fix(web-search): isolate replay cache by request context

[luvs01]

Motivation

• Prevent cross-context replay of bridged web-search results by binding cached entries to the full request context rather than only the provider base URL.
• Fail closed when a request lacks the complete replay scope so possession of a client-visible cell id does not grant authority to recover another principal's result.

Description

• Change bridgeSearchReplayScope to accept an OcxReasoningReplayScopeRef and derive a scope that includes clientPrincipalId, clientThreadId, providerName, providerDestinationIdentity, adapterName, modelId, and credentialIdentity so the cache is keyed to the exact conversation and serving identity (src/responses/bridge-search-replay-cache.ts).
• Populate the request's reasoning replay scope with the caller principal in prepareResponsesRequest using contextPrincipalIdOf(options.admission) (with a loopback sentinel) so restoration has the authenticated principal available (src/server/responses/request-prepare.ts).
• Use the fully bound parsed._reasoningReplayScope when recording and restoring bridged-search entries instead of the provider baseUrl in both the bridge delivery and passthrough adapter paths (src/server/responses/passthrough-delivery.ts, src/adapters/openai-responses/passthrough.ts).
• Add type and tests support: extend OcxReasoningReplayScopeRef with clientPrincipalId, update tests to exercise mismatched principal/conversation/provider/adapter/model/credential/destination cases, and add a regression that proves replay cannot cross those boundaries (tests/web-search/web-search-bridge-replay.test.ts).
• Update the architecture documentation to describe the strengthened isolation and fail-closed behavior (structure/providers-and-adapters.md).

Testing

• Ran bun x tsc --noEmit / bun run typecheck and it succeeded.
• Ran the focused web-search replay tests with ./node_modules/.bin/bun test tests/web-search/web-search-bridge-replay.test.ts and all tests passed (10 passed, 0 failed).
• Ran bun run structure:check and bun run privacy:scan and both checks passed for the modified sources.
• Notes: a full bun run test in this environment encountered unrelated environment/timeouts and a Bun 1.2.14 vs 1.4.0 zlib export mismatch; the focused tests and repository structure/privacy checks that exercise the changes are green.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6a9a8840-295a-4922-9803-8b6eac5670ef

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T06:31:12.469128Z	71f3bad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

Fixed in 4202c4b. oauthDispatch now calls bindRouteReasoningReplayScope (with the refreshed adapter's name) before nextAdapter.buildRequest, matching the bind-before-rebuild order used by every other rebuild site (passthrough-dispatch.ts, adapter-dispatch.ts, run-turn-execution.ts). Covered by a regression test in tests/server/server-key-failover-e2e.test.ts that switches the active key while a request is queued behind request pacing and asserts the bridged web_search_call is not restored under the lapsed credential (seeded memo keyed to the first credential is a miss for the second).

[luvs01]

Closing: superseded by combined PR #614, which carries this PR's request-context replay-cache isolation together with the deadline-safe quota evidence change on current dev. Combined tests: 65 pass.