cooper-oai 1c414e0d65 Use thread runtime auth for Guardian Decisions and memory quota checks (#60064) ...

## Why

Guardian Decisions requests used bearer keys directly, bypassing runtime authentication. Memory startup quota checks used the app-level auth manager instead of the thread's provider auth context.

## What changed

- Bind Decisions credentials to runtime authentication and use route-aware HTTP clients with sensitive header protection. Preserve workload identity credentials, reuse the saved-login runtime binding, and isolate explicit API key bindings.
- Select the staging Decisions endpoint when the ChatGPT environment is staging.
- Use the thread's `ProviderAuthContext` for memory startup and quota checks, preserving account-bound network policy and applying runtime authentication.
- Keep custom destinations independent of runtime assertions.

## Testing

Add regression tests for dual-header and assertion-only authentication, fresh Decisions assertions, saved versus explicit credential isolation, workload identity, staging routing, redirect header protection, and memory quota authentication with custom destinations.

GitOrigin-RevId: 27bc7821a1cad1f5d1d2a71680527ea91ace95db

2026-11-07 05:50:00 +00:00

..

src

Use thread runtime auth for Guardian Decisions and memory quota checks (#60064)

2026-11-07 05:50:00 +00:00

templates

Add dedicated memory v2 consolidation and read prompts (#43813)

2026-09-08 12:58:11 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Use thread runtime auth for Guardian Decisions and memory quota checks (#60064)

2026-11-07 05:50:00 +00:00