pdd sync Opus run fails commands module because inner llm_invoke requires ANTHROPIC_API_KEY

[Serhan-Asad]

Problem

The follow-up pdd sync job for #1128 failed after the original change job successfully created PR #1131.

The sync job succeeded for 7 modules, but the commands module failed because an inner llm_invoke path required ANTHROPIC_API_KEY, which was not present in the subprocess environment.

Evidence

• Issue: Add /pdd budget control comments for GitHub App runs (clean Opus rerun) #1128
• PR artifact: feat: add /pdd budget control comments for GitHub App runs (#1128) #1131
• Sync Job ID: mk7r5m1dhv1k5ceD8yHX
• Cloud Run execution: pdd-executor-job-opus-km4d6
• Final GitHub comment: Add /pdd budget control comments for GitHub App runs (clean Opus rerun) #1128 (comment)
• Progress comment: Add /pdd budget control comments for GitHub App runs (clean Opus rerun) #1128 (comment)

Final module result from Cloud Run logs:

Status: Failed
Message: Failed: ['commands']. Succeeded: ['jobs', 'models', 'track_cost', 'cost_budget_watcher', 'budget_settings', 'slash_command_parser', 'budget_comments'].
commands: │ Total time: 232.02s | Total cost: $0.8077 | Overall status: Failed │
ERROR: API key 'ANTHROPIC_API_KEY' not set. In --force mode, skipping interactive prompt.
Cost: $50.0924
Model: anthropic

The attribution payload inside the failed module showed:

PDD_AGENTIC_PROVIDER=anthropic
PDD_MODEL_DEFAULT=vertex_ai/gemini-3.5-flash
CLAUDE_CODE_USE_VERTEX=0
GOOGLE_CLOUD_PROJECT=prompt-driven-development
CLOUD_RUN_EXECUTION=pdd-executor-job-opus-km4d6

The outer executor selected Opus/OAuth credentials earlier in the job:

Model override: claude-opus-4-7 (family=claude_cli)
Claude CLI model override: claude-opus-4-7
Trying credential: claude-oauth-v9

Expected behavior

An Opus GitHub App sync run should not fail an inner module because direct ANTHROPIC_API_KEY is absent if the executor is intentionally using Claude OAuth credentials. The credential/model path used by pdd sync module generation should stay compatible with the selected executor credential path, or fail early with a clearer unsupported-credential error before spending work on other modules.

Actual behavior

The job did real work, generated/synced seven modules, then the overall pdd sync command exited 1 because only commands failed. No new commit was pushed to PR #1131; the PR head stayed at 5d5b435b8202ab464cf6c2ab285a1d61caa044ba.

Notes

This is related to provider/credential routing but appears distinct from #1113. #1113 is about a missing Vertex default causing cross-provider fallback. This failure happened under an Anthropic/Opus Cloud Run execution where the outer executor had Claude OAuth available, but the inner llm_invoke route still required direct ANTHROPIC_API_KEY.

[Serhan-Asad]

Investigation update:

This now looks like the same root cause as #1113, not a separate Opus/OAuth-only bug.

Repro in a separate PR #1131 worktree (/tmp/pdd-pr1131-sync-failure) using the failed job's default model:

_select_model_candidates(0.818, "vertex_ai/gemini-3.5-flash", repo llm_model.csv)

On PR #1131/current main code, because vertex_ai/gemini-3.5-flash is not in the CSV, _select_model_candidates falls through to the surrogate-base path and sorts the full CSV across providers. The first candidates include AWS Bedrock, Google Vertex, direct Anthropic, Azure, Perplexity, OpenRouter, Vercel, Moonshot, and Fireworks. In a Cloud Run --force environment without direct ANTHROPIC_API_KEY / FIREWORKS_API_KEY, that produces the exact skip/failure seen in the commands module.

On PR #1115 (fix(llm_invoke): lock provider when PDD_MODEL_DEFAULT has routing prefix (#1113)), the same call returns only Google Vertex candidates. That PR already has a regression test for PDD_MODEL_DEFAULT=vertex_ai/gemini-3.5-flash and all GitHub checks are green.

Conclusion: fix/merge #1115 first, then rerun #1128/#1131 sync. If the rerun still fails after #1115 is merged/deployed, this ticket should track the remaining failure. Otherwise this can be closed as covered by #1113/#1115.