# Phase 3 — OpenAI integration

**Status:** Implemented (local key via gitignored xcconfig)  
**Date:** 2026-10-12

## What shipped

- `OpenAIClient` — async chat completions with JSON Schema response format, 30s timeout
- `OpenAISearchInterpreter` — NL query → schema-validated `SearchCriteria`
- `SecretsProvider` — XOR/base64 de-obfuscation of build-injected key (still extractable from binary)
- `FeatureFlags.isAIInterpretationEnabled` — disable AI and fall back to mock interpreter
- Sandbox: `ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES`
- Job listings still come from **mock/fixture** Indeed sources (Option C vendor pending)

## Local setup

1. Copy `Config/Secrets.xcconfig.example` → `Config/Secrets.xcconfig`
2. Set `OPENAI_API_KEY_OBFUSCATED` using:

```swift
SecretsProvider.obfuscateForConfig("sk-...")
```

3. Build & run. App uses `AppDependencies.live`.

`Secrets.xcconfig` is **gitignored**. Never commit plaintext or obfuscated production keys.

## Security limits

- Obfuscation is **not** encryption; a determined attacker can recover the key from the binary.
- Do not log prompts/responses that contain PII in production builds.
- Rotate keys if exposed in chat, screenshots, or commits.

## Feature flag

```swift
FeatureFlags.isAIInterpretationEnabled = false // mock interpretation only
```