fix(ai): keep provider diagnostics behind the customer boundary

[seonghobae]

Buyer impact

ScopeWeave no longer exposes raw contextual-orchestrator/provider diagnostics when an AI briefing fails. Customers receive a stable, non-cacheable error contract that explains the next action without leaking internal service names, provider routing details, configuration names, status text, or token-like diagnostics.

Exact current identity

• protected live base: develop@2c328875e00e86537df3e965170be80532571cad;
• exact contributor head: 50f0c2d18e4361e5f11507ca194c94fc7caabbdc;
• branch: fix/ai-brief-error-envelope;
• Ready/non-Draft and mechanically mergeable at the latest fresh refetch;
• current inline review threads: none; and
• no qualifying independent current-head/last-push approval exists.

Any contributor-head or protected-base movement invalidates revision-sensitive evidence until freshly revalidated.

TDD and production repair

The regression in tests/api/orchestrator-attribution.test.mjs simulates an upstream 503 containing private provider/routing diagnostics and requires the public API to suppress them. Protected develop previously returned AI 분석 실패: ${e.message}.

The production catch boundary for POST /api/projects/:id/ai/brief now returns HTTP 502 with:

{
  "error": "AI 분석을 지금 완료할 수 없습니다.",
  "code": "ai_brief_unavailable",
  "action": "잠시 후 다시 시도하세요. 계속 실패하면 워크스페이스 관리자에게 문의하세요.",
  "retryable": true
}

and Cache-Control: no-store. The repair preserves the existing authenticated tenant boundary, server-derived cost attribution, contextual-orchestrator transport behavior, timeout/response bounds, and 502 compatibility.

The regression also proves the serialized customer response excludes contextual-orchestrator, ORCHESTRATOR_, provider routing identifiers, token-like diagnostics, and upstream HTTP-status details.

Current evidence

For exact contributor head 50f0c2d18e4361e5f11507ca194c94fc7caabbdc, all six currently associated repository workflow runs are terminal GitHub-success:

• Server Tests 32679358648;
• Fuzz 32679358496;
• SAST Semgrep 32679358501;
• Security Scan 32679358631;
• Dependency Review 32679358555; and
• OSV Scanner 32679358833.

CodeRabbit's current walkthrough reports no actionable comments and Devin's current review reports no issues. Those model/comment results are supplementary and are not treated as qualifying independent approval.

The green workflow labels are product-behavior evidence, not integration authority where the owning workflow still materializes a synthetic pull-request merge instead of the immutable contributor SHA. ScopeWeave #523 owns repository-native exact-head Server Tests/coverage checkout integrity; ContextualWisdomLab/.github#1222 owns organization-reusable SAST/Security exact-head checkout integrity. Predecessor, synthetic-only, status-only, author-only, model-only, pending, skipped, neutral, absent, or stale evidence is non-authorizing.

Merge gate

Do not merge or enable auto-merge until this unchanged exact head remains reconciled to freshly resolved protected develop, the applicable exact-head evidence controls are protected-shipped and regenerated, every required CI/browser/owned statement-branch-function-line coverage/docstring/CodeQL/SAST/security/dependency/supply-chain/package/provenance gate is substantively terminal-passing for the exact contributor revision, valid unresolved findings are zero, and a qualifying independent current-head/last-push approval genuinely exists under live branch protection/rulesets.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 87563a4b-732e-472b-ac80-02e6247c3f42

📥 Commits

Reviewing files that changed from the base of the PR and between 2c32887 and 50f0c2d.

📒 Files selected for processing (2)

• server/app.mjs
• tests/api/orchestrator-attribution.test.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

AI 분석 실패 응답이 예외 메시지를 노출하지 않도록 변경되었습니다. API는 고정된 한국어 메시지, 오류 코드, 재시도 정보와 no-store 정책을 반환합니다. 테스트는 업스트림 503 응답과 내부 정보 비노출을 검증합니다.

Changes

AI 브리핑 오류 응답 경계

Layer / File(s)	Summary
AI 분석 오류 응답 및 검증 server/app.mjs, tests/api/orchestrator-attribution.test.mjs	AI 분석 실패 시 API가 502 상태, 고정된 고객용 한국어 메시지, ai_brief_unavailable 코드, 재시도 안내, retryable 플래그와 no-store 캐시 정책을 반환합니다. 테스트는 업스트림 503 응답에서 내부 서비스명, 환경변수, 토큰, 라우팅 정보와 HTTP 상태 세부사항이 노출되지 않는지 확인합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 50f0c

The PR replaces raw provider and orchestration diagnostics with a stable customer-facing AI briefing error and retry/admin guidance. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 고객 경계에서 제공자 진단 정보를 숨기는 핵심 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ai-brief-error-envelope

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.