Henry Levy ffd3429d75 Preserve model catalog caches across header credential rotation (#54946) ...

## Why

Rotating header credentials should not discard the model catalog when a stable account ID is available.

## What changed

- Use the account ID from `CodexAuth::Headers` instead of opaque auth headers in the catalog cache identity. Provider settings remain part of the key.
- Retain credential-sensitive keys when the account ID is missing or the provider uses an explicit API key, bearer token, or command auth.
- Document that hosts using header auth must isolate model managers and cache storage by user and catalog-varying request context, since an account ID can represent a shared workspace.

## Testing

Update the auth-rotation test fixture to omit stable account metadata, preserving coverage for catalog invalidation when opaque credentials change.

GitOrigin-RevId: f96a20c5baf76b9235e131140716731da4dbee81

2026-10-17 23:22:14 +00:00

..

src

Preserve model catalog caches across header credential rotation (#54946)

2026-10-17 23:22:14 +00:00

BUILD.bazel

feat: add opt-in provider runtime abstraction (#17713)

2026-04-17 02:27:45 +00:00

Cargo.toml

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00