From e87b6b73ecd1d9b20ac17e68963df145d8bae691 Mon Sep 17 00:00:00 2001 From: dtzp555-max Date: Mon, 25 May 2026 15:19:13 +1000 Subject: [PATCH] =?UTF-8?q?release(phase-2-close):=20v0.2.0=20=E2=80=94=20?= =?UTF-8?q?multi-key=20auth=20+=20audit=20+=20owner=20gating=20+=20keygen?= =?UTF-8?q?=20CLI=20(D43-A=20=E2=86=92=20D47)=20(#24)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes Phase 2. All 11 ADR 0007 § 10 acceptance criteria shipped + tested in main across 6 D-day commits (D43-A doc cleanup, D43-B ADR 0007 ratify, D44 lib/keys.mjs core, D45 server.mjs auth integration + lib/audit.mjs, D46 owner gating /health + X-OLP-Fallback-Detail, D47 bin/olp-keys.mjs keygen CLI). Test count 468 (v0.1.1) → 544 (v0.2.0). Per CLAUDE.md release_kit.phase_close_trigger this PR is the explicit maintainer-triggered close action. CHANGES IN THIS COMMIT (release-kit machinery only — no code): package.json: - version 0.1.1 → 0.2.0 CLAUDE.md release_kit.phase_rolling_mode: - current_phase: Phase 2 → Phase 3 - current_pre_release_identifier: "0.2.0-phase2" → "0.3.0-phase3" CHANGELOG.md: - Unreleased promoted to "## v0.2.0 — 2026-05-25" with the D43-A → D47 entries intact (already accumulated under release_kit phase_rolling_mode discipline during Phase 2 D-days). - New Phase 2 release_kit checklist + ADR 0007 § 10 acceptance criteria final-ship table + known-limitations-beyond-v0.2.0. - New "## Unreleased\n\n(empty — Phase 3 entries land here once Phase 3 opens)" sentinel for the next phase. D37 phase_rolling_mode gate will pass (sentinel-only Unreleased). README.md: - Status header v0.1.1 → v0.2.0; Phase 1+2 shipped; Phase 3 next. - Implementation status note dated post-v0.2.0; reflects Phase 2 close. - Phase plan Phase 2 promoted to ✅ Shipped; Phase 3 marked (next). Test count 544 / 544 pass (npm test verified locally; no test or .mjs file touched in this release commit). NEXT STEPS (post-merge, auto-triggered): - git tag v0.2.0 + git push --tags - release.yml fires: phase_rolling_mode gate passes (Unreleased is sentinel-only) + GitHub Release auto-published from the CHANGELOG v0.2.0 section. ACKNOWLEDGEMENTS: - Phase 2 was executed under the maintainer's standing autopilot grant (~/.cc-rules/memory/auto/standing_autopilot_phase_2.md, cc-rules bf0ed9a); D-day cadence: 6 implementation D-days + multiple opus-reviewer fold-ins, all in a single session. - ADR 0007 was authored via D43-B with maintainer text review on top of fresh-context opus review (4 findings: 1 P1 safety + 2 P2 + 1 P3) folded in before ratification. Authority: - CLAUDE.md release_kit overlay phase_rolling_mode (Iron Rule 5.5) governs this commit's shape; phase_close_trigger requires explicit maintainer action — the user issued "go" to trigger. - ADR 0007 (multi-key auth) — the Phase 2 design contract; acceptance criteria #1–#11 covered. - CC 开发铁律 v1.6 § 10 — fresh-context opus reviewer required for every implementation phase + design ADR (executed on D44, D45, D46, D47, and D43-B with double-review). Co-authored-by: dtzp555 Co-authored-by: Claude Opus 4.7 --- CHANGELOG.md | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ CLAUDE.md | 4 ++-- README.md | 10 +++++----- package.json | 2 +- 4 files changed, 57 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 74abcad..dc20666 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,55 @@ All notable changes to OLP land here. Per `CLAUDE.md` release_kit overlay, this ## Unreleased +(empty — Phase 3 entries land here once Phase 3 opens) + +## v0.2.0 — 2026-05-25 + +### Phase 2 — Multi-key auth + audit + owner gating + keygen CLI (D43-A → D47) + +**Overview.** v0.2.0 closes Phase 2 — the multi-key authentication track that grew OLP from single-tenant anonymous-only proxy (v0.1.1) to a multi-identity deployment with per-key cache isolation, audit attribution, owner-vs-guest header gating, and a reproducible bootstrap CLI. 6 D-day commits (D43-A through D47) shipped between 2026-05-25 (single intensive session under the standing-autopilot grant). All 11 ADR 0007 § 10 acceptance criteria are implemented + tested. + +**Test count: 468 (v0.1.1) → 544 (v0.2.0).** +76 tests across the Phase 2 arc. + +**Phase 2 release_kit checklist** + +- [x] All 6 D-day deliverables landed on main (D43-A, D43-B ADR draft, D44, D45, D46, D47) +- [x] CI green on every D-day merge commit + on this release commit's head +- [x] Fresh-context opus reviewer on every implementation D-day (D44/D45/D46/D47), maintainer text-review on D43-B ADR +- [x] All 11 ADR 0007 § 10 acceptance criteria (#1–#11) covered by Suite 19/20/21/22 tests +- [x] CHANGELOG "Unreleased" promoted to "## v0.2.0 — 2026-05-25" with D43-A through D47 entries +- [x] `package.json` bumped 0.1.1 → 0.2.0 +- [x] `CLAUDE.md release_kit.phase_rolling_mode`: `current_phase` Phase 2 → Phase 3; `current_pre_release_identifier` `0.2.0-phase2` → `0.3.0-phase3` +- [x] README status header + Implementation Status + Phase plan reflect Phase 2 shipped +- [ ] Tag pushed (next step in this PR's lifecycle) +- [ ] `release.yml` triggered + GitHub Release created (auto on tag push; D37 phase_rolling_mode gate will pass because Unreleased is now sentinel-only) + +**ADR 0007 § 10 acceptance criteria — final ship status** + +| # | Criterion | Covering tests | +|---|---|---| +| 1 | Per-key cache namespace isolation | Suite 20i | +| 2 | Anonymous prod-default off → 401 | Suite 20a | +| 3 | Anonymous dev-mode on → 200 | Suite 20g | +| 4 | Owner-vs-guest `/health` gating | Suite 21a-d | +| 5 | Owner-vs-guest `X-OLP-Fallback-Detail` gating | Suite 21e-h | +| 6 | Post-revoke 401 within next request | Suite 19o + Suite 20e | +| 7 | Manifest atomicity + revoke-dominates-touch | Suite 19y-1..4 | +| 8 | Audit ndjson round-trip + PII guard | Suite 20j + 20j-stream + 20j-401 | +| 9 | Bootstrap keygen surface reproducible | Suite 22 | +| 10 | `OLP_OWNER_TOKEN` env override | Suite 19p + Suite 20f | +| 11 | `providers_enabled` 403 scope enforcement | Suite 20h | + +**Known limitations carried beyond v0.2.0** + +Phase 2 functional scope is complete. The following remain as Phase 3+ deferrals (tracked in `docs/v1x-roadmap.md` + new entries below): + +- **Dashboard (`dashboard.html`)** — owner-only multi-provider quota / fallback / cache-hit-rate panels. Per ADR 0007 § 12 + v0.1 spec § 4.6. Phase 3 mainline. +- **Audit query layer + rotation** — `audit.ndjson` is append-only at v0.2.0; aggregate queries + log rotation deferred to Phase 3 alongside Dashboard. +- **`tried_providers` semantics on `key_no_provider_access` 403** — schema currently reports filter-rejected hops as "tried"; either ADR § 8 amendment (rename / add field) or D46+ semantic fix. Noted by D45 opus reviewer. +- **Per-provider per-key auth artifact mapping** — ADR § 12 explicit out-of-scope. Per-key cache + audit isolation works; per-key per-provider OAuth tokens (e.g., two OLP keys each authenticated to different OpenAI Codex accounts) is Phase 3+ work. +- **SQLite migration (Option 3 hybrid)** — ADR § 13 documents the forward path; trigger is Dashboard / SQL-aggregate-quota / multi-second audit-query workload. Requires engines bump (`>=22.13.0` or `>=23.4.0`) per ADR § 11 as a separate prior PR. + ### D47 — `bin/olp-keys.mjs` keygen CLI (Phase 2 functional scope closes) Fourth Phase 2 implementation D-day. Closes ADR 0007 § 10 acceptance criterion #9 (bootstrap workflow must be reproducible without manual file editing) by shipping a minimal keygen CLI per § 9.1. **Phase 2 functional scope is complete with this D-day** — remaining work is Phase 2 close → v0.2.0 (maintainer-triggered, explicit per CLAUDE.md `release_kit.phase_close_trigger`). diff --git a/CLAUDE.md b/CLAUDE.md index 0d4e597..63298a3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -135,7 +135,7 @@ release_kit: # This overlay is the authoritative source. If Iron Rule 5 appears to be silently # violated (no version bump after many D-day pushes), check this section first # before filing a compliance finding. - current_phase: Phase 2 - current_pre_release_identifier: "0.2.0-phase2" + current_phase: Phase 3 + current_pre_release_identifier: "0.3.0-phase3" phase_close_trigger: explicit maintainer action (not automated) ``` diff --git a/README.md b/README.md index af557a7..b48fa53 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ A personal- and family-scale multi-provider LLM proxy. One HTTP endpoint, many subscriptions behind it, automatic routing, automatic fallback, content-addressed caching — so your IDEs and family clients keep working as long as *any* of your subscriptions has quota left. -> **Status:** v0.1.1 shipped (2026-05-25) — Phase 1 multi-provider proxy core + cleanup. Phase 2 (multi-key auth, `lib/keys.mjs`) is currently in progress per ADR 0007. Sections marked _placeholder_ land alongside the relevant phase of work (see [phase plan](#phase-plan)). +> **Status:** v0.2.0 shipped (2026-05-25) — Phase 1 multi-provider proxy core (v0.1.0 + v0.1.1) + Phase 2 multi-key auth + audit + owner gating + keygen CLI. Phase 3 (Dashboard + audit query layer) is the next milestone. Sections marked _placeholder_ land alongside the relevant phase of work (see [phase plan](#phase-plan)). --- @@ -165,9 +165,9 @@ If a fallback chain is exhausted, `X-OLP-Fallback-Exhausted` lists the tried pro --- -## Implementation status (as of 2026-05-25) +## Implementation status (as of 2026-05-25, post-v0.2.0) -Phase 1 is closed at v0.1.1 (multi-provider proxy core + pre-Phase-2 cleanup). Phase 2 (multi-key auth, `lib/keys.mjs`) is in progress per ADR 0007. This table reflects what is currently shipped vs. what is designed for later phases. +Phase 1 closed at v0.1.1 (multi-provider proxy core + pre-Phase-2 cleanup). Phase 2 closed at v0.2.0 (multi-key auth + audit + owner gating + keygen CLI; ADR 0007 § 10 all 11 acceptance criteria shipped). Phase 3 (Dashboard + audit query layer) is the next milestone. This table reflects what is currently shipped vs. what is designed for later phases. | File / artifact | Status | Notes | |---|---|---| @@ -248,8 +248,8 @@ The original v0.1 spec (in `~/.cc-rules/memory/projects/olp_v0_1_spec.md` on the - **Phase 0** — Repo bootstrap, `ALIGNMENT.md`, founding ADRs, CI workflows, PR template. ✅ Shipped (2026-05-23). - **Phase 1** — Multi-provider proxy core: `server.mjs`, IR, three Tier-D provider plugins (Anthropic / OpenAI Codex / Mistral Vibe), cache (D1+D4) + cleanup (D2 bypass / D3 chunked replay / D23 size cap), fallback engine with first-chunk safety + hard triggers + per-hop log observability, IR↔OpenAI translation under Rule 2(b). ✅ Shipped — v0.1.0 (2026-05-24) + v0.1.1 cleanup (2026-05-25, D35–D42). -- **Phase 2** — Multi-key auth (`lib/keys.mjs`) per ADR 0007: opaque OLP API keys, per-key cache namespacing (the data model already supports this — only the `keyId` source is missing), owner-vs-guest tier for header gating, audit ndjson, owner-only gating for `/health` + `X-OLP-Fallback-Detail` (D40 follow-up). **(current — ADR drafting at D43-B)**. -- **Phase 3** — Dashboard (`dashboard.html`) + audit query layer (deferred from Phase 2). Owner-only multi-provider quota panels, fallback rate, cache hit rate; localhost-bound by default. +- **Phase 2** — Multi-key auth (`lib/keys.mjs`) per ADR 0007: opaque OLP API keys, per-key cache namespacing, owner-vs-guest tier for header gating, audit ndjson (`lib/audit.mjs`), `/health` payload trimming + `X-OLP-Fallback-Detail` emission gating, `OLP_OWNER_TOKEN` env override, keygen CLI (`bin/olp-keys.mjs`). ✅ Shipped — v0.2.0 (2026-05-25, D43-A → D47). All 11 ADR 0007 § 10 acceptance criteria covered. +- **Phase 3** — Dashboard (`dashboard.html`) + audit query layer (deferred from Phase 2). Owner-only multi-provider quota panels, fallback rate, cache hit rate; localhost-bound by default. **(next)**. - **Phase 4+** — v1.x roadmap items as triggered. Full deferred-work tracker: [`docs/v1x-roadmap.md`](./docs/v1x-roadmap.md). Includes streaming-path singleflight ([issue #16](https://github.com/dtzp555-max/olp/issues/16) + ADR 0005 Amendment 8 design ratified), soft-trigger reactivation (ADR 0004 Amendment 2), `/health` activeSpawns integration, provider-level `cacheKeyFields` mask, streaming-path SPAWN_FAILED salvage. - **Phase N (opt-in)** — Tier-2 / Tier-C provider plugins (Grok / Kimi / MiniMax / GLM / Qwen) per [ADR 0006](./docs/adr/0006-provider-inclusion.md); provider-native protocol endpoints; deterministic triggers. Triggered by tier-2 demand, not on the bootstrap path. diff --git a/package.json b/package.json index 23ea5c9..b8786bf 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "olp", - "version": "0.1.1", + "version": "0.2.0", "description": "Personal multi-provider LLM proxy. Successor to OCP. One HTTP endpoint, multiple subscriptions behind it, automatic routing + fallback + caching.", "type": "module", "main": "server.mjs",