test(reborn): close OpenAI compat security gates

crates/ironclaw_architecture/tests/reborn_dependency_boundaries.rs

@@ -1296,6 +1296,68 @@ fn reborn_product_api_crates_do_not_bind_http_ingress() {
     );
 }
 
+#[test]
+fn reborn_openai_compat_routes_do_not_depend_on_v1_gateway_or_legacy_streams() {
+    let forbidden = [
+        ForbiddenUse {
+            pattern: "src/channels/web",
+            reason: "OpenAI-compatible Reborn routes must not route through v1 gateway handlers",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "crate::channels::web",
+            reason: "OpenAI-compatible Reborn routes must not import v1 gateway modules",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "ironclaw::channels::web",
+            reason: "OpenAI-compatible Reborn routes must not import v1 gateway modules",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "GatewayState",
+            reason: "OpenAI-compatible Reborn routes must not depend on v1 gateway state",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "SseManager",
+            reason: "OpenAI-compatible Reborn streaming must use projection-stream ports, not raw legacy SSE streams",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "AppEvent",
+            reason: "OpenAI-compatible Reborn streaming must translate ProductProjectionItem state, not raw legacy AppEvent streams",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "IncomingMessage",
+            reason: "OpenAI-compatible Reborn routes must enter through ProductWorkflow, not legacy channel ingress",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "get_or_create_assistant_conversation",
+            reason: "OpenAI-compatible Reborn retrieve/cancel must use opaque refs and projection readers, not legacy conversation reconstruction",
+            exempt: None,
+        },
+        ForbiddenUse {
+            pattern: "ConversationManager",
+            reason: "OpenAI-compatible Reborn routes must not reconstruct legacy conversations directly",
+            exempt: None,
+        },
+    ];
+
+    let root = workspace_root();
+    let compat_src = root.join("crates/ironclaw_reborn_openai_compat/src");
+    let mut violations = Vec::new();
+    collect_forbidden_uses(&compat_src, &root, &forbidden, &mut violations);
+
+    assert!(
+        violations.is_empty(),
+        "Reborn OpenAI-compatible routes must stay ProductWorkflow/projection-port backed and independent of v1 gateway handlers, legacy SSE/AppEvent streams, and legacy conversation reconstruction:\n{}",
+        violations.join("\n")
+    );
+}
+
 #[test]
 fn reborn_product_auth_contract_stays_reborn_native() {
     let forbidden = [

crates/ironclaw_reborn_openai_compat/CLAUDE.md

@@ -1,8 +1,7 @@
 # ironclaw_reborn_openai_compat
 
 Reborn-native OpenAI-compatible API contract surface for #3283 / #4442 /
-#4443 / #4444 / #4445 / #4446.
-
+#4443 / #4444 / #4445 / #4446 / #4447.
 ## Boundary
 
 This crate is a product/API route surface, not a host runtime:
@@ -13,13 +12,13 @@ This crate is a product/API route surface, not a host runtime:
   directly to `ironclaw_llm`.
 - Host composition owns listener binding, bearer/session auth, CORS/origin,
   body/rate limits, mounting, audit, and product workflow wiring.
-- Later slices should route through the channel-neutral `ProductWorkflow`
-  surface rather than recreating v1 `/v1/chat/completions` LLM proxy behavior.
+- Chat, Responses, and streaming paths route through the channel-neutral
+  `ProductWorkflow` plus projection-reader/streamer ports rather than
+  recreating v1 `/v1/chat/completions` LLM proxy behavior.
 
 ## Opaque Refs and Idempotency
 
-The `refs` module owns the OpenAI-compatible identity contract used before
-routes are wired to ProductWorkflow:
+The `refs` module owns the OpenAI-compatible identity contract:
 
 - Public ids are typed opaque refs: `chatcmpl-*` for Chat Completions and
   `resp_*` for Responses.
@@ -43,8 +42,8 @@ With `openai-compat-beta`, the default router remains fail-closed unless host
 composition injects `OpenAiCompatRouterState::with_chat_completions(...)`.
 `ironclaw_reborn_composition::build_openai_compat_route_mount` performs that
 host wiring for `ironclaw-reborn serve` by mounting the router inside the
-protected Reborn route stack. The injected `OpenAiChatCompletionsWorkflow` is
-the Chat Completions slice:
+protected Reborn route stack. The injected `OpenAiChatCompletionsWorkflow`
+handles Chat Completions create and optional projection-backed SSE streaming:
 
 - `POST /v1/chat/completions` parses the OpenAI-compatible DTO, reserves an
   opaque `chatcmpl-*` ref with actor-scoped idempotency, and submits the user
@@ -68,9 +67,12 @@ the Chat Completions slice:
 - The route requires a verified `OpenAiCompatAuthenticatedCaller` extension
   minted by host auth middleware. Do not mint auth evidence in this crate's
   production feature set.
-- This crate still must not call v1 gateway handlers, `ironclaw_llm`,
-  `TurnCoordinator`, projection internals, listener APIs, secrets, DBs, or the
-  host runtime directly.
+- Streaming create consumes a composition-supplied projection streamer and must
+  suppress keepalive/control frames, internal refs, projection cursors, and
+  sanitized backend details.
+- This crate still must not call v1 gateway handlers, raw `SseManager`/
+  `AppEvent` streams, `ironclaw_llm`, `TurnCoordinator`, projection internals,
+  listener APIs, secrets, DBs, or the host runtime directly.
 
 ## Responses Workflow
 

crates/ironclaw_reborn_openai_compat/tests/chat_workflow_handlers_contract.rs

@@ -10,10 +10,10 @@ use http::Request;
 use http_body_util::BodyExt;
 use ironclaw_host_api::{AgentId, ProjectId, TenantId, ThreadId, UserId};
 use ironclaw_product_adapters::{
-    AuthRequirement, FakeProductWorkflow, ProductCommandResultPayload, ProductInboundAck,
-    ProductInboundEnvelope, ProductInboundPayload, ProductProjectionReadInput,
+    AuthRequirement, FakeProductWorkflow, ProductAdapterError, ProductCommandResultPayload,
+    ProductInboundAck, ProductInboundEnvelope, ProductInboundPayload, ProductProjectionReadInput,
     ProductProjectionSubject, ProductRejection, ProductRejectionKind, ProductWorkflow,
-    ProjectionReadRequest, ProtocolAuthEvidence, ProtocolAuthFailure,
+    ProjectionReadRequest, ProtocolAuthEvidence, ProtocolAuthFailure, RedactedString,
 };
 use ironclaw_reborn_openai_compat::{
     InMemoryOpenAiCompatRefStore, OpenAiChatCompletionProjection,
@@ -561,6 +561,38 @@ async fn chat_completion_projection_reader_error_is_propagated_as_response() {
     assert_eq!(workflow.read_count(), 1);
 }
 
+#[tokio::test]
+async fn chat_completion_product_workflow_error_redacts_request_and_backend_details() {
+    let workflow = Arc::new(ErrorWorkflow::new(ProductAdapterError::Internal {
+        detail: RedactedString::new(
+            "provider stack /host/path /Users/alice SECRET_SENTINEL sk-live runtime trace",
+        ),
+    }));
+    let router = test_router_with_workflow(
+        workflow,
+        Arc::new(StaticChatProjectionReader::text("unused")),
+    );
+
+    let response = router
+        .oneshot(chat_request(
+            json!({
+                "model": "gpt-reborn",
+                "messages": [{
+                    "role": "user",
+                    "content": "RAW_TOOL_INPUT_SENTINEL secret-token /host/path"
+                }]
+            }),
+            None,
+        ))
+        .await
+        .expect("response");
+
+    assert_eq!(response.status(), http::StatusCode::INTERNAL_SERVER_ERROR);
+    let rendered = json_body(response).await.to_string();
+    assert!(rendered.contains("internal_error"), "{rendered}");
+    assert_error_body_excludes_redaction_sentinels(&rendered);
+}
+
 #[test]
 fn authenticated_caller_rejects_missing_claim() {
     let result = OpenAiCompatAuthenticatedCaller::new(
@@ -1131,6 +1163,26 @@ impl ProductWorkflow for FixedAckWorkflow {
     }
 }
 
+struct ErrorWorkflow {
+    error: ProductAdapterError,
+}
+
+impl ErrorWorkflow {
+    fn new(error: ProductAdapterError) -> Self {
+        Self { error }
+    }
+}
+
+#[async_trait]
+impl ProductWorkflow for ErrorWorkflow {
+    async fn submit_inbound(
+        &self,
+        _envelope: ProductInboundEnvelope,
+    ) -> Result<ProductInboundAck, ProductAdapterError> {
+        Err(self.error.clone())
+    }
+}
+
 fn accepted_ack() -> ProductInboundAck {
     ProductInboundAck::Accepted {
         accepted_message_ref: AcceptedMessageRef::new("msg:test").expect("accepted ref"),
@@ -1253,3 +1305,21 @@ impl OpenAiChatCompletionProjectionReader for RecordingChatProjectionReader {
         Ok(self.projection.clone())
     }
 }
+
+fn assert_error_body_excludes_redaction_sentinels(rendered: &str) {
+    for forbidden in [
+        "RAW_TOOL_INPUT_SENTINEL",
+        "provider stack",
+        "/host/path",
+        "/Users/alice",
+        "SECRET_SENTINEL",
+        "secret-token",
+        "sk-live",
+        "runtime trace",
+    ] {
+        assert!(
+            !rendered.contains(forbidden),
+            "error body leaked forbidden detail {forbidden:?}: {rendered}"
+        );
+    }
+}