fix(boost): address review findings — race condition, proxy options, stale paths

- Clear pendingFetch in KeycloakAuthClient.invalidateToken() to prevent
  returning a stale in-flight token during 401 retry
- Forward ChatOptions second parameter through boostAiProviderServiceFactory
  lazy proxy to chat() and chatStream()
- Update 3 stale doc references from kagenti-entity-provider/src/providers/
  kagentiAuth.ts to boost-node/src/KeycloakAuthClient.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gabemontero

workspaces/boost/openspec/changes/security-safety-governance/proposal.md

@@ -45,4 +45,4 @@ Enterprise AI platforms must treat security, safety, and governance as foundatio
 - `plugins/boost-common/src/permissions.ts` — 16 permission definitions with resource types
 - `plugins/boost-backend/src/middleware/security.ts` — `authorizeLifecycleAction` middleware
 - `plugins/boost-frontend/src/components/SecurityGate.tsx` — granular permission checks
-- `plugins/kagenti-entity-provider/src/providers/kagentiAuth.ts` — `KeycloakAuthClient` (OAuth2 Client Credentials Grant)
+- `plugins/boost-node/src/KeycloakAuthClient.ts` — `KeycloakAuthClient` (OAuth2 Client Credentials Grant)

workspaces/boost/plugins/boost-backend/src/plugin.ts

@@ -86,11 +86,13 @@ export const boostAiProviderServiceFactory = createServiceFactory({
       get descriptor() {
         return providerManager.getActiveProvider().descriptor;
       },
-      chat(messages) {
-        return providerManager.getActiveProvider().chat(messages);
+      chat(messages, options) {
+        return providerManager.getActiveProvider().chat(messages, options);
       },
-      chatStream(messages) {
-        return providerManager.getActiveProvider().chatStream(messages);
+      chatStream(messages, options) {
+        return providerManager
+          .getActiveProvider()
+          .chatStream(messages, options);
       },
     };
   },

workspaces/boost/plugins/boost-node/src/KeycloakAuthClient.ts

@@ -118,5 +118,6 @@ export class KeycloakAuthClient {
   invalidateToken(): void {
     this.cachedToken = undefined;
     this.tokenExpiresAt = 0;
+    this.pendingFetch = undefined;
   }
 }

workspaces/boost/specifications/prd/pluggable-ai-platform-architecture.md

@@ -214,7 +214,7 @@ Hot-swaps between configured providers at runtime. Monitors capability differenc
 | RuntimeConfigResolver              | `services/RuntimeConfigResolver.ts`                             | 30s                 | P0       | Immediate invalidation on write via `cache.delete()` |
 | ResponsesApiProvider.\_modelsCache | `providers/llamastack/ResponsesApiProvider.ts`                  | Match Kagenti       | P1       | Eliminates model cache asymmetry                     |
 | McpAuthService tokens              | `providers/llamastack/auth/McpAuthService.ts`                   | From token expiry   | P1       | Security-sensitive                                   |
-| KeycloakAuthClient                 | `kagenti-entity-provider/src/providers/kagentiAuth.ts`          | From token expiry   | P1       | Security-sensitive                                   |
+| KeycloakAuthClient                 | `boost-node/src/KeycloakAuthClient.ts`                          | From token expiry   | P1       | Security-sensitive                                   |
 | BackendToolExecutor                | `providers/responses-api/tools/BackendToolExecutor.ts`          | 5 min               | P1       | Add max size limit                                   |
 | ConversationRegistry               | `providers/responses-api/conversations/ConversationRegistry.ts` | 24h                 | P1       | Replaces unbounded Map                               |
 | DocumentSyncService                | `providers/responses-api/documents/DocumentSyncService.ts`      | No expiry           | P2       | Content hash tracking                                |

workspaces/boost/staged-issues.md

@@ -388,7 +388,7 @@ From `openspec/changes/security-safety-governance/tasks.md` section 7:
 - 7.5b Integrate into `KagentiApiClient` — inject bearer token
 - 7.6 Propagate user identity via `X-Backstage-User` header
 
-**Note:** `KeycloakAuthClient` was implemented in `kagenti-entity-provider/src/providers/kagentiAuth.ts` for entity provider use. The remaining tasks (7.3, 7.5b, 7.6) target the `KagentiApiClient` in `boost-backend-module-kagenti` for user-facing provider module use.
+**Note:** `KeycloakAuthClient` was implemented in `boost-node/src/KeycloakAuthClient.ts` for entity provider use. The remaining tasks (7.3, 7.5b, 7.6) target the `KagentiApiClient` in `boost-backend-module-kagenti` for user-facing provider module use.
 
 ### Specifications