113 lines
5.8 KiB
Markdown
113 lines
5.8 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Cloud-wide LLM Provider profiles are durable and validated
|
|
The Cloud Control Plane SHALL persist administrator-managed LLM Provider
|
|
profiles with a unique name, provider type, model, timeout, enabled state,
|
|
revision, and timestamps. A profile's provider type SHALL be either
|
|
`anthropic` or `openai-compatible`; either profile MAY specify an absolute
|
|
HTTP(S) base URL and SHALL use its official provider endpoint when it does not.
|
|
|
|
#### Scenario: Administrator creates an OpenAI-compatible profile
|
|
- **WHEN** an authorized administrator submits a unique profile name,
|
|
`openai-compatible` provider type, model, valid timeout, API key, and an
|
|
optional valid base URL
|
|
- **THEN** the Cloud Control Plane persists an enabled profile with a new
|
|
revision and returns its non-secret metadata
|
|
|
|
#### Scenario: Administrator creates an Anthropic profile with a custom base URL
|
|
- **WHEN** an authorized administrator submits a unique profile name,
|
|
`anthropic` provider type, model, valid timeout, API key, and a valid
|
|
Anthropic-compatible base URL
|
|
- **THEN** the Cloud Control Plane persists the normalized URL with the profile
|
|
and returns its non-secret metadata
|
|
|
|
#### Scenario: Invalid profile configuration is rejected
|
|
- **WHEN** an administrator submits an unsupported provider type, blank model,
|
|
non-positive timeout, duplicate name, or invalid base URL
|
|
- **THEN** the Cloud Control Plane rejects the write without creating or
|
|
changing a profile
|
|
|
|
### Requirement: Provider API keys are encrypted and never disclosed
|
|
The Cloud Control Plane SHALL encrypt Provider API keys before persistence
|
|
using a deployment-held encryption key, and SHALL not expose plaintext keys in
|
|
read responses, validation errors, audit records, or application logs.
|
|
|
|
#### Scenario: Provider profile is listed after creation
|
|
- **WHEN** an authorized administrator lists Provider profiles after creating
|
|
one with an API key
|
|
- **THEN** every response reports only key-presence and rotation metadata and
|
|
does not contain the submitted API key or its ciphertext
|
|
|
|
#### Scenario: Encryption configuration is unavailable
|
|
- **WHEN** a database-managed profile is created, rotated, activated, or
|
|
resolved without a valid deployment encryption key
|
|
- **THEN** the operation fails with a controlled configuration error that does
|
|
not reveal an API key
|
|
|
|
### Requirement: Administrators can manage and activate Provider profiles
|
|
The Cloud Control Plane SHALL expose session-CSRF-protected and scope-guarded
|
|
operations to list, create, update, rotate a key, enable, disable, activate,
|
|
and delete inactive LLM Provider profiles. Mutating operations SHALL require
|
|
the `llm-providers:admin` scope and record a non-secret audit event.
|
|
|
|
#### Scenario: Non-administrator attempts to modify a profile
|
|
- **WHEN** a principal without `llm-providers:admin` invokes a Provider
|
|
mutation endpoint
|
|
- **THEN** the Cloud Control Plane rejects the request before decrypting or
|
|
modifying a Provider credential
|
|
|
|
#### Scenario: Administrator switches the active profile
|
|
- **WHEN** an authorized administrator activates an enabled profile
|
|
- **THEN** the Cloud Control Plane atomically selects that profile as the one
|
|
Cloud-wide active profile and records the activation without retaining an
|
|
API key in the audit event
|
|
|
|
#### Scenario: Administrator attempts to retire the active profile
|
|
- **WHEN** an administrator attempts to disable or delete the active profile
|
|
before activating a replacement
|
|
- **THEN** the Cloud Control Plane rejects the operation and preserves the
|
|
active profile selection
|
|
|
|
### Requirement: Activation dynamically selects one Provider for cloud transport
|
|
The Cloud Control Plane SHALL resolve the active database-managed profile for
|
|
each Cloud planner decision and SHALL apply an activation to subsequent
|
|
requests without requiring a Cloud API restart or any Host Agent
|
|
reconfiguration.
|
|
|
|
#### Scenario: A Host requests a decision after a model switch
|
|
- **WHEN** an administrator activates a different enabled profile and a
|
|
cloud-transport Host Agent submits its next planner-decision request
|
|
- **THEN** the Cloud Control Plane calls that profile's provider, model,
|
|
timeout, base URL, and API key while the Host Agent continues using the same
|
|
Cloud Control Plane endpoint
|
|
|
|
#### Scenario: Active OpenAI-compatible profile is used
|
|
- **WHEN** the active profile is OpenAI-compatible and includes a base URL
|
|
- **THEN** the Cloud Control Plane makes the existing OpenAI Chat Completions
|
|
tool-calling request to that base URL using the profile's decrypted API key
|
|
and returns the resulting single tool-call decision
|
|
|
|
#### Scenario: Active Anthropic profile is used with a custom base URL
|
|
- **WHEN** the active profile is Anthropic and includes a base URL
|
|
- **THEN** the Cloud Control Plane makes the existing Anthropic native
|
|
tool-calling request to that base URL using the profile's decrypted API key
|
|
and returns the resulting single tool-call decision
|
|
|
|
### Requirement: Cloud planner Provider configuration is database-only
|
|
The Cloud Control Plane SHALL resolve Cloud planner Provider, model, timeout,
|
|
base URL, and API key from the active database profile and SHALL NOT read
|
|
planner Provider/model/timeout or Provider API-key environment variables.
|
|
When no usable active profile exists, it SHALL fail a planner request with a
|
|
structured unavailable response.
|
|
|
|
#### Scenario: Active profile is unavailable
|
|
- **WHEN** the active database Provider profile is missing, disabled, or
|
|
cannot be decrypted
|
|
- **THEN** the planner decision fails without invoking a legacy
|
|
environment-configured Provider
|
|
|
|
#### Scenario: Legacy environment variables are present
|
|
- **WHEN** the Cloud API process has legacy planner Provider or API-key
|
|
environment variables but an active database profile exists
|
|
- **THEN** the planner decision uses only the active database profile
|