fix: separate target credentials from mutation configuration

[Sonike]

Summary

Fixes #58 (MUT-004, MUT-005).

With only OPENAI_API_KEY set for the target agent, Mutiny currently selects the Featherless mutator and passes that key to its default endpoint. Invalid timeout or temperature strings also raise from the shared config loader, breaking both the CLI and /api/health.

Require a dedicated mutation key (MUTINY_FEATHERLESS_API_KEY or FEATHERLESS_API_KEY), or an explicit non-empty MUTINY_FEATHERLESS_BASE_URL before accepting the compatible OPENAI_API_KEY fallback. Keep dedicated-key precedence; empty/whitespace keys and endpoint overrides do not opt in.

Invalid, non-finite or non-positive timeouts and invalid, non-finite or negative temperatures now return an unconfigured mutator with safe numeric defaults. Existing CLI and health callers then select templates; health remains available with llm_configured=false.

Document the credential split and fallback behavior in README and .env.example. Comment out the optional example endpoint so copying the template does not itself authorize use of a target-only key. This stays within the env contract fix; the broader provider naming work remains in #21.

Type of change

• Bug fix
• Tests
• CLI / DX

Checklist

• Read CONTRIBUTING.md and SECURITY.md.
• One concern; no framework imports added to Core.
• Added unit and integration coverage for real CLI and health paths.
• Fake credentials, local mock tools and scripted sample model only; new CLI tests disable SDK trace uploads and reject creation of a remote mutation client.

Test plan

• Regression reproduction: the initial 43-case suite had 34 failures / 9 passes on the original implementation. Final coverage contains 44 new cases, including dedicated-key compatibility, explicit endpoint fallback, precedence, blank settings, malformed/non-finite values, a copied .env.example, healthy API responses and offline sample CLI runs.
• uv run --locked ruff check — passed.
• Full offline unit/integration/reliability suite on Python 3.12 — 720 passed (API keys empty; SDK tracing disabled).
• scripts/verify_release_artifacts.sh — passed: wheel/sdist builds, isolated installs, offline CLI regression fail/fix/pass, database backup/restore.
• Web npm ci, npm run lint, npx tsc --noEmit, npm run build — passed.
• git diff --check — passed.

All six jobs passed in GitHub CI at commit 0a52ea6f37715c4b1675e604f70097be7dad2a8a: Python lint, backend tests on Python 3.11 and 3.12, CLI smoke, web lint/typecheck/build, and package build. Vercel preview deployment separately requires upstream team authorization.

Created with Codex assistance.

[vercel]

@Sonike is attempting to deploy a commit to the priyanshu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[CodewithJha]

MERGE READY — root-cause fix for MUT-004/MUT-005 in load_llm_config_from_env, solid unit + health/CLI integration coverage, mutation checks fail when either guard is undone. Vercel fork auth ignored; GitHub Actions green.

[CodewithJha]

Merged — thank you @Sonike. The env contract change is exactly where it belongs: OPENAI_API_KEY alone no longer selects Featherless, garbage timeout/temperature fail closed to templates without taking down /api/health, and the new unit + CLI/health suites lock that in.

If you want another pass in the same area, these fit well:

• #21 — provider-neutral OpenAI-compatible LLM client (the rename/refactor that [BUG] MUT-004, MUT-005: OPENAI_API_KEY treated as Featherless key; garbage LLM timeout crashes health #58 deliberately left alone)
• #16 — expand secret redaction keys / inline API-key patterns
• #75 — CLI / reliability / adapter extract test gaps