fix(runtime): resolve authenticated Sol 401 and missing Azure models after gateway recovery #262

Activity

1. github-actions

   closed this as not plannedon Sep 19, 2026
2. github-actions commented on Sep 19, 2026

   

   github-actionsBot

   on Sep 19, 2026 – with GitHub Actions

   Last edited by github-actions

   Contributor

   More actions

   _{Automated translation bookkeeping — detected language: unknown.}
3. github-actions commented on Sep 19, 2026

   

   github-actionsBot

   on Sep 19, 2026 – with GitHub Actions

   Contributor

   More actions

   Issue closed: use an issue template

   Thanks for taking the time to submit this issue. It was closed automatically because it was not opened with a recognized issue template (Bug report, Feature request, Documentation, or Provider compatibility). Freeform and API-opened issues cannot skip this check.

   • This issue does not use a recognized issue template.

   Please edit the issue to add:

   • Open a new issue with the Bug report, Feature request, Documentation, or Provider compatibility template.
   • Or edit this issue so the body uses the template section headings for the kind of report you are filing.

   See the README for details.

   Once the report passes the automated checks, it will be reopened automatically unless a maintainer has changed its state.
4. ChefGroep commented on Sep 19, 2026

   

   OnlineChef (ChefGroep)

   on Sep 19, 2026 – with ChatGPT Codex Connector

   ContributorAuthor

   More actions

   Execution evidence, 2026-09-20 around 00:10 Europe/Amsterdam (read-only except bounded Azure inference):

   1. Existing bc-scan-2 OCX v1.4.2 remains healthy. AWS relay /healthz 200, dedicated service-token /v1/models 200, public/unauthenticated data and management routes 401. AWS OCX runner active. No production cutover performed.
   2. Authenticated management /api/providers shows exactly one configured provider, openai (openai-responses, authMode=forward, host chatgpt.com, hasApiKey=false); /api/config lists only openai. No Azure provider is wired. The observed Sol 401 must not be called an Azure failure. Forward mode expects caller upstream credentials; the bare gateway service-token smoke did not establish such a credential. See src/adapters/openai-responses.ts and its FORWARD_HEADERS allowlist.
   3. The logged-in Azure subscription on joep has three AI resources. openaichef-se (Sweden): grok-4-6, DeepSeek-V4-1-Flash; openaichef (East US): grok-4-6, DeepSeek-V4-1-Flash, DeepSeek-V4-Pro, DeepSeek-V4-Pro-dz; azure-foundry-us has no deployments. Azure ARM lists all six with provisioning Succeeded; no Astra/Sol Azure deployment on this subscription.
   4. Actual data-plane verification using az rest --resource https://ai.azure.com with cached Entra auth, no keys printed: Sweden grok-4-6 Responses completed; East US grok-4-6 Responses completed; East US DeepSeek-V4-Pro and DeepSeek-V4-Pro-dz chat completions each returned one choice. Sweden and East US DeepSeek-V4-1-Flash both returned unknown_model (backend reports DeepSeek-V4.1-Flash), despite ARM Succeeded. Mark Flash unavailable until its backend discrepancy is resolved.
   5. Existing local 0600 env files on joep have key material but contain stale deployment names (gpt-4.1-mini, not deployed on these resources) and an older jort-7512-resource account not shown in the active subscription. Do not copy them blindly or push values to Git. The Azure adapter currently requires a nonempty provider apiKey, uses api-key header and disallows forward mode. Attempts to execute token-bearing diagnostic requests through remote tooling were blocked by its safety controls; no secret was exported, rotated, or inserted into the live OCX config.

   Next executable gate: use approved file-backed ChefVault delivery or another authorized secret injection for an actual resource key, create Azure provider(s) at real https://<resource>.services.ai.azure.com/openai/v1 endpoints with tested deployment aliases only, then verify /v1/responses through OCX. Native openai forward must be tested with a legitimate Codex caller's upstream Authorization separately, not with an OCX service token alone. Hold Flash, 1.5.0 release, DNS and OIDC cutover until exact-head tests and runtime inference are proven.