Clarify credential inspection and protect request privacy

types.go

@@ -363,7 +363,7 @@ type ExecutionTarget struct {
 // separate from that target to preserve ExecutionTarget's general execution
 // and stable JSON contracts.
 type ProfileInspection struct {
-	// ProfileID is the trimmed, exact profile ID inspected by the engine.
+	// ProfileID is the exact profile ID inspected by the engine.
 	ProfileID string
 	// EffectiveModelParams contains settings resolved from the framework timeout
 	// baseline, selected backend, and then profile, without a request override.
@@ -371,9 +371,9 @@ type ProfileInspection struct {
 	// provider default. APIKeyEnv is an environment-variable name, never its
 	// credential value.
 	EffectiveModelParams ExecutionTarget
-	// APIKeyRequired reports that a later execution must supply a direct API
-	// key or an explicit request environment override. It is mutually exclusive
-	// with a nonblank EffectiveModelParams.APIKeyEnv.
+	// APIKeyRequired reports that a later execution must supply a usable direct
+	// key or environment credential. An explicit profile environment source can
+	// coexist with this requirement.
 	APIKeyRequired bool
 }