discovery.

Files Needing Attention: src/provider-security/resolve.ts, src/provider-security/slots.ts, and src/oauth/index.ts

Security Review

The provider credential boundary can be bypassed during model discovery: when ChefVault rejects a credential reference, the application continues with an unauthenticated request to the configured upstream. Lease rotation also lacks credential and metadata consistency for non-active slot responses, which can cause requests to carry a secret that does not match the associated lease fencing and expiry information. These issues should be fixed before merge.

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for the posted P1 finding related to the ChefVault slot-hint reproduction harness.
• T-Rex produced a proof for the posted P1 finding related to the ChefVault model-discovery reproduction script and denial path.
• T-Rex validated contract behavior by running the executable harness and capturing the command output for the ChefVault contract scenario.
• T-Rex produced a P1 finding proof with no artifacts attached, following additional contract-validation work.
• T-Rex performed a second general-contract-validation run showing a direct ProviderSecurityError and discovery-path differences in the oauth flow.

_{Ran code and verified through T-Rex}

Comments Outside Diff (2)

1. General comment

   Resolver returns unusable or internally inconsistent credentials for non-active slot hints

   • Bug
     • Confirmed at src/provider-security/resolve.ts:83-88, with request selection in src/provider-security/slots.ts:114-122. A first resolve returning slotHint: "next" is stored in slots.next, but snapshotForRequest selects only active then retiring, so line 86 throws authority_error despite a successful ChefVault response. If the resolve response is retiring while an active lease exists, line 88 returns lease.secret from retiring but the selected snapshot describes active, so API-key material and lease metadata disagree.
   • Cause
     • applyResolve honors slotHint, whereas snapshotForRequest excludes next; resolveCredentialRef independently uses the lease returned by applyResolve for apiKey and a separately selected request snapshot for metadata.
   • Fix
     • Make resolution return a self-consistent selected credential: define the intended eligibility/promotion behavior for next, then either select/promote it when it is the sole usable resolved lease or reject/defer it explicitly. Return apiKey from the same snapshot selected for the request (or require the snapshot lease ID to equal the applied lease ID) so retiring/active responses cannot mix lease material.

   _{Ran code and verified through T-Rex}

2. General comment

   ChefVault credential-resolution failures are downgraded to unauthenticated model discovery

   • Bug
     • For a key-auth provider with credentialRef: chefvault://team/demo-provider, a deterministic ChefVault 404 carrying code: ref_not_found reaches the resolver as ProviderSecurityError(ref_not_found). resolveModelsAuthToken catches it and returns undefined; fetchProviderModels subsequently sends GET /models to the configured upstream with no Authorization header and accepts its returned live model catalog.
   • Cause
     • src/oauth/index.ts:471-475 catches every ChefVault resolver failure and converts it to undefined. Unlike the OAuth-specific unauthenticated fallback, the surrounding key-auth discovery path does not treat an absent key as a reason to stop; it builds and executes the live discovery request without an auth header.
   • Fix
     • At src/oauth/index.ts:471-475, do not convert ChefVault resolver errors to undefined. Let the typed ProviderSecurityError propagate (or explicitly handle it as a failed/blocked discovery before any upstream request), so model discovery cannot silently bypass a ChefVault failure.

   _{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
src/provider-security/resolve.ts:83-88
**Slot responses produce inconsistent credentials**

A successful ChefVault response with `slotHint: "next"` is stored in `next`, but request snapshot selection only considers active and retiring slots. The first resolution therefore throws `authority_error` even though ChefVault returned a valid credential. A `retiring` response while an active lease exists is also inconsistent: this method returns the retiring lease's secret while attaching the active lease's snapshot metadata. Select or promote an eligible resolved slot before returning it, and derive both the secret and metadata from that same selected snapshot.

### Issue 2
src/oauth/index.ts:470-476
**ChefVault failures become missing auth**

This catch converts typed ChefVault resolution failures into `undefined`. For key-auth providers, model discovery treats that as absent credentials and proceeds to call the upstream `/models` endpoint without an `Authorization` header, accepting any unauthenticated response instead of reporting the authority failure. Allow `ProviderSecurityError` to propagate, or stop discovery explicitly when credential resolution fails.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(provider-security): ChefVault clien..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

Context used:

• Context used - Focking gretig zijn en niet stoppen tot perfectie.... (source)

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: eeba906a-1a68-482b-9c35-c19de311febe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Wrong target branch

This pull request currently targets feat/all-provider-account-management, but pull requests must target one of dev or dev2-go.

Its title has been prefixed with [WRONG BRANCH].

OnlineChef Please retarget this PR to dev. Most contributions go to dev first; use dev2-go only for scoped Go native-port work. main receives only release promotions. See our Contributing guide for details. Thanks! 🙏

This pull request is being kept as a draft automatically. Once the target branch is corrected, it will be marked ready for review again.

[OnlineChef]

Superseded by #38 on the same head after fallback stack landed.

[greptile-apps]

Slot responses produce inconsistent credentials

A successful ChefVault response with slotHint: "next" is stored in next, but request snapshot selection only considers active and retiring slots. The first resolution therefore throws authority_error even though ChefVault returned a valid credential. A retiring response while an active lease exists is also inconsistent: this method returns the retiring lease's secret while attaching the active lease's snapshot metadata. Select or promote an eligible resolved slot before returning it, and derive both the secret and metadata from that same selected snapshot.

Context Used: Focking gretig zijn en niet stoppen tot perfectie.... (source)

Artifacts

Executable ChefVault slot-hint reproduction harness

• This deterministic Bun source drives next-only and retiring-with-active resolve paths against the real resolver and slot store, showing the two claimed outcomes.

Observed ChefVault slot-hint reproduction output

• This captured command output shows the next-only authority_error and the retiring secret paired with active snapshot metadata, confirming the defect.

Focused provider-security regression-suite output

• This captured Bun test output shows the pre-existing provider-security suite completed with 12 passing tests while not covering the reproduced paths.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/provider-security/resolve.ts
Line: 83-88

Comment:
**Slot responses produce inconsistent credentials**

A successful ChefVault response with `slotHint: "next"` is stored in `next`, but request snapshot selection only considers active and retiring slots. The first resolution therefore throws `authority_error` even though ChefVault returned a valid credential. A `retiring` response while an active lease exists is also inconsistent: this method returns the retiring lease's secret while attaching the active lease's snapshot metadata. Select or promote an eligible resolved slot before returning it, and derive both the secret and metadata from that same selected snapshot.

**Context Used:** Focking gretig zijn en niet stoppen tot perfectie.... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

ChefVault failures become missing auth

This catch converts typed ChefVault resolution failures into undefined. For key-auth providers, model discovery treats that as absent credentials and proceeds to call the upstream /models endpoint without an Authorization header, accepting any unauthenticated response instead of reporting the authority failure. Allow ProviderSecurityError to propagate, or stop discovery explicitly when credential resolution fails.

Context Used: Focking gretig zijn en niet stoppen tot perfectie.... (source)

Artifacts

Executable ChefVault model-discovery reproduction script

• Runs local deterministic ChefVault-denial and upstream-model services through the production resolver and catalog discovery path, demonstrating the differing outcomes.

Typed ChefVault denial before model discovery

• The direct resolver run exits 0 after capturing `ProviderSecurityError(ref_not_found)` from ChefVault and confirms no upstream request was made.

Unauthenticated upstream model discovery after ChefVault denial

• The discovery integration run exits 0 after ChefVault returns `ref_not_found`, then records an upstream `/models` request with `authorization: null` and an accepted live model.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/oauth/index.ts
Line: 470-476

Comment:
**ChefVault failures become missing auth**

This catch converts typed ChefVault resolution failures into `undefined`. For key-auth providers, model discovery treats that as absent credentials and proceeds to call the upstream `/models` endpoint without an `Authorization` header, accepting any unauthenticated response instead of reporting the authority failure. Allow `ProviderSecurityError` to propagate, or stop discovery explicitly when credential resolution fails.

**Context Used:** Focking gretig zijn en niet stoppen tot perfectie.... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.