feat(auth): verify OpenAI settlement readiness

[robinbraemer]

Advances #96.

What changed

• make AI Gateway semantic readiness require the shared authenticated budget-settlement readiness check before accepting pooled OAuth or the explicit API-key fallback
• return one bounded budget_settlement_unavailable diagnostic while keeping process health independent and content-free
• wire the shared Effect readiness service and reporter from one bounded HTTP layer in the production runtime
• add the missing agentos.akua.dev/credential-domain: openai-responses Pod label required by the authorizer's ingress-only NetworkPolicy
• prove both sides of that network contract while preserving automountServiceAccountToken: false, the 10-minute projected settlement token, and unrestricted ordinary Internet
• add the OpenAI adapter as the held-out provider-adapter outage regression source

Verification

• focused AI/access/telemetry/authorizer: 34 suites / 166 tests passed
• core repository matrix excluding only the unavailable local Docker Collector validator: 160 suites / 758 tests passed
• Bun/runtime matrix: 18 suites / 81 tests passed
• runtime-control matrix: 9 suites / 34 tests passed
• website matrix: 37 suites / 109 tests passed
• Effect migration policy: 503 TypeScript paths, no violations
• build, root typecheck, site lint/typecheck, and affected Kustomize renders passed

The pre-existing OTel Collector container validator remains unavailable locally because Docker/OrbStack is not running. GitHub CI is authoritative for that environment-dependent check.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	agentos-site	a2c04d4	Commit Preview URL Branch Preview URL	Aug 03 2026, 06:34 PM