plans: decision 119 (Q126, row 92 credential file, swappable)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2681,3 +2681,22 @@ which stay with him. Each item names who decided it and what happened.
       separately. The choice and the file are Jason's; row 92 can pass
       review and the gate first but doesn't land until the file is in
       place.
+119. **Row 92 lands on Jason's token file, swappable for a proxy key
+    (2026-10-12).** Jason answered Q126 through Mos (sage-0109): "Token
+    saved. This needs to be the initial testing configuration." Mos
+    checked that `~/.config/mosaic-dev/secrets/claude-session.env`
+    exists, is mode 600 and has one `CLAUDE_CODE_OAUTH_TOKEN` line, and
+    read no value. His longer-term ask, credentials set programmatically,
+    maybe through CLIProxyAPI, is Vikunja #237 and waits on Q127. No one
+    designs or builds it yet.
+    - Row 92's unit loads that file with `EnvironmentFile=`. The launch
+      check accepts any provider credential `ENV_ALLOW` already passes
+      (`packages/seat/src/session.mjs:62-64`): `CLAUDE_CODE_OAUTH_TOKEN`,
+      `ANTHROPIC_API_KEY`, or `ANTHROPIC_AUTH_TOKEN` with
+      `ANTHROPIC_BASE_URL`. Swapping in a proxy-issued local key then
+      changes the file, not the code or the unit.
+    - The file name and its one place in the unit and README stay the
+      only references to it, so a later row can rename it in one edit.
+    - Decision 114 still holds: no session traffic goes through
+      CLIProxyAPI until Jason rules, and no agent reads its management
+      key.