Set release boundaries for the command-line LLM summarizer

Before release, define what the artifact refuses to do. The operational risks here are missing keys, timeouts, rate limits, malformed JSON, empty choices, and prompt text accidentally appearing in logs. Validate ranges, minimize retained data, pin the reviewed configuration, and assign an owner who can disable the feature. Safety is implemented at the boundary and release process; it is not a warning paragraph placed after an unsafe function.

The artifact's user-facing goal is specific: send one system message and one user message through an HTTP-shaped client and return a bounded one-sentence summary. Its accepted input is a non-empty text string, model name, timeout, and API key loaded from the environment. Those statements are intentionally narrower than “build an AI system.” Narrow scope lets us inspect every input and expected result, and it prevents a toy result from being presented as a production claim. Run this gate as part of a release command. A failed assertion means stop, investigate, and do not publish.

Save this as lesson.js and run node lesson.js. It uses only the language standard library, so the example is reproducible offline.

if(process.env.API_KEY) console.log('key loaded; value not printed'); else console.log('offline test mode');
const safeLog={prompt_sha256:'example',input_chars:20}; console.log(safeLog);

Expected output: offline test mode unless API_KEY exists; never the key value. Exact floating-point formatting may vary slightly, but the asserted behavior must not. Read the output as evidence about this stage, not merely proof that the interpreter started.

Separate request construction, transport, and response parsing. Test each with a fake transport before contacting a provider. For a malformed response, print the status and safe structural fields, never the API key or full prompt. Retry only explicit transient statuses such as 429, cap attempts, and preserve the final error. A missing choices array is a contract failure, not an empty successful summary.

At the safety and operations stage, save the smallest failing fixture beside the expected result. Change one cause at a time and rerun the exact command printed above; that makes the repair reviewable and keeps this chapter's progressive artifact reproducible.

Run a fixed set of short prompts through the fake contract and, when credentials are intentionally available, through the real adapter. Measure latency, retries, output length, and whether the one-sentence constraint holds. Save expected properties rather than exact prose because model wording can vary. Contract tests must remain deterministic and runnable offline.

For this safety and operations page, preserve the fixture and result as evidence for the next page. Label observations separately from conclusions: a passing assertion establishes the behavior it names, while broader usefulness requires the chapter's full evaluation set and stated operating limits.