Skip to content

qa-lab: (GPT 5.4 Parity vs. Opus Agentic) stage mock auth profiles so the parity gate runs without real credentials#64909

Closed
100yenadmin wants to merge 2 commits into
openclaw:mainfrom
electricsheephq:fix/qa-mock-auth-profiles
Closed

qa-lab: (GPT 5.4 Parity vs. Opus Agentic) stage mock auth profiles so the parity gate runs without real credentials#64909
100yenadmin wants to merge 2 commits into
openclaw:mainfrom
electricsheephq:fix/qa-mock-auth-profiles

Conversation

@100yenadmin

@100yenadmin 100yenadmin commented Apr 11, 2026

Copy link
Copy Markdown
Contributor

Summary

Makes the mock structural parity gate actually runnable without real provider credentials.

After the current rebase, this PR is intentionally narrow. The legacy runtime seam work that was in earlier drafts has been absorbed elsewhere; what this branch still owns is the auth-staging path that the mock parity gate needs in order to reach the mock providers at all.

Current scope:

  • stage placeholder auth profiles per provider / agent dir in mock-openai mode
  • apply the staged auth profile config once per provider after the profile files exist
  • default the gateway-child provider mode through the shared helper so omitted providerMode still stages mock auth correctly

Part of #64227.

Why this still matters

Without this branch, the mock parity lane can still fail before the mock server ever sees a request because the auth resolver refuses to route through the mock provider base URL until a matching auth profile exists.

This branch makes the structural gate self-contained:

  • openai and anthropic placeholder API-key profiles are staged for the agents the suite uses
  • the child config is patched to reference those profiles
  • callers that omit provider mode still get the mock-openai auth staging path through the default-provider-mode helper

The mock server does not validate the key contents. The placeholder is just enough to satisfy the auth resolver so the parity harness can actually hit the local mock server.

What changed

extensions/qa-lab/src/gateway-child.ts

  • stages placeholder mock auth profiles for openai and anthropic
  • applies the auth-profile config once per provider after staging
  • resolves the effective provider mode through the shared helper before deciding whether mock auth staging is needed

extensions/qa-lab/src/gateway-child.test.ts

  • covers the staged mock-auth profile path
  • covers the provider / agent override path
  • covers the default-provider-mode path so omitted providerMode still stages mock auth correctly

Validation

Current head validation after rebase:

CI=1 pnpm exec vitest run extensions/qa-lab/src/gateway-child.test.ts

Result: 26/26 passing.

Program-level verification update:

  • this branch is part of what made the offline structural parity rerun possible without real keys
  • on the integrated patched stack, with this branch plus the qa-lab mock/provider follow-ups, the full offline 10-scenario parity rerun passed end-to-end

Non-goals

  • no runtime strict-agentic behavior changes
  • no scenario YAML changes
  • no parity-report scoring changes
  • no live-frontier credential path changes

@greptile-apps

greptile-apps Bot commented Apr 11, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR makes the GPT-5.4 / Opus 4.6 parity gate runnable without real API keys via two narrowly scoped fixes: staging placeholder api_key auth profiles per agent dir in mock-openai mode (so the auth resolver can route requests through providerBaseUrl), and replacing the bundled-dist-breaking dynamic import in legacy.registration.ts with a proper *.runtime.ts seam. Both changes are well-tested and the approach follows documented patterns in CLAUDE.md.

Confidence Score: 5/5

Safe to merge; only one minor P2 style note, both fixes are correct and well-tested.

All findings are P2 (redundant idempotent call inside a loop). No logic errors, security issues, or correctness problems. Tests cover the new staging function including the override path and confirm both config-side and per-agent store-side outputs.

No files require special attention.

Prompt To Fix All With AI
This is a comment left during a code review.
Path: extensions/qa-lab/src/gateway-child.ts
Line: 350-357

Comment:
**Redundant `applyAuthProfileConfig` calls inside the agent loop**

`applyAuthProfileConfig` mutates the global config and is keyed by `profileId`, which is agent-independent. As written, it is called once per `(agentId, provider)` pair, so with the defaults of 2 agents × 2 providers it runs 4 times when 2 would suffice. The operation is idempotent so the result is correct, but moving the config update outside the agentId loop and keeping only `upsertAuthProfile` (the per-agent store write) inside it better expresses the separation of concerns.

How can I resolve this? If you propose a fix, please make it concise.

Reviews (1): Last reviewed commit: "qa-lab: stage mock auth profiles so the ..." | Re-trigger Greptile

Comment thread extensions/qa-lab/src/gateway-child.ts Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Enables the qa-lab parity suite to run end-to-end in mock-openai mode without real provider credentials, and fixes legacy context-engine registration so it works in bundled dist builds.

Changes:

  • Stage placeholder api_key auth profiles for mock runs across the qa suite’s agent directories and patch runtime config to reference them.
  • Add unit tests covering default and overridden mock-auth staging behavior.
  • Introduce a legacy.runtime.ts seam and update legacy context-engine registration to avoid the prior bundled-dist dynamic import failure.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File Description
src/context-engine/legacy.runtime.ts Adds a runtime seam for legacy context engine loading.
src/context-engine/legacy.registration.ts Switches legacy engine registration to use the runtime seam.
extensions/qa-lab/src/gateway-child.ts Stages mock auth profiles in mock-openai mode and exposes helpers/constants for testing.
extensions/qa-lab/src/gateway-child.test.ts Adds tests asserting mock auth profiles are staged correctly (defaults + overrides).

Comment thread src/context-engine/legacy.registration.ts Outdated
Comment thread src/context-engine/legacy.runtime.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ebff21375

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread extensions/qa-lab/src/gateway-child.ts Outdated

Copy link
Copy Markdown
Contributor Author

Current head: 2f3df64151

Maintainer update after the rebase/body cleanup:

  • Re-ran:
    • CI=1 pnpm exec vitest run extensions/qa-lab/src/gateway-child.test.ts
    • 26/26 passing
  • Current head is intentionally narrower than the original draft body was:
    • stages placeholder mock auth profiles per provider / agent dir
    • applies those auth-profile config changes once per provider after staging
    • defaults provider mode through the shared helper so omitted providerMode still stages mock auth correctly
  • I updated the PR body to match that current rebased scope.
  • Program-level impact:
    • this branch is part of what made the offline structural parity rerun possible without real keys
    • on the integrated patched stack, the full offline 10-scenario parity run is now green end-to-end with this auth path in place

I do not see remaining branch-owned review work here. If GitHub is still red, it is not this PR’s auth-staging scope.

Copy link
Copy Markdown
Contributor Author

One more maintainer note on top of the earlier status update: I updated the PR body after the rebase because the old draft still described the legacy runtime seam work. That part is no longer on this branch. The current public head is intentionally just the mock-auth staging / default-provider-mode fix that the offline structural parity rerun depended on.

@100yenadmin

Copy link
Copy Markdown
Contributor Author

Superseded by #65216. The code, tests, and proof work from this slice were carried forward into the parity proof rollup so maintainers only need to review one proof/release-certification PR. Closing this preserves the discussion history while avoiding review sprawl.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants