OPENAI_API_KEY
missingMissing; live OpenAI route must remain blocked.
Owner
System administrator
/cases/CASE-DEMO-001/readiness
blocked-before-live-provisioning
Provisioning
Read-only live OpenAI provisioning checklist. It does not provision secrets, expose secret values, record approvals, or call OpenAI.
Environment
blocked-before-live-provisioningDIGIBEAT_LLM_MODEL
configuredConfigured model is gpt-4.1-mini; confirm this is approved before live validation.
Owner
Prompt/model owner
/cases/CASE-DEMO-001/prompts
DIGIBEAT_DATABASE_PATH
configuredRuntime SQLite path is /root/code/clmbs-workspace/var/digibeat-demo/pipeline.sqlite; persist or archive it if live evidence must survive restarts.
Owner
System administrator
/cases/CASE-DEMO-001/audit
Prompt registry path
configuredFilesystem prompt registry path: /root/code/clmbs-workspace/src/clmbs_digibeat_demo/prompts.
Owner
Prompt owner
/cases/CASE-DEMO-001/prompts
Operator steps
1
Confirm approvals
Accept required gates for the smoke-run scope before touching secrets.
/cases/CASE-DEMO-001/approvals2
Provision secret outside git
Set OPENAI_API_KEY in the app process manager or shell; never paste it into tracked files.
/cases/CASE-DEMO-001/provisioning3
Restart app process
Restart `uv run dev` or the target process so the environment is visible to FastAPI.
/cases/CASE-DEMO-001/readiness4
Verify readiness
Check that the readiness page reports OPENAI_API_KEY present without showing the value.
/cases/CASE-DEMO-001/readiness5
Run live smoke
Use the readiness page live-run button once, then inspect the created run detail.
/cases/CASE-DEMO-001/readiness6
Capture review evidence
Capture decision, action-board, audit, run-detail, and review-pack evidence after the smoke run.
/cases/CASE-DEMO-001/live-rehearsalApproval preconditions
Data handling policy
blockedRecord and accept this gate before provisioning live credentials for the smoke run: Data handling policy.
/cases/CASE-DEMO-001/approvalsAccess and role model
blockedRecord and accept this gate before provisioning live credentials for the smoke run: Access and role model.
/cases/CASE-DEMO-001/approvalsLive OpenAI validation
blockedRecord and accept this gate before provisioning live credentials for the smoke run: Live OpenAI validation.
/cases/CASE-DEMO-001/approvalsOutput and archive boundary
blockedRecord and accept this gate before provisioning live credentials for the smoke run: Output and archive boundary.
/cases/CASE-DEMO-001/approvalsAnonymized learning
blockedRecord and accept this gate before provisioning live credentials for the smoke run: Anonymized learning.
/cases/CASE-DEMO-001/approvalsEvidence after provisioning
Readiness screenshot
requiredShows OPENAI_API_KEY present without exposing the key.
/cases/CASE-DEMO-001/readinessLive run detail
requiredStored run with model, prompt refs, selected sources, outputs, usage metadata, and raw payload.
/cases/CASE-DEMO-001/runs/<run_id>Live evidence log
requiredLocal evidence entries for readiness, run detail, audit, decision, and review pack.
/cases/CASE-DEMO-001/live-evidenceAudit snapshot
requiredDerived event list that includes the live run and any errors.
/cases/CASE-DEMO-001/audit-log.jsonDecision snapshot
requiredUpdated go/no-go state after the live smoke result is reviewed.
/cases/CASE-DEMO-001/decision-center.jsonReview pack
requiredInternal Markdown pack with source ids and stored run evidence.
/cases/CASE-DEMO-001/review-pack.mdNo-go rules
Missing approvals
abortDo not provision or run live generation while required gates are pending.
/cases/CASE-DEMO-001/approvalsMissing source boundary
abortDo not run real customer material until source scope, retention, and access decisions are accepted.
/cases/CASE-DEMO-001/sourcesMissing QA owner
abortDo not send or label client-facing output without manual QA ownership.
/cases/CASE-DEMO-001/output-qaUnsourced live output
abortDo not use model output externally if claims lack source ids or assumption labels.
/cases/CASE-DEMO-001/canvasPublic/client sharing
abortNo public link or client login exists; use internal review or consultant-led screenshare only.
/cases/CASE-DEMO-001/client-handoffSecret handling rules
Do not commit OPENAI_API_KEY or paste it into Markdown, JSON, screenshots, approval notes, or prompt overrides.
Provision the key only after data-handling, access/role, live OpenAI, output/archive, and learning gates are accepted for the rehearsal scope.
Restart the app process after provisioning; do not expect an already-running process to see new environment variables.
Use the readiness page only to confirm presence/absence; never add a route that displays the secret value.
Rotate or remove the key after rehearsal if the environment is not a controlled persistent runtime.