[WRONG BRANCH] fix(reasoning): scope learned reasoning-effort refusals to credential identity

[luvs01]

Motivation

• Prevent learned upstream refusals from one credential or configured provider entry from silently downgrading other credentials that share the same destination.
• Keep the persisted refusal cache non-secret while making learned facts credential-scoped and expiring legacy destination-wide rows.

Description

• Bind learned refusals to a one-way digest of the active API key by adding credentialIdentity() and including the digest in the support cache key, serialised as a JSON array key; no raw credentials are persisted (src/providers/reasoning-metadata.ts).
• Advance the persisted support snapshot format to version: 2 and deliberately ignore legacy version: 1 destination-wide rows on load so prior global refusals do not survive the upgrade (src/providers/reasoning-metadata.ts).
• Update downgrade/filtering logic to consult the credential-scoped key and to refuse to record/consume entries for providers without a key-auth identity (src/providers/reasoning-metadata.ts).
• Add regression tests that verify credential isolation and legacy-cache invalidation and adapt the existing tests to the new format (tests/codex-integration/reasoning-metadata.test.ts).
• Document the behaviour in structure docs to record the contract change (structure/runtime.md, structure/subagents.md, structure/transports/inventory.md, structure/providers/xai-grok.md).

Testing

• Ran focused unit tests: bun test tests/codex-integration/reasoning-metadata.test.ts and it passed (18 tests, 0 failures).
• Ran bun run typecheck, bun run structure:check, and bun run privacy:scan and they all succeeded.
• Attempted the targeted responses recovery test bun test tests/responses/responses-reasoning-effort-downgrade.test.ts but the local environment used Bun 1.2.14 which lacks the node:zlib export zstdDecompressSync; that prevented the focused responses test from running here (upstream CI uses Bun 1.4.2).
• Ran the full suite (bun run test) in this environment and it exercised many tests but exited nonzero due to unrelated environment/concurrency fixture issues; those failures are orthogonal to this change and were observed only under the local runner constraints.

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T01:59:04.094030Z	fa57dc0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1a8d5a30-2d95-4ce7-a681-a3d73f1f3837

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa57dc02d1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve key references before hashing the credential

When apiKey is configured through the supported ${ENV_VAR} or keychain: references, request routing resolves it before planReasoningEffortDowngrade records the refusal, while catalog generation passes the unresolved configured value to configuredReasoningEfforts. Hashing provider.apiKey directly therefore produces different identities for the same credential, so subsequent catalog syncs continue advertising the refused rung and selecting it is silently clamped at request time. Resolve the key reference before hashing, and cover this path with an env/keychain-reference regression test.

AGENTS.md reference: src/AGENTS.md:L7-L10

Useful? React with 👍 / 👎.