Fix Vercel runtime OIDC inference readiness

[Ankit6149]

Why

Production GP2 readiness is stuck at 2/8 even after #267 because Vercel supplies its function OIDC identity request-scoped (x-vercel-oidc-token), while SignalFlow only checked process.env.VERCEL_OIDC_TOKEN. The readiness card therefore reports Hosted inference missing, and the real generation routes cannot consume the runtime token either.

What changes

• add a bounded server-only runtime OIDC reader that prefers x-vercel-oidc-token and falls back to VERCEL_OIDC_TOKEN
• wire the same owner-scoped runtime credential through all six canonical intelligence routes: project context, opportunity, strategy, platform draft, targeted revision, critics
• pass the token only as the Vercel Gateway credential for authenticated owner requests; it is never returned to the client or persisted
• make GP2 readiness evaluate the actual request-scoped runtime identity
• keep explicit AI Gateway/direct-provider keys as fallbacks
• fix the empty Hosted inference missing-card label by emitting a UI-safe configuration identifier
• add regression tests for runtime token precedence/rejection, readiness, and all six inference routes

Safety

• no database migration
• no secret value is persisted or exposed
• no weakening of owner access or inference privacy gates
• docs: synchronize Sep 4 execution and GP2 acceptance truth #265/Refine the workspace loading experience #266 remain untouched for later real Gate-C event acceptance

Base / head

• base: 9df4ab710bcc00c3cd7d4da14f3c08a15d82cad9
• head: b90dc9d15cdd32a1a9c86c3e6d4c66e394af33d7
• one squashed commit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
signal-flow-studio	Ready	Preview	Sep 4, 2026 7:27pm UTC