agentic-mobile-control/openspec/changes/database-llm-provider-management/tasks.md

1. Secure persistence

• 1.1 Add the encryption dependency and a testable Cloud Provider secret-box configuration backed by CLOUD_LLM_PROVIDER_ENCRYPTION_KEY.
• 1.2 Add SQLAlchemy profile/settings rows and an Alembic migration after the current Cloud schema revision.
• 1.3 Extend the Cloud repository contract and SQL implementation with profile CRUD, atomic activation, revision checks, and active-profile resolution.

2. Administrator management API

• 2.1 Add non-secret Pydantic SDK request/response models and a dedicated llm-providers:admin scope.
• 2.2 Add the authenticated, CSRF-protected Provider profile router with audit records and compose it into the Cloud API.
• 2.3 Add focused repository and API tests for validation, encryption redaction, authorization, CSRF, revisions, activation, and retirement invariants.

3. Cloud planner resolution

• 3.1 Allow runtime Anthropic and OpenAI clients to receive explicit API keys and an OpenAI-compatible base URL without changing direct transport behavior.
• 3.2 Resolve the active database profile per planner request, remove Cloud API planner environment configuration, and use the resolved metadata for token accounting.
• 3.3 Add planner route and client tests for database activation, fail-closed resolution, and OpenAI-compatible client construction.

4. Cloud Console

• 4.1 Add Provider profile types and CSRF-aware client methods to the Cloud Console API layer.
• 4.2 Add an administrator-only Provider management view with create, edit/key rotation, enable/disable, activate, and inactive-profile deletion workflows.
• 4.3 Add Console tests for Provider API methods and permission-gated navigation/view behavior.

5. Documentation and validation

• 5.1 Document encryption-key provisioning, required active-profile cutover, OpenAI-compatible configuration, removed planner environment variables, and rollback in Cloud deployment documentation.
• 5.2 Run relevant backend tests, Console tests/build, format/lint, compile checks, and strict OpenSpec validation; resolve failures.

6. Anthropic custom base URL

• 6.1 Allow Anthropic Provider profiles to validate and persist an optional custom base URL, and pass it to the Cloud planner client.
• 6.2 Extend AnthropicToolCallingClient to construct the Anthropic SDK with an explicit base URL while preserving direct-transport defaults.
• 6.3 Expose the Base URL field for Anthropic in the Cloud Console; add backend/runtime tests and update deployment/specification documentation.