Take up the command center's two remaining notes on the key slots - #1050

Scope

• What this PR changes, in one or two sentences: it takes up the two command-center quality notes on Add Anthropic key slots api-5 to api-10, the key practice and a no-token health check #969's key slots that never reached the merged PR. anthropic-api-6 is recorded as a spare key of anthropic-api-5's account (it adds no credit, and the next key goes in anthropic-api-7). tools/credentials/anthropic_key_health.py passes a throttling 429 (one with retry-after) as rate_limited and fails a spend-cap 429 (one without) as spend_capped.
• Base commit: df3a477c (main). Three commits: 1581d620 (the notes), a86a5991, which takes anthropic-api-6 out of the fill-first order (the command center's ruling of 2026-10-12, 20:34Z), and 6a40d6ab, fix round 1 (below).
• Rebases: both were registry-only and approved by the command center, the last on 2026-10-13 (15:32Z), from head d5bcfd33 to 6a40d6ab. That rebase took main's manifests/evidence.json and catalogs/foundation/upstream-surface-dispositions.json, moved the five locators with the repository's locator mapping, and re-registered this change's rows.
  • The change touches the same 10 manifest rows against the old base (738fdf70) as against the new one, none is removed, and every row matches its file.
  • Every non-registry file keeps its git patch-id --stable.
  • validate.py passes, and git merge-tree --write-tree against df3a477c returns 0 (checked before the push).
• Lane: lane:foundation
• Owned paths touched:
  • tools/credentials/anthropic_key_health.py and tests/test_anthropic_key_health.py;
  • tools/claude-review-worker/worker.py (DEFAULT_KEYS), its README.md and tests/test_claude_review_worker.py;
  • tests/test_published_digest_privacy.py: KeySlotRecordDigestTests (fix round 1);
  • adoption/credential-inventory.json: anthropic-api-6's label and notes, anthropic-api-7's notes, anthropic-api-3's purpose and rotation, anthropic-api-4's CI sentence;
  • docs/decisions/2026-10-09-claude-review-worker.md: the default key list;
  • docs/decisions/2026-10-10-anthropic-key-slots-and-practice.md: the follow-up section, the slot table and the citation of the refreshed record;
  • docs/secret-storage.md: the key-practice paragraphs;
  • catalogs/foundation/upstream-surface-dispositions.json: five locators moved by 18 lines (against main 738fdf70; five lines in the first commit, the rest in fix round 1);
  • manifests/evidence.json: re-registration.

Origin. The command center's read of #969 at 28c99ca9 (2026-10-10) passed with three quality notes. The commit that answered them, ea7f3638, stayed on a local follow-up branch and was never pushed. #969 merged at 5c5bff1e without it (squash 421bf3f9). This PR is that commit, ported to current main:

• anthropic-api-6 is a spare. It holds a second key of anthropic-api-5's account, so the slot table and the next-key step say so. The next key goes in anthropic-api-7, from a new account. Checked 2026-10-12 with credential_run.py <id> --check, which prints names and state only: anthropic-api-6 is stored and anthropic-api-7 is missing.
• A throttling 429 passes; a spend-cap 429 fails. The note asked for every 429 to pass. Anthropic's docs give 429 a second meaning: the tier's spend cap, which answers 429 with no retry-after until access resumes the next month. Passing it would hide a key with no usable credit.
  • The probe child keeps only whether a 429 on GET /v1/models carried retry-after, never its value.
  • A 429 with the header is rate_limited and exits 0, so a daily timer does not alarm on throttling.
  • A 429 without it, or with its presence unknown, is spend_capped and fails.
  • Any other non-2xx answer still fails, and so does main's probe_failed (a probe that exited nonzero or reported an error). The docstrings carry the rules.
• anthropic-api-6 leaves the fill-first order (the command center's ruling of 2026-10-12, 20:34Z). The owner's order exists to fill distinct credit pools first, and a second key on anthropic-api-5's account caps exactly when anthropic-api-5 caps. It stays in the inventory as anthropic-api-5's spare, used only to replace that key.
  • The review worker's DEFAULT_KEYS drops it. The test that pins the order fails on main's worker.
  • The inventory label and notes say it is a spare of anthropic-api-5's account, citing the command center's key-practice record (table row anthropic-api-6).
  • docs/secret-storage.md item 10 now gives the current order: anthropic-api-4, -3, -2, -5, anthropic-api, then -7 to -10. The page had not taken up the owner's 2026-10-11 move of anthropic-api-2 to third (the command center's ruling-anthropic-api-automation-practice-20261011.md, which the worker already followed), nor that anthropic-api-3 serves local work only since Retire Claude review inside GitHub; AI reviews run locally #981.
  • The 2026-10-10 decision text stays as history, with a pointer to its follow-up section.
• Dropped: the third note, a planned CI fallback to anthropic-api-4 on credit exhaustion. It lapsed when Claude review inside GitHub was retired (Retire Claude review inside GitHub; AI reviews run locally #981, docs/decisions/2026-10-10-retire-in-github-claude-review.md), and the record says so.

Fix round 1 (d5bcfd33). Astra's first read at 116ebd97 asked for changes: 1 P1 and 5 P3s. The command center's tests-only Claude check passed. The command center also sent two requests about anthropic-api-7.

• anthropic-api-7 goes first in the fill-first order (the command center's requests of 2026-10-12, about 23:17Z and 23:30Z, on the owner's subscription-oriented direction).
  • It holds the owner's Max-plan API credit, which the subscription includes, so it fills before the paid keys.
  • It is a personal key scoped to one workspace. The command center's health check read it valid at 23:28:51Z.
  • The order is now anthropic-api-7, -4, -3, -2, -5, anthropic-api, then -8 to -10.
  • DEFAULT_KEYS, the worker's README, the inventory notes, the slot table, item 10 and both decision records say so. The organization's name and id are not recorded.
  • The order test pins the new order. It fails on 116ebd97's worker and passes here.
• P1, private digests: the key-slot records no longer publish digests of private command-center records: the key-practice record, cc-tools/anthropic_key_health.sh and the 2026-10-11 ruling. They are cited by name only.
  • Each public-page digest that remains is labelled "capture of a public page, read " (the command center's ruling of 2026-10-12, 22:44Z).
  • The body carries no private digest.
  • Regression: KeySlotRecordDigestTests requires each digest in the decision record, and in docs/secret-storage.md's key-practice section, to be either labelled a public capture or the sha256 of a repository file named beside it. It fails on 116ebd97 (13 sites in the decision record, 1 in secret-storage.md) and passes here. The existing guard reads JSON only.
• P3 Publish evidence-led convergence practice and retrieval comparisons #2, the captures: re-read at 2026-10-12T23:34:41Z, the errors and rate-limits pages hash exactly to the cited captures, with the cited lines unchanged. The co-op can put both in the delta read's packet.
• P3 Adopt native upstream tools and preserve token-efficiency evidence #4, the stale CI text: taken.
  • anthropic-api-3's purpose, its rotation step, anthropic-api-4's note, item 5 and item 9 now say the claude-review environment is gone. Retire Claude review inside GitHub; AI reviews run locally #981 removed the workflows that used it, and the repository's environment list, read 2026-10-12, holds only offhost-fixture.
  • The slot table gives each slot's place in the order.

Follow-ups (not in this change):

• From Astra's first read (P3):
  • Inherited hostname labels in catalogs/foundation/upstream-surface-dispositions.json (35) and manifests/evidence.json (20). None is on an added line.
  • blueprints/runtime-workers/openhands/resolver/patch_policy.py:137 cites docs/secret-storage.md:199-200, an older locator; the text it means is in the project-settings passages. It is inherited and outside this change's paths.
  • The worker's exhaustion predicate (worker.py:1091) switches keys on 402 or on 400 with "credit balance is too low", not on a spend-cap 429. The health tool now names that 429 spend_capped. Aligning the worker needs a sanitized refusal capture from the pinned CLI first.
• From Astra's delta read at d5bcfd33 (ACK; P3):
  • Captures of the 2026-10-10 Console pages (Admin API, Usage and Cost API, prompt caching, response headers) are not in the reader's packet. Each digest is labelled a capture of a public page; supplying the bytes is a packet item.
  • KeySlotRecordDigestTests checks the citation form (a labelled public capture or a named repository file), not the capture's bytes.
  • The delta's P2, the OSV oauthlib ignore expiry, is the command center's incident of 2026-10-13, 00:17Z, outside this change.
• From the command center (2026-10-12, about 23:30Z): the health tool should classify a 400 from GET /v1/models together with a 200 from GET /v1/organizations/me as an unscoped key that needs anthropic-workspace-id. The source is the "Select a workspace" section of https://docs.claude.com/en/docs/manage-claude/authentication.md (capture of a public page, read 2026-10-12T23:35:20Z, sha256 e047c3b1d130cb39939c00a5ee15b946aaba9603e3aa98c4e16e8965fc913141, lines 124-128). That is a separate change.

SOTA sources

• Anthropic API errors: https://docs.anthropic.com/en/api/errors.md, capture of a public page, read 2026-10-12T20:27:51Z and again at 23:34:41Z with the same bytes (sha256 45b370216e463bac22090d9f5823d9e410de5a05e69fac111dd8795628db4181), line 25: a 429 rate_limit_error means a rate limit, the usage tier's monthly spend cap, or a workspace spend limit; a tier spend-cap 429 has no retry-after and keeps failing until access resumes.
• Anthropic API rate limits: https://docs.anthropic.com/en/api/rate-limits.md, capture of a public page, read 2026-10-12T20:28:08Z and again at 23:34:41Z with the same bytes (sha256 447a6f223f60445f056cf237d7f690a113abc5fcd908d9bc0fb37e25c6bbbacc). Line 47: at the spend cap, usage pauses until the first day of the next month and requests return 429. Line 293: retry-after is "Not sent with the spend-cap 429".
• The command center's key-practice record key-practice-20261010.md (a private record, unchanged since 2026-10-10; no digest of it is published), which the decision cites.

Evidence-class table

Local commands run

$ python3 -m unittest <the 11 test modules that name the inventory, the health tool, the review worker, secret-storage, the dispositions or anthropic-api> tests.test_evidence_manifest tests.test_validate
Ran 944 tests in 295.365s
OK (skipped=152)
$ python3 -m unittest tests.test_claude_review_worker.ReviewRunTest.test_the_default_key_order_is_fill_first_with_api_3_second_and_api_2_third   # with main's worker.py
FAILED (failures=1)
$ python3 -m unittest tests.test_anthropic_key_health   # with main's anthropic_key_health.py
FAILED (failures=3, errors=1)   # the rate-limited/spend-capped slot test, the probe's retry-after presence, the 429 validity rows
$ python3 scripts/validate.py
(rc 0)
$ python3 scripts/evidence_manifest.py --check
{"files": 11809, "status": "passed"}
$ gitleaks git --log-opts="origin/main..HEAD" --redact .
no leaks found   (rc 0)
$ git merge-tree --write-tree origin/main HEAD   # main 489b2632, after the second commit
rc 0
# Fix round 1 (d5bcfd33, rebased onto main 738fdf70):
$ python3 -m unittest tests.test_claude_review_worker   # the order test changed first, with 116ebd97's worker.py
FAILED (failures=1)
$ python3 -m unittest tests.test_published_digest_privacy tests.test_claude_review_worker tests.test_anthropic_key_health tests.test_credential_run tests.test_credential_status tests.test_credential_tools tests.test_credential_boot_receipt tests.test_upstream_surface_watch tests.test_evidence_manifest tests.test_validate
Ran 540 tests in 114.665s
OK (skipped=8)
$ python3 scripts/validate.py
{"components": 71, "hashed_files": 11859, "profiles": 4, "receipts": 240, "status": "passed"}
$ python3 scripts/evidence_manifest.py --check
{"files": 11859, "status": "passed"}
$ gitleaks git --log-opts="origin/main..HEAD" --redact .
no leaks found
$ git merge-tree --write-tree origin/main HEAD   # main 738fdf70, before the rebase
rc 0

Decision record

docs/decisions/2026-10-10-anthropic-key-slots-and-practice.md, section "Follow-up after the command center's read (2026-10-10, taken up 2026-10-12)".

Host evidence

Not applicable: no receipt changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). (none changed)
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

🤖 Generated with Claude Code