jif 2c502d8b3d Bind Guardian Decisions requests to their credential source (#59914) ...

## Why

Guardian Decisions retained a copied login key after the saved login changed or was removed. Queued comparisons need to respect credential changes, while runtime-bound threads must remain tied to their startup credential source.

## What changed

- Select login credentials from the thread's `ProviderAuthContext`, falling back to the supplied auth manager when no context exists.
- Resolve saved login keys before sending requests and reject queued comparisons if their credential source has changed. Pin runtime-bound credentials to the source selected at startup.
- Revalidate implicit keys before sending, rejecting missing, padded, or FedRAMP keys. Preserve explicit key overrides and the environment-key fallback.

## Testing

Extend credential lookup and queued-request tests to cover reloaded logins, runtime source pinning, rejection of stale queued comparisons, replacement-key authorization, invalid keys, and logout.

GitOrigin-RevId: 1d975613040e08c3825ba6355a166cf0fa812cad

2026-11-06 13:54:03 +00:00

..

src

Bind Guardian Decisions requests to their credential source (#59914)

2026-11-06 13:54:03 +00:00

BUILD.bazel

Run Guardian conversation classifiers concurrently and preserve action order (#52061)

2026-10-08 10:42:28 +00:00

Cargo.toml

Support typed content in contextual prompt fragments (#54776)

2026-10-17 04:02:21 +00:00