[freeqaz-openai]

An operator can retry a static credential update after a Gateway outage; a missing or ambiguous provider requires a configuration fix. The API distinguishes those cases, but the existing test would still pass if an outage were reported as a provider conflict.

Extend the existing HTTP update test for a Gateway-owned source. With a healthy catalog, removing or duplicating the admitted provider still returns 409. With that provider present but its Gateway catalog unavailable, the update returns 503. Both refusals leave the stored source unchanged and cause no additional Secret reads or provider requests. A successful update still uses the admitted provider after providers are reordered.

This changes one test and no production code.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR extends the static credential update integration test to distinguish an owning Gateway outage from a provider conflict and verify that refusals preserve the complete stored source.

Example: PATCH an unbound OpenAI credential source while its admitted provider remains registered but the owning Gateway catalog throws an error.

• Before: The existing test did not assert that this outage returns 503 instead of 409.
• After: The test requires 503 DEPENDENCY_UNAVAILABLE, unchanged stored source data, and no additional Secret reads or provider requests.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused, source-supported coverage with successful head CI; evidence is integration-harness based, and detailed execution logs were inaccessible.
Proof confidence	🦐 gold shrimp (3/6)	This maintainer-authored test-only PR has no changed production behavior requiring separate live proof; its integration scenario uses the production HTTP API with fixture storage and an injected catalog failure.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Test only · Worth it: Yes · Fix scope: Complete
User problem: Operators need a retryable Gateway outage to remain distinguishable from a provider configuration conflict.
Reason: The maintainer-authored test extension protects a useful existing API distinction without expanding product scope.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it adds focused, useful coverage for an existing API distinction, with no introduced defect found; repository policy and collaborator authorship reserve disposition for maintainers.

Priority: P3
Reviewed head: 5bcd2c60b850a16f8d63d14ebe188d365e962de3

Before merge

None.

Findings

None.

Agent review details

How this fits together

Authenticated credential-source PATCH requests enter the production Fastify API, pass through OCC authorization and source ownership checks, and consult the owning Gateway catalog before credential material access or persistence changes.

flowchart LR
  A[Authenticated PATCH request] --> B[Fastify API]
  B --> C[OCC update handler]
  C --> D[Owning Gateway catalog]
  D --> E[503 on catalog outage]
  C --> F[Secret access and source update]

Loading

Technical review

Best possible solution:

Retain the focused extension to the existing integration test without changing production behavior or introducing another fixture.

Do we have a high-confidence way to reproduce the issue?

This PR closes a coverage gap rather than fixing a reproduced production failure; source inspection confirms the expected outage path, and no target code was executed.

Is this the best way to solve the issue?

Extending the existing authenticated HTTP scenario is proportionate: the test exercises the real error mapping and state preservation while injecting only the dependency failure.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 32f1476071e4.

Provenance checked

• Provider-pinning update test and persisted-source assertions keeps the original intent (9bc30f1: Keep the admitted provider across catalog reordering and refuse missing or ambiguous registrations before exposing credential material.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced change: The pinned introduction changes only the existing integration test: it expands source preservation assertions and adds a catalog-outage scenario. (tests/integration/credential-proxy-provider-pin.test.ts:441, 5bcd2c60b850)
• Distinct outage coverage: The test restores the admitted provider, injects a Gateway catalog failure, and asserts 503 DEPENDENCY_UNAVAILABLE, complete source preservation, unchanged Secret reads and validations, and zero provider requests. (tests/integration/credential-proxy-provider-pin.test.ts:473, 5bcd2c60b850)
• Current main behavior: Current main resolves the recorded Gateway and reads its source-type catalog before static provider selection or Secret material access; credentialGatewayOperation maps an ordinary catalog failure to DependencyUnavailableError. (packages/occ/src/index.ts:6735, 32f1476071e4)
• Real API boundary with simulated dependencies: The fixture starts createFastifyApp on loopback and sends authenticated HTTP requests; runtime observations and storage are fixtures, and the new case replaces only the catalog method with a failure. (tests/helpers/console-app.mjs:490, 5bcd2c60b850)
• Original test intent: Keep the selected credential provider through source updates and requests #3879 introduced the provider-pinning test to prevent catalog reordering or ambiguous registrations from changing the approved provider; this PR preserves those checks. (tests/integration/credential-proxy-provider-pin.test.ts:416, 9bc30f1157c8)
• CI validation and inspection limits: The pull-request CI run reports success for head 5bcd2c6, including Checks and Conformance 1, whose manifest includes this test. Detailed job logs redirected to a blocked Azure host, so individual test results were not inspected. Older-blob gaps also limited extended blame and history searches. (scripts/ci/test-suites/checks-baseline-1.json:111, 5bcd2c60b850)

Likely related people:

• Free Wortley: Raw commit 9bc30f1 adds tests/integration/credential-proxy-provider-pin.test.ts:414 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 9bc30f1157c8; files: tests/integration/credential-proxy-provider-pin.test.ts)

Review metrics

Metric	Value	Why it matters
Change scope	Production +0/-0; tests +24/-7	The growth adds a distinct failure scenario and stronger preservation assertions inside the existing test.

Labels

Label changes:

• add P3: This is a focused test improvement for behavior already implemented on main.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is a focused test improvement for behavior already implemented on main.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 30, 2026, 3:43 AM ET / 07:43 UTC.