[choisimo]

Problem and prepared change

The published site has no PUBLIC AI endpoint/model settings and falls back to ai.dothechi.com, which returns Cloudflare530/1033. The configured private service is air.nodove.com: an authenticated models request succeeds, but the browser preflight returns404 without CORS, so the actual UI cannot fetch a response.

Preserve public-variable overrides while connecting endpoint/model configuration, keep private tokens out of browser assets, gate deployment on a real authenticated service check, and verify the released commit through the actual UI without configuration overrides. Live verification now requires nonempty Korean SSE content, one terminal event, and exact agreement between the service answer and displayed text; HTTP200 or a fallback message alone cannot pass.

Verification

• Updated branch includes current main415e68d without rewriting existing history.
• Public configuration boundary and stream-evidence tests:5PASS; syntax and diff checks PASS.
• Fresh private-service diagnostic run34275202389: models200 and configured model present; preflight404, documentation origin not allowed; actual browser request failed.
• Server CORS correction prepared separately in AI-server branchfix/docs-origin-cors. Both Nginx configs pass real Nginx1.27/1.31.4 tests (preflight, origin/path/method boundaries, upstream header deduplication, error headers, unchanged caller Authorization and SSE). Full Smart Router suite1623PASS,2existingSKIP; protected source guard PASS. No production server mutation yet.

Remaining work

Do not merge until the deployed user path works. Select anonymous bounded server mediation versus per-user authentication, deploy the reviewed server correction as authorized, finish the corresponding site authentication configuration, and prove a real streamed answer from the deployed revision. Existing AI_API_TOKEN stays private and must not be copied into public JavaScript.

[codoki-pr-intelligence]

Codoki skipped this review because this pull request is in Draft. Mark it ready for review or change this in AI Review Settings.