[margrop]

Summary

• add POST /api/token-forge/plan with a fixed OpenAI-compatible qwen-latest Adapter
• persist P4-004 admission and settlement state atomically in a SQLite Durable Object
• derive anonymous rate-limit keys with server-side HMAC and keep raw IP, keys, prompts, plans, and Provider errors out of storage/logs/responses
• add explicit “AI 增强生成” and independent “仅生成模板” paths; every AI/network/policy/contract failure retains validated template exports
• document ADR-0005, conservative production limits, custom-port DNS requirements, Secrets, Preview acceptance, and manual Production gate

Conservative production profile

• input/output/attempts: 22,000 / 2,000 Token / 1
• Provider timeout: 15 seconds
• per-request reservation: 24,000 Token
• actor/Lab/site requests per day: 4 / 50 / 100
• actor/Lab/site requests per 60 seconds: 1 / 6 / 10
• actor/Lab/site concurrency: 1 / 2 / 3
• circuit: 3 failures, 120 seconds open, 1 half-open probe
• reservation TTL: 45 seconds
• monetary budget remains owned by the upstream gateway; Labs uses only the minimum policy-contract placeholder

Verification

• ASTRO_TELEMETRY_DISABLED=1 npm run validate
  • 24 test files, 275 tests passed
  • format, lint, Astro/TypeScript checks, static build, and static privacy checks passed
• Production Wrangler dry-run passed
• Preview Wrangler dry-run passed
• browser bundle assertion confirms Provider URL, model, Secret binding names, and server prompt are absent

Activation gate

This PR does not deploy Production and intentionally leaves P1-008 open. After merge:

1. set Preview TOKEN_FORGE_AI_API_KEY and TOKEN_FORGE_ACTOR_KEY_SECRET
2. confirm api-gpt.speedtest.margrop.net remains DNS-only for port 16666, or move the upstream to a supported HTTPS port
3. deploy and verify Preview with the real compatible endpoint
4. only after human approval, set Production Secrets and manually deploy Production
5. close P1-008 after Production smoke passes