# AETERNA OpenAI Web Launch Checkpoint

October 7 2026

AETERNA has a substantial implemented domain architecture, but this source state is not ready for public production use. OpenAI text chat has been added and verified with simulated provider responses. No live OpenAI call, cloud authentication, production database check, image build, or deployment was performed. The API key has not been requested or stored.

## Sources and authority

The three supplied documents were read: AETERNA The Living Architecture copy.docx, Aterna version 1.0.txt, and Build the damn thing.txt. They describe an earlier organism/research architecture and an earlier Google-native implementation proposal. The October 1 AETERNA-3.0-main.zip supplies the implementation examined here. The repository's docs/00_AETERNA_3_SOURCE_OF_TRUTH.md identifies AETERNA 3.0 as active authority and earlier versions as historical reference. This checkpoint does not establish that the archive equals the current GitHub or AI Studio head.

Original archive SHA-256: 0d1326a0f1a56b04f49ba0b4fcfcf412a85842df034f21577167e371e30d736e

Original archive server.ts SHA-256: 0732828709e5fd71a3d46e3b6118e34e7a711c75291b23af60d755deed5aed04

The September 7 database alignment checkpoint quotes a different server.ts hash, 3d0e25e9772232c8b0ffe284fbe1eb2d16185fb41737891f94f834cdd088c547. Therefore its frozen receipt cannot ratify this later archive by itself. No historical hashes were reconstructed.

## Verified implementation and changes

| Area | Status and evidence |
| --- | --- |
| OpenAI model adapter | Added server-only Responses transport at the fixed api.openai.com endpoint, a text-chat ModelProvider, server-selected model, bounded output, store:false, safe provider failures, and no automatic retry. Model outputs remain MODEL_OUTPUT with all truth/authority/action flags false. |
| Execution gate | /api/openai/chat uses the existing identity, delegation, signature and replay path with distinct model:openai resource. A Gemini capability cannot authorize OpenAI. |
| PHOENIX | Mandatory precommit and terminal audit surround provider invocation. Added storage-adapter tests and corrected undefined optional field persistence, head-document exclusion, corrupt-head validation, sequence gaps and tip mismatch detection. Precommit outage prevents execution; terminal outage returns failure/uncertainty, never successful output. Cloud durability/retention remains unverified. |
| Browser chat | Automatically requests a fresh permission through /api/authority/openai-chat and submits it to /api/openai/chat with the same signed-in identity. Removed the token drawer and session capability reuse. Operational notices stay out of model context; save failure does not misreport model failure. Account changes clear the thread and suppress stale replies. |
| Authority policies and service | Added openai-chat as a distinct server-controlled template requiring established identity and exact administrative entitlement. Packaged a separate issuer process, with bounded HTTP requests, a private Ed25519 key and no model imports. The gateway only relays; it does not sign or create grants. Local end-to-end tests use the real domain issuer, signature verifier and PHOENIX pipeline. |
| Usage gate | Production defaults to the named Firestore budget adapter. User/global UTC daily attempt counts and single-use reservation receipt commit in one transaction. Tested contention, reconstructed instances, rollover, corrupt counts and outages with transactional fixtures. Defaults: 5 attempts per user and 20 globally per day; call limits are not dollar budgets. |
| Production defaults | Unconfigured durable discernment stores, research acquisition and deliberation invoker no longer silently select test-style implementations in production. Cloud Run identity uses the production verifier even without NODE_ENV explicitly set. Production issuer/budget/ledger paths reject emulator configuration. Live IAM remains unverified. |
| Web packaging | Added Dockerfile.web and Dockerfile.authority; existing Dockerfile still packages only the trusted replay runtime. Backend bundles/source maps are no longer served as static web assets. Main server honors PORT and bounded shutdown. Image retrieval, container execution and live lifecycle checks remain unverified. |
| Dependencies and checks | Repaired stale npm lockfile within existing package ranges. Node server tests use the declared tsx loader because existing extensionless TypeScript imports prevent plain node --test from loading the full gateway. No new SDK dependency was required for OpenAI. |

The existing charter identifies AETHER as the research subsystem. It is not renamed into the authority issuer. SENTINEL retains capability enforcement. The model fabric's documented flow does not by itself prove every stage runs for ordinary chat: this route carries evidence references and marks responses unverified, but it does not implement a new research verification engine or execute a council before every chat turn.

## Validation

| Check | Result |
| --- | --- |
| npm run test:server | 207 passed, 0 failed, 1 skipped, 208 total |
| npx vitest run | 52 files passed; 1099 tests passed, 0 failed, 1 skipped, 1100 total |
| npm run lint | Type checking passed |
| npm run build and npm run build:authority | UI, bundled Node gateway and isolated issuer passed |
| Launch tests | 26 targeted tests pass across OpenAI chat, automatic authorization, atomic budgets, PHOENIX Firestore adapter and frontend asset isolation. No duplicate test registration is included in this count. |
| Bundle isolation checks | No OPENAI_API_KEY, issuer private-key variable or test secret marker in browser assets; issuer build metadata contains no model-fabric/OpenAI/Gemini input modules |
| Live API, Firestore and container checks | Not performed; the skipped integration tests do not establish production readiness |
| Browser preview | Attempt blocked by local tsx IPC socket permission error; no layout, login or phone-browser signoff claimed |

The production frontend bundle is approximately 1.1 MB before compression and triggers Vite's large-chunk warning. Browser usability and live provider behavior have not been ratified in this session. No available Google Cloud deployment connector, authenticated gcloud CLI or Docker runtime was found. See docs/19_OPENAI_PRODUCTION_RUNBOOK.md for exact service separation, configuration and live verification prerequisites.

## Remaining launch work

1. Establish current source head against the recovered October 1 archive before merging into an active remote build.
2. Obtain authenticated cloud access and inspect the existing project before mutations. Deploy the packaged isolated Sentinel issuer with named Firestore, exact entitlements and a production Ed25519 signing authority. Keep private signing material out of the gateway.
3. Configure the gateway's issuer origin, workload identity invocation permission and matching public verification key. Automatic browser acquisition is implemented and locally tested; live service-to-service IAM remains unverified.
4. Verify the implemented atomic budget gate against real Firestore. Choose spending limits and the admission policy: explicit beta enrollment or a separately reviewed public-enrollment mechanism. Sign-in alone does not grant model access. No automatic public grant policy was added.
5. Verify IAM, actual reachability, named database alignment, production replay transactions, and PHOENIX durability. Complete durable VERITAS/discernment/MNEMOSYNE wiring for any features advertised as persistent. Process-local tests and hash chains are not evidence of tamper-proof cloud retention.
6. Wire real production deliberation and evidence acquisition before enabling those endpoints. Historical deterministic providers remain test/research fixtures.
7. Preserve the existing Node/Cloud Run and Firestore deployment architecture unless a hosting migration is explicitly chosen. Sites hosts Cloudflare Workers and cannot directly execute this Express, Node WebSocket and Firestore-gRPC gateway. The existing AETERNA Site has version 0 and no live URL. Its source-opening attempt failed; no Site was deployed.
8. Supply the OpenAI key through a secure hosted secret configuration only after the production path is ready, then perform a bounded live smoke test. The backend default is gpt-5.4-mini and can be changed through OPENAI_MODEL; actual key/model access has not been verified.
9. Test phone layout, login, capability acquisition, one successful response, replay rejection, missing identity, audit outage, budget exhaustion, and restart persistence against the deployed system before public release.

Visitors will use AETERNA's own authentication and the owner's server-side API access; the design does not require a ChatGPT subscription from visitors. API usage must be funded by the owner. OpenAI text chat is implemented here. Gemini and other providers are reserved for later. ENABLE_ALTERNATE_PROVIDERS defaults to false. Their HTTP routes and live WebSocket are denied, and their interface controls are hidden. Existing provider adapters are retained. Legacy voice, maps and transcription have not been migrated to OpenAI. Firestore/Firebase remain storage and identity infrastructure, independent of the AI-provider choice.

Official API references used for implementation:
- https://developers.openai.com/api/reference/overview
- https://developers.openai.com/api/docs/quickstart
- https://developers.openai.com/api/docs/models/gpt-5.4-mini

## Saved source state

The accompanying source archive contains the changed code, this checkpoint, exact test/build logs, original-to-current changes.patch, and SHA256SUMS.txt for every included source file. It excludes dependencies, generated build output and credentials. The original uploaded archive and source documents were not overwritten. This is a tested development checkpoint, not a production ratification or deployment receipt.