# One machine that becomes a mesh, then plays out the STATIC-KEY half of model-access (novox/hq
# ADR 0050) for OpenAI. Where the Anthropic bed proves the refreshable-grant shape (a manager holds a
# refresh token, the mesh delivers only the access token), this proves the OTHER shape ADR 0050
# defines and no vendor had exercised: a single operator-supplied key, sealed to the consumer holder,
# unsealed by the host, and written where an OpenAI/Codex client reads it. There is no manager, no
# refresh, and no usage — a static-key vendor exposes none, which ADR 0054 says is fine.
#
# The flow the test drives:
#   the operator sets the API key on the licence  ->  the mesh seals it to the consumer holder  ->
#   the host unseals it and mounts it at the consumer's secret path  ->  the consumer writes it as
#   OPENAI_API_KEY (env file + the Codex auth.json). The test asserts the written key equals the one
#   the operator set — through the sealed delivery path, unchanged.
#
#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
#   Build the consumer runtime image into the local daemon first (raise() stocks it from there):
#     scripts/build-module-runtime.sh openai-consumer  /tmp/openai-consumer.tar
scenario: openai-bed

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    egress: true
    inbound: allow
    memory: 3GiB
    cpus: 2

images:
  - mesh-control:development
  # The static-key consumer runtime, built by scripts/build-module-runtime.sh into the local daemon and
  # loaded onto the machine, which holds it by its own image ID.
  - mesh-runtime-openai-consumer:development

place:
  all: [host, runtime]