[LuneZ99]

Native WorkBuddy proxy and governed maintenance

Add an opt-in native WorkBuddy provider with isolated credential persistence, transports and durable risk state. Chat uses the vendor SSE contract and supports OpenAI Chat/Responses, Claude and Gemini clients. Account/model throttling, regional holds, free-model reset caps, breakers, credit parking and observed token/credit budgets share one governor. Midstream failures cannot replay emitted output; refresh persists rotated credentials before retrying.

Session affinity and long-conversation paging operate only within SDK-eligible credentials. Optional product switching, exit backoff and paid fallback have bounded request budgets; restrictions and durable caps survive identity changes. Content-rejection recovery rebuilds the original request, then applies user payload rules exactly once as the final semantic mutation.

Opt-in maintenance adds live catalog discovery, paginated balance observation, CN check-in, growth acceptance/verified reward claims, free-model quota scans and reset probes. Atomic receipts precede actions, survive restarts, bound retries and retain unknown rewards as unknown. Configuration reload cancels active maintenance and fences stale executors. Probes use the governed native executor with paid fallback and product switching disabled. All jobs default off.

A separate image workflow runs offline race checks and publishes immutable ghcr.io/corgicortex/cliproxyapi-wb:sha-<full-sha> candidates. It does not deploy, modify the existing DockerHub image, or use production provider accounts. Deployment is prepared independently in Qortex-GitOps with its own namespace, PVC, Secret and API key, an empty auth directory and jobs disabled.

Validation

• Full package tests pass for internal/workbuddy, internal/runtime/executor, internal/runtime/executor/helps, sdk/cliproxy/auth, sdk/cliproxy and internal/config; required server build passes.
• Fixtures cover four downstream protocols, payload ordering, parallel tool calls, truncated streams, refresh/store fencing, restrictions across restart, affinity/paging, bounded recovery, actual credit accounting, background gating, pagination completeness, reward receipts, lifecycle cancellation and reset recovery.
• WorkBuddy race CI is required before merge; local CGO is unavailable on this host.
• A full go test ./... run also encountered existing WebRTC/Responses interrupt test failures outside the modified paths. TestResponsesInterruptStopsHTTPUpstream was separately reproduced on the clean upstream-sync branch without WorkBuddy changes. Latest-head CI remains the merge gate; these failures are not represented as passing.
• No real WorkBuddy account or upstream service was used. Production litellm/cliproxy remains UID 80e2bbb7-4a50-4259-bbf1-04f947a114c8, generation 18, image eceasy/cli-proxy-api:v8.0.35, ready replica 1.

Explicit limits

Actual international web activity and task-specific growth actions remain follow-up work; the implementation does not fabricate telemetry to claim tasks were performed. Mock tests do not establish current upstream entitlement, real reward amounts or anti-abuse acceptance. Dedicated-account validation remains pending the owner's later credential handoff.