feat(codex): add provider outbound policy boundary

apps/aether-gateway/src/ai_serving/codex_context.rs

@@ -1,15 +1,15 @@
 use std::sync::{Arc, OnceLock};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use aether_provider_transport::CodexFingerprintConvergenceContext;
 use http::{request::Parts, HeaderMap};
 use serde_json::Value;
 use uuid::Uuid;
 
+use crate::ai_serving::transport::ProviderOutboundRequestContext;
 use crate::client_session_affinity::codex_request_signals_from_request;
 
 #[derive(Debug, Clone)]
-pub(crate) struct CodexFingerprintContextSlot(Arc<OnceLock<CodexFingerprintConvergenceContext>>);
+pub(crate) struct CodexFingerprintContextSlot(Arc<OnceLock<ProviderOutboundRequestContext>>);
 
 impl Default for CodexFingerprintContextSlot {
     fn default() -> Self {
@@ -18,11 +18,7 @@ impl Default for CodexFingerprintContextSlot {
 }
 
 impl CodexFingerprintContextSlot {
-    fn resolve(
-        &self,
-        headers: &HeaderMap,
-        body_json: &Value,
-    ) -> CodexFingerprintConvergenceContext {
+    fn resolve(&self, headers: &HeaderMap, body_json: &Value) -> ProviderOutboundRequestContext {
         self.0
             .get_or_init(|| {
                 build_codex_fingerprint_context(headers, body_json, Uuid::now_v7().to_string())
@@ -34,10 +30,10 @@ impl CodexFingerprintContextSlot {
 pub(crate) fn resolve_codex_fingerprint_context(
     parts: &Parts,
     body_json: &Value,
-) -> CodexFingerprintConvergenceContext {
+) -> ProviderOutboundRequestContext {
     if let Some(context) = parts
         .extensions
-        .get::<CodexFingerprintConvergenceContext>()
+        .get::<ProviderOutboundRequestContext>()
         .cloned()
     {
         return context;
@@ -51,7 +47,7 @@ pub(crate) fn resolve_codex_fingerprint_context(
 pub(crate) fn install_codex_fingerprint_context_slot(parts: &mut Parts) {
     if parts
         .extensions
-        .get::<CodexFingerprintConvergenceContext>()
+        .get::<ProviderOutboundRequestContext>()
         .is_none()
         && parts
             .extensions
@@ -67,11 +63,11 @@ pub(crate) fn install_codex_fingerprint_context_slot(parts: &mut Parts) {
 pub(crate) fn ensure_codex_fingerprint_context(
     parts: &mut Parts,
     body_json: &Value,
-) -> CodexFingerprintConvergenceContext {
+) -> ProviderOutboundRequestContext {
     let context = resolve_codex_fingerprint_context(parts, body_json);
     if parts
         .extensions
-        .get::<CodexFingerprintConvergenceContext>()
+        .get::<ProviderOutboundRequestContext>()
         .is_none()
     {
         parts.extensions.remove::<CodexFingerprintContextSlot>();
@@ -84,7 +80,7 @@ pub(crate) fn attach_codex_logical_turn_context(
     parts: &mut Parts,
     body_json: &Value,
     logical_turn_id: &str,
-) -> CodexFingerprintConvergenceContext {
+) -> ProviderOutboundRequestContext {
     let context =
         build_codex_fingerprint_context(&parts.headers, body_json, logical_turn_id.to_string());
     parts.extensions.remove::<CodexFingerprintContextSlot>();
@@ -94,7 +90,7 @@ pub(crate) fn attach_codex_logical_turn_context(
 
 pub(crate) fn restore_codex_logical_turn_context(
     parts: &mut Parts,
-    context: &CodexFingerprintConvergenceContext,
+    context: &ProviderOutboundRequestContext,
 ) {
     parts.extensions.remove::<CodexFingerprintContextSlot>();
     parts.extensions.insert(context.clone());
@@ -104,10 +100,9 @@ fn build_codex_fingerprint_context(
     headers: &HeaderMap,
     body_json: &Value,
     logical_turn_id: String,
-) -> CodexFingerprintConvergenceContext {
+) -> ProviderOutboundRequestContext {
     let signals = codex_request_signals_from_request(headers, Some(body_json));
-    let mut context =
-        CodexFingerprintConvergenceContext::new(logical_turn_id, current_unix_millis());
+    let mut context = ProviderOutboundRequestContext::new(logical_turn_id, current_unix_millis());
 
     if let Some(turn_id) = signals.turn_id {
         context = context.with_original_turn_id(turn_id);
@@ -160,14 +155,14 @@ mod tests {
         assert_eq!(context.original_client_session_id(), Some("header-thread"));
         assert_eq!(context.original_prompt_cache_key(), Some("client-cache"));
         assert_eq!(
-            parts.extensions.get::<CodexFingerprintConvergenceContext>(),
+            parts.extensions.get::<ProviderOutboundRequestContext>(),
             Some(&context)
         );
     }
 
     #[test]
     fn restored_context_wins_over_retry_request_signals() {
-        let original = CodexFingerprintConvergenceContext::new("logical-turn", 1234)
+        let original = ProviderOutboundRequestContext::new("logical-turn", 1234)
             .with_original_turn_id("original-turn")
             .with_original_client_session_id("original-thread")
             .with_original_prompt_cache_key("original-cache");