Add credential-aware Issue runtime choices

[luokerenx4]

What changed

• adds a secret-free credential slug to scheduled Issue declarations, mutations, projections, tools, audit, and snapshots
• changes the Issue work-item flow to Runtime → Credential → provider-scoped Model → model-semantic Effort
• freezes the chosen credential/model/effort tuple into each fresh Session runtime binding while keeping exact resumed Sessions immutable
• updates demo handlers, localization, owner guides, self-scheduling guidance, and the implementation plan

Why

The previous Issue editor only exposed a default/custom model and a runtime-hardcoded effort list. It could not show which provider credential would actually own the run, so users could accidentally pair one provider's model with another provider's endpoint.

User impact

Scheduled Issues can now explicitly choose a compatible OpenAlice credential, then select from that provider's known models and only the effort tiers supported by the selected model. Workspace/native authentication remains a valid default and no secret-bearing data is persisted in the Issue.

Validation

• npx tsc --noEmit
• pnpm -C ui exec tsc -b
• focused Issue, scheduler, route, tool, UI, and demo-handler Vitest suites
• pnpm test — 476 files / 3,950 tests passed, one file skipped
• real dev and demo browser walkthroughs
• CSC_IDENTITY_AUTO_DISCOVERY=false pnpm electron:smoke:workspace

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openalice-demo	Building	Preview	Aug 5, 2026 4:03pm