Module credentials 

Provider credential pools (DW-080, Ent).

A credential pool holds N resolved API keys for a single provider. At request time the pool picks one credential (round-robin or weighted); when a key receives a 429 from the provider, it is quarantined for a configurable window and subsequent requests rotate to the next available key. Pool exhaustion (all keys quarantined) degrades gracefully — the request fails with a 429 + Retry-After, not a panic.

The pool is compiled from the ai.providers[].credential_pool config block at AiRuntime::compile time (each entry’s secret is resolved via the same resolve_configured_secret path as singular auth). The pool lives inside CompiledProvider and is accessed per-request by the AI proxy. Quarantine state is mutable and thread-safe (behind Mutex); the rest of CompiledProvider is immutable.

Ent-only: the config schema accepts credential_pool regardless of the ent feature, but snapshot validation rejects it when ent is off (the runtime module is not compiled and the pool machinery does not exist). This keeps the config schema uniform across editions while the behavior is edition-gated.

Structs

CredentialPool

The compiled credential pool (DW-080). Lives inside CompiledProvider behind an Arc so the quarantine state can be shared across request tasks without cloning the whole provider.

CredentialStatus

Admin-facing per-key status (no secret values).

KeyHealth

AI-09 (#198): Per-key health state derived from provider rate-limit headers. Updated on every provider response (200 or error). The pool uses remaining to proactively cool keys before a 429 occurs: when remaining is 0 (or below a threshold), the key is quarantined for the provider’s reset window.

PoolEntry

A single resolved credential in the pool. The header name + value are injected into the outbound request exactly like singular auth.