cooper-oai faeb379646 Bind runtime auth to the provider's selected credential source (#59823) ...

## Why

Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.

## What changed

- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.

## Testing

Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.

GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0

2026-11-06 04:33:14 +00:00

..

common

Stabilize cross-platform tests and directory-change fork permissions (#59369)

2026-11-04 09:51:28 +00:00

suite

Bind runtime auth to the provider's selected credential source (#59823)

2026-11-06 04:33:14 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

prompt_prefix.rs

Stabilize cross-platform tests and directory-change fork permissions (#59369)

2026-11-04 09:51:28 +00:00