fix(responses): validate stateful requests and include projections

[pjb157]

Summary

• return a structured 400 before lifecycle creation when ZDR clients send previous_response_id
• return a structured 400 before lifecycle creation when any client requests or replays unsupported reasoning.encrypted_content
• keep plaintext reasoning-item replay supported for open-weight models
• support message.output_text.logprobs in blocking and streaming Responses output
• reject unknown include values with a structured 400 instead of accepting a silent no-op
• hydrate stored Responses output from the persisted final response shape, avoiding internal 5xx errors
• correct the OpenAPI include schema from a scalar to an array

Root cause

The Responses request shape accepted extension fields through its flattened extra object, while the active translator did not fully model the include contract. Stateful hydration also tried to parse the persisted partial retrieval object as a complete response, converting absent stored content into an internal error.

Encrypted reasoning replay needs a durable client-carried sealing-key lifecycle that is separate from the one-time ZDR response key. The previous implementation draft reused a long-lived application secret, which introduced an undeclared durable content-decryption capability. This PR removes that path and fails safely until the lifecycle and security contract are designed.

Follow-up: #1489

User impact

Callers now get actionable 4xx errors for unavailable stateful capabilities rather than a silent no-op or internal error. Supported logprob projection and plaintext reasoning replay continue to work.

Verification

• cargo fmt --all -- --check
• cargo test -p dwctl --lib -j 1 inference::translation::responses:: — 63 passed
• cargo test -p dwctl --lib -j 1 test::responses:: -- --test-threads=1 — 13 passed
• just lint rust was attempted but is currently blocked outside this diff by generated SQLx optionality mismatches in fusillade-arsenal/src/postgres.rs

[cloudflare-workers-and-pages]

Deploying control-layer with    Cloudflare Pages

Latest commit:	9f856be
Status:	✅  Deploy successful!
Preview URL:	https://0d26c256.control-layer.pages.dev
Branch Preview URL:	https://peter-fix-zdr-responses-vali.control-layer.pages.dev

View logs

[Copilot]

Pull request overview

This PR tightens contract validation for the OpenAI Responses API in dwctl’s inference middleware and makes previous_response_id hydration resilient to partially-shaped stored response objects, especially in zero-data-retention (ZDR) scenarios.

Changes:

• Added early 400s for unsupported include values and for previous_response_id when ZDR is enabled, ensuring validation happens before lifecycle/storage access.
• Updated hydration to deserialize only the stored output items (instead of requiring a fully schema-valid stored response object), preventing avoidable 5xx errors.
• Added regression tests covering ZDR continuation rejection and unsupported include rejection, plus a unit test for partial stored-response hydration.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
dwctl/src/test/responses.rs	Adds integration tests asserting contract 400s for ZDR stateful continuation and unsupported include, and verifies no lifecycle rows are created.
dwctl/src/inference/translation/responses/hydrate.rs	Hydrates from stored output only (tolerant to partial stored shapes) and adds a focused unit test for the new behavior.
dwctl/src/inference/middleware.rs	Introduces early request validation for include and ZDR previous_response_id, plus a helper for consistent 400 JSON error responses.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.