1.1 KiB
Model provider credential test executor
This is a caller-created, one-shot Job. Create the durable test plan through
provider-credential.test.plan, copy its testId into a fresh command, use a
fresh executionId, and instantiate a new Job name from the template.
The base admits only DNS. Production activation requires both the reviewed
PostgreSQL overlay and a deployment-specific private provider CIDR patch.
The application independently enforces the exact canonical HTTPS URL and
zero-retry/zero-cost budgets from the same allowlist mounted by the manager.
If the provider uses a private CA, also apply the public-only provider CA patch;
it adds NODE_EXTRA_CA_CERTS and a read-only CA projection without mounting a
client key or any provider credential.
The long-lived provider credential manager never mounts provider Secret
material and never receives provider egress. Only this Job mounts the one
project-scoped material file selected by the durable binding. An existing
execution intent is never sent to the provider again: the Job returns either
the durable result or outcome_unknown.