Round-2 remediation Wave 1 — BYOK honesty, cache-governance, tenant-scoped intelligence, honest self-description, live MCP agent tools

2026-08-09

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: [ "POST /v1/chat/completions", "GET /v1/self", "GET /v1/intelligence/savings", "POST /v1/grants", "none", ] sdk_methods_updated: [ "baseURL default now targets /v1 (TS + Py, v0.1.2)", "additive response fields (SavingsSummary.scope/tenant_id, Self.capabilities.ungranted) — types follow-up", ] mcp_tools_updated: [ "br_bootstrap_agent", "br_agent_status", "br_agent_limits", "br_agent_anomaly", "unwired stubs now return isError:true across 54 handlers", ] ---

What We Built

Wave 1 of the Round-2 stochastic-review remediation: five defects, each found independently by multiple reviewer personas, fixed and verified against the full unit suite (9592 passing, 0 failing) with revert-the-fix tests for every change.

1. BYOK-cascade no longer lies. An explicit provider-pinned request (e.g.

anthropic/claude-opus-4-7) on a tenant with no matching credential used to be silently served by OpenAI while the response still carried x-br-model-contract: strict. It now fails closed with a typed byok_required 403 naming the provider and the remedy (POST /v1/providers), unless the caller opted into fallback (route.allowFallback:true or model:auto). When substitution is permitted it is disclosed (X-BR-Model-Substituted, x-br-model-contract: flexible), and the routing stage is honestly labeled byok_cascade. Closes the contradiction with 2026-08-05-routing-constraints-are-inviolable.md.

1. The prompt cache can no longer bypass governance. Cache hits used to return billable-shaped

200s with no audit row, no evidence artifact, invisibility in /v1/usage, and — worst — they defeated the ZDR gate (a pre-warmed prompt let provider.zdr:true return 200 instead of refusing). All data-policy/ZDR gates now run before the cache lookup, and a cache hit emits a completion_audit row (cache_hit, linked to the producing request via the new prompt_cache.request_id column, migration v67) plus a zero-cost is_cached usage row, and is retrievable as a governance artifact.

1. route.dataPolicy is enforced. It was silently discarded, so unknown retention satisfied a

"zero" demand. It is now threaded into routing preferences and validated (invalid_data_policy 400 on bad enums); the existing fail-closed gate is reachable. The BR-namespace data_protection field is stripped before provider passthrough (it was being forwarded verbatim, causing upstream 400s that even tripped the circuit breaker).

1. Intelligence is tenant-scoped. /v1/intelligence/savings returned fleet-wide aggregates to

any tenant key; it now scopes to the caller (scope:"tenant", tenant_id), returns an explicit low-data state when the Postgres usage store is absent instead of the global in-memory buffer, and the doubled provider prefix (deepseek/deepseek/deepseek-chat) is canonicalized. /rankings and /benchmark stay fleet-wide but are now explicitly labeled scope:"fleet".

1. Self-description is honest, and MCP agent tools work. GET /v1/self no longer advertises

grants.* as granted when the grants feature is disabled (it now lists them under capabilities.ungranted via the same evaluator the routes use), and the grants write routes gate before schema validation so read and write fail identically. Four MCP tools (br_bootstrap_agent, br_agent_status, br_agent_limits, br_agent_anomaly) that returned an "unwired" stub as a JSON-RPC success are now wired to the same core the REST routes use; and every unwired stub across 54 handlers now returns isError:true so a machine can never mistake one for a result.

Plus a developer-facing fix: both SDKs' default baseURL now targets /v1 (v0.1.2), so the documented client.chat.completions.create() quickstart no longer 405s on a new developer's first line. (npm/PyPI publish pending owner consent.)

Why It Matters

Round 2 scored the platform an audited mean of 5.4 precisely because its narrative surfaces (routing contract, cost/optimisation, self-description, MCP manifest) claimed more than the build delivered, while the evidence core was genuinely excellent. Wave 1 closes that gap on the highest- leverage surfaces: it makes the platform tell the truth about what it routed, what it cached, what it charged, and what it can do — which is the entire thesis of an "authorization & evidence plane."

How It Works

Every fix ships with a revert-the-fix test that fails against the pre-change behavior. The completions-path changes gate on a new pure evaluatePreCacheDataPolicy chokepoint shared between the handler and the cache middleware, so the two can never diverge. The MCP fix extracts a transport-neutral bootstrapAgentCore so REST and MCP execute the identical create path.

The Numbers

• 5 systemic/capping defects closed; 8 of 10 personas targeted.
• Unit suite: 9592 passing / 0 failing / 212 skipped (baseline 9219). pnpm tsgo clean.
• DB migration v67 (prompt_cache.request_id).

Competitive Edge

Portkey/OpenRouter ship controls; none of them re-audit their own runtime with adversarial personas and then fix the exact lies those personas found. This wave is that loop closing once.

Lockstep Checklist

• [x] API Routes: src/api/routes/completions/ + capabilities updated. No route add/remove/method change (no routes.json contract change).
• [x] TS SDK: packages/sdk-ts baseURL fix (v0.1.2). Additive response-field types (SavingsSummary.scope/tenant_id, Self.capabilities.ungranted) tracked as follow-up.
• [x] Python SDK: packages/sdk-py baseURL fix (v0.1.2). Same additive-type follow-up.
• [x] MCP Schemas: four agent tools wired; requiredDep manifest metadata added; stub sweep across handlers.
• [x] Master Record: no new capability; defects tracked in docs/reviews/2026-08-08/ledger.json.

Follow-ups (not blocking this deploy): SDK additive response-type fields + npm/PyPI publish (owner consent); write-side model-key canonicalization in usage-aggregation.ts. Wave 2 (router reliability, cost truthfulness, platform-sre alerting, dashboard UX) is architected and queued.