feat: v2 BYOK + multi-tenant credential foundations

[rekpero]

Summary

Lays the foundations for bring-your-own-key (BYOK) credentials and multi-tenant
deployment. Single-tenant self-host keeps working exactly as before — the new
behavior is gated behind DEPLOYMENT_MODE.

• Deployment mode: new DEPLOYMENT_MODE (single_tenant default / multi_tenant), documented in .env.example alongside Postgres + Fernet encryption setup.
• Per-org credentials: replaces the shared CLAUDE_CODE_OAUTH_TOKEN with a CredentialProvider that resolves each org's Anthropic credentials, injected through a DI container.
• Call-site wiring: agent_pool, planner, and rate_limit_watcher now resolve credentials per org and surface MissingCredentialError rather than spawning agents that would immediately fail.
• New modules: settings (pydantic-settings), tenancy (resolve_org_id), credentials, secrets, infra/crypto, models, repositories.
• Persistence: Alembic migrations + config for the Postgres system of record.
• Docs & tests: v2 planning/strategy/system-design docs and a tests/ suite.

Test plan

• Single-tenant: existing env-based credentials run agents unchanged.
• Multi-tenant: alembic upgrade head, connect a per-org key, confirm agents/planner/probe use it.
• Missing credential surfaces MissingCredentialError instead of a failed agent spawn.

🤖 Generated with Claude Code

[rekpero]

🔴 Claude BugBot Analysis

Found 4 potential bugs in this PR.

medium: 3 | low: 1

The most significant bugs are a thread-unsafe lazy-init race in the SQLAlchemy engine/session-factory helpers, a non-atomic get-or-create pattern for the bootstrap org that will throw an IntegrityError under concurrent startup in multi-tenant mode, and credential-validation logic that conflates rate-limiting with an invalid key and persists the wrong status. There is also a test-isolation gap where the get_container lru_cache is never cleared between tests.

[rekpero]

🔴 Claude BugBot Analysis

Found 1 potential bug in this PR.

medium: 1

All four previously-reported bugs are fixed in this PR (double-checked locking in db.py, IntegrityError catch-and-retry in organization_repo, tri-state _probe in api_key_provider, and get_container cache clear in conftest). One new race condition remains: FernetSecretStore._get_or_create_dek lacks the same IntegrityError catch-and-retry that was applied to get_or_create_default().

[rekpero]

🔴 Claude BugBot Analysis

Found 1 potential bug in this PR.

medium: 1

The previously reported race condition in fernet_store.py (_get_or_create_dek with no IntegrityError handling) has been correctly fixed with a try/except IntegrityError block that rolls back and re-reads the winning caller's committed DEK. One new bug was found: the test written to validate this exact fix does not exercise the IntegrityError path at all because the winning DEK is pre-committed before put() is called, causing _get_or_create_dek to short-circuit on the first get_for_org() read.

[rekpero]

🟢 Claude BugBot Analysis

No new bugs found. The previously reported race condition test (PRRT_kwDORZvToM6LYex4) has been properly fixed: get_for_org is now mocked to return None on the first call and delegate to the real implementation on subsequent calls, correctly simulating the race-loser scenario and exercising the IntegrityError catch-and-retry path end-to-end.

No bugs were detected in this PR.

[rekpero]

🔴 Claude BugBot Analysis

Found 3 potential bugs in this PR.

high: 1 | medium: 2

Three issues found: a likely NameError in planner.py where workspace_id is used in _planning_credential_env() but the enclosing function only receives workspace: dict; unhandled MissingCredentialError propagation in the agent spawn and resume paths (unlike the probe path which correctly catches it); and a fragile manual session.rollback() inside session_scope context managers in FernetSecretStore and OrganizationRepository, which works under SQLAlchemy 2.0 autobegin but risks identity-map corruption if ORM objects are referenced after the rollback.

[rekpero]

🟢 Claude BugBot Analysis

The PR correctly replaces the shared CLAUDE_CODE_OAUTH_TOKEN with a per-org credential provider. The three key improvements are: (1) resume_rate_limited_agent and _run_planning_agent_impl now fully handle MissingCredentialError with graceful cleanup; (2) the manual session.rollback() anti-pattern is replaced with session.begin_nested() SAVEPOINT in both fernet_store.py and organization_repo.py; and (3) single-tenant mode correctly bypasses all DB/crypto infrastructure. No new bugs were found in the added code.

No bugs were detected in this PR.

[rekpero]

Re: both outstanding threads (orchestrator/planner.py undefined workspace_id, orchestrator/agent_pool.py uncaught MissingCredentialError) — these were anchored to commit b4ff031. The fix landed one commit later in b3ba0da (before this run started):

• planner.py: workspace_id = workspace["id"] is assigned at the top of _run_planning_agent_impl (line 230) before the _planning_credential_env(workspace_id) call at line 240 — no NameError. _run_planning_agent_impl also already catches MissingCredentialError and marks the planning session status="error".
• agent_pool.py: _spawn_agent and resume_rate_limited_agent both already catch MissingCredentialError — resume_rate_limited_agent marks the agent failed, resets the issue to pending, and cleans up the worktree; _spawn_agent's re-raise is caught by every call site (dispatch_implement/dispatch_fix_review/dispatch_resolve_conflict), which already wrap the call in except Exception and clean up.

Added regression tests in 3d36847 (tests/test_agent_pool_credentials.py::test_resume_rate_limited_agent_missing_credential_fails_cleanly, tests/test_planner_credentials.py) covering the resume and planner paths, confirming subprocess.Popen is never invoked and state is reset cleanly. Full suite (25 tests) passes. Resolved both threads.

[rekpero]

🔴 Claude BugBot Analysis

Found 1 potential bug in this PR.

high: 1

One logic bug found: in the new MissingCredentialError handler for planning session startup, a cancelled session that also hit a missing credential is incorrectly reset to 'active' status instead of 'error', which could cause a silent infinite retry loop whenever credentials are absent.

[rekpero]

🔴 Claude BugBot Analysis

Found 1 potential bug in this PR.

medium: 1

One new medium-severity race condition: CredentialRepository.upsert() lacks the SAVEPOINT + IntegrityError guard that two analogous methods in the same PR apply, leaving concurrent first-time credential inserts unprotected. The previously reported HIGH bug (planning session incorrectly set to 'active' on MissingCredentialError + cancelled) has been fixed — the handler now unconditionally sets status='error', and the new test covers the cancelled+missing-credential path explicitly.

[rekpero]

🟢 Claude BugBot Analysis

No new bugs found in the changed lines. The previously reported race-condition bug in upsert() has been fixed: the INSERT is now wrapped in self.session.begin_nested() (SAVEPOINT) and an IntegrityError is caught to re-read the winner's row, matching the same pattern already used in _get_or_create_dek and OrganizationRepository.get_or_create_default. Corresponding tests have been added in test_fernet_store.py to exercise both concurrent DEK creation and concurrent credential upsert races.

No bugs were detected in this PR.