feat(gateway): add Codex Live and OpenAI Realtime

Implement preflighted Live/Realtime WebSocket transports, protocol-aware authentication, usage auditing, UI filtering, and legacy Codex permission migration.

apps/aether-gateway/src/ai_serving/planner/mod.rs

@@ -38,6 +38,7 @@ pub(crate) use self::common::resolve_upstream_is_stream_for_provider;
 pub(crate) use self::passthrough::{
     build_local_same_format_stream_attempt_source, build_local_same_format_stream_plan_and_reports,
     build_local_same_format_sync_attempt_source, build_local_same_format_sync_plan_and_reports,
+    maybe_build_pinned_stream_local_same_format_provider_decision_payload,
 };
 pub(crate) use self::plan_builders::{
     build_gemini_stream_plan_from_decision, build_gemini_sync_plan_from_decision,

apps/aether-gateway/src/ai_serving/planner/passthrough/mod.rs

@@ -8,6 +8,7 @@ pub(crate) use self::provider::{
     build_local_sync_attempt_source as build_local_same_format_sync_attempt_source,
     build_local_sync_plan_and_reports as build_local_same_format_sync_plan_and_reports,
     maybe_build_local_same_format_provider_decision_payload_for_candidate,
+    maybe_build_pinned_stream_local_same_format_provider_decision_payload,
     maybe_build_stream_local_same_format_provider_decision_payload,
     maybe_build_sync_local_same_format_provider_decision_payload,
 };

apps/aether-gateway/src/ai_serving/planner/passthrough/provider.rs

@@ -69,6 +69,7 @@ pub(crate) use self::family::{
     LocalSameFormatProviderFamily, LocalSameFormatProviderSpec,
 };
 pub(crate) use self::family::{
+    maybe_build_pinned_stream_local_same_format_provider_decision_payload,
     maybe_build_stream_local_same_format_provider_decision_payload,
     maybe_build_sync_local_same_format_provider_decision_payload,
 };

apps/aether-gateway/src/ai_serving/planner/passthrough/provider/family/build.rs

@@ -89,6 +89,21 @@ pub(crate) async fn maybe_build_stream_local_same_format_provider_decision_paylo
     decision: &GatewayControlDecision,
     body_json: &serde_json::Value,
     plan_kind: &str,
+) -> Result<Option<AiExecutionDecision>, GatewayError> {
+    maybe_build_pinned_stream_local_same_format_provider_decision_payload(
+        state, parts, trace_id, decision, body_json, plan_kind, None,
+    )
+    .await
+}
+
+pub(crate) async fn maybe_build_pinned_stream_local_same_format_provider_decision_payload(
+    state: &AppState,
+    parts: &http::request::Parts,
+    trace_id: &str,
+    decision: &GatewayControlDecision,
+    body_json: &serde_json::Value,
+    plan_kind: &str,
+    pinned_candidate: Option<(&str, &str, &str)>,
 ) -> Result<Option<AiExecutionDecision>, GatewayError> {
     let Some(spec) = resolve_stream_spec(plan_kind) else {
         return Ok(None);
@@ -141,6 +156,18 @@ pub(crate) async fn maybe_build_stream_local_same_format_provider_decision_paylo
             )
             .await?
         {
+            if pinned_candidate.is_some_and(|(provider_id, endpoint_id, key_id)| {
+                payload.provider_id.as_deref() != Some(provider_id)
+                    || payload.endpoint_id.as_deref() != Some(endpoint_id)
+                    || payload.key_id.as_deref() != Some(key_id)
+            }) {
+                crate::orchestration::release_pool_key_lease_from_report_context(
+                    state,
+                    payload.report_context.as_ref(),
+                )
+                .await;
+                continue;
+            }
             return Ok(Some(payload));
         }
     }

apps/aether-gateway/src/ai_serving/planner/passthrough/provider/family/mod.rs

@@ -4,6 +4,7 @@ mod payload;
 mod request;
 
 pub(crate) use self::build::{
+    maybe_build_pinned_stream_local_same_format_provider_decision_payload,
     maybe_build_stream_local_same_format_provider_decision_payload,
     maybe_build_sync_local_same_format_provider_decision_payload,
 };