fix(auth): keep credentials scoped to the final routed provider - #4081

Closed

luvs01 wants to merge 9 commits into

lidge-jun:devfrom

luvs01:agent/routed-credential-scope-20260909

Commits on Sep 9, 2026

fix(auth): scope caller credentials to the selected route
luvs01
committed
6908967
fix(auth): retain explicit OpenAI credentials within their destination scope
luvs01
committed
5f83666
fix(auth): keep ChatGPT-claimed and combined bearers off noncanonical caller-auth routes
t
committed
823ab49
fix(auth): restore caller Direct credentials on canonical reroutes under Direct own predicate
t
committed
3313d45
fix(auth): require an account claim for Direct credential restore across reroutes
t
committed
6d96a9f
fix(auth): restore only provably ChatGPT-domain caller credentials across reroutes
lidge-jun
committed
9db9648
docs(auth): note that the reroute restore is stricter than unchanged Direct forwarding
lidge-jun
committed
1466e78
test(auth): pin the canonical caller restore boundary
luvs01
committed
6314da6
test(auth): assert claimed bearer rejection outcomes
luvs01
committed
630d4fe