Restarts, retention and privacy boundaries
Idempotency metadata is retained for 10 minutes under the unique constraint (owner_session_hash, idempotency_key); the database has no input, prompt or generated-text column. Results exist only in process memory. After a restart, a successful DB record with no in-memory result yields RESULT_UNAVAILABLE: use a new key to regenerate manually; the provider is never called automatically.
The formal API requires AI_PROVIDER / AI_BASE_URL / AI_API_KEY / AI_MODEL / SESSION_SECRET; public config lists names only. Clients cannot send arbitrary system prompts, provider URLs, model names or API keys. The vendor.example.invalid address in tests is a placeholder, not evidence of real vendor integration.