Preserve fail-closed LLM gateway admission evidence behind contextual-orchestrator

[seonghobae]

Problem and authority boundary

Wardnet must preserve fail-closed credential/admission, framing, header-minimization and streaming security behavior at its LLM-facing gateway seam without becoming the model/provider-routing authority.

contextual-orchestrator (CO) is the canonical owner of production LLM provider/model discovery, routing/fallback, concrete model selection, provider credentials and provider-specific transport differences. Wardnet must not own a LiteLLM deployment surface, virtual-key authority, provider/model/group selector, provider credential registry, or direct paid-provider fallback.

Wardnet remains responsible for the gateway/security-control side of the seam: fail-closed admission of the request/credential class required by a released CO contract, bounded request/framing validation, header minimization, security evidence, credential non-disclosure, safe streaming relay where Wardnet actually proxies a released CO interface, and denial before upstream work when Wardnet policy fails.

Current preservation lane — 2026-09-05

PR #88 remains open at exact 98a935e4b058d0500d520425b8ebf6ff4106aa1b and GitHub now correctly records it as Draft. It is non-mergeable by architecture in its current direct-LiteLLM shape and remains a preservation lane rather than the production integration vehicle.

Fresh contextual-orchestrator GitHub Release inventory is still empty. Wardnet therefore has no immutable compatible CO API/client/schema Agent to pin. A mutable CO branch/head, sibling checkout, direct provider SDK, or copied routing implementation is not an acceptable substitute.

Do not close #88 merely because its architecture is superseded. Preserve and later transfer every still-valid Wardnet-owned delta, test, fixture, security rationale and hostile proof before a successor retires it.

Evidence that must survive reconstruction

• bounded Authorization/request credential grammar and fail-closed missing/duplicate/wrong-scheme/malformed/non-ASCII/oversized handling;
• zero-upstream-hit negative tests for invalid credential classes;
• no submitted credential or masked fragment in errors/events/audit/support/telemetry;
• narrow request-header forwarding with cookies, management credentials, forwarding/proxy, host, framing and unrelated trace baggage stripped;
• redirects and ambient proxies disabled where Wardnet owns the HTTP boundary;
• request path/query/method and bounded-body preservation required by the released upstream contract;
• streaming response relay without whole-response buffering;
• safe correlation/rate-limit metadata only when the released upstream contract permits it;
• stable property tests and fuzz coverage for the same untrusted credential/request grammar;
• existing non-LLM Wardnet route behavior remains unchanged.

Historical LiteLLM/provider-specific implementation details are preservation evidence only. They do not become current architecture authority.

Replacement contract after CO release

When contextual-orchestrator publishes an immutable compatible release, reconstruct the Wardnet consumer slice from fresh protected Wardnet main through an Anti-Corruption Layer.

1. Consume only the released CO API/client/schema Agent and bind exact version/digest/provenance.
2. Remove direct LiteLLM/provider/model/group/paid-fallback authority from Wardnet.
3. Keep model/provider selection absent from Wardnet-owned domain/API state unless CO exposes an opaque capability/request field that grants no provider authority.
4. Fail closed when the required CO release/schema/capability/provenance is absent, stale, malformed, incompatible or unverifiable.
5. Transfer the Wardnet-owned security regressions above against the actual released CO boundary and prove zero direct provider/LiteLLM calls from Wardnet.
6. Keep GitHub Actions model-backed use on the organization-owned orchestrator/free gateway contract only; no provider/model/group/paid fallback pin belongs in Wardnet.
7. Update the Wardnet Context Map/ADR/SECURITY/THREAT_MODEL/TRACEABILITY/CHANGELOG and the sole product-gap writer with released-contract evidence rather than mutable source claims.
8. Reacquire every exact-current-head CI/security/coverage/package/SBOM/provenance/review/thread/governance gate after reconstruction. draft(architecture): preserve credential-guard evidence pending CO release #88 predecessor evidence does not transfer.

Explicit non-goals

• Wardnet does not authenticate provider virtual-key existence, revocation, budget, team or model scope.
• Wardnet does not manufacture or repair a provider credential.
• Wardnet does not choose a concrete model/provider or silently fall back to a paid provider.
• Wardnet does not embed contextual-orchestrator or copy its routing implementation.
• This issue does not weaken non-LLM gateway authentication or generic request-security controls.

Completion gate

Close only after an immutable compatible CO release exists and a protected-main Wardnet successor consumes it through a versioned ACL with every still-valid #88 Wardnet-owned security delta demonstrably transferred or specifically proven obsolete. The successor must have one unchanged exact head with terminal repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence. No mutable foreign dependency, self/model approval, routine bypass, force push, gate weakening or predecessor-evidence reuse.

[seonghobae]

2026-09-04 canonical-owner revalidation: contextual-orchestrator still publishes zero GitHub Releases. Its release mechanism remains Draft contextual-orchestrator#1030@a304d74d9d7396fcefd50d779b43c888d29de314, based on main@212ff437dc297613289dba2e6064ade9942e07d8; #1030 itself states prerequisite #995 is unmerged, exact-head hosted gates are not terminal, one valid review finding remains intentionally unresolved, and no real release has been cut. Wardnet #89 therefore remains a preservation/reconstruction gate only: do not pin a mutable CO branch, restore direct LiteLLM/provider/model authority, or transfer #88 predecessor evidence. GREEN starts only after an immutable compatible CO API/client/schema Agent release exists; Wardnet must then reconstruct its fail-closed credential/header/streaming ACL against that exact release and reacquire exact-head evidence.