Harden the no-QA generation slice from local alpha testing (4.3.2)

Dockerfile

@@ -31,6 +31,10 @@ RUN groupadd --system --gid 10001 episodic \
     && chown -R episodic:episodic /app
 
 COPY --from=builder --chown=episodic:episodic /app/.venv /app/.venv
+# Pricing snapshots are read at boot; the packaged default path resolves
+# inside site-packages, so ship the repository snapshots and point
+# PRICING_SNAPSHOT_DIRECTORY at this location in deployment configuration.
+COPY --chown=episodic:episodic config/pricing-snapshots /app/config/pricing-snapshots
 
 USER 10001:10001
 

Makefile

@@ -36,7 +36,11 @@ DF12_FUTURE_ANNOTATIONS = $(DF12_PYLINT_BASE) --enable=C9112 \
 AMBRLEAKS = $(UV_ENV) $(UV) tool run --python $(DF12_PYTHON) \
 	--from '$(DF12_PYTHON_LINTS)' ambrleaks
 SKYLOS_VERSION = 4.33.2
-SKYLOS = $(UV_ENV) $(UV) tool run --from 'skylos==$(SKYLOS_VERSION)' skylos \
+# Pin the tool interpreter: Skylos parses sources with its own runtime `ast`,
+# so an older default Python misreads the project's 3.14 syntax.
+SKYLOS_CLI = $(UV_ENV) $(UV) tool run --python 3.14 \
+	--from 'skylos==$(SKYLOS_VERSION)' skylos
+SKYLOS = $(SKYLOS_CLI) \
 	--config-file pyproject.toml
 SKYLOS_PRODUCTION_TARGETS ?= alembic episodic openai_test_types.py
 
@@ -111,12 +115,18 @@ lint: check-architecture ## Run linters
 	$(AMBRLEAKS) tests
 	$(SKYLOS) $(SKYLOS_PRODUCTION_TARGETS) --category dead_code --gate --format concise --no-upload --no-provenance --no-grep-verify
 
-skylos-allow: export SKYLOS_NAME = $(value NAME)
-skylos-allow: export SKYLOS_REASON = $(value REASON)
+# Accept NAME/REASON only from the make command line so ambient environment
+# variables (for example, a host NAME export) cannot leak into the whitelist.
+cli_value = $(if $(filter command line,$(origin $(1))),$(value $(1)))
+
+skylos-allow: export SKYLOS_NAME = $(call cli_value,NAME)
+skylos-allow: export SKYLOS_REASON = $(call cli_value,REASON)
 skylos-allow: ## Document one named Skylos exception, not an entry point
 	@test -n "$${SKYLOS_NAME}" || { printf "Error: NAME is required for a named whitelist exception\\n" >&2; exit 2; }
 	@test -n "$${SKYLOS_REASON}" || { printf "Error: REASON is required for a named whitelist exception\\n" >&2; exit 2; }
-	$(SKYLOS) whitelist "$${SKYLOS_NAME}" --reason "$${SKYLOS_REASON}"
+	# The whitelist subcommand must be skylos's first argument; global
+	# options such as --config-file make the main parser treat it as a path.
+	$(SKYLOS_CLI) whitelist "$${SKYLOS_NAME}" --reason "$${SKYLOS_REASON}"
 
 check-architecture: build ## Check hexagonal architecture import boundaries
 	$(UV_ENV) $(UV) run hecate check

charts/episodic/templates/deployment.yaml

@@ -70,6 +70,14 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/episodic/values.local.yaml

@@ -5,13 +5,47 @@ image:
 
 config:
   EPISODIC_ENV: local
+  # The HTTP runtime refuses to boot without these settings, so the local
+  # preview must supply them. The object store writes beneath /tmp, which
+  # the emptyDir volume below keeps writable under the chart's
+  # readOnlyRootFilesystem default.
+  SOURCE_INTAKE_OBJECT_STORE_ROOT: /tmp/episodic-object-store
+  PRICING_SNAPSHOT_DIRECTORY: /app/config/pricing-snapshots
+  API_AUTHORIZATION_PRINCIPAL_ID: local-preview
+  DRAFT_MODEL: gpt-5.6-sol
+  OPENAI_REASONING_EFFORT: low
+  OPENAI_TOKEN_LIMIT_PARAM: max_completion_tokens
+  OPENAI_TIMEOUT_SECONDS: "600"
+  GENERATION_MAX_OUTPUT_TOKENS: "32768"
+
+# Keep the chart's readOnlyRootFilesystem default and make /tmp writable
+# through an emptyDir so the source-intake object store has somewhere to
+# write. The volume is pod-scoped: blobs vanish when the pod is replaced.
+volumes:
+  - name: tmp
+    emptyDir: {}
+volumeMounts:
+  - name: tmp
+    mountPath: /tmp
 
 existingSecretName: episodic-local
 allowMissingSecret: false
 secretEnvFromKeys:
   DATABASE_URL:
     key: database-url
     optional: false
+  API_AUTHORIZATION_BEARER_TOKEN:
+    key: api-bearer-token
+    optional: false
+  # The OpenAI pair is optional so the preview still boots without a key;
+  # the runtime requires both or neither, and the preview secret writes
+  # both together.
+  OPENAI_BASE_URL:
+    key: openai-base-url
+    optional: true
+  OPENAI_API_KEY:
+    key: openai-api-key
+    optional: true
 
 ingress:
   enabled: true

charts/episodic/values.yaml

@@ -107,6 +107,12 @@ podDisruptionBudget:
   minAvailable: 1
   # maxUnavailable: 1  # Use this OR minAvailable, not both.
 
+# Extra pod volumes and container volume mounts, passed through verbatim.
+# The container runs with readOnlyRootFilesystem, so any writable path
+# (for example, the source-intake object store root) needs a volume here.
+volumes: []
+volumeMounts: []
+
 nodeSelector: {}
 tolerations: []
 affinity: {}

config/pricing-snapshots/openai-2026-08.yaml

@@ -0,0 +1,16 @@
+pricing_snapshot_id: 018f15f8-8c12-7c3a-9e9f-9f8f8f8f8f92
+provider_name: openai
+model: gpt-5.6-sol
+operation: chat_completions
+source_kind: provider_rate_card
+currency: USD
+billing_period_key: "2026-08"
+rates_minor_per_metric:
+  input_tokens: 200
+  output_tokens: 1000
+  cached_input_tokens: 20
+  reasoning_tokens: 1000
+source_metadata:
+  source_url: https://developers.openai.com/api/docs/pricing
+retrieved_at: "2026-08-22T00:00:00Z"
+effective_from: "2026-08-01T00:00:00Z"