While checking the consolidated transport in PR #66 at HEAD 12dc469, I found a configuration gap outside its 16 OCR findings:
OpenAIResponsesModel::new saves api_key, but initializes headers to an empty vector (serdes-ai-models/src/openai/responses/mod.rs).ws::run_ws_turn creates WebSocketConfig and assigns only model.headers to config.headers (serdes-ai-models/src/openai/responses/ws.rs:77-79).- HTTP POST construction separately applies Authorization, OpenAI-Organization, and OpenAI-Project from the model fields.
Consequently a caller who sets the WebSocket endpoint, selects Transport::WebSocket, and supplies credentials through the existing constructor must also explicitly call with_header("Authorization", ...). The model's organization/project builders likewise do not populate the handshake. The codex_haiku example explicitly adds Authorization, so it does not expose this gap.
Suggested follow-up: define one model-level auth/routing/custom-header policy for both transports, with a documented override policy and handshake-capture regression tests. This observation is based on the actual configuration path; no live API credentials were used. It is recorded separately rather than silently expanding the current findings-only implementation scope.
While checking the consolidated transport in PR #66 at HEAD
12dc469, I found a configuration gap outside its 16 OCR findings:OpenAIResponsesModel::newsavesapi_key, but initializesheadersto an empty vector (serdes-ai-models/src/openai/responses/mod.rs).ws::run_ws_turncreates WebSocketConfig and assigns onlymodel.headersto config.headers (serdes-ai-models/src/openai/responses/ws.rs:77-79).Consequently a caller who sets the WebSocket endpoint, selects Transport::WebSocket, and supplies credentials through the existing constructor must also explicitly call with_header("Authorization", ...). The model's organization/project builders likewise do not populate the handshake. The codex_haiku example explicitly adds Authorization, so it does not expose this gap.
Suggested follow-up: define one model-level auth/routing/custom-header policy for both transports, with a documented override policy and handshake-capture regression tests. This observation is based on the actual configuration path; no live API credentials were used. It is recorded separately rather than silently expanding the current findings-only implementation scope.