openai bed: prove the static-key model-access path (ADR 0050)

A single-node VM bed: the operator sets an API key on an openai licence, the mesh seals it to the consumer, the host unseals and mounts it, and the consumer writes it as OPENAI_API_KEY (env + Codex auth.json). Asserts the written key equals the one set — the other shape ADR 0050 defines, and the ADR 0054 branch where a static-key vendor records no usage. Green on the first run. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
2026-09-07 04:25:26 +02:00
parent 0513163119
commit a1231a7f89
2 changed files with 287 additions and 0 deletions
@@ -0,0 +1,41 @@
+# One machine that becomes a mesh, then plays out the STATIC-KEY half of model-access (novox/hq
+# ADR 0050) for OpenAI. Where the Anthropic bed proves the refreshable-grant shape (a manager holds a
+# refresh token, the mesh delivers only the access token), this proves the OTHER shape ADR 0050
+# defines and no vendor had exercised: a single operator-supplied key, sealed to the consumer holder,
+# unsealed by the host, and written where an OpenAI/Codex client reads it. There is no manager, no
+# refresh, and no usage — a static-key vendor exposes none, which ADR 0054 says is fine.
+#
+# The flow the test drives:
+#   the operator sets the API key on the licence  ->  the mesh seals it to the consumer holder  ->
+#   the host unseals it and mounts it at the consumer's secret path  ->  the consumer writes it as
+#   OPENAI_API_KEY (env file + the Codex auth.json). The test asserts the written key equals the one
+#   the operator set — through the sealed delivery path, unchanged.
+#
+#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
+#   Build the consumer runtime image into the local daemon first (raise() stocks it from there):
+#     scripts/build-module-runtime.sh openai-consumer  /tmp/openai-consumer.tar
+scenario: openai-bed
+
+segments:
+  hosting:
+    kind: public
+    cidr: [192.0.2.0/24]
+
+machines:
+  anchor:
+    at: { segment: hosting, address: [192.0.2.10] }
+    inbound: allow
+    memory: 3GiB
+    cpus: 2
+
+images:
+  # The first-node substrate: store, broker, control.
+  - postgres:17-alpine
+  - cloudamqp/lavinmq:latest
+  - mesh-control:development
+  # The static-key consumer runtime, built by scripts/build-module-runtime.sh into the local daemon and
+  # stocked into the scenario's own registry, which is where the host pulls it from.
+  - mesh-runtime-openai-consumer:development
+
+place:
+  all: [host, runtime]