## 1. AI Provider Setup

- [x] 1.1 Hide provider ID from the primary form and generate it deterministically from provider kind/name.
- [x] 1.2 Keep the primary workflow to provider kind plus platform secret reference, using official-provider defaults for Base URL, models, relay mode, timeout, and redaction policy.
- [x] 1.3 Move lower-frequency provider metadata into an advanced section.
- [x] 1.4 Preserve frontend and backend raw-key redaction boundaries.

## 2. API Authorization

- [x] 2.1 Require platform administrator authentication for AI provider create/list/detail/update/status/test/models routes.
- [x] 2.2 Add or update backend tests for authorized management and unauthorized rejection.

## 3. Custom Background Theme Polish

- [x] 3.1 Tone down magical-girl custom-background panel gradients, frame ornaments, and glow.
- [x] 3.2 Add CSS contract coverage so custom-background magical-girl overrides stay muted.
- [x] 3.3 Update theme documentation to explain custom-background restraint.

## 4. Local Debug Documentation

- [x] 4.1 Document that agents should use `scripts/local-debug-start.sh` and existing default ports unless explicit `LOCAL_DEBUG_*` overrides are provided.
- [x] 4.2 Document restart discipline through `scripts/local-debug-stop.sh` then `scripts/local-debug-start.sh`.

## 5. Verification

- [x] 5.1 Run focused backend AI provider API tests.
- [x] 5.2 Run focused frontend AI provider/theme tests plus typecheck/build if touched code requires it.
- [x] 5.3 Run `scripts/check-structure.sh`.
- [x] 5.4 Run `openspec validate polish-ai-provider-onboarding --strict`.
- [x] 5.5 Browser-walkthrough `http://127.0.0.1:5173/#/aiProviders` using the existing local debug stack; cover magical-girl custom-background via CSS contract test.

## Evidence

- `npm test -- AiProvidersPage.test.tsx aiProviders.test.ts base-css.test.js` passed.
- `go test ./api -run 'TestAIProvider|TestAIInvocation|TestPluginBridgeExecute|TestCoreAPI(CreateListDetailWorkflows|ErrorResponses)' -count=1` passed.
- `npm run typecheck` and `npm run build` passed in `platform_web`.
- `scripts/check-structure.sh` passed.
- `openspec validate polish-ai-provider-onboarding --strict` returned valid; PostHog telemetry flush failed due DNS after validation success.
- Browser walkthrough used existing `http://127.0.0.1:5173/#/aiProviders`: logged in with local debug account, opened 新增提供商, confirmed no editable ID input, generated ID copy, and no visible raw key copy. OpenAI defaults `gpt-5.6-terra, gpt-5.6-luna` are covered by `schemas/aiProviders.test.ts`; magical-girl custom-background restraint is covered by `theme/base-css.test.js`.