Update 1.5.0

services/agent/internal/config/config.go

@@ -325,6 +325,7 @@ func Load() (Config, error) {
 		CommunicationSalutation:                env("COMMUNICATION_SALUTATION", "Guten Tag,"),
 		CommunicationClosing:                   env("COMMUNICATION_CLOSING", "Mit freundlichen Grüßen"),
 		CommunicationSignature:                 env("COMMUNICATION_SIGNATURE", "IT-Service"),
+		AIContentLabelEnabled:                  envBool("AI_CONTENT_LABEL_ENABLED", true),
 		AutoCategory:                           envBool("AUTO_CATEGORY", true),
 		AutoReply:                              envBool("AUTO_REPLY", false),
 		PriorityEnabled:                        envBool("PRIORITY_ENABLED", true),
@@ -651,6 +652,12 @@ func (c Config) Validate() error {
 		return fmt.Errorf("KNOWLEDGE_VECTOR_BACKEND must be one of: local, dual, neuroforge (got %q)", c.KnowledgeVectorBackend)
 	}
 	if c.KnowledgeVectorBackend == "dual" || c.KnowledgeVectorBackend == "neuroforge" {
+		if len(c.NeuroForgeAPIKey) < 24 {
+			return errors.New("NEUROFORGE_API_KEY must contain at least 24 characters for dual/neuroforge mode")
+		}
+		if isPlaceholder(c.NeuroForgeAPIKey) {
+			return errors.New("NEUROFORGE_API_KEY still contains a CHANGE_ME placeholder")
+		}
 		u, err := url.Parse(c.NeuroForgeURL)
 		if err != nil || u.Scheme == "" || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
 			return errors.New("NEUROFORGE_URL must be an absolute http(s) URL")

services/agent/internal/config/config_test.go

@@ -515,3 +515,40 @@ func TestValidateGLPIKBAutoReplyUncategorizedRequiresArticleAllowlist(t *testing
 		t.Fatalf("expected uncategorized auto reply with explicit article allowlist to validate: %v", err)
 	}
 }
+
+func TestLoadReadsAIContentLabelEnabled(t *testing.T) {
+	for key, value := range map[string]string{
+		"GLPI_URL":                 "https://glpi.internal.example",
+		"GLPI_CLIENT_ID":           "client-id",
+		"GLPI_CLIENT_SECRET":       "real-secret-value",
+		"GLPI_USERNAME":            "svc-agent",
+		"GLPI_PASSWORD":            "real-password-value",
+		"WEB_ALLOW_ANONYMOUS":      "true",
+		"AI_CONTENT_LABEL_ENABLED": "false",
+	} {
+		t.Setenv(key, value)
+	}
+	c, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.AIContentLabelEnabled {
+		t.Fatal("AI_CONTENT_LABEL_ENABLED=false was not loaded")
+	}
+}
+
+func TestValidateNeuroForgeAPIKeyForRemoteVectorBackend(t *testing.T) {
+	c := validConfig()
+	c.KnowledgeVectorBackend = "dual"
+	c.NeuroForgeURL = "http://neuroforge:8090"
+	c.NeuroForgeSearchK = 128
+	c.NeuroForgeTimeout = 5 * time.Second
+	c.NeuroForgeAPIKey = "CHANGE_ME_NEUROFORGE_API_KEY"
+	if err := c.Validate(); err == nil {
+		t.Fatal("expected placeholder NEUROFORGE_API_KEY to be rejected")
+	}
+	c.NeuroForgeAPIKey = "integration-token-0123456789abcdef"
+	if err := c.Validate(); err != nil {
+		t.Fatalf("expected strong NEUROFORGE_API_KEY to validate: %v", err)
+	}
+}