cooper-oai faeb379646 Bind runtime auth to the provider's selected credential source (#59823) ...

## Why

Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.

## What changed

- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.

## Testing

Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.

GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0

2026-11-06 04:33:14 +00:00

..

src

Bind runtime auth to the provider's selected credential source (#59823)

2026-11-06 04:33:14 +00:00

BUILD.bazel

Add wire types for runtime agent registration (#55398)

2026-10-19 22:21:46 +00:00

Cargo.toml

Bind reusable backend clients to runtime authentication (#59255)

2026-11-03 23:35:00 +00:00