Evidence record / omp

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-omp-oauth-account-pools-became-workload-controls-then-needed-a-fix-for-spending-excluded-accou

OAuth account pools became workload controls, then needed a fix for spending excluded accounts reset credits. task.agentAccountPools maps exact named agents and listed providers to allowed OAuth identities. For those providers the child refuses other accounts and API keys; an empty list permits none. Pools choose identities, not providers; model and retry policy still choose providers, and a custom SDK getApiKey resolver bypasses pools. A quota-blocked session could nevertheless redeem a saved reset credit for an account it could not use. v18.9.0 checks pool membership both when planning that restore and immediately before spending it. This is an excluded-account credit-consumption defect, not evidence of task inference under that identity.

Channel: tagged-release. Half: both. Date: 2026-10-07 (v18.8.1); 2026-10-11 (v18.9.0).

Operator consequence: Configure workload identity pools deliberately and use v18.9.0 or later for the blocked-reset fix, preferably 18.10.4. Check model/fallback policy separately and audit SDK custom key resolvers. Inspect reset-credit history for excluded identities when earlier versions handled quota recovery.

Receipt

Finding metadata

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-omp-oauth-account-pools-became-workload-controls-then-needed-a-fix-for-spending-excluded-accou

Profile citations

  • omp / claim / account-pools-and-reset-credits

Source links

Primary links, including exact changelog lines when available.

Versioned source: run artifact