Re-vendor Interchange trees to main HEAD for the director loader

[TheGreatAxios]

Summary

Re-pins all 11 vendored Interchange trees from 0205b07b to upstream main HEAD 1ad0104 (retrieved 2026-09-14), adding workflow-definition-loader.ts under vendor/intx-workflow-host/ for the director loader. Two commits: pristine sync, then ledgered patch re-application (as-is / adapt triage, none subsumed). First-party call sites migrate to the new source-credential resolver model. Tool-packaging stays transitive-only by written decision in docs/VENDORING.md. Sibling to #1024, which targets the same issue from an older base; parent will reconcile.

Verification

• bun install: clean
• bun run typecheck (tsc --noEmit): exit 0
• bun run build: exit 0
• bun run test (7366 tests, seed 424242): pass
• tests/unit/vendor-patch-ledger.test.ts: pass
• bun test vendor/ (1691 pass): 3 failures are pre-existing sandbox artifacts (storage-isogit delta tests shell git commit, blocked by the environment git hook), unrelated to this change
• bun run check: exit 0

Fixes CL-7913

[linear-code]

CL-7913

[TheGreatAxios]

[warden trust review] First-party credential migration (apiKey -> credentialId + credential cell).

Verdict: no blocking trust defects. Safe to land from the trust lane.

Fail-closed, verified:

• src/config/source-credentials.ts:82-89 — readSourceCredentialMaterial throws on unknown credentialId; no empty-auth path.
• vendor/intx-agent/src/credential-resolver.ts — createUnconfiguredCredentialResolver throws; vendor/intx-inference/src/harness.ts:414 installs it as the default, so any call site missing a resolver errors rather than sending unauthenticated. injectCredentials (vendor/intx-inference/src/auth.ts) resolves lazily, only when a header actually carries a sentinel.

No leak to disk/logs introduced:

• The cell (source-credentials.ts:72) is a module-scope Map that is never serialized. peekSourceCredentialSecret results flow only into ===/!== comparisons (exec/runner, tui exit/session) — never into logs, telemetry, or writers.
• Summarizer telemetry captures provider/model/error_kind only; log lines carry err.message, and the resolver error message embeds the credentialId (source id, non-secret), not the secret.
• Net effect is strictly safer persistence: InferenceSource objects no longer carry secrets at all.

No downgrade:

• No production code reads .apiKey off an InferenceSource anymore. Remaining .apiKey reads are input-lane shapes (ProviderSettings/catalog/SubAgentProvider, src/config/index.ts, src/config/inference-sources.ts, src/subagent/run.ts:291,307) feeding buildXSource inputs. The go/zen ...(fields.apiKey ...) spreads (src/config/index.ts:480,546) forward into buildOpenAISource input; the output is credentialId-based.

Session/subagent boundary sound:

• Every production agent env wires the resolver: src/session/assemble-runtime.ts:587 (covers TUI + exec via assembleChatAgent), src/subagent/run.ts:1155. Summarizer passes readMaterial (src/session/summarizer.ts:206); both runInference sites covered. Subagent primary sources register through buildXSource into the shared in-process cell. OAuth refresh paths (exec, TUI exit/session, refresh-inference-source.ts) register-then-compare, never copying secrets into source objects.

File for later (non-blocking):

• Cell is keyed by source id with silent last-write-wins. Id reuse across scopes would share/overwrite secrets. Consider warning or asserting on overwrite-with-a-different-value.
• peekSourceCredentialSecret returns the raw secret; all current uses are comparisons, but the export invites future misuse — keep an eye on new callers.
• Cross-process sidecar workers share no cell (in-process memory), so a credentialId crossing a process boundary fails closed (throws). Trust-safe direction; availability only.

Suggested permanent tests (for testsmith/builder): unknown-credentialId send throws instead of empty-auth; persisted session/settings snapshots contain no secret material; OAuth refresh registers the fresh token with no residual raw apiKey on the source.

Out of lane, not covered: vendor-tree verbatimness (critic). Did not run the suite (review-only). Pre-existing settings-file persistence of ProviderSettings.apiKey is unchanged by this PR and out of scope.

[TheGreatAxios]

Critic review · Approve

Re-vendors all 11 Interchange trees to upstream 1ad0104 as a pristine-then-patches pair with the first-party credentialId migration. Verified independently against the upstream repo — no blocking defects.

Evidence

• 5a291aad5 pristine: reactor.ts, runtime.ts, workflow-definition-loader.ts, harness.ts byte-identical (cmp) to faremeter/interchange@1ad0104; git ls-remote confirms that SHA is upstream HEAD. Both claimed upstream deletions (sidecar-placement.ts, google-genai.test.ts) confirmed absent at that SHA.
• Ledger honest: all 10 re-carry concepts (isStreamTerminal, doomLoopPolicy, ephemeralTurns, loadErrors, stopReason, …) confirmed absent upstream via git grep at the pin; adapt claims grounded (upstream assembly.ts now carries direct contextTransforms, upstream harness.ts emits inference.retry itself, upstream auth.ts/harness.ts carry the credentialId + readMaterial model). The two dropped 0.2.2-era patches document their superseding upstream code. vendor-patch-ledger.test.ts passes (marker anchors resolve both directions, incl. the new reactor-test-frozen-turns-mutation entry and the commitment-boundary marker fix).
• Migration minimal and correctly layered: buildXSource registers the secret and emits credentialId; readCurrentMaterial (agent env) vs readMaterial (summarizer auth call) match upstream's own field names. Rotation paths (refresh-inference-source, exec/runner, tui exit) re-register under the same id. tsc --noEmit exit 0 proves no InferenceSource construction site was missed.
• docs/VENDORING.md: pin + retrieval date + kill dates (2027-03-14) updated on all rows, loader provenance row added, tool-packaging decision recorded.
• Ran in the PR worktree: ledger correspondence 2 pass, credential/config/summarizer suites 130 pass, vendored-carry 2 pass, bun run lint clean, bun run build clean, tsc --noEmit clean. (Full 7366-suite not re-run; PR body reports it green.)

Should-fix (non-blocking)

• docs/VENDORING.md:109-112 + vendor/intx-inference/PATCHES.md:80-84 — "no first-party caller passes provider credentials into the vendored trees, so no migration was needed" reads as false next to this same commit's src/config/source-credentials.ts + six wiring sites. Suggest: "no ledger entry touches auth; first-party sources migrate to credentialId + cell."
• src/config/source-credentials.ts:46 — clearSourceCredentials "test seam" has zero callers in src/ or tests/; the cell leaks across tests in-process. Wire it into a shared setup or delete it.

Notes

• The "fails over to the next source on a credential failure" reactor test (reactor.test.ts:6149) is upstream code at this pin (present in the pristine tree), not a local carry — nothing to ledger there.
• Left #1024 alone; no commits made.

Reviewed: 5a291aad5 (pristine) + 1d4beb89 (patches) vs upstream 1ad010463a6bce6034cded3e078b14db482882a8.

[TheGreatAxios]

Nits fixed in 7a6ba42 (pushed to cl-7913-re-vendor-1ad0104, not merged):

1. Migration contradiction clarified — docs/VENDORING.md and vendor/intx-inference/PATCHES.md now say the vendored trees needed no migration but first-party callers were migrated to the new credential-cell model (each built source registers its secret in src/config/source-credentials.ts, handed to the vendored trees as their resolver).
2. clearSourceCredentials wired up — it now empties the module-scope credential cell in afterEach of the four suites that mutate it (src/config.test.ts, src/config/inference-sources.test.ts, src/subagent/refresh-inference-source.test.ts, src/subagent/run-source.test.ts), per the no-cross-test-state rule. No ledger triage or migration logic touched.

Verification: bun test on those 4 files — 118 pass, 0 fail; bun run typecheck — clean.