Crew runs on a forge admin's org repos use the forge's model account (every child made for an org fails its first run today) #11128

A funded child's org now reaches the parent's lent credit once an admin has granted the org a model budget. I couldn't confirm point 4: I haven't seen glint-agency's runs, and nothing is proven live. The new test passes with test/model-grant.test.ts, as does tsc, and scripts/gate.ts printed nothing when run.

The bug found.

• A run on an org repo only gets past the "no model account" check through the org's explicit model grant.
• It then used the forge's own credentials. A child has none of its own, so the run had nothing to call the model with.
• The parent's lent credit was used only when the run picked the forge's own account, not when it came in on an org's grant.
• credentialEnv in src/crew/runner.ts now uses the lent credit for both cases. That fits trevato's note that glint-agency still shows $0 of its $50 spent.

Where this differs from the issue.

• Not what point 1 asks: an org whose Owners include a forge admin does not use the forge's account automatically. I first built that, then reversed it in b25bcee66: Owners membership belongs to the org's owners, so it must not reach the forge's credential. An admin grants the org instead.
• Point 2: the refusal reads "the account <org> has no model grant; an admin can grant one at /settings/accounts/<org>". I pointed it at the existing grant page rather than /admin/accounts/<org>, and I did not check that it renders as a link.
• Point 3: test/model-grant.test.ts covers an org with and without a grant.

What I chose not to do. I did not make the spawn grant the org a model budget automatically, so a new child's first crew run still needs an admin to set one. The issue says every child made for an org hits this on its first run. That would be a policy change, so I left it for you to decide.

To try it.

1. As an admin on glint-agency, open /settings/accounts/glint-agency and set the Model budget.
2. That child must be running an image that includes this fix.
3. Start a crew run on agency; the forge list should then show spend against the $50.

I couldn't check from this sandbox that glint-agency's image has the fix or what its newest run says.

🤖 Generated with Claude Code

Closes #10991

A funded child's org now reaches the parent's lent credit once an admin has granted the org a model budget. I couldn't confirm point 4: I haven't seen glint-agency's runs, and nothing is proven live. The new test passes with test/model-grant.test.ts, as does tsc, and scripts/gate.ts printed nothing when run.

The bug found.

• A run on an org repo only gets past the "no model account" check through the org's explicit model grant.
• It then used the forge's own credentials. A child has none of its own, so the run had nothing to call the model with.
• The parent's lent credit was used only when the run picked the forge's own account, not when it came in on an org's grant.
• credentialEnv in src/crew/runner.ts now uses the lent credit for both cases. That fits trevato's note that glint-agency still shows $0 of its $50 spent.

Where this differs from the issue.

• Not what point 1 asks: an org whose Owners include a forge admin does not use the forge's account automatically. I first built that, then reversed it in b25bcee66: Owners membership belongs to the org's owners, so it must not reach the forge's credential. An admin grants the org instead.
• Point 2: the refusal reads "the account <org> has no model grant; an admin can grant one at /settings/accounts/<org>". I pointed it at the existing grant page rather than /admin/accounts/<org>, and I did not check that it renders as a link.
• Point 3: test/model-grant.test.ts covers an org with and without a grant.

What I chose not to do. I did not make the spawn grant the org a model budget automatically, so a new child's first crew run still needs an admin to set one. The issue says every child made for an org hits this on its first run. That would be a policy change, so I left it for you to decide.

To try it.

1. As an admin on glint-agency, open /settings/accounts/glint-agency and set the Model budget.
2. That child must be running an image that includes this fix.
3. Start a crew run on agency; the forge list should then show spend against the $50.

I couldn't check from this sandbox that glint-agency's image has the fix or what its newest run says.

🤖 Generated with Claude Code