Check declared credentials at launch, not at compile

[varunursekar]

Summary

vero harbor build used to refuse to compile unless every credential a build declares was present in the environment, even though compiling writes only the variable names into task.toml and compose. Every compile-only use (preflight, CI, tests, docs) therefore carried VERO_SKIP_SECRET_CHECK=1, and CI exported placeholder keys to satisfy it.

• The check moves to vero harbor run, after the env file is loaded and before anything is compiled or spent. Same message, same guard, at the one place the values are consumed.
• VERO_SKIP_SECRET_CHECK is gone from the compiler, the docs (11 files) and the CI workflow's placeholder env.
• New CLI test: a run with an unset declared credential exits non-zero, names the variable, and never reaches the compiler. The compiler test that expected the failure now asserts the opposite: compiling with the value unset succeeds and emits the placeholder.

Verification

tests/test_v05_harbor_build.py, tests/test_v05_cli.py, tests/test_v05_harbor_http.py and tests/test_v05_benchmark_configs.py pass with OPENAI_API_KEY and OPENAI_BASE_URL unset.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; the credential check is placed at the supported launch boundary without changing generated credential routing.

Summary

• Compile-only workflows can now emit tasks containing credential placeholders without requiring credential values.
• Launch validation runs after env-file loading and before model preflight, compilation, or execution.
• The new helper keeps ordinary task secrets and gateway upstream credential sources aligned with generated launch configuration.
• Tests and benchmark documentation are updated for the new lifecycle contract.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Load env file] --> B[Resolve build parameters]
    B --> C[Load and validate config]
    C --> D[Collect declared credential names]
    D --> E{All values present?}
    E -->|No| F[Fail before compilation or spend]
    E -->|Yes| G[Preflight models]
    G --> H[Compile temporary Harbor task]
    H --> I[Transform gateway environment]
    I --> J[Launch Harbor]
    K[Compile-only build] --> L[Emit placeholders without credential values]

Loading

_{Reviews (1) · Last reviewed commit: "Check declared credentials at launch, no..."}