[jennifer-bowser]

Closes #110

[korikuzma]

This is a quick review from Codex. I haven’t reviewed the PR myself yet, but I can take a look later this week.

Please address token expiry and blocking I/O, add outbound authentication tests, and document the new client.

[korikuzma]

Codex finding: Minor: Add outbound authentication documentation

These variables appear in the generated example environment page, but users have no setup or client usage instructions. Please document credential setup, the fixed Auth0 endpoint and audience, and a minimal client example under docs/, and include the new modules in the API reference. Clarify that credentials are required for outbound authentication; the existing inbound endpoints do not instantiate this provider.

[korikuzma]

Codex finding: Severity - Moderate (incorrect behavior under specific, realistic conditions); Blocking: Correct the credential setup instructions

Credential setup instructions are now present, but the configuration table names the secret VLM_SECRET_ID; the implementation reads VLM_CLIENT_SECRET. Following the table therefore sends no configured client secret to Auth0 and prevents token retrieval. Please change the documented name to VLM_CLIENT_SECRET.

Please also distinguish these outbound credentials from the settings required to launch the existing inbound service. The table’s introductory note currently says every listed value is required for startup, although the inbound service does not instantiate TokenProvider. These are corrections needed to make the setup instructions accurate, separate from the optional documentation additions in the original comment.

[korikuzma]

Codex finding: Severity - Low (limited impact, such as documentation or maintainability issues); Non-blocking: Add client usage guidance

The previously suggested fixed Auth0 endpoint and audience, minimal client example, and API-reference entries are still absent. Adding them would help developers construct and use the outbound client without reading its implementation. These additions are optional and can be left out; they do not need a separate issue.

[jennifer-bowser]

whoops, fixed the incorrect variable name in the env var documentation. But instructions re: how to obtain a token are not public information, that's something the VLM Network admins explain once you've been accepted in. So I've documented that, but won't add further info.

Also these aren't technically required for startup now, but they will be in #112 so no point in changing docs now just to change 'em back later.

[korikuzma]

Codex finding: Severity - Low (limited impact, such as documentation or maintainability issues); Non-blocking: Clarify when credentials are required

The variable-name correction fixes the blocking issue. The remaining documentation point is smaller: the configuration page says AnyVLM cannot start without VLM_CLIENT_ID and VLM_CLIENT_SECRET, but this PR only requires them when constructing the outbound token provider.

Consider wording this as: “These credentials are required for authenticated outbound requests; they are not currently required to start the inbound service.” I understand #112 may change that requirement. This clarification is optional and can be left out.

[korikuzma]

This is still Codex reviewing. Kori will perform a human review tomorrow.

Reopened the token-expiry and credential-setup threads because required fixes remain. Please address these before merging. The optional documentation improvements can be left out.

[korikuzma]

Some small human review suggestions that are non-blocking

[korikuzma]

The blocking issues are addressed. Approved with two non-blocking follow-ups. The credential setup thread remains open.