instar 1.3.547 → 1.3.548

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.547",
+  "version": "1.3.548",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-13T23:46:43.625Z",
-  "instarVersion": "1.3.547",
+  "generatedAt": "2026-06-13T23:53:47.403Z",
+  "instarVersion": "1.3.548",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "054d8365d27713d8bd2ca1834d0e1b4365ca49e599a20c29812a768b67056c0b",
+      "contentHash": "1d336e923995f97cac3f85ee9ec234ef4e69994c3fd2e87585a716c28e0737ac",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.548.md

@@ -0,0 +1,24 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Completes Increment B's tooling with the promotion gate made reachable: `POST /credentials/livetest` runs the §5 livetest battery (the harness built in Step 10) against the real swap executor + identity oracle.
+
+- **Double-gated credential-action route.** A real credential move needs BOTH `armed:true` in the request body (the harness performs zero swaps otherwise) AND a deliberate `dryRun:false` (the executor writes nothing otherwise). Either gate alone keeps every credential untouched.
+- **Defence-in-depth.** Dark → 503 (the lever guard); every named slot is validated against the enumerated ledger set → 400 before the harness runs (a `../`/`~`/absolute path can't reach a write); the report is scrubbed and carries no token material.
+- **The report.** Surfaces the automatable round-trip verdicts (identity-verified exchange-then-restore, always restoring) and the inherently-manual items (refresher correctness, the §0.c residual via a disposable grant, liveness) — `promotable` stays false while any manual item remains.
+
+## What to Tell Your User
+
+The "is this safe to turn on?" check is now a button you can press when you're ready. It runs the real safety battery — a live account-swap and swap-back, verified with the trustworthy identity check, always restoring — and tells you whether the automatic moves landed correctly. Two separate safety catches protect it: it does nothing unless you explicitly arm it, and even armed it won't move a real credential until you've also flipped off dry-run. Two parts of the full battery are hands-on (waiting out a token refresh, stressing a throwaway login), which it lists for you. This is the last rung before the go/no-go: when you want to actually turn on real credential moves, you run this first, watch it pass, then decide.
+
+## Summary of New Capabilities
+
+`POST /credentials/livetest` — the reachable promotion gate for live credential re-pointing. Runs the §5 livetest battery against the real executor + oracle; double-gated (armed:true AND dryRun:false both required to move a real credential), dark → 503, slots validated → 400, report scrubbed. The operator-run last rung before the dry-run→live go/no-go.
+
+## Evidence
+
+- `tests/integration/credential-routes.test.ts` (+4 = 13) — DARK → 503; ENABLED + NOT armed → refused report with zero swaps + the manual items surfaced; ENABLED + armed → the battery runs (armed report, both round-trip steps present, promotable false); unknown slot → 400 (no harness run). tsc + full lint clean; docs-coverage route floor preserved. Independent second-pass review CONCUR (two independent gates intact — armed AND dryRun:false; dark 503s before construction; path-traversal slots rejected; report scrubbed; harness always-restores).

package/upgrades/side-effects/ws52-incb-b4-livetest-route.md

@@ -0,0 +1,42 @@
+# Side-Effects Review — WS5.2 Increment B / B4: the livetest battery entrypoint (promotion gate)
+
+**Version / slug:** `ws52-incb-b4-livetest-route`
+**Date:** 2026-06-13
+**Author:** echo
+**Second-pass reviewer:** independent reviewer subagent — CONCUR (a credential-action route that can trigger real swaps → Phase 5 required)
+
+## Summary of the change
+
+Adds `POST /credentials/livetest` (src/server/routes.ts) — the reachable entrypoint for the §5 livetest battery (the Step-10 `CredentialRepointingLivetest` harness). It wires the harness to the REAL swap executor + identity oracle and runs the automatable round-trips (the dry-run→live PROMOTION gate). The destructive surface is protected by TWO independent gates: the harness performs ZERO swaps unless `armed:true` is in the body (the operator explicitly arms the battery), AND even armed, the executor's own `dryRun` keeps writes off until a deliberate `dryRun:false`. Dark → 503 (credLeverGuard); every named slot is validated against the enumerated ledger set (→ 400) before the harness runs. This completes Increment B's tooling — running the battery live is the operator's enablement moment (CMT-1494).
+
+## Decision-point inventory
+
+- `POST /credentials/livetest` — add — a credential-action entrypoint. It can trigger credential swaps, but ONLY when BOTH (a) `armed:true` (harness gate) AND (b) `dryRun:false` (executor gate, set only at construction, never touched by the route) hold. Both gates are independently reviewed (Step 10 harness armed-guard; Step 5 executor dryRun). The route adds only slot-validation + the dark gate.
+
+---
+
+## 1. Over-block
+No legitimate input is wrongly rejected: the slot validation rejects only values not in the enumerated ledger set (path-traversal `../`/`~`/absolute can't reach a write — the executor re-validates too). The dark 503 and the not-armed refusal are the conservative directions.
+
+## 2. Under-block
+The honest exposure: an operator with the Bearer token who arms the battery AND has flipped `dryRun:false` can move real credentials via this route — which is the INTENT (the promotion gate is the operator's enablement action). The reviewer confirmed no path moves a real credential without BOTH gates; the harness's always-restore leaves no residual exchange even on a forward-verify failure.
+
+## 3. Level-of-abstraction fit
+Correct: the route is a thin wrapper that wires the already-reviewed harness to the real executor + oracle. It holds no battery logic of its own (that's the harness) and no swap mechanics (that's the executor).
+
+## 4. Signal vs authority compliance
+- [x] Yes — but the authority is the operator's, exercised through two independent explicit gates (armed + dryRun:false). The route grants no autonomous authority; it is a manual, operator-armed entrypoint. (Ref: docs/signal-vs-authority.md.)
+
+## 5. Interactions
+- **Double-gate independence:** `armed` (request body) and `dryRun` (executor construction config) are independent; the route passes `armed` through and never overrides `dryRun`. Verified by integration tests (not-armed → refused/zero-swaps; the executor's dry-run path returns 'dry-run' with zero writes).
+- **Validation before run:** slot validation + the dark gate run BEFORE harness construction/run.
+- No shadowing/race — a manual, synchronous request.
+
+## 6. External surfaces
+- A new authenticated route. Dark → 503 (unchanged for a fleet/disabled agent). On a live (dev) agent, NOT armed → a refused report (zero swaps); armed → the battery runs (in dry-run, the round-trips report honestly that identities didn't exchange — real verification needs `dryRun:false`). The report is scrubbed via credSend and carries no token/blob material.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+- **Machine-local BY DESIGN.** The battery validates THIS machine's keychain/slots before promoting THIS machine's feature; the route operates on the local ledger + executor + oracle. No cross-machine surface.
+
+## 8. Rollback cost
+Trivial. Revert the commit → the route is gone; no state, no migration. Any swap the armed+live battery ever performs is the reversible, oracle-verified, always-restored round-trip the executor + harness own.