Stochastic review round 4: the data-residency false guarantee, closed for real

2026-08-28

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: [ "POST /v1/completions (route.dataPolicy enforced, not vacuous)", "POST /v1/providers (live key validation)", "GET /v1/explain/{id} (auto-exhausted + MCP-routed requests)", "GET /v1/observability (permission granted)", "GET /v1/usage/by-owner (tenant-only headline)", ] sdk_methods_updated: ["none — no contract signature drift (gen:contract --emit=all: openapi/SDK stable)"] mcp_tools_updated: ["br_route_completion (persists decision to explain store; not-found recovery envelope)"] ---

What We Built

Round 4 of the 2026-08-28 review (round-3 mean 7.5, anchored at 4 by a false-guarantee hard-cap). Closes 11 residuals; the headline is a governance correctness bug that a product selling data-residency guarantees must never ship.

The route.dataPolicy:"zero" FALSE GUARANTEE — closed (data-protection, was 4). route.dataPolicy (routing axis) and data_protection.* (requirement axis) are separate. A caller sending route.dataPolicy:"zero" with NO data_protection block left the resolved requirement EMPTY, so checkEndpointEligibility short-circuited to eligible:true ("nothing to check") and factsEligible() admitted an unattested endpoint — 200 served on unattested DeepSeek under x-br-data-policy: policy=zero with enforced:false. The fix threads the routing-axis policy into the eligibility check (composeRouteDataPolicy): "zero" tightens the requirement to retentionMaxDays:0 (never loosens a declared bound), "no-training" adds the training prohibition. A composed requirement can no longer pass vacuously, so an unattested endpoint fails closed unless a genuine tenant ProcessorFact or an operator-static-zero endpoint attests the dimension. Threaded at both the selection filter (checkEndpointConstraints) and the B3 boundary (assertEndpointEligible). The prior stub-based unit test never caught this because it stubbed the closure; the new test exercises the REAL binding end to end.

Failed & MCP-routed requests are explainable (agent-consumer 6, router-scientist 8). Two explain-loop gaps, both closed at the source:

• br_route_completion minted a req_ id but never persisted the decision, so

/v1/explain 404'd. It now writes the usage_events row through the SAME recordUsageEvent the REST path uses, keyed by the returned id; the MCP not-found result carries a machine-parseable recovery envelope.

• An auto-routing-exhausted 503 dropped its pre-failure detail. Producer half:

ModelRouterError/ModelUnavailableError now re-attach the selector's routingStages (mirroring ModelRouterBudgetError), so err.routingStages recovers the scored auto_select candidates + complexity. Consumer half: a handler-captured pre-dispatch snapshot remains the fallback for CascadeExhaustedError (which carries only tierErrors). Neither fabricates.

Provider keys are validated, not assumed (api-integrator). POST /v1/providers live-probes the key: status:"active" ONLY on a strict pass (2xx / the Anthropic OPTIONS-405-no-note case), 400 (key not stored) on a hard auth failure with a machine-actionable body, honest status:"unvalidated" for a weak pass or an unreachable provider (retryable flag distinguishes them), and a default-on probe with a validate:false opt-out that still never reports "active" unprobed.

Truthful ops & cost (platform-sre, claim-auditor, cost-owner). observability.read/observability.write were in no role — GET /v1/observability 403'd for everyone; now granted to admin/operator (read also developer/auditor), and the RBAC drift-invariant test that was red for this route is green. X-BR-Budget-Remaining already emits for per-key and tenant budgets; the llms.txt claim is now conditional (honest about the truly-unmetered default plan where remaining spend is undefined). GET /v1/usage/by-owner now reports a tenant-only headline with platform overhead in its own labeled bucket, matching summary.

Dashboard (dashboard-user 7). The sidebar nav is now the sole scroll container (outer clipped, footer pinned) so the Settings link is reachable at ≤768px heights; GET /auth/security/owasp-coverage is implemented as the JWT mirror the Compliance view calls (console error gone); the fabricated "Policy enforcement" table is replaced with real getGovernanceSummary data + an honest empty-state; and the /auth/events credentialed preflight echoes the allowlisted Origin instead of *.

Verification

• pnpm build green (675 routes, 40 models / 9 providers / 120 MCP tools; llms.txt
• llms-full + openapi + static-assets embed regenerated), pnpm tsgo exit 0,

oxlint --type-aware 0/0, oxfmt --check clean, dashboard tsc --noEmit exit 0.

• 233 unit tests across the round-4 touched files pass (data-protection 36,

model-strategy 26, model-router incl. producer test, classify-dispatch-failure 15, mcp-adapters/routing, providers-register 7, rbac + invariants, usage-queries, budget, mcp/server 29).

• gen:contract --emit=all: NO openapi/SDK signature drift — the changes are

behavioral within existing schemas, so the TS/Python SDK surfaces are unchanged.

• Round 5 review runs against the deployed build; scores land in

docs/reviews/2026-08-28/ledger.json.

Known residuals (round 5)

• GET /v1/providers list still hard-codes status:"active" per row — a stored

"unvalidated" key would list as active. Surface the real per-key status.

• Attestation cosign self-verify (ECR 401) persists — status stays honestly

signed_unverified; a real in-process verify path is infra work.

• External blocker — Python SDK 0.1.2 verified locally but PyPI serves broken

0.1.0; PYPI_TOKEN invalid. Caps api-integrator until the operator refreshes it.

Lockstep Checklist

• [x] API Routes: data-policy enforcement, provider validation, explain

(auto-exhausted producer + MCP persistence), observability permission, usage by-owner.

• [x] TS/Python SDK: no contract drift (gen:contract confirmed stable); Python publish still token-blocked.
• [x] MCP: br_route_completion persists its decision + recovery envelope; tool count 120 unchanged.
• [x] Docs/OpenAPI: regenerated (openapi + llms + llms-full 675 routes + static-assets embed).