InfraBench

Attempt scoring

Weighted checks

• ✓Passed
  core engine and unrelated capabilities are unchanged
  Reward weight 4%
• ✓Passed
  web-openai resolves its dependency set
  Reward weight 3%
• ✓Passed
  web-openai adds OpenAI SDK 7.x
  Reward weight 3%
• ✓Passed
  standalone web-openai declares one runtime key
  Reward weight 3%
• ✓Passed
  standalone credentials remain server-only
  Reward weight 3%
• ✓Passed
  standalone guidance explains server-only use
  Reward weight 2%
• ✓Passed
  infra declares the official provider constraint
  Reward weight 3%
• ✓Passed
  Terraform formats and validates when the registry is available
  Reward weight 4%
• ✓Passed
  infra declares only the Terraform admin credential
  Reward weight 3%
• ✓Passed
  openai plus infra does not create web output
  Reward weight 2%
• !Verifier or setup issue
  infra plans one app-named OpenAI project
  Reward weight 5%
• !Verifier or setup issue
  infra plans one app-named runtime service account
  Reward weight 5%
• !Verifier or setup issue
  runtime identity receives the API project-member role
  Reward weight 5%
• !Verifier or setup issue
  Terraform outputs expose both managed IDs
  Reward weight 4%
• !Verifier or setup issue
  Terraform does not mint or expose runtime API keys
  Reward weight 5%
• ✓Passed
  combined secret map is correct in plugin order 1
  Reward weight 3%
• ✓Passed
  runtime workflow works in plugin order 1
  Reward weight 4%
• ✓Passed
  combined secret map is correct in plugin order 2
  Reward weight 3%
• ✓Passed
  runtime workflow works in plugin order 2
  Reward weight 4%
• ✓Passed
  openai does not own web-openai behavior
  Reward weight 6%
• ×Failed
  plain web and infra remain isolated from OpenAI
  Reward weight 6%
• ✓Passed
  repeated apply is idempotent
  Reward weight 5%
• ✓Passed
  removing web-openai preserves infra provisioning
  Reward weight 4%
• ×Failed
  removing openai cleans all managed output
  Reward weight 4%
• ×Failed
  README documents the operator credential boundary
  Reward weight 3%
• ✓Passed
  downstream lint fixture covers OpenAI
  Reward weight 2%
• ×Failed
  repository smoke regression passes
  Reward weight 1%
• ×Failed
  repository smoke detects broken OpenAI contracts
  Reward weight 1%

The official reward is authoritative; verifier hard gates can override the visible sum of checks.

Agent input

Instruction

# Add first-class OpenAI API Platform support to n1x

Introduce an `openai` capability which, when composed with `infra`, declares the
official `openai/openai` Terraform provider at `~> 0.7.0`, creates an OpenAI
project named from `local.app_id`, creates a `${local.app_id}-runtime` service
account with the API project-member role, and exposes the project and service
account IDs as Terraform outputs. Terraform must not mint runtime API keys; it
authenticates with `OPENAI_ADMIN_KEY`.

Introduce a `web-openai` capability that requires `web` and `openai`, adds
`openai` `^7.0.0` to the generated web app, and makes the server-only
`OPENAI_API_KEY` part of the normal generated web environment workflow. When
`infra` is selected, pass the runtime key through the existing
`TF_VAR_web_secret_env_values` map. Never expose either credential through a
`NEXT_PUBLIC_*` variable.

Keep the capabilities composable:

- `web-openai` must work without `infra`.
- `openai` with `infra` must not introduce the web SDK or runtime key.
- Existing projects that select neither capability must not gain OpenAI output.
- Repeated apply operations must be idempotent.
- Removing the capabilities must clean up their managed Terraform, environment,
  and guidance insertions according to n1x's existing lifecycle rules.

Document the operator workflow and credential boundary. After provisioning, an
operator creates a scoped runtime key through the OpenAI Admin API and supplies
it through `TF_VAR_web_secret_env_values`; the admin key is only for Terraform
and must never be used for model requests.

Update repository documentation, generated guidance, lint coverage, and smoke
coverage while preserving all existing behavior.