diff --git a/deploy/mecak8s-kind/README.md b/deploy/mecak8s-kind/README.md index 1f18b4a40..f281e465b 100644 --- a/deploy/mecak8s-kind/README.md +++ b/deploy/mecak8s-kind/README.md @@ -17,8 +17,9 @@ no provider tokens. `mecak8s-openrouter` Secret from standard input, applies the real-provider overlay, and disables `--mock`. The credential is projected only as the container's `OPENROUTER_API_KEY` environment variable; it is never a Helm value or command-line -argument. Running setup later without the variable returns to mock mode and deletes -that fixture-owned Secret. +argument. Real-provider mode pins new sessions to `openai/gpt-6-sol`. Running +setup later without the variable returns to mock mode and deletes that fixture-owned +Secret. A real-provider smoke call is a **separate, explicit billable operator action** after setup. It is not part of fixture setup or default tests; inspect the deployment and diff --git a/deploy/mecak8s-kind/fixture_test.go b/deploy/mecak8s-kind/fixture_test.go index e1bc53878..9bee73ee7 100644 --- a/deploy/mecak8s-kind/fixture_test.go +++ b/deploy/mecak8s-kind/fixture_test.go @@ -97,6 +97,35 @@ func TestMecak8sKindFixture_Scenario2_MockDefault(t *testing.T) { } } +func TestMecak8sKindFixture_Scenario2_LiveProviderDefaultModel(t *testing.T) { + body, err := os.ReadFile("kind-provider-real.yaml") + if err != nil { + t.Fatal(err) + } + var values struct { + Model string `yaml:"model"` + } + if err := yaml.Unmarshal(body, &values); err != nil { + t.Fatal(err) + } + if values.Model != "openai/gpt-6-sol" { + t.Fatalf("real-provider model = %q, want %q", values.Model, "openai/gpt-6-sol") + } + + if _, err := exec.LookPath("helm"); err != nil { + t.Skip("helm is required to render the real-provider fixture") + } + cmd := exec.Command("helm", "template", "kind", ".", "-f", "values-kind.yaml", "-f", "../../mecak8s-kind/kind-provider-real.yaml") + cmd.Dir = "../helm/mecak8s" + rendered, err := cmd.CombinedOutput() + if err != nil { + t.Fatalf("render real-provider fixture: %v\n%s", err, rendered) + } + if !strings.Contains(string(rendered), "--model=openai/gpt-6-sol") { + t.Fatal("real-provider fixture render omits the pinned model") + } +} + // TestMecak8sKindFixture_Scenario2_LiveSmokeIsExplicit pins that the executable // setup task closure excludes the billable live-provider smoke action. func TestMecak8sKindFixture_Scenario2_LiveSmokeIsExplicit(t *testing.T) { diff --git a/deploy/mecak8s-kind/kind-provider-real.yaml b/deploy/mecak8s-kind/kind-provider-real.yaml index 6140992f8..7ad45ae54 100644 --- a/deploy/mecak8s-kind/kind-provider-real.yaml +++ b/deploy/mecak8s-kind/kind-provider-real.yaml @@ -6,6 +6,7 @@ # visibly-annotated opt-in -- the same escape hatch deploy/mecak8s-vmcp's # Taskfile.yml uses for its own real-provider wiring (#800). mockProvider: false +model: openai/gpt-6-sol security: allowUnsafeRealProvider: true extraEnv: