instar 1.3.542 → 1.3.543

package/dist/core/CredentialRepointingLivetest.d.ts

@@ -0,0 +1,114 @@
+/**
+ * CredentialRepointingLivetest — the §5 livetest battery as testable orchestration
+ * (Step 10 of live credential re-pointing).
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §5 (livetest battery),
+ * §0.c (E3/E4 live experiments), §2.8 (dogfood (d) — the §0.c residual).
+ *
+ * ── What this is ──
+ * The livetest battery is the GATE for the dry-run → live promotion decision. It is
+ * NOT part of the merge CI and it NEVER runs autonomously: it exchanges REAL OAuth
+ * credentials between the operator's REAL subscription accounts, so executing it is an
+ * enablement-time action the OPERATOR takes (with the agent), never a dark-build step.
+ *
+ * This module is the ORCHESTRATION + VERDICT logic for battery items (a) and (b) —
+ * the automatable round-trip swaps — expressed over INJECTED dependencies so it is
+ * fully unit-testable WITHOUT touching a keychain (the same fake-deps discipline the
+ * CredentialSwapExecutor itself uses). Items (c) post-swap refresher correctness and
+ * (d) the §0.c at-expiry residual (a deliberately-minted disposable grant) are
+ * inherently manual/destructive and are surfaced as REQUIRED operator steps in the
+ * report rather than auto-run — the harness reports them as pending, it does not fake
+ * a pass.
+ *
+ * ── The load-bearing safety contract ──
+ *   1. ARMED GUARD. `run()` REFUSES unless explicitly armed (the live entrypoint sets
+ *      `armed` only behind an operator flag + the feature's own enable check). An
+ *      unarmed run returns a `refused` report and performs ZERO swaps — so importing
+ *      or unit-testing this module can never move a real credential.
+ *   2. IDENTITY-VERIFIED ROUND TRIP. Every swap is verified by the identity oracle
+ *      (NOT by `claude auth status`, disqualified in E4a as a lying oracle): after a
+ *      swap the two slots' oracle identities must have EXCHANGED; after the swap-back
+ *      they must be RESTORED to the originals. Any deviation fails the step.
+ *   3. ALWAYS SWAP BACK. A round-trip leaves the world as it found it. If the forward
+ *      swap's verification fails the harness still attempts the restoring swap and
+ *      reports the residual state honestly (never silently leaves slots exchanged).
+ *
+ * This module performs NO IO of its own: it calls injected `swap` + `resolveIdentity`
+ * functions. The live entrypoint wires those to the real CredentialSwapExecutor +
+ * CredentialIdentityOracle; a unit test wires fakes.
+ */
+/** Identity of the account whose credential currently sits in a slot (oracle answer). */
+export interface SlotIdentity {
+    /** The owning account id/email per the identity oracle, or null when unresolvable. */
+    accountId: string | null;
+}
+export interface CredentialRepointingLivetestDeps {
+    /**
+     * Executes a REAL staged swap of the credentials in slotA and slotB (the shipped
+     * CredentialSwapExecutor.swap in live mode). Resolves on success; rejects on a
+     * refusal/error (the harness records the rejection as a step failure).
+     */
+    swap: (slotA: string, slotB: string) => Promise<{
+        ok: boolean;
+        detail?: string;
+    }>;
+    /**
+     * Resolves which account a slot's credential belongs to via the identity oracle
+     * (GET /api/oauth/profile over the slot's blob — E4b). Returns `{ accountId: null }`
+     * when the oracle is unavailable/uncertain (the harness treats null as a verify
+     * failure, never a guess).
+     */
+    resolveIdentity: (slot: string) => Promise<SlotIdentity>;
+}
+/** A single battery step's verdict. */
+export interface LivetestStepResult {
+    step: string;
+    passed: boolean;
+    detail: string;
+    /** Ordered observations (identities seen, swaps performed) for the operator report. */
+    observations: string[];
+}
+/** The full battery report. */
+export interface LivetestReport {
+    armed: boolean;
+    /** True only when armed AND every automated step passed AND no manual step is outstanding. */
+    promotable: boolean;
+    refusedReason?: string;
+    steps: LivetestStepResult[];
+    /** Items (c)/(d): inherently manual/destructive — listed, never auto-passed. */
+    manualSteps: string[];
+}
+export interface CredentialRepointingLivetestOptions {
+    /**
+     * MUST be true to run any swap. The live entrypoint sets this only behind the
+     * operator flag + the feature enable check. Default false ⇒ a strict no-op refusal.
+     */
+    armed?: boolean;
+}
+export declare class CredentialRepointingLivetest {
+    private readonly swap;
+    private readonly resolveIdentity;
+    private readonly armed;
+    constructor(deps: CredentialRepointingLivetestDeps, opts?: CredentialRepointingLivetestOptions);
+    /** The §2.8 manual/destructive items — surfaced for the operator, never auto-run. */
+    static readonly MANUAL_STEPS: readonly string[];
+    /**
+     * Battery items (a)/(b): an identity-verified swap round-trip between two slots.
+     * Used for both an enrolled-home pair (a) and the default-home slot (b).
+     * ALWAYS attempts to restore the original layout, even when the forward verify fails.
+     */
+    private roundTrip;
+    /**
+     * Runs the automatable battery (items a + b). REFUSES (zero swaps) unless armed.
+     * @param enrolledPair two enrolled-home slots for item (a).
+     * @param defaultSlotPair the default-home slot paired with an enrolled slot for item (b).
+     */
+    run(enrolledPair: {
+        slotA: string;
+        slotB: string;
+    }, defaultSlotPair: {
+        defaultSlot: string;
+        enrolledSlot: string;
+    }): Promise<LivetestReport>;
+}
+//# sourceMappingURL=CredentialRepointingLivetest.d.ts.map

package/dist/core/CredentialRepointingLivetest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRepointingLivetest.d.ts","sourceRoot":"","sources":["../../src/core/CredentialRepointingLivetest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF;;;;;OAKG;IACH,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1D;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,gFAAgF;IAChF,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,mCAAmC;IAClD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2C;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsD;IACtF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;gBAEpB,IAAI,EAAE,gCAAgC,EAAE,IAAI,CAAC,EAAE,mCAAmC;IAM9F,qFAAqF;IACrF,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAW7C;IAEF;;;;OAIG;YACW,SAAS;IA2CvB;;;;OAIG;IACG,GAAG,CACP,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAC9C,eAAe,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAC7D,OAAO,CAAC,cAAc,CAAC;CA6B3B"}

package/dist/core/CredentialRepointingLivetest.js

@@ -0,0 +1,135 @@
+/**
+ * CredentialRepointingLivetest — the §5 livetest battery as testable orchestration
+ * (Step 10 of live credential re-pointing).
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §5 (livetest battery),
+ * §0.c (E3/E4 live experiments), §2.8 (dogfood (d) — the §0.c residual).
+ *
+ * ── What this is ──
+ * The livetest battery is the GATE for the dry-run → live promotion decision. It is
+ * NOT part of the merge CI and it NEVER runs autonomously: it exchanges REAL OAuth
+ * credentials between the operator's REAL subscription accounts, so executing it is an
+ * enablement-time action the OPERATOR takes (with the agent), never a dark-build step.
+ *
+ * This module is the ORCHESTRATION + VERDICT logic for battery items (a) and (b) —
+ * the automatable round-trip swaps — expressed over INJECTED dependencies so it is
+ * fully unit-testable WITHOUT touching a keychain (the same fake-deps discipline the
+ * CredentialSwapExecutor itself uses). Items (c) post-swap refresher correctness and
+ * (d) the §0.c at-expiry residual (a deliberately-minted disposable grant) are
+ * inherently manual/destructive and are surfaced as REQUIRED operator steps in the
+ * report rather than auto-run — the harness reports them as pending, it does not fake
+ * a pass.
+ *
+ * ── The load-bearing safety contract ──
+ *   1. ARMED GUARD. `run()` REFUSES unless explicitly armed (the live entrypoint sets
+ *      `armed` only behind an operator flag + the feature's own enable check). An
+ *      unarmed run returns a `refused` report and performs ZERO swaps — so importing
+ *      or unit-testing this module can never move a real credential.
+ *   2. IDENTITY-VERIFIED ROUND TRIP. Every swap is verified by the identity oracle
+ *      (NOT by `claude auth status`, disqualified in E4a as a lying oracle): after a
+ *      swap the two slots' oracle identities must have EXCHANGED; after the swap-back
+ *      they must be RESTORED to the originals. Any deviation fails the step.
+ *   3. ALWAYS SWAP BACK. A round-trip leaves the world as it found it. If the forward
+ *      swap's verification fails the harness still attempts the restoring swap and
+ *      reports the residual state honestly (never silently leaves slots exchanged).
+ *
+ * This module performs NO IO of its own: it calls injected `swap` + `resolveIdentity`
+ * functions. The live entrypoint wires those to the real CredentialSwapExecutor +
+ * CredentialIdentityOracle; a unit test wires fakes.
+ */
+export class CredentialRepointingLivetest {
+    swap;
+    resolveIdentity;
+    armed;
+    constructor(deps, opts) {
+        this.swap = deps.swap;
+        this.resolveIdentity = deps.resolveIdentity;
+        this.armed = opts?.armed === true;
+    }
+    /** The §2.8 manual/destructive items — surfaced for the operator, never auto-run. */
+    static MANUAL_STEPS = [
+        '(c) Post-swap hourly-refresher correctness on BOTH slots — observe one QuotaPoller ' +
+            '401-refresh cycle per slot after a swap and confirm the refreshed token stays on the ' +
+            'right account (requires waiting out an access-token expiry; operator-observed).',
+        '(d) §0.c at-expiry write-back residual — mint a DISPOSABLE second grant, swap it under a ' +
+            'live session, drive it past access-token expiry, and confirm the scheduled identity ' +
+            'audit detects-or-clears any old-lineage write-back. Destructive to a real lineage by ' +
+            'design ⇒ operator-run with a throwaway grant only.',
+        'Liveness (E4): run the round-trip while a real interactive session is pinned to one slot ' +
+            'and confirm zero interruption (the harness cannot observe the operator\'s session; ' +
+            'operator-observed).',
+    ];
+    /**
+     * Battery items (a)/(b): an identity-verified swap round-trip between two slots.
+     * Used for both an enrolled-home pair (a) and the default-home slot (b).
+     * ALWAYS attempts to restore the original layout, even when the forward verify fails.
+     */
+    async roundTrip(slotA, slotB, label) {
+        const observations = [];
+        const beforeA = await this.resolveIdentity(slotA);
+        const beforeB = await this.resolveIdentity(slotB);
+        observations.push(`before: ${slotA}=${beforeA.accountId ?? 'UNRESOLVED'}, ${slotB}=${beforeB.accountId ?? 'UNRESOLVED'}`);
+        if (beforeA.accountId === null || beforeB.accountId === null) {
+            return { step: label, passed: false, detail: 'oracle could not resolve a slot identity before the swap (fail-closed — never guess)', observations };
+        }
+        if (beforeA.accountId === beforeB.accountId) {
+            return { step: label, passed: false, detail: 'both slots already report the same account — cannot prove an exchange', observations };
+        }
+        // Forward swap.
+        const fwd = await this.swap(slotA, slotB).catch((e) => ({ ok: false, detail: e instanceof Error ? e.message : String(e) }));
+        observations.push(`forward swap: ${fwd.ok ? 'ok' : 'FAILED — ' + (fwd.detail ?? 'unknown')}`);
+        if (!fwd.ok) {
+            return { step: label, passed: false, detail: `forward swap did not complete: ${fwd.detail ?? 'unknown'}`, observations };
+        }
+        const afterA = await this.resolveIdentity(slotA);
+        const afterB = await this.resolveIdentity(slotB);
+        observations.push(`after swap: ${slotA}=${afterA.accountId ?? 'UNRESOLVED'}, ${slotB}=${afterB.accountId ?? 'UNRESOLVED'}`);
+        const exchanged = afterA.accountId === beforeB.accountId && afterB.accountId === beforeA.accountId;
+        // ALWAYS restore — even if the verify above failed, leave the world as we found it.
+        const back = await this.swap(slotA, slotB).catch((e) => ({ ok: false, detail: e instanceof Error ? e.message : String(e) }));
+        observations.push(`restoring swap: ${back.ok ? 'ok' : 'FAILED — ' + (back.detail ?? 'unknown')}`);
+        const restoredA = await this.resolveIdentity(slotA);
+        const restoredB = await this.resolveIdentity(slotB);
+        observations.push(`after restore: ${slotA}=${restoredA.accountId ?? 'UNRESOLVED'}, ${slotB}=${restoredB.accountId ?? 'UNRESOLVED'}`);
+        const restored = restoredA.accountId === beforeA.accountId && restoredB.accountId === beforeB.accountId;
+        if (!exchanged) {
+            return { step: label, passed: false, detail: 'oracle identities did NOT exchange after the forward swap — actuation unproven', observations };
+        }
+        if (!back.ok || !restored) {
+            return { step: label, passed: false, detail: 'forward swap verified, but the layout was NOT cleanly restored — left in a residual state, investigate before promotion', observations };
+        }
+        return { step: label, passed: true, detail: 'identity-verified round trip: slots exchanged then restored cleanly', observations };
+    }
+    /**
+     * Runs the automatable battery (items a + b). REFUSES (zero swaps) unless armed.
+     * @param enrolledPair two enrolled-home slots for item (a).
+     * @param defaultSlotPair the default-home slot paired with an enrolled slot for item (b).
+     */
+    async run(enrolledPair, defaultSlotPair) {
+        const manualSteps = [...CredentialRepointingLivetest.MANUAL_STEPS];
+        if (!this.armed) {
+            return {
+                armed: false,
+                promotable: false,
+                refusedReason: 'livetest is the dry-run→live PROMOTION gate — it swaps REAL credentials between REAL ' +
+                    'accounts and only runs when explicitly armed by the operator at enablement (never in CI, ' +
+                    'never as a dark-build step). No swaps performed.',
+                steps: [],
+                manualSteps,
+            };
+        }
+        const steps = [];
+        steps.push(await this.roundTrip(enrolledPair.slotA, enrolledPair.slotB, '(a) enrolled-home swap round-trip (E3/E4 vs the shipped executor)'));
+        steps.push(await this.roundTrip(defaultSlotPair.defaultSlot, defaultSlotPair.enrolledSlot, '(b) default-home slot swap + swap-back (CMT-1337 payoff; the claude-created ACL)'));
+        const allAutomatedPassed = steps.every((s) => s.passed);
+        return {
+            armed: true,
+            // Promotion still requires the operator to complete the manual items — the harness
+            // never declares promotable while manual steps remain outstanding.
+            promotable: allAutomatedPassed && manualSteps.length === 0,
+            steps,
+            manualSteps,
+        };
+    }
+}
+//# sourceMappingURL=CredentialRepointingLivetest.js.map

package/dist/core/CredentialRepointingLivetest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRepointingLivetest.js","sourceRoot":"","sources":["../../src/core/CredentialRepointingLivetest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAoDH,MAAM,OAAO,4BAA4B;IACtB,IAAI,CAA2C;IAC/C,eAAe,CAAsD;IACrE,KAAK,CAAU;IAEhC,YAAY,IAAsC,EAAE,IAA0C;QAC5F,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,qFAAqF;IACrF,MAAM,CAAU,YAAY,GAAsB;QAChD,qFAAqF;YACnF,uFAAuF;YACvF,iFAAiF;QACnF,2FAA2F;YACzF,sFAAsF;YACtF,uFAAuF;YACvF,oDAAoD;QACtD,2FAA2F;YACzF,qFAAqF;YACrF,qBAAqB;KACxB,CAAC;IAEF;;;;OAIG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClD,YAAY,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,OAAO,CAAC,SAAS,IAAI,YAAY,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC;QAC1H,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sFAAsF,EAAE,YAAY,EAAE,CAAC;QACtJ,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,YAAY,EAAE,CAAC;QACvI,CAAC;QAED,gBAAgB;QAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrI,YAAY,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC;QAC3H,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,YAAY,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC;QAC5H,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;QAEnG,oFAAoF;QACpF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtI,YAAY,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAElG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,YAAY,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,SAAS,CAAC,SAAS,IAAI,YAAY,KAAK,KAAK,IAAI,SAAS,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC;QACrI,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;QAExG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,gFAAgF,EAAE,YAAY,EAAE,CAAC;QAChJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,yHAAyH,EAAE,YAAY,EAAE,CAAC;QACzL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,qEAAqE,EAAE,YAAY,EAAE,CAAC;IACpI,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CACP,YAA8C,EAC9C,eAA8D;QAE9D,MAAM,WAAW,GAAG,CAAC,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,KAAK;gBACjB,aAAa,EACX,uFAAuF;oBACvF,2FAA2F;oBAC3F,kDAAkD;gBACpD,KAAK,EAAE,EAAE;gBACT,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAyB,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,mEAAmE,CAAC,CAAC,CAAC;QAC9I,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,YAAY,EAAE,kFAAkF,CAAC,CAAC,CAAC;QAEhL,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,mFAAmF;YACnF,mEAAmE;YACnE,UAAU,EAAE,kBAAkB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAC1D,KAAK;YACL,WAAW;SACZ,CAAC;IACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.542",
+  "version": "1.3.543",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-13T22:02:57.992Z",
-  "instarVersion": "1.3.542",
+  "generatedAt": "2026-06-13T22:07:14.093Z",
+  "instarVersion": "1.3.543",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {

package/upgrades/{1.3.542.md → 1.3.543.md}

@@ -5,6 +5,13 @@
 
 ## What Changed
 
+Delivers the §5 livetest battery as testable orchestration — the structural gate for the dry-run→live promotion decision, so "is this safe to turn on?" is a runnable, verified procedure rather than a memory.
+
+- **`CredentialRepointingLivetest`** (src/core/CredentialRepointingLivetest.ts) — drives the automatable battery items against injected deps (wired to the real CredentialSwapExecutor + identity oracle only at enablement):
+  - **(a)** enrolled-home swap round-trip and **(b)** default-home slot round-trip — each verified by the identity oracle (NOT `claude auth status`, disqualified in E4a): after the swap the two slots' identities must have EXCHANGED; after the swap-back they must be RESTORED. The harness ALWAYS attempts the restoring swap, even when the forward verify fails, and reports any residual state honestly.
+  - **Manual items surfaced, never auto-passed** — (c) post-swap refresher correctness, (d) the §0.c at-expiry residual (a deliberately-minted disposable grant), and the E4 liveness observation are listed as required operator steps; `promotable` stays `false` while any remain outstanding.
+- **Armed guard** — `run()` performs ZERO swaps unless explicitly armed. The arm is set only at enablement, behind an operator flag + the feature's own enable check — never in CI, never as a dark-build step. So importing or testing the module can never move a real credential.
+
 Closes the Migration Parity + Agent Awareness gap for live credential re-pointing: existing agents (not just fresh installs) learn the `/credentials/*` manual levers and the zero-touch default-account flip on their next update, and the dark config defaults are proven to install in place.
 
 - **CLAUDE.md awareness (new + existing agents)** — `generateClaudeMd()` (new agents) and `migrateClaudeMd()` (existing agents, content-sniffed + idempotent) both gain a "Live Credential Re-pointing" section documenting the levers (`GET /credentials/locations`, `POST /credentials/swap`, `POST /credentials/set-default`, `POST /credentials/restore-enrollment`, `GET /credentials/rebalancer`) and the two proactive triggers: "flip my default account" → `set-default`; "which account is this slot on?" → `GET /credentials/locations` (read the ledger, never infer from `claude auth status`).
@@ -13,13 +20,19 @@ Closes the Migration Parity + Agent Awareness gap for live credential re-pointin
 
 ## What to Tell Your User
 
+Nothing changes for you yet — this is off-by-default validation tooling. What it adds: before the credential-moving feature is ever turned on, there's now a runnable, verified "is this actually safe to switch on?" check. It performs a real account-swap and swap-back and confirms — using the trustworthy identity check, not the misleading one — that the move landed on the right account and then cleanly undid itself, always leaving things exactly as they were. Two parts of that check are inherently hands-on (they involve waiting out a token refresh and deliberately stressing a throwaway login), so the tool lists those as steps you and I do together. Crucially, the whole battery refuses to run unless explicitly armed at turn-on time — it can never move a real credential just by existing or being tested. Turning the feature on, and running this gate, stays your decision.
+
 Nothing changes for you yet — the underlying feature is still switched off. What this does is make me *aware* of it so that, once it's turned on after a review window, you can just say "flip my default account to X" or "which account is this session on?" and I'll know exactly which lever to use instead of guessing. It also makes sure that awareness reaches agents that were set up before this feature existed, not only brand-new ones — so the capability isn't silently missing on an older install.
 
 ## Summary of New Capabilities
 
+No new runtime capability — this is the dry-run→live promotion gate for live credential re-pointing, shipped unwired (it runs only when the operator arms it at enablement). New internal class `CredentialRepointingLivetest`: drives the automatable swap round-trip battery (identity-verified exchange-then-restore, always restoring), surfaces the manual items (refresher correctness, the at-expiry residual via a disposable grant, liveness) without ever auto-passing them, and refuses every swap unless explicitly armed. Not wired into any runtime path; no route, no config flag, no credential write path.
+
 No new runtime capability — this is the Migration Parity + Agent Awareness step. New + existing agents' CLAUDE.md now documents the live-credential-re-pointing levers and the "flip my default account" / "which account is this slot on?" proactive triggers, and the feature's dark config defaults are proven to install on existing agents without clobbering an operator's explicit settings. The feature itself remains dark behind `subscriptionPool.credentialRepointing.enabled`.
 
 ## Evidence
 
+- `tests/unit/credential-repointing-livetest.test.ts` (8) — armed guard (refuses + zero swaps when unarmed); armed happy path (both round-trips exchange-then-restore, world left exactly as found, 4 swaps); not-promotable while manual items remain; fail-closed when the oracle can't resolve a slot; refusal when both slots already report one account; fail-AND-still-restore when the forward swap doesn't actuate; residual-state report when the restoring swap fails; the manual items (c)/(d)/E4 are surfaced. tsc + full lint clean; feature-delivery-completeness 97/97.
+
 - `tests/unit/PostUpdateMigrator-credentialRepointing.test.ts` (8) — migrateClaudeMd adds the section when absent (with both proactive triggers + the dark-posture line + the `claude auth status` honesty caveat present), is idempotent (no duplicate on re-run, byte-identical), preserves prior content, and gracefully skips a missing CLAUDE.md; the generateClaudeMd template emits the same section (source parity); and migrateConfig installs the DARK credentialRepointing block on a config lacking it, NEVER clobbers an operator's explicit `enabled:true` (fills only the missing sibling default), and is idempotent.
 - tsc clean; full `npm run lint` clean (dark-gate unchanged — no ConfigDefaults edit; the defaults already existed from Steps 1/7).

package/upgrades/side-effects/ws52-step10-livetest.md

@@ -0,0 +1,43 @@
+# Side-Effects Review — WS5.2 Step 10: livetest battery orchestration (dry-run→live promotion gate)
+
+**Version / slug:** `ws52-step10-livetest`
+**Date:** 2026-06-13
+**Author:** echo
+**Second-pass reviewer:** not required (no runtime gate/sentinel/session-lifecycle/messaging-block surface; the module is unwired-by-design tooling, run only at enablement)
+
+## Summary of the change
+
+Adds `src/core/CredentialRepointingLivetest.ts` — the §5 livetest battery expressed as testable orchestration — plus its fake-deps unit test. The harness drives the automatable battery items (a) enrolled-home swap round-trip and (b) default-home slot round-trip against INJECTED `swap` + `resolveIdentity` deps (wired to the real CredentialSwapExecutor + identity oracle only at enablement), verifying each swap by oracle identity (exchange-then-restore) and ALWAYS restoring the original layout. The inherently manual/destructive items — (c) post-swap refresher correctness and (d) the §0.c at-expiry residual via a disposable grant — are surfaced as required operator steps, never auto-passed. The module is **not wired into any runtime path**: it is the dry-run→live PROMOTION gate, which by the spec is NOT part of merge CI and runs only when the operator arms it at enablement.
+
+## Decision-point inventory
+
+- `CredentialRepointingLivetest.run()` — add — a guard (`armed`) and a verdict computation. It is NOT a runtime decision point in any live path: nothing in `server.ts` constructs or calls it. It only ever runs from a unit test (fakes) or, at enablement, an operator-armed entrypoint. The only authority it holds is over its own report (`promotable`), which is advisory input to the operator's enable decision — never an automated action.
+
+---
+
+## 1. Over-block
+No block/allow surface — over-block not applicable. (The `armed` guard refuses to RUN the test battery when unarmed; it gates a test harness, not any user/agent action.)
+
+## 2. Under-block
+No block/allow surface — under-block not applicable. Worth noting the deliberate under-claim: `promotable` is `false` while any manual step remains outstanding, so the harness can never green-light promotion on automated checks alone.
+
+## 3. Level-of-abstraction fit
+Correct layer. This is test/validation tooling at the same abstraction as the executor it exercises, expressed over injected deps so the orchestration is unit-testable without IO (the established CredentialSwapExecutor fake-deps pattern). The real keychain/oracle wiring is deferred to the enablement entrypoint, keeping this module pure and verifiable.
+
+## 4. Signal vs authority compliance
+- [x] No — this change has no block/allow surface in any live path.
+
+The `promotable` verdict is a signal to the operator's enable decision, not an authority that performs any action. (Ref: docs/signal-vs-authority.md.)
+
+## 5. Interactions
+- **Shadowing / double-fire / race:** none — the module is unwired; nothing else constructs or calls it. The `armed` default (`false`) guarantees that importing it (e.g. a future index re-export, or a test) performs zero swaps.
+- **Executor interaction (at enablement only):** the harness calls the real `swap` exactly twice per round-trip (forward + restore) and verifies via the oracle between/after; it relies on the executor's own §2.3 safety (staging, verify, quarantine) — it does not re-implement any of it.
+
+## 6. External surfaces
+- No runtime/API/agent-facing surface today (unwired). At enablement the armed entrypoint performs REAL credential swaps on the operator's REAL accounts — which is exactly why it is gated behind an explicit operator arm + the feature's own enable check, runs WITH the operator, and always restores. This module itself ships inert.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+- **Machine-local BY DESIGN.** The battery validates THIS machine's keychain + slots before promoting THIS machine's feature to live. Credentials and the identity oracle answers are per-machine; there is no cross-machine surface. Running it on one machine makes no claim about another (each machine is promoted on its own battery).
+
+## 8. Rollback cost
+Trivial. Revert the commit — the module is unwired, so removing it changes no runtime behavior. No state, no migration, no credential touch (the unit test uses fakes only). Any real swap the armed harness ever performs is itself the reversible, oracle-verified, always-restored round-trip from Step 5.