feat(MAPCO-11434): let the worker bill a Claude subscription instead of an API key - #13
Open
razbroc wants to merge 1 commit into
Open
feat(MAPCO-11434): let the worker bill a Claude subscription instead of an API key#13razbroc wants to merge 1 commit into
razbroc wants to merge 1 commit into
Conversation
MAPCO-11434. Adds a second authentication mode so a deployment can run against a Claude subscription token rather than a metered Anthropic API key, and wires the Secret and the docs that were the unmet half of the first acceptance criterion. Which mode is in use is explicit configuration, `MODEL_AUTH`, and is never inferred from whichever credential happens to be set. Both credentials look alike to the SDK and bill completely differently, so inferring would make the billed party a property of the pod's environment rather than of a decision — and the failure is silent, because a run that quietly spends someone's personal quota looks exactly like a working one. One mode's credential is never used for the other; the worker refuses to start and names the one it found, since setting a token and forgetting the mode is the mistake an operator actually makes. An unrecognised mode also refuses rather than falling back to the default. `modelEnv` now scrubs every credential and injects exactly one, the configured mode's. Previously it injected ANTHROPIC_API_KEY over a partially-scrubbed environment; with two modes reading different variables, leaving the unused one in place would let the SDK pick the other. Chart: MODEL_AUTH plus a secretKeyRef for whichever credential the mode needs, from worker.modelSecretName. README documents both variables and the mode. subscription mode is reachable, not blessed. Anthropic's Agent SDK documentation states that claude.ai login and its rate limits may not be used for products built on the Agent SDK unless previously approved, so setting the mode asserts this deployment has that approval — code cannot check it. Three consequences no code can fix are recorded in README.md and credential.ts: the quota is shared with that person's own interactive use, runs are attributed to them rather than to the worker, and the pod crash-loops when the token expires. api-key remains the default for those reasons. Renames apiKey.ts to credential.ts, since it no longer only reads a key.
|
🎫 Related Jira Issue: MAPCO-11434 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #7 — review that first.
Adds a second authentication mode so the worker can bill a Claude subscription token instead of a metered Anthropic API key, and wires the Secret and README rows that were the unmet half of #7's first acceptance criterion.
Anthropic's Agent SDK documentation states:
This PR makes the mode reachable, not permitted. Setting
MODEL_AUTH=subscriptionasserts that this deployment has that approval; no code can check it.api-keystays the default.Three consequences no code can fix, recorded in both
README.mdandcredential.ts:The mode is explicit, never inferred
The design decision worth reviewing.
MODEL_AUTHis read from configuration; the worker does not pick whichever credential happens to be present.Both credentials look alike to the SDK and bill completely differently. Inferring would make the billed party a property of the pod's environment rather than of a decision, and the failure mode is silent — a run that quietly spends someone's personal quota looks exactly like a working one. So:
modelEnvnow scrubs then injectsIt previously injected
ANTHROPIC_API_KEYover a partially-scrubbed environment. With two modes reading different variables, leaving the unused one in place would let the SDK pick the other — so every credential is scrubbed and exactly one goes back in, making the choice singular by construction. Tested in both modes.What this closes on #7
helm/templates/deployment.yamlgetsMODEL_AUTHplus asecretKeyReffor whichever credential the mode needs (apiKeyoroauthTokenfromworker.modelSecretName), and the README documents all three variables.Note the criterion's wording is now strained:
subscriptionmode is an interactive-login credential, obtained withclaude setup-token. It is opt-in, off by default, and the reason is in the file — but if you'd rather the ticket's wording hold literally, this PR is the thing to drop.Verification
tsc --noEmitclean,eslintclean, 202 tests pass (17 files) on this branch.Not verified: the chart change.
helm templatecannot run here —Error: found in Chart.yaml, but missing in charts/ directory: mclabels, the known gap the README already records. The template edit is unrendered. Worth a second pair of eyes on the{{- if eq .Values.worker.modelAuth "subscription" }}branch.apiKey.tsis renamed tocredential.ts, since it no longer reads only a key.Refs: MAPCO-11434