fix(server): preserve cyber-policy request logs

[luvs01]

Summary

• preserve structured cyber_policy terminals as 400 / cyber_policy in request logs instead of collapsing them to 502 / upstream_server_error
• apply the context-aware terminal status to native Responses, Chat Completions, and Claude Messages SSE surfaces while leaving ordinary terminal failures unchanged
• align the active physical attempt with the final semantic error code and clear terminal classification before policy-candidate fallback
• document the request-log terminal ordering and add endpoint-level regressions for every affected surface

Root cause and impact

The SSE inspector already classified response.failed payloads and stored the semantic HTTP status in the request-log context before invoking the native terminal callback. The three HTTP-derived native callbacks ignored that context and finalized every failed terminal through the generic failed -> 502 mapper. The final log taxonomy then converted the remaining 502 to upstream_server_error.

As a result, a Trusted Access for Cyber refusal could appear in /api/logs and usage.jsonl as an upstream outage even though the provider returned a structured cyber_policy client error. This change keeps that policy refusal non-retryable and does not add account switching or request replay.

Verification

• Bun 1.4.0-canary.1: 66 focused request-log, policy-fallback, and cyber-fidelity tests passed; 270 assertions
• Bun 1.3.14: the same 66 focused tests passed; 270 assertions
• Bun 1.4.0-canary.1: 4 native endpoint cyber regressions passed; 11 assertions
• Bun 1.3.14: the same 4 endpoint regressions passed; 11 assertions
• TypeScript 7.0.2 tsc --noEmit passed under Bun 1.4.0-canary.1 and Bun 1.3.14
• bun run privacy:scan passed
• git diff --check passed
• independent production and test reviews found no remaining P0-P3 findings
• broader Bun 1.4 affected-file diagnostic: 226 passed and 3 pre-existing native-main/environment assertions failed; those failures do not exercise this request-log change and were not retried

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Correctly classifies recognized cybersecurity policy failures as HTTP 400 errors with the cyber_policy code instead of generic 502 errors.
  • Preserves policy failure details, including upstream messages and terminal status information, across streamed and native requests.
  • Improves failure reporting consistency across Chat Completions, Claude Messages, Responses, WebSocket, and server-auth flows.

• Tests

  • Added coverage for policy-error handling, request logs, streaming responses, retries, and fallback scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3aebf44a-6e5b-4eac-ad9b-8f593132e932

📥 Commits

Reviewing files that changed from the base of the PR and between 6ef9dce and 2ad05a6.

📒 Files selected for processing (5)

• src/server/claude-messages.ts
• structure/04_transports-and-sidecars.md
• tests/chat-completions-endpoint.test.ts
• tests/claude-messages-endpoint.test.ts
• tests/server-auth.test.ts

---

📝 Walkthrough

Walkthrough

The change preserves recognized cyber_policy terminal errors in request logs. Native passthrough and SSE paths now use context-aware HTTP status mapping. Tests cover HTTP 400 classification, terminal metadata, and attempt-level cleanup.

Changes

Cyber-policy request-log classification

Layer / File(s)	Summary
Capture and classify terminal error codes src/server/request-log.ts, src/server/responses/policy-fallback.ts	RequestLogContext stores recognized terminal error codes. Classification prioritizes cyber_policy, clears stale values, and synchronizes the final code with the active attempt. Failed policy attempts clear the context value.
Apply context-aware terminal mapping src/server/chat-completions.ts, src/server/claude-messages.ts, src/server/index.ts, structure/04-transports-and-sidecars.md	Native passthrough handlers use httpStatusForRequestLogTerminal(status, logCtx). SSE inspection records response.failed before terminal observation. The obsolete status-helper re-export is removed.
Validate policy failure logging tests/request-log.test.ts, tests/routing-policy-fallback.test.ts, tests/chat-completions-endpoint.test.ts, tests/claude-messages-endpoint.test.ts, tests/server-auth.test.ts	Tests verify streamed and native cyber_policy failures, HTTP 400 status, upstream messages, terminal metadata, and attempt-level error-code cleanup.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• lidge-jun/opencodex#302: Modifies Claude Messages terminal and error handling.
• lidge-jun/opencodex#483: Extends structured cyber_policy code and status propagation.
• lidge-jun/opencodex#1281: Updates policy-fallback handling and retry tests.

Suggested labels: review-ready

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving structured cyber-policy errors in server request logs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request has been marked Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently. If no CodeRabbit review appears, comment @coderabbitai review to request one.
Maintainers notified: @lidge-jun @Ingwannu @Wibias

[Wibias]

Review on current head 6ef9dce71f4373acd6881d41273f93f6fd1d2c4a.

I did not find a code blocker in the cyber-policy logging fix itself. The structured terminal code is captured before terminal finalization, the semantic HTTP status is used consistently by Responses / Chat Completions / Claude Messages, active-attempt classification is aligned with the final log code, and terminalErrorCode is cleared alongside the existing terminal-status state before policy fallback.

The remaining blocker is integration. This head is now 10 commits behind current dev@70d2e175 after #1464 merged, including overlap in src/server/claude-messages.ts, the transport structure doc, and tests/claude-messages-endpoint.test.ts. Exact-head Cross-platform CI and React Doctor are also action_required; the Cross-platform run executed zero jobs.

Please rebase onto current dev and obtain an executed exact-head CI signal, then request re-review. I am not asking for additional feature changes at this point.

[coderabbitai]

@github-actions[bot] The readiness gate is complete. I will review pull request #1511.

---

🧠 Learnings used

Learnt from: Wibias
Repo: lidge-jun/opencodex PR: 986
File: .github/workflows/enforce-pr-target.yml:631-636
Timestamp: 2026-08-04T06:41:30.089Z
Learning: For the PR readiness gate in `.github/workflows/enforce-pr-target.yml`, the required scope is to bind contributor checklist completion and maintainer notification to the exact PR head SHA, then reset them after a new head commit. Maintainer approval staleness is separate from this gate and should be enforced by GitHub branch protection, such as `dismiss-stale-reviews` or `require_last_push_approval`, when configured for `dev`.

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@github-actions The readiness gate for PR #1511 is complete. CodeRabbit already reviewed the current commits.

---

🧠 Learnings used

Learnt from: Wibias
Repo: lidge-jun/opencodex PR: 986
File: .github/workflows/enforce-pr-target.yml:631-636
Timestamp: 2026-08-04T06:41:30.089Z
Learning: For the PR readiness gate in `.github/workflows/enforce-pr-target.yml`, the required scope is to bind contributor checklist completion and maintainer notification to the exact PR head SHA, then reset them after a new head commit. Maintainer approval staleness is separate from this gate and should be enforced by GitHub branch protection, such as `dismiss-stale-reviews` or `require_last_push_approval`, when configured for `dev`.

_{You are interacting with an AI system.}

[Wibias]

Re-review on exact head 2ad05a604969a618cfd68aa104b66c4b647591b0.

I still do not find a code-level blocker in the cyber-policy logging fix. The current patch preserves the structured cyber_policy identity narrowly rather than forwarding arbitrary upstream codes, captures the semantic terminal HTTP status before native finalization, and routes Responses / Chat Completions / Claude Messages native terminal callbacks through the context-aware mapper. The active physical attempt is synchronized with the final semantic error code, and policy-candidate fallback clears both terminalHttpStatus and terminalErrorCode, so stale policy classification cannot leak into a later fallback attempt.

The endpoint regressions cover the affected native surfaces, and ordinary terminal behavior remains on the existing mapper when no structured terminal status is present. I do not see a retry, auth, or taxonomy regression introduced by this change.

I am requesting changes for integration/readiness only. Current dev is 4a299fa09352e9f3d5dd119f0d892f92d3d0bab1; this head is 1 ahead / 1 behind with merge base d667367528afa2c604d19af2fc8538b965b88cf1. Exact-head Cross-platform CI (31566369815) and React Doctor (31566369809) are both action_required with 0 jobs, so GitHub CI has not executed this head. The PR is also still draft with the readiness checklist unchecked.

Please rebase onto current dev, obtain executed exact-head CI, and request re-review. No additional feature change is requested from me at this point.

done

[Wibias]

Thank you @luvs01 for the work on this PR and for tightening the terminal logging behavior.

This is useful because structured cyber_policy failures now keep their real 400 / cyber_policy semantics across native Responses, Chat Completions, Claude Messages, and attempt telemetry instead of degrading into a generic 502. That makes logs and diagnostics materially more trustworthy and lets operators distinguish an intentional policy rejection from an upstream transport/server failure.