Upload folder using huggingface_hub

Dockerfile

@@ -1,64 +1,7 @@
-# syntax=docker/dockerfile:1.2
-# ---- deps stage: needs git + a credentialed clone of the private ARF repos
-#      (agentic_reliability_framework, ARF-Bayesian-Pricing-Calculator).
-#      This stage is discarded after build -- the credential never reaches
-#      the final image's layers, env, or git config. ----
-#
-# GH_PAT is read via a BuildKit secret mount, not `ARG` -- an ARG's value is
-# printed in plaintext as part of the logged RUN command that uses it (this
-# is exactly how a real, live token ended up visible in a Render deploy log
-# this session). A secret mount's value is never written to a log line or
-# an image layer. REQUIRES a matching setup step in Render's dashboard
-# before this will build: Render's Docker service settings -> Secret Files
-# -> add a file named exactly `gh_pat` containing the token value (nothing
-# else in the file). The old `GH_PAT` environment variable is no longer
-# read by this Dockerfile and can be removed once this is confirmed working.
-FROM python:3.12-slim AS deps
+FROM python:3.12-slim
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN --mount=type=secret,id=gh_pat,dst=/etc/secrets/gh_pat \
-    git config --global url."https://$(cat /etc/secrets/gh_pat)@github.com/".insteadOf "https://github.com/"
-RUN python -m venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
 WORKDIR /app
 COPY requirements.txt .
-# torch has no explicit pin anywhere in this dependency tree -- it's pulled in
-# transitively by sentence-transformers (for agentic_reliability_framework's
-# RAG/semantic-memory features) and, left to the default PyPI index, resolves
-# to the CUDA-enabled build (nvidia-cusparselt, cuda-toolkit, nvidia-nccl, ...)
-# even though this service runs on CPU-only Render instances. That variant's
-# extra weight is a real contributor to out-of-memory deploy failures.
-#
-# A separate `pip install torch==... --index-url .../cpu` RUN before this one
-# does NOT work: it's a distinct resolve that only knows about the CPU wheel;
-# the very next `pip install -r requirements.txt`, seeing no --index-url, only
-# has the default PyPI index in view and re-resolves torch from there,
-# silently replacing the CPU build with the CUDA one at the same version
-# number (confirmed happening in a real deploy -- final `pip install` log
-# showed plain `torch-2.13.0` plus the full nvidia/cuda-toolkit/triton stack,
-# not `torch-2.13.0+cpu`). Putting torch and -r requirements.txt in one
-# `pip install` call, with the CPU wheelhouse as the primary --index-url and
-# PyPI as --extra-index-url, makes it a single resolve: torch is satisfied
-# from the CPU index and nothing later re-derives a different build for it.
-# Version pinned to 2.13.0 to match exactly what pip's resolver already chose
-# for this dependency tree (confirmed available on the CPU index for
-# cp312/manylinux before pinning it here, not assumed).
-RUN pip install --no-cache-dir \
-    --index-url https://download.pytorch.org/whl/cpu \
-    --extra-index-url https://pypi.org/simple \
-    torch==2.13.0 \
-    -r requirements.txt
-
-# ---- final stage: just the built venv + app code, no git, no credential ----
-FROM python:3.12-slim
-COPY --from=deps /opt/venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
-WORKDIR /app
+RUN pip install --no-cache-dir -r requirements.txt
 COPY . .
-# Shell form (not exec/JSON-array form) deliberately -- ${PORT:-7860} only
-# expands with a real shell interpreting the command; exec form passes
-# arguments literally with no variable substitution at all. Render injects
-# PORT and expects the app to bind to it (its deploy log explicitly failed
-# port-scanning for it: "Bind your service to at least one port"); the
-# Hugging Face Space mirror sets no such variable and expects the
-# conventional default, 7860. One image, correct on both targets.
-CMD uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-7860}
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

README.md

@@ -1,31 +1,16 @@
----
-title: ARF API
-emoji: 🛡️
-colorFrom: blue
-colorTo: gray
-sdk: docker
-pinned: false
----
-
 # arf-api
 
 ARF API Control Plane (FastAPI)
 
 ## Live Demo
 
-**Render is the primary deployment target** (custom domain, real scaling, standard secrets
-management -- the multi-stage Docker build in this repo was purpose-built for it). The Hugging
-Face Space below is a secondary, publicly-browsable mirror of the same code, not the primary
-integration target -- point real pilot/customer integrations at Render once its URL is
-confirmed live, not at the Space URL.
-
-- **HF Space (public mirror)**: [https://arf-ai-agentic-reliability-framework-api.hf.space](https://arf-ai-agentic-reliability-framework-api.hf.space)
+The API is deployed and accessible at:
+- **Base URL**: [https://arf-ai-agentic-reliability-framework-api.hf.space](https://arf-ai-agentic-reliability-framework-api.hf.space)
 - **Interactive Documentation**: [https://arf-ai-agentic-reliability-framework-api.hf.space/docs](https://arf-ai-agentic-reliability-framework-api.hf.space/docs)
 
 ## Quick Start (Local Development)
 
 1. **Install dependencies**:
-
 ```bash
 pip install -r requirements.txt
 ```
@@ -39,11 +24,9 @@ ARF_HMC_MODEL – path to HMC model JSON (default: models/hmc_model.json)
 
 ARF_USE_HYPERPRIORS – true/false
 
-API_KEY – dead setting, not read by any current route (see docs/authentication.md)
+API_KEY – optional (currently not enforced)
 ```
 
-The settings that actually gate access are `ARF_INTERNAL_API_KEY` and `ARF_ADMIN_API_KEY`, not `API_KEY` above — see [docs/authentication.md](docs/authentication.md) for what's actually enforced and what isn't yet.
-
 3. **Run the app locally**:
 
 ```bash
@@ -106,7 +89,9 @@ curl -X POST "http://localhost:8000/api/v1/v1/incidents/evaluate"   -H "Content-
     "effect": -90,
     "explanation_text": "If we apply restart_container instead of no_action, latency would change from 600.00 to 510.00 (Δ = -90.00). Based on heuristic causal model.",
     "is_model_based": false,
-    "warnings": ["Using heuristic causal model (no fitted SCM)."]
+    "warnings": [
+      "Using heuristic causal model (no fitted SCM)."
+    ]
   },
   "utility_decision": {
     "best_action": "restart_container",
@@ -133,3 +118,4 @@ Notes
 
 - The governance endpoints use an in-process `RiskEngine` initialized at startup.
 - Outcomes are recorded via `POST /api/v1/intents/outcome` (`app/api/routes_governance.py`), tenant-scoped and auth-protected.
+

alembic/versions/a1f3c9d2e6b7_create_api_keys_table.py

@@ -1,58 +0,0 @@
-"""create api_keys table (moves API key storage off ephemeral SQLite)
-
-api_keys previously lived only in a SQLite file per service (arf_usage.db),
-which is wiped on every Render deploy/restart on the Free plan and was also
-independently duplicated between arf-api and arf-gateway. This creates the
-durable, single source of truth in Postgres. Rows are hashed at rest
-(pepper-HMAC lookup_hash + salted key_hash) -- no plaintext key column,
-since there is no pre-pepper data to migrate here (confirmed with the user:
-existing SQLite api_keys rows in both services are safe to discard, keys get
-reissued via POST /admin/keys).
-
-Revision ID: a1f3c9d2e6b7
-Revises: d36deffe7fa2
-Create Date: 2026-08-24 00:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision: str = 'a1f3c9d2e6b7'
-down_revision: Union[str, Sequence[str], None] = 'd36deffe7fa2'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Upgrade schema."""
-    # No FK to tenants.id here, deliberately -- the pre-existing SQLite
-    # schema this replaces never enforced one either (seeded/demo keys via
-    # ARF_API_KEYS may reference synthetic tenant_ids that don't have a
-    # tenants row), and adding one now would be a behavior change beyond
-    # this migration's scope.
-    op.create_table(
-        'api_keys',
-        sa.Column('id', sa.Integer(), nullable=False),
-        sa.Column('tenant_id', sa.String(length=64), nullable=False),
-        sa.Column('tier', sa.String(length=32), nullable=False),
-        sa.Column('created_at', sa.DateTime(), nullable=False),
-        sa.Column('last_used_at', sa.DateTime(), nullable=True),
-        sa.Column('is_active', sa.Boolean(), nullable=False, server_default=sa.true()),
-        sa.Column('salt', sa.String(length=64), nullable=False),
-        sa.Column('key_hash', sa.String(length=64), nullable=False),
-        sa.Column('lookup_hash', sa.String(length=64), nullable=False),
-        sa.PrimaryKeyConstraint('id'),
-    )
-    op.create_index(op.f('ix_api_keys_tenant_id'), 'api_keys', ['tenant_id'], unique=False)
-    op.create_unique_constraint('uq_api_keys_lookup_hash', 'api_keys', ['lookup_hash'])
-
-
-def downgrade() -> None:
-    """Downgrade schema."""
-    op.drop_constraint('uq_api_keys_lookup_hash', 'api_keys', type_='unique')
-    op.drop_index(op.f('ix_api_keys_tenant_id'), table_name='api_keys')
-    op.drop_table('api_keys')

alembic/versions/e4a7c1f9b3d2_create_onchain_rationales_table.py

@@ -1,62 +0,0 @@
-"""create onchain_rationales table
-
-Stores the plaintext preimage of an anchored `RiskAttestation.rationale_hash`
-(arf-onchain's RiskAttestationRegistry / enterprise's
-arf_enterprise.onchain.attestation). The chain only ever holds the hash --
-see models_onchain.py's module docstring for why the text has to live here,
-keyed by that same hash, or the anchored hash is unverifiable.
-
-Revision ID: e4a7c1f9b3d2
-Revises: a1f3c9d2e6b7
-Create Date: 2026-09-07 00:00:00.000000
-
-"""
-
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision: str = "e4a7c1f9b3d2"
-down_revision: Union[str, Sequence[str], None] = "a1f3c9d2e6b7"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Upgrade schema."""
-    op.create_table(
-        "onchain_rationales",
-        sa.Column("id", sa.String(length=64), nullable=False),
-        sa.Column("rationale_hash", sa.String(length=66), nullable=False),
-        sa.Column("rationale", sa.Text(), nullable=False),
-        sa.Column("agent_address", sa.String(length=42), nullable=True),
-        sa.Column("evaluator_address", sa.String(length=42), nullable=True),
-        sa.Column("created_at", sa.DateTime(), nullable=False),
-        sa.PrimaryKeyConstraint("id"),
-    )
-    op.create_index(
-        op.f("ix_onchain_rationales_rationale_hash"),
-        "onchain_rationales",
-        ["rationale_hash"],
-        unique=True,
-    )
-    op.create_index(
-        op.f("ix_onchain_rationales_created_at"),
-        "onchain_rationales",
-        ["created_at"],
-        unique=False,
-    )
-
-
-def downgrade() -> None:
-    """Downgrade schema."""
-    op.drop_index(
-        op.f("ix_onchain_rationales_created_at"), table_name="onchain_rationales"
-    )
-    op.drop_index(
-        op.f("ix_onchain_rationales_rationale_hash"), table_name="onchain_rationales"
-    )
-    op.drop_table("onchain_rationales")

app/api/routes_admin.py

@@ -2,18 +2,14 @@
 Admin API endpoints for API key management and audit logs.
 These endpoints should be protected (e.g., by an admin API key) in production.
 """
-from fastapi import APIRouter, Depends, HTTPException, Query, Path, Body, Request
+from fastapi import APIRouter, Depends, HTTPException, Query, Path, Body
 from pydantic import BaseModel
 from typing import Optional
 from datetime import datetime
 import os
 import secrets
 import uuid
-from sqlalchemy.orm import Session
-from app.api.deps import get_db
-from app.core import usage_tracker
-from app.core.usage_tracker import Tier
-from app.database.models_intents import TenantDB
+from app.core.usage_tracker import tracker, Tier
 
 router = APIRouter(prefix="/admin", tags=["admin"])
 # Admin key must be supplied via environment; there is no default. Fail closed
@@ -31,8 +27,6 @@ def verify_admin(admin_key: str = Query(..., alias="admin_key")):
 
 class CreateKeyRequest(BaseModel):
     tier: str
-    tenant_id: Optional[str] = None  # attach to an existing tenant; omit to create a new one
-    org_name: Optional[str] = None   # used only when creating a new tenant
 
 
 class UpdateTierRequest(BaseModel):
@@ -40,141 +34,75 @@ class UpdateTierRequest(BaseModel):
 
 
 @router.post("/keys", dependencies=[Depends(verify_admin)])
-async def create_api_key(req: CreateKeyRequest, db: Session = Depends(get_db)):
-    # Previously called get_or_create_api_key(new_key, tier_enum) -- since
-    # that function's signature is (key, tenant_id, tier=FREE), tier_enum
-    # was silently accepted as tenant_id and every key of the same tier
-    # collided onto one bogus tenant_id (e.g. every "free" key sharing
-    # tenant_id="free"). tenant_id gates real per-tenant isolation
-    # elsewhere (BetaStateDB, IntentDB, decision audit log), so this was a
-    # cross-tenant data bug, not just a mislabeled field.
+async def create_api_key(req: CreateKeyRequest):
     if req.tier not in [t.value for t in Tier]:
         raise HTTPException(
             status_code=400, detail=f"Invalid tier. Must be one of {[t.value for t in Tier]}")
-    tier_enum = Tier(req.tier)
-
-    tenant_id = req.tenant_id
-    if tenant_id:
-        if not db.query(TenantDB).filter(TenantDB.id == tenant_id).first():
-            raise HTTPException(status_code=404, detail=f"Tenant {tenant_id} not found")
-    else:
-        tenant_id = str(uuid.uuid4())
-        db.add(TenantDB(
-            id=tenant_id,
-            name=req.org_name or "Default Organization",
-            created_at=datetime.utcnow(),
-            created_by="admin",
-        ))
-        db.commit()
-
     new_key = f"sk_live_{uuid.uuid4().hex[:24]}"
-    usage_tracker.tracker.get_or_create_api_key(new_key, tenant_id=tenant_id, tier=tier_enum)
-    return {"api_key": new_key, "tenant_id": tenant_id, "tier": req.tier}
+    tier_enum = Tier(req.tier)
+    tracker.get_or_create_api_key(new_key, tier_enum)
+    return {"api_key": new_key, "tier": req.tier}
 
 
 @router.get("/keys", dependencies=[Depends(verify_admin)])
 async def list_api_keys(limit: int = 100, offset: int = 0):
-    """Lists keys by a non-secret `key_id` (the key's pepper-HMAC lookup
-    hash), never the plaintext key -- there is no plaintext key to show
-    since the H-2 fix (api_keys are hashed at rest). Use `key_id` in the
-    tier/deactivate endpoints below. `current_month_usage` is not shown
-    here: `monthly_counts` is intentionally still keyed by the raw API key
-    (arf-gateway depends on reading it that way), which this endpoint no
-    longer has -- query `/admin/keys/{api_key}/audit` with the real key for
-    per-key usage/audit history instead.
-    """
-    with usage_tracker.tracker._get_pg_conn() as conn:
-        rows = usage_tracker.tracker._pg_execute(
-            conn,
-            "SELECT lookup_hash, tier, created_at, last_used_at, is_active FROM api_keys "
-            "ORDER BY created_at DESC LIMIT %s OFFSET %s",
+    with tracker._get_conn() as conn:
+        rows = conn.execute(
+            "SELECT key, tier, created_at, last_used_at, is_active FROM api_keys ORDER BY created_at DESC LIMIT ? OFFSET ?",  # noqa: E501
             (limit, offset)
-        ).fetchall()
-        conn.commit()
-        keys = [
-            {
-                "key_id": row["lookup_hash"],
-                "tier": row["tier"],
-                "created_at": row["created_at"].isoformat(),
-                "last_used_at": row["last_used_at"].isoformat() if row["last_used_at"] else None,
-                "is_active": bool(row["is_active"]),
-            }
-            for row in rows
-        ]
+        ).fetchall()  # noqa: E501
+        keys = []
+        for row in rows:
+            month = tracker._get_month_key()
+            usage_row = conn.execute(
+                "SELECT count FROM monthly_counts WHERE api_key = ? AND year_month = ?",
+                (row["key"], month)
+            ).fetchone()
+            usage = usage_row["count"] if usage_row else 0
+            keys.append(
+                {
+                    "key": row["key"],
+                    "tier": row["tier"],
+                    "created_at": datetime.fromtimestamp(
+                        row["created_at"]).isoformat(),
+                    "last_used_at": datetime.fromtimestamp(
+                        row["last_used_at"]).isoformat() if row["last_used_at"] else None,
+                    "is_active": bool(
+                        row["is_active"]),
+                    "current_month_usage": usage,
+                })
         return {"keys": keys, "total": len(keys)}
 
 
-@router.patch("/keys/{key_id}/tier", dependencies=[Depends(verify_admin)])
+@router.patch("/keys/{api_key}/tier", dependencies=[Depends(verify_admin)])
 async def update_key_tier(
-    key_id: str = Path(..., description="The key_id from GET /admin/keys (not the raw API key)"),
+    api_key: str = Path(..., description="The API key to update"),
     req: UpdateTierRequest = Body(...),
 ):
     if req.tier not in [t.value for t in Tier]:
         raise HTTPException(
             status_code=400, detail=f"Invalid tier. Must be one of {[t.value for t in Tier]}")
-    with usage_tracker.tracker._get_pg_conn() as conn:
-        row = usage_tracker.tracker._pg_execute(
-            conn, "SELECT lookup_hash FROM api_keys WHERE lookup_hash = %s", (key_id,)).fetchone()
+    with tracker._get_conn() as conn:
+        row = conn.execute(
+            "SELECT key FROM api_keys WHERE key = ?", (api_key,)).fetchone()
         if not row:
-            conn.rollback()
             raise HTTPException(status_code=404, detail="API key not found")
-        usage_tracker.tracker._pg_execute(
-            conn, "UPDATE api_keys SET tier = %s WHERE lookup_hash = %s", (req.tier, key_id))
+        conn.execute("UPDATE api_keys SET tier = ? WHERE key = ?",
+                     (req.tier, api_key))
         conn.commit()
     return {"message": f"Tier updated to {req.tier}"}
 
 
-@router.post("/keys/{key_id}/rotate", dependencies=[Depends(verify_admin)])
-async def rotate_api_key(
-    key_id: str = Path(..., description="The key_id from GET /admin/keys (not the raw API key)"),
-):
-    """Atomically deactivate a key and issue a new one on the same tenant
-    and tier -- the single action a leaked/compromised key actually needs.
-    Doing this as get-old + deactivate + create separately (the only option
-    before this endpoint existed) risks losing track of the tenant_id
-    partway through, or leaving the old key active if a later step fails.
-    The new plaintext key is returned exactly once, like create_api_key's."""
-    with usage_tracker.tracker._get_pg_conn() as conn:
-        old_row = usage_tracker.tracker._pg_execute(
-            conn, "SELECT tenant_id, tier FROM api_keys WHERE lookup_hash = %s", (key_id,)
-        ).fetchone()
-        if not old_row:
-            conn.rollback()
-            raise HTTPException(status_code=404, detail="API key not found")
-
-        new_key = f"sk_live_{uuid.uuid4().hex[:24]}"
-        salt = secrets.token_hex(16)
-        usage_tracker.tracker._pg_execute(
-            conn, "UPDATE api_keys SET is_active = false WHERE lookup_hash = %s", (key_id,))
-        usage_tracker.tracker._pg_execute(
-            conn,
-            "INSERT INTO api_keys "
-            "(tenant_id, tier, created_at, is_active, salt, key_hash, lookup_hash) "
-            "VALUES (%s, %s, %s, %s, %s, %s, %s)",
-            (old_row["tenant_id"], old_row["tier"], datetime.utcnow(), True,
-             salt, usage_tracker.tracker._salted_hash(new_key, salt), usage_tracker.tracker._lookup_hash(new_key)),
-        )
-        conn.commit()
-
-    return {
-        "api_key": new_key,
-        "tenant_id": old_row["tenant_id"],
-        "tier": old_row["tier"],
-        "deactivated_key_id": key_id,
-    }
-
-
-@router.delete("/keys/{key_id}", dependencies=[Depends(verify_admin)])
+@router.delete("/keys/{api_key}", dependencies=[Depends(verify_admin)])
 async def deactivate_api_key(
-        key_id: str = Path(..., description="The key_id from GET /admin/keys (not the raw API key)")):
-    with usage_tracker.tracker._get_pg_conn() as conn:
-        row = usage_tracker.tracker._pg_execute(
-            conn, "SELECT lookup_hash FROM api_keys WHERE lookup_hash = %s", (key_id,)).fetchone()
+        api_key: str = Path(..., description="The API key to deactivate")):
+    with tracker._get_conn() as conn:
+        row = conn.execute(
+            "SELECT key FROM api_keys WHERE key = ?", (api_key,)).fetchone()
         if not row:
-            conn.rollback()
             raise HTTPException(status_code=404, detail="API key not found")
-        usage_tracker.tracker._pg_execute(
-            conn, "UPDATE api_keys SET is_active = false WHERE lookup_hash = %s", (key_id,))
+        conn.execute(
+            "UPDATE api_keys SET is_active = 0 WHERE key = ?", (api_key,))
         conn.commit()
     return {"message": "API key deactivated"}
 
@@ -188,23 +116,21 @@ async def get_audit_logs(
 ):
     start = datetime.fromisoformat(start_date) if start_date else None
     end = datetime.fromisoformat(end_date) if end_date else None
-    logs = usage_tracker.tracker.get_audit_logs(api_key, start, end, limit)
+    logs = tracker.get_audit_logs(api_key, start, end, limit)
     return {"api_key": api_key, "logs": logs}
 
 
 @router.get("/stats", dependencies=[Depends(verify_admin)])
 async def get_global_stats():
-    with usage_tracker.tracker._get_pg_conn() as pg_conn:
-        total_keys = usage_tracker.tracker._pg_execute(
-            pg_conn, "SELECT COUNT(*) FROM api_keys WHERE is_active = true").fetchone()["count"]
-        pg_conn.commit()
-    with usage_tracker.tracker._get_conn() as conn:
+    with tracker._get_conn() as conn:
+        total_keys = conn.execute(
+            "SELECT COUNT(*) FROM api_keys WHERE is_active = 1").fetchone()[0]
         total_requests = conn.execute(
             "SELECT COUNT(*) FROM usage_log").fetchone()[0]
         by_tier = conn.execute(
             "SELECT tier, COUNT(*) as count FROM usage_log GROUP BY tier"
         ).fetchall()
-        month = usage_tracker.tracker._get_month_key()
+        month = tracker._get_month_key()
         current_month_requests = conn.execute(
             "SELECT SUM(count) FROM monthly_counts WHERE year_month = ?", (month,)
         ).fetchone()[0] or 0
@@ -214,74 +140,3 @@ async def get_global_stats():
         "current_month_evaluations": current_month_requests,
         "by_tier": [{"tier": row[0], "count": row[1]} for row in by_tier],
     }
-
-
-# ---------------------------------------------------------------------------
-# Enterprise execution approvals (v4.3.4, opt-in -- see routes_governance.py's
-# POST /intents/{id}/execute). Without these, the durable approval ledger has
-# no way to actually be resolved through the API at all -- present but
-# unusable. app.state.approval_store is None whenever ARF_ENABLE_EXECUTION
-# is unset/false or arf_enterprise isn't installed (see main.py lifespan).
-# ---------------------------------------------------------------------------
-
-class ResolveApprovalRequest(BaseModel):
-    approved: bool
-    note: Optional[str] = None
-
-
-def _require_approval_store(request: Request):
-    approval_store = getattr(request.app.state, "approval_store", None)
-    if approval_store is None:
-        raise HTTPException(
-            status_code=501,
-            detail="Enterprise execution approvals are not enabled on this deployment "
-                   "(ARF_ENABLE_EXECUTION unset, or arf_enterprise is not installed)",
-        )
-    return approval_store
-
-
-@router.get("/executions/pending", dependencies=[Depends(verify_admin)])
-async def list_pending_executions(request: Request, limit: int = 100, offset: int = 0):
-    approval_store = _require_approval_store(request)
-    pending = approval_store.list_pending(limit=limit, offset=offset)
-    return {
-        "pending": [
-            {
-                "approval_id": r.id,
-                "decision_id": r.decision_id,
-                "intent_id": r.intent_id,
-                "level": r.level,
-                "approval_required": r.approval_required,
-                "requested_at": r.requested_at.isoformat(),
-            }
-            for r in pending
-        ],
-        "total": len(pending),
-    }
-
-
-@router.post("/executions/{approval_id}/resolve", dependencies=[Depends(verify_admin)])
-async def resolve_execution_approval(
-    request: Request,
-    req: ResolveApprovalRequest,
-    approval_id: str = Path(..., description="The approval_id from POST /intents/{id}/execute's 202 response"),
-):
-    # resolved_by is a fixed "admin" constant, not derived from admin_key in
-    # any way -- even a prefix of that secret has no business being
-    # persisted into a database row a GET endpoint can read back. Matches
-    # create_api_key's existing created_by="admin" pattern above: this
-    # codebase has one shared admin credential, not per-admin identity, so
-    # there's nothing more specific to record.
-    approval_store = _require_approval_store(request)
-    resolved = approval_store.resolve(
-        approval_id, approved=req.approved, resolved_by="admin", note=req.note
-    )
-    if not resolved:
-        raise HTTPException(
-            status_code=404,
-            detail="Approval not found or already resolved",
-        )
-    return {
-        "message": f"Approval {'approved' if req.approved else 'rejected'}",
-        "approval_id": approval_id,
-    }

app/api/routes_governance.py

@@ -24,12 +24,10 @@ intents and healing decisions. It integrates:
 
 from fastapi import APIRouter, Depends, HTTPException, Request, BackgroundTasks, Header
 from fastapi.encoders import jsonable_encoder
-from fastapi.responses import JSONResponse
 from sqlalchemy.orm import Session
 from pydantic import BaseModel
 import uuid
 import logging
-import os
 import time
 import datetime
 from typing import Optional, Dict, Any, List
@@ -42,7 +40,7 @@ from app.services.outcome_service import record_outcome
 from app.api.deps import get_db, get_skill_registry, verify_internal_key          # <-- v4.3.2
 from app.database.session import SessionLocal
 from app.core.usage_tracker import enforce_quota                                  # <-- tenant resolution
-from app.database.models_intents import DecisionAuditLogDB, IntentDB
+from app.database.models_intents import DecisionAuditLogDB
 from agentic_reliability_framework.core.models.event import ReliabilityEvent
 from agentic_reliability_framework.core.governance.policies import (
     PolicyEvaluator,
@@ -69,57 +67,6 @@ except ImportError:
     RUST_AVAILABLE = False
     ExecutionLadder = None
 
-# ===== ENTERPRISE EXECUTOR (optional) =====
-# `arf_enterprise` is not in requirements.txt -- it's a proprietary,
-# private-repo package, and unlike agentic_reliability_framework/
-# arf-pricing-calculator (plain git+https URLs with no visible credential
-# setup in the Dockerfile) I can't confirm Render's build can actually
-# clone it. Stays fully optional/try-except-guarded, same shape as
-# RUST_AVAILABLE above, deliberately not added as a hard dependency this
-# session -- see POST /intents/{id}/execute below and .env.example for what
-# an operator needs to do to actually turn this on.
-try:
-    from arf_enterprise.executor import EnterpriseExecutor
-    from arf_enterprise.actuators.fake import FakeCloudActuator
-    from arf_enterprise.config import EnterpriseConfig
-    from arf_enterprise.store import ApprovalStore, PostgresStore
-    from arf_enterprise.exceptions import (
-        ExecutionError as EnterpriseExecutionError,
-        PendingApprovalError,
-        SafetyError as EnterpriseSafetyError,
-    )
-    ENTERPRISE_EXECUTOR_AVAILABLE = True
-except ImportError:
-    ENTERPRISE_EXECUTOR_AVAILABLE = False
-    EnterpriseExecutor = None
-    FakeCloudActuator = None
-    EnterpriseConfig = None
-    ApprovalStore = None
-    PostgresStore = None
-    EnterpriseExecutionError = None
-    PendingApprovalError = None
-    EnterpriseSafetyError = None
-
-
-def _trusted_signing_keys() -> List[str]:
-    """Parse ARF_TRUSTED_SIGNING_KEYS into a list of hex fingerprints.
-
-    Comma-separated, matching EnterpriseConfig.from_env's own parsing.
-    Splitting matters: the variable holds N fingerprints, and passing the
-    raw string as a single-element list would register the literal
-    "abc,def" as one key -- so neither real key would be trusted, and an
-    unset variable would register the empty string as trusted rather than
-    trusting nothing.
-
-    An empty result is the correct fail-closed state: the ladder then
-    rejects every signed intent, which is loud and safe.
-    """
-    raw = os.getenv("ARF_TRUSTED_SIGNING_KEYS", "")
-    return [k.strip() for k in raw.split(",") if k.strip()]
-
-
-ARF_ENABLE_EXECUTION = os.getenv("ARF_ENABLE_EXECUTION", "false").lower() == "true"
-
 # ===== OPEN TELEMETRY =====
 try:
     from opentelemetry import trace
@@ -146,22 +93,6 @@ class OutcomeRequest(BaseModel):
     skill_version: Optional[int] = None
 
 
-class ExecuteIntentRequest(BaseModel):
-    """The client already received `healing_intent` in /intents/evaluate's
-    response -- resubmitting it here (rather than this endpoint trying to
-    reconstruct a signed, action/component/parameters-bearing intent from
-    IntentDB's stored oss_payload, which doesn't carry the signature) is
-    the cheapest correct design; IntentDB is used only to confirm the
-    intent exists and belongs to the caller's tenant."""
-    healing_intent: Dict[str, Any]
-    human_approved: bool = False
-    admin_approved: bool = False
-    # v4.3.1: optional skill provenance, forwarded to record_outcome the
-    # same way OutcomeRequest already does.
-    skill_id: Optional[str] = None
-    skill_version: Optional[int] = None
-
-
 class HealingDecisionRequest(BaseModel):
     event: ReliabilityEvent
     # v4.3.1: optional skill context for Bayesian utility
@@ -307,7 +238,7 @@ async def evaluate_intent_endpoint(
 
     record = UsageRecord(
         api_key=api_key,
-        tier=quota["tier"],
+        tier=None,
         timestamp=start_time,
         endpoint="/api/v1/intents/evaluate",
         request_body=intent_req.model_dump(),
@@ -435,144 +366,7 @@ async def evaluate_intent_endpoint(
             span.set_status(Status(StatusCode.ERROR, error_msg))
             span.record_exception(e)
             span.end()
-        raise HTTPException(status_code=500, detail="Internal server error")
-
-
-# --------------------------------------------------------------------------
-# Endpoint: execute a previously evaluated intent (v4.3.4, opt-in)
-# --------------------------------------------------------------------------
-@router.post("/intents/{deterministic_id}/execute")
-async def execute_intent_endpoint(
-    request: Request,
-    deterministic_id: str,
-    exec_req: ExecuteIntentRequest,
-    db: Session = Depends(get_db),
-    skill_registry=Depends(get_skill_registry),
-    quota: dict = Depends(enforce_quota),           # tenant resolved from authenticated API key
-):
-    """
-    Execute a previously evaluated healing intent through
-    arf_enterprise.EnterpriseExecutor -- gate re-check (Rust ladder),
-    optional durable approval, actuation, and independent read-back
-    verification, whose *verified* result (not a client self-report) feeds
-    record_outcome the same way /intents/outcome already does.
-
-    Off by default (ARF_ENABLE_EXECUTION unset or false) and a 501 if the
-    arf_enterprise package isn't importable -- this is new, opt-in
-    capability, not a replacement for the existing advisory-only flow.
-    Uses FakeCloudActuator regardless of what's configured elsewhere:
-    selecting a real cloud actuator (which provider, which credentials) is
-    a deliberate later step for whoever actually deploys against real
-    infrastructure, not something this endpoint defaults into.
-    """
-    if not ENTERPRISE_EXECUTOR_AVAILABLE:
-        raise HTTPException(
-            status_code=501,
-            detail="arf_enterprise is not installed on this deployment; execution is unavailable",
-        )
-    if not ARF_ENABLE_EXECUTION:
-        raise HTTPException(
-            status_code=501,
-            detail="Execution is not enabled (set ARF_ENABLE_EXECUTION=true to opt in)",
-        )
-
-    tenant_id = quota["tenant_id"]
-
-    # Existence + tenant-ownership check only -- the healing_intent to
-    # execute comes from the request body (see ExecuteIntentRequest), not
-    # reconstructed from what's stored here.
-    intent_row = db.query(IntentDB).filter(
-        IntentDB.deterministic_id == deterministic_id,
-        IntentDB.tenant_id == tenant_id,
-    ).one_or_none()
-    if not intent_row:
-        raise HTTPException(status_code=404, detail=f"Intent not found: {deterministic_id}")
-
-    risk_engine = request.app.state.risk_engine
-
-    def _on_verified_outcome(intent: Dict[str, Any], verified_success: bool, context: Dict[str, Any]) -> None:
-        try:
-            record_outcome(
-                db=db,
-                tenant_id=tenant_id,
-                deterministic_id=deterministic_id,
-                success=verified_success,
-                recorded_by="enterprise_executor",
-                notes=f"Auto-recorded from verified execution. Observed: {context.get('observed')}",
-                risk_engine=risk_engine,
-                skill_id=exec_req.skill_id,
-                skill_version=exec_req.skill_version,
-                skill_registry=skill_registry,
-            )
-        except Exception:
-            # Execution already happened by the time this fires -- a failure
-            # here must not be raised back through EnterpriseExecutor.execute()
-            # (which would misreport a real actuation as failed). Logged so
-            # the risk-engine-not-updated case is visible, not silent.
-            logger.exception(
-                "Failed to record verified outcome for intent %s after execution",
-                deterministic_id,
-            )
-
-    # Singleton initialised once at startup (main.py lifespan) rather than
-    # constructed fresh per request -- None here means either
-    # ARF_ENABLE_EXECUTION wasn't set (unreachable, checked above) or the
-    # ledger failed to initialise at startup, in which case boolean-trust
-    # mode is the documented fallback (see EnterpriseExecutor.execute).
-    approval_store = getattr(request.app.state, "approval_store", None)
-
-    # A narrow config carrying only the trust anchor. Deliberately NOT
-    # EnterpriseConfig.from_env(), which would also pick up ARF_CLOUD,
-    # ARF_MAX_BLAST_RADIUS, ARF_ENFORCE_BUSINESS_HOURS and the audit/safety
-    # toggles -- turning on guardrails and audit logging as a side effect of
-    # enabling signing is a behaviour change nobody asked for. Everything
-    # other than the trusted keys stays on today's defaults.
-    #
-    # Without this the executor got EnterpriseConfig() with an empty
-    # trusted_signing_keys, so the ladder trusted no keys and rejected every
-    # signed intent as "Untrusted signing key" -- the whole execute path was
-    # unreachable regardless of ARF_ENABLE_EXECUTION.
-    trusted_keys = _trusted_signing_keys()
-    if not trusted_keys:
-        logger.warning(
-            "ARF_TRUSTED_SIGNING_KEYS is unset or empty; the execution ladder "
-            "trusts no signing keys and will reject every signed intent. Set it "
-            "to the hex fingerprint(s) of the key(s) permitted to sign intents."
-        )
-
-    executor = EnterpriseExecutor(
-        config=EnterpriseConfig(trusted_signing_keys=trusted_keys),
-        actuator=FakeCloudActuator(),
-        approval_store=approval_store,
-        on_verified_outcome=_on_verified_outcome,
-    )
-
-    try:
-        result = await executor.execute(
-            exec_req.healing_intent,
-            human_approved=exec_req.human_approved,
-            admin_approved=exec_req.admin_approved,
-        )
-        return result
-    except PendingApprovalError as e:
-        return JSONResponse(
-            status_code=202,
-            content={
-                "status": "pending_approval",
-                "approval_id": e.approval_id,
-                "level": e.level,
-                "approval_required": e.approval_required,
-                "detail": str(e),
-            },
-        )
-    except (EnterpriseExecutionError, EnterpriseSafetyError) as e:
-        # A legitimate "did not execute" outcome (ladder denial, safety
-        # constraint, verification mismatch) -- not a server bug, so not a
-        # 5xx.
-        raise HTTPException(status_code=422, detail=str(e))
-    except Exception:
-        logger.exception("Unexpected error in execute_intent_endpoint")
-        raise HTTPException(status_code=500, detail="Internal server error")
+        raise HTTPException(status_code=500, detail=error_msg)
 
 
 # --------------------------------------------------------------------------
@@ -619,9 +413,8 @@ async def record_outcome_endpoint(
                 logger.warning(f"Failed to update pricing buffer for intent {outcome.deterministic_id}: {e}")
 
         return {"message": "Outcome recorded", "outcome_id": outcome_record.id}
-    except Exception:
-        logger.exception("Error recording outcome")
-        raise HTTPException(status_code=500, detail="Internal server error")
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
 
 
 # --------------------------------------------------------------------------
@@ -661,7 +454,7 @@ async def evaluate_healing_decision_endpoint(
 
     record = UsageRecord(
         api_key=api_key,
-        tier=quota["tier"],
+        tier=None,
         timestamp=start_time,
         endpoint="/api/v1/healing/evaluate",
         request_body=decision_req.model_dump(),
@@ -760,4 +553,4 @@ async def evaluate_healing_decision_endpoint(
             span.set_status(Status(StatusCode.ERROR, error_msg))
             span.record_exception(e)
             span.end()
-        raise HTTPException(status_code=500, detail="Internal server error")
+        raise HTTPException(status_code=500, detail=error_msg)

app/api/routes_history.py

@@ -1,10 +1,9 @@
-from fastapi import APIRouter, Depends
-from app.api.deps import verify_internal_key
+from fastapi import APIRouter
 from app.core.storage import incident_history
 
-router = APIRouter(dependencies=[Depends(verify_internal_key)])
+router = APIRouter()
 
 
 @router.get("/history")
 async def get_history():
-    return {"incidents": list(incident_history)}
+    return {"incidents": incident_history}

app/api/routes_incidents.py

@@ -30,21 +30,23 @@ from agentic_reliability_framework.core.models.event import (
     ReliabilityEvent,
 )
 
-from app.api.deps import verify_internal_key
 from app.causal_explainer import CausalExplainer
-from app.core.storage import incident_history
-from app.core import usage_tracker
-from app.core.usage_tracker import UsageRecord, enforce_quota
+from app.core.usage_tracker import UsageRecord, enforce_quota, tracker
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter()
 
+# ---------------------------------------------------------------------------
+# In‑memory incident store  (for auditing / debugging only)
+# ---------------------------------------------------------------------------
+incident_history: list[dict] = []
+
 
 # ---------------------------------------------------------------------------
 # POST /api/v1/report_incident
 # ---------------------------------------------------------------------------
-@router.post("/report_incident", dependencies=[Depends(verify_internal_key)])
+@router.post("/report_incident")
 async def report_incident(event: ReliabilityEvent) -> dict[str, str]:
     """
     Record a ``ReliabilityEvent`` in the in‑memory incident history.
@@ -52,10 +54,7 @@ async def report_incident(event: ReliabilityEvent) -> dict[str, str]:
     This endpoint is used by internal monitoring tools to feed incident
     data into the causal explainer and downstream analysis.  The event
     is stored as a JSON‑safe dictionary and is **not** persisted across
-    API restarts. Requires the same ``X-Internal-Key`` header every other
-    data-bearing route in this API requires -- previously this endpoint had
-    no auth dependency at all, so anyone could write into the incident
-    history that feeds the causal explainer and ``GET /history``.
+    API restarts.
 
     Parameters
     ----------
@@ -228,7 +227,7 @@ async def evaluate_incident(
         # ------------------------------------------------------------------
         # Asynchronous usage logging
         # ------------------------------------------------------------------
-        if usage_tracker.tracker:
+        if tracker:
             record = UsageRecord(
                 api_key=api_key,
                 tier=tier,
@@ -238,7 +237,7 @@ async def evaluate_incident(
                 response=response_data,
                 processing_ms=(time.time() - start_time) * 1000,
             )
-            await usage_tracker.tracker.increment_usage_async(record, background_tasks)
+            await tracker.increment_usage_async(record, background_tasks)
 
         logger.warning(
             "Deprecated endpoint /v1/incidents/evaluate called by key %s",
@@ -250,8 +249,7 @@ async def evaluate_incident(
         raise
     except Exception as exc:
         error_msg = str(exc)
-        logger.exception("Error in evaluate_incident (deprecated endpoint)")
-        if usage_tracker.tracker:
+        if tracker:
             record = UsageRecord(
                 api_key=api_key,
                 tier=tier,
@@ -261,5 +259,5 @@ async def evaluate_incident(
                 error=error_msg,
                 processing_ms=(time.time() - start_time) * 1000,
             )
-            await usage_tracker.tracker.increment_usage_async(record, background_tasks)
-        raise HTTPException(status_code=500, detail="Internal server error")
+            await tracker.increment_usage_async(record, background_tasks)
+        raise HTTPException(status_code=500, detail=error_msg)

app/api/routes_intents.py

@@ -1,13 +1,8 @@
-import logging
-
-from fastapi import APIRouter, Depends, HTTPException
-from app.api.deps import verify_internal_key
+from fastapi import APIRouter, HTTPException
 from app.models.intent_models import IntentSimulation, IntentSimulationResponse
 from app.services.intent_service import simulate_intent
 
-logger = logging.getLogger(__name__)
-
-router = APIRouter(dependencies=[Depends(verify_internal_key)])
+router = APIRouter()
 
 
 @router.post("/simulate_intent", response_model=IntentSimulationResponse)
@@ -15,6 +10,5 @@ async def simulate_intent_endpoint(intent: IntentSimulation):
     try:
         result = simulate_intent(intent)
         return IntentSimulationResponse(**result)
-    except Exception:
-        logger.exception("simulate_intent failed")
-        raise HTTPException(status_code=500, detail="Internal server error")
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

app/api/routes_memory.py

@@ -1,7 +1,6 @@
-from fastapi import APIRouter, Depends, Request
-from app.api.deps import verify_internal_key
+from fastapi import APIRouter, Request
 
-router = APIRouter(dependencies=[Depends(verify_internal_key)])
+router = APIRouter()
 
 
 @router.get("/stats")

app/api/routes_onchain.py

@@ -1,149 +0,0 @@
-"""Routes for on-chain attestation rationale.
-
-`RiskAttestationRegistry` (arf-onchain) anchors only a `rationale_hash` --
-never the reasoning itself, to keep operational detail about a customer's
-infrastructure off a public chain. These endpoints are the off-chain half:
-a reference risk evaluator (`arf_enterprise.onchain.evaluator`) persists the
-plaintext here immediately after signing an attestation, keyed by the same
-hash it put on-chain, and an auditor who reads a `DecisionAnchored` or
-`AttestationIssued` event can fetch the reasoning behind it here.
-
-Internal-key gated like `routes_governance.py`: this is a service-to-service
-surface for the evaluator process and for auditor tooling, not a
-tenant-scoped customer endpoint -- see `OnchainRationaleDB`'s docstring for
-why there is no tenant_id to enforce here.
-"""
-
-import logging
-
-from fastapi import APIRouter, Depends, HTTPException, Response
-from pydantic import BaseModel, field_validator
-from sqlalchemy.orm import Session
-
-from app.api.deps import get_db, verify_internal_key
-from app.database.models_onchain import OnchainRationaleDB
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(dependencies=[Depends(verify_internal_key)])
-
-
-def _validate_hex_hash(value: str) -> str:
-    text = value.strip()
-    if not text.startswith("0x") or len(text) != 66:
-        raise ValueError("rationale_hash must be a 0x-prefixed 32-byte hex string")
-    try:
-        int(text, 16)
-    except ValueError:
-        raise ValueError("rationale_hash is not valid hex") from None
-    return text.lower()
-
-
-class RationaleRequest(BaseModel):
-    rationale_hash: str
-    rationale: str
-    agent_address: str | None = None
-    evaluator_address: str | None = None
-
-    @field_validator("rationale_hash")
-    @classmethod
-    def _validate_hash(cls, value: str) -> str:
-        return _validate_hex_hash(value)
-
-    @field_validator("rationale")
-    @classmethod
-    def _validate_rationale(cls, value: str) -> str:
-        if not value.strip():
-            raise ValueError("rationale must not be empty")
-        return value
-
-
-class RationaleResponse(BaseModel):
-    rationale_hash: str
-    rationale: str
-    agent_address: str | None
-    evaluator_address: str | None
-
-
-@router.post("/onchain/rationale", status_code=201)
-async def persist_rationale(
-    req: RationaleRequest,
-    response: Response,
-    db: Session = Depends(get_db),
-):
-    """Store the plaintext behind an anchored `rationale_hash`.
-
-    Idempotent on `rationale_hash`: signing the same decision twice (a
-    retry after a network error, for instance) posts the same hash and
-    text, so the second call is a no-op rather than a uniqueness-constraint
-    error. A *different* text arriving for a hash already on record is
-    refused -- that would mean either hash collision or a caller bug, and
-    silently overwriting an anchored record's preimage is the one thing
-    this table must never do.
-    """
-    existing = (
-        db.query(OnchainRationaleDB)
-        .filter(OnchainRationaleDB.rationale_hash == req.rationale_hash)
-        .one_or_none()
-    )
-    if existing is not None:
-        if existing.rationale != req.rationale:
-            raise HTTPException(
-                status_code=409,
-                detail=(
-                    "rationale_hash already recorded with different text; "
-                    "an anchored hash's preimage cannot be overwritten"
-                ),
-            )
-        # The route decorator's status_code=201 is FastAPI's default for
-        # every plain-dict return from this handler, including this one --
-        # it must be overridden explicitly here or a replayed post reports
-        # itself as newly Created.
-        response.status_code = 200
-        return {"status": "already_recorded", "rationale_hash": req.rationale_hash}
-
-    row = OnchainRationaleDB(
-        rationale_hash=req.rationale_hash,
-        rationale=req.rationale,
-        agent_address=req.agent_address,
-        evaluator_address=req.evaluator_address,
-    )
-    db.add(row)
-    db.commit()
-    logger.info("persisted rationale for hash %s", req.rationale_hash)
-    return {"status": "recorded", "rationale_hash": req.rationale_hash}
-
-
-@router.get("/onchain/rationale/{rationale_hash}", response_model=RationaleResponse)
-async def get_rationale(
-    rationale_hash: str,
-    db: Session = Depends(get_db),
-):
-    """Fetch the plaintext behind an anchored `rationale_hash`.
-
-    What an auditor calls after reading a `DecisionAnchored` event off-chain
-    -- the hash from the event is the only key this endpoint accepts, by
-    design: there is no listing or search here, only lookup by the exact
-    value that was signed and anchored.
-    """
-    try:
-        normalized = _validate_hex_hash(rationale_hash)
-    except ValueError as exc:
-        raise HTTPException(status_code=422, detail=str(exc)) from exc
-
-    row = (
-        db.query(OnchainRationaleDB)
-        .filter(OnchainRationaleDB.rationale_hash == normalized)
-        .one_or_none()
-    )
-    if row is None:
-        raise HTTPException(
-            status_code=404, detail="no rationale recorded for this hash"
-        )
-
-    return RationaleResponse(
-        rationale_hash=row.rationale_hash,
-        rationale=row.rationale,
-        agent_address=row.agent_address,
-        evaluator_address=row.evaluator_address,
-    )

app/api/routes_payments.py

@@ -2,16 +2,12 @@
 Payment endpoints – Stripe Checkout integration.
 """
 
-import logging
 import os
 import stripe
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel
 
-from app.core import usage_tracker
-from app.core.usage_tracker import Tier, resolve_api_key_identity
-
-logger = logging.getLogger(__name__)
+from app.core.usage_tracker import tracker, Tier
 
 router = APIRouter(prefix="/payments", tags=["payments"])
 
@@ -21,46 +17,24 @@ STRIPE_WEBHOOK_SECRET = os.getenv("STRIPE_WEBHOOK_SECRET")
 
 
 class CheckoutRequest(BaseModel):
+    api_key: str
+
     success_url: str
     cancel_url: str
 
 
 @router.post("/create-checkout-session")
-async def create_checkout_session(
-    req: CheckoutRequest,
-    identity: dict = Depends(resolve_api_key_identity),
-):
-    """Create a Stripe Checkout session for the Pro tier.
-
-    Identity comes from `resolve_api_key_identity` (Authorization: Bearer
-    header, same pepper-HMAC lookup every other authenticated endpoint
-    uses) rather than from a caller-supplied field in the request body --
-    previously this endpoint took `api_key` as a JSON field with no
-    `Depends()` gate at all, so nothing distinguished "the caller proved
-    they hold this key" from "the caller typed this string into a
-    request." `enforce_quota` is deliberately not used here: a FREE-tier
-    caller who has exhausted their monthly quota must still be able to
-    reach this endpoint, since upgrading is often exactly what they are
-    trying to do.
-    """
+async def create_checkout_session(req: CheckoutRequest):
+    """Create a Stripe Checkout session for the Pro tier."""
     if not stripe.api_key:
         raise HTTPException(status_code=500, detail="Stripe not configured")
-    if not usage_tracker.tracker:
-        raise HTTPException(status_code=503, detail="Usage tracking service not initialised")
 
-    if identity["tier"] != Tier.FREE:
+    # Verify the API key exists and is free tier
+    tier = tracker.get_tier(req.api_key) if tracker else None
+    if tier != Tier.FREE:
         raise HTTPException(status_code=400,
                             detail="Only free tier keys can be upgraded")
 
-    # tenant_id, not the raw api_key, is what travels to Stripe from here
-    # on. api_key is a bearer secret -- usage_tracker.py exists specifically
-    # to never store it in plaintext (pepper-HMAC lookup + salted
-    # verification hash), and Stripe's dashboard/webhook logs/API are a
-    # third party with no reason to ever see it. tenant_id is an opaque,
-    # non-secret row identifier and is exactly what the webhook needs to
-    # look up which tenant's keys to retier.
-    tenant_id = identity["tenant_id"]
-
     try:
         checkout_session = stripe.checkout.Session.create(
             payment_method_types=["card"],
@@ -74,17 +48,9 @@ async def create_checkout_session(
             mode="subscription",
             success_url=req.success_url,
             cancel_url=req.cancel_url,
-            metadata={"tenant_id": tenant_id},
-            client_reference_id=tenant_id,
-            # checkout.session.completed carries this metadata via
-            # session.metadata (handled below), but customer.subscription.*
-            # events only carry the *subscription's own* metadata -- Stripe
-            # does not copy Session.metadata onto the Subscription it
-            # creates. Without this, cancellations can't be traced back to
-            # a tenant and PRO tier never downgrades.
-            subscription_data={"metadata": {"tenant_id": tenant_id}},
+            metadata={"api_key": req.api_key},
+            client_reference_id=req.api_key,
         )
         return {"sessionId": checkout_session.id, "url": checkout_session.url}
-    except Exception:
-        logger.exception("create_checkout_session failed")
-        raise HTTPException(status_code=500, detail="Internal server error")
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

app/api/routes_pricing.py

@@ -57,26 +57,48 @@ async def run_pricing(
     quota: dict = Depends(enforce_quota),
 ):
     """
-    Multi‑run pricing with cooldown and buffer persistence. TEMPORARILY DISABLED.
-
-    This endpoint used to persist each run's "outcome" as
-    `random.random() > risk_score` -- a fabricated result, not a real deal
-    outcome -- into a calibration buffer with no customer_id scoping, so
-    every customer's calls read and wrote the same file. Net effect: every
-    customer's price was shaped by every other customer's randomly-generated
-    outcomes, not just their own. Disabled until both are fixed: (1) a real
-    outcome-ingestion path (this endpoint must not invent one), and (2) the
-    buffer scoped per customer. See AUDIT_arf-bayesian-pricing-calculator.md
-    and AUDIT_arf-api.md (workspace root) for the original findings and
-    recommended fix. `Depends(enforce_quota)` stays active so this still
-    requires the same auth it always did -- only authenticated callers reach
-    the disabled-notice below; everyone else still gets the normal 401/403.
+    Multi‑run pricing with cooldown and buffer persistence.
+    Each run’s simulated outcome is added to the buffer, so subsequent runs
+    see an updated posterior.
     """
-    raise HTTPException(
-        status_code=503,
-        detail=(
-            "This endpoint is temporarily disabled while a data-integrity issue is "
-            "fixed. Use POST /api/v1/pricing/estimate for a single price estimate "
-            "with no persisted learning in the meantime."
-        ),
-    )
+    # We need to reuse the same buffer across runs; we'll load it per request.
+    # For simplicity, we'll load from the default location.
+    from arf_pricing_calculator.storage.buffer import load_buffer, add_event
+    from arf_pricing_calculator.orchestration.cooldown import enforce_cooldown, is_cooldown_active
+
+    outputs = []
+    buffer = load_buffer()   # loads from calibration_buffer.json
+
+    for i in range(req.runs):
+        if not req.force and is_cooldown_active(
+                req.customer_id, req.cooldown_hours):
+            raise HTTPException(status_code=429,
+                                detail=f"Cooldown active after {i} runs")
+
+        pricing_input = parse_input_dict(req.input)
+        engine = PricingEngine(calibration_buffer=buffer)
+        out = engine.estimate(pricing_input)
+
+        # Simulate an outcome (in real use, this would come from the actual
+        # deal)
+        import random
+        outcome = "success" if random.random() > out.risk_score else "failure"  # nosec B311
+
+        event = {
+            "run_id": out.run_history_id,
+            "customer_id": req.customer_id,
+            "outcome": outcome,
+            "price": out.recommended_price,
+            "value": out.expected_value,
+            "risk_score": out.risk_score,
+            "run_number": i + 1,
+        }
+        add_event(event)
+        buffer = load_buffer()   # reload after update
+
+        outputs.append(out)
+
+        if i < req.runs - 1:
+            enforce_cooldown(req.customer_id, req.cooldown_hours)
+
+    return outputs

app/api/routes_risk.py

@@ -1,13 +1,8 @@
-import logging
-
-from fastapi import APIRouter, Depends, HTTPException
-from app.api.deps import verify_internal_key
+from fastapi import APIRouter, HTTPException
 from app.models.risk_models import RiskResponse
 from app.services.risk_service import get_system_risk
 
-logger = logging.getLogger(__name__)
-
-router = APIRouter(dependencies=[Depends(verify_internal_key)])
+router = APIRouter()
 
 
 @router.get("/get_risk", response_model=RiskResponse)
@@ -18,9 +13,8 @@ async def get_risk():
         raise HTTPException(
             status_code=501,
             detail="This endpoint is deprecated and not implemented")
-    except Exception:
-        logger.exception("get_risk failed")
-        raise HTTPException(status_code=500, detail="Internal server error")
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
 
     if risk < 0.3:
         status = "low"
@@ -31,3 +25,13 @@ async def get_risk():
     else:
         status = "critical"
     return RiskResponse(system_risk=risk, status=status)
+
+
+@router.get("/history")
+async def get_risk_history():
+    import random
+    import datetime
+    now = datetime.datetime.now()
+    data = [{"time": (now - datetime.timedelta(hours=i)).isoformat(),
+             "risk": round(random.uniform(0.2, 0.8), 2)} for i in range(24, 0, -1)]
+    return data

app/api/routes_users.py

@@ -9,8 +9,7 @@ from sqlalchemy.orm import Session
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 
-from app.core import usage_tracker
-from app.core.usage_tracker import enforce_quota, Tier
+from app.core.usage_tracker import tracker, enforce_quota, Tier
 from app.api.deps import get_db
 from app.database.models_intents import TenantDB  # <-- NEW
 
@@ -31,7 +30,7 @@ async def register_user(
     Public endpoint to create a new free‑tier API key and a new tenant.
     Rate‑limited to 5 requests per hour per IP address.
     """
-    if usage_tracker.tracker is None:
+    if tracker is None:
         raise HTTPException(status_code=503, detail="Usage tracking service not initialised")
 
     # 1. Create a new tenant in the main database
@@ -49,7 +48,7 @@ async def register_user(
 
     # 2. Generate a new API key for this tenant
     new_key = f"sk_free_{uuid.uuid4().hex[:24]}"
-    success = usage_tracker.tracker.get_or_create_api_key(api_key=new_key, tenant_id=tenant_id, tier=Tier.FREE)
+    success = tracker.get_or_create_api_key(api_key=new_key, tenant_id=tenant_id, tier=Tier.FREE)
     if not success:
         # Rollback tenant creation if key creation fails
         db.delete(new_tenant)

app/api/webhooks.py

@@ -2,24 +2,16 @@
 Stripe webhook handler – updates API key tier on subscription events.
 """
 
-import logging
 import os
 import stripe
 from fastapi import APIRouter, Request, HTTPException
-from app.core.usage_tracker import update_key_tier_by_tenant_id, Tier
-
-logger = logging.getLogger(__name__)
+from app.core.usage_tracker import update_key_tier, Tier
 
 router = APIRouter(prefix="/webhooks", tags=["webhooks"])
 
 STRIPE_WEBHOOK_SECRET = os.getenv("STRIPE_WEBHOOK_SECRET")
 stripe.api_key = os.getenv("STRIPE_SECRET_KEY")
 
-# Subscription statuses that mean "not entitled to Pro anymore". Deliberately
-# does NOT include "past_due" -- whether a failed-payment grace period keeps
-# Pro access is a dunning-policy decision, not a bug, and isn't decided here.
-_DOWNGRADE_STATUSES = {"canceled", "unpaid", "incomplete_expired"}
-
 
 @router.post("/stripe")
 async def stripe_webhook(request: Request):
@@ -38,33 +30,20 @@ async def stripe_webhook(request: Request):
     except stripe.error.SignatureVerificationError:
         raise HTTPException(status_code=400, detail="Invalid signature")
 
-    # tenant_id (not api_key) is what Checkout was given -- see
-    # routes_payments.py's create_checkout_session for why the raw bearer
-    # key must never round-trip through a third party.
+    # Handle subscription events
     if event["type"] == "checkout.session.completed":
         session = event["data"]["object"]
-        # For card payments this is already "paid" by the time this event
-        # fires; for delayed-notification payment methods (bank debits,
-        # etc.) it can still be "unpaid" here. Upgrading on an unpaid
-        # session would grant Pro access before payment actually clears.
-        if session.get("payment_status") != "paid":
-            logger.info(
-                "checkout.session.completed with payment_status=%r; not upgrading yet",
-                session.get("payment_status"),
-            )
-            return {"status": "ok"}
-        tenant_id = session.get("client_reference_id") or session.get(
-            "metadata", {}).get("tenant_id")
-        if tenant_id:
-            update_key_tier_by_tenant_id(tenant_id, Tier.PRO)
-    elif event["type"] in ("customer.subscription.deleted", "customer.subscription.updated"):
+        api_key = session.get("client_reference_id") or session.get(
+            "metadata", {}).get("api_key")
+        if api_key:
+            update_key_tier(api_key, Tier.PRO)
+    elif event["type"] == "customer.subscription.deleted":
         subscription = event["data"]["object"]
-        tenant_id = subscription.get("metadata", {}).get("tenant_id")
-        if not tenant_id:
-            return {"status": "ok"}
-        if event["type"] == "customer.subscription.deleted" or (
-            subscription.get("status") in _DOWNGRADE_STATUSES
-        ):
-            update_key_tier_by_tenant_id(tenant_id, Tier.FREE)
+        # You need to store a mapping from subscription ID to API key.
+        # For simplicity, we assume you stored it in metadata during checkout.
+        # Alternatively, look up by customer ID.
+        api_key = subscription.get("metadata", {}).get("api_key")
+        if api_key:
+            update_key_tier(api_key, Tier.FREE)
 
     return {"status": "ok"}

app/core/config.py

@@ -14,7 +14,6 @@ class Settings(BaseSettings):
     ARF_USAGE_DB_PATH: str = "arf_usage.db"
     ARF_REDIS_URL: Optional[str] = None
     ARF_API_KEYS: str = "{}"  # JSON string of {key: tier}
-    ARF_KEY_PEPPER: Optional[str] = None  # required if ARF_USAGE_TRACKING is true
 
     # Tracing (OpenTelemetry)
     OTEL_EXPORTER_OTLP_ENDPOINT: Optional[str] = None

app/core/storage.py

@@ -1,16 +1,2 @@
-"""In-memory store for recent incident reports.
-
-Bounded (maxlen), not persisted across restarts -- exists to give the
-causal explainer and GET /history recent context, not as a durable audit
-trail. The cap protects against unbounded memory growth from
-POST /report_incident, which can be called repeatedly by anything holding
-a valid internal key.
-
-Shared by app.api.routes_incidents (writes, via report_incident) and
-app.api.routes_history (reads, via GET /history) -- both must import this
-same object rather than declaring their own list, or writes and reads
-silently operate on two different lists.
-"""
-from collections import deque
-
-incident_history: deque = deque(maxlen=10_000)
+# Simple in-memory list for incident history
+incident_history = []

app/core/usage_tracker.py

@@ -4,49 +4,11 @@ Thread‑safe, atomic quota consumption, idempotent, fail‑closed.
 
 Extended for multi‑tenancy: each API key is linked to a tenant ID.
 Tenant ID is stored in the `api_keys` table and used for resource isolation.
-
-API keys in `api_keys` are never stored in plaintext. The lookup index is
-HMAC-SHA256(pepper, key) -- a deterministic but one-way value computed with
-a server-only secret (ARF_KEY_PEPPER), so a leaked database alone does not
-expose usable keys. A per-row random salt plus a second SHA-256 check is a
-defense-in-depth verification layer after the row is found by lookup hash.
-This mirrors arf-gateway's internal/auth/apikey.go.
-
-`api_keys` itself lives in Postgres (DATABASE_URL), not in the SQLite file
-the rest of this module uses -- a single durable table that both arf-api
-and arf-gateway point at, instead of each service's own local SQLite copy
-(which on Render's Free plan is wiped on every deploy/restart anyway).
-
-`usage_log` and `idempotency_keys` remain SQLite-only, local to this
-service -- arf-gateway never reads them. `monthly_counts` is different:
-arf-gateway's Go code (internal/auth/apikey.go) queries it from Postgres
-directly, via the pgx driver against the same DATABASE_URL, to compute
-each key's remaining quota. It never had a way to read this service's
-local SQLite file (a different process, a different disk, a different
-protocol), so a prior version of this module -- which wrote
-`monthly_counts` to SQLite only -- left that Postgres table permanently
-empty, and arf-gateway's quota check silently treated every key as having
-consumed nothing all month, every month. `consume_quota_and_log` now
-mirrors every successfully-counted call into the Postgres `monthly_counts`
-table too (`_record_pg_monthly_count`), best-effort and logged loudly on
-failure rather than raised -- this service's own quota decision is still
-made from its local SQLite/Redis count and must not fail because a
-mirroring write to a peer service's view did. Still keyed by the raw API
-key (not hashed), matching the existing SQLite schema and a separately
-tracked plaintext-storage gap -- not addressed by this fix.
 """
-import hashlib
-import hmac
 import json
-import logging
-import os
-import secrets
 import sqlite3
 import threading
 import time
-
-import psycopg2
-import psycopg2.extras
 from contextlib import contextmanager
 from datetime import datetime, timedelta
 from dataclasses import dataclass
@@ -106,51 +68,15 @@ class UsageRecord:
     processing_ms: Optional[float] = None
 
 
-# Bounded retry for the initial Postgres connect -- see _get_pg_conn's
-# docstring. 5 attempts with exponential backoff (1+2+4+8 = 15s of sleep,
-# worst case) comfortably fits inside a container's normal boot window
-# without turning a real outage into a long hang.
-_PG_CONNECT_MAX_ATTEMPTS = 5
-_PG_CONNECT_BACKOFF_BASE = 1.0
-
-logger = logging.getLogger(__name__)
-
-
 class UsageTracker:
     """
     Thread‑safe usage tracker with atomic quota consumption and idempotency.
     Extended to support tenant isolation: each API key is linked to a tenant.
     """
 
-    # Whether the Postgres api_keys schema check has already run in this
-    # process. Class-level, not per-instance: the schema is a property of
-    # the database, not of a tracker object, and every instance in a
-    # process points at the same DATABASE_URL. Guarded by a lock because
-    # _get_pg_conn is called from request threads.
-    _pg_schema_ready: bool = False
-    _pg_schema_lock = threading.Lock()
-
     def __init__(self, db_path: str = "arf_usage.db",
-                 redis_url: Optional[str] = None,
-                 pepper: Optional[str] = None):
+                 redis_url: Optional[str] = None):
         self.db_path = db_path
-        self._pepper = pepper if pepper is not None else os.getenv("ARF_KEY_PEPPER", "")
-        if not self._pepper:
-            raise RuntimeError(
-                "ARF_KEY_PEPPER is not set -- refusing to start without it, "
-                "since it is required to look up or verify any API key."
-            )
-        if len(self._pepper) < 32:
-            raise RuntimeError(
-                f"ARF_KEY_PEPPER is too short ({len(self._pepper)} chars); "
-                "use at least 32 random characters."
-            )
-        self._pg_dsn = os.getenv("DATABASE_URL", "")
-        if not self._pg_dsn:
-            raise RuntimeError(
-                "DATABASE_URL is not set -- refusing to start without it, "
-                "since api_keys is stored in Postgres, not SQLite."
-            )
         self._local = threading.local()
         self._init_db()
 
@@ -160,40 +86,9 @@ class UsageTracker:
         elif redis_url:
             raise ImportError("Redis client not installed. Run: pip install redis")
 
-    def _lookup_hash(self, key: str) -> str:
-        """Deterministic pepper-HMAC used to find a key's row without ever
-        storing or querying by the plaintext key."""
-        return hmac.new(self._pepper.encode(), key.encode(), hashlib.sha256).hexdigest()
-
-    @staticmethod
-    def _salted_hash(key: str, salt_hex: str) -> str:
-        """Per-row salted verification hash, checked after a row has
-        already been found via lookup hash."""
-        return hashlib.sha256(bytes.fromhex(salt_hex) + key.encode()).hexdigest()
-
-    def _verify_key(self, conn, api_key: str) -> Optional[dict]:
-        """Look up a row by pepper-HMAC, then verify with the salted hash.
-        `conn` is a Postgres connection from _get_pg_conn. Returns the row
-        (tenant_id, tier, is_active, salt, key_hash) if the key is valid and
-        active, else None."""
-        row = self._pg_execute(
-            conn,
-            "SELECT tenant_id, tier, is_active, salt, key_hash FROM api_keys "
-            "WHERE lookup_hash = %s",
-            (self._lookup_hash(api_key),)
-        ).fetchone()
-        if not row or not row["is_active"]:
-            return None
-        if not hmac.compare_digest(self._salted_hash(api_key, row["salt"]), row["key_hash"]):
-            return None
-        return row
-
     @contextmanager
     def _get_conn(self):
-        """Get a thread‑local SQLite connection with WAL and immediate transactions.
-
-        Backs usage_log/monthly_counts/idempotency_keys only -- api_keys
-        lives in Postgres, see _get_pg_conn below."""
+        """Get a thread‑local SQLite connection with WAL and immediate transactions."""
         if not hasattr(self._local, "conn"):
             self._local.conn = sqlite3.connect(
                 self.db_path, check_same_thread=False, isolation_level=None)
@@ -201,160 +96,20 @@ class UsageTracker:
             self._local.conn.execute("PRAGMA journal_mode=WAL")
         yield self._local.conn
 
-    @contextmanager
-    def _get_pg_conn(self):
-        """Get a thread-local Postgres connection for the api_keys table.
-        Rows come back as dict-like objects (row["col"]) via RealDictCursor,
-        matching the sqlite3.Row access pattern used elsewhere in this file.
-
-        Retries the initial connect with backoff, but how patiently depends
-        on who is asking:
-
-        - **Startup** (`warm_up`, `retries=True`): a short DNS blip during a
-          cold container boot has been observed on Render, so a few seconds
-          of retrying is worth it to come up cleanly.
-        - **Request path** (the default, `retries=False`): fails fast. A
-          request thread that blocks for 15s on a database outage doesn't
-          make the request succeed; it holds a worker thread hostage, and
-          under any concurrency the pool is exhausted and the whole service
-          stops responding -- including its health endpoint. A prompt 503 is
-          strictly better than a slow one.
-
-        Genuine connection errors (bad credentials, wrong host) still raise
-        either way, preserving fail-closed."""
-        if not hasattr(self._local, "pg_conn") or self._local.pg_conn.closed:
-            self._connect_pg(retries=False)
-        yield self._local.pg_conn
-
-    def _connect_pg(self, retries: bool) -> None:
-        """Open this thread's Postgres connection, optionally retrying."""
-        attempts = _PG_CONNECT_MAX_ATTEMPTS if retries else 1
-        last_exc: Optional[psycopg2.OperationalError] = None
-        for attempt in range(attempts):
-            try:
-                self._local.pg_conn = psycopg2.connect(
-                    self._pg_dsn, cursor_factory=psycopg2.extras.RealDictCursor)
-                last_exc = None
-                break
-            except psycopg2.OperationalError as exc:
-                last_exc = exc
-                if attempt < attempts - 1:
-                    time.sleep(_PG_CONNECT_BACKOFF_BASE * (2 ** attempt))
-        if last_exc is not None:
-            raise last_exc
-        self._ensure_pg_schema(self._local.pg_conn)
-
-    def warm_up(self) -> bool:
-        """Best-effort startup connection, with retries.
-
-        Returns True if Postgres is reachable and the api_keys schema is
-        ready. Returns False -- rather than raising -- when it isn't, so a
-        caller can log the degradation and still start serving. That
-        asymmetry is the point: an unreachable database at boot should cost
-        api_keys-backed functionality, not the entire service.
-        """
-        try:
-            self._connect_pg(retries=True)
-            return True
-        except psycopg2.OperationalError:
-            return False
-
-    def _ensure_pg_schema(self, conn) -> None:
-        """Run the api_keys schema check once per process, on the first
-        connection that actually succeeds.
-
-        Guarded by a process-wide flag rather than done in __init__ so a
-        database that is unreachable at startup doesn't prevent the tracker
-        from existing -- it just means the first request that needs
-        Postgres pays for the schema check, and requests before that get a
-        clean 503 from enforce_quota instead of the whole service being
-        down. The statements are all IF NOT EXISTS, so re-running them on a
-        later process is harmless."""
-        if UsageTracker._pg_schema_ready:
-            return
-        with UsageTracker._pg_schema_lock:
-            if UsageTracker._pg_schema_ready:
-                return
-            self._create_pg_schema(conn)
-            UsageTracker._pg_schema_ready = True
-
-    @staticmethod
-    def _pg_execute(conn, sql: str, params: tuple = ()):
-        """Run a query against a Postgres connection and return the cursor,
-        so callers can chain .fetchone()/.fetchall() the same way sqlite3's
-        conn.execute(...) is used elsewhere in this file."""
-        cur = conn.cursor()
-        cur.execute(sql, params)
-        return cur
-
-    def _create_pg_schema(self, conn):
-        """Idempotently ensure the Postgres api_keys table/index exist.
-
-        Takes an already-open connection rather than acquiring one, because
-        its only caller is _ensure_pg_schema, which runs *from inside*
-        _get_pg_conn -- acquiring another connection here would recurse.
-
-        The canonical schema is the Alembic migration
-        (alembic/versions/*_create_api_keys_table.py) -- but nothing in this
-        codebase runs `alembic upgrade head` automatically on deploy (a
-        known gap, tracked separately), and arf-gateway's Go code needs the
-        same table without going through Python/Alembic at all. Mirroring
-        the same CREATE TABLE IF NOT EXISTS self-healing pattern this file
-        already uses for its SQLite tables keeps both services (and tests)
-        working whether or not the migration has actually been applied.
-        Column set/types must stay in sync with that migration."""
-        self._pg_execute(conn, """
-            CREATE TABLE IF NOT EXISTS api_keys (
-                id SERIAL PRIMARY KEY,
-                tenant_id VARCHAR(64) NOT NULL,
-                tier VARCHAR(32) NOT NULL,
-                created_at TIMESTAMP NOT NULL,
-                last_used_at TIMESTAMP,
-                is_active BOOLEAN NOT NULL DEFAULT true,
-                salt VARCHAR(64) NOT NULL,
-                key_hash VARCHAR(64) NOT NULL,
-                lookup_hash VARCHAR(64) NOT NULL
-            )
-        """)
-        self._pg_execute(conn, """
-            CREATE UNIQUE INDEX IF NOT EXISTS uq_api_keys_lookup_hash
-            ON api_keys (lookup_hash)
-        """)
-        self._pg_execute(conn, """
-            CREATE INDEX IF NOT EXISTS ix_api_keys_tenant_id
-            ON api_keys (tenant_id)
-        """)
-        # Mirrors arf-gateway's self-healing CREATE TABLE IF NOT EXISTS for
-        # this same table (internal/auth/apikey.go's NewValidator) -- either
-        # service may be the first to connect to a fresh database.
-        self._pg_execute(conn, """
-            CREATE TABLE IF NOT EXISTS monthly_counts (
-                api_key TEXT NOT NULL,
-                year_month TEXT NOT NULL,
-                count INTEGER NOT NULL DEFAULT 0,
-                PRIMARY KEY (api_key, year_month)
-            )
-        """)
-        conn.commit()
-
     def _init_db(self):
-        """Initialise SQLite tables for usage_log/monthly_counts/idempotency_keys.
-
-        Deliberately does NOT touch Postgres. The api_keys schema is
-        ensured lazily on the first successful Postgres connection instead
-        (see _ensure_pg_schema) so that constructing a UsageTracker never
-        depends on the database being reachable *at that instant*.
-
-        This is the difference between a degraded service and no service.
-        Every other subsystem in main.py's lifespan already degrades
-        gracefully when Postgres is unreachable -- the Beta-state loader
-        logs a warning and continues -- but init_tracker raised, and
-        main.py turns that into RuntimeError, killing the process. On
-        Render that produced a crash loop that outlived the port-detection
-        window, so a DNS failure lasting seconds took the whole deploy
-        down and left the previous release serving.
-        """
+        """Initialise SQLite tables with tenant_id support."""
         with self._get_conn() as conn:
+            # Modified: api_keys now has tenant_id column
+            conn.execute("""
+                CREATE TABLE IF NOT EXISTS api_keys (
+                    key TEXT PRIMARY KEY,
+                    tenant_id TEXT NOT NULL,
+                    tier TEXT NOT NULL,
+                    created_at REAL NOT NULL,
+                    last_used_at REAL,
+                    is_active INTEGER DEFAULT 1
+                )
+            """)
             conn.execute("""
                 CREATE TABLE IF NOT EXISTS usage_log (
                     id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -397,84 +152,65 @@ class UsageTracker:
         Register a new API key for a given tenant.
 
         Args:
-            key: The API key (plain text -- hashed before storage, never persisted as-is).
+            key: The API key (plain text, will be hashed in production).
             tenant_id: UUID of the tenant (must already exist in main DB).
             tier: Initial tier for the key.
 
         Returns:
             True if key was created (or already exists for the same tenant).
         """
-        lookup_hash = self._lookup_hash(key)
-        with self._get_pg_conn() as conn:
-            row = self._pg_execute(
-                conn, "SELECT tenant_id FROM api_keys WHERE lookup_hash = %s", (lookup_hash,)
-            ).fetchone()
+        with self._get_conn() as conn:
+            row = conn.execute(
+                "SELECT key FROM api_keys WHERE key = ?", (key,)).fetchone()
             if row:
                 # Key already exists – ensure it belongs to the same tenant
-                if row["tenant_id"] != tenant_id:
-                    conn.rollback()
+                existing_tenant = conn.execute(
+                    "SELECT tenant_id FROM api_keys WHERE key = ?", (key,)).fetchone()
+                if existing_tenant["tenant_id"] != tenant_id:
                     raise ValueError(f"Key {key[:8]}... already belongs to a different tenant.")
-                conn.commit()
                 return True
-            salt = secrets.token_hex(16)
-            self._pg_execute(
-                conn,
-                "INSERT INTO api_keys "
-                "(tenant_id, tier, created_at, is_active, salt, key_hash, lookup_hash) "
-                "VALUES (%s, %s, %s, %s, %s, %s, %s)",
-                (tenant_id, tier.value, datetime.utcnow(), True,
-                 salt, self._salted_hash(key, salt), lookup_hash)
+            conn.execute(
+                "INSERT INTO api_keys (key, tenant_id, tier, created_at, is_active) VALUES (?, ?, ?, ?, ?)",
+                (key, tenant_id, tier.value, time.time(), 1)
             )
             conn.commit()
             return True
 
     def get_tier(self, api_key: str) -> Optional[Tier]:
         """Return the tier for a given API key, or None if key invalid/inactive."""
-        with self._get_pg_conn() as conn:
-            row = self._verify_key(conn, api_key)
-            return Tier(row["tier"]) if row else None
+        with self._get_conn() as conn:
+            row = conn.execute(
+                "SELECT tier FROM api_keys WHERE key = ? AND is_active = 1",
+                (api_key,)
+            ).fetchone()
+            if not row:
+                return None
+            return Tier(row["tier"])
 
     def get_tenant_id(self, api_key: str) -> Optional[str]:
         """Return the tenant ID associated with the API key, or None if key invalid."""
-        with self._get_pg_conn() as conn:
-            row = self._verify_key(conn, api_key)
-            return row["tenant_id"] if row else None
+        with self._get_conn() as conn:
+            row = conn.execute(
+                "SELECT tenant_id FROM api_keys WHERE key = ? AND is_active = 1",
+                (api_key,)
+            ).fetchone()
+            if not row:
+                return None
+            return row["tenant_id"]
 
     def update_api_key_tier(self, api_key: str, new_tier: Tier) -> bool:
         """Update the tier of an existing API key. Returns True if successful."""
-        lookup_hash = self._lookup_hash(api_key)
-        with self._get_pg_conn() as conn:
-            row = self._pg_execute(
-                conn, "SELECT lookup_hash FROM api_keys WHERE lookup_hash = %s", (lookup_hash,)
-            ).fetchone()
+        with self._get_conn() as conn:
+            row = conn.execute(
+                "SELECT key FROM api_keys WHERE key = ?", (api_key,)).fetchone()
             if not row:
-                conn.rollback()
                 return False
-            self._pg_execute(
-                conn, "UPDATE api_keys SET tier = %s WHERE lookup_hash = %s",
-                (new_tier.value, lookup_hash))
+            conn.execute(
+                "UPDATE api_keys SET tier = ? WHERE key = ?",
+                (new_tier.value, api_key))
             conn.commit()
             return True
 
-    def update_tier_by_tenant_id(self, tenant_id: str, new_tier: Tier) -> bool:
-        """Update the tier of every active API key belonging to tenant_id.
-
-        Used by the Stripe webhook, which must never handle a raw API key
-        (Stripe's own systems -- dashboard, logs, webhook payloads -- are a
-        third party; the plaintext bearer secret has no business being
-        stored there, which is exactly what passing it as Checkout
-        metadata used to do). tenant_id is not a secret -- it's an opaque
-        row identifier -- so it's safe to round-trip through Stripe."""
-        with self._get_pg_conn() as conn:
-            cur = self._pg_execute(
-                conn,
-                "UPDATE api_keys SET tier = %s WHERE tenant_id = %s AND is_active = true",
-                (new_tier.value, tenant_id),
-            )
-            updated = cur.rowcount > 0
-            conn.commit()
-            return updated
-
     # --------------------------------------------------------------------------
     # Atomic quota consumption (unchanged, but uses api_key which links to tenant)
     # --------------------------------------------------------------------------
@@ -535,34 +271,6 @@ class UsageTracker:
         result = self._redis_client.eval(lua_script, 1, redis_key, limit)
         return result == 1
 
-    def _record_pg_monthly_count(self, api_key: str, month: str) -> None:
-        """Mirror one successfully-counted call into Postgres `monthly_counts`,
-        the table arf-gateway's Go code actually reads to compute quota
-        remaining (see this module's docstring). Best-effort: this service's
-        own quota decision was already made from SQLite/Redis before this is
-        called, so a failure here must not fail the request that already
-        legitimately counted against quota -- but it also must not fail
-        *silently*, since a swallowed error here is exactly how arf-gateway's
-        quota check went blind for every key in the first place. Logged at
-        ERROR, not raised."""
-        try:
-            with self._get_pg_conn() as conn:
-                self._pg_execute(
-                    conn,
-                    "INSERT INTO monthly_counts (api_key, year_month, count) "
-                    "VALUES (%s, %s, 1) ON CONFLICT (api_key, year_month) "
-                    "DO UPDATE SET count = monthly_counts.count + 1",
-                    (api_key, month),
-                )
-                conn.commit()
-        except Exception:
-            logger.error(
-                "Failed to mirror monthly_counts to Postgres for api_key=%s month=%s -- "
-                "arf-gateway's quota check will undercount usage for this key until this "
-                "is resolved.",
-                api_key, month, exc_info=True,
-            )
-
     # --------------------------------------------------------------------------
     # Idempotency handling (unchanged)
     # --------------------------------------------------------------------------
@@ -597,8 +305,6 @@ class UsageTracker:
         if not quota_ok:
             return False, None
 
-        self._record_pg_monthly_count(record.api_key, month)
-
         try:
             with self._get_conn() as conn:
                 conn.execute(
@@ -607,8 +313,8 @@ class UsageTracker:
                         processing_ms, idempotency_key)
                        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
                     (record.api_key, record.tier.value, record.timestamp, record.endpoint,
-                     json.dumps(record.request_body, default=str) if record.request_body else None,
-                     json.dumps(record.response, default=str) if record.response else None,
+                     json.dumps(record.request_body) if record.request_body else None,
+                     json.dumps(record.response) if record.response else None,
                      record.error, record.processing_ms, idempotency_key)
                 )
                 conn.commit()
@@ -621,40 +327,6 @@ class UsageTracker:
             self._mark_idempotent_key_used(idempotency_key)
         return True, None
 
-    def _insert_audit_log(self, record: UsageRecord) -> None:
-        """Insert a standalone usage_log row for a call whose quota was
-        already consumed at request time (see consume_quota_and_log) --
-        used by routes_governance.py's background tasks to record the
-        response body once it's known, under a distinct endpoint suffix
-        (e.g. ".../response"). Best-effort and logged, not raised, for the
-        same reason _record_pg_monthly_count is: this runs after the
-        response has already been sent to the caller, so it must not
-        surface as a request failure -- a background task exception here
-        is otherwise swallowed silently. `record.tier` is None at both real
-        call sites (tier only matters for quota consumption, already done
-        by the earlier consume_quota_and_log call for the same request),
-        but usage_log.tier is NOT NULL, so an absent tier is recorded as
-        "unknown" rather than raising or silently guessing a real tier."""
-        tier_value = record.tier.value if record.tier else "unknown"
-        try:
-            with self._get_conn() as conn:
-                conn.execute(
-                    """INSERT INTO usage_log
-                       (api_key, tier, timestamp, endpoint, request_body, response, error,
-                        processing_ms, idempotency_key)
-                       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
-                    (record.api_key, tier_value, record.timestamp, record.endpoint,
-                     json.dumps(record.request_body, default=str) if record.request_body else None,
-                     json.dumps(record.response, default=str) if record.response else None,
-                     record.error, record.processing_ms, None)
-                )
-                conn.commit()
-        except Exception:
-            logger.error(
-                "Failed to insert audit log for api_key=%s endpoint=%s",
-                record.api_key, record.endpoint, exc_info=True,
-            )
-
     # --------------------------------------------------------------------------
     # Legacy interface (kept for compatibility)
     # --------------------------------------------------------------------------
@@ -722,17 +394,6 @@ class UsageTracker:
 # --------------------------------------------------------------------------
 # Global instance and FastAPI dependency
 # --------------------------------------------------------------------------
-# Rebound by init_tracker() during the app lifespan, which means consumers
-# MUST reach it through the module -- `from app.core import usage_tracker`,
-# then `usage_tracker.tracker`. Never `from app.core.usage_tracker import
-# tracker`: that copies the *binding* (None) at import time, and init_tracker
-# rebinding this global does not update the importer's copy. Five modules
-# did exactly that (main, routes_admin, routes_incidents, routes_payments,
-# routes_users) and every one of them saw None forever -- silently skipping
-# metering and disabling signup/checkout, and crashing the Render deploy
-# outright once main.py called a method on it. Functions defined *in* this
-# module (enforce_quota, update_key_tier*) are safe to import by name: they
-# resolve `tracker` here, at call time.
 tracker: Optional[UsageTracker] = None
 
 
@@ -747,36 +408,20 @@ def update_key_tier(api_key: str, new_tier: Tier) -> bool:
     return tracker.update_api_key_tier(api_key, new_tier)
 
 
-def update_key_tier_by_tenant_id(tenant_id: str, new_tier: Tier) -> bool:
-    if tracker is None:
-        return False
-    return tracker.update_tier_by_tenant_id(tenant_id, new_tier)
-
-
-def _extract_api_key(request: Request, api_key: str = None) -> str:
-    if api_key:
-        return api_key
-    auth_header = request.headers.get("Authorization")
-    if auth_header and auth_header.startswith("Bearer "):
-        return auth_header[7:]
-    return request.query_params.get("api_key")
-
-
-async def resolve_api_key_identity(request: Request, api_key: str = None):
+async def enforce_quota(request: Request, api_key: str = None):
     """
-    FastAPI dependency that authenticates an API key and attaches tenant_id
-    to request state, without enforcing monthly quota.
-
-    Deliberately separate from `enforce_quota`: a caller whose quota is
-    already exhausted must still be able to reach an endpoint like
-    `/payments/create-checkout-session` (upgrading tier is often exactly
-    what a rate-limited caller is trying to do) -- gating that path behind
-    `enforce_quota` would 429 the one action that lets them fix it.
+    FastAPI dependency that enforces quota and attaches tenant_id to request state.
     """
     if tracker is None:
         raise HTTPException(status_code=503, detail="Usage tracking service not initialised.")
 
-    api_key = _extract_api_key(request, api_key)
+    if api_key is None:
+        auth_header = request.headers.get("Authorization")
+        if auth_header and auth_header.startswith("Bearer "):
+            api_key = auth_header[7:]
+        else:
+            api_key = request.query_params.get("api_key")
+
     if not api_key:
         raise HTTPException(status_code=401, detail="Missing API key")
 
@@ -784,6 +429,11 @@ async def resolve_api_key_identity(request: Request, api_key: str = None):
     if tier is None:
         raise HTTPException(status_code=403, detail="Invalid or inactive API key")
 
+    remaining = tracker.get_remaining_quota(api_key, tier)
+    if remaining is not None and remaining <= 0:
+        raise HTTPException(status_code=429, detail="Monthly evaluation quota exceeded")
+
+    # Retrieve tenant_id
     tenant_id = tracker.get_tenant_id(api_key)
     if not tenant_id:
         raise HTTPException(status_code=403, detail="API key not associated with a tenant")
@@ -792,18 +442,4 @@ async def resolve_api_key_identity(request: Request, api_key: str = None):
     request.state.tier = tier
     request.state.tenant_id = tenant_id
 
-    return {"api_key": api_key, "tier": tier, "tenant_id": tenant_id}
-
-
-async def enforce_quota(request: Request, api_key: str = None):
-    """
-    FastAPI dependency that enforces quota and attaches tenant_id to request state.
-    """
-    identity = await resolve_api_key_identity(request, api_key)
-    api_key, tier, tenant_id = identity["api_key"], identity["tier"], identity["tenant_id"]
-
-    remaining = tracker.get_remaining_quota(api_key, tier)
-    if remaining is not None and remaining <= 0:
-        raise HTTPException(status_code=429, detail="Monthly evaluation quota exceeded")
-
     return {"api_key": api_key, "tier": tier, "tenant_id": tenant_id, "remaining": remaining}

app/database/models_intents.py

@@ -3,18 +3,14 @@ Database models for the ARF API Control Plane.
 
 This module defines the SQLAlchemy ORM models for:
     - Tenants (multi‑tenant isolation root)
+    - API keys (per‑tenant, tier‑based)
+    - Usage logs (immutable records of API calls)
     - Intents (InfrastructureIntent evaluations)
     - Outcomes (recorded results of executed intents)
     - Beta state (conjugate Bayesian posteriors per tenant and category)
     - Audit logs (immutable decision records for compliance)
 
 All tables include a `tenant_id` column to enforce data partitioning.
-
-API keys and usage/quota logs are tracked separately in
-`app/core/usage_tracker.py` (SQLite, pepper-HMAC hashed) -- an
-`APIKeyDB`/`UsageLogDB` pair used to live here as a second, unused,
-plaintext-keyed parallel schema; removed 2026-08-23 since nothing
-referenced them.
 """
 
 import uuid
@@ -50,11 +46,74 @@ class TenantDB(Base):
     created_by = Column(String(128), nullable=True)
 
     # Relationships
+    api_keys = relationship("APIKeyDB", back_populates="tenant", cascade="all, delete-orphan")
     intents = relationship("IntentDB", back_populates="tenant")
     beta_states = relationship("BetaStateDB", back_populates="tenant")
     audit_logs = relationship("DecisionAuditLogDB", back_populates="tenant")
 
 
+# ============================================================================
+# API keys (extended with tenant_id)
+# ============================================================================
+
+class APIKeyDB(Base):
+    """
+    Stores API keys for authentication and tiered quota. Each key belongs
+    to exactly one tenant. The `tier` determines monthly evaluation limits.
+
+    Attributes:
+        key (str): The hashed API key (primary key).
+        tenant_id (str): Foreign key to `tenants.id`.
+        tier (str): Tier enumeration value (free, pro, premium, enterprise).
+        created_at (datetime): UTC creation time.
+        last_used_at (datetime, optional): Timestamp of last successful request.
+        is_active (bool): Soft‑delete flag.
+    """
+    __tablename__ = "api_keys"
+
+    key = Column(String(256), primary_key=True, index=True)
+    tenant_id = Column(String(64), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, index=True)
+    tier = Column(String(32), nullable=False)
+    created_at = Column(DateTime, default=datetime.datetime.utcnow, nullable=False)
+    last_used_at = Column(DateTime, nullable=True)
+    is_active = Column(Boolean, default=True, nullable=False)
+
+    # Relationships
+    tenant = relationship("TenantDB", back_populates="api_keys")
+    usage_logs = relationship("UsageLogDB", back_populates="api_key_rel", cascade="all, delete-orphan")
+
+
+# ============================================================================
+# Usage logs – each API call
+# ============================================================================
+
+class UsageLogDB(Base):
+    """
+    Immutable record of each API call for quota tracking and billing.
+
+    Attributes:
+        id (int): Primary key.
+        api_key (str): Foreign key to `api_keys.key`.
+        tier (str): Tier at the time of the call.
+        timestamp (float): Unix timestamp of the request.
+        endpoint (str): URL or route of the endpoint hit.
+        request_body (JSON, optional): Request payload (sanitised).
+        response (JSON, optional): Response metadata (e.g., status code).
+    """
+    __tablename__ = "usage_logs"
+
+    id = Column(Integer, primary_key=True, index=True)
+    api_key = Column(String(256), ForeignKey("api_keys.key", ondelete="CASCADE"), nullable=False)
+    tier = Column(String(32), nullable=False)
+    timestamp = Column(Float, nullable=False)
+    endpoint = Column(String(512), nullable=True)
+    request_body = Column(JSON, nullable=True)
+    response = Column(JSON, nullable=True)
+
+    # Relationship back to API key
+    api_key_rel = relationship("APIKeyDB", back_populates="usage_logs")
+
+
 # ============================================================================
 # Intents (evaluations) – now tenant‑scoped
 # ============================================================================

app/database/models_onchain.py

@@ -1,54 +0,0 @@
-"""Database models for on-chain governance attestations.
-
-``RiskAttestation.rationale_hash`` (see arf-onchain's ``AttestationLib.sol``
-and enterprise's ``arf_enterprise.onchain.attestation``) is a ``keccak256``
-digest anchored on Monad -- the chain deliberately never stores the rationale
-text itself, only its hash, to keep operational detail about a customer's
-infrastructure off a public ledger. That means the text has to live
-somewhere off-chain, keyed by the same hash, or the anchored hash proves
-nothing: nobody could ever produce the preimage to check it against.
-
-This table is that store. It is intentionally separate from
-``DecisionAuditLogDB`` (``models_intents.py``) rather than an extension of
-it: that table is written for every governance decision, on-chain or not,
-and already has its own signature column for a different purpose (Ed25519
-intent-signing, not the secp256k1 EIP-712 signature the guard verifies).
-Conflating the two would mean a column that is only sometimes meaningful
-depending on whether the decision was ever attested on-chain.
-"""
-
-import uuid
-import datetime
-
-from sqlalchemy import Column, String, DateTime, Text
-
-from .base import Base
-
-
-class OnchainRationaleDB(Base):
-    """The plaintext preimage of an anchored ``rationale_hash``.
-
-    Keyed by the hash itself (unique, indexed) rather than by an
-    auto-incrementing id: a lookup always starts from a hash read off-chain
-    (from `DecisionAnchored` or `AttestationIssued`), never from a row id
-    nothing on-chain knows about.
-
-    No ``tenant_id`` / foreign key to ``tenants``: an on-chain agent is
-    identified by its wallet address, not by this service's tenant concept,
-    and the two are not yet bridged. `evaluator_address` and `agent_address`
-    are recorded instead so a row can still be attributed and audited
-    without assuming a tenant relationship that may not exist.
-    """
-
-    __tablename__ = "onchain_rationales"
-
-    id = Column(String(64), primary_key=True, default=lambda: str(uuid.uuid4()))
-    rationale_hash = Column(
-        String(66), nullable=False, unique=True, index=True
-    )  # "0x" + 64 hex chars
-    rationale = Column(Text, nullable=False)
-    agent_address = Column(String(42), nullable=True)
-    evaluator_address = Column(String(42), nullable=True)
-    created_at = Column(
-        DateTime, default=datetime.datetime.utcnow, nullable=False, index=True
-    )

app/main.py

@@ -25,7 +25,6 @@ All heavy components are loaded **lazily and best‑effort** – if a dependency
 is missing the API continues to serve health‑check and status endpoints,
 degrading gracefully rather than crashing.
 """
-import hashlib
 import logging
 import os
 import sys
@@ -35,9 +34,8 @@ import time as _time
 from contextlib import asynccontextmanager
 from typing import Dict
 
-from fastapi import FastAPI, Request
+from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse
 
 # ── Optional: Prometheus metrics ─────────────────────────────
 try:
@@ -83,15 +81,13 @@ from agentic_reliability_framework.core.temporal_reliability import (
 )
 
 # ── Usage tracker ────────────────────────────────────────────
-from app.core import usage_tracker
-from app.core.usage_tracker import init_tracker, Tier
+from app.core.usage_tracker import init_tracker, tracker, Tier
 
 from app.api import (
     routes_governance,
     routes_history,
     routes_incidents,
     routes_intents,
-    routes_onchain,
     routes_risk,
     routes_memory,
     routes_admin,
@@ -272,65 +268,14 @@ async def lifespan(app: FastAPI):
                 db_path=os.getenv("ARF_USAGE_DB_PATH", "arf_usage.db"),
                 redis_url=os.getenv("ARF_REDIS_URL"),
             )
-
-            # Constructing the tracker no longer touches Postgres, so warm
-            # it deliberately here: a few seconds of retrying is worth it to
-            # come up with the api_keys schema ready.
-            #
-            # A failure is logged and survived, NOT raised. Everything above
-            # in this lifespan already degrades that way -- the Beta-state
-            # loader logs a warning on the identical error and continues --
-            # and the asymmetry here is what turned a database blip into a
-            # total outage: raising crash-loops the process, which on Render
-            # exhausts the port-detection window, fails the deploy, and
-            # leaves the previous release serving. Starting degraded means
-            # the health endpoint answers, the deploy succeeds, and API
-            # requests get a clean 503 from enforce_quota until the database
-            # is reachable -- at which point they recover with no redeploy.
-            postgres_ready = usage_tracker.tracker.warm_up()
-            if not postgres_ready:
-                logger.error(
-                    "Usage tracker started WITHOUT a Postgres connection: api_keys "
-                    "is unreachable, so API-key validation and quota enforcement "
-                    "will fail (503) until it recovers. Check that DATABASE_URL's "
-                    "host resolves from this service, and that the database is "
-                    "running and in the same region."
-                )
-
-            # Seed initial API keys from environment variable (for testing
-            # / demo). Skipped entirely when Postgres is unreachable: every
-            # get_or_create_api_key below is a write to api_keys, so
-            # attempting it would raise straight back into the handler that
-            # kills the process -- reintroducing the crash loop the warm-up
-            # above exists to prevent.
+            # Seed initial API keys from environment variable (for testing / demo)
             api_keys_json = os.getenv("ARF_API_KEYS", "{}")
-            if not postgres_ready and api_keys_json not in ("", "{}"):
-                logger.warning(
-                    "Skipping ARF_API_KEYS seeding: Postgres is unreachable. "
-                    "Seeded keys will not exist until the database recovers "
-                    "and the service is restarted."
-                )
-                api_keys_json = "{}"
             try:
                 api_keys = json.loads(api_keys_json)
                 for key, tier_str in api_keys.items():
                     try:
                         tier = Tier(tier_str.lower())
-                        # Previously called get_or_create_api_key(key, tier)
-                        # -- tier was silently accepted as tenant_id, so
-                        # every seeded key of the same tier collided onto
-                        # one bogus tenant_id. These are demo/env-seeded
-                        # keys with no real TenantDB row, but each still
-                        # needs its own tenant_id to avoid cross-key
-                        # contamination in tenant-scoped state elsewhere
-                        # (BetaStateDB, IntentDB, decision audit log). A
-                        # fixed-length key prefix isn't safe here: keys
-                        # generated elsewhere in this codebase share an
-                        # 8-char prefix ("sk_live_"/"sk_free_"), so a
-                        # prefix-based id would collide the same way the
-                        # original bug did. Hash the whole key instead.
-                        tenant_id = "env-seed-" + hashlib.sha256(key.encode()).hexdigest()[:16]
-                        usage_tracker.tracker.get_or_create_api_key(key, tenant_id=tenant_id, tier=tier)
+                        tracker.get_or_create_api_key(key, tier)
                         logger.info(f"Seeded API key for tier {tier.value}")
                     except ValueError:
                         logger.warning(
@@ -340,51 +285,15 @@ async def lifespan(app: FastAPI):
                 logger.warning(
                     "ARF_API_KEYS environment variable is not valid JSON; skipping seeding."
                 )
-            app.state.usage_tracker = usage_tracker.tracker
-            if postgres_ready:
-                logger.info("✅ Usage tracker ready.")
-            else:
-                logger.warning("⚠️  Usage tracker started in degraded mode (no Postgres).")
+            app.state.usage_tracker = tracker
+            logger.info("✅ Usage tracker ready.")
         except Exception as e:
-            # Still fail closed on genuine configuration errors -- a missing
-            # or too-short ARF_KEY_PEPPER, an unset DATABASE_URL. Those never
-            # self-resolve, and starting without them would mean serving with
-            # broken API-key hashing. Database *reachability* is handled
-            # above and no longer reaches here.
             logger.critical(f"Failed to initialise usage tracker: {e}")
             raise RuntimeError("Usage tracker initialisation failed") from e
     else:
         logger.info("Usage tracking disabled by ARF_USAGE_TRACKING=false.")
         app.state.usage_tracker = None
 
-    # ── 6b. Enterprise execution approval ledger (optional) ───
-    # Singleton for the same reason usage_tracker/risk_engine are: a fresh
-    # PostgresStore() per request would open a brand-new DB connection (and
-    # re-run its schema check) on every call to POST
-    # /intents/{id}/execute instead of reusing one across requests handled
-    # by the same worker. Only initialised when execution is actually
-    # opted into (ARF_ENABLE_EXECUTION=true) and arf_enterprise is
-    # importable -- always sets app.state.approval_store (to None if
-    # either condition isn't met) so downstream code never needs a
-    # hasattr/getattr guard.
-    app.state.approval_store = None
-    if os.getenv("ARF_ENABLE_EXECUTION", "false").lower() == "true":
-        try:
-            from arf_enterprise.store import ApprovalStore, PostgresStore
-            app.state.approval_store = ApprovalStore(PostgresStore())
-            logger.info("✅ Enterprise execution approval ledger ready.")
-        except ImportError:
-            logger.warning(
-                "ARF_ENABLE_EXECUTION=true but arf_enterprise is not installed; "
-                "POST /intents/{id}/execute will return 501."
-            )
-        except Exception as e:
-            logger.error(
-                "Failed to initialise the enterprise approval ledger (%s); "
-                "POST /intents/{id}/execute will fall back to boolean-trust "
-                "mode for approvals rather than failing startup entirely.", e
-            )
-
     # ── 7. Wilson confidence monitor ──────────────────────────
     try:
         from app.services.wilson_monitor import update as wilson_update
@@ -447,19 +356,6 @@ def create_app() -> FastAPI:
     )
     logger.debug("CORS middleware configured")
 
-    # ── Generic exception handler ────────────────────────────
-    # Defense-in-depth for anything that escapes a route's own try/except
-    # uncaught (HTTPException instances are unaffected -- FastAPI's own,
-    # more specific handler for those still takes precedence). Logs the
-    # real exception server-side and returns a generic message: routes
-    # that catch their own exceptions have each been fixed to do the same,
-    # but this exists so a bug that skips that pattern doesn't leak raw
-    # exception text (paths, internals, third-party SDK details) to callers.
-    @app.exception_handler(Exception)
-    async def unhandled_exception_handler(request: Request, exc: Exception):
-        logger.exception("Unhandled exception on %s %s", request.method, request.url.path)
-        return JSONResponse(status_code=500, content={"detail": "Internal server error"})
-
     # ── Rate limiter ──────────────────────────────────────────
     if SLOWAPI_AVAILABLE:
         app.state.limiter = limiter
@@ -492,9 +388,6 @@ def create_app() -> FastAPI:
     app.include_router(
         routes_governance.router, prefix="/api/v1", tags=["governance"]
     )
-    app.include_router(
-        routes_onchain.router, prefix="/api/v1", tags=["onchain"]
-    )
     app.include_router(
         routes_memory.router, prefix="/v1/memory", tags=["memory"]
     )

deploy/kubernetes/arf-api/secret.yaml

@@ -1,16 +1,3 @@
-# DO NOT apply this file as-is. Every value below is a placeholder, not a
-# real secret -- ARF_INTERNAL_API_KEY in particular is a fixed, publicly
-# visible string in this repo's git history. Applying it unmodified means
-# the "secret" is a known value, not a secret.
-#
-# Generate real values instead, e.g.:
-#   kubectl create secret generic arf-api-secrets -n arf-system \
-#     --from-literal=DATABASE_URL=... \
-#     --from-literal=ARF_INTERNAL_API_KEY=$(openssl rand -hex 32) \
-#     --from-literal=ARF_API_KEYS='{}' \
-#     --from-literal=ARF_REDIS_URL=...
-# or manage this via a secrets operator (External Secrets, Sealed Secrets,
-# SOPS) rather than a plain committed manifest.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -18,7 +5,7 @@ metadata:
   namespace: arf-system
 type: Opaque
 stringData:
-  # Placeholders only -- see warning above. Replace before applying.
+  # Replace these placeholder values with the actual secrets.
   DATABASE_URL: "postgresql://user:password@host:5432/arf"
   ARF_INTERNAL_API_KEY: "change-me-to-a-strong-random-key"
   ARF_API_KEYS: '{}'

docs/authentication.md

@@ -2,50 +2,20 @@
 
 This page describes how to authenticate with the ARF API.
 
-Current status
-
-- `routes_governance.py`, `routes_risk.py`, `routes_intents.py`, `routes_history.py`,
-  `routes_memory.py`: the entire router requires the `X-Internal-Key` header, verified against
-  `ARF_INTERNAL_API_KEY` (`app/api/deps.py::verify_internal_key`). This fails closed — requests
-  are rejected with 401 if the env var is unset, if the header is missing, or if it doesn't
-  match (constant-time comparison). This is the header arf-gateway injects when proxying to
-  this service. The last four were unauthenticated until this was fixed — see
-  `tests/test_deps.py` for the tests that verify the dependency itself actually rejects what
-  it should, not just that it's wired in.
-- `routes_incidents.py`'s `POST /report_incident` requires the same `X-Internal-Key`
-  dependency as above — it did not until a later audit found it had none at all, unlike every
-  other route in this file, despite its own docstring saying it's meant for internal monitoring
-  tools only. Anyone could previously write arbitrary events into the incident history that
-  feeds the causal explainer and `GET /history`. That history is now also a bounded
-  `deque(maxlen=10_000)` (`app/core/storage.py`), not an unbounded list — the same audit found
-  `POST /report_incident` and `GET /history` were reading/writing two _different_ Python lists
-  with the same name, so `GET /history` had in fact always returned empty regardless of what was
-  reported; both routers now share the one list in `app.core.storage`.
-- `routes_admin.py`: individual `/admin/*` endpoints require an `admin_key` query parameter,
-  verified against `ARF_ADMIN_API_KEY` (`app/api/deps.py`, or the local `verify_admin`
-  dependency in that router). Also fails closed if unset. Includes
-  `POST /admin/keys/{key_id}/rotate` — deactivates a key and issues a new one on the same
-  tenant/tier in one transaction, for when a key needs to be revoked without losing the
-  tenant's identity or history. `api_keys` itself lives in Postgres (`DATABASE_URL`), shared
-  with arf-gateway (both must use the identical `ARF_KEY_PEPPER`) — see the comments on those
-  two variables in `.env.example` for why.
-- `routes_pricing.py`: individual `/pricing/*` endpoints require a real per-customer API key
-  (`Authorization: Bearer <key>` or `?api_key=`), verified against the tracked/tenant-scoped
-  `enforce_quota` dependency (`app/core/usage_tracker.py`) — a different mechanism from
-  `X-Internal-Key`, since pricing estimates are meant to be reachable by a customer directly,
-  not only via the gateway.
+Current status (mixed — not all routers are protected)
+
+- `routes_governance.py`: the entire router requires the `X-Internal-Key` header, verified against `ARF_INTERNAL_API_KEY` (`app/api/deps.py::verify_internal_key`). This fails closed — requests are rejected with 401 if the env var is unset. This is the header arf-gateway injects when proxying to this service.
+- `routes_admin.py`: individual `/admin/*` endpoints require an `admin_key` query parameter, verified against `ARF_ADMIN_API_KEY` (`app/api/deps.py`, or the local `verify_admin` dependency in that router). Also fails closed if unset.
+- `routes_risk.py`, `routes_intents.py`, `routes_history.py`, `routes_memory.py`: **no auth dependency at all**. If this service is reachable directly (e.g., its public HF Space URL) rather than only through arf-gateway, these routes are open to anyone.
 
 What the code provides
 
-- `app/core/config.py` exposes an `api_key` setting read from `.env`, but no current route
-  checks it — it is not the mechanism in use. The real mechanisms are `X-Internal-Key`,
-  `ARF_ADMIN_API_KEY`, and per-customer API keys (`enforce_quota`), all checked in
-  `app/api/deps.py` / `app/core/usage_tracker.py`.
+- `app/core/config.py` exposes an `api_key` setting read from `.env`, but no current route checks it — it is not the mechanism in use. The real mechanism is the two env vars above, checked in `app/api/deps.py`.
+
+If you need to lock down the remaining unauthenticated routers
+
+- Add `dependencies=[Depends(verify_internal_key)]` (or a purpose-built dependency) to the `APIRouter(...)` construction in the files listed above, following the pattern already used in `routes_governance.py`.
 
 Notes
 
 - Tests run against a real Postgres connection (`tests/conftest.py`), not SQLite; see the top-level README's Tests section.
-- `tests/conftest.py` globally overrides `verify_internal_key` for the test suite (so routes
-  behind it can be exercised without the gateway-injected header) — this means the app-level
-  test suite alone can't confirm the dependency actually fails closed. `tests/test_deps.py`
-  calls it directly, bypassing that override, specifically to verify that.

docs/disaster-recovery.md

@@ -0,0 +1,396 @@
+# ARF Disaster Recovery & Business Continuity Plan
+
+**Version:** 2.0
+**ARF Version:** v4.3.2
+**Date:** July 8, 2026
+**Classification:** Proprietary – Access‑Controlled
+**Target Environment:** Kubernetes (AWS EKS), PostgreSQL (RDS), Redis (ElastiCache), S3
+
+---
+
+## 1. Executive Summary
+
+This document defines the disaster recovery and business continuity procedures for the Agentic Reliability Framework (ARF). It is designed to ensure that the platform can recover from catastrophic failures while meeting stringent recovery objectives. The plan is grounded in the same Bayesian risk‑quantification principles that ARF applies to infrastructure governance, providing a mathematically rigorous framework for assessing and minimizing the probability of data loss and service unavailability.
+
+### 1.1 Recovery Objectives
+
+| Metric | Target | Rationale |
+|--------|--------|-----------|
+| **Recovery Point Objective (RPO)** | ≤ 5 minutes (PostgreSQL) | The conjugate Bayesian posteriors are updated on every outcome; a 5‑minute window limits the expected information loss to a negligible fraction of the total evidence. |
+| **Recovery Time Objective (RTO)** | ≤ 15 minutes | The gateway and API can be redeployed automatically via Kubernetes; database restoration from a recent snapshot completes within this window. |
+| **Maximum Acceptable Outage Probability** | ≤ 0.001 (99.9% availability) | For critical infrastructure, the service must be available at least 99.9% of the time, corresponding to an annual downtime of ≤ 8.76 hours. |
+
+---
+
+## 2. Data Topology and Fault Domains
+
+### 2.1 Stateful Components
+
+| Component | Data Stored | Consistency Model | Failure Impact |
+|-----------|-------------|-------------------|----------------|
+| **PostgreSQL (RDS)** | Tenant conjugate posteriors (`beta_state`), audit logs (`decision_audit_log`), intent records, outcome records | Strong (ACID) | Loss would revert all learned Bayesian priors and audit history. |
+| **Redis (ElastiCache)** | Quota counters, rate‑limit state | Eventually consistent (AOF persistence) | Loss would reset monthly usage counters but not affect governance decisions. |
+| **S3 (audit log exports)** | Daily exports of audit logs for long‑term compliance | Eventually consistent (immutable once written) | Loss would require reconstruction from PostgreSQL; data is redundant. |
+
+### 2.2 Stateless Components (Kubernetes)
+
+| Component | Replicas | Recovery Mechanism |
+|-----------|----------|--------------------|
+| `arf-api` | 3 (auto‑scaled to 10) | Re‑deployment from container image; ConfigMap and Secret mounted from Kubernetes. |
+| `arf-gateway` | 3 (auto‑scaled to 10) | Re‑deployment; configuration via environment variables. |
+
+---
+
+## 3. Bayesian Risk Model for Recovery
+
+We model the probability of a successful recovery as a Bayesian update problem. Let \(R\) be the event “successful recovery within RTO and RPO.” We assume a Beta prior for the probability of success, updated by the results of regular disaster recovery drills.
+
+\[
+P(R \mid \text{data}) \sim \text{Beta}(\alpha_0 + s,\ \beta_0 + f)
+\]
+
+where \(s\) is the number of successful drills and \(f\) the number of failed drills. We set a prior \(\text{Beta}(2,2)\) (weakly informative, mean 0.5). The posterior after \(n\) drills with \(s\) successes is used to compute the probability that the true recovery success rate exceeds the target of 0.99:
+
+\[
+\mathbb{P}(\theta_R > 0.99 \mid s, n) = 1 - I_{0.99}(\alpha_0 + s,\ \beta_0 + (n - s))
+\]
+
+This probability must exceed 0.95 before the platform can be considered production‑ready.
+
+### 3.1 Example
+
+After 10 successful drills and 0 failures, the posterior is \(\text{Beta}(12, 2)\). The probability that the true recovery rate exceeds 0.99 is
+
+\[
+1 - I_{0.99}(12, 2) \approx 0.9999,
+\]
+
+indicating very high confidence.
+
+---
+
+## 4. Backup Procedures
+
+### 4.1 PostgreSQL – Automated RDS Snapshots
+
+**Frequency:** Every 1 hour, retained for 30 days.
+**Continuous WAL archiving:** Enabled for point‑in‑time recovery with 5‑minute granularity.
+
+```bash
+# Verify backup configuration
+aws rds describe-db-instances \
+  --db-instance-identifier arf-postgres \
+  --query 'DBInstances[0].{BackupRetentionPeriod:BackupRetentionPeriod,PreferredBackupWindow:PreferredBackupWindow}'
+
+# Verify WAL archiving
+aws rds describe-db-log-files \
+  --db-instance-identifier arf-postgres \
+  --query 'DBLogFiles[?LogFileName==`wal_archive.log`]'
+```
+
+### 4.2 PostgreSQL – Pre‑Upgrade Snapshot
+
+```bash
+aws rds create-db-snapshot \
+  --db-instance-identifier arf-postgres \
+  --db-snapshot-identifier arf-pre-upgrade-$(date +%Y%m%d-%H%M)
+```
+
+### 4.3 Redis – AOF Snapshots
+
+**Frequency:** Every 5 minutes via Kubernetes CronJob.
+
+```yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: redis-backup
+  namespace: arf-system
+spec:
+  schedule: "*/5 * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: backup
+              image: amazon/aws-cli
+              command: ["/bin/sh", "-c"]
+              args:
+                - |
+                  redis-cli -h $REDIS_HOST BGREWRITEAOF
+                  sleep 10
+                  aws s3 cp /data/appendonly.aof s3://arf-backups/redis/$(date +%Y%m%d-%H%M).aof
+              env:
+                - name: REDIS_HOST
+                  valueFrom:
+                    secretKeyRef:
+                      name: arf-api-secrets
+                      key: ARF_REDIS_URL
+          restartPolicy: OnFailure
+```
+
+### 4.4 Audit Log Exports to S3
+
+**Frequency:** Daily, at midnight UTC.
+
+```bash
+#!/bin/bash
+# arf-audit-export.sh
+DATABASE_URL=$(kubectl get secret arf-api-secrets -n arf-system -o jsonpath='{.data.DATABASE_URL}' | base64 -d)
+psql $DATABASE_URL -c "\copy (SELECT row_to_json(t) FROM decision_audit_log t WHERE timestamp > NOW() - INTERVAL '1 day') TO '/tmp/audit_export.json'"
+aws s3 cp /tmp/audit_export.json s3://arf-backups/audit-logs/$(date +%Y%m%d).json
+```
+
+Deployed as a Kubernetes CronJob:
+
+```yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: audit-log-export
+  namespace: arf-system
+spec:
+  schedule: "0 0 * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: exporter
+              image: amazon/aws-cli
+              command: ["/bin/sh", "-c"]
+              args:
+                - |
+                  psql $DATABASE_URL -c "\copy (SELECT row_to_json(t) FROM decision_audit_log t WHERE timestamp > NOW() - INTERVAL '1 day') TO '/tmp/audit_export.json'"
+                  aws s3 cp /tmp/audit_export.json s3://arf-backups/audit-logs/$(date +%Y%m%d).json
+              env:
+                - name: DATABASE_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: arf-api-secrets
+                      key: DATABASE_URL
+          restartPolicy: OnFailure
+```
+
+5\. Restore Procedures
+----------------------
+
+### 5.1 PostgreSQL – Full Database Restore from Latest Snapshot
+
+```bash
+# 1. Restore the latest automated snapshot
+LATEST_SNAPSHOT=$(aws rds describe-db-snapshots \
+  --db-instance-identifier arf-postgres \
+  --snapshot-type automated \
+  --query 'DBSnapshots[-1].DBSnapshotIdentifier' \
+  --output text)
+
+aws rds restore-db-instance-from-db-snapshot \
+  --db-instance-identifier arf-postgres-restored \
+  --db-snapshot-identifier $LATEST_SNAPSHOT
+
+# 2. Wait for instance availability
+aws rds wait db-instance-available --db-instance-identifier arf-postgres-restored
+
+# 3. Update the Kubernetes Secret with the new endpoint
+NEW_ENDPOINT=$(aws rds describe-db-instances \
+  --db-instance-identifier arf-postgres-restored \
+  --query 'DBInstances[0].Endpoint.Address' \
+  --output text)
+
+kubectl create secret generic arf-api-secrets \
+  --namespace arf-system \
+  --from-literal=DATABASE_URL="postgresql://user:password@${NEW_ENDPOINT}:5432/arf" \
+  --from-literal=ARF_INTERNAL_API_KEY="$(kubectl get secret arf-api-secrets -n arf-system -o jsonpath='{.data.ARF_INTERNAL_API_KEY}' | base64 -d)" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# 4. Restart API pods to reload configuration
+kubectl rollout restart deployment/arf-api -n arf-system
+```
+
+### 5.2 PostgreSQL – Point‑in‑Time Recovery
+
+```bash
+RESTORE_TIME="2026-07-08T14:30:00Z"
+
+aws rds restore-db-instance-to-point-in-time \
+  --source-db-instance-identifier arf-postgres \
+  --target-db-instance-identifier arf-postgres-pitr \
+  --restore-time $RESTORE_TIME
+# Follow steps 2–4 from Section 5.1.
+```
+
+### 5.3 Redis – Restore from AOF
+
+```bash
+# 1. Scale down Redis to prevent writes during restoration
+kubectl scale deployment arf-redis --replicas=0 -n arf-system
+
+# 2. Copy the latest AOF file to the Redis data directory
+LATEST_AOF=$(aws s3 ls s3://arf-backups/redis/ | sort | tail -1 | awk '{print $4}')
+aws s3 cp s3://arf-backups/redis/$LATEST_AOF /data/appendonly.aof
+
+# 3. Restart Redis
+kubectl scale deployment arf-redis --replicas=1 -n arf-system
+```
+
+### 5.4 Full Cluster Recovery
+
+```bash
+# Apply all manifests in dependency order
+kubectl apply -f deploy/kubernetes/arf-api/configmap.yaml
+kubectl apply -f deploy/kubernetes/arf-api/secret.yaml
+kubectl apply -f deploy/kubernetes/arf-api/networkpolicy.yaml
+kubectl apply -f deploy/kubernetes/arf-api/deployment.yaml
+kubectl apply -f deploy/kubernetes/arf-api/service.yaml
+kubectl apply -f deploy/kubernetes/arf-api/hpa.yaml
+kubectl apply -f deploy/kubernetes/arf-gateway/deployment.yaml
+kubectl apply -f deploy/kubernetes/arf-gateway/service.yaml
+kubectl apply -f deploy/kubernetes/arf-gateway/hpa.yaml
+
+# Verify all pods are running
+kubectl get pods -n arf-system
+```
+
+6\. Post‑Recovery Verification
+------------------------------
+
+### 6.1 Cryptographic Audit Log Integrity Check
+
+This procedure uses the hash‑chained structure of the decision\_audit\_log to verify that no entries have been tampered with or lost during recovery.
+
+```python
+import hashlib
+import psycopg2
+
+def verify_audit_log_chain(db_url):
+    conn = psycopg2.connect(db_url)
+    cur = conn.cursor()
+    cur.execute("SELECT id, deterministic_id, context_hash, signature FROM decision_audit_log ORDER BY timestamp")
+    prev_hash = None
+    for row in cur.fetchall():
+        entry_id, det_id, ctx_hash, sig = row
+        # Recompute the intent hash from the stored fields
+        # (simplified; actual verification uses the full canonical JSON)
+        computed = hashlib.sha256(f"{det_id}:{ctx_hash}:{prev_hash or ''}".encode()).hexdigest()
+        # In production, the full Ed25519 signature verification would be performed.
+        prev_hash = computed
+    cur.close()
+    conn.close()
+    return True
+```
+
+### 6.2 Conjugate Posterior State Validation
+
+```python
+from agentic_reliability_framework.core.governance.risk_engine import ActionCategory
+
+def validate_beta_state(risk_engine, expected_state):
+    for category, (alpha, beta) in expected_state.items():
+        actual = risk_engine._beta_stores["__default__"].get(category)
+        assert abs(actual[0] - alpha) < 1e-6, f"Alpha mismatch for {category}"
+        assert abs(actual[1] - beta) < 1e-6, f"Beta mismatch for {category}"
+```
+
+### 6.3 Automated Smoke Test
+
+```bash
+#!/bin/bash
+# smoke-test.sh
+GW_URL="http://arf-gateway.xxxxx.elb.amazonaws.com:8080"
+TENANT="test-tenant"
+
+# Health check
+curl -s -f $GW_URL/health || { echo "Health check failed"; exit 1; }
+
+# Evaluation
+RESP=$(curl -s -X POST $GW_URL/api/v1/intents/evaluate \
+  -H "Content-Type: application/json" \
+  -H "X-Tenant-ID: $TENANT" \
+  -d '{"intent_type":"provision_resource","environment":"dev","resource_type":"database","region":"eastus","size":"Standard","estimated_cost":1200,"policy_violations":[],"requester":"alice","provenance":{},"configuration":{}}')
+RISK=$(echo $RESP | jq -r '.risk_score')
+if [ -z "$RISK" ] || [ "$RISK" = "null" ]; then
+  echo "Evaluation failed: $RESP"
+  exit 1
+fi
+echo "Smoke test passed. Risk score: $RISK"
+```
+
+7\. Chaos Engineering & Resilience Testing
+------------------------------------------
+
+### 7.1 Pod Deletion Test
+
+```bash
+# Randomly delete an API pod; verify that the service continues to serve requests without error.
+kubectl delete pod -l app=arf-api -n arf-system --grace-period=1
+sleep 5
+# Run smoke test
+./smoke-test.sh
+```
+
+### 7.2 Network Partition Simulation
+
+```bash
+# Apply a NetworkPolicy that temporarily denies ingress to the API from the gateway,
+# then verify that the gateway returns 503.
+kubectl apply -f - <<EOF
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: arf-api-deny-all
+  namespace: arf-system
+spec:
+  podSelector:
+    matchLabels:
+      app: arf-api
+  policyTypes:
+    - Ingress
+EOF
+
+sleep 5
+# Gateway should return 503 Service Unavailable
+curl -s -o /dev/null -w "%{http_code}" $GW_URL/health | grep 503
+
+# Revert
+kubectl delete networkpolicy arf-api-deny-all -n arf-system
+```
+
+### 7.3 Database Connection Failure
+
+```bash
+# Simulate a database outage by temporarily misconfiguring the Secret.
+kubectl create secret generic arf-api-secrets \
+  --namespace arf-system \
+  --from-literal=DATABASE_URL="postgresql://nonexistent:5432/arf" \
+  --dry-run=client -o yaml | kubectl apply -f -
+kubectl rollout restart deployment/arf-api -n arf-system
+
+# Verify that the readiness probe fails (pods should not become ready).
+kubectl wait --for=condition=ready pod -l app=arf-api -n arf-system --timeout=60s || echo "Expected: pods not ready"
+# Restore the correct secret and restart.
+```
+
+8\. Continuous Improvement and Bayesian Updates
+-----------------------------------------------
+
+After each disaster recovery drill, we update the Beta posterior for the recovery success probability using the procedure in Section 3. The results are reviewed quarterly:
+
+Drill DateSuccess (s)Failure (f)Posterior αPosterior βP(θ > 0.99)2026‑07‑0810320.6875(target)1001220.9999
+
+The posterior probability is used to decide whether the platform can be promoted from pilot to production.
+
+9\. Alignment with Regulatory Frameworks
+----------------------------------------
+
+FrameworkRequirementARF DR CapabilityNIST AI RMF Manage‑4Post‑deployment monitoring and incident responseAutomated backups, disaster recovery tests, continuous recalibrationEU AI Act Art. 12Record‑keeping and data integrityHash‑chained audit logs verified after recoverySOC 2 A1.1Availability commitmentsRTO ≤ 15 minutes, RPO ≤ 5 minutesISO/IEC 42001 §8.2Operational resilienceChaos engineering tests, rolling updates, multi‑AZ deployment
+
+10\. Document Maintenance
+-------------------------
+
+This document is reviewed and updated quarterly, or after any major infrastructure change. The revision history is maintained in the repository.
+
+VersionDateAuthorChanges1.02026‑07‑08ARF EngineeringInitial version2.02026‑07‑08ARF EngineeringExtended with Bayesian risk model, chaos engineering, regulatory alignment
+
+_This document is proprietary and access‑controlled. Distribution is limited to qualified pilots and enterprise customers under written agreement._

docs/pilot-readiness.md

@@ -0,0 +1,125 @@
+
+### 12.2 Key Manifests
+
+| Repository | File | Purpose |
+|------------|------|---------|
+| `arf-api` | `deploy/kubernetes/arf-api/deployment.yaml` | API Deployment (3 replicas) |
+| `arf-api` | `deploy/kubernetes/arf-api/service.yaml` | API ClusterIP Service |
+| `arf-api` | `deploy/kubernetes/arf-api/hpa.yaml` | API HPA (3–10) |
+| `arf-api` | `deploy/kubernetes/arf-api/networkpolicy.yaml` | Restrict ingress to gateway |
+| `arf-api` | `deploy/kubernetes/arf-api/configmap.yaml` | Non‑sensitive config |
+| `arf-api` | `deploy/kubernetes/arf-api/secret.yaml` | Sensitive values |
+| `arf-gateway` | `deploy/kubernetes/arf-gateway/deployment.yaml` | Gateway Deployment (3 replicas) |
+| `arf-gateway` | `deploy/kubernetes/arf-gateway/service.yaml` | LoadBalancer Service |
+| `arf-gateway` | `deploy/kubernetes/arf-gateway/hpa.yaml` | Gateway HPA (3–10) |
+
+---
+
+## 13. Test & Verification Evidence
+
+### 13.1 Pressure Test Suite
+
+**44 tests, 100% pass rate.**  Covers:
+
+- Bayesian conjugate updates
+- Policy condition evaluation
+- Governance loop integration
+- HealingIntent serialization
+- Edge cases (zero data, large data, concurrency)
+
+### 13.2 Formal Verification Suite
+
+**7 property‑based test classes with 60,000+ examples.**
+
+| Test | Examples | Result |
+|------|----------|--------|
+| Determinism (10,000 runs) | 10,000 | ✅ 1 unique hash |
+| Criticality monotonicity | 5,000 | ✅ No violations |
+| Stability gate cross‑validation | 10,000 | ✅ All within 1e‑12 |
+| Skill gate monotonicity | 5,000 | ✅ No violations |
+| Context hash determinism | 5,000 | ✅ Order‑independent |
+| CUSUM optimality | 1,000 | ✅ Detection ≤150 steps |
+| Conjugate update correctness | — | ✅ α, β match theory |
+
+### 13.3 Performance Benchmarks
+
+| Operation | p50 | p99 | Target |
+|-----------|-----|-----|--------|
+| Full governance loop | < 50 ms | < 100 ms | ✅ Met |
+| Risk calculation | < 1 ms | < 5 ms | ✅ Met |
+| HealingIntent serialization | < 5 ms | < 10 ms | ✅ Met |
+
+### 13.4 Integration Tests
+
+**8 end‑to‑end tests** covering the full HTTP → API → governance → audit pipeline,
+including skill context, criticality, and outcome recording.
+
+---
+
+## 14. Roadmap & Future
+
+### 14.1 v4.3.3 (Q4 2026)
+
+- Multi‑agent Lyapunov coupling
+- Emergent behavior detection
+- Gateway Prometheus metrics
+- Brute‑force protection on API keys
+- Dependency vulnerability scanning in CI
+
+### 14.2 v4.4 (Q1 2027)
+
+- Gaussian Process sandbox dynamics
+- Active GP‑based stability control
+- Multi‑objective policy optimisation
+- Helm charts for all components
+
+### 14.3 v5.0 (Q2 2027)
+
+- Federated learning of risk models across tenants
+- Integration with major cloud policy frameworks (AWS SCP, Azure Policy)
+- Certified NIST AI RMF profile
+
+---
+
+## 15. Next Steps
+
+1. **Identify a design partner** in a regulated sector (finance, healthcare, telecom, energy).
+2. **Execute a mutual NDA** and share this package.
+3. **Schedule a 2‑hour technical deep‑dive** with the partner’s SRE and security teams.
+4. **Deploy the sandbox** in the partner’s Kubernetes environment (Week 1).
+5. **Begin the 8‑week pilot program** as described in Section 10.
+
+---
+
+## 16. Appendices
+
+### A. Glossary
+
+| Term | Definition |
+|------|------------|
+| CVaR | Conditional Value‑at‑Risk – expected loss in the worst 5% of outcomes |
+| CUSUM | Cumulative Sum – sequential change‑detection algorithm |
+| E‑value | Minimum confounding strength needed to nullify a causal effect |
+| HMC | Hamiltonian Monte Carlo – Bayesian sampling method |
+| IPW | Inverse Probability Weighting – causal effect estimator |
+| TLA⁺ | Temporal Logic of Actions – formal specification language |
+
+### B. Code Repositories
+
+| Repository | Purpose | Access |
+|------------|---------|--------|
+| `agentic_reliability_framework` | Core Bayesian engine, governance loop, policies | Private |
+| `arf-api` | FastAPI control plane, database models, routes | Private |
+| `enterprise` | Rust execution ladder, safety gates | Private |
+| `arf-gateway` | Go reverse proxy with auth, rate limiting, circuit breaker | Private |
+
+### C. Contact
+
+**Juan Petter**  
+Founder & Steward, Agentic Reliability Framework  
+Email: juan@arf-ai.com  
+Website: https://arf-ai.com  
+
+---
+
+*This document is proprietary and access‑controlled. Distribution is limited to qualified pilots and enterprise customers under written agreement. No part of this document may be reproduced, distributed, or used for AI training without express written permission.*

docs/regulatory-mapping.md

@@ -0,0 +1,212 @@
+# ARF Comprehensive Regulatory Alignment & Compliance Handbook
+## NIST AI RMF 1.0, EU AI Act, ISO/IEC 42001, SOC 2, GDPR, and More
+
+**Document Version:** 2.0  
+**ARF Version:** v4.3.2  
+**Date:** July 8, 2026  
+**Classification:** Proprietary – Access‑Controlled  
+
+---
+
+## 1. Introduction
+
+The Agentic Reliability Framework (ARF) is a governance control plane for AI‑driven infrastructure operations. This document provides an exhaustive, auditable mapping between ARF's capabilities and the requirements of global regulatory frameworks applicable to high‑risk AI systems in critical infrastructure.
+
+It is intended for:
+- **Design partners** evaluating ARF for regulated deployments.
+- **Compliance officers** preparing for certification audits.
+- **Independent auditors** verifying the platform's claims.
+- **Regulators** assessing the adequacy of ARF’s governance controls.
+
+Every mapping includes a **code reference**, **audit evidence location**, and **verification procedure** so that claims can be tested without relying on vendor assertions.
+
+---
+
+## 2. Framework Overview
+
+ARF addresses the following frameworks:
+
+| Framework | Jurisdiction | Status | ARF Alignment |
+|-----------|--------------|--------|---------------|
+| **NIST AI RMF 1.0** | United States | Active (revision underway) | Full – Govern, Map, Measure, Manage |
+| **EU AI Act** | European Union | In force | Full – Articles 9–16, Annex IV |
+| **ISO/IEC 42001:2023** | International | Published | Full – AI management system |
+| **SOC 2 (Trust Services Criteria)** | International (AICPA) | Widely adopted | Security, Availability, Confidentiality |
+| **GDPR** | European Union | In force | Data protection by design, right to explanation |
+| **NIST SP 800‑53** | United States | Active | Security and privacy controls |
+| **OWASP Top 10 for LLM Applications** | International | Best practice | Prompt injection, supply chain |
+
+---
+
+## 3. Detailed Framework Mappings
+
+### 3.1 NIST AI RMF 1.0
+
+The NIST AI RMF is organized into four core functions: **Govern**, **Map**, **Measure**, and **Manage**.  ARF addresses each function with specific technical controls.
+
+#### 3.1.1 Govern
+
+| NIST Subcategory | ARF Capability | Code Reference | Audit Evidence | Verification Procedure |
+|------------------|----------------|----------------|----------------|------------------------|
+| **GOV‑1: Policies, processes, and procedures** | Policy algebra (TLA⁺ verified); criticality parameter; pre‑built policy packs | `policies.py` (PolicyAlgebra), `gates.rs` (dynamic thresholds), `policy_engine.py` (healing policies), `policy_packs/` | Policy tree definitions stored in ConfigMap; every decision logs which policies were checked. | 1. Export the active policy tree from the ConfigMap. 2. Run TLC on PolicyAlgebra.tla to verify algebraic laws. 3. Verify that 100% of decisions in the audit log include policy violation lists. |
+| **GOV‑2: Roles, responsibilities, and delegated authority** | Gateway RBAC via API key tiers; internal API key protects governance endpoints; human‑override fields in `HealingIntent`. | `auth/apikey.go` (gateway), `deps.py` (verify_internal_key), `healing_intent.py` (human_overrides, approvals) | Gateway access logs show per‑key requests; audit log entries record approver identity for overridden decisions. | 1. Attempt to call the API directly without X‑Internal‑Key; confirm 401. 2. Call the API with a read‑only tier key; confirm that outcome recording fails. 3. Inspect the audit log for any decision with `status=approved_with_overrides` and verify the `approved_by` field is populated. |
+| **GOV‑4: AI risk management integration with organizational risk** | Bayesian risk scores feed into CVaR loss minimization; stability and drift flags provide continuous risk signals. | `risk_engine.py`, `governance_loop.py` (CVaR, stability, drift) | Every `HealingIntent` carries a risk score, epistemic breakdown, and stability/drift metadata. | 1. Query the audit log for any decision where `risk_score > 0.8` and verify that the action was DENY or ESCALATE. 2. Verify that `lyapunov_stable` and `temporal_drift_detected` are present in every `HealingIntent.metadata`. |
+| **GOV‑5: Continuous improvement** | Conjugate Beta updates, online recalibration, memory‑weight optimization, and causal effect re‑estimation after every outcome. | `risk_engine.py` (update_outcome, _maybe_recalibrate), `memory_weight_optimizer.py`, `causal_effect_estimator.py` | Outcome log shows feedback loop; recalibration events are logged. | 1. Record a sequence of outcomes; verify that the conjugate α and β values change as expected. 2. Verify that after 100 outcomes, the `risk_engine` recalibrates if ECE exceeds 0.1. |
+
+#### 3.1.2 Map
+
+| NIST Subcategory | ARF Capability | Code Reference | Audit Evidence | Verification Procedure |
+|------------------|----------------|----------------|----------------|------------------------|
+| **MAP‑1: Context and intended use** | `InfrastructureIntent` carries provenance, environment, requester identity; `context_hash` cryptographically binds all inputs. | `intents.py` (InfrastructureIntent), `healing_intent.py` (context_hash), `governance_loop.py` (context extraction) | `HealingIntent.context_hash` is a SHA‑256 of the canonical context; auditor can recompute and verify. | 1. For any decision in the audit log, retrieve the stored context and recompute `SHA‑256(canonical_json(context))`. 2. Assert equality with the stored `context_hash`. |
+| **MAP‑2: AI system categorization** | `RiskEngine` categorizes every intent into action categories (database, network, compute, security) with category‑specific priors. | `risk_engine.py` (categorize_intent, PRIORS) | The `risk_score` explanation string includes the category; audit log records the category. | 1. Submit intents of each type (ProvisionResource, GrantAccess, DeployConfiguration). 2. Verify that the risk explanation string contains the correct category. |
+| **MAP‑3: AI capabilities, limitations, and appropriate use** | Skill registry tracks per‑skill reliability; skill gate blocks unreliable skills; counterfactual explanations describe limitations. | `skill_registry.py`, `gates.rs` (SkillGate), `causal_effect_estimator.py` (generate_counterfactual) | Skill alpha/beta values are logged; counterfactual text is included in every `HealingIntent`. | 1. Register a new skill with no history. 2. Submit an intent with that skill; verify that the SkillGate blocks it (P(θ>0.5) < 0.95). 3. Submit an intent with a well‑established skill (α=20, β=3); verify that the SkillGate passes. |
+| **MAP‑4: Risk mapping to AI system lifecycle** | Time‑decayed risk and temporal drift detection monitor risk evolution over time. | `governance_loop.py` (time‑decayed risk, temporal drift), `temporal_reliability.py` | `HealingIntent.metadata.decayed_risk`, `.temporal_drift_detected` | 1. Run 100 decisions with a fixed risk score; verify that `decayed_risk` converges to the input risk. 2. Inject a sudden risk spike; verify that `temporal_drift_detected` becomes True within the CUSUM threshold. |
+
+#### 3.1.3 Measure
+
+| NIST Subcategory | ARF Capability | Code Reference | Audit Evidence | Verification Procedure |
+|------------------|----------------|----------------|----------------|------------------------|
+| **MEASURE‑1: Risk measurement methodologies** | Bayesian risk fusion (conjugate + hyperprior + HMC), CVaR, epistemic uncertainty decomposition (CUDL Shapley values). | `risk_engine.py` (calculate_risk), `governance_loop.py` (CVaR, epistemic), `research/cudl/` | `HealingIntent` contains risk score, epistemic breakdown, and Shapley attribution. | 1. Submit an intent with known risk factors; verify that `risk_factors` sum to the `risk_score`. 2. Enable epistemic probing; verify that `epistemic_breakdown` contains hallucination, forecast, and sparsity components. |
+| **MEASURE‑2: Evaluation of trustworthiness characteristics** | Lyapunov stability monitoring, CUSUM drift detection, Expected Calibration Error (ECE) recalibration, E‑value sensitivity analysis. | `stability_controller.py`, `temporal_reliability.py`, `risk_engine.py` (ECE), `causal_effect_estimator.py` (E‑value) | `HealingIntent.metadata.lyapunov_stable`, `.temporal_drift_detected`; E‑values reported with ATE estimates. | 1. Run two consecutive decisions with increasing risk; verify that `lyapunov_stable` becomes False. 2. Compute the E‑value for a known ATE; verify that it matches the formula `RR + sqrt(RR(RR‑1))`. |
+| **MEASURE‑3: Mechanisms for tracking and responding to emergent risks** | Passive Lyapunov check triggers active stability override; CUSUM drift triggers recalibration; skill gate blocks unproven skills. | `governance_loop.py` (active stability response), `gates.rs` (StabilityGate, SkillGate) | Gate failure reasons are logged; stability override events are recorded. | 1. Artificially destabilize the Lyapunov monitor by alternating risk/psi; verify that the active stability response overrides the decision to ESCALATE. 2. Inject a skill with α=3, β=3; verify that the SkillGate fails with a message containing "Bayesian confidence low". |
+
+#### 3.1.4 Manage
+
+| NIST Subcategory | ARF Capability | Code Reference | Audit Evidence | Verification Procedure |
+|------------------|----------------|----------------|----------------|------------------------|
+| **MANAGE‑1: Risk treatment strategies** | Three‑action decision (approve, deny, escalate) based on posterior expected loss minimization; human‑in‑the‑loop overrides. | `governance_loop.py` (decision rule), `healing_intent.py` (human_overrides) | `HealingIntent.action` and `.status` fields; audit log records the final decision and any overrides. | 1. Submit an intent with policy violations; verify action is DENY. 2. Submit an intent with high epistemic uncertainty; verify action is ESCALATE. 3. Submit an intent with low risk and no violations; verify action is APPROVE. |
+| **MANAGE‑2: Documentation and reporting** | Immutable, hash‑chained audit log; every decision carries full trace (risk score, justification, counterfactual, metadata). | `routes_governance.py` (write_audit_log), `models_intents.py` (DecisionAuditLogDB) | The `decision_audit_log` table is queryable by tenant and timestamp; hashes are cryptographically verifiable. | 1. Query the audit log for a specific tenant and date range; verify that all decisions are present and ordered. 2. Select two consecutive entries; verify that the hash chain is intact. |
+| **MANAGE‑3: Stakeholder communication** | Plain‑language justification; counterfactual explanation; advisory‑only status for OSS edition. | `healing_intent.py` (justification, metadata.counterfactual) | Every decision response includes a human‑readable explanation. | 1. Call the `/intents/evaluate` endpoint; verify that the response includes a `justification` field with a plain‑language explanation. 2. Verify that when a causal model is available, the response includes a `counterfactual` field. |
+| **MANAGE‑4: Post‑deployment monitoring** | Outcome feedback loop updates conjugate posteriors, memory weights, and causal estimates; usage tracker provides quota visibility. | `outcome_service.py`, `risk_engine.py` (update_outcome), `usage_tracker.py` | Outcome log shows feedback events; usage tracker shows remaining quota. | 1. Record an outcome via the `/intents/outcome` endpoint; verify that the risk engine's conjugate parameters have changed. 2. Call the `/auth/info` endpoint via the gateway; verify that `remaining` decreases after each evaluation. |
+
+---
+
+### 3.2 EU AI Act
+
+ARF is designed to govern AI‑driven infrastructure actions, which may be classified as high‑risk under the EU AI Act when they affect critical infrastructure.
+
+| Article | Requirement | ARF Capability | Code Reference | Audit Evidence | Verification Procedure |
+|---------|-------------|----------------|----------------|----------------|------------------------|
+| **Art. 9** | Risk management system | CVaR expected loss minimization; StabilityGate blocks when platform is unstable; temporal drift triggers recalibration. | `governance_loop.py` (CVaR, stability), `gates.rs` (StabilityGate), `risk_engine.py` (recalibration) | Every `HealingIntent` contains risk score, CVaR usage flag, stability sample, and drift metadata. | Same as NIST Measure‑1/Measure‑3. |
+| **Art. 10** | Data governance and data quality | `context_hash` cryptographically binds decisions to input data; `provenance` field in intent tracks data origin. | `healing_intent.py` (context_hash), `intents.py` (provenance) | Auditor can recompute `context_hash` from stored context; provenance chain is logged. | Same as NIST Map‑1. |
+| **Art. 11** | Technical documentation | Immutable audit log; `HealingIntent` carries full decision trace including pre‑/post‑memory risk, epistemic breakdown, counterfactual. | `models_intents.py` (DecisionAuditLogDB), `healing_intent.py` (to_enterprise_request) | Audit log table is queryable; each entry contains the complete decision payload. | Same as NIST Manage‑2. |
+| **Art. 12** | Record‑keeping | Every decision logged with timestamp, tenant, risk score, action, justification; logs are hash‑chained and Ed25519‑signed. | `routes_governance.py` (write_audit_log), `crypto.py` (Ed25519 signing) | Hash chain integrity can be verified without trusting the runtime; signatures are base64‑encoded Ed25519. | 1. Export the audit log. 2. For each entry, verify the Ed25519 signature using the stored public key. 3. Verify that `SHA‑256(entry_n || entry_n‑1.hash) == entry_n.hash`. |
+| **Art. 13** | Transparency and provision of information | Plain‑language justification; counterfactual explanation; memory‑based evidence summary. | `healing_intent.py` (justification, metadata.counterfactual) | Every API response includes `justification` and `counterfactual` fields. | Same as NIST Manage‑3. |
+| **Art. 14** | Human oversight | Escalate action; human override fields; approval tracking; gateway RBAC for human reviewers. | `governance_loop.py` (decision rule), `healing_intent.py` (with_human_approval), `auth/apikey.go` | `HealingIntent.approvals` records reviewer identity and timestamp; gateway enforces role‑based access. | Same as NIST Govern‑2. |
+| **Art. 15** | Accuracy, robustness, and cybersecurity | Deterministic RNG (SHA‑256 seeded), cryptographic signatures, constant‑time API key comparison, internal API key protection. | `governance_loop.py` (deterministic RNG), `crypto.py` (signatures), `deps.py` (constant‑time compare) | All probabilistic operations are reproducible; tampering with signed intents is detected. | 1. Run the governance loop twice with the same input; verify identical output. 2. Modify one field of a signed `HealingIntent`; verify that `verify()` returns False. |
+| **Art. 16** | Reporting obligations | Usage tracker and audit log provide quota consumption and decision history; Wilson monitor tracks Rust enforcer agreement. | `usage_tracker.py`, `models_intents.py`, `wilson_monitor.py` | Usage and audit logs are queryable; Wilson confidence interval is updated every 5 minutes. | 1. Query the usage log for a given API key; verify that monthly counts match the quota. 2. Verify that the Wilson monitor emits a Prometheus metric with the current confidence interval. |
+
+---
+
+### 3.3 ISO/IEC 42001:2023 – AI Management System
+
+ISO/IEC 42001 provides a certifiable framework for an AI management system. ARF can serve as the technical enforcement layer for the controls required by this standard.
+
+| Clause | Requirement | ARF Capability | Code Reference |
+|--------|-------------|----------------|----------------|
+| 4.1 | Understanding the organization and its context | `InfrastructureIntent` captures operational context; `context_hash` binds it to decisions. | `intents.py`, `healing_intent.py` |
+| 5.1 | Leadership and commitment | Criticality parameter allows leadership to set risk appetite. | `infrastructure_intents.py` (criticality) |
+| 6.1 | Actions to address risks and opportunities | Full Bayesian risk pipeline, CVaR, stability monitoring. | `risk_engine.py`, `governance_loop.py` |
+| 7.5 | Documented information | Immutable, hash‑chained audit log. | `models_intents.py`, `routes_governance.py` |
+| 8.1 | Operational planning and control | Policy engine enforces rules; gates block unsafe actions. | `policies.py`, `gates.rs` |
+| 9.1 | Monitoring, measurement, analysis, and evaluation | Epistemic uncertainty, Shapley decomposition, ECE recalibration, Lyapunov stability, CUSUM drift. | `governance_loop.py`, `stability_controller.py`, `temporal_reliability.py` |
+| 10.1 | Continual improvement | Conjugate updates, memory weight optimization, causal re‑estimation. | `risk_engine.py`, `memory_weight_optimizer.py`, `causal_effect_estimator.py` |
+
+---
+
+### 3.4 SOC 2 (Trust Services Criteria)
+
+SOC 2 evaluates the security, availability, processing integrity, confidentiality, and privacy of a system.
+
+| Trust Service Criterion | ARF Capability | Code Reference |
+|--------------------------|----------------|----------------|
+| **Security** (CC6.1, CC6.6) | Internal API key authentication, constant‑time comparison, gateway salted SHA‑256 hashing, RBAC. | `deps.py` (verify_internal_key), `auth/apikey.go` |
+| **Availability** (A1.1, A1.2) | Kubernetes HPA (3–10 replicas), liveness/readiness probes, rolling updates. | `deploy/kubernetes/arf‑api/hpa.yaml`, `deployment.yaml` |
+| **Confidentiality** (C1.1) | NetworkPolicy restricts API to gateway only; CORS restricted to specific origin. | `networkpolicy.yaml`, `main.py` (CORS) |
+| **Processing Integrity** (PI1.2, PI1.3) | Deterministic policy evaluation, TLA⁺ verified algebra, property‑based testing. | `PolicyAlgebra.tla`, `test_policy_properties.py`, `proptest_policy.rs` |
+| **Privacy** (P1.1, P4.1) | Tenant isolation in risk engine; API keys scoped to tenants; usage data retained per retention policy. | `risk_engine.py` (tenant isolation), `usage_tracker.py` (retention) |
+
+---
+
+### 3.5 GDPR (General Data Protection Regulation)
+
+For deployments processing personal data, ARF provides the following controls:
+
+| GDPR Article | Requirement | ARF Capability |
+|--------------|-------------|----------------|
+| Art. 5(1)(f) | Integrity and confidentiality | Cryptographic signatures, hash‑chained audit log, constant‑time API key verification. |
+| Art. 25 | Data protection by design | `context_hash` minimizes the need to store raw personal data; only hashes are retained. |
+| Art. 30 | Records of processing activities | Audit log provides a complete record of all decisions, including requester identity and justification. |
+| Art. 35 | Data protection impact assessment | Risk scores, epistemic uncertainty, and counterfactuals provide evidence for DPIAs. |
+| Art. 22 | Automated individual decision‑making | Human‑in‑the‑loop override ensures that no solely automated decision is made without review capability. |
+
+---
+
+## 4. Cross‑Framework Alignment Matrix
+
+| Requirement Category | NIST AI RMF | EU AI Act | ISO 42001 | SOC 2 | GDPR | ARF Feature(s) |
+|----------------------|-------------|-----------|-----------|-------|------|----------------|
+| Risk identification and quantification | Measure‑1, Measure‑2 | Art. 9 | 6.1 | — | Art. 35 | Bayesian risk fusion, CVaR, epistemic uncertainty, E‑value |
+| Policy enforcement and controls | Govern‑1, Manage‑1 | Art. 9, Art. 14 | 8.1 | PI1.2 | Art. 22 | Policy algebra, Rust gates, human override |
+| Data provenance and quality | Map‑1 | Art. 10 | 4.1 | — | Art. 5(1)(f) | `context_hash`, `InfrastructureIntent.provenance` |
+| Documentation and record‑keeping | Manage‑2 | Art. 11, Art. 12 | 7.5 | — | Art. 30 | Immutable audit log, Ed25519 signatures |
+| Transparency and explainability | Map‑3, Manage‑3 | Art. 13 | — | — | Art. 22 | Plain‑language justification, counterfactuals |
+| Continuous monitoring and improvement | Map‑4, Measure‑3, Govern‑5 | Art. 9, Art. 15 | 9.1, 10.1 | — | — | Conjugate updates, stability/drift detection, recalibration |
+| Human oversight | Govern‑2, Manage‑1 | Art. 14 | — | — | Art. 22 | Escalate action, human approval workflow, RBAC |
+| Security and access control | — | Art. 15 | — | CC6.1, CC6.6, C1.1 | Art. 5(1)(f) | Internal API key, gateway auth, NetworkPolicy, CORS |
+| Availability and resilience | — | — | — | A1.1, A1.2 | — | Kubernetes HPA, liveness/readiness probes, rolling updates |
+| Privacy | — | — | — | P1.1, P4.1 | Art. 25 | Tenant isolation, API key scoping, usage retention |
+
+---
+
+## 5. Evidence Collection & Audit Procedure
+
+### 5.1 Automated Evidence Collection
+
+ARF provides the following automated evidence sources:
+
+1. **Audit log (PostgreSQL):** The `decision_audit_log` table contains every governance decision with timestamp, tenant, risk score, action, justification, and cryptographic hashes.
+2. **Prometheus metrics:** `arf_evaluations_total`, `arf_rust_agreement_total`, `arf_evaluation_duration_seconds` provide real‑time observability.
+3. **OpenTelemetry traces:** Every request is traced with a unique `trace_id`, linking gateway logs to API decisions.
+4. **Usage tracker (SQLite/PostgreSQL):** Provides per‑API‑key quota consumption and audit logs.
+
+### 5.2 Independent Auditor Verification Checklist
+
+| Step | Procedure | Expected Outcome |
+|------|-----------|-----------------|
+| 1. Deterministic replay | Run `GovernanceLoop.run()` twice with identical inputs. | SHA‑256 of serialized `HealingIntent` is identical. |
+| 2. Hash chain integrity | Query `decision_audit_log` ordered by timestamp; verify that each hash links to the previous entry. | No broken chains. |
+| 3. Signature verification | For any signed intent, verify the Ed25519 signature using the stored public key fingerprint. | Signature verification returns `True`. |
+| 4. Tamper detection | Modify one field of a signed `HealingIntent` and call `verify()`. | `verify()` returns `False`. |
+| 5. Policy algebra | Run TLC on `PolicyAlgebra.tla`. | All invariants hold. |
+| 6. Cross‑language policy equivalence | Generate random policy trees and evaluate in both Python and Rust; compare violation sets. | Identical violation sets. |
+| 7. Bayesian update correctness | Record a sequence of outcomes; manually compute expected α, β. | `BetaStore` matches manual computation. |
+| 8. Skill gate | Submit intents with varying skill evidence; verify gate behavior. | Low‑evidence skills fail; high‑evidence skills pass. |
+| 9. Criticality‑aware gates | Submit intents with criticality=1.0; verify that tolerance is zero and confidence threshold is 1.0. | High‑criticality actions are blocked unless perfect. |
+| 10. Context hash verification | Retrieve stored context for any decision; recompute SHA‑256. | Matches stored `context_hash`. |
+
+---
+
+## 6. Continuous Compliance Monitoring
+
+ARF includes built‑in mechanisms for ongoing compliance verification:
+
+- **Wilson confidence interval monitor:** Every 5 minutes, the Wilson updater checks the Rust enforcer agreement and adjusts the canary promotion status. This provides a statistical control chart for policy enforcement consistency.
+- **Expected Calibration Error (ECE):** Monitored per tenant and category; triggers recalibration when exceeding 0.1.
+- **Lyapunov stability window:** The StabilityGate blocks execution when the recent stability record is poor, preventing the platform from operating in a degraded state.
+- **Temporal drift detection:** CUSUM tracks sustained drift in risk estimates; alerts when the model becomes stale.
+
+---
+
+## 7. References
+
+- NIST AI RMF 1.0: `https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf`
+- EU AI Act: `https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0206`
+- ISO/IEC 42001:2023: `https://www.iso.org/standard/81230.html`
+- SOC 2 Trust Services Criteria: `https://www.aicpa.org/soc2`
+- GDPR: `https://gdpr-info.eu/`
+- ARF Mathematical Work Journal: `docs/math_journal.md`
+- ARF Policy Algebra TLA⁺ Specification: `agentic_reliability_framework/spec/tla/PolicyAlgebra.tla`
+- ARF Pressure Test Suite: `tests/pressure/test_pressure.py`
+
+*This document is proprietary and access‑controlled. Distribution is limited to qualified pilots and enterprise customers under written agreement.*

docs/security-assessment.md

@@ -0,0 +1,186 @@
+# ARF Security Self‑Assessment & Penetration Test Report
+
+**Version:** 1.0  
+**ARF Version:** v4.3.2  
+**Date:** July 9, 2026  
+**Classification:** Proprietary – Access‑Controlled  
+**Scope:** arf-api, arf-gateway, agentic_reliability_framework  
+
+---
+
+## 1. Executive Summary
+
+This document presents the results of a structured security review of the ARF platform, conducted by the development team and supplemented by manual penetration testing performed by the steward.  It is organized according to the OWASP Top 10 (2021) and includes specific findings, code references, and a risk‑based prioritization of residual gaps.  The Bayesian confidence model introduced in Section 7 quantifies our degree of belief that the platform is secure enough for a regulated pilot deployment.
+
+### 1.1 Overall Risk Rating
+
+| Category | Rating | Explanation |
+|----------|--------|-------------|
+| Confidentiality | **Medium** | Internal API key protects governance endpoints; no encryption at rest for audit logs. |
+| Integrity | **High** | Ed25519 signatures, hash‑chained audit logs, and constant‑time key comparison prevent tampering. |
+| Availability | **High** | Kubernetes HPA, liveness/readiness probes, and rolling updates ensure resilience. |
+| Authentication | **High** | Gateway uses salted SHA‑256 API keys; internal API key prevents direct API access. |
+| Authorization | **Medium** | API key tiers exist but are not granularly enforced at the endpoint level. |
+
+---
+
+## 2. Scope
+
+The security review covered the following components:
+
+| Component | Language | Lines of Code | Reviewed |
+|-----------|----------|---------------|----------|
+| `arf-api` (FastAPI) | Python | ~1,700 | Yes |
+| `arf-gateway` (Go) | Go | ~500 | Yes |
+| `agentic_reliability_framework` | Python | ~15,000 | Partial (core governance only) |
+| `enterprise/arf_execution` (Rust) | Rust | ~1,200 | Partial (gates only) |
+
+**Out of scope:** Third‑party dependencies not directly audited; infrastructure‑level security (AWS IAM, Kubernetes RBAC); physical security.
+
+---
+
+## 3. OWASP Top 10 (2021) Assessment
+
+### 3.1 Broken Access Control (A01)
+
+**Finding:** The API routes previously had no authentication.  This has been **remediated** in v4.3.2 by adding the `verify_internal_key` dependency to the governance router (`routes_governance.py`).  The gateway proxies requests and injects the `X‑Internal‑Key` header.  The API key is compared using a constant‑time algorithm to prevent timing attacks.
+
+**Code evidence:** `app/api/deps.py` (verify_internal_key), `app/api/routes_governance.py` (router dependency).
+
+**Residual risk:** Low.  If the `ARF_INTERNAL_API_KEY` environment variable is not set, the dependency is a no‑op (for local development).  This must be enforced in production via Kubernetes Secrets.
+
+### 3.2 Cryptographic Failures (A02)
+
+**Finding:** No cryptographic failures detected.  The gateway uses salted SHA‑256 for API key storage (`auth/apikey.go`).  `HealingIntent` supports Ed25519 signatures (`healing_intent.py`).  Context hashes use SHA‑256.  Audit logs are hash‑chained.
+
+**Code evidence:** `internal/auth/apikey.go`, `healing_intent.py` (sign/verify), `governance_loop.py` (context_hash).
+
+**Residual risk:** Low.  No known weaknesses in the employed algorithms.
+
+### 3.3 Injection (A03)
+
+**Finding:** The API uses Pydantic models with strict field validation (`BaseIntentRequest`), which mitigates type‑based injection.  The gateway and API do not construct SQL queries with user input directly (the risk engine uses parameterized queries via SQLAlchemy; the gateway uses SQLite with placeholders).  No injection vulnerabilities were found.
+
+**Code evidence:** `models/infrastructure_intents.py` (validators), `usage_tracker.py` (parameterized queries), `auth/apikey.go` (placeholders).
+
+**Residual risk:** Low.
+
+### 3.4 Insecure Design (A04)
+
+**Finding:** No design‑level flaws identified.  The separation of advisory and execution layers, the immutable HealingIntent contract, and the deterministic governance loop are strong design patterns that reduce the attack surface.
+
+**Residual risk:** Low.
+
+### 3.5 Security Misconfiguration (A05)
+
+**Finding:** CORS is restricted to a specific frontend origin in `main.py`.  The Kubernetes NetworkPolicy restricts API access to the gateway pod only.  However, the gateway’s rate‑limiter (token bucket) is configured with a global rate of 100 req/min and burst of 20 – this may be too permissive for some tiers.
+
+**Code evidence:** `app/main.py` (CORS), `deploy/kubernetes/arf-api/networkpolicy.yaml`, `internal/middleware/ratelimit.go`.
+
+**Residual risk:** Medium.  Rate limiting should be tier‑specific.
+
+### 3.6 Vulnerable and Outdated Components (A06)
+
+**Finding:** Dependencies are tracked via `requirements.txt` and `go.mod`.  No automated vulnerability scanning is integrated into CI.  A manual review of the Go dependencies (`go.sum`) shows up‑to‑date packages; Python dependencies were not exhaustively audited.
+
+**Code evidence:** `requirements.txt`, `go.mod`, `go.sum`.
+
+**Residual risk:** Medium.  Recommend integrating `pip‑audit` and `govulncheck` into CI.
+
+### 3.7 Identification and Authentication Failures (A07)
+
+**Finding:** The gateway implements salted SHA‑256 API key hashing with random 16‑byte salts (`auth/apikey.go`).  The API’s internal key uses constant‑time comparison.  No authentication bypasses were found during testing.
+
+**Code evidence:** `auth/apikey.go`, `deps.py` (_constant_time_compare).
+
+**Residual risk:** Low.
+
+### 3.8 Software and Data Integrity Failures (A08)
+
+**Finding:** The `HealingIntent` supports Ed25519 signatures, and audit logs are hash‑chained.  This provides strong integrity guarantees.  However, there is no mechanism to verify the integrity of the governance loop’s Python dependencies at runtime.
+
+**Residual risk:** Medium.  Consider adding a signed SBOM or integrity check for dependencies.
+
+### 3.9 Security Logging and Monitoring Failures (A09)
+
+**Finding:** The gateway uses structured logging (slog) with JSON output to stdout.  The API uses OpenTelemetry tracing and Prometheus metrics.  Audit logs are written to PostgreSQL.  However, there is no centralized log aggregation or alerting configured.
+
+**Residual risk:** Medium.  Recommend integrating a log aggregation system (e.g., Loki, CloudWatch) and alerting on security events (e.g., repeated 401 responses).
+
+### 3.10 Server‑Side Request Forgery (SSRF) (A10)
+
+**Finding:** The gateway proxies requests to the core API URL specified by the `ARF_CORE_URL` environment variable.  If an attacker could manipulate this variable, they could redirect internal traffic.  However, the variable is set at deployment time and cannot be modified via user input.
+
+**Residual risk:** Low.
+
+---
+
+## 4. Additional Security Controls
+
+### 4.1 Internal API Key Protection (v4.3.2)
+
+The governance endpoints are now protected by an internal API key (`X‑Internal‑Key` header), verified via constant‑time comparison.  This ensures that even if an attacker bypasses the gateway, the API itself is not open.  The gateway injects this header for all authenticated requests.
+
+### 4.2 Rate Limiting
+
+The gateway implements a per‑API‑key token‑bucket rate limiter (`internal/middleware/ratelimit.go`).  The default configuration (100 req/min, burst 20) is conservative but may need to be adjusted per tier in production.
+
+### 4.3 Network Segmentation
+
+The Kubernetes `NetworkPolicy` (`deploy/kubernetes/arf-api/networkpolicy.yaml`) restricts ingress to the API pods to only traffic from pods labeled `app: arf-gateway`.  This provides defense‑in‑depth beyond the internal API key.
+
+---
+
+## 5. Penetration Test Findings (Steward‑Reported)
+
+The steward performed manual penetration testing and reported the following:
+
+| Finding | Severity | Status |
+|---------|----------|--------|
+| No authentication on governance endpoints (direct API access) | Critical | **Fixed** (v4.3.2, internal key) |
+| CORS restricted to single origin | Informational | Accepted |
+| Rate limiter bypassable via multiple API keys | Medium | **Open** (recommend per‑tier limits) |
+| No brute‑force protection on API key validation | Medium | **Open** (gateway does not track failed attempts) |
+
+---
+
+## 6. Residual Risk Matrix
+
+| Risk | Likelihood | Impact | Rating | Mitigation |
+|------|------------|--------|--------|------------|
+| Tier‑agnostic rate limiting | Medium | Low | Low | Implement per‑tier rate limits in gateway. |
+| No brute‑force protection | Low | Medium | Low | Add exponential backoff or account lockout after N failed attempts. |
+| Dependency vulnerabilities (unscanned) | Medium | Medium | Medium | Integrate automated scanning into CI. |
+| No centralized log aggregation | High | Low | Medium | Add Loki or CloudWatch log shipping. |
+| Internal key not enforced in dev mode | Low | High | Low | Ensure production Helm chart requires the key. |
+
+---
+
+## 7. Bayesian Confidence Model
+
+We model the platform's security readiness as a Beta distribution over the probability that no critical security vulnerability exists.  We start with a weak Beta(1,1) prior and update based on the findings from this assessment.
+
+- **Positive evidence (α‑1):** API auth fixed, constant‑time key compare, Ed25519 signatures, hash‑chained logs, salted API key hashing, NetworkPolicy, CORS restriction, rate limiter.
+- **Negative evidence (β‑1):** No brute‑force protection, dependency scanning not integrated, no centralized log alerting, rate limiter not tier‑specific.
+
+Posterior: **Beta(9, 5)**.  Posterior mean: **0.64**.  This represents our current degree of belief that the platform is secure enough for a pilot.  The remaining open items would shift this toward Beta(12,5) with mean ~0.71.
+
+---
+
+## 8. Recommendations
+
+| Priority | Recommendation | Effort | Impact |
+|----------|---------------|--------|--------|
+| **P0** | Add brute‑force protection to gateway auth (account lockout after 5 failed attempts). | Small | High |
+| **P0** | Implement per‑tier rate limiting in the gateway. | Medium | Medium |
+| **P1** | Integrate `pip‑audit` and `govulncheck` into CI. | Small | Medium |
+| **P1** | Add centralized log aggregation (Loki or CloudWatch). | Medium | Medium |
+| **P2** | Produce a signed SBOM for the governance loop dependencies. | Small | Low |
+
+---
+
+## 9. Conclusion
+
+ARF’s security posture is adequate for a controlled pilot deployment in a regulated environment, provided the P0 recommendations are addressed before production.  The platform demonstrates strong integrity controls (Ed25519, hash chains) and authentication (salted SHA‑256, internal key).  The residual risks are mitigable with relatively low effort.
+
+*This document is proprietary and access‑controlled. Distribution is limited to qualified pilots and enterprise customers under written agreement.*

render.yaml

@@ -11,8 +11,6 @@ services:
           property: connectionString
       - key: API_KEY
         sync: false
-      - key: ARF_KEY_PEPPER
-        sync: false
       - key: ENVIRONMENT
         value: production
 databases:

requirements.txt

@@ -9,14 +9,9 @@ pydantic-settings
 sqlalchemy
 psycopg2-binary==2.9.10
 slowapi==0.1.9
-limits==3.3.1   # slowapi 0.1.9's own poetry.lock pins this; left unpinned it resolves
-                # to a much newer major version whose internal API to slowapi breaks
-                # (Limiter._check_request_limit raises a plain ValueError instead of
-                # RateLimitExceeded, which slowapi's middleware mishandles as an
-                # unhandled 500 on every request touching a rate limit)
 prometheus-fastapi-instrumentator==7.1.0
 flake8==7.2.0
-cryptography==50.0.0
+cryptography==48.0.1
 sentence-transformers>=2.2.0
 scikit-learn
 redis>=4.0.0   # optional, for faster counters

tests/conftest.py

@@ -18,10 +18,6 @@ import pytest
 # ===== STEP 1: Set environment variables BEFORE any app imports =====
 os.environ["ARF_USAGE_TRACKING"] = "false"
 
-# UsageTracker now requires a real pepper to hash/verify API keys (H-2 fix);
-# tests never touch a production key, so a fixed test-only value is fine.
-os.environ.setdefault("ARF_KEY_PEPPER", "test-only-pepper-not-for-production-use-32chars")
-
 # Force the correct database URL for tests
 os.environ["DATABASE_URL"] = "postgresql://postgres:postgres@localhost:5432/testdb"
 os.environ["TEST_DATABASE_URL"] = "postgresql://postgres:postgres@localhost:5432/testdb"
@@ -46,9 +42,6 @@ class MockTracker:
 
         return 1000
 
-    def get_tenant_id(self, api_key):
-        return "test-tenant"
-
     def consume_quota_and_log(self, record, idempotency_key=None):
 
         return (True, None)

tests/test_deps.py

@@ -1,10 +1,5 @@
-import importlib
-from unittest.mock import MagicMock, patch
-
 import pytest
-from fastapi import HTTPException
-
-import app.api.deps as deps
+from unittest.mock import patch, MagicMock
 from app.api.deps import get_db
 
 
@@ -18,72 +13,3 @@ def test_get_db_closes_session():
         with pytest.raises(Exception):
             db_gen.throw(Exception("test error"))
         mock_session.close.assert_called_once()
-
-
-# verify_internal_key tests below are called directly, not through
-# TestClient: tests/conftest.py globally overrides verify_internal_key
-# (`fastapi_app.dependency_overrides[verify_internal_key] = mock_verify_internal_key`)
-# so that already-protected routes (routes_governance.py) can be exercised
-# in tests without the gateway-injected X-Internal-Key header. That override
-# makes the real fail-closed behavior untestable through the app for any
-# router that uses it -- this is the only place it's actually verified to
-# reject what it should reject, rather than just trusted to work because
-# it's wired in.
-#
-# Newly relevant as of the auth fix to routes_risk.py, routes_intents.py,
-# routes_history.py, routes_memory.py (see docs/authentication.md) -- those
-# four routers now depend on this function passing correctly.
-
-_NEWLY_PROTECTED_ROUTER_MODULES = [
-    "app.api.routes_risk",
-    "app.api.routes_intents",
-    "app.api.routes_history",
-    "app.api.routes_memory",
-]
-
-
-@pytest.mark.asyncio
-async def test_verify_internal_key_rejects_missing_header(monkeypatch):
-    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "real-secret")
-    with pytest.raises(HTTPException) as exc_info:
-        await deps.verify_internal_key(x_internal_key=None)
-    assert exc_info.value.status_code == 401
-
-
-@pytest.mark.asyncio
-async def test_verify_internal_key_rejects_wrong_key(monkeypatch):
-    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "real-secret")
-    with pytest.raises(HTTPException) as exc_info:
-        await deps.verify_internal_key(x_internal_key="wrong-key")
-    assert exc_info.value.status_code == 401
-
-
-@pytest.mark.asyncio
-async def test_verify_internal_key_fails_closed_when_unset(monkeypatch):
-    """The env var being unset must reject every request, not let them
-    through -- this is the specific property that makes this safe to add
-    to a router without also needing to guarantee the env var is always
-    set."""
-    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "")
-    with pytest.raises(HTTPException) as exc_info:
-        await deps.verify_internal_key(x_internal_key="anything")
-    assert exc_info.value.status_code == 401
-
-
-@pytest.mark.asyncio
-async def test_verify_internal_key_accepts_correct_key(monkeypatch):
-    monkeypatch.setattr(deps, "INTERNAL_API_KEY", "real-secret")
-    result = await deps.verify_internal_key(x_internal_key="real-secret")
-    assert result is None
-
-
-@pytest.mark.parametrize("router_module_name", _NEWLY_PROTECTED_ROUTER_MODULES)
-def test_router_requires_verify_internal_key(router_module_name):
-    """Structural check, independent of the function-level tests above:
-    proves each router actually declares verify_internal_key as a
-    router-level dependency, not just that the function itself works in
-    isolation. Mirrors the pattern routes_governance.py already uses
-    (`APIRouter(dependencies=[Depends(verify_internal_key)])`)."""
-    module = importlib.import_module(router_module_name)
-    dependency_callables = [d.dependency for d in module.router.dependencies]
-    assert deps.verify_internal_key in dependency_callables

tests/test_governance.py

@@ -1,11 +1,7 @@
 """
 Tests for governance endpoints: /api/v1/intents/evaluate
 """
-import tempfile
-
 import pytest
-import app.core.usage_tracker as usage_tracker_module
-from app.core.usage_tracker import UsageTracker
 from app.database.models_intents import TenantDB
 
 
@@ -117,36 +113,3 @@ def test_evaluate_with_criticality(client):
     # context_hash is computed by the governance loop (a 64‑char hex string)
     ctx_hash = healing.get("context_hash")
     assert isinstance(ctx_hash, str) and len(ctx_hash) == 64
-
-
-def test_evaluate_intent_against_real_tracker_does_not_crash(client, monkeypatch):
-    """Every other test in this file runs against tests/conftest.py's
-    MockTracker, whose consume_quota_and_log ignores record.tier entirely
-    and always returns (True, None) -- so none of them would have noticed
-    that this endpoint hardcoded tier=None instead of using quota["tier"]
-    (already resolved by the enforce_quota dependency). Against the real
-    UsageTracker, consume_quota_and_log evaluates tier.monthly_evaluation_limit
-    unconditionally, so a None tier raised AttributeError on every real
-    call, outside any try/except, surfacing as a raw 500. This test swaps
-    in a real UsageTracker (a throwaway SQLite file; the same real
-    Postgres the CI service provides backs api_keys/monthly_counts) to
-    prove the endpoint no longer crashes."""
-    with tempfile.NamedTemporaryFile(suffix=".db") as tmp:
-        monkeypatch.setattr(usage_tracker_module, "tracker", UsageTracker(db_path=tmp.name))
-
-        payload = {
-            "intent_type": "provision_resource",
-            "environment": "prod",
-            "resource_type": "database",
-            "region": "eastus",
-            "size": "Standard",
-            "estimated_cost": 1200,
-            "policy_violations": [],
-            "requester": "alice",
-            "provenance": {},
-            "configuration": {}
-        }
-        response = client.post("/api/v1/intents/evaluate", json=payload,
-                               headers={"X-Tenant-ID": "test-tenant"})
-        assert response.status_code == 200, response.text
-        assert "risk_score" in response.json()

tests/test_healing_endpoint.py

@@ -1,9 +1,5 @@
-import tempfile
-
 from fastapi.testclient import TestClient
 from app.main import app
-import app.core.usage_tracker as usage_tracker_module
-from app.core.usage_tracker import UsageTracker
 
 client = TestClient(app)
 
@@ -22,27 +18,3 @@ def test_healing_evaluate_endpoint():
     response = client.post("/api/v1/healing/evaluate", json=payload,
                            headers={"X-Tenant-ID": "test-tenant"})
     assert response.status_code == 200, f"Expected 200, got {response.status_code}: {response.text}"
-
-
-def test_healing_evaluate_against_real_tracker_does_not_crash(monkeypatch):
-    """Same regression as test_governance.py's equivalent test, for this
-    endpoint's own hardcoded tier=None (routes_governance.py's
-    /healing/evaluate handler) -- see that test's docstring for the full
-    explanation. Swaps in a real UsageTracker to prove
-    consume_quota_and_log no longer crashes on a None tier here either."""
-    payload = {
-        "event": {
-            "component": "my-service",
-            "latency_p99": 450.0,
-            "error_rate": 0.25,
-            "service_mesh": "default",
-            "cpu_util": 0.85,
-            "memory_util": 0.90
-        }
-    }
-    with tempfile.NamedTemporaryFile(suffix=".db") as tmp:
-        monkeypatch.setattr(usage_tracker_module, "tracker", UsageTracker(db_path=tmp.name))
-
-        response = client.post("/api/v1/healing/evaluate", json=payload,
-                               headers={"X-Tenant-ID": "test-tenant"})
-        assert response.status_code == 200, f"Expected 200, got {response.status_code}: {response.text}"

tests/test_history.py

@@ -8,5 +8,9 @@ def test_history():
     response = client.get("/api/v1/history")
     assert response.status_code == 200
     data = response.json()
-    assert "incidents" in data
-    assert isinstance(data["incidents"], list)
+    # The endpoint returns a list of risk points, not an object with an
+    # "incidents" key
+    assert isinstance(data, list)
+    if data:  # if not empty, verify the structure of the first item
+        assert "risk" in data[0]
+        assert "time" in data[0]

tests/test_payments.py

@@ -1,19 +1,17 @@
+import os
 import pytest
 from unittest.mock import patch, MagicMock
 from fastapi.testclient import TestClient
 from app.main import app
 
-# Every Stripe call in this module is mocked -- nothing here reaches the
-# network, and no real credentials are involved. This module used to skip
-# entirely whenever STRIPE_SECRET_KEY was unset (always, in CI), so none of
-# it ran; stripe.api_key is patched below instead of relying on env vars,
-# since routes_payments.py reads it at import time.
 client = TestClient(app)
 
-
-@pytest.fixture(autouse=True)
-def stripe_configured(monkeypatch):
-    monkeypatch.setattr("stripe.api_key", "sk_test_fake")
+# Skip all tests in this module if Stripe secret key is not set
+STRIPE_SECRET_KEY = os.getenv("STRIPE_SECRET_KEY")
+if not STRIPE_SECRET_KEY:
+    pytest.skip(
+        "Stripe not configured – skipping payment tests",
+        allow_module_level=True)
 
 
 @pytest.fixture
@@ -23,13 +21,11 @@ def mock_stripe():
 
 
 def test_create_checkout_session_missing_stripe_key(monkeypatch):
-    # routes_payments.py sets stripe.api_key from the environment at import
-    # time and checks `stripe.api_key`, so setenv here would be a no-op.
-    monkeypatch.setattr("stripe.api_key", None)
+    monkeypatch.setenv("STRIPE_SECRET_KEY", "")
     response = client.post(
         "/api/v1/payments/create-checkout-session",
-        headers={"Authorization": "Bearer test_key"},
         json={
+            "api_key": "test_key",
             "success_url": "https://example.com/success",
             "cancel_url": "https://example.com/cancel"})
     assert response.status_code == 500
@@ -40,13 +36,12 @@ def test_create_checkout_session_free_key(mock_stripe):
     # Mock tracker.get_tier to return Tier.FREE
     with patch("app.core.usage_tracker.tracker") as mock_tracker:
         mock_tracker.get_tier.return_value = "free"
-        mock_tracker.get_tenant_id.return_value = "tenant_test_123"
         mock_stripe.return_value = MagicMock(
             id="cs_test_123", url="https://checkout.stripe.com/pay")
         response = client.post(
             "/api/v1/payments/create-checkout-session",
-            headers={"Authorization": "Bearer test_key"},
             json={
+                "api_key": "test_key",
                 "success_url": "https://example.com/success",
                 "cancel_url": "https://example.com/cancel"})
         assert response.status_code == 200
@@ -60,39 +55,10 @@ def test_create_checkout_session_pro_key():
         mock_tracker.get_tier.return_value = "pro"
         response = client.post(
             "/api/v1/payments/create-checkout-session",
-            headers={"Authorization": "Bearer test_key"},
             json={
+                "api_key": "test_key",
                 "success_url": "https://example.com/success",
                 "cancel_url": "https://example.com/cancel"})
         assert response.status_code == 400
         assert "Only free tier keys can be upgraded" in response.json()[
             "detail"]
-
-
-def test_create_checkout_session_requires_authentication(mock_stripe):
-    # Regression test: this endpoint used to take `api_key` as a plain JSON
-    # body field with no Depends() gate at all, so any caller could request
-    # a session for any tenant_id-bearing key string without proving they
-    # held it. No Authorization header (and no api_key in the body -- the
-    # field no longer exists on CheckoutRequest) must be rejected before
-    # ever reaching Stripe.
-    response = client.post(
-        "/api/v1/payments/create-checkout-session",
-        json={
-            "success_url": "https://example.com/success",
-            "cancel_url": "https://example.com/cancel"})
-    assert response.status_code == 401
-    mock_stripe.assert_not_called()
-
-
-def test_create_checkout_session_rejects_invalid_key(mock_stripe):
-    with patch("app.core.usage_tracker.tracker") as mock_tracker:
-        mock_tracker.get_tier.return_value = None
-        response = client.post(
-            "/api/v1/payments/create-checkout-session",
-            headers={"Authorization": "Bearer not-a-real-key"},
-            json={
-                "success_url": "https://example.com/success",
-                "cancel_url": "https://example.com/cancel"})
-        assert response.status_code == 403
-        mock_stripe.assert_not_called()

tests/test_risk.py

@@ -31,8 +31,4 @@ def test_get_risk_internal_error(client, monkeypatch):
             "X-API-Key": "test-key"})
     assert response.status_code == 500
     data = response.json()
-    # The raw exception message must NOT reach the caller -- routes_risk.py
-    # logs the real exception server-side and returns a generic detail
-    # instead (information-disclosure fix from this session's audit).
-    assert data.get("detail") == "Internal server error"
-    assert "test error" not in data.get("detail", "")
+    assert "test error" in data.get("detail", "")

tests/test_routes_admin.py

@@ -1,126 +0,0 @@
-"""
-Route-level tests for the /admin/keys endpoints against the real,
-Postgres-backed UsageTracker -- these routes are normally exercised through
-the module-level `tracker` singleton (conftest.py replaces it globally with
-MockTracker for every other test), so `tracker` is patched on
-`app.core.usage_tracker` and `ADMIN_API_KEY` on `app.api.routes_admin` for
-the duration of this module.
-
-`tracker` is patched on the *defining* module, not on routes_admin, because
-routes_admin no longer holds its own binding: it reaches the singleton
-through `usage_tracker.tracker` so that init_tracker()'s rebinding is
-visible to it. That is also what makes one patch here sufficient where five
-would otherwise be needed.
-
-This is the main regression coverage for the api_keys-on-Postgres
-migration: it exercises the exact raw SQL routes_admin.py runs against
-`usage_tracker.tracker._get_pg_conn()`.
-"""
-import hashlib
-import hmac
-import os
-
-import pytest
-
-from app.core import usage_tracker
-from app.core.usage_tracker import UsageTracker
-import app.api.routes_admin as routes_admin
-
-TEST_ADMIN_KEY = "test-admin-key-for-routes-admin-tests"
-TEST_PEPPER = os.environ["ARF_KEY_PEPPER"]  # set in conftest.py before app import
-
-
-def _key_id(raw_key: str) -> str:
-    """Reproduce UsageTracker._lookup_hash without a tracker instance, so
-    tests can locate the row created for a given raw key deterministically."""
-    return hmac.new(TEST_PEPPER.encode(), raw_key.encode(), hashlib.sha256).hexdigest()
-
-
-@pytest.fixture(autouse=True)
-def real_tracker(monkeypatch):
-    real = UsageTracker(db_path=":memory:")
-    monkeypatch.setattr(usage_tracker, "tracker", real)
-    monkeypatch.setattr(routes_admin, "ADMIN_API_KEY", TEST_ADMIN_KEY)
-    yield real
-
-
-def test_create_list_update_deactivate_key(client):
-    create_resp = client.post(
-        "/api/v1/admin/keys",
-        params={"admin_key": TEST_ADMIN_KEY},
-        json={"tier": "free", "org_name": "Test Org"},
-    )
-    assert create_resp.status_code == 200
-    body = create_resp.json()
-    api_key = body["api_key"]
-    assert body["tier"] == "free"
-    key_id = _key_id(api_key)
-
-    list_resp = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
-    assert list_resp.status_code == 200
-    keys_by_id = {row["key_id"]: row for row in list_resp.json()["keys"]}
-    assert key_id in keys_by_id
-    assert keys_by_id[key_id]["tier"] == "free"
-    assert keys_by_id[key_id]["is_active"] is True
-
-    patch_resp = client.patch(
-        f"/api/v1/admin/keys/{key_id}/tier",
-        params={"admin_key": TEST_ADMIN_KEY},
-        json={"tier": "pro"},
-    )
-    assert patch_resp.status_code == 200
-
-    list_resp2 = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
-    assert list_resp2.json()["keys"][0]  # non-empty, sanity check
-    keys_by_id2 = {row["key_id"]: row for row in list_resp2.json()["keys"]}
-    assert keys_by_id2[key_id]["tier"] == "pro"
-
-    delete_resp = client.delete(f"/api/v1/admin/keys/{key_id}", params={"admin_key": TEST_ADMIN_KEY})
-    assert delete_resp.status_code == 200
-
-    list_resp3 = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
-    keys_by_id3 = {row["key_id"]: row for row in list_resp3.json()["keys"]}
-    assert keys_by_id3[key_id]["is_active"] is False
-
-
-def test_update_nonexistent_key_returns_404(client):
-    resp = client.patch(
-        "/api/v1/admin/keys/does-not-exist/tier",
-        params={"admin_key": TEST_ADMIN_KEY},
-        json={"tier": "pro"},
-    )
-    assert resp.status_code == 404
-
-
-def test_rotate_key_deactivates_old_and_creates_new_on_same_tenant(client):
-    create_resp = client.post(
-        "/api/v1/admin/keys",
-        params={"admin_key": TEST_ADMIN_KEY},
-        json={"tier": "pro", "org_name": "Rotate Test Org"},
-    )
-    assert create_resp.status_code == 200
-    old_body = create_resp.json()
-    old_key_id = _key_id(old_body["api_key"])
-    tenant_id = old_body["tenant_id"]
-
-    rotate_resp = client.post(
-        f"/api/v1/admin/keys/{old_key_id}/rotate", params={"admin_key": TEST_ADMIN_KEY})
-    assert rotate_resp.status_code == 200
-    rotated = rotate_resp.json()
-    assert rotated["tenant_id"] == tenant_id
-    assert rotated["tier"] == "pro"
-    assert rotated["deactivated_key_id"] == old_key_id
-    new_key_id = _key_id(rotated["api_key"])
-    assert new_key_id != old_key_id
-
-    list_resp = client.get("/api/v1/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
-    keys_by_id = {row["key_id"]: row for row in list_resp.json()["keys"]}
-    assert keys_by_id[old_key_id]["is_active"] is False
-    assert keys_by_id[new_key_id]["is_active"] is True
-    assert keys_by_id[new_key_id]["tier"] == "pro"
-
-
-def test_rotate_nonexistent_key_returns_404(client):
-    resp = client.post(
-        "/api/v1/admin/keys/does-not-exist/rotate", params={"admin_key": TEST_ADMIN_KEY})
-    assert resp.status_code == 404

tests/test_routes_governance_execute.py

@@ -1,352 +0,0 @@
-"""
-Tests for POST /intents/{id}/execute and POST /admin/executions/{id}/resolve.
-
-arf_enterprise is not installed in this test environment (by design -- it's
-an optional, proprietary package; see routes_governance.py's
-ENTERPRISE_EXECUTOR_AVAILABLE guard). The 501 "not available"/"not enabled"
-paths are real, unconditional behavior and tested as such. For the
-success/pending/error paths, the enterprise classes referenced in
-routes_governance.py (EnterpriseExecutor, FakeCloudActuator,
-PendingApprovalError, EnterpriseExecutionError, EnterpriseSafetyError) are
-monkeypatched with lightweight stand-ins -- this tests arf-api's own glue
-code (existence/tenant check, exception-to-HTTP-status mapping, response
-shaping), not EnterpriseExecutor's internals, which are already covered by
-the enterprise repo's own test suite.
-"""
-import pytest
-from app.database.models_intents import TenantDB
-import app.api.routes_governance as routes_governance
-import app.api.routes_admin as routes_admin
-
-TENANT_ID = "test-tenant"
-
-
-@pytest.fixture(autouse=True)
-def seed_tenant(db_session):
-    tenant = db_session.query(TenantDB).filter_by(id=TENANT_ID).first()
-    if not tenant:
-        db_session.add(TenantDB(id=TENANT_ID, name="Test Tenant"))
-        db_session.commit()
-
-
-def _evaluate_intent(client):
-    payload = {
-        "intent_type": "provision_resource",
-        "environment": "prod",
-        "resource_type": "database",
-        "region": "eastus",
-        "size": "Standard",
-        "estimated_cost": 1200,
-        "policy_violations": [],
-        "requester": "alice",
-        "provenance": {},
-        "configuration": {},
-    }
-    resp = client.post(
-        "/api/v1/intents/evaluate", json=payload, headers={"X-Tenant-ID": TENANT_ID}
-    )
-    assert resp.status_code == 200, resp.text
-    data = resp.json()
-    # data["intent_id"] (top level, set by evaluate_intent_endpoint right
-    # before returning: result["intent_id"] = deterministic_id) is what
-    # save_evaluated_intent actually persisted to IntentDB.deterministic_id.
-    # data["healing_intent"]["intent_id"] is a separate, independently
-    # generated id belonging to the HealingIntent object itself -- using it
-    # here instead was the exact bug that made every test in this file 404.
-    return data["intent_id"], data["healing_intent"]
-
-
-class _FakePendingApprovalError(Exception):
-    def __init__(self, message, level, approval_required, approval_id=None):
-        super().__init__(message)
-        self.level = level
-        self.approval_required = approval_required
-        self.approval_id = approval_id
-
-
-class _FakeExecutionError(Exception):
-    pass
-
-
-class _FakeSafetyError(Exception):
-    pass
-
-
-class _FakeConfig:
-    """Stands in for EnterpriseConfig, which is None in the import fallback
-    whenever arf_enterprise isn't installed -- as it isn't in CI, since it's
-    a private-repo package deliberately kept out of requirements.txt.
-
-    Records what it was constructed with so a test can assert that
-    ARF_TRUSTED_SIGNING_KEYS actually reaches the executor. Without that
-    the trust store could silently go back to empty and every signed intent
-    would be rejected as "Untrusted signing key" with nothing failing here.
-    """
-    last_trusted_signing_keys = None
-
-    def __init__(self, trusted_signing_keys=None, **kwargs):
-        self.trusted_signing_keys = trusted_signing_keys
-        type(self).last_trusted_signing_keys = trusted_signing_keys
-
-
-class _FakeExecutor:
-    """Stands in for EnterpriseExecutor. Behavior is selected via a
-    class-level `mode` set by each test before the request is made."""
-    mode = "success"
-    last_config = None
-
-    def __init__(self, config=None, actuator=None, approval_store=None,
-                 on_verified_outcome=None):
-        self._on_verified_outcome = on_verified_outcome
-        type(self).last_config = config
-
-    async def execute(self, intent, human_approved=False, admin_approved=False):
-        if self.mode == "success":
-            if self._on_verified_outcome:
-                self._on_verified_outcome(intent, True, {"observed": {"status": "running"}})
-            return {"status": "success", "verified": {"status": "running"}, "compensating_action": None}
-        if self.mode == "pending":
-            raise _FakePendingApprovalError(
-                "needs human approval", level="HumanInLoop", approval_required="human",
-                approval_id="appr_test123",
-            )
-        if self.mode == "execution_error":
-            raise _FakeExecutionError("ladder denied this intent")
-        if self.mode == "safety_error":
-            raise _FakeSafetyError("blast radius exceeded")
-        raise RuntimeError(f"unhandled test mode: {self.mode}")
-
-
-@pytest.fixture
-def enterprise_execution_enabled(monkeypatch):
-    monkeypatch.setattr(routes_governance, "ENTERPRISE_EXECUTOR_AVAILABLE", True)
-    monkeypatch.setattr(routes_governance, "ARF_ENABLE_EXECUTION", True)
-    monkeypatch.setattr(routes_governance, "EnterpriseExecutor", _FakeExecutor)
-    monkeypatch.setattr(routes_governance, "EnterpriseConfig", _FakeConfig)
-    monkeypatch.setattr(routes_governance, "FakeCloudActuator", lambda: None)
-    monkeypatch.setattr(routes_governance, "PendingApprovalError", _FakePendingApprovalError)
-    monkeypatch.setattr(routes_governance, "EnterpriseExecutionError", _FakeExecutionError)
-    monkeypatch.setattr(routes_governance, "EnterpriseSafetyError", _FakeSafetyError)
-    _FakeExecutor.mode = "success"
-    yield
-    _FakeExecutor.mode = "success"
-
-
-def test_execute_returns_501_when_enterprise_package_not_available(client):
-    resp = client.post(
-        "/api/v1/intents/does-not-matter/execute",
-        json={"healing_intent": {}},
-    )
-    assert resp.status_code == 501
-    assert "not installed" in resp.json()["detail"]
-
-
-def test_execute_returns_501_when_not_enabled(client, monkeypatch):
-    monkeypatch.setattr(routes_governance, "ENTERPRISE_EXECUTOR_AVAILABLE", True)
-    monkeypatch.setattr(routes_governance, "ARF_ENABLE_EXECUTION", False)
-    resp = client.post(
-        "/api/v1/intents/does-not-matter/execute",
-        json={"healing_intent": {}},
-    )
-    assert resp.status_code == 501
-    assert "not enabled" in resp.json()["detail"]
-
-
-def test_execute_returns_404_for_unknown_intent(client, enterprise_execution_enabled):
-    resp = client.post(
-        "/api/v1/intents/does-not-exist-at-all/execute",
-        json={"healing_intent": {}},
-    )
-    assert resp.status_code == 404
-
-
-def test_execute_success_path(client, enterprise_execution_enabled):
-    deterministic_id, healing_intent = _evaluate_intent(client)
-    resp = client.post(
-        f"/api/v1/intents/{deterministic_id}/execute",
-        json={"healing_intent": healing_intent, "human_approved": True},
-    )
-    assert resp.status_code == 200, resp.text
-    assert resp.json()["status"] == "success"
-
-
-def test_trusted_signing_keys_reach_the_executor_split_not_raw(
-    client, enterprise_execution_enabled, monkeypatch
-):
-    """ARF_TRUSTED_SIGNING_KEYS holds N comma-separated fingerprints.
-    Passing the raw string through as a one-element list would register the
-    literal "abc,def" as a single key -- trusting neither real one -- and
-    would look identical from the outside, since both spellings produce a
-    non-empty list and a 200 here."""
-    monkeypatch.setenv("ARF_TRUSTED_SIGNING_KEYS", " abc123 , def456 ,, ")
-    deterministic_id, healing_intent = _evaluate_intent(client)
-    resp = client.post(
-        f"/api/v1/intents/{deterministic_id}/execute",
-        json={"healing_intent": healing_intent, "human_approved": True},
-    )
-    assert resp.status_code == 200, resp.text
-    assert _FakeConfig.last_trusted_signing_keys == ["abc123", "def456"]
-    assert _FakeExecutor.last_config is not None
-
-
-def test_unset_trusted_signing_keys_trusts_nothing_rather_than_the_empty_string(
-    client, enterprise_execution_enabled, monkeypatch
-):
-    """Fail closed. `"".split(",")` is `[""]`, so the naive parse would
-    register the empty string as a trusted fingerprint -- trusting a key
-    nobody holds is harmless, but it makes "trusts nothing" and
-    "misconfigured" indistinguishable in the logs."""
-    monkeypatch.delenv("ARF_TRUSTED_SIGNING_KEYS", raising=False)
-    deterministic_id, healing_intent = _evaluate_intent(client)
-    resp = client.post(
-        f"/api/v1/intents/{deterministic_id}/execute",
-        json={"healing_intent": healing_intent, "human_approved": True},
-    )
-    assert resp.status_code == 200, resp.text
-    assert _FakeConfig.last_trusted_signing_keys == []
-
-
-def test_execute_pending_approval_returns_202_with_approval_id(client, enterprise_execution_enabled):
-    deterministic_id, healing_intent = _evaluate_intent(client)
-    _FakeExecutor.mode = "pending"
-    resp = client.post(
-        f"/api/v1/intents/{deterministic_id}/execute",
-        json={"healing_intent": healing_intent},
-    )
-    assert resp.status_code == 202
-    body = resp.json()
-    assert body["approval_id"] == "appr_test123"
-    assert body["level"] == "HumanInLoop"
-
-
-def test_execute_execution_error_returns_422(client, enterprise_execution_enabled):
-    deterministic_id, healing_intent = _evaluate_intent(client)
-    _FakeExecutor.mode = "execution_error"
-    resp = client.post(
-        f"/api/v1/intents/{deterministic_id}/execute",
-        json={"healing_intent": healing_intent, "human_approved": True},
-    )
-    assert resp.status_code == 422
-    assert "ladder denied" in resp.json()["detail"]
-
-
-def test_execute_safety_error_returns_422(client, enterprise_execution_enabled):
-    deterministic_id, healing_intent = _evaluate_intent(client)
-    _FakeExecutor.mode = "safety_error"
-    resp = client.post(
-        f"/api/v1/intents/{deterministic_id}/execute",
-        json={"healing_intent": healing_intent, "human_approved": True},
-    )
-    assert resp.status_code == 422
-    assert "blast radius" in resp.json()["detail"]
-
-
-def test_execute_belongs_to_different_tenant_returns_404(client, enterprise_execution_enabled, db_session):
-    """A deterministic_id that exists but under a different tenant must not
-    be executable by this caller -- same tenant-scoping guarantee
-    record_outcome already provides for /intents/outcome."""
-    other_tenant = "other-tenant"
-    if not db_session.query(TenantDB).filter_by(id=other_tenant).first():
-        db_session.add(TenantDB(id=other_tenant, name="Other Tenant"))
-        db_session.commit()
-
-    from app.database.models_intents import IntentDB
-    import datetime
-    db_session.add(IntentDB(
-        deterministic_id="belongs-to-other-tenant",
-        tenant_id=other_tenant,
-        intent_type="provision_resource",
-        payload={},
-        oss_payload={},
-        environment="prod",
-        evaluated_at=datetime.datetime.utcnow(),
-        risk_score="0.1",
-    ))
-    db_session.commit()
-
-    resp = client.post(
-        "/api/v1/intents/belongs-to-other-tenant/execute",
-        json={"healing_intent": {}},
-    )
-    assert resp.status_code == 404
-
-
-# ---------------------------------------------------------------------------
-# Admin resolve/list endpoints
-# ---------------------------------------------------------------------------
-
-TEST_ADMIN_KEY = "test-admin-key-for-governance-execute-tests"
-
-
-class _FakeApprovalRecord:
-    def __init__(self, id, decision_id, intent_id, level, approval_required, requested_at):
-        self.id = id
-        self.decision_id = decision_id
-        self.intent_id = intent_id
-        self.level = level
-        self.approval_required = approval_required
-        self.requested_at = requested_at
-
-
-class _FakeApprovalStore:
-    def __init__(self):
-        import datetime
-        self._pending = {
-            "appr_1": _FakeApprovalRecord(
-                "appr_1", "dec_1", "intent-1", "HumanInLoop", "human", datetime.datetime.utcnow()
-            )
-        }
-        self.resolved = []
-
-    def list_pending(self, limit=100, offset=0):
-        return list(self._pending.values())[:limit]
-
-    def resolve(self, approval_id, approved, resolved_by, note=None):
-        if approval_id not in self._pending:
-            return False
-        del self._pending[approval_id]
-        self.resolved.append((approval_id, approved, resolved_by, note))
-        return True
-
-
-@pytest.fixture
-def admin_with_approval_store(monkeypatch, client):
-    monkeypatch.setattr(routes_admin, "ADMIN_API_KEY", TEST_ADMIN_KEY)
-    fake_store = _FakeApprovalStore()
-    client.app.state.approval_store = fake_store
-    yield fake_store
-    client.app.state.approval_store = None
-
-
-def test_list_pending_executions_returns_501_without_store(client, monkeypatch):
-    monkeypatch.setattr(routes_admin, "ADMIN_API_KEY", TEST_ADMIN_KEY)
-    client.app.state.approval_store = None
-    resp = client.get("/api/v1/admin/executions/pending", params={"admin_key": TEST_ADMIN_KEY})
-    assert resp.status_code == 501
-
-
-def test_list_pending_executions(client, admin_with_approval_store):
-    resp = client.get("/api/v1/admin/executions/pending", params={"admin_key": TEST_ADMIN_KEY})
-    assert resp.status_code == 200
-    body = resp.json()
-    assert body["total"] == 1
-    assert body["pending"][0]["approval_id"] == "appr_1"
-
-
-def test_resolve_execution_approval(client, admin_with_approval_store):
-    resp = client.post(
-        "/api/v1/admin/executions/appr_1/resolve",
-        params={"admin_key": TEST_ADMIN_KEY},
-        json={"approved": True, "note": "looks fine"},
-    )
-    assert resp.status_code == 200
-    assert admin_with_approval_store.resolved == [("appr_1", True, "admin", "looks fine")]
-
-
-def test_resolve_unknown_approval_returns_404(client, admin_with_approval_store):
-    resp = client.post(
-        "/api/v1/admin/executions/does-not-exist/resolve",
-        params={"admin_key": TEST_ADMIN_KEY},
-        json={"approved": True},
-    )
-    assert resp.status_code == 404

tests/test_routes_onchain.py

@@ -1,88 +0,0 @@
-"""Tests for POST/GET /api/v1/onchain/rationale.
-
-`verify_internal_key` and `get_db` are already overridden in conftest.py the
-same way every other route test relies on -- this exercises the endpoint's
-own logic (idempotent-on-hash write, conflict on a differing text, 404 on an
-unknown hash, hash format validation), not authentication or the database
-layer itself.
-"""
-
-VALID_HASH = "0x" + "ab" * 32
-
-
-def _post(
-    client,
-    rationale_hash=VALID_HASH,
-    rationale="the volume's final backup was skipped",
-    **extra,
-):
-    payload = {"rationale_hash": rationale_hash, "rationale": rationale, **extra}
-    return client.post("/api/v1/onchain/rationale", json=payload)
-
-
-class TestPersistRationale:
-    def test_a_new_hash_is_recorded(self, client):
-        resp = _post(client)
-        assert resp.status_code == 201, resp.text
-        assert resp.json() == {"status": "recorded", "rationale_hash": VALID_HASH}
-
-    def test_posting_the_same_hash_and_text_again_is_a_no_op(self, client):
-        # A hash of its own -- the `client` fixture is session-scoped against
-        # a real, persistent Postgres with no truncation between tests, so
-        # reusing VALID_HASH here would collide with whichever other test in
-        # this file claims it first.
-        hash_ = "0x" + "22" * 32
-        first = _post(client, rationale_hash=hash_)
-        assert first.status_code == 201
-        second = _post(client, rationale_hash=hash_)
-        assert second.status_code == 200
-        assert second.json()["status"] == "already_recorded"
-
-    def test_the_same_hash_with_different_text_is_refused(self, client):
-        hash_ = "0x" + "33" * 32
-        first = _post(client, rationale_hash=hash_)
-        assert first.status_code == 201
-        second = _post(client, rationale_hash=hash_, rationale="a different reason entirely")
-        assert second.status_code == 409
-
-    def test_a_malformed_hash_is_rejected(self, client):
-        resp = _post(client, rationale_hash="not-a-hash")
-        assert resp.status_code == 422
-
-    def test_a_short_hash_is_rejected(self, client):
-        resp = _post(client, rationale_hash="0x" + "ab" * 16)
-        assert resp.status_code == 422
-
-    def test_empty_rationale_is_rejected(self, client):
-        resp = _post(client, rationale="   ")
-        assert resp.status_code == 422
-
-    def test_agent_and_evaluator_addresses_are_stored(self, client):
-        resp = _post(
-            client,
-            rationale_hash="0x" + "cd" * 32,
-            agent_address="0x00000000000000000000000000000000000000A1",
-            evaluator_address="0x00000000000000000000000000000000000000B2",
-        )
-        assert resp.status_code == 201
-        fetched = client.get(f"/api/v1/onchain/rationale/{'0x' + 'cd' * 32}")
-        assert fetched.status_code == 200
-        body = fetched.json()
-        assert body["agent_address"] == "0x00000000000000000000000000000000000000A1"
-        assert body["evaluator_address"] == "0x00000000000000000000000000000000000000B2"
-
-
-class TestGetRationale:
-    def test_fetching_a_recorded_hash_returns_its_text(self, client):
-        _post(client)
-        resp = client.get(f"/api/v1/onchain/rationale/{VALID_HASH}")
-        assert resp.status_code == 200
-        assert resp.json()["rationale"] == "the volume's final backup was skipped"
-
-    def test_fetching_an_unknown_hash_is_404(self, client):
-        resp = client.get(f"/api/v1/onchain/rationale/{'0x' + 'ef' * 32}")
-        assert resp.status_code == 404
-
-    def test_fetching_a_malformed_hash_is_422_not_404(self, client):
-        resp = client.get("/api/v1/onchain/rationale/not-a-hash")
-        assert resp.status_code == 422

tests/test_routes_pricing.py

@@ -1,47 +0,0 @@
-from fastapi.testclient import TestClient
-from app.main import app
-
-client = TestClient(app)
-
-
-def test_run_pricing_is_temporarily_disabled():
-    """/pricing/run was disabled after AUDIT_arf-bayesian-pricing-calculator.md's
-    Critical finding: it persisted a fabricated random.random() outcome into a
-    calibration buffer with no customer_id scoping, so every customer's price
-    was shaped by every other customer's fabricated outcomes. This asserts the
-    disabled state itself, not the old (buggy) behavior -- update this test
-    when the endpoint is actually fixed and re-enabled, not before."""
-    response = client.post(
-        "/api/v1/pricing/run",
-        json={"input": {}, "customer_id": "test-customer", "runs": 1},
-    )
-    assert response.status_code == 503
-    assert "temporarily disabled" in response.json()["detail"].lower()
-
-
-def test_run_pricing_still_requires_auth():
-    """Disabling the endpoint must not also disable its auth -- conftest.py's
-    mock_enforce_quota makes every request "authenticated" for this test
-    client, so this only confirms the Depends(enforce_quota) dependency is
-    still declared and still runs before the handler body (i.e. it wasn't
-    accidentally dropped along with the rest of the function body); it does
-    not exercise the real 401/403 paths, which are covered by test_deps.py
-    and usage_tracker's own tests."""
-    response = client.post(
-        "/api/v1/pricing/run",
-        json={"input": {}, "customer_id": "test-customer", "runs": 1},
-    )
-    # Reaching the 503 (not erroring before it) proves enforce_quota resolved
-    # successfully -- if the dependency were missing or broken, this would be
-    # a 401/422/500 instead.
-    assert response.status_code == 503
-
-
-def test_estimate_pricing_route_still_registered():
-    """/pricing/estimate was not touched by the disable -- confirm it's still
-    a distinct, reachable route (a malformed request should 400, not 503/404),
-    so a caller following the "use /pricing/estimate instead" guidance in the
-    503 detail message actually has somewhere to go."""
-    response = client.post("/api/v1/pricing/estimate", json={"input": {}})
-    assert response.status_code != 503
-    assert response.status_code != 404

tests/test_tracker_binding.py

@@ -1,95 +0,0 @@
-"""Guard against re-introducing the stale `tracker` from-import.
-
-`app.core.usage_tracker.tracker` starts as None and is rebound by
-`init_tracker()` during the lifespan. `from app.core.usage_tracker import
-tracker` copies the *binding* -- None -- at import time, and the later
-rebinding never reaches the importer. Five modules did this: main.py
-crashed the Render deploy with "'NoneType' object has no attribute
-'warm_up'", routes_admin's 20 unguarded uses would have 500'd, and
-routes_incidents/payments/users each had a `if tracker` guard that could
-only ever take the None branch -- so usage went unmetered and signup and
-checkout were permanently disabled, silently.
-
-This is a source-level check on purpose. Reproducing the bug at runtime
-needs a real UsageTracker (Postgres, pepper) and would only cover the
-modules the test happened to import; parsing every module catches the
-next one too, and costs nothing.
-"""
-
-import ast
-import re
-import pathlib
-
-import pytest
-
-APP = pathlib.Path(__file__).resolve().parent.parent / "app"
-
-# Names safe to import directly: functions defined in usage_tracker.py
-# resolve the module global at call time, so they always see the live
-# instance. Only the mutable module-level object itself is unsafe.
-UNSAFE_NAMES = {"tracker"}
-
-
-def _source_files():
-    return sorted(p for p in APP.rglob("*.py"))
-
-
-TESTS = pathlib.Path(__file__).resolve().parent
-
-# `patch("app.api.routes_admin.tracker")` and
-# `monkeypatch.setattr(routes_payments, "tracker", ...)` both target an
-# attribute that only exists while the broken from-import does. They passed
-# for as long as the bug was there and broke the moment it was fixed --
-# and, worse, while the bug was there they were patching a name the route
-# code was already reading as None, so they proved nothing.
-#
-# conftest.py has always done the right thing (`app.core.usage_tracker
-# .tracker = MockTracker()`), which is why this is the correct target: one
-# patch on the defining module reaches every consumer.
-_BAD_PATCH_TARGETS = re.compile(
-    r"""["']app\.api\.routes_\w+\.tracker["']"""
-    r"""|setattr\(\s*routes_\w+\s*,\s*["']tracker["']"""
-)
-
-
-def _test_files():
-    """Every test module but this one.
-
-    The check is textual, so this file trips it on the comment above that
-    quotes the bad forms. Excluding self rather than contorting the regex
-    keeps the pattern readable and the examples literal -- and the cost is
-    only that this file cannot police itself, which it has no reason to.
-    """
-    here = pathlib.Path(__file__).resolve()
-    return sorted(p for p in TESTS.glob("test_*.py") if p.resolve() != here)
-
-
-@pytest.mark.parametrize("path", _test_files(), ids=lambda p: p.name)
-def test_no_test_patches_tracker_on_a_route_module(path):
-    src = path.read_text(encoding="utf-8")
-    for lineno, line in enumerate(src.splitlines(), start=1):
-        assert not _BAD_PATCH_TARGETS.search(line), (
-            f"{path.name}:{lineno} patches `tracker` on a route module. Route "
-            "modules reference `usage_tracker.tracker` and hold no binding of "
-            'their own -- patch "app.core.usage_tracker.tracker" instead, '
-            "which is what conftest.py already does."
-        )
-
-
-@pytest.mark.parametrize("path", _source_files(), ids=lambda p: p.name)
-def test_tracker_is_never_imported_by_name(path):
-    tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
-    for node in ast.walk(tree):
-        if not isinstance(node, ast.ImportFrom):
-            continue
-        if node.module != "app.core.usage_tracker":
-            continue
-        offenders = sorted(
-            {a.name for a in node.names} & UNSAFE_NAMES
-        )
-        assert not offenders, (
-            f"{path.name}:{node.lineno} imports {offenders} by name from "
-            "app.core.usage_tracker. That binding is None at import time and "
-            "init_tracker() will not update it. Use `from app.core import "
-            "usage_tracker` and reference `usage_tracker.tracker` instead."
-        )

tests/test_usage_tracker.py

@@ -1,8 +1,3 @@
-import json
-import os
-from datetime import datetime
-
-import psycopg2
 import pytest
 import tempfile
 import time
@@ -83,126 +78,3 @@ def test_get_audit_logs(tracker):
     logs = tracker.get_audit_logs("test_key", limit=10)
     assert len(logs) == 1
     assert logs[0]["endpoint"] == "/test"
-
-
-def _pg_monthly_count(api_key: str, month: str) -> int:
-    """Direct Postgres read, bypassing UsageTracker entirely -- this is
-    exactly the query arf-gateway's Go code runs against the same table."""
-    conn = psycopg2.connect(os.environ["DATABASE_URL"])
-    try:
-        with conn.cursor() as cur:
-            cur.execute(
-                "SELECT COALESCE(count, 0) FROM monthly_counts WHERE api_key = %s AND year_month = %s",
-                (api_key, month),
-            )
-            row = cur.fetchone()
-            return row[0] if row else 0
-    finally:
-        conn.close()
-
-
-def test_increment_usage_sync_mirrors_to_postgres_monthly_counts(tracker):
-    """Regresses arf-gateway-001: arf-gateway's quota check reads
-    monthly_counts from Postgres, not from this service's local SQLite
-    file. Every successfully-counted call must be visible there."""
-    tracker.get_or_create_api_key("pg-mirror-key", tenant_id="test")
-    month = tracker._get_month_key()
-
-    # No truncate fixture exists for this Postgres-resident table (CI's
-    # Postgres service is ephemeral per run, but a local repeat run against
-    # a persistent database could have leftover rows) -- assert the delta,
-    # not an absolute count.
-    baseline = _pg_monthly_count("pg-mirror-key", month)
-
-    record = UsageRecord(
-        api_key="pg-mirror-key", tier=Tier.FREE, timestamp=time.time(), endpoint="/test",
-    )
-    tracker.increment_usage_sync(record)
-    assert _pg_monthly_count("pg-mirror-key", month) == baseline + 1
-
-    tracker.increment_usage_sync(record)
-    assert _pg_monthly_count("pg-mirror-key", month) == baseline + 2
-
-
-def test_increment_usage_sync_succeeds_even_if_postgres_mirror_fails(tracker, monkeypatch):
-    """The local quota decision (SQLite/Redis) must not fail just because
-    the best-effort mirror write to Postgres did -- see
-    _record_pg_monthly_count's docstring. A degraded mirror write should
-    not turn into a degraded evaluate/healing endpoint for the caller."""
-    def _boom(*args, **kwargs):
-        raise psycopg2.OperationalError("simulated Postgres outage")
-
-    # get_or_create_api_key also goes through _get_pg_conn (it persists to
-    # the real api_keys table), so it must run before the patch below -- the
-    # outage this test simulates is specific to the monthly_counts mirror
-    # write, not to Postgres as a whole.
-    tracker.get_or_create_api_key("mirror-fail-key", tenant_id="test")
-
-    # Patch what _record_pg_monthly_count calls internally, not the method
-    # itself -- replacing the whole method would bypass its own try/except
-    # and prove nothing about that error-handling actually working.
-    monkeypatch.setattr(tracker, "_get_pg_conn", _boom)
-
-    record = UsageRecord(
-        api_key="mirror-fail-key", tier=Tier.FREE, timestamp=time.time(), endpoint="/test",
-    )
-
-    # Must not raise, and the local quota decision must still succeed.
-    result = tracker.increment_usage_sync(record)
-    assert result is True
-    assert tracker.get_remaining_quota("mirror-fail-key", Tier.FREE) == 999
-
-
-def test_insert_audit_log_writes_response_row(tracker):
-    """routes_governance.py schedules current_tracker._insert_audit_log as
-    a background task (background_tasks.add_task) to record the response
-    body once it's known, at app/api/routes_governance.py:407 and :738 --
-    always with tier=None, since quota was already consumed by an earlier
-    consume_quota_and_log call for the same request. The real UsageTracker
-    had no such method (only tests/conftest.py's MockTracker did), so every
-    real call raised AttributeError inside the background task (arf-api-002)."""
-    record = UsageRecord(
-        api_key="audit-log-key",
-        tier=None,
-        timestamp=time.time(),
-        endpoint="/api/v1/intents/evaluate/response",
-        request_body=None,
-        response={"recommended_action": "approve"},
-        processing_ms=12.5,
-    )
-
-    tracker._insert_audit_log(record)
-
-    logs = tracker.get_audit_logs("audit-log-key", limit=10)
-    assert len(logs) == 1
-    assert logs[0]["endpoint"] == "/api/v1/intents/evaluate/response"
-    assert logs[0]["tier"] == "unknown"
-    assert json.loads(logs[0]["response"]) == {"recommended_action": "approve"}
-
-
-def test_consume_quota_and_log_handles_non_json_native_request_body(tracker):
-    """request_body/response are whatever a Pydantic model's plain
-    .model_dump() returns, e.g. ReliabilityEvent.timestamp in
-    app/api/routes_governance.py's HealingDecisionRequest -- a raw
-    datetime, not the ISO string model_dump(mode="json") would produce.
-    json.dumps has no default encoder for datetime, so any real request
-    carrying one raised TypeError here, outside any try/except in the
-    /healing/evaluate handler, on every call (surfaced while verifying the
-    tier=None fix for that same endpoint: fixing tier alone still crashed,
-    one layer deeper, on this). default=str makes the insert tolerant of
-    datetime and any other type json.dumps doesn't natively handle."""
-    tracker.get_or_create_api_key("datetime-body-key", tenant_id="test")
-    record = UsageRecord(
-        api_key="datetime-body-key",
-        tier=Tier.FREE,
-        timestamp=time.time(),
-        endpoint="/api/v1/healing/evaluate",
-        request_body={"event": {"component": "svc", "timestamp": datetime.now()}},
-    )
-
-    result = tracker.increment_usage_sync(record)
-    assert result is True
-
-    logs = tracker.get_audit_logs("datetime-body-key", limit=10)
-    assert len(logs) == 1
-    assert "timestamp" in json.loads(logs[0]["request_body"])["event"]

tests/test_webhooks.py

@@ -1,25 +1,17 @@
+import os
 import pytest
 from unittest.mock import patch
 from fastapi.testclient import TestClient
 from app.main import app
 
-# Every Stripe call in this module is mocked -- nothing here reaches the
-# network, and no real credentials are involved.
-#
-# This module used to skip entirely (pytest.skip(allow_module_level=True))
-# whenever STRIPE_* env vars were unset, which is always in CI -- so none of
-# it was ever exercised anywhere. webhooks.py reads its config into
-# module-level globals at import time, so env vars set in conftest.py can't
-# help (conftest's imports run before its os.environ assignments); the
-# fixture below patches those globals directly instead, which works
-# regardless of import order.
 client = TestClient(app)
 
-
-@pytest.fixture(autouse=True)
-def stripe_configured(monkeypatch):
-    monkeypatch.setattr("app.api.webhooks.STRIPE_WEBHOOK_SECRET", "whsec_test_fake")
-    monkeypatch.setattr("stripe.api_key", "sk_test_fake")
+# Skip all tests in this module if Stripe webhook secret is not set
+STRIPE_WEBHOOK_SECRET = os.getenv("STRIPE_WEBHOOK_SECRET")
+if not STRIPE_WEBHOOK_SECRET:
+    pytest.skip(
+        "Stripe webhook not configured – skipping webhook tests",
+        allow_module_level=True)
 
 
 @pytest.fixture
@@ -29,9 +21,7 @@ def mock_stripe_webhook():
 
 
 def test_webhook_missing_secret(monkeypatch):
-    # webhooks.py reads STRIPE_WEBHOOK_SECRET into a module-level global at
-    # import time, so setenv here would be a no-op -- patch the global.
-    monkeypatch.setattr("app.api.webhooks.STRIPE_WEBHOOK_SECRET", "")
+    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "")
     response = client.post(
         "/webhooks/stripe",
         json={},
@@ -41,7 +31,8 @@ def test_webhook_missing_secret(monkeypatch):
     assert "Stripe not configured" in response.json()["detail"]
 
 
-def test_webhook_invalid_payload(mock_stripe_webhook):
+def test_webhook_invalid_payload(mock_stripe_webhook, monkeypatch):
+    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
     mock_stripe_webhook.side_effect = ValueError("Invalid payload")
     response = client.post(
         "/webhooks/stripe",
@@ -52,12 +43,9 @@ def test_webhook_invalid_payload(mock_stripe_webhook):
     assert "Invalid payload" in response.json()["detail"]
 
 
-def test_webhook_invalid_signature(mock_stripe_webhook):
-    import stripe
-    # Must be the real exception type the route catches -- a bare Exception
-    # would propagate as a 500 instead of the 400 this asserts.
-    mock_stripe_webhook.side_effect = stripe.error.SignatureVerificationError(
-        "Invalid signature", "sig_header")
+def test_webhook_invalid_signature(mock_stripe_webhook, monkeypatch):
+    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
+    mock_stripe_webhook.side_effect = Exception("Invalid signature")
     response = client.post(
         "/webhooks/stripe",
         json={},
@@ -67,92 +55,35 @@ def test_webhook_invalid_signature(mock_stripe_webhook):
     assert "Invalid signature" in response.json()["detail"]
 
 
-def test_webhook_checkout_completed():
+def test_webhook_checkout_completed(monkeypatch):
+    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
+    monkeypatch.setenv("STRIPE_SECRET_KEY", "sk_test")
     with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
+            patch("app.core.usage_tracker.update_key_tier") as mock_update:
         mock_construct.return_value = {
             "type": "checkout.session.completed",
             "data": {
                 "object": {
-                    "client_reference_id": "tenant_123",
-                    "payment_status": "paid",
+                    "client_reference_id": "test_key",
                     "metadata": {
-                        "tenant_id": "tenant_123"}}}}
-        response = client.post(
-            "/webhooks/stripe",
-            json={},
-            headers={"stripe-signature": "test"}
-        )
-        assert response.status_code == 200
-        mock_update.assert_called_once_with("tenant_123", "pro")
-
-
-def test_webhook_checkout_completed_not_yet_paid_does_not_upgrade():
-    """checkout.session.completed can fire before payment actually clears
-    for delayed-notification payment methods -- must not grant Pro yet."""
-    with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
-        mock_construct.return_value = {
-            "type": "checkout.session.completed",
-            "data": {
-                "object": {
-                    "client_reference_id": "tenant_123",
-                    "payment_status": "unpaid",
-                    "metadata": {"tenant_id": "tenant_123"}}}}
+                        "api_key": "test_key"}}}}
         response = client.post(
             "/webhooks/stripe",
             json={},
             headers={"stripe-signature": "test"}
         )
         assert response.status_code == 200
-        mock_update.assert_not_called()
+        mock_update.assert_called_once_with("test_key", "pro")
 
 
-def test_webhook_subscription_deleted():
+def test_webhook_subscription_deleted(monkeypatch):
+    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
+    monkeypatch.setenv("STRIPE_SECRET_KEY", "sk_test")
     with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
+            patch("app.core.usage_tracker.update_key_tier") as mock_update:
         mock_construct.return_value = {
             "type": "customer.subscription.deleted",
-            "data": {"object": {"metadata": {"tenant_id": "tenant_123"}}}
-        }
-        response = client.post(
-            "/webhooks/stripe",
-            json={},
-            headers={"stripe-signature": "test"}
-        )
-        assert response.status_code == 200
-        mock_update.assert_called_once_with("tenant_123", "free")
-
-
-def test_webhook_subscription_updated_canceled_downgrades():
-    """customer.subscription.updated (not just .deleted) must also
-    downgrade -- a status transition to canceled/unpaid can arrive this
-    way, and .deleted is not the only terminal event Stripe sends."""
-    with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
-        mock_construct.return_value = {
-            "type": "customer.subscription.updated",
-            "data": {"object": {
-                "status": "canceled",
-                "metadata": {"tenant_id": "tenant_123"}}}
-        }
-        response = client.post(
-            "/webhooks/stripe",
-            json={},
-            headers={"stripe-signature": "test"}
-        )
-        assert response.status_code == 200
-        mock_update.assert_called_once_with("tenant_123", "free")
-
-
-def test_webhook_subscription_updated_active_does_not_downgrade():
-    with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
-        mock_construct.return_value = {
-            "type": "customer.subscription.updated",
-            "data": {"object": {
-                "status": "active",
-                "metadata": {"tenant_id": "tenant_123"}}}
+            "data": {"object": {"metadata": {"api_key": "test_key"}}}
         }
         response = client.post(
             "/webhooks/stripe",
@@ -160,4 +91,4 @@ def test_webhook_subscription_updated_active_does_not_downgrade():
             headers={"stripe-signature": "test"}
         )
         assert response.status_code == 200
-        mock_update.assert_not_called()
+        mock_update.assert_called_once_with("test_key", "free")