Add a bounded provider adapter

The HttpRequest snippet is a bounded construction example, not permission for a live provider call. Local candidate TLS proof does not qualify a provider account or full egress security.

Steps

Inject the framework HttpTransport port, select a fixed reviewed endpoint, keep credentials server-side, require TLS verification, disable redirects, and set connect/total timeouts plus a response-byte limit.

// Adapter fragment: imports and credential retrieval belong in the adapter source.
$response = $transport->send(new HttpRequest(
    'POST', 'https://api.openai.com/v1/responses',
    headers: ['Authorization' => 'Bearer ' . $key->reveal()],
    json: $boundedPayload,
    connectTimeoutSeconds: 5, totalTimeoutSeconds: 30,
    maximumResponseBytes: 131072, followRedirects: false
));

This fragment must not be executed with an unreviewed payload or key. The shipped AI adapter is disabled until explicitly configured. No constructor makes network calls; no unknown-outcome retry is automatic.

Verify

Use FakeHttpTransport for request assertions, malformed output, refusals, timeouts, and limits. Live verification requires separate permission and an isolated provider project. See Providers and webhooks.

Candidate transport and shared-state boundaries

The candidate's local TLS tests check actual private CA trust/hostname and deadline/size/429 failures; they are not live-provider certification. cURL does not inherit ambient proxy settings. Optional exact-origin HTTPS enforcement is not a complete DNS-rebinding or deployment-egress boundary.

Keep a single retry owner and require explicit definitely-safe/idempotent semantics before repeating writes. A timeout may mean a side effect happened. File quota/circuit/OAuth adapters need a shared private local directory and live lease authority; they are not NFS/distributed stores. Refresh or a half-open probe must finish within the configured lease.

Consequential webhooks now have an opt-in database adapter with scoped local MySQL evidence for INT-09/10. Adopt the shared-connection transaction, optional schema, private verified payload store, dispatcher and SQL-only processor contract deliberately; the old split WebhookReceiver path remains unsuitable for an atomic receipt/outbox claim. File publication and external effects are not part of that SQL transaction. A duplicate or UNKNOWN result requires the documented canonical-proof/reconciliation path, not blind replay. See atomic webhook adoption and module profile. This does not qualify a live provider, activate the KB, or authorize sending a request.

Editorial provenance

Source: resources/guides/provider.md. Source SHA-256: be9c8383697b3eec7e1c64947f956d5a77343b6b255773cf768667d6ce1373b1.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.