feat(inference): bounded native BYOK key rotation (Wave 1, validation pending)

crates/openhuman-core/src/config/schema/context.rs

@@ -11,7 +11,7 @@
 use serde::{Deserialize, Serialize};
 
 pub use tinyagents_harness::config::{CompactionSettings, CompactionStrategy, ContextConfig};
-pub use tinyagents_harness::summarization::ToolRendering;
+use tinyagents_harness::summarization::ToolRendering;
 
 /// The whole `[context]` table: TinyAgents' [`ContextConfig`] and the
 /// compaction summarizer's OpenHuman-side settings.

crates/openhuman-core/src/inference/provider/factory.rs

@@ -13,10 +13,20 @@
 
 pub(crate) mod access_gates;
 mod chat_model;
+mod cloud_fleet;
+mod cloud_http;
 mod cloud_slug;
 mod cloud_spec;
+// The adapter is compiled and unit-tested before wiring any live BYOK route.
+// No credential group is enabled in production until explicit factory support.
+#[allow(dead_code)]
+mod credential_fleet;
 mod credentials;
 mod inspection;
+// Wave-1 scheduler foundation: remain isolated until the model-factory integration
+// adopts it in the next stacked change. No inference behavior changes in this draft.
+#[allow(dead_code)]
+mod key_pool;
 mod local_runtime;
 mod managed_backend;
 mod routing;
@@ -29,6 +39,13 @@ pub use chat_model::{
 pub(crate) use chat_model::{resolves_to_managed_backend, OpenHumanModelFactory};
 pub(crate) use cloud_slug::resolve_cloud_slug_for;
 pub(crate) use cloud_spec::{cloud_provider_spec, CloudCredentialResolver};
+/// Catalog discovery is a one-credential HTTP call. Never give its request
+/// builder a delimited fleet: that would forward multiple secrets as a single
+/// Authorization header. The native inference path owns per-call rotation.
+pub(crate) fn byok_catalog_keys(raw: &str) -> Vec<String> {
+    key_pool::parse_api_keys(raw)
+}
+
 pub use credentials::{auth_key_for_slug, lookup_key_for_slug};
 pub(crate) use credentials::{
     openai_bearer_is_oauth, redact_endpoint_origin, resolve_codex_routing,

crates/openhuman-core/src/inference/provider/factory/cloud_fleet.rs

@@ -0,0 +1,58 @@
+//! Minimal native-cloud adapter for multi-key BYOK requests.
+//! The ordinary single-key model stays unchanged. Inspection constructs only
+//! the first credential's model; it must not perform runtime failover.
+use std::sync::Arc;
+
+use tinyinference_llm::model::ChatModel;
+
+use super::credential_fleet::CredentialFleetModel;
+use super::key_pool::RotationStrategy;
+
+/// Health and cooldown belong to a destination, not merely a provider alias:
+/// changing the endpoint must not carry its previous 429 or invalid-key state.
+pub(super) fn rotation_pool_scope(
+    workspace: &std::path::Path,
+    slug: &str,
+    model: &str,
+    endpoint: &str,
+) -> String {
+    format!(
+        "{}:{}:{}:{:016x}",
+        workspace.display(),
+        slug,
+        model,
+        super::key_pool::scope_fingerprint(endpoint),
+    )
+}
+
+pub(super) fn build_cloud_model_with_keys(
+    scope: String,
+    keys: Vec<String>,
+    enable_rotation: bool,
+    mut build: impl FnMut(&str) -> anyhow::Result<Arc<dyn ChatModel<()>>>,
+) -> anyhow::Result<Arc<dyn ChatModel<()>>> {
+    let keys = if keys.is_empty() {
+        vec![String::new()]
+    } else {
+        keys
+    };
+    if !enable_rotation || keys.len() == 1 {
+        return build(&keys[0]);
+    }
+
+    let models = keys
+        .iter()
+        .map(|key| build(key))
+        .collect::<anyhow::Result<Vec<_>>>()?;
+    Ok(Arc::new(CredentialFleetModel::new(
+        scope,
+        keys,
+        models,
+        None,
+        RotationStrategy::RoundRobin,
+    )))
+}
+
+#[cfg(test)]
+#[path = "cloud_fleet_tests.rs"]
+mod tests;

crates/openhuman-core/src/inference/provider/factory/cloud_fleet_tests.rs

@@ -0,0 +1,47 @@
+use super::*;
+use std::cell::RefCell;
+
+struct NoNetworkModel;
+
+#[async_trait::async_trait]
+impl ChatModel<()> for NoNetworkModel {
+    async fn invoke(
+        &self,
+        _: &(),
+        _: tinyinference_llm::model::ModelRequest,
+    ) -> tinyinference_llm::Result<tinyinference_llm::model::ModelResponse> {
+        Err(tinyinference_llm::Error::Model("unused test route".into()))
+    }
+}
+
+#[test]
+fn inspection_binds_one_credential_without_enabling_failover() {
+    let built = RefCell::new(Vec::new());
+    let result = build_cloud_model_with_keys(
+        "inspection-model".into(),
+        vec!["key-one".into(), "key-two".into()],
+        false,
+        |key| {
+            built.borrow_mut().push(key.to_owned());
+            Ok(Arc::new(NoNetworkModel) as Arc<dyn ChatModel<()>>)
+        },
+    );
+    assert!(result.is_ok());
+    assert_eq!(*built.borrow(), ["key-one"]);
+}
+
+#[test]
+fn runtime_builds_one_native_model_per_distinct_credential() {
+    let built = RefCell::new(Vec::new());
+    let result = build_cloud_model_with_keys(
+        "runtime-model".into(),
+        vec!["key-one".into(), "key-two".into()],
+        true,
+        |key| {
+            built.borrow_mut().push(key.to_owned());
+            Ok(Arc::new(NoNetworkModel) as Arc<dyn ChatModel<()>>)
+        },
+    );
+    assert!(result.is_ok());
+    assert_eq!(*built.borrow(), ["key-one", "key-two"]);
+}

crates/openhuman-core/src/inference/provider/factory/cloud_http.rs

@@ -0,0 +1,31 @@
+//! HTTP-client policy shared by native BYOK construction.
+//! Credentialed routes never follow redirects: a custom authorization header
+//! must not travel to a different host or a plaintext HTTP endpoint.
+use crate::config::schema::cloud_providers::AuthStyle;
+
+pub(super) fn build_cloud_http_client(
+    style: AuthStyle,
+    anthropic_native: bool,
+    ca_pem: Option<&str>,
+) -> Result<Option<reqwest::Client>, String> {
+    let service_key = if anthropic_native {
+        "provider.anthropic"
+    } else {
+        "provider.compatible"
+    };
+    let pem = ca_pem.filter(|value| !value.is_empty());
+    if matches!(style, AuthStyle::Bearer | AuthStyle::Anthropic) {
+        let client = crate::util::tls::credentialed_client_builder(service_key, pem)?
+            .build()
+            .map_err(|_| "Could not build secure provider inference HTTP client".to_string())?;
+        return Ok(Some(client));
+    }
+    match pem {
+        Some(pem) => crate::util::tls::client_with_ca_bundle(pem, service_key).map(Some),
+        None => Ok(None),
+    }
+}
+
+#[cfg(test)]
+#[path = "cloud_http_tests.rs"]
+mod tests;

crates/openhuman-core/src/inference/provider/factory/cloud_http_tests.rs

@@ -0,0 +1,24 @@
+use super::*;
+
+#[test]
+fn unauthenticated_cloud_routes_keep_the_optional_http_client_behavior() {
+    assert!(build_cloud_http_client(AuthStyle::None, false, None)
+        .expect("no-auth client")
+        .is_none());
+    assert!(build_cloud_http_client(
+        AuthStyle::None,
+        false,
+        Some(include_str!("../../../util/tls/test-ca.pem")),
+    )
+    .expect("custom CA client")
+    .is_some());
+}
+
+#[test]
+fn authenticated_cloud_routes_always_install_a_redirect_safe_client() {
+    for style in [AuthStyle::Bearer, AuthStyle::Anthropic] {
+        assert!(build_cloud_http_client(style, false, None)
+            .expect("authenticated client")
+            .is_some());
+    }
+}

crates/openhuman-core/src/inference/provider/factory/cloud_slug.rs

@@ -77,6 +77,8 @@ pub(crate) fn resolve_cloud_slug_for<'a>(
     )
 }
 
+pub(super) use super::cloud_fleet::rotation_pool_scope;
+
 /// The user-facing error for a failed credential lookup: the guidance, plus
 /// the expiry signal when the lookup reported one. The doctor's
 /// refresh-required check and the Codex reconnect classifier key on those
@@ -661,45 +663,66 @@ fn try_create_cloud_slug_chat_model_from_string_with_native_tools_and_access(
         crate::security::egress::EgressDescriptor::inference(&slug, &effective_model, true),
     );
 
-    let http = match config
-        .cloud_provider_ca_certs
-        .get(&slug)
-        .filter(|pem| !pem.is_empty())
-    {
-        Some(pem) => {
-            let service_key = if anthropic_native {
-                "provider.anthropic"
-            } else {
-                "provider.compatible"
-            };
-            match crate::util::tls::client_with_ca_bundle(pem, service_key) {
-                Ok(http) => Some(http),
-                Err(error) => return Some(Err(anyhow::anyhow!(error))),
-            }
-        }
-        None => None,
+    let http = match super::cloud_http::build_cloud_http_client(
+        entry.auth_style,
+        anthropic_native,
+        config
+            .cloud_provider_ca_certs
+            .get(&slug)
+            .map(String::as_str),
+    ) {
+        Ok(client) => client,
+        Err(error) => return Some(Err(anyhow::anyhow!(error))),
     };
     let auth_style = cloud_spec::registry_auth_style(entry.auth_style)
         .expect("managed JWT entries returned above");
-    let chat = cloud_spec::build_cloud_model(cloud_spec::CloudBuild {
-        spec: cloud_spec::cloud_provider_spec(entry, &effective_model),
-        auth_style,
-        key: key.as_str(),
-        temperature_override,
-        temperature_unsupported_models: config.temperature_unsupported_models.as_slice(),
-        native_tool_calling,
-        default_provider_options,
-        extra_headers: extra_headers.as_slice(),
-        extra_query_params: extra_query_params.as_slice(),
-        user_agent: user_agent.as_deref(),
-        codex: codex_route,
-        http,
-    });
+    // Parse only actual BYOK credentials. OAuth, hosted and unauthenticated
+    // routes retain their original single-key identity and provider semantics.
+    let eligible =
+        !codex.using_oauth && matches!(entry.auth_style, AuthStyle::Bearer | AuthStyle::Anthropic);
+    let keys = if eligible {
+        super::key_pool::parse_api_keys(&key)
+    } else {
+        vec![key.clone()]
+    };
+    if keys.len() > 1 && (crate::core::runtime::is_saas() || codex.account_id.is_some()) {
+        return Some(Err(anyhow::anyhow!(
+            "multi-key BYOK rotation is unavailable for shared or account-bound sessions"
+        )));
+    }
+    let inspection_key = keys.first().cloned().unwrap_or_default();
+    let scope = rotation_pool_scope(
+        &config.workspace_dir,
+        &slug,
+        &effective_model,
+        &codex.endpoint,
+    );
+    let chat = super::cloud_fleet::build_cloud_model_with_keys(
+        scope,
+        keys,
+        eligible && credential_access == CredentialAccess::Runtime,
+        |credential| {
+            cloud_spec::build_cloud_model(cloud_spec::CloudBuild {
+                spec: cloud_spec::cloud_provider_spec(entry, &effective_model),
+                auth_style: auth_style.clone(),
+                key: credential,
+                temperature_override,
+                temperature_unsupported_models: config.temperature_unsupported_models.as_slice(),
+                native_tool_calling,
+                default_provider_options: default_provider_options.clone(),
+                extra_headers: extra_headers.as_slice(),
+                extra_query_params: extra_query_params.as_slice(),
+                user_agent: user_agent.as_deref(),
+                codex: codex_route,
+                http: http.clone(),
+            })
+        },
+    );
     if let Some(identity) = inspection_identity {
         let credential = if entry.auth_style == AuthStyle::None {
             String::new()
         } else {
-            key.clone()
+            inspection_key.clone()
         };
         let output_budget = inspection_output_budget_capability(&codex);
         // Doctor's live probe deduplicates on this identity, so it carries