[baktun14]

Why

Part of CON-1264.

Console now has teams and projects. An API key acts in the personal account or team it was created in, with its creator's role, and can be limited to one project. The skill still says every key carries the full rights of the account and that a Console account is a single wallet, so an agent following it can deploy into the wrong project, misread a project_forbidden refusal, or tell a user to spend personal credits for a team.

Ships with the Console teams launch. It leans on akash-network/console#4413, which publishes the team and project routes in the API reference; merge that first.

What

• New rules/deploy/console-api/teams-and-projects.md: roles, how a request picks its team and project (x-organization-id, x-project-id), keys bound to a team or a project and the organizationId/projectId on each key, deploying into a project, listing by project and moving a deployment, project budgets, team billing (team wallet, cards, Auto recharge), provider JWTs for project keys, session-only actions, and the new codes organization_forbidden, organization_mismatch, project_forbidden, project_required, project_budget_exceeded, project_limit_reached, organization_limit_reached, session_required; only owners and admins create projects, up to 10 per team counting the default one
• authentication.md: the "full rights of the account, no per-key scopes" rule is replaced by what a key can actually do; key fields, the new auth errors, and expiresAt capped at 1 year with a 365-day default
• account-and-funding.md: the "a Console account is a wallet" model now covers the personal account and teams, each with its own wallet; team billing and 402s on a team key
• deployment-endpoints.md, overview.md, operations.md, api-key-quickstart.md, secrets.md: projectId on create and list, the move and location endpoints, project_forbidden on writes and JWTs, the 3600 s JWT ttl cap in a team, error rows and the endpoint map
• SKILL.md, rules/deploy/overview.md, rules/overview.md, provider-sdk.md, README: the same corrections where they said a key is the whole account
• Evals 26 to 32: project key deploy and project_forbidden, deploy into a named project, list and move by project, team 402 with personal credits, session-only team actions, provider JWT for a project key, a contractor key for one project
• The akt pages are unchanged; they follow in CON-1265

Testing

Every endpoint, field, role rule and error code was checked against the Console API source on main and the OpenAPI spec from #4413. Evals 26 to 32 each ran in a fresh Opus subagent, once against this branch and once against main: this branch passes 32 of 32 assertions, main passes 16 of 32. Two assertions were loosened after the first run because they failed correct answers (a PATCH sent through a helper function, and access: "full" named in a prose table), and eval 30 was tightened so it needs the session_required reason. evals.json round-trips through json.dumps(indent=2) unchanged, and every relative link and @ reference resolves.