Repo cleanup of unneeded files of OSS repo

Author: symbibot

.env.example

@@ -7,6 +7,20 @@ SYMBIONT_API_TOKEN=                  # any opaque bearer token
 GITHUB_TOKEN=                        # OSV/GHSA rate-limit headroom
 SYMBI_LOG_LEVEL=info                 # debug | info | warn | error
 
+# LLM inference provider for the reasoning agents (pattern_scout, chain_builder,
+# poc_forge, devils_advocate, reflector). Default is ANTHROPIC_API_KEY above.
+# Provider precedence: OPENROUTER_API_KEY -> OPENAI_API_KEY -> ANTHROPIC_API_KEY.
+#
+# AWS Bedrock: codered has no native Bedrock (SigV4) client, but you can use
+# Bedrock's models through an OpenAI-compatible gateway — LiteLLM proxy or the
+# AWS "Bedrock Access Gateway" — which signs the bedrock-runtime calls for you.
+# Point the OpenAI path at the gateway (note: CHAT_MODEL + OPENAI_BASE_URL drive
+# inference; OPENAI_MODEL above is only for embeddings). The gateway host must be
+# public HTTPS — an SSRF guard rejects private/link-local addresses.
+# OPENAI_API_KEY=<token-the-gateway-accepts>
+# OPENAI_BASE_URL=https://your-bedrock-gateway/v1
+# CHAT_MODEL=anthropic.claude-3-5-sonnet-20241022-v2:0   # gateway's model id
+
 # Embeddings (default: local bge-small; override here to use ollama/openai)
 # EMBEDDINGS_PROVIDER=ollama
 # OLLAMA_HOST=http://ollama:11434

.github/workflows/refresh-compromised-packages.yml

@@ -97,6 +97,8 @@ flowchart TD
 # Prereqs: docker, docker compose, rust toolchain, Anthropic API key.
 git clone <this-repo> && cd symbi-codered
 cp .env.example .env  # set ANTHROPIC_API_KEY (and SYMBIONT_*)
+# Other LLM providers (OpenAI / OpenRouter, or AWS Bedrock via an
+# OpenAI-compatible gateway) are configured in .env — see the comments there.
 
 # Build the CLI:
 cargo build -j2 -p symbi-codered-cli --release
@@ -217,7 +219,6 @@ Everything that touches a finding or a tool call is policy-gated and audited. Se
 - [`policies/tool-authorization.cedar`](policies/tool-authorization.cedar) — per-agent permits + the `devils-advocate-forbids-store` invariant
 - [`policies/advocate.cedar`](policies/advocate.cedar) — a `rebutted` advocate verdict requires a structural witness (suppression is witness-bound, symmetric with finding creation)
 - [`policies/handoff.cedar`](policies/handoff.cedar) — which findings are eligible for the redteam handoff (advocate-confirmed/uncertain, citation-bearing, severity ≥ medium, poc not refuted; `inconclusive` is **not** dropped — a non-test is not a disproof)
-- [`policies/portal.cedar`](policies/portal.cedar) — client-portal access: operators see all runs, clients see only runs for repos they're granted (fail-closed; unauthorized → 404)
 - [`policies/step-up.cedar`](policies/step-up.cedar) — actions requiring out-of-band approval
 - [`policies/phase-gates.cedar`](policies/phase-gates.cedar) — ordering constraints between stages
 - [`policies/reflector.cedar`](policies/reflector.cedar) — reflector's capability surface