feat(providers): stream direct GPT-5.6 replies on iOS

[tcballard]

Summary

Implements the generic direct-provider slice of WF-ROADMAP-0016.

Adds:

• direct GPT-5.6 execution from the native iPhone/iPad app without a Mac or local gateway
• a generic OpenAI-compatible Chat Completions streaming boundary backed by the device-only Keychain credential
• explicit destination pinning, multi-turn completed history, cancellation, bounded SSE parsing, sanitized failures, and deterministic coverage

Scope

Included

• one compiled OpenAI Platform destination using the current gpt-5.6 alias
• direct URLSession streaming from iOS with a 60-second request timeout
• fragmented SSE parsing with exactly one terminal completion
• 1 MiB request, 4 MiB response, and 512 KiB individual-event bounds
• sanitized authentication, permission, usage-limit, timeout, network, malformed-response, interruption, and size failures
• explicit GPT-5.6 selection in Chat and readiness in Destinations
• completed prior user/assistant turns in follow-up requests; failed and partial attempts are excluded

Excluded

• silently adding a newly configured destination to Automatic
• OpenAI-specific Responses API behavior
• Moonshot/Kimi and OpenRouter execution presets
• dynamic model discovery or user-editable generic endpoints
• ChatGPT/Codex account authentication, OAuth, Apple Foundation Models, and paired Mac execution

Product / Architecture Decisions

• Kept the provider behind ProviderExecutor; SwiftUI does not read Keychain or perform network work.
• Reused one root-owned KeychainCredentialStore for readiness and execution while exposing only configured/not-configured snapshots to AppModel.
• Chose the current gpt-5.6 alias after verifying official OpenAI guidance and Chat Completions support.
• Kept the compatibility adapter on Chat Completions. An OpenAI-specific Responses adapter is a separate provider-preset decision.
• A saved key changes readiness only. The user must explicitly pin GPT-5.6; Automatic remains unchanged.
• Pinned requests still pass privacy and readiness eligibility through the authoritative embedded Rust routing core.
• Replays only completed conversation pairs so failed, stopped, interrupted, or partial assistant attempts do not contaminate later requests.
• Provider and raw network errors are mapped to bounded user-facing classes; response bodies and secrets are never logged or persisted.

User-Facing Contract

Chat

• The destination menu offers Automatic — Wayfinder chooses and GPT-5.6.
• Selecting GPT-5.6 sends the conversation directly from the device to OpenAI Platform.
• Stop cancels the active provider task and preserves a truthful stopped message state.

Destinations

• GPT-5.6 appears under Direct Cloud as Ready or Key required.
• Adding a key does not select GPT-5.6 or add it to Automatic.

Network Contract

• POST https://api.openai.com/v1/chat/completions
• bearer credential read only inside the provider boundary
• model: "gpt-5.6"
• ordered server-sent events ending in [DONE]

Failure Contract

• missing/invalid authentication, permission, rate/credit limits, timeout, offline/network loss, malformed/truncated output, and bounds violations remain distinct sanitized states
• a pinned unavailable destination fails specifically and never silently falls back

Verification

Ran

• xcodegen generate --spec ios/WayfinderIOS/project.yml
• xcrun swift-format format --in-place over every changed Swift source and test
• XcodeBuildMCP test_sim on iPhone 17, iOS 26.3, signed Debug build
• XcodeBuildMCP test_sim with CODE_SIGNING_ALLOWED=NO to match Apple mobile CI
• XcodeBuildMCP build_run_sim and runtime accessibility snapshot of the destination menu
• git diff --check

Covered

• 43 signed simulator tests passed, including the real simulator Keychain smoke test
• 42 unsigned simulator tests passed; the expected entitlement-dependent Keychain smoke test skipped
• fragmented and malformed SSE, ordered deltas, terminal completion, truncation, cancellation, HTTP classification, timeout, network failure, request/response bounds, and secret isolation
• readiness updates without Automatic mutation
• explicit pinned routing through the Rust core
• completed multi-turn history and exclusion of failed partial turns
• production app launch and discoverable GPT-5.6 destination

Review Path

1. OpenAICompatibleProvider.swift — credential custody, request bounds, streaming, cancellation, and error normalization
2. ChatExecution.swift and AppModel.swift — typed history and explicit pinned-route orchestration
3. WayfinderIOSApp.swift, ChatTabView.swift, and DestinationsView.swift — production dependency graph and minimal controls
4. OpenAICompatibleProviderTests.swift and AppModelTests.swift — protocol and product-boundary evidence
5. roadmap and iOS README — accepted scope and deferred provider work

Notes For Reviewer

• Official OpenAI guidance recommends the GPT-5.6 family and confirms Chat Completions support; Responses remains the preferred OpenAI-specific path for future provider optimization.
• No live API key or provider call is used in tests.
• The next review boundary is additional provider presets and model inventory/discovery, not OAuth or paired-host work.

Implementation Process

Implemented with AI assistance under the roadmap contract; final scope, review, and acceptance decisions remain with the maintainer.