tracker: multiple inference credential sets per account

[jhgaylor]

Two customers want the same sentence and need different things.

The reseller. One account is really N end customers. He needs each end
customer's turns on that customer's inference credential, never another's.

The quota-juggler. One tenant, several Claude subscriptions, exhausting
quota on one and wanting the next agent to run on another.

Today inference_credentials is one row per user with four fixed ciphertext
columns and a unique_constraint(:user_id). InferenceCredentials.select/4
is the whole selection rule, and it reads that one row.

Direction

The reseller's answer is principals, not credential sets. ADR 0044 already
wrote the objection down -- "one shared service account is not isolation" --
and Principals.billing_subject_id/1 already gives him one invoice with
per-end-user usage attribution. One gap blocks it (item 10 below).

The juggler's answer is credential sets: inference_credentials becomes
1:N, an agent names its default and a launch may override it.

Relationship to ADR 0052

ADR 0052 (user-owned ChatGPT grants, #2010) is merged as Proposed, and
#2011-#2015 + #2017 build its sections 1, 3 and 6. Sections 4 (selection)
and 5 (sandbox identity) are unbuilt, and that is exactly the ground this
work stands on. This tracker builds section 4's selection plumbing in the
shape 0052 asks for, so the ChatGPT work lands on top of it rather than
colliding, and amends 0052's "no per-agent preference in the first version".

Stack

1. ADR 0053 + index refresh
2. select/4 returns a source struct, not a bare atom (pure refactor)
3. Fix: an env/vault secret shadowing a static inference credential resolves
   the source to :own (P1, mis-bills on prod today)
4. Inference credential pairs move off the shared .env into process env
5. inference_credentials gains name + is_default; 1:N
6. agents.inference_credential_id + allowed_inference_credential_ids
7. conversations.inference_credential_id per-launch override
8. API: CRUD, OpenAPI, contract, TS SDK
9. Console
10. An owner may set an inference credential on a principal it owns
11. Docs, CHANGELOG, SDK bump

The bug in item 3

PlatformInference.gate/3 and select/4 both ask has_own?, which reads only
the inference_credentials table. A vault secret named ANTHROPIC_API_KEY
is invisible to it, but wins in the sandbox env (egress.ex:223-226, and
docs/concepts/secrets.md:212 publishes the rule). So on a deployment holding
platform keys -- ours since 2026-09-03 -- the turn is selected :platform,
stamped "platform" by TurnMachine.with_inference/2, priced by
CreditPricer, counted against PLATFORM_INFERENCE_DAILY_CENTS, and can be
refused by check_ceiling/0, while the tenant's own vault key actually serves
it. #1941 fixed an adjacent facet today; this one stands.

ADR 0052 section 4 already mandates the fix: "Environment/vault API-key
overrides must resolve into the same explicit source decision."

[jhgaylor]

Stack opened. Item 3 split in two: the mis-billing and the door refusal are
the same root cause but separate fixes with separate blast radii.

#	PR	State
1	#2019 — ADR 0053 + index	open
2	#2022 — select/4 returns a source struct	open
3	#2023 — a tenant secret resolves the source to :own	open
4	the door gate stops refusing those launches on the platform ceiling
5	inference pairs move off the shared .env
6	inference_credentials gains name + is_default; 1:N
7	agents.inference_credential_id + allowlist
8	conversations.inference_credential_id per-launch override
9	API, OpenAPI, contract, TS SDK
10	console
11	an owner may write a credential on a principal it owns
12	docs, CHANGELOG, SDK bump

Note for whoever is on the ADR 0052 stack

#2011-#2015 and #2017 and this stack do not touch the same files. The 0052
stack lives in chatgpt_accounts/*, platform_chatgpt*,
broker/native/protected_compiler.ex and one line each of
environments/secret.ex, vaults/vault_secret.ex and
secret_bindings/binding.ex. This one lives in inference_credentials*,
platform_inference.ex, sprite_env.ex, identity.ex, turn_machine.ex
and the agent/conversation schemas.

The overlap is conceptual and deliberate: PR 2 builds ADR 0052 decision 4's
source struct, which #2017 does not, so the grant work should extend
%InferenceCredentials.Source{} with grant_id and generation rather than
introduce a second carrier. ADR 0053 decision 5 also adopts #2017's reserved
name — CODEX_CHATGPT_ACCESS_TOKEN stays un-overridable while the four
static credentials stay overridable, stated as "reserve what rotates,
resolve what is static".

[jhgaylor]

Follow-up found while reviewing the stack: #2033 — an environment's plain env_vars map can name ANTHROPIC_API_KEY and overrides the credential in the sandbox identically to a secret, but secret_keys/2 reads only the two secrets tables, so that tenant is still selected :platform and still billed to the platform ledger. Not a regression (gate and provision agree), but it is the hole left in "a tenant secret naming a credential is not platform inference" once #2023 lands.

[jhgaylor]

Stack complete — 13 PRs, all chained.

#	PR	What
1	#2019	ADR 0053 + index
2	#2022	select/4 returns a source struct
3	#2023	a tenant secret resolves the source to :own — the live mis-billing
4	#2025	the door gate stops refusing those launches
5	#2027	credentials off the shared .env ⚠️ upgrade note
6	#2028	inference_credentials becomes 1:N named sets
7	#2031	agents.inference_credential_id + allowlist
8	#2034	per-launch override
9	#2042	sets over the API
10	#2043	write a credential into a named set
11	#2044	an owner may write a credential on its principal — the reseller's blocker
12	#2045	console: name a set, point an agent at it
13	#2046	docs, CHANGELOG, SDK 1.32.0

Where the two customers land

The reseller gets principals, not sets — ADR 0044 already decided that a
shared service account is not isolation, and billing_subject_id/1 already
gives one invoice with per-customer usage attribution. #2044 closes the one
gap that blocked it: a principal-scoped key cannot write account state, so
nothing could put a customer's key on the tenant that would run on it.
#1566 stays open — the console cannot see a principal an account owns, so
this path is API-only today.

The quota-juggler gets sets: a set per subscription, an agent pointed at
one, a launch able to name another inside the agent's allowlist. Automatic
failover on quota exhaustion is deliberately not built (ADR 0053
consequences): it needs per-runtime quota-error detection, per-credential
cooldown state and a mid-turn ACP restart. Static per-agent assignment is how
people actually divide work across subscriptions.

Two bugs found on the way, both live

• The mis-billing in fix: a tenant secret naming a credential is not platform inference #2023, and its mirror image in fix: the door gate asks what the provision will answer #2025 — a tenant on their
  own vault-supplied key was billed for platform inference and could be
  refused once the deployment spent its daily ceiling.
• Two schema gaps closed in feat(api): credential sets over the API, and a launch that can name one #2042: POST /api/conversations and the agent
  schema each had a column the context read that no API could write. The
  conversation one was worse than invisible — @queued_attr_keys is an
  allowlist, so a queued launch dropped the field.

Also filed

#2024 — ExecutionTransportTest and ExecutionDeadlineWorkerTest assert
async progress against a 200 ms wall clock. Reproduced on clean main with a
fixed seed; green in CI, so it is a margin rather than a break. Not this
stack's doing.