AI Provider Settings Runtime Proof

This proof covers only the AI-owned non-secret provider runtime selection. It does not add a public Gateway route, invoke a live provider, or move quota or wallet ownership out of usage-service and wallet-service.

Contract

• provider_settings is owned by ai-classifier-service and has one active default feature selection.
• The selection may contain provider, model, base URL, and an allowlisted secret environment-variable reference. It never contains a raw provider API key.
• On startup, an enabled default row wins over environment provider/model/base URL defaults. Missing or disabled rows preserve the environment fallback.
• GET and PUT /v1/admin/ai/providers/settings are internal owner APIs and require an ADMIN actor. A write validates the provider configuration before persistence and swaps the active runtime only after that validation.
• GET /v1/ai/providers/status reports configurationSource=environment|database and only the boolean apiKeyConfigured; it does not expose a secret.

Focused Verification

make test-ai-provider-settings

AI_GENERATION_SETTLEMENT_LOCAL_POSTGRES_CONFIRM=local-postgres \
  make test-ai-generation-settlement-local-postgres

The focused Go target proves non-admin writes are rejected, an allowed secret reference can resolve only from its documented environment variable, raw secret content is absent from responses, and the in-memory owner store persists only the non-secret selection fields.

The local PostgreSQL runner creates a fresh initdb cluster under /tmp, applies current AI/Usage/Wallet migrations, inserts only a disposable mock default selection, updates it through the native ADMIN owner endpoint, and starts the current AI binary twice. It saves provider-runtime-initial.json, provider-setting-update.json, and provider-runtime-after-restart.json; they must report configurationSource=database, provider mock, and apiKeyConfigured=false. The initial model is database-selected-mock-v1; the persisted update and the restarted binary must use database-selected-mock-v2. Its separate settlement assertions remain scoped to the same fresh databases and loopback processes.

Current Isolated Run (2026-07-15 ICT)

AI_GENERATION_SETTLEMENT_LOCAL_POSTGRES_CONFIRM=local-postgres make test-ai-generation-settlement-local-postgres passed with artifact output/qa/ai-generation-settlement-local-postgres-20260714-191927/ (the artifact timestamp is UTC). provider-setting-seed.txt recorded default:mock:database-selected-mock-v1:true; the native ADMIN endpoint then persisted default:mock:database-selected-mock-v2:true:provider-settings-proof. The initial status recorded model database-selected-mock-v1; the update and post-restart status recorded status=ok, configurationSource=database, provider mock, model database-selected-mock-v2, and apiKeyConfigured=false. The same isolated run retained the settlement boundary evidence: 1:true:0 before restart, 1:false:1 after restart, four preflight checks, eight consumes, and no configured local, Docker, or legacy database.

This is local, mock-provider, isolated owner-runtime evidence. It is not proof of a configured live provider secret, provider-network call, browser behavior, deployed target, Gateway rollback, or default-route promotion.