fix: reject unsafe configurable AI promotion headers

[mkoushni]

Summary

Configurable promotion headers could receive a client-derived model (or other body fact) on transport, credential, and other Praxis routing headers. openai_responses_model_rewrite was the original #554 case (content-length, host, hop-by-hop); the same class of config is now rejected on every body-derived promotion sink.

• Reject hop-by-hop, framing, Host, credential, and provider API-key names (authorization, x-api-key, api-key, x-goog-api-key, …) at config load.
• Pin each fact to its dedicated x-praxis-* header (or a custom non-x-praxis-* name). Model rewrite cannot overwrite x-praxis-ai-format; format model cannot overwrite format/rewrite facts.
• Apply the same validator to Responses and Anthropic format classifiers, model_to_header, A2A, and MCP.
• Share is_credential_header with inference-fixture sanitization so the denylist cannot drift.
• Reject duplicate original/effective rewrite headers. Fail closed on unsafe targets (no parse-skip).

Default dedicated headers (x-praxis-ai-effective-model, x-praxis-ai-format, X-Model, A2A/MCP defaults) and forward_headers for Authorization are unchanged.

Related issue

Closes #554

Validation

• Unit tests
• Integration or functional tests
• make lint

Covered by promotion, openai_responses_model_rewrite, openai_responses_format, anthropic_messages_format, model_to_header, A2A, MCP, and fixture header_policy unit tests. cargo clippy -p praxis-ai-apis -p praxis-ai-filters -p praxis-test-utils --lib --tests -- -D warnings passed. cargo xtask lint-filter-docs is clean. No new example config is required; existing defaults and format: x-praxis-ai-format examples remain valid.

Checklist

• I reviewed every changed line and can explain the change.
• New capabilities include an example config and functional example test.
• User-facing behavior and generated documentation are updated.
• Performance-sensitive changes include appropriate benchmark or load-test evidence.
• Commits are signed and include a Signed-off-by trailer.

Breaking changes

Configs that name a transport, credential, API-key, or other internal x-praxis-* header as a promotion target now fail at filter construction. Dedicated defaults and custom non-x-praxis-* names continue to work. Using the same header for both rewrite effective_model and original_model is also rejected.

[leseb]

P1: promotion.rs:29 still permits authorization and unrelated internal x-praxis-* targets. A client model such as Bearer attacker can overwrite upstream credentials or routing facts.
P1: The class-level fix is missing from Anthropic config:122 and Responses-format config:112, which retain syntax-only validation before promoting body-derived values. Issue #554 explicitly requires these sibling sinks to be fixed.
P2: Generated documentation:17 omits the new requirement that original/effective header names must differ.

[mkoushni]

> P1: promotion.rs:29 still permits authorization and unrelated internal x-praxis-* targets. A client model such as Bearer attacker can overwrite upstream credentials or routing facts. P1: The class-level fix is missing from Anthropic config:122 and Responses-format config:112, which retain syntax-only validation before promoting body-derived values. Issue #554 explicitly requires these sibling sinks to be fixed. P2: Generated documentation:17 omits the new requirement that original/effective header names must differ.

P1 credentials / internal headers. Promotion targets now reject authorization/cookie/set-cookie/www-authenticate and x-praxis-* names outside the AI fact namespaces (x-praxis-ai-, x-praxis-responses-). Defaults such as x-praxis-ai-effective-model and x-praxis-responses-mode stay allowed. forward_headers still uses only the transport list, so Authorization can still be forwarded to APIs.

P1 sibling sinks. openai_responses_format and anthropic_messages_format use the same validate_promotion_header helper.

P2 docs. Generated model-rewrite docs now say effective_model and original_model must use distinct names.

[leseb]

P1 — Credential headers remain promotable. promotion.rs:64 omits x-api-key, api-key, and x-goog-api-key, although the repository explicitly classifies them as credentials in header_policy.rs:168. A client-controlled model can therefore replace an upstream API key.

P1 — Cross-purpose routing headers remain promotable. promotion.rs:68 permits every x-praxis-ai-* and x-praxis-responses-* destination. For example, configuring effective_model: x-praxis-ai-format writes a client-derived model into the format-routing fact through model_rewrite/mod.rs:411.

[praxis-bot]

Security Hardening Review

Solid security fix. The centralized denylist in promotion.rs is well-structured, the dedicated-allowlist pattern prevents cross-fact overwrites, and test coverage is thorough across all six call sites. Three items below.

[leseb]

LGMT, just need to address the bot review. Thanks!