docs: record responses choice verification and GLM tool-stream evidence

BUILD-LOG.md

@@ -5583,3 +5583,14 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 
 2026-10-24 — Magica row329 R2 (#1827): B1 ASCII-only management key fix verified with complete-tree refusals and positive auth control; package66/66,30bus readers261/261,49CLI readers726/726,config55/55, no required skip/failure. N1 corrects R1 bus total to1019; N3 stale-lock guidance and N4 34-code inventory corrected. Two over-selected file runs are recorded separately, with no F7 inference; cause unknown/Vikunja625. Old502 test/helper files byte-identical, slot returned to Sage. Evidence agents/magica/work/queue-329/BUILD.md.
 2026-10-24T23:37:46Z | Sage | Row 329 (#1827, P1 pinned model proxy, Magica) LANDED 61ebf2c34, pushed 23:31:27Z 10-24. Before: refactor at 669cdf42c. After: Magica's 4 commits (94cde633e, c65fb34ee, d1f6f2b19, 61ebf2c34) cherry-picked onto 669cdf42c, diff vs the gated tree limited to drift paths, range-diff in scratch. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r329l/wt (gate.sh 8b4978887 c8a9bcf94), started 23:08:12Z at load 14.35, GATE GREEN 23:29:14Z at load 8.67, no rerun, no test or timeout edit (mos-1634). Host note: two Codex workers cleaned T3 worktrees from about 23:14Z (mos-1639, Vikunja 632). Approvals: Dewey r2 c31643 rev 4047, Boyd r2 c31642 rev 4048. #1827 comment 31650, closed. Vikunja 237 comment 1109 (stays open for P2-P7); C4 P10 red filed as Vikunja 631. Queue: note rev 4063, done rev 4064, committed b24d917ec. DEFERRED: N2 and R2-N1 bound to row 331, N1 bound to P7. Overlap: row 284 (packages/bus/src/broker.mjs) and row 157 (scripts/mosaic-config.mjs) rebase onto 61ebf2c34 before their gates.
+## 2026-10-24 — row332 P3 proxy harness configuration: investigation/test placement
+
+Fethry at c8a9bcf94, per Sage sage-4292 and mos-1616 pi-route amendment. Before: every managed session receives instance-wide provider credentials; harnesses have no transient per-session proxy context; pi preflight checks only its binary. Intended after: proxy-mode isolation, Claude proxy env, pi private run-local route config using environment references only, credential preflight, and business proxy account settings. Design/test plan: agents/fethry/work/queue-332/BUILD.md. Initial tests placed before production changes. No tests run: Sage CLEAR is required and has not arrived. No success/acceptance claim, live change, or dependency landing. Existing proxy issue number requested from Sage; not yet received.
+
+## 2026-10-24 — row332 crash stop, documentation-only checkpoint
+
+Fethry stopped under Mos mos-1630/Jason's T3 crash instruction. No production implementation, tests, probes, mutants or acceptance runs occurred; Sage CLEAR never arrived. Explicit route metadata per sage-4293 is recorded in agents/fethry/work/queue-332/BUILD.md; full state and resumption boundaries are in HANDOFF.md there. Safe crash checkpoint commits documentation/historical plain-text import manifest only; four unrun tests and the import-audit script remain uncommitted. No long jobs restarted, protected branch changes, merges, live changes or further thread messages.
+
+2026-10-24 — Fethry row332 P3 UNRUN implementation checkpoint: optional proxy route per sage-4325 (default Anthropic), transient preflight/bundle/spawn context and serialization split, pi private model file/provider credential requirement. Existing initial RED evidence precedes source changes; only specifically authorized old fixtures updated. GPT wire API value PENDING until separate offline CLEAR/evidence; P2 seam remains injected context, no real proxy/auth access. Not GREEN, not accepted or landed. Details agents/fethry/work/queue-332/BUILD.md.
+
+2026-10-24 — Fethry row332 P3 checkpoint ef0939e35: required explicit route restored per sage-4293/4328; openai-responses chosen by Sage sage-4331 as reasoning-based tie-break, not evidence-decided (both offline shapes passed). Rehashed pinned8.0.42 single active-tool isolated GLM turn confirms thinking/tool_stream survive to stand-in;bundle7/7,proxy-harness5/5,no skips. Real Codex auth proof remains row209 phaseA step7. P2 landing/rebase,mutants,reviews and full gate still pending; no landing claim. Plain evidence/limitations in agents/fethry/work/queue-332/BUILD.md.

agents/fethry/work/queue-332/BUILD.md

@@ -0,0 +1,299 @@
+# Row 332 — P3 harness config from the model proxy
+
+## Assignment and boundaries
+
+2026-10-24: Fethry, thread 65673bd9-3bfa-412b-85d5-9b364187d8b6, branch fethry/row332, baseline c8a9bcf94. Sage assignment sage-4292; accepted brief plus full pi-routes amendment c8a9bcf94 (mos-1616). Gladstone first review, Dewey landing review; landing waits for P1/329 and P2/331, rebase on both and Sage's gate. No tests before Sage's CLEAR. No live proxy, host credential directories, real proxy data, management key, cutover, policy edits, or Codex harness changes.
+
+Queue next in canonical checkout returned `nothing` during assignment. Starting row with op fethry-332-start met Sage's queue update lock; retry through the queue only. Root npm ci --ignore-scripts --no-audit --no-fund completed in this worktree (128 packages); no canonical node_modules use.
+
+## Design note (line numbers at c8a9bcf94)
+
+- packages/seat/src/session.mjs:242-247 defines ENV_ALLOW; keep it unchanged. sessionEnv:256-262 gains optional proxy context and drops CLAUDE_CODE_OAUTH_TOKEN, every passed ANTHROPIC_* variable, OPENAI_API_KEY, OPENROUTER_API_KEY and ZAI_API_KEY before adding harness env. Non-proxy results retain current behavior exactly.
+- packages/plugins/harness/claude-code/index.mjs:56-67 preflight accepts the session proxy credential; env:119-126 sets ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN from that context.
+- packages/plugins/harness/pi/index.mjs:33-36 preflight requires its own provider credential or proxy key, never a Claude OAuth token. env:63-70 sets only the session's proxy key as ANTHROPIC_API_KEY and selects the generated provider. Fresh run-local home/.pi/agent/models.json is private (0600; parent directories 0700). Every apiKey is the literal reference $ANTHROPIC_API_KEY; recursively forbid values beginning with !. Nothing stores the key in models.json or a manifest.
+- packages/harness/src/bundle.mjs:313 buildBundle accepts transient proxy context; :379 harness.env call needs it plus run location and launch.models. Context must never be added to session metadata, source digests, or manifest. The run-local file regenerates on each launch.
+- packages/cli/src/launcher.mjs:391,400 preflight, :412 account checks, :529 bundle creation and :592 child env must agree on the same session credential. Coordinate its acquisition with P2; build/test now against the specified { baseUrl, key } stand-in, not a management client or a key-store implementation.
+
+Exact business setting keys remain launch.models.<selection>.provider, launch.models.<selection>.model, launch.account.name and launch.account.credential (launch.mjs:12-24,81-89). Provider already accepts proxy. Proposed account credential sentinel is the literal proxy (add alongside existing uppercase environment-set syntax), with launch.account.name a human-readable id such as proxy. No new fields. Existing provider anthropic selects the Anthropic route, zai selects GLM, and proxy selects the stack-owned GPT route; send this interpretation to Sage before implementation because the brief doesn't specify route encoding for provider proxy.
+
+## Build-time API choice and pinned binary
+
+P1's committed magica/row329 has CLIProxyAPI 8.0.42 in packages/model-proxy/PIN. Use that commit's fetchPinned({dataRoot:<fresh temporary root>}) implementation, copied from Git objects to this seat's temp tooling directory with its relative dependencies and PIN, until P1 lands. Never inspect another seat's worktree/scratch. It fetches only pinned GitHub release assets and checks archive, executable and panel hashes. No production instance config is needed and nothing under a real dataRoot/proxy is read.
+
+After CLEAR, try actual pinned pi requests with both openai-responses and openai-completions through that binary under unshare -rn, against stand-in upstreams with made-up credentials under 24 characters. Record version, API path, safe request fields, response status and turn result. Choose one shape once from those results and hard-code it; no runtime fallback. Real Codex OAuth cannot be simulated as a real authenticated turn: first real Codex turn remains row209 phase A step7. Distinguish the offline compatibility evidence from that deferred real-auth proof.
+
+The separate offline GLM acceptance script (outside scripts/test-*.sh) uses pinned pi and proxy, checks the upstream sees the model id from /v1/models, and records whether thinkingFormat/zaiToolStream-derived fields survive translation. All configs/auth placeholders belong to its fresh temp root.
+
+## Implementation and test sequence
+
+1. Add tests first for env isolation, Claude proxy env and preflight, pi credential refusal and each generated route/file invariant, and business account acceptance. Do not run until CLEAR; first new-test red is reported afterward, old-test red or second red is reported before changing anything.
+2. Implement harness/bundle/env handling against P2's transient interface. Add launcher boundary integration once its exact P2 acquisition seam is agreed. Keep secrets out of session.json and bundle manifests.
+3. With CLEAR, run the offline API-shape probe and GLM turn, then whole touched test files. Before each whole-file run report the list derived by parsing imports and traversing local dependencies; include harness plug-in dynamic loading explicitly. packages/cli/tests/case1-accept.test.mjs remains excluded without Mos approval.
+4. Kill named mutants; restore production source and verify. Record exact output and nice. Use a fresh shell mktemp -d /mnt/storage/scratch/tmp/XXXXXX TMPDIR for each run, absolute nice 19, and timeout -k 10 for each scripts/test-*.sh. No hidden skips; Sage owns the package/script landing gate.
+5. After dependency landings, rebase, complete review and gate stages, update queue only through its CLI, and append session/build receipts. Push only fethry/* when ready for authorized review; no force-push or attribution trailers.
+
+Planned tests:
+- Each forbidden environment variable is absent in proxy mode; all existing allowed env is identical without a proxy; two launches receive distinct own keys and no other agent's key.
+- Claude env has exactly the supplied proxy base URL/auth token; proxy credential satisfies preflight without host upstream credentials.
+- pi refuses no-session-credential for no key or Claude OAuth alone, accepts an own provider key and a proxy key.
+- models.json covers Anthropic anthropic-messages at root URL, GLM openai-completions at /v1, and a stack-owned GPT provider at /v1 with the chosen API; routes use configured model ids.
+- Every apiKey is $ANTHROPIC_API_KEY; no key value occurs in file; recursively no value starts with !; mode 0600 and private parents; next launch uses changed port/models/key reference with no stale content.
+- Business accepts provider proxy and account credential proxy while preserving existing valid and invalid account behavior.
+- Launcher/bundle integration keeps context transient and passes only the launch's own key.
+- Every new refusal code gets a separate test.
+- Offline GLM pinned-pi turn and z.ai compat observation; both GPT API-shape requests recorded with limitations.
+
+Named gate mutants:
+1. Proxy mode still passes CLAUDE_CODE_OAUTH_TOKEN (original brief).
+2. models.json receives the key value instead of $ANTHROPIC_API_KEY (amendment).
+
+No tests have run. API-shape choice is pending evidence, not claimed.
+
+## Progress 22:27Z
+
+Placed initial RED tests (not executed): packages/seat/tests/proxy-session-env.test.mjs and packages/plugins/tests/proxy-harness.test.mjs. These exercise real sessionEnv and loader-loaded harness exports. Production source remains untouched pending the first authorized RED run. Removed no assertions and ran no tests. Correct baseline bundle harness.env line is 376 (not 379 in the initial design note).
+
+Sage reporting attempts fethry-0001 (including same-key retry) and fethry-0002 all returned `T3 GET /api/orchestration/threads/<sage> timed out after 30s`. Delivery is unconfirmed. Queue move retry also met a Sage queue update lock (sage-333-reviewers-1024a); no bypass.
+
+Additional test-first placement: packages/business/tests/proxy-launch.test.mjs covers existing proxy model acceptance, proposed proxy account credential literal, preserved environment account forms, and rejection of mixed/literal credential strings. Pending Sage's route/account interpretation and CLEAR; no production edits or tests run.
+
+## Import audit and queue status
+
+The non-evaluating import audit uses Node vm.SourceTextModule.dependencySpecifiers, not a text-path grep, plus explicit computed-import edges from the plug-in loader to both harness modules. Source: import-run-list.mjs; output: IMPORT-RUN-LIST.txt (211 entries, including the explicitly EXCLUDED case1-accept file). This is a candidate impact list for the planned source changes, not an executed test list. Before a whole-file run, report the actual authorized subset to Sage. Parsing executes no repository modules and runs no tests. The first audit invocation had a path-depth setup error (ENOENT); corrected the audit's own repository root and regenerated successfully.
+
+At 22:28:19Z the canonical start operation returned `queue: only the owner (sage) may start row 332`. Per assignment, wait at least two minutes before repeating this same op. No queue state was edited manually.
+
+## Design correction after D9 re-read
+
+The initial route-encoding proposal (provider proxy for GPT only) is not sufficient: design D9 explicitly defines provider proxy as any model through the instance proxy. Do not implement the earlier proposal. Two viable encodings need resolving before route-dependent tests/production: exact model-id lookup in pinned pi's provider catalogs (no new business fields, but refuses proxy-only aliases/unknown models), or explicit route metadata in launch.models (additive schema, needs Sage to confirm it is within the approved brief). Recommend exact catalog membership if all intended configured model ids are in pinned pi; otherwise ask Sage to define/approve an explicit route field. Never guess by model prefix or silently choose a wire API. Independent env/preflight tests already placed remain valid.
+
+Reporting recovered: fethry-0004 was accepted by t3_send_message at approximately 22:29:51Z. It delivered the D9 route correction, route-encoding/P2-seam question, import-manifest location and no-tests status to Sage. Earlier failed-message deliveries remain unconfirmed.
+
+22:32:18Z: The start retry issued at 22:30:40Z (over two minutes after first owner refusal) also exited 2: `queue: only the owner (sage) may start row 332`. This is an ownership boundary; row was not started and no code/test execution proceeds through it. Sage's assignment must take effect before the same op can succeed. The full design report fethry-0005 again timed out; fethry-0004 is the confirmed delivered report. git diff --check passed; no test, probe, commit or push has run.
+
+## Route ruling accepted — sage-4293, 22:37Z
+
+Sage settled explicit metadata, superseding both initial encoding proposals and the catalog proposal. Exact new setting: launch.models.<selection>.route; permitted values anthropic, glm, codex, required only when provider is proxy. Nonproxy entries still allow provider/model only. Missing route refuses proxy-route-missing; present unknown/nonstring route refuses proxy-route-unknown. Both get independent code assertions; each valid value gets a test using a proxy-only model id absent from any catalog. The GPT route's generated pi provider will be mosaic-proxy-codex, never openai-codex. Its wire API remains a build-time choice after the pinned-binary probe. P2 passes only {baseUrl,key}; no route belongs to that seam.
+
+A key persistence hazard found during source inspection: launcher.mjs:571 writes bundle.env as session.harnessEnv. Adding the key to harness.env must not retain this behavior for credentials. P3 will keep generated key env transient for spawnSession and omit those credential values from serialized harnessEnv. runner.mjs:390 already inherits the spawn environment before applying nonsecret harnessEnv. Test the on-disk session/bundle boundary, not only models.json.
+
+The old launch-settings.test.mjs already uses provider proxy fixtures without route. Update those fixtures to explicit anthropic routes before any full-file run; preserve their existing authorization assertions. This is the new approved validation shape, not permission to loosen tests. No tests have run and no production edits exist.
+
+Additional test-first placement after route ruling: packages/harness/tests/proxy-bundle.test.mjs exercises real buildBundle with explicit provider proxy entries and proxy-only model ids, three generated providers, run-local file mode, environment references, recursive no-! values, no key in bundle files/manifest, fresh model/port/key on next launch. The exact GPT API assertion must be added from the authorized pinned-binary probe before this test file's first run; it deliberately makes no unverified wire-shape claim now. No skip is introduced.
+
+Canonical queue show returned owner sage and after=331 at 22:40Z; it also warned `view unknown` for the rendered table. No repair or queue bypass attempted; wait for Sage's announced batch. Queue metadata identifies shared proxy Gitea issue #1830.
+
+## STOPPED — mos-1630, 2026-10-24T22:48Z
+
+Jason's relayed crash instruction supersedes active work: no long-job restart, commit/push safe documentation only, handoff in this worktree, no other thread messages, then stop. See HANDOFF.md for complete state, next steps, uncommitted tests/audit script, and reruns needed. No tests or probes ever ran; no production implementation exists. Latest design is explicit launch.models route metadata per sage-4293; earlier catalog/GPT-only proposals are superseded. The original 211-entry import manifest predates the fourth new test file and is historical, not run authorization. Full inline resends still hit T3 timeouts. Crash commit will exclude every unrun test and the audit script.
+
+## Resumed — sage-4298, 2026-10-24T23:12Z
+
+Resume authorized; crash-stop state above is historical. Sage accepts route spellings, refusal codes, mosaic-proxy-codex and launch.account.credential=proxy. Added third named mutant: **proxy key serialized into session.json**. Added an unrun real-launcher integration test in packages/cli/tests/launcher.test.mjs: a stand-in `{baseUrl,key}` enters via proposed createLauncher proxy option; real harness generation, session writer and runner must pass the key transiently while disk session/bundle files omit it. Adapter alone is fake. This catches restoring harnessEnv:bundle.env without credential separation. Existing test assertions are unchanged.
+
+Regenerated IMPORT-RUN-LIST.txt with the non-evaluating import audit (static module dependencies plus explicit computed harness-loader edges). It now includes proxy-bundle.test.mjs; case1-accept remains explicitly EXCLUDED (mos-1612). Full manifest, touched tests and all three named mutants delivered inline to Sage using t3_code t3_thread_send, clientRequestId fethry-row332-resume-report-001, delivery steered. No unresolved route question remains. GPT API selection awaits CLEAR and pinned-binary evidence. Production implementation remains held for required first RED; tests/probes/fetches remain held for CLEAR. git diff --check clean.
+
+Canonical queue next fethry started without timeout; no start retry until Sage confirms after-none write. Initial local-worktree queue invocation refused because queue requires canonical checkout; rerouted to canonical as required, no state bypass.
+
+## Queue start retry — sage-4301, 2026-10-24T23:15Z
+
+Sage reports after=none at rev4057. Retried canonical `scripts/mosaic queue move 332 in-progress --op fethry-332-start --by fethry` without a timeout. Awaiting its result; no duplicate command or manual queue edit. Lane B remains held and all tests/probes/fetches remain forbidden until CLEAR. Static review of test fixtures confirms launcher test uses the existing real-harness fake-adapter setup; initial RED remains unrun.
+
+Start result: `ok fethry-332-start rev 4059 row 332 briefed→in-progress` (exit0). No tests/probes/fetches run.
+
+## P1 rebase and pre-run reader stop — sage-4312/4313
+
+Rebased onto 9e2689dff; current documentation checkpoint efe3e4697. Saved/restored all uncommitted notes/tests with named stash (retained for recovery). BUILD-LOG.md and SESSIONS.md append conflicts preserve both upstream and row332 entries. No production edits or force-push. git diff --check clean.
+
+CLEAR received in sage-4313, conditional on pre-step reader check. STOP condition found before any test/probe/fetch: packages/cli/tests/launcher.test.mjs imports ./helpers.mjs, whose line10 imports BusError/Broker from ../../bus/src/broker.mjs (P1-changed path). The P3 test also starts the real broker through startHost. Report delivered to Sage as fethry-resume-0003, clientRequestId fethry-row332-p1-reader-stop. Await specific reader-chain authorization. No runs, counts or mutant outcomes exist. Mutant execution requires implementation reaching GREEN first; baseline RED will not be claimed as mutant evidence.
+
+## First execution — sage-4316/4319, lane B, 2026-10-24
+
+Reader chain authorized by sage-4316. Every run below used fresh shell `mktemp -d /mnt/storage/scratch/tmp/gXXX`, absolute nice19 (recorded), timeout -k10 (180s new files/300s whole launcher). No probes/fetches/mutants or case1-accept run. Logs are plain text in red/ beside this note.
+
+| File | UTC start/end | pass/fail/skip | Classification |
+| --- | --- | --- | --- |
+| business proxy-launch | 23:41:37/23:41:37 | 2/4/0 | Expected missing route validation/account support |
+| harness proxy-bundle | 23:41:42/23:41:42 | 0/5/0 | Fixture ERROR: assignment to frozen resolved.vars, not feature RED |
+| plugins proxy-harness | 23:41:44/23:41:44 | 0/5/0 | Fixture ERROR: missing createLoader options, not feature RED |
+| seat proxy-session-env | 23:41:50/23:41:50 | 1/1/0 | Expected instance OAuth leak |
+| cli launcher (whole) | 23:41:55/23:42:25 | 34/1/0 | New P3 route rejected; all34 old tests pass |
+
+Per sage-4319, fixed only the two new-file fixtures and committed b285e581e `fixture fix, untested` before rerunning. resolvedFor uses its mutation callback; createLoader receives {log(){}}. Existing launcher assertions were not changed.
+
+| Corrected file | UTC start/end | pass/fail/skip | Classification |
+| --- | --- | --- | --- |
+| harness proxy-bundle | 23:42:41/23:42:41 | 0/5/0 | Another fixture ERROR: pm selects a/z/g absent from fixture launch.models; not valid feature RED |
+| plugins proxy-harness | 23:42:41/23:42:41 | 1/4/0 | Valid feature REDs: missing Claude proxy URL/key and preflight; pi missing-credential refusals absent. Acceptance test already passes because existing pi preflight only checks binary; not proof of proxy credential behavior |
+
+Stopped after exactly one authorized corrected run each. No edits/reruns after second harness fixture error; report to Sage before changes. Proposed follow-up: preserve valid fixture business routing, then overlay a test-local resolved vars object for buildBundle, or supply a coherent model table in callback. GPT API assertion still awaits authorized evidence and must precede a GREEN claim.
+
+Stash created before rebase: 69ad35ec79805a0303ede4454f8d6815ddfa7bb3. Shared refs/stash must not be used again; entry remains untouched for Sage to clear. Future checkpoints use branch WIP commits.
+
+Own-worktree node/chromium process sweep at23:42:57Z found only six tool-service processes predating tests (started23:12:08–23:12:10Z), no test node/chromium leftovers. Preserved tool services. No process killed. Lane B returned; mutants deferred until RED→fix→GREEN and later CLEAR with tip.
+
+## Corrected bundle first valid RED — sage-4320
+
+Only proxy-bundle.test.mjs edited: resolve a valid existing fixture business first, then copy resolved and vars locally, overlay harness/model, and assert selection exists in the supplied declared models table. Frozen original is untouched. Commit56701f715 `fixture fix, untested`, directly atop b285e581e, before execution.
+
+Exactly one whole proxy-bundle run at23:44:40Z (start/end), fresh gXXX TMPDIR, nice19, timeout-k10/180s: 5tests,0pass,5fail,0skip,exit1. All five now reach real buildBundle and fail ENOENT on the required run/home/.pi/agent/models.json: missing production generation, valid feature RED rather than fixture errors. Earlier frozen-vars and unknown-model errors remain separately recorded. Log red/harness-corrected-2.txt. No production edits, further runs, mutants, probes or fetches. Lane B free.
+
+Rebase made original origin/fethry/row332 diverge from local; publish current history on fethry/row332-p1 without force, preserving original remote checkpoint. Shared stash69ad35ec79805a0303ede4454f8d6815ddfa7bb3 remains untouched. Remaining uncommitted business/seat tests, launcher addition and audit source are not included in this two-fixture checkpoint.
+
+## P3 implementation checkpoint — sage-4323/4325, UNRUN
+
+Scope correction: sage-4322's P1 meant P3; no P1 code changed. Source edits authorized by sage-4323; all runs remain held. This is an implementation checkpoint, not GREEN or acceptance. Executing the established plan inline; user lane restrictions supersede skill test-run/commit defaults for this checkpoint.
+
+Latest route ruling sage-4325 supersedes sage-4293/4298 and all earlier route-required notes: omitted proxy route means Anthropic and preserves the stored provider/model shape. Explicit anthropic/glm/codex routes remain accepted; unknown/present-invalid route refuses proxy-route-unknown. proxy-route-missing is withdrawn, not implemented. Other providers keep provider/model-only schema. Own business test updated for default; new bundle test exercises default generation without changing existing explicit-route assertions. launch-settings.test.mjs remains byte-unchanged.
+
+Implementation in six production files:
+- business launch validates optional proxy route, preserves omission, accepts account credential literal proxy.
+- seat sessionEnv leaves ENV_ALLOW unchanged and filters provider variables only with proxy context.
+- Claude accepts proxy credential preflight and returns proxy base/auth env; pi requires own provider key or proxy key, never Claude OAuth.
+- bundle carries transient proxy/models to harness calls and propagates proxyRoute separately from primary/fallback route; no context in manifest.
+- pi groups declared routes into run-local private models.json, references only $ANTHROPIC_API_KEY, refuses executable-looking model ids/key collisions, exclusive create and0700 parents/0600 file. No host auth reads. Generated file digest included in bundle manifest. Models use pi's documented default sizes/costs and reasoning support, with explicit z.ai compat for GLM; no catalog membership inference.
+- launcher accepts the specified context stand-in or a per-agent factory, copies only baseUrl/key, carries it through repeated preflight checks and final bundle/spawn. Factory receives business/instance; P2 owns acquisition and may be called twice due to existing launch recheck. No P2 store/client calls invented. Provider credential variables split out at actual session.json serialization and delivered only through spawn env. Account proxy source validates against the supplied context, not host upstream variables.
+
+### Old-test changes authorized by sage-4325 (baseline1e47b0919)
+
+P3 item4 (rows brief pi preflight bullet, lines250-252) mandates refusal without proxy/own credential:
+- plugins/tests/harness.test.mjs:102 before `assert.equal(pi.preflight({ env: {} }), null)`; after asserts `.code === no-session-credential`. Other assertions unchanged.
+- cli/tests/launcher.test.mjs prepare():84 before only fake Claude OAuth; after additionally supplies ZAI_API_KEY=fx332-pi only when chief primary/fallback names pi. Other tests' assertions unchanged; Claude-only preparation does not receive it.
+- cli/tests/launcher.test.mjs old no-credential pi test (sage reference697): before deletes OAuth then expects launch/pi and launch-log event; after also deletes newly supplied fake ZAI key, expects no-session-credential refusal, refused log code and no registered session. Test renamed to reflect mandated behavior. Existing no-session-credential Claude test unchanged.
+
+No other old test was changed. Static review found these conflicts before execution and authorization preceded edits. No old-test RED occurred; baseline whole launcher had34 old passes.
+
+### GPT wire API: PENDING
+
+Single build-time value PROXY_CODEX_API=null in pi/index.mjs. A declared codex route refuses generation with a plain pending-evidence error until that value is settled; no guessed wire API, environment switch or runtime fallback. Consequently existing all-three-route bundle tests are not expected GREEN yet. P2 integration, full tests, pinned evidence, mutants and reviews remain pending.
+
+Planned separate 4c evidence run (outside scripts/test-*.sh), requiring its own lane B CLEAR:
+1. Use landed P1 fetchPinned only under a fresh owned temp root for the exact PIN (8.0.42). Fetch is a separately approved preparation, not part of offline networking. Verify hashes via P1; never use host installation or another seat's scratch.
+2. Run the pinned proxy and local stand-in upstream inside unshare -rn with loopback enabled, empty private HOME/auth dir and a sanitized environment. No real auth file or network. All fake credentials under24 chars. Private test-only proxy config points only at the stand-in.
+3. Generate two private probe-only pi model configs, one openai-responses and one openai-completions, both baseUrl=the isolated proxy/v1. Run pinned pi turns and record safe path/body shape fields, statuses, stream result and upstream observations, omitting auth/header values. These probe configs do not select the production constant.
+4. Separately run the GLM completions turn under the same isolation and record whether thinkingFormat=zai/zaiToolStream-derived fields survive proxy translation.
+5. If the offline stand-in cannot distinguish the two GPT shapes for the Codex-login route, report inconclusive evidence to Sage for Mos; do not select a value. A compatibility route cannot be reported as a real Codex-auth turn. First real Codex turn remains row209 phaseA step7.
+
+No tests, probes, binary invocation or fetch ran during implementation. Import audit below is source parsing only, never repository evaluation. New run list includes the old harness.test.mjs touched under ruling; case1-accept remains EXCLUDED. Shared stash already cleared by Sage after1e47b0919 confirmation; no further stash operation used.
+
+## Six whole files on a5330386c — sage-4326 lane B
+
+Each ran exactly once, in requested order, no edits between runs and no reruns. Fresh shell gXXX TMPDIR per file; every log records nice19; timeout-k10/180s (launcher300s). No mutants/probes/fetches or extra impact files. Logs green-attempt/*.txt.
+
+| File | pass/fail/skip | exit | UTC start/end |
+| --- | --- | --- | --- |
+| business | 6/0/0 | 0 | 23:57:06Z/23:57:06Z |
+| seat | 2/0/0 | 0 | 23:57:06Z/23:57:06Z |
+| proxy-harness | 5/0/0 | 0 | 23:57:06Z/23:57:06Z |
+| harness | 9/0/0 | 0 | 23:57:12Z/23:57:12Z |
+| proxy-bundle | 1/5/0 | 1 | 23:57:12Z/23:57:12Z |
+| launcher | 34/1/0 | 1 | 23:57:12Z/23:57:42Z |
+
+Expected-PENDING failures (each shared declared table includes codex), all stop before assertions with `Error: proxy GPT API is PENDING build-time evidence`:
+- P3 Anthropic route uses messages at proxy root and the declared model id
+- P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility
+- P3 GPT route selects a stack-owned provider instead of pi Codex OAuth
+- P3 models file is private, references the one session key, and stores no executable values or keys
+- P3 every launch regenerates proxy port, declared models and own key without caching
+
+The omitted-route-only bundle case passed. Five pending failures do not establish the remaining route/file assertions; no claim of GREEN.
+
+Real old-test RED: `row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason` (launcher.test.mjs:714). First expected operation `await launcher.launchPm()` throws before the result assertions: `PM launch refused: no-session-credential (fallback fixture: pi needs its own provider key or a session proxy key (primary down: fixture preflight fails))`. Fixture harness re-exports real pi; prepare() recognized literal pi primary/fallback only, so it did not supply the needed own key. Reported to Sage as fethry-resume-0012 before any edit; no fix or rerun authorized/performed. P3 serialization test and all other launcher tests passed.
+
+After all runs finished, changed only harness.test.mjs:100 title per sage-4326 to `row 65 pi preflight refuses missing credentials, and its version is the package pin`; assertion unchanged, no rerun for title. Sweep after end23:57:42Z found the same six pre-existing tool services (2699602,2699605,2700525,2700526,2700531,2700931), no test node/chromium leftovers; no process killed. Lane B free. No other source/test fixes in this follow-up.
+
+## Fixture correction authorized — sage-4327
+
+Old-test list addition: launcher.test.mjs row65 fallback test (line714 at e9fc105ac), before: no own pi credential before setup; after: this test alone sets given.f.env.ZAI_API_KEY=fx332-pi immediately before setup. All assertions unchanged; prepare() condition unchanged. Reason: P3 item4 requires pi own/proxy credential; this fixture inherits pi preflight. Prior real RED and first thrown error preserved above.
+
+New proxy-bundle tests now supply explicit per-test declared tables: Anthropic only, omitted/default only, GLM only, GPT only; privacy/regeneration use Anthropic+GLM and retain every key/mode/no-executable assertion applicable to those routes. Regeneration additionally checks changed GLM endpoint/model. Added expected refusal test for declared Codex with pending build-time API; no production source changes. Only GPT generation test should remain expected-PENDING. Fixture fixes committed untested before exactly two authorized whole-file runs.
+
+### Two-file fixture verification — sage-4327
+
+Fixture checkpoint f1e8cda07, no source change. Exactly one run each, no edits between runs or reruns. nice19, fresh gXXX TMPDIR per file, timeout-k10/180s bundle and300s launcher. Logs fixture-r3/*.txt.
+- proxy-bundle23:59:16Z:7tests,6pass,1fail,0skip,exit1. Sole expected-PENDING failure: `P3 GPT route selects a stack-owned provider instead of pi Codex OAuth`, error `proxy GPT API is PENDING build-time evidence`. All other route/privacy/regeneration cases and explicit pending-refusal case pass.
+- launcher23:59:16–23:59:45Z:35tests,35pass,0fail,0skip,exit0. Row65 fallback assertions unchanged and now pass; P3 transient serialization case passes.
+
+No failure other than expected GPT generation; GPT wire evidence, P2 integration/rebase, mutants and reviews still pending. Sweep shows only same six pre-existing node/chrome tool services, no test leftovers. Lane B free after23:59:45Z. No probes/fetches/mutants or extra tests run.
+
+## Route-required correction — sage-4328 restores sage-4293
+
+sage-4325 default-Anthropic ruling withdrawn. Explicit route required again: missing proxy-route-missing, present invalid proxy-route-unknown, distinct own tests. Removed generation/session-model defaults; bundle omitted-route test now asserts missing-route code. Active plug-in documentation corrected. No catalog/prefix inference.
+
+Old-test list (baseline1da28a7bd): launch-settings.test.mjs41,154,161,188,198 object fixtures before provider:proxy/model only; after identical objects plus route:anthropic. Line45 before assignment models.opus.provider=proxy; after adds models.opus.route=anthropic. Every assertion byte-unchanged; no assertion relaxed. Authority/reason sage-4293 restored by sage-4328: D9 proxy is any upstream route and omission cannot select Anthropic silently.
+
+Pre-run git-grep audit scoped 'packages/*/tests/*', saved route-required/proxy-fixture-grep.txt:16 model/assignment lines in four files. Positive controls matched launch-settings41 literal,45 assignment and intentional missing inputs proxy-launch14/proxy-bundle47. Broader quoted-proxy literal audit saved proxy-literal-grep.txt, manually reviewed for multiline entries. Remaining route omissions only intentional refusal cases (proxy-launch14,proxy-bundle47); unknown-route test uses route variable. All six old fixtures explicit; launcher155 and remaining bundle model literals explicit. Other broad hits are account sentinels, CLI argv or filesystem strings, not model table entries. Findings sent inline as fethry-resume-0015 BEFORE any tests. No other missing-route positive fixture found.
+
+Committed untested per instruction; four whole-file runs follow under lane B CLEAR, no reruns or extra files. GPT offline run and P1 fetch remain unstarted and require separate explicit go.
+
+### Required-route four-file verification — sage-4328
+
+Tested9563fbc8b, exactly once per whole file in authorized order. No edits between runs, no reruns/extra tests. Each fresh gXXX TMPDIR,nice19,timeout-k10/180s (launcher300s). Plain logs route-required/*.txt.
+
+| File | pass/fail/skip | exit | UTC start/end (2026-10-25) |
+| --- | --- | --- | --- |
+| proxy-launch | 6/0/0 | 0 | 00:01:47Z/00:01:47Z |
+| launch-settings | 18/0/0 | 0 | 00:01:55Z/00:01:56Z |
+| proxy-bundle | 6/1/0 | 1 | 00:01:56Z/00:01:56Z |
+| launcher | 35/0/0 | 0 | 00:01:56Z/00:02:27Z |
+
+Only failure: `P3 GPT route selects a stack-owned provider instead of pi Codex OAuth`, expected-PENDING error before assertions: proxy GPT API is PENDING build-time evidence. No other failures; missing-route and unknown-route separate-code tests pass; six old launch-settings fixture metadata changes preserve all assertions. All35 launcher tests pass.
+
+Sweep after00:02:27Z: only same six pre-existing tool services; no test node/chromium leftovers and no process killed. Lane B free. GPT wire-shape evidence and P1 fetch NOT started; each still needs Sage explicit go/CLEAR. No mutants.
+
+## GPT offline attempt1 and static diagnosis — sage-4329/4330
+
+One authorized landed-P1 fetchPinned invocation succeeded, exact PIN8.0.42 executable SHA74661f8cf949977870231359e8bf4344e07946766a673c08fa25a3e5f72fc95e, panel1.26.7 SHA8c9c6b7d3fb311e6aad5d06e1993e53a2d28389e640448a1bc6304ed20b057b5. Fresh owned root named in evidence/root.txt, no alternate binary/new fetch. Fetch entry required nice19, end log observed16 due host renice; disclosed before continuing. Static-inspection invocation then failed entry nice guard before any binary read/launch; no turn. Main isolated attempt1 setPriority19 explicitly, but static binary tag scan again observed host renice16; subsequent child starts explicitly set19.
+
+Attempt1 unshare-rn showed interfaces[lo], empty private HOME/auth and sanitized env. Proxy booted version8.0.42 commitbc064340, built2026-10-24T14:21:38Z. GET/v1/models response200 with modelIds[], script refused `stand-in routes absent from proxy catalog`; zero GPT-responses/GPT-completions/GLM pi turns ran, so zero compatibility evidence. Cleanup remainingManagedChildren0. No rerun under that CLEAR; reported0018. Raw sanitized receipt evidence/offline.txt preserved.
+
+Startup network finding for P7/unit, plain text from isolated proxy log:
+`failed to fetch latest Grok CLI version from npm, keeping fallback/cached version error=npm registry request failed: Get https://registry.npmjs.org/@xai-official/grok/latest: dial tcp [2606:4700::6810:122]:443: connect: network is unreachable`.
+The namespace blocked external egress. Panel auto-update was disabled; this separate Grok version check still attempted startup egress. No real auth or host proxy touched.
+
+### Static cause recorded BEFORE attempt2 (sage-4330)
+
+No executable/probe invocation for diagnosis. Read the hash-pinned bundled management.html's config reader/serializer and P1 initialConfig in packages/model-proxy/src/settings.mjs. P1 produces nested server/management/access/oauth/observability/routing but adds no upstream provider config. Bundled panel Ip explicitly reads `api-keys.openai-compatibility`; zee reads e['api-keys'][provider]; Fp rejects groups without array group.keys; Np reads group name/base-url/keys/models; xv serializes a group with name,base-url,keys; hv serializes each key as api-key. Therefore the version8 payload is ROOT `api-keys: { openai-compatibility: [{name,base-url,keys:[{api-key}],models:[{name}]}] }`, distinct from the client allowlist under access.api-keys. Source excerpts/character offsets in evidence/bundled-panel-shape.txt; no header/auth values in receipts. This is actual pinned bundled UI reader/writer source, not a guessed provider nesting or an external/unpinned example.
+
+Cause of first setup failure: my test used providers.openai-compatibility with api-key-entries, neither the root key nor the group-key field expected by that pinned writer. Initial readiness also stopped at first200 instead of waiting for required models; fixed to30s bound,1s intervals, model count logged per poll. Under sage-4330 one further isolated attempt only: reuse fetched binary and re-hash with P1 verifyInstall before launch; separate attempt2 test roots; actual pi turns each once, retry disabled in pi settings; API constant remains PENDING. Record/restore niceness for own descendants when host policy changes it. No actual turn has yet run as of this pre-attempt note.
+
+## Offline attempt2 evidence — sage-4330, API STILL PENDING
+
+Static diagnosis above preceded this one extra attempt. No new fetch. P1 verifyInstall recomputed existing executable/panel hashes before use and matched PIN8.0.42/panel1.26.7. unshare-rn verified only lo, empty private HOME/auth, sanitized env. Test config uses bundled writer's root api-keys.openai-compatibility/groups.keys shape. Readiness poll1 not-ready/modelCount0; poll2 status200/modelCount2; proxy lists gpt-fixture and glm-fixture. No setup failure on attempt2.
+
+A transparent loopback HTTP tap captures pi's method/path and a whitelist of body shape fields; forwards original body bytes to pinned proxy; no header/auth values recorded. Upstream stand-in receives proxy output. Both remain inside network namespace. Each actual pi invocation once,50s timeout-k10; retry.enabled=false and provider.maxRetries=0 in private pi settings. Proxy has request-retry0. Outer isolation240s timeout-k10; no reruns. All three turn exits0 and marker P332_OFFLINE_OK observed:
+
+| Turn | Pi request to proxy through transparent tap | Proxy response | Stand-in upstream observation |
+| --- | --- | --- | --- |
+| GPT responses | POST/v1/responses, modelgpt-fixture,streamtrue,reasoning={effort:low,summary:auto} |200,response.completed event, marker |POST/v1/chat/completions,reasoning_effort=low,max_tokens=16384,streamtrue |
+| GPT completions | POST/v1/chat/completions, modelgpt-fixture,roles[developer,user],reasoning_effort=low,max_completion_tokens=16384 |200,completion stream marker |POST/v1/chat/completions,roles[developer,user],reasoning_effort=low,max_tokens=16384 |
+| GLM completions | POST/v1/chat/completions,modelglm-fixture,thinking={type:enabled,clear_thinking:false},reasoning_effort=low,max_completion_tokens=16384 |200,completion stream marker |POST/v1/chat/completions,same thinking object and reasoning_effort retained,max_tokens=16384 |
+
+GLM compatibility finding: thinkingFormat=zai-generated thinking.type=enabled/clear_thinking=false survives proxy translation, as does reasoning_effort=low. zaiToolStream-derived tool_stream was NOT emitted, because this turn disabled tools; its survival is NOT proven. Static pinned pi source node_modules/@earendil-works/pi-ai/dist/api/openai-completions.js:612-618 sets params.tool_stream=true only with active tools and compat.zaiToolStream. No tool-call stream was exercised. This limitation is reported, not silently interpreted as pass or drop.
+
+Both GPT shapes pass on the stand-in openai-compatibility credential route. This does not distinguish them for the Codex-login route; no Codex OAuth/auth file exists in this experiment. Evidence is INCONCLUSIVE for the production GPT choice. PROXY_CODEX_API remains null/PENDING; no source or API selection changed. Sage rules or takes to Mos per plan item5; first real Codex-auth turn stays row209 phaseA step7.
+
+Niceness: attempt2 entry/emitted turn values19, explicit setPriority at entry/child start and100ms restore over owned descendants. Host policy temporarily changed processes to16 eight times; corrections restored19, disclosed here. Initial fetch end16 and failed inspection guard are retained separately, not represented as clean19 throughout. Full safe request/response receipts in evidence/offline-attempt2.txt; no auth/header value recorded. Process cleanup reports remainingManagedChildren0. Sweep over worktree and owned evidence root found same six pre-existing tool services only, no proxy/pi/timeout/chromium test leftovers. Lane B free. No mutants or other test files run.
+
+## API choice and active-tool follow-up — sage-4331
+
+Sage's ruling: PROXY_CODEX_API=openai-responses. The evidence does not separate the two shapes: both pass through pinned8.0.42. This is a tie broken on reasoning; it is NOT an evidence-decided pick. Sage's reason: Codex upstream speaks Responses natively and Responses carries pi's reasoning summary field, while completions drops that field; expected fewer translations/lost fields on the real route. This reasoning is a lead decision, not a claim of an authenticated Codex experiment. Row209 phaseA step7 verifies first real Codex turn; change the single constant if it fails there, with no runtime fallback/env switch. Earlier PENDING logs/notes remain historical evidence.
+
+Set constant/remove pending refusal; GPT route test asserts openai-responses on mosaic-proxy-codex. Replaced temporary pending-refusal test with generated single-provider/responses/key-reference assertions per ruling. No other production change. Active plug-in docs updated.
+
+Evidence script adds glm-tool mode: one GLM turn only, same pinned verified binary and isolated setup, distinct attempt3-tool root, active built-in read tool but stand-in still returns text only. Capture tool_stream and tool names before/after proxy, never header/auth values. No actual tool execution is demanded by stand-in, so this checks wire-field survival, not arbitrary tool-call semantics. Rehash before launch, no fetch,30s catalog readiness with counts,50s timeout-k10 for one turn,own descendants restored nice19. Commit untested before cleared run; then proxy-bundle and proxy-harness each whole once. No other runs/mutants.
+
+### sage-4331 single active-tool GLM turn and two-file results
+
+Tested ef0939e35. No fetch. P1 verifyInstall rehashed existing binary/panel and matched both PIN hashes before use. One isolated glm-tool run, unshare-rn interfaces[lo],empty private HOME/auth,sanitized env. Readiness poll1 not-ready/count0;poll2 status200/count2. One pi invocation with one active builtin read tool,exit0,markerP332_OFFLINE_OK; no rerun. Outer timeout-k10/140s,inner120s,pi50s;nice19 explicitly at entry/child starts and guard restores observed16→19 three times. No production API chosen by script.
+
+Plain request/response evidence (full safe receipt evidence/glm-tool.txt):
+- pi POST/v1/chat/completions modelglm-fixture,streamtrue,tools=[read],tool_stream=true,thinking={type:enabled,clear_thinking:false},reasoning_effort=low,max_completion_tokens=16384.
+- pinned proxy200 completion stream,marker.
+- stand-in receives POST/v1/chat/completions,tools=[read],tool_stream=true and same thinking/reasoning_effort fields;max_tokens=16384. Thus zaiToolStream-derived tool_stream survives this proxy route. No tool invocation or tool-call delta sequence was requested by the stand-in; this proves field survival with active tool, not every tool-call streaming semantic.
+
+Then exactly once each whole file, fresh gXXX TMPDIR,nice19,timeout-k10/180s:
+- packages/harness/tests/proxy-bundle.test.mjs00:14:20Z:7pass,0fail,0skip,exit0.
+- packages/plugins/tests/proxy-harness.test.mjs00:14:20Z:5pass,0fail,0skip,exit0.
+
+No failures, no extra runs/mutants. Cleanup managed children0. Own-worktree/evidence-root sweep found only same six pre-existing tool services,no proxy/pi/test/timeout/chromium leftovers. Lane B free. P3 now waits for P2/row331 landing before rebase,mutants,Gladstone review and further gates; no landing/merge requested or performed.

agents/fethry/work/queue-332/HANDOFF.md

@@ -0,0 +1,51 @@
+# STOPPED — row 332 (P3), T3 crash handoff
+
+Stopped on 2026-10-24 under Mos mos-1630, relaying Jason's instruction: do not restart long jobs; commit/push safe work, leave a handoff, then stop. No further thread messages, tests, probes, queue operations, or implementation will run in this session.
+
+## Branch and completed work
+
+- Worktree: /home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332
+- Branch: fethry/row332, based on refactor c8a9bcf94. No implementation commits, rebases, merges or production source edits.
+- Read P3 brief, rules, full pi amendment, gate template, design and named source files. Detailed notes in BUILD.md beside this handoff.
+- Root npm ci --ignore-scripts --no-audit --no-fund completed in this worktree only (128 packages). No canonical node_modules used.
+- Initial test files written before implementation; none executed. Sage has not sent CLEAR. No proxy fetch, binary probe, offline turn, mutant, or suite has run.
+- No real proxy, management key, host auth directory or live instance was accessed. No production service was started/stopped.
+- Canonical queue next returned nothing during the assignment. Queue start op fethry-332-start refused on locks, then owner sage, including a retry after two minutes. Latest completed queue show still had owner sage, state briefed, after 331; it also warned that the rendered table was unknown. Did not repair or bypass it. Sage sage-4293 says an assign/after=none batch is running. Queue metadata identifies shared Gitea issue #1830.
+
+## Latest accepted design
+
+Sage sage-4293 supersedes all earlier route proposals: explicit route metadata, never catalog membership or model-prefix inference. Selected spelling: launch.models.<selection>.route = anthropic | glm | codex, required only with provider proxy. Missing route: proxy-route-missing; unknown/nonstring route: proxy-route-unknown. Other providers keep provider/model-only entries. Proposed launch.account.credential literal proxy; existing name/credential field names retained. GPT generated provider: mosaic-proxy-codex, never openai-codex. GPT wire API is still undecided pending the authorized pinned-binary requests. P2's seam stays exactly { baseUrl, key }.
+
+Important implementation finding: launcher.mjs:571 serializes bundle.env into session.harnessEnv. Harness env will contain the session key in proxy mode, so credentials must instead reach spawnSession through transient environment variables and be omitted from serialized harnessEnv. runner.mjs:390 already inherits the spawn environment. Preserve ENV_ALLOW; filter instance provider variables in proxy mode only.
+
+## Uncommitted work, intentionally left for the next session
+
+These are unrun, incomplete tests/audit code, excluded from the documentation-only crash commit:
+
+- packages/business/tests/proxy-launch.test.mjs — explicit routes and refusal codes, proxy account credential, existing nonproxy/account behavior.
+- packages/plugins/tests/proxy-harness.test.mjs — Claude env/preflight, own-key isolation, pi preflight and OAuth-only refusal.
+- packages/seat/tests/proxy-session-env.test.mjs — instance credential filtering and unchanged nonproxy env.
+- packages/harness/tests/proxy-bundle.test.mjs — real bundle generation, all three providers, key reference/no-key/no-! invariants, file modes and launch freshness. Exact GPT API assertion deliberately pending probe evidence; add before its first run.
+- agents/fethry/work/queue-332/import-run-list.mjs — non-evaluating static import audit using vm.SourceTextModule plus explicit computed loader edges. It ran successfully after correcting its own root-depth setup error. It is not a test runner.
+
+IMPORT-RUN-LIST.txt is a historical 211-entry candidate impact list, generated before proxy-bundle.test.mjs was added. It includes case1-accept as explicitly EXCLUDED (mos-1612). Regenerate the list after resuming and report the actual authorized run list inline before any whole-file run. Do not treat the historical manifest as a current run authorization.
+
+## Reporting status
+
+T3 reporting repeatedly failed during GET with a 30-second timeout. fethry-0004 was confirmed delivered. Some later short numeric keys returned reused:true unexpectedly; do not rely on them as delivery evidence. A row-scoped detailed design resend and the inline 211-line import manifest also timed out, including the manifest's same-key retry. Sage may not have those messages. This handoff and BUILD.md are being pushed so they can be read with git show; no new thread message is sent under mos-1630.
+
+## Next session, after restart authorization
+
+1. Read this handoff/BUILD.md and recover queue state from canonical checkout. Wait for owner fethry and no after, then retry the same start op. Never bypass a refusal.
+2. Recover Sage's slot status. Still NO tests or probes until Sage sends CLEAR. No job needs restarting merely to preserve current state.
+3. Review the four uncommitted test files. Add the pinned-proxy API probe and exact GPT assertion before the first relevant run. Initial RED has not happened; production implementation must follow the authorized first RED.
+4. Rebuild the import-derived run list and send it inline or in a reviewed pushed commit before runs. case1-accept remains off without Mos approval. Existing launch-settings.test.mjs proxy fixtures need explicit route metadata with their authorization assertions preserved; no old-test red has occurred.
+5. Use P1's committed fetchPinned code under an owned fresh temporary root (8.0.42 at the inspected magica/row329 revision), never live proxy assets or another seat's scratch. After CLEAR, try pi's responses and completions requests under unshare -rn against stand-in upstream, record evidence, choose one GPT API at build time. Separately prove offline GLM and record z.ai compat survival. Real Codex auth proof remains row209 phase A step7.
+6. Implement transient P2 context, model validation/route propagation, harness config, preflight, spawn env/serialization separation and tests. Named mutants: OAuth token leak; literal key in models.json. No policy or real credentials involved.
+7. Land only after 329 and 331 land, rebasing on both, Gladstone first review, Dewey landing review and Sage's required gate. No force-push or merge authority is added by the crash instruction.
+
+All future tests use a fresh shell-created short TMPDIR, absolute nice 19, and timeout -k 10 for scripts/test-*.sh. First new-test red is reportable afterward; old-test red or a second red goes to Sage before changes/reruns. No test outcomes are claimed here.
+
+## Crash commit
+
+Only documentation and the historical plain-text import manifest are committed. The final STOPPED reply records the exact pushed commit. The uncommitted files above remain deliberately available in this worktree because they have never run and test-slot authorization has not arrived.

agents/fethry/work/queue-332/IMPORT-RUN-LIST.txt

@@ -0,0 +1,213 @@
+packages/bus/tests/access-revoke.test.mjs
+packages/bus/tests/broker.test.mjs
+packages/bus/tests/channel-proof.test.mjs
+packages/bus/tests/chief-of-staff.test.mjs
+packages/bus/tests/citation-guard.test.mjs
+packages/bus/tests/citation-runtime.test.mjs
+packages/bus/tests/creative.test.mjs
+packages/bus/tests/credential-verbs.test.mjs
+packages/bus/tests/grant-scope-runtime.test.mjs
+packages/bus/tests/host-run.test.mjs
+packages/bus/tests/land.test.mjs
+packages/bus/tests/library-credential.test.mjs
+packages/bus/tests/library-lookups.test.mjs
+packages/bus/tests/library-sync.test.mjs
+packages/bus/tests/library.test.mjs
+packages/bus/tests/lifecycle-revoke.test.mjs
+packages/bus/tests/limit-checks.test.mjs
+packages/bus/tests/messages.test.mjs
+packages/bus/tests/processing-runtime.test.mjs
+packages/bus/tests/project-runtime.test.mjs
+packages/bus/tests/reload.test.mjs
+packages/bus/tests/tasks.test.mjs
+packages/bus/tests/tester-writes.test.mjs
+packages/bus/tests/tester.test.mjs
+packages/bus/tests/usage-runtime.test.mjs
+packages/bus/tests/usage.test.mjs
+packages/bus/tests/workflow-roles.test.mjs
+packages/business/tests/access-levels.test.mjs
+packages/business/tests/access.test.mjs
+packages/business/tests/agent-identity.test.mjs
+packages/business/tests/assistant.test.mjs
+packages/business/tests/business.test.mjs
+packages/business/tests/case1-business-file.test.mjs
+packages/business/tests/chief-library-credentials.test.mjs
+packages/business/tests/chief-of-staff.test.mjs
+packages/business/tests/cli.test.mjs
+packages/business/tests/credentials.test.mjs
+packages/business/tests/csuite.test.mjs
+packages/business/tests/grant-scope.test.mjs
+packages/business/tests/hard-waits.test.mjs
+packages/business/tests/hosts.test.mjs
+packages/business/tests/instance-credential-transitions.test.mjs
+packages/business/tests/instance-settings.test.mjs
+packages/business/tests/launch-settings.test.mjs
+packages/business/tests/library-projects-protected.test.mjs
+packages/business/tests/library-seats.test.mjs
+packages/business/tests/lifecycle-settings.test.mjs
+packages/business/tests/optional-tracker.test.mjs
+packages/business/tests/plugin-settings.test.mjs
+packages/business/tests/project-repo.test.mjs
+packages/business/tests/project.test.mjs
+packages/business/tests/proxy-launch.test.mjs
+packages/business/tests/record-grants.test.mjs
+packages/business/tests/reply-limits.test.mjs
+packages/business/tests/resolve.test.mjs
+packages/business/tests/role.test.mjs
+packages/business/tests/token-limit-settings.test.mjs
+packages/business/tests/vars.test.mjs
+packages/business/tests/workflow-roles.test.mjs
+packages/cli/tests/access-boot.test.mjs
+packages/cli/tests/access.test.mjs
+packages/cli/tests/app.test.mjs
+packages/cli/tests/boot-status.test.mjs
+EXCLUDED (mos-1612) packages/cli/tests/case1-accept.test.mjs
+packages/cli/tests/case1-hostcheck.test.mjs
+packages/cli/tests/case2-install.test.mjs
+packages/cli/tests/case2-persona-import.test.mjs
+packages/cli/tests/case2-unit.test.mjs
+packages/cli/tests/channel-cli.test.mjs
+packages/cli/tests/channel-recovery.test.mjs
+packages/cli/tests/cli.test.mjs
+packages/cli/tests/compactions-launch.test.mjs
+packages/cli/tests/config.test.mjs
+packages/cli/tests/credentials.test.mjs
+packages/cli/tests/federation-acceptance.test.mjs
+packages/cli/tests/follow.test.mjs
+packages/cli/tests/git-socket.test.mjs
+packages/cli/tests/grants-scope.test.mjs
+packages/cli/tests/grants.test.mjs
+packages/cli/tests/host.test.mjs
+packages/cli/tests/hosts.test.mjs
+packages/cli/tests/idle-stop-race.test.mjs
+packages/cli/tests/instances.test.mjs
+packages/cli/tests/launch-account.test.mjs
+packages/cli/tests/launch-limit-checks.test.mjs
+packages/cli/tests/launch-limits.test.mjs
+packages/cli/tests/launch-routes.test.mjs
+packages/cli/tests/launcher.test.mjs
+packages/cli/tests/lifecycle.test.mjs
+packages/cli/tests/limits-tokens.test.mjs
+packages/cli/tests/limits.test.mjs
+packages/cli/tests/mark-read.test.mjs
+packages/cli/tests/model-proxy.test.mjs
+packages/cli/tests/names.test.mjs
+packages/cli/tests/notifier.test.mjs
+packages/cli/tests/optional-tracker.test.mjs
+packages/cli/tests/other-tree.test.mjs
+packages/cli/tests/processing-cli.test.mjs
+packages/cli/tests/project-name-repo.test.mjs
+packages/cli/tests/project.test.mjs
+packages/cli/tests/publish-socket.test.mjs
+packages/cli/tests/reply-limits.test.mjs
+packages/cli/tests/revoke-window.test.mjs
+packages/cli/tests/session-clear.test.mjs
+packages/cli/tests/session-cli.test.mjs
+packages/cli/tests/session-launch.test.mjs
+packages/cli/tests/stack-copy.test.mjs
+packages/cli/tests/stack-instances.test.mjs
+packages/cli/tests/tester-reads.test.mjs
+packages/cli/tests/tester-threads.test.mjs
+packages/cli/tests/tester.test.mjs
+packages/cli/tests/thread-cli.test.mjs
+packages/cli/tests/thread-launch.test.mjs
+packages/cli/tests/thread-revoke.test.mjs
+packages/cli/tests/trackers-boot.test.mjs
+packages/cli/tests/transport.test.mjs
+packages/cli/tests/usage.test.mjs
+packages/cli/tests/verbs.test.mjs
+packages/control-board/tests/creative-hidden.test.mjs
+packages/control-board/tests/discord.test.mjs
+packages/control-board/tests/serve.test.mjs
+packages/conversation/tests/flows.test.mjs
+packages/harness/tests/bundle.test.mjs
+packages/harness/tests/claude-gate.test.mjs
+packages/harness/tests/claude-session.test.mjs
+packages/harness/tests/creative.test.mjs
+packages/harness/tests/gate.test.mjs
+packages/harness/tests/git-tools.test.mjs
+packages/harness/tests/library-tools.test.mjs
+packages/harness/tests/mcp-server.test.mjs
+packages/harness/tests/pi-session.test.mjs
+packages/harness/tests/proxy-bundle.test.mjs
+packages/harness/tests/raise-domain.test.mjs
+packages/harness/tests/runner.test.mjs
+packages/harness/tests/skills.test.mjs
+packages/harness/tests/spec-tools.test.mjs
+packages/harness/tests/tools.test.mjs
+packages/plugins/tests/channel.test.mjs
+packages/plugins/tests/harness-compactions.test.mjs
+packages/plugins/tests/harness.test.mjs
+packages/plugins/tests/loader.test.mjs
+packages/plugins/tests/proxy-harness.test.mjs
+packages/plugins/tests/searxng.test.mjs
+packages/processing-control/tests/task.test.mjs
+packages/seat/tests/compactions-budget.test.mjs
+packages/seat/tests/compactions-ledger.test.mjs
+packages/seat/tests/compactions.test.mjs
+packages/seat/tests/proxy-session-env.test.mjs
+packages/seat/tests/sandbox.test.mjs
+packages/seat/tests/session-workspace.test.mjs
+packages/seat/tests/session.test.mjs
+packages/tasks/tests/fields.test.mjs
+packages/webui/tests/agents-browser.test.mjs
+packages/webui/tests/agents.test.mjs
+packages/webui/tests/assistant.test.mjs
+packages/webui/tests/board-held.test.mjs
+packages/webui/tests/browser-edge.test.mjs
+packages/webui/tests/browser.test.mjs
+packages/webui/tests/bus-browser.test.mjs
+packages/webui/tests/bus.test.mjs
+packages/webui/tests/channel-chat.test.mjs
+packages/webui/tests/chat-browser.test.mjs
+packages/webui/tests/chat-instances.test.mjs
+packages/webui/tests/chat-replies-browser.test.mjs
+packages/webui/tests/chat.test.mjs
+packages/webui/tests/conversation.test.mjs
+packages/webui/tests/decide-browser.test.mjs
+packages/webui/tests/decide-sso.test.mjs
+packages/webui/tests/discord.test.mjs
+packages/webui/tests/docs-browser.test.mjs
+packages/webui/tests/editor-browser.test.mjs
+packages/webui/tests/editor.test.mjs
+packages/webui/tests/granted-user.test.mjs
+packages/webui/tests/history-return-flow.test.mjs
+packages/webui/tests/instances-browser.test.mjs
+packages/webui/tests/instances.test.mjs
+packages/webui/tests/library-cli.test.mjs
+packages/webui/tests/library-routes.test.mjs
+packages/webui/tests/limits-browser.test.mjs
+packages/webui/tests/limits-route.test.mjs
+packages/webui/tests/messages.test.mjs
+packages/webui/tests/pinned-copy.test.mjs
+packages/webui/tests/preview.test.mjs
+packages/webui/tests/processing-browser.test.mjs
+packages/webui/tests/processing.test.mjs
+packages/webui/tests/project-file.test.mjs
+packages/webui/tests/proof-cli.test.mjs
+packages/webui/tests/proof.test.mjs
+packages/webui/tests/reads.test.mjs
+packages/webui/tests/relaunch.test.mjs
+packages/webui/tests/return-flow.test.mjs
+packages/webui/tests/room-browser.test.mjs
+packages/webui/tests/room-http.test.mjs
+packages/webui/tests/routes-browser.test.mjs
+packages/webui/tests/routes.test.mjs
+packages/webui/tests/send-browser.test.mjs
+packages/webui/tests/send.test.mjs
+packages/webui/tests/serve.test.mjs
+packages/webui/tests/settings-form.test.mjs
+packages/webui/tests/settings-write.test.mjs
+packages/webui/tests/shell.test.mjs
+packages/webui/tests/sso-browser.test.mjs
+packages/webui/tests/sso.test.mjs
+packages/webui/tests/tester-browser.test.mjs
+packages/webui/tests/tester-cli.test.mjs
+packages/webui/tests/tester-listener.test.mjs
+packages/webui/tests/thread-claims-browser.test.mjs
+packages/webui/tests/thread-claims.test.mjs
+packages/webui/tests/thread-sharing.test.mjs
+packages/webui/tests/usage-browser.test.mjs
+packages/webui/tests/usage.test.mjs
+packages/webui/tests/user-option-swap.test.mjs
+packages/webui/tests/views.test.mjs

agents/fethry/work/queue-332/api-choice/proxy-bundle.txt

@@ -0,0 +1,19 @@
+00:14:20Z
+nice=19
+✔ P3 Anthropic route uses messages at proxy root and the declared model id (12.070131ms)
+✔ P3 omitted route refuses proxy-route-missing before model config generation (2.197623ms)
+✔ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (3.390562ms)
+✔ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (4.240948ms)
+✔ P3 a declared Codex route generates only the single build-time responses provider (3.37448ms)
+✔ P3 models file is private, references the one session key, and stores no executable values or keys (3.305299ms)
+✔ P3 every launch regenerates proxy port, declared models and own key without caching (6.287121ms)
+ℹ tests 7
+ℹ suites 0
+ℹ pass 7
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 128.759611
+exit=0
+00:14:20Z

agents/fethry/work/queue-332/api-choice/proxy-harness.txt

@@ -0,0 +1,17 @@
+00:14:20Z
+nice=19
+✔ P3 Claude env receives the session proxy URL and key, without another agent or host credential (3.096286ms)
+✔ P3 Claude preflight accepts a proxy key without a host provider credential (1.305258ms)
+✔ P3 pi refuses no-session-credential with no provider key (1.23137ms)
+✔ P3 pi refuses no-session-credential with only a Claude OAuth token (3.659409ms)
+✔ P3 pi accepts its own provider key or a session proxy key (0.590987ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 5
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 68.648537
+exit=0
+00:14:20Z

agents/fethry/work/queue-332/evidence/bundled-panel-shape.txt

@@ -0,0 +1,17 @@
+Ip=e=> @ char 1054606:
+Ip=e=>{let t={raw:Dc(e)?e:{}};if(!Dc(e))return t;let n=t=>t.split(`.`).reduce((e,t)=>Dc(e)?e[t]:void 0,e);t.debug=wp(n(`observability.logs.debug`)),t.requestLog=wp(n(`observability.logs.request-log`)),t.loggingToFile=wp(n(`observability.logs.logging-to-file`));let r=n(`observability.logs.logs-max-total-size-mb`);typeof r==`number`&&(t.logsMaxTotalSizeMb=r);let i=n(`requests.proxy-url`);typeof i==`string`&&(t.proxyUrl=i);let a=n(`routing.retry.request-retry`);typeof a==`number`&&(t.requestRetry=a),t.wsAuth=wp(n(`oauth.providers.aistudio.ws-auth`))??!0,t.forceModelPrefix=wp(n(`routing.force-model-prefix`));let o=n(`routing.strategy`);typeof o==`string`&&(t.routingStrategy=o);let s=n(`access.api-keys`);return t.apiKeys=Array.isArray(s)?s.filter(e=>typeof e==`string`):[],t.quotaExceeded={antigravityCredits:wp(n(`oauth.providers.antigravity.antigravity-credits`))??!1},t.providerGroups=Dc(e[`api-keys`])?e[`api-keys`]:{},t.geminiApiKeys=Fp(n(`api-keys.gemini`)),t.interactionsApiKeys=Fp(n(`api-keys.interactions`)),t.codexApiKeys=Fp(n(`api-keys.codex`)),t.metaApiKeys=Fp(n(`api-keys.meta`)),t.xaiApiKeys=Fp(n(`api-keys.xai`)),t.claudeApiKeys=Fp(n(`api-keys.claude`)),t.vertexApiKeys=Fp(n(`api-keys.vertex`)),t.openaiCompatibility=Fp(n(`api-keys.openai-compatibility`),!0),t.oauthExcludedModels=Pp(n(`oauth.excluded-models`)),t},Lp={async getConfig(){return Ip(await W.get(`/config`))},updateRequestLog:e=>W.put(`/config/observability/logs/request-log`,e)},Rp=0,zp=null,Bp=null,Vp=()=>Bp!==null&&Date.now()-Bp.timestamp<3e4,Hp=Tc((e,t)=>({config:null,fetchConfig:async(t=!1)=>{if(!t&&Bp&&Vp())return Bp.data;if(zp)return zp.promise;let n=Rp+=1;try{let t=Lp.getConfig();zp={id:n,promise:t};let r
+
+Fp=(e,t= @ char 1054198:
+Fp=(e,t=!1)=>Array.isArray(e)?e.flatMap((n,r)=>{if(!Dc(n)||!Array.isArray(n.keys))return[];if(t){let t=Np(n,r);return t?[{...t,source:{groupIndex:r,group:n,groups:e}}]:[]}return n.keys.flatMap((t,i)=>{if(!Dc(t))return[];let a={...n};delete a.keys,delete a.name,Object.entries(t).forEach(([e,t])=>{t!==null&&(a[e]=t)});let o=Mp(a);return o?[{...o,source:{groupIndex:r,keyIndex:i,group:n,groups:e}}]:[]})}):[],Ip=e=>{let t={raw:Dc(e)?e:{}};if(!Dc(e))return t;let n=t=>t.split(`.`).reduce((e,t)=>Dc(e)?e[t]:void 0,e);t.debug=wp(n(`observability.logs.debug`)),t.requestLog=wp(n(`observability.logs.reques
+
+Np=(e,t)=> @ char 1053331:
+Np=(e,t)=>{if(!Dc(e))return null;let n=e.name,r=e[`base-url`];if(!n||!r)return null;let i=Array.isArray(e.keys)?e.keys.map((e,t)=>{let n=Ap(e);return n?{...n,sourceIndex:t}:null}).filter(Boolean):[],a=Ep(e.headers),o=Tp(e.models),s=e.priority,c={name:String(n),baseUrl:String(r),apiKeyEntries:i,...jp(e)},l=wp(e[`support-prompt-cache-key`]);l!==void 0&&(c.supportPromptCacheKey=l);let u=wp(e.disabled);u!==void 0&&(c.disabled=u);let d=wp(e[`disable-cooling`]);d!==void 0&&(c.disableCooling=d);let f=Op(e.prefix);f&&(c.prefix=f),a&&(c.headers=a),o.length&&(c.models=o),s!==void 0&&(c.priority=Number(s));let p=kp(e[`auth-index`]);return p&&(c.authIndex=p),t!==void 0&&(c.sourceIndex=t),c},Pp=e=>{if(!Dc(e))return;let t=e;if(!Dc(t))return;let n={};return Object.entries(t).forEach(([e,t])=>{let r=String(e||``).trim();if(!r)return;let i=Dp(t);n[r.toLow
+
+xv=e=> @ char 1129493:
+xv=e=>{let t={name:e.name,"base-url":e.baseUrl,...gv(e),keys:Array.isArray(e.apiKeyEntries)?e.apiKeyEntries.map(e=>hv(e)):[]};e.prefix?.trim()&&(t.prefix=e.prefix.trim()),e.disabled!==void 0&&(t.disabled=e.disabled),e.supportPromptCacheKey!==void 0&&(t[`support-prompt-cache-key`]=e.supportPromptCacheKey);let n=pv(e.headers);n&&(t.headers=n);let r=mv(e.models,!0);return r&&r.length&&(t.models=r),e.priority!==void 0&&(t.priority=e.priority),e.disableCooling!==void 0&&(t[`disable-cooling`]=e.disableCooling),t},Sv=(e,t)=>{if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t))return e.length===t.length&&e.every((e,n)=>Sv(e,t[n]));if(Dc(e)&&Dc(t)){let n=Object.keys(e).filter(t=>e[t]!==void 0);re
+
+hv=e=> @ char 1126395:
+hv=e=>{let t={"api-key":e.apiKey};return e.proxyUrl&&(t[`proxy-url`]=e.proxyUrl),e.weight!==void 0&&(t.weight=e.weight),t},gv=(e,t=!0)=>{let n={};return e.requestRetry!==void 0&&(n[`request-retry`]=e.requestRetry),t&&e.r
+
+zee=(e,t)=> @ char 1130380:
+zee=(e,t)=>{if(!Dc(e)||!Dc(e[`api-keys`]))return[];let n=e[`api-keys`][t];if(n===void 0)return[];if(!Array.isArray(n)||!n.every(e=>Dc(e)&&Array.isArray(e.keys)))throw Cv();return n},wv=async e=>{let t=cv(),n=Nm.getState(),r=await W.get(`/config`);t();let i=Nm.getState();if(n.apiBase!==i.apiBase||n.managementKey!==i.managementKey||n.isAuthenticated!==i.isAuthenticated)throw Cv();return zee(r,e)},Tv

agents/fethry/work/queue-332/evidence/config-tags.txt

@@ -0,0 +1,11 @@
+file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/agents/fethry/work/queue-332/proxy-evidence.mjs:9
+if (getPriority(0) !== 19) throw Error('nice19 required');
+                                 ^
+
+Error: nice19 required
+    at file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/agents/fethry/work/queue-332/proxy-evidence.mjs:9:34
+    at ModuleJob.run (node:internal/modules/esm/module_job:569:25)
+    at async node:internal/modules/esm/loader:650:26
+    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)
+
+Node.js v26.8.1

agents/fethry/work/queue-332/evidence/fetch.txt

@@ -0,0 +1 @@
+{"phase":"fetch","version":"8.0.42","binarySha256":"74661f8cf949977870231359e8bf4344e07946766a673c08fa25a3e5f72fc95e","panelVersion":"1.26.7","panelSha256":"8c9c6b7d3fb311e6aad5d06e1993e53a2d28389e640448a1bc6304ed20b057b5","nice":16,"verified":true}

agents/fethry/work/queue-332/evidence/glm-tool.txt

@@ -0,0 +1,8 @@
+{"phase":"isolation","interfaces":["lo"],"enteredNice":19,"nice":19,"version":"8.0.42","binarySha256":"74661f8cf949977870231359e8bf4344e07946766a673c08fa25a3e5f72fc95e","panelSha256":"8c9c6b7d3fb311e6aad5d06e1993e53a2d28389e640448a1bc6304ed20b057b5","reverified":true}
+{"phase":"readiness","poll":1,"status":"not-ready","modelCount":0}
+{"phase":"readiness","poll":2,"status":200,"modelCount":2}
+{"phase":"catalog","modelIds":["gpt-fixture","glm-fixture"]}
+{"phase":"turn","name":"glm-completions-tool","api":"openai-completions","exit":0,"signal":null,"marker":true,"piRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_completion_tokens","messages","model","reasoning_effort","store","stream","stream_options","thinking","tool_stream","tools"],"model":"glm-fixture","stream":true,"roles":["developer","user"],"inputTypes":"undefined","thinking":{"type":"enabled","clear_thinking":false},"reasoning_effort":"low","tool_stream":true,"toolNames":["read"],"stream_options":{"include_usage":true},"max_completion_tokens":16384}],"proxyResponses":[{"request":0,"status":200,"events":[],"marker":true}],"upstreamRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_tokens","messages","model","reasoning_effort","store","stream","stream_options","thinking","tool_stream","tools"],"model":"glm-fixture","stream":true,"roles":["developer","user"],"inputTypes":"undefined","thinking":{"type":"enabled","clear_thinking":false},"reasoning_effort":"low","tool_stream":true,"toolNames":["read"],"stream_options":{"include_usage":true},"max_tokens":16384}],"nice":19}
+{"phase":"conclusion","limitation":"Stand-in openai-compatibility credential only; no Codex OAuth credential or real-auth turn. This script never selects the production API."}
+{"phase":"nice-corrections","restoredTo":19,"observedBeforeRestore":{"16":3}}
+{"phase":"cleanup","remainingManagedChildren":0}

agents/fethry/work/queue-332/evidence/offline-attempt2.txt

@@ -0,0 +1,10 @@
+{"phase":"isolation","interfaces":["lo"],"enteredNice":19,"nice":19,"version":"8.0.42","binarySha256":"74661f8cf949977870231359e8bf4344e07946766a673c08fa25a3e5f72fc95e","panelSha256":"8c9c6b7d3fb311e6aad5d06e1993e53a2d28389e640448a1bc6304ed20b057b5","reverified":true}
+{"phase":"readiness","poll":1,"status":"not-ready","modelCount":0}
+{"phase":"readiness","poll":2,"status":200,"modelCount":2}
+{"phase":"catalog","modelIds":["gpt-fixture","glm-fixture"]}
+{"phase":"turn","name":"gpt-responses","api":"openai-responses","exit":0,"signal":null,"marker":true,"piRequests":[{"method":"POST","path":"/v1/responses","keys":["include","input","max_output_tokens","model","prompt_cache_key","reasoning","store","stream"],"model":"gpt-fixture","stream":true,"inputTypes":[null,null],"reasoning":{"effort":"low","summary":"auto"}}],"proxyResponses":[{"request":0,"status":200,"events":["response.created","response.in_progress","response.output_item.added","response.content_part.added","response.output_text.delta","response.output_text.done","response.content_part.done","response.output_item.done","response.completed"],"marker":true}],"upstreamRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_tokens","messages","model","reasoning_effort","stream","stream_options"],"model":"gpt-fixture","stream":true,"roles":["user","user"],"inputTypes":"undefined","reasoning_effort":"low","stream_options":{"include_usage":true},"max_tokens":16384}],"nice":19}
+{"phase":"turn","name":"gpt-completions","api":"openai-completions","exit":0,"signal":null,"marker":true,"piRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_completion_tokens","messages","model","reasoning_effort","store","stream","stream_options"],"model":"gpt-fixture","stream":true,"roles":["developer","user"],"inputTypes":"undefined","reasoning_effort":"low","stream_options":{"include_usage":true},"max_completion_tokens":16384}],"proxyResponses":[{"request":1,"status":200,"events":[],"marker":true}],"upstreamRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_tokens","messages","model","reasoning_effort","store","stream","stream_options"],"model":"gpt-fixture","stream":true,"roles":["developer","user"],"inputTypes":"undefined","reasoning_effort":"low","stream_options":{"include_usage":true},"max_tokens":16384}],"nice":19}
+{"phase":"turn","name":"glm-completions","api":"openai-completions","exit":0,"signal":null,"marker":true,"piRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_completion_tokens","messages","model","reasoning_effort","store","stream","stream_options","thinking"],"model":"glm-fixture","stream":true,"roles":["developer","user"],"inputTypes":"undefined","thinking":{"type":"enabled","clear_thinking":false},"reasoning_effort":"low","stream_options":{"include_usage":true},"max_completion_tokens":16384}],"proxyResponses":[{"request":2,"status":200,"events":[],"marker":true}],"upstreamRequests":[{"method":"POST","path":"/v1/chat/completions","keys":["max_tokens","messages","model","reasoning_effort","store","stream","stream_options","thinking"],"model":"glm-fixture","stream":true,"roles":["developer","user"],"inputTypes":"undefined","thinking":{"type":"enabled","clear_thinking":false},"reasoning_effort":"low","stream_options":{"include_usage":true},"max_tokens":16384}],"nice":19}
+{"phase":"conclusion","limitation":"Stand-in openai-compatibility credential only; no Codex OAuth credential or real-auth turn. API value remains PENDING."}
+{"phase":"nice-corrections","restoredTo":19,"observedBeforeRestore":{"16":8}}
+{"phase":"cleanup","remainingManagedChildren":0}

agents/fethry/work/queue-332/evidence/offline.txt

@@ -0,0 +1,4 @@
+{"phase":"isolation","interfaces":["lo"],"enteredNice":19,"nice":16,"version":"8.0.42","configTags":["ntptr; X0 []string } \"*struct { F uintptr; X0 net.Conn }  Models yaml:\"models\" json:\"models\" \"*config.DisableImageGene","ubscriptionCommand $*struct { F uintptr; R *api.Server }  APIKey yaml:\"api-key\" json:\"api-key\" $EffectiveSignInWithChat","on:\\\"type\\\"\" } '*struct { F uintptr; X0 *bufio.Reader }  BaseURL yaml:\"base-url\" json:\"base-url\" '*config.CodexWebSearch","ise-management\" json:\"advertise-management\"  OpenAICompatibility7yaml:\"openai-compatibility\" json:\"openai-compatibility\" K*struct { "]}
+{"phase":"catalog","modelIds":[]}
+{"phase":"error","message":"stand-in routes absent from proxy catalog","proxyDiagnostic":"CLIProxyAPI Version: 8.0.42, Commit: bc064340, BuiltAt: 2026-10-24T14:21:38Z\n[2026-10-24 19:07:27] [--------] [info ] [main.go:641] CLIProxyAPI Version: 8.0.42, Commit: bc064340, BuiltAt: 2026-10-24T14:21:38Z\n[2026-10-24 19:07:27] [--------] [info ] [main.go:752] Local model mode: using embedded catalogs unless an explicit catalog source is configured\n[2026-10-24 19:07:27] [--------] [info ] [antigravity_version.go:71] periodic antigravity version refresh started (interval=3h0m0s)\n[2026-10-24 19:07:27] [--------] [info ] [service_lifecycle.go:103] core auth auto-refresh started (interval=15m0s)\n[2026-10-24 19:07:27] [--------] [info ] [server_management.go:22] management routes registered after secret key configuration\n[2026-10-24 19:07:27] [--------] [warn ] [xai_version.go:96] failed to fetch latest Grok CLI version from npm, keeping fallback/cached version error=npm registry request failed: Get \"https://registry.npmjs.org/@xai-official/grok/latest\": dial tcp [2606:4700::6810:122]:443: connect: network is unreachable\n[2026-10-24 19:07:27] [--------] [info ] [xai_version.go:79] periodic Grok CLI version refresh started (interval=3h0m0s)\n[2026-10-24 19:07:27] [b7852b37] [info ] [gin_logger.go:113] 200 |            0s |       127.0.0.1 | GET     \"/v1/models\"\n"}
+{"phase":"cleanup","remainingManagedChildren":0}

agents/fethry/work/queue-332/evidence/root.txt

@@ -0,0 +1 @@
+/mnt/storage/scratch/tmp/g2Ta

agents/fethry/work/queue-332/fixture-r3/launcher.txt

@@ -0,0 +1,63 @@
+23:59:16Z
+nice=19
+✔ C2-04: launcher workspace clones code but never the library (1450.400805ms)
+✔ P3 proxy key reaches the spawned runner but never session.json or the bundle (1347.117393ms)
+✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1362.533548ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r5c4bfddc2d03","instance":"chief","turn":"2ce6282a-5e4f-4276-851e-3d8dd2d53a7a","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rf9b4b14789bc","instance":"coder","turn":"d7a0db99-cce3-417f-8e7d-9910641f0860","source":"@none","code":"baseline-unknown"}
+✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (842.489432ms)
+usage: {"event":"usage-unknown","business":"acme","run":"rd5fa76df3fb0","instance":"chief","turn":"f739ef1e-c01f-401f-9a89-cf45bc15b976","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r2c414ea1d43f","instance":"pm","turn":"8852a197-c1be-4108-a3af-34dad0232264","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rd5fa76df3fb0","instance":"chief","turn":"6ccde05e-202a-43af-8556-43481f552676","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rd5fa76df3fb0","instance":"chief","turn":"4a8f168b-8676-4b54-9404-174a2a703fcf","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r2c414ea1d43f","instance":"pm","turn":"67ee96fd-1338-48aa-a4fc-edbb7e0aef0e","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r2c414ea1d43f","instance":"pm","turn":"ead68527-7bf4-49a1-8fd7-0107b9c6dfdf","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rd5fa76df3fb0","instance":"chief","turn":"c1cc3a5e-1afe-4994-aea4-a3ea811a8f30","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r2c414ea1d43f","instance":"pm","turn":"e60723f6-187d-4b55-bd81-66189ae014c0","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rd5fa76df3fb0","instance":"chief","turn":"1b7721ee-a337-4623-9fcc-1e05277336ce","source":"@none","code":"baseline-unknown"}
+✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1152.112093ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (4210.704487ms)
+✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (713.043698ms)
+✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (456.475273ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r0e259f41ad4d","instance":"coder","turn":"52bb41d8-5eb6-4c72-9c5c-0b8abf8eae42","source":"@none","code":"baseline-unknown"}
+✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (838.095383ms)
+✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (721.283915ms)
+✔ after a restart, the new host's first tick starts a holder whose decision is still held (963.365086ms)
+✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (708.305295ms)
+✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (300.51414ms)
+✔ a runner that stops at once ends its launch with the runner's reason (380.448961ms)
+✔ a Claude Code launch with no session credential refuses before it starts (206.153531ms)
+✔ a pi launch with no own credential refuses no-session-credential (207.22057ms)
+usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (398.352887ms)
+✔ a runner killed from the host ends its launch as killed, not failed (418.567314ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (211.208923ms)
+✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (215.670064ms)
+✔ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (321.498853ms)
+✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (208.543617ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r1f065863b517","instance":"chief","turn":"2c19dcc1-343e-4c12-93e3-4cd6dd65c4d9","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"reae1621f7ddf","instance":"coder","turn":"03cc3667-aab3-4f55-9e57-bf637e1be0dc","source":"@none","code":"baseline-unknown"}
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1566.080686ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (1164.65123ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (4189.297007ms)
+✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (258.381919ms)
+✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (219.378242ms)
+✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1236.400078ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (198.129142ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (200.659094ms)
+✔ a launch client that never closes its side doesn't hold the host's close (211.221353ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1398.582123ms)
+✔ kill switch refuses chief and hire before launch work and a clear permits a later request (373.807885ms)
+✔ kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle (372.1022ms)
+✔ a launch waiting across halt and resume cannot use its stale admission (236.835216ms)
+ℹ tests 35
+ℹ suites 0
+ℹ pass 35
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 29398.149477
+exit=0
+23:59:45Z

agents/fethry/work/queue-332/fixture-r3/proxy-bundle.txt

@@ -0,0 +1,35 @@
+23:59:16Z
+nice=19
+✔ P3 Anthropic route uses messages at proxy root and the declared model id (9.965114ms)
+✔ P3 omitted route generates the Anthropic provider at proxy root (3.050792ms)
+✔ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (2.833686ms)
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.980797ms)
+✔ P3 a declared Codex route refuses generation while the build-time API is PENDING (4.028363ms)
+✔ P3 models file is private, references the one session key, and stores no executable values or keys (3.814909ms)
+✔ P3 every launch regenerates proxy port, declared models and own key without caching (7.841047ms)
+ℹ tests 7
+ℹ suites 0
+ℹ pass 6
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 117.036157
+
+✖ failing tests:
+
+test at packages/harness/tests/proxy-bundle.test.mjs:68:1
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.980797ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:354:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:69:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+exit=1
+23:59:16Z

agents/fethry/work/queue-332/green-attempt/business.txt

@@ -0,0 +1,18 @@
+23:57:06Z
+nice=19
+✔ P3 proxy model validation preserves each explicit wire route and the proxy model id (1.161459ms)
+✔ P3 a proxy model without route preserves its stored shape for the default Anthropic route (0.134804ms)
+✔ P3 an unknown proxy route refuses proxy-route-unknown (0.823069ms)
+✔ P3 nonproxy models retain their provider/model-only shape and reject route metadata (0.170037ms)
+✔ P3 launch.account accepts the proxy credential source without naming host variables (0.132947ms)
+✔ P3 existing environment-set accounts retain their validated representation (0.200363ms)
+ℹ tests 6
+ℹ suites 0
+ℹ pass 6
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 52.197696
+exit=0
+23:57:06Z

agents/fethry/work/queue-332/green-attempt/harness.txt

@@ -0,0 +1,21 @@
+23:57:12Z
+nice=19
+✔ row 65 both harness modules load through the loader with every export the kind names (7.907431ms)
+✔ row 65 each module answers for its own harness: adapter, levels, account, web, turn end and session files (0.745524ms)
+✔ row 65 claude-code preflight: a missing credential, then a missing or relative binary, each refuse with their code (3.501824ms)
+✔ row 65 claude-code version asks MOSAIC_CLAUDE_BIN when set, else claude on PATH, else null (3.715209ms)
+✔ row 65 pi preflight passes with the repository's pi, and its version is the package pin (0.570287ms)
+✔ row 65 env passes the thinking level to both adapters, and claude-code's bundle writes its hook and MCP files (1.263458ms)
+✔ row 65 a route's thinking reaches pi as --thinking and claude as --effort, through each module's env and adapter (14.961799ms)
+✔ row 65 no core source outside packages/plugins names a harness, apart from the listed exceptions (14.014352ms)
+✔ row 65 the grep's pattern catches a quoted name and a regex alternation, and not a word in prose (0.144087ms)
+ℹ tests 9
+ℹ suites 0
+ℹ pass 9
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 95.780618
+exit=0
+23:57:12Z

agents/fethry/work/queue-332/green-attempt/launcher.txt

@@ -0,0 +1,74 @@
+23:57:12Z
+nice=19
+✔ C2-04: launcher workspace clones code but never the library (1409.48354ms)
+✔ P3 proxy key reaches the spawned runner but never session.json or the bundle (1360.002763ms)
+✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1355.188394ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r77c2d6253086","instance":"chief","turn":"492fcf7a-ee92-4637-b1ee-de6d29c5f536","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r0caee85973df","instance":"coder","turn":"a8f6e869-e911-4e61-8913-9bcb8c84bca5","source":"@none","code":"baseline-unknown"}
+✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (844.874148ms)
+usage: {"event":"usage-unknown","business":"acme","run":"rdd1124f17d39","instance":"chief","turn":"99cbfb5d-a0b1-4de7-b94b-855285416cea","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r3ee360b6ea6f","instance":"pm","turn":"3299c709-0616-4d80-878e-589213b2833a","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rdd1124f17d39","instance":"chief","turn":"aaef40d5-2c04-4a58-8019-3a9fed2740d3","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rdd1124f17d39","instance":"chief","turn":"f7697cc5-383e-41e4-8f48-ca8032cb501f","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r3ee360b6ea6f","instance":"pm","turn":"b6f5d1de-a58e-40de-9d2c-9e79472bc8f5","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r3ee360b6ea6f","instance":"pm","turn":"7a8278f1-c934-418d-a62a-34528048a50c","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rdd1124f17d39","instance":"chief","turn":"c8f0554c-b415-4b2c-aa8e-8eebf3253c12","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r3ee360b6ea6f","instance":"pm","turn":"d5084f6b-43d9-48b4-ada8-14c78f9a6472","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rdd1124f17d39","instance":"chief","turn":"2b8f60d0-5e87-4823-a4c8-e7a13fdffae2","source":"@none","code":"baseline-unknown"}
+✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1499.426496ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (4214.335578ms)
+✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (731.541713ms)
+✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (452.219971ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r8dca21c7af83","instance":"coder","turn":"b0a65410-42a5-495d-a881-d7828ea5dc69","source":"@none","code":"baseline-unknown"}
+✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (859.92414ms)
+✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (813.442124ms)
+✔ after a restart, the new host's first tick starts a holder whose decision is still held (1026.204746ms)
+✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (698.000891ms)
+✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (333.63354ms)
+✔ a runner that stops at once ends its launch with the runner's reason (392.682058ms)
+✔ a Claude Code launch with no session credential refuses before it starts (219.352153ms)
+✔ a pi launch with no own credential refuses no-session-credential (202.834512ms)
+usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+✖ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (214.464488ms)
+✔ a runner killed from the host ends its launch as killed, not failed (437.720138ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (240.940882ms)
+✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (220.344629ms)
+✔ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (288.705681ms)
+✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (211.010194ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r31e317a9ff60","instance":"chief","turn":"bf22f39d-2bf0-48ec-849b-bf8665a262af","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rcb1b05afaad6","instance":"coder","turn":"40f65cf7-8938-4265-949a-c816ef7084cd","source":"@none","code":"baseline-unknown"}
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1532.310766ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (1163.295788ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (4129.096956ms)
+✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (253.012747ms)
+✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (210.12322ms)
+✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1206.988059ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (200.617792ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (208.31407ms)
+✔ a launch client that never closes its side doesn't hold the host's close (210.5977ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1396.242105ms)
+✔ kill switch refuses chief and hire before launch work and a clear permits a later request (356.328128ms)
+✔ kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle (411.659934ms)
+✔ a launch waiting across halt and resume cannot use its stale admission (248.122427ms)
+ℹ tests 35
+ℹ suites 0
+ℹ pass 34
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 29678.41987
+
+✖ failing tests:
+
+test at packages/cli/tests/launcher.test.mjs:714:1
+✖ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (214.464488ms)
+  Error [CliError]: PM launch refused: no-session-credential (fallback fixture: pi needs its own provider key or a session proxy key (primary down: fixture preflight fails))
+      at file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/cli/src/launcher.mjs:1189:23
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
+    exitCode: 3,
+    code: 'no-session-credential'
+  }
+exit=1
+23:57:42Z

agents/fethry/work/queue-332/green-attempt/proxy-bundle.txt

@@ -0,0 +1,88 @@
+23:57:12Z
+nice=19
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (8.82863ms)
+✔ P3 omitted route generates the Anthropic provider at proxy root (3.493006ms)
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (2.169226ms)
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.321456ms)
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (2.285532ms)
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (2.062519ms)
+ℹ tests 6
+ℹ suites 0
+ℹ pass 1
+ℹ fail 5
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 94.962091
+
+✖ failing tests:
+
+test at packages/harness/tests/proxy-bundle.test.mjs:35:1
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (8.82863ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:354:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:36:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:57:1
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (2.169226ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:354:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:58:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:68:1
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.321456ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:354:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:69:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:79:1
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (2.285532ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:354:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:81:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:94:1
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (2.062519ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:354:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:95:17)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+exit=1
+23:57:12Z

agents/fethry/work/queue-332/green-attempt/proxy-harness.txt

@@ -0,0 +1,17 @@
+23:57:06Z
+nice=19
+✔ P3 Claude env receives the session proxy URL and key, without another agent or host credential (2.459573ms)
+✔ P3 Claude preflight accepts a proxy key without a host provider credential (1.019636ms)
+✔ P3 pi refuses no-session-credential with no provider key (0.965529ms)
+✔ P3 pi refuses no-session-credential with only a Claude OAuth token (0.264623ms)
+✔ P3 pi accepts its own provider key or a session proxy key (0.345262ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 5
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 56.359357
+exit=0
+23:57:06Z

agents/fethry/work/queue-332/green-attempt/seat.txt

@@ -0,0 +1,14 @@
+23:57:06Z
+nice=19
+✔ P3 proxy sessionEnv removes every instance provider credential without widening ENV_ALLOW (0.976855ms)
+✔ P3 no proxy retains the full existing allowlist and run environment (0.214793ms)
+ℹ tests 2
+ℹ suites 0
+ℹ pass 2
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 47.349955
+exit=0
+23:57:06Z

agents/fethry/work/queue-332/import-run-list.mjs

@@ -0,0 +1,42 @@
+// Parse static imports without evaluating any repository module. This is an audit tool, not a test runner.
+// Usage: node --experimental-vm-modules agents/fethry/work/queue-332/import-run-list.mjs
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { SourceTextModule } from 'node:vm';
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
+const files = [];
+function walk(dir) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (['node_modules', '.git', 'dist'].includes(entry.name)) continue;
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) walk(path);
+    else if (entry.isFile() && path.endsWith('.mjs')) files.push(path);
+  }
+}
+for (const dir of ['packages', 'scripts', 'adapters']) walk(join(root, dir));
+const graph = new Map();
+for (const file of files) {
+  const module = new SourceTextModule(readFileSync(file, 'utf8'), { identifier: file });
+  graph.set(file, module.dependencySpecifiers.filter(spec => spec.startsWith('.')).map(spec => resolve(dirname(file), spec)));
+}
+// The loader imports the configured harness via a computed path. Explicit runtime import edges:
+const loader = join(root, 'packages/plugins/src/loader.mjs');
+graph.get(loader).push(...['claude-code', 'pi'].map(name => join(root, 'packages/plugins/harness', name, 'index.mjs')));
+const changed = new Set([
+  'packages/seat/src/session.mjs', 'packages/business/src/launch.mjs',
+  'packages/plugins/harness/claude-code/index.mjs', 'packages/plugins/harness/pi/index.mjs',
+  'packages/harness/src/bundle.mjs', 'packages/cli/src/launcher.mjs',
+].map(file => join(root, file)));
+function affected(file, seen = new Set()) {
+  if (changed.has(file)) return true;
+  if (seen.has(file)) return false;
+  seen.add(file);
+  return (graph.get(file) ?? []).some(dep => affected(dep, seen));
+}
+const excluded = 'packages/cli/tests/case1-accept.test.mjs';
+for (const file of files.filter(file => file.endsWith('.test.mjs')).sort()) {
+  if (!affected(file)) continue;
+  const path = relative(root, file);
+  console.log(`${path === excluded ? 'EXCLUDED (mos-1612) ' : ''}${path}`);
+}

agents/fethry/work/queue-332/proxy-evidence.mjs

@@ -0,0 +1,211 @@
+// Row332 evidence. The only network-capable phase is the single authorized fetch.
+// offline runs in unshare -rn; a transparent local tap records pi payload shapes
+// without retaining headers, then pipes bytes unchanged to the pinned proxy.
+import { mkdirSync, readFileSync, readlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getPriority, setPriority, networkInterfaces } from 'node:os';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import http from 'node:http';
+import { fetchPinned } from '../../../../packages/model-proxy/src/fetch.mjs';
+import { PIN } from '../../../../packages/model-proxy/src/common.mjs';
+import { initialConfig, verifyInstall } from '../../../../packages/model-proxy/src/settings.mjs';
+const root = process.env.P3_EVIDENCE_ROOT;
+if (!root || !root.startsWith('/mnt/storage/scratch/') || resolve(root) !== root) throw Error('owned evidence root required');
+const enteredNice = getPriority(0);
+setPriority(0, 19);
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
+const mode = process.argv[2];
+const fakeKeys = ['fx332-client', 'fx332-upstream', 'fx332-manage'];
+function redact(value) {
+  let text = String(value);
+  for (const key of fakeKeys) text = text.split(key).join('[redacted]');
+  return text;
+}
+const emit = (value) => console.log(redact(JSON.stringify(value)));
+if (mode === 'fetch') {
+  const dataRoot = join(root, 'data');
+  mkdirSync(dataRoot, { mode: 0o700 });
+  const installed = await fetchPinned({ dataRoot, pin: PIN });
+  writeFileSync(join(root, 'installed.json'), JSON.stringify(installed) + '\n', { mode: 0o600, flag: 'wx' });
+  emit({ phase: 'fetch', version: PIN.version, binarySha256: PIN.binary.sha256,
+    panelVersion: PIN.panel.version, panelSha256: PIN.panel.sha256, enteredNice, nice: getPriority(0), verified: true });
+} else if (mode === 'offline' || mode === 'glm-tool') {
+  const withTool = mode === 'glm-tool';
+  if (readlinkSync('/proc/self/ns/net') === process.env.P3_HOST_NET_NS) throw Error('network namespace was not isolated');
+  if (Object.keys(networkInterfaces()).some(name => name !== 'lo')) throw Error('loopback-only namespace required');
+  // Re-hash the already fetched assets; this function performs no network I/O.
+  const installed = verifyInstall(join(root, 'data'), PIN);
+  const attemptRoot = join(root, withTool ? 'attempt3-tool' : 'attempt2');
+  mkdirSync(attemptRoot, { mode: 0o700 });
+  setPriority(0, 19);
+  emit({ phase: 'isolation', interfaces: Object.keys(networkInterfaces()), enteredNice, nice: getPriority(0), version: PIN.version,
+    binarySha256: PIN.binary.sha256, panelSha256: PIN.panel.sha256, reverified: true });
+  const requests = [], responses = [], upstreamRequests = [], children = new Set();
+  const managed = (args, options = {}) => {
+    setPriority(0, 19);
+    const child = spawn('/usr/bin/timeout', ['-k', '10', ...args], { env: {
+      PATH: '/usr/bin:/bin', HOME: join(root, 'home'), TMPDIR: process.env.TMPDIR,
+      LANG: 'C.UTF-8', ...options.env,
+    }, cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
+    children.add(child);
+    setPriority(child.pid, 19);
+    child.once('close', () => children.delete(child));
+    return child;
+  };
+  const summary = body => ({ keys: Object.keys(body).sort(), model: body.model, stream: body.stream,
+    roles: Array.isArray(body.messages) ? body.messages.map(message => message.role) : undefined,
+    inputTypes: Array.isArray(body.input) ? body.input.map(item => item.type) : typeof body.input,
+    ...(Object.hasOwn(body, 'reasoning') ? { reasoning: body.reasoning } : {}),
+    ...(Object.hasOwn(body, 'thinking') ? { thinking: body.thinking } : {}),
+    ...(Object.hasOwn(body, 'reasoning_effort') ? { reasoning_effort: body.reasoning_effort } : {}),
+    ...(Object.hasOwn(body, 'enable_thinking') ? { enable_thinking: body.enable_thinking } : {}),
+    ...(Object.hasOwn(body, 'tool_stream') ? { tool_stream: body.tool_stream } : {}),
+    ...(Array.isArray(body.tools) ? { toolNames: body.tools.map(tool => tool.function?.name) } : {}),
+    ...(Object.hasOwn(body, 'stream_options') ? { stream_options: body.stream_options } : {}),
+    ...(Object.hasOwn(body, 'max_tokens') ? { max_tokens: body.max_tokens } : {}),
+    ...(Object.hasOwn(body, 'max_completion_tokens') ? { max_completion_tokens: body.max_completion_tokens } : {}) });
+  const payload = async req => { let text = ''; for await (const part of req) text += part; return JSON.parse(text || '{}'); };
+  const listen = async server => { await new Promise((ok, no) => { server.once('error', no); server.listen(0, '127.0.0.1', ok); }); return server.address().port; };
+  const marker = 'P332_OFFLINE_OK';
+  const upstream = http.createServer(async (req, res) => {
+    const body = await payload(req);
+    upstreamRequests.push({ method: req.method, path: req.url, ...summary(body) });
+    const item = { id: 'msg_fixture', type: 'message', role: 'assistant', status: 'completed', content: [{ type: 'output_text', text: marker, annotations: [] }] };
+    if (req.url.endsWith('/chat/completions')) {
+      res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+      const chunk = (delta, finish_reason = null) => res.write(`data: ${JSON.stringify({ id: 'chat_fixture', object: 'chat.completion.chunk', created: 1, model: body.model, choices: [{ index: 0, delta, finish_reason }] })}\n\n`);
+      chunk({ role: 'assistant', content: marker }); chunk({}, 'stop');
+      res.write(`data: ${JSON.stringify({ id: 'chat_fixture', object: 'chat.completion.chunk', created: 1, model: body.model, choices: [], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } })}\n\n`);
+      res.end('data: [DONE]\n\n');
+    } else if (req.url.endsWith('/responses')) {
+      res.writeHead(200, { 'Content-Type': 'text/event-stream' });
+      const event = (type, more) => res.write(`event: ${type}\ndata: ${JSON.stringify({ type, ...more })}\n\n`);
+      const response = { id: 'resp_fixture', object: 'response', model: body.model, status: 'in_progress', output: [] };
+      event('response.created', { response });
+      event('response.output_item.added', { output_index: 0, item: { ...item, status: 'in_progress', content: [] } });
+      event('response.content_part.added', { item_id: item.id, output_index: 0, content_index: 0, part: { type: 'output_text', text: '', annotations: [] } });
+      event('response.output_text.delta', { item_id: item.id, output_index: 0, content_index: 0, delta: marker });
+      event('response.output_text.done', { item_id: item.id, output_index: 0, content_index: 0, text: marker });
+      event('response.output_item.done', { output_index: 0, item });
+      event('response.completed', { response: { ...response, status: 'completed', output: [item], usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 } } });
+      res.end();
+    } else { res.writeHead(404); res.end('{"error":"stand-in path refused"}'); }
+  });
+  let proxy, tap;
+  let proxyText = '';
+  const corrections = {};
+  const restoreNice = pid => {
+    try {
+      const priority = getPriority(pid);
+      if (priority !== 19) { corrections[priority] = (corrections[priority] ?? 0) + 1; setPriority(pid, 19); }
+      const descendants = readFileSync(`/proc/${pid}/task/${pid}/children`, 'utf8').trim().split(/\s+/).filter(Boolean);
+      for (const child of descendants) restoreNice(Number(child));
+    } catch {}
+  };
+  const keepNice = setInterval(() => restoreNice(process.pid), 100);
+  keepNice.unref();
+  try {
+    const upstreamPort = await listen(upstream);
+    const reservation = http.createServer(); const proxyPort = await listen(reservation);
+    await new Promise(ok => reservation.close(ok));
+    if (proxyPort === 8317 || upstreamPort === 8317) throw Error('reserved host-proxy port excluded');
+    const dataRoot = join(attemptRoot, 'offline');
+    mkdirSync(dataRoot, { mode: 0o700 });
+    mkdirSync(join(dataRoot, 'proxy'), { mode: 0o700 });
+    mkdirSync(join(dataRoot, 'proxy', 'auth'), { mode: 0o700 });
+    const config = initialConfig({ dataRoot, port: proxyPort, key: fakeKeys[2], sentinel: fakeKeys[0] });
+    config.management['disable-control-panel'] = true;
+    config.observability.logs['logging-to-file'] = false;
+    // Bundled panel1.26.7: Ip reads api-keys.openai-compatibility;
+    // Fp/Np require group.keys; xv/hv serialize keys:[{"api-key":...}].
+    config['api-keys'] = { 'openai-compatibility': [{ name: 'p332-standin', 'base-url': `http://127.0.0.1:${upstreamPort}/v1`,
+      keys: [{ 'api-key': fakeKeys[1] }], models: [{ name: 'gpt-fixture' }, { name: 'glm-fixture' }] }] };
+    const configFile = join(dataRoot, 'config.yaml');
+    writeFileSync(configFile, JSON.stringify(config, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+    proxy = managed(['200', installed.binary, '-config', configFile, '-local-model'], { env: { MANAGEMENT_STATIC_PATH: dirname(installed.panel) } });
+    proxy.stdout.on('data', bytes => { proxyText += bytes; });
+    proxy.stderr.on('data', bytes => { proxyText += bytes; });
+    let catalog, ids = [];
+    const readinessDeadline = Date.now() + 30000;
+    for (let poll = 1; Date.now() < readinessDeadline; poll++) {
+      if (proxy.exitCode !== null) throw Error('proxy exited before readiness');
+      try {
+        const result = await fetch(`http://127.0.0.1:${proxyPort}/v1/models`, { headers: { Authorization: `Bearer ${fakeKeys[0]}` }, signal: AbortSignal.timeout(1000) });
+        catalog = result.ok ? await result.json() : null;
+        ids = (catalog?.data ?? []).map(model => model.id);
+        emit({ phase: 'readiness', poll, status: result.status, modelCount: ids.length });
+        if (['gpt-fixture', 'glm-fixture'].every(id => ids.includes(id))) break;
+      } catch { emit({ phase: 'readiness', poll, status: 'not-ready', modelCount: 0 }); }
+      await new Promise(ok => setTimeout(ok, 1000));
+    }
+    if (!catalog) throw Error('proxy readiness failed');
+    emit({ phase: 'catalog', modelIds: ids });
+    if (!['gpt-fixture', 'glm-fixture'].every(id => ids.includes(id))) throw Error('stand-in routes absent from proxy catalog');
+    tap = http.createServer(async (req, res) => {
+      let raw = ''; for await (const part of req) raw += part;
+      const body = JSON.parse(raw || '{}');
+      const index = requests.push({ method: req.method, path: req.url, ...summary(body) }) - 1;
+      const outgoing = http.request({ hostname: '127.0.0.1', port: proxyPort, method: req.method, path: req.url,
+        headers: { ...req.headers, host: `127.0.0.1:${proxyPort}` } }, incoming => {
+        const chunks = [];
+        res.writeHead(incoming.statusCode, incoming.headers);
+        incoming.on('data', bytes => { chunks.push(bytes); res.write(bytes); });
+        incoming.on('end', () => {
+          const text = Buffer.concat(chunks).toString();
+          const events = text.split('\n').filter(line => line.startsWith('event: ')).map(line => line.slice(7));
+          responses.push({ request: index, status: incoming.statusCode, events, marker: text.includes(marker),
+            ...(incoming.statusCode >= 400 ? { errorBody: redact(text).slice(0, 800) } : {}) });
+          res.end();
+        });
+      });
+      outgoing.on('error', () => { res.writeHead(502); res.end(); });
+      // Preserve exact body bytes and never log a header value.
+      outgoing.end(raw);
+    });
+    const tapPort = await listen(tap);
+    if (tapPort === 8317) throw Error('reserved host-proxy port excluded');
+    const scenarios = [
+      ['gpt-responses', 'openai-responses', 'gpt-fixture', null],
+      ['gpt-completions', 'openai-completions', 'gpt-fixture', null],
+      ['glm-completions', 'openai-completions', 'glm-fixture', { thinkingFormat: 'zai', zaiToolStream: true }],
+    ];
+    for (const [name, api, model, compat] of (withTool ? scenarios.filter(([name]) => name === 'glm-completions') : scenarios)) {
+      const turnHome = join(attemptRoot, name, 'home');
+      const agentDir = join(turnHome, '.pi', 'agent');
+      mkdirSync(agentDir, { recursive: true, mode: 0o700 });
+      const models = { providers: { 'p332-probe': { baseUrl: `http://127.0.0.1:${tapPort}/v1`, api,
+        apiKey: '$ANTHROPIC_API_KEY', ...(compat ? { compat } : {}), models: [{ id: model, reasoning: true }] } } };
+      writeFileSync(join(agentDir, 'models.json'), JSON.stringify(models) + '\n', { mode: 0o600, flag: 'wx' });
+      writeFileSync(join(agentDir, 'settings.json'), JSON.stringify({ retry: { enabled: false, maxRetries: 0, provider: { maxRetries: 0 } } }) + '\n', { mode: 0o600, flag: 'wx' });
+      const reqStart = requests.length, upstreamStart = upstreamRequests.length, responseStart = responses.length;
+      const pi = managed(['50', '/usr/bin/node', join(repo, 'node_modules/@earendil-works/pi-coding-agent/dist/cli.js'),
+        '--no-extensions', '--no-skills', '--no-prompt-templates', '--no-themes', '--no-context-files', '--no-session',
+        ...(withTool ? ['--tools', 'read'] : ['--no-tools']),
+        '--provider', 'p332-probe', '--model', model, '--thinking', 'low', '-p', 'Reply P332_OFFLINE_OK only.'],
+        { env: { HOME: turnHome, PI_CODING_AGENT_DIR: agentDir, ANTHROPIC_API_KEY: fakeKeys[0] } });
+      let stdout = '', stderr = '';
+      pi.stdout.on('data', bytes => { stdout += bytes; });
+      pi.stderr.on('data', bytes => { stderr += bytes; });
+      const [exit, signal] = await once(pi, 'close');
+      emit({ phase: 'turn', name: withTool ? `${name}-tool` : name, api, exit, signal, marker: stdout.includes(marker),
+        piRequests: requests.slice(reqStart), proxyResponses: responses.slice(responseStart), upstreamRequests: upstreamRequests.slice(upstreamStart),
+        ...(exit !== 0 ? { stderr: redact(stderr).slice(0, 1200), stdout: redact(stdout).slice(0, 1200) } : {}), nice: getPriority(0) });
+    }
+    emit({ phase: 'conclusion', limitation: 'Stand-in openai-compatibility credential only; no Codex OAuth credential or real-auth turn. This script never selects the production API.' });
+    emit({ phase: 'nice-corrections', restoredTo: 19, observedBeforeRestore: corrections });
+  } catch (error) {
+    emit({ phase: 'error', message: error.message, proxyDiagnostic: redact(proxyText).slice(-3000) });
+    process.exitCode = 1;
+  } finally {
+    clearInterval(keepNice);
+    for (const child of [...children]) child.kill('SIGTERM');
+    for (const child of [...children]) {
+      await Promise.race([once(child, 'close'), new Promise(ok => setTimeout(ok, 1200))]);
+      if (child.exitCode === null) child.kill('SIGKILL');
+    }
+    for (const server of [tap, upstream].filter(Boolean)) { server.closeAllConnections(); await new Promise(ok => server.close(ok)); }
+    emit({ phase: 'cleanup', remainingManagedChildren: children.size });
+  }
+} else { throw Error('fetch, offline or glm-tool phase required'); }

agents/fethry/work/queue-332/red/business.txt

@@ -0,0 +1,104 @@
+23:41:37Z
+nice=19
+✖ P3 proxy model validation preserves each explicit wire route and the proxy model id (0.843397ms)
+✖ P3 a proxy model without route refuses proxy-route-missing (0.621133ms)
+✖ P3 an unknown proxy route refuses proxy-route-unknown (1.448927ms)
+✔ P3 nonproxy models retain their provider/model-only shape and reject route metadata (0.541212ms)
+✖ P3 launch.account accepts the proxy credential source without naming host variables (0.159973ms)
+✔ P3 existing environment-set accounts retain their validated representation (0.209852ms)
+ℹ tests 6
+ℹ suites 0
+ℹ pass 2
+ℹ fail 4
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 58.617716
+
+✖ failing tests:
+
+test at packages/business/tests/proxy-launch.test.mjs:6:1
+✖ P3 proxy model validation preserves each explicit wire route and the proxy model id (0.843397ms)
+  Error [BusinessError]: unsupported launch.models.selected key: "route"
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at rejectUnknownKeys (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/util.mjs:17:33)
+      at file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/launch.mjs:18:5
+      at Array.map (<anonymous>)
+      at checkModels (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/launch.mjs:15:51)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/tests/proxy-launch.test.mjs:9:22)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    exitCode: 2
+  }
+
+test at packages/business/tests/proxy-launch.test.mjs:13:1
+✖ P3 a proxy model without route refuses proxy-route-missing (0.621133ms)
+  AssertionError [ERR_ASSERTION]: Missing expected exception.
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/tests/proxy-launch.test.mjs:14:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: { code: 'proxy-route-missing' },
+    operator: 'throws',
+    diff: 'simple'
+  }
+
+test at packages/business/tests/proxy-launch.test.mjs:19:1
+✖ P3 an unknown proxy route refuses proxy-route-unknown (1.448927ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+  + Comparison {}
+  - Comparison {
+  -   code: 'proxy-route-unknown'
+  - }
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/tests/proxy-launch.test.mjs:21:12)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: BusinessError: unsupported launch.models.selected key: "route"
+        at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+        at rejectUnknownKeys (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/util.mjs:17:33)
+        at file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/launch.mjs:18:5
+        at Array.map (<anonymous>)
+        at checkModels (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/launch.mjs:15:51)
+        at assert.throws.code (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/tests/proxy-launch.test.mjs:21:25)
+        at getActual (node:assert:580:5)
+        at strict.throws (node:assert:728:24)
+        at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/tests/proxy-launch.test.mjs:21:12)
+        at Test.runInAsyncScope (node:async_hooks:226:14),
+    expected: { code: 'proxy-route-unknown' },
+    operator: 'throws',
+    diff: 'simple'
+  }
+
+test at packages/business/tests/proxy-launch.test.mjs:34:1
+✖ P3 launch.account accepts the proxy credential source without naming host variables (0.159973ms)
+  Error [BusinessError]: launch.account.credential must name environment variables, joined with "+"
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at checkAccount (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/launch.mjs:86:5)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/tests/proxy-launch.test.mjs:35:20)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    exitCode: 2
+  }
+exit=1
+23:41:37Z

agents/fethry/work/queue-332/red/harness-corrected-2.txt

@@ -0,0 +1,107 @@
+23:44:40Z
+nice=19
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (10.834783ms)
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (3.078049ms)
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.606176ms)
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (2.917109ms)
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (2.778195ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 0
+ℹ fail 5
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 117.630612
+
+✖ failing tests:
+
+test at packages/harness/tests/proxy-bundle.test.mjs:35:1
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (10.834783ms)
+  Error: ENOENT: no such file or directory, open '/mnt/storage/scratch/tmp/gxWP/p332-ddGpq6/run/home/.pi/agent/models.json'
+      at readFileSync (node:fs:621:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:28:43)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:36:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    errno: -2,
+    code: 'ENOENT',
+    syscall: 'open',
+    path: '/mnt/storage/scratch/tmp/gxWP/p332-ddGpq6/run/home/.pi/agent/models.json'
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:45:1
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (3.078049ms)
+  Error: ENOENT: no such file or directory, open '/mnt/storage/scratch/tmp/gxWP/p332-7vqUkh/run/home/.pi/agent/models.json'
+      at readFileSync (node:fs:621:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:28:43)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:46:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    errno: -2,
+    code: 'ENOENT',
+    syscall: 'open',
+    path: '/mnt/storage/scratch/tmp/gxWP/p332-7vqUkh/run/home/.pi/agent/models.json'
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:56:1
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.606176ms)
+  Error: ENOENT: no such file or directory, open '/mnt/storage/scratch/tmp/gxWP/p332-xqR4OI/run/home/.pi/agent/models.json'
+      at readFileSync (node:fs:621:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:28:43)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:57:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    errno: -2,
+    code: 'ENOENT',
+    syscall: 'open',
+    path: '/mnt/storage/scratch/tmp/gxWP/p332-xqR4OI/run/home/.pi/agent/models.json'
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:67:1
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (2.917109ms)
+  Error: ENOENT: no such file or directory, open '/mnt/storage/scratch/tmp/gxWP/p332-jAVWvp/run/home/.pi/agent/models.json'
+      at readFileSync (node:fs:621:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:28:43)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:69:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    errno: -2,
+    code: 'ENOENT',
+    syscall: 'open',
+    path: '/mnt/storage/scratch/tmp/gxWP/p332-jAVWvp/run/home/.pi/agent/models.json'
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:82:1
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (2.778195ms)
+  Error: ENOENT: no such file or directory, open '/mnt/storage/scratch/tmp/gxWP/p332-yUgdwP/run/home/.pi/agent/models.json'
+      at readFileSync (node:fs:621:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:28:43)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:83:17)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    errno: -2,
+    code: 'ENOENT',
+    syscall: 'open',
+    path: '/mnt/storage/scratch/tmp/gxWP/p332-yUgdwP/run/home/.pi/agent/models.json'
+  }
+exit=1
+23:44:40Z

agents/fethry/work/queue-332/red/harness-corrected.txt

@@ -0,0 +1,99 @@
+23:42:41Z
+nice=19
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (6.017482ms)
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (1.65735ms)
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (1.23753ms)
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (1.202284ms)
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (1.210998ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 0
+ℹ fail 5
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 88.02888
+
+✖ failing tests:
+
+test at packages/harness/tests/proxy-bundle.test.mjs:35:1
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (6.017482ms)
+  Error [BusinessError]: /mnt/storage/scratch/tmp/gQE5/mosaic-harness-biz-FaxPH3/businesses/acme.json launch: instance pm selects unknown model a
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at checkLaunch (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:204:125)
+      at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:310:57)
+      at resolvedFor (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/helpers.mjs:46:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:17:20)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:36:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    exitCode: 2
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:45:1
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (1.65735ms)
+  Error [BusinessError]: /mnt/storage/scratch/tmp/gQE5/mosaic-harness-biz-rtXOnL/businesses/acme.json launch: instance pm selects unknown model z
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at checkLaunch (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:204:125)
+      at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:310:57)
+      at resolvedFor (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/helpers.mjs:46:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:17:20)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:46:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19) {
+    exitCode: 2
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:56:1
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (1.23753ms)
+  Error [BusinessError]: /mnt/storage/scratch/tmp/gQE5/mosaic-harness-biz-IGXaeo/businesses/acme.json launch: instance pm selects unknown model g
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at checkLaunch (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:204:125)
+      at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:310:57)
+      at resolvedFor (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/helpers.mjs:46:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:17:20)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:57:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19) {
+    exitCode: 2
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:67:1
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (1.202284ms)
+  Error [BusinessError]: /mnt/storage/scratch/tmp/gQE5/mosaic-harness-biz-z5VTgc/businesses/acme.json launch: instance pm selects unknown model a
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at checkLaunch (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:204:125)
+      at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:310:57)
+      at resolvedFor (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/helpers.mjs:46:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:17:20)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:69:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19) {
+    exitCode: 2
+  }
+
+test at packages/harness/tests/proxy-bundle.test.mjs:82:1
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (1.210998ms)
+  Error [BusinessError]: /mnt/storage/scratch/tmp/gQE5/mosaic-harness-biz-83xrrf/businesses/acme.json launch: instance pm selects unknown model a
+      at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/errors.mjs:12:9)
+      at checkLaunch (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:204:125)
+      at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/business/src/business.mjs:310:57)
+      at resolvedFor (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/helpers.mjs:46:20)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:17:20)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:83:17)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19) {
+    exitCode: 2
+  }
+exit=1
+23:42:41Z

agents/fethry/work/queue-332/red/harness.txt

@@ -0,0 +1,77 @@
+23:41:42Z
+nice=19
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (8.181278ms)
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (1.652506ms)
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (1.297337ms)
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (1.318875ms)
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (1.353193ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 0
+ℹ fail 5
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 104.116628
+
+✖ failing tests:
+
+test at packages/harness/tests/proxy-bundle.test.mjs:34:1
+✖ P3 Anthropic route uses messages at proxy root and the declared model id (8.181278ms)
+  TypeError: Cannot assign to read only property 'vars' of object '#<Object>'
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:18:17)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:35:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:44:1
+✖ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (1.652506ms)
+  TypeError: Cannot assign to read only property 'vars' of object '#<Object>'
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:18:17)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:45:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:55:1
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (1.297337ms)
+  TypeError: Cannot assign to read only property 'vars' of object '#<Object>'
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:18:17)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:56:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:66:1
+✖ P3 models file is private, references the one session key, and stores no executable values or keys (1.318875ms)
+  TypeError: Cannot assign to read only property 'vars' of object '#<Object>'
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:18:17)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:68:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/harness/tests/proxy-bundle.test.mjs:81:1
+✖ P3 every launch regenerates proxy port, declared models and own key without caching (1.353193ms)
+  TypeError: Cannot assign to read only property 'vars' of object '#<Object>'
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:18:17)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:82:17)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+exit=1
+23:41:42Z

agents/fethry/work/queue-332/red/launcher.txt

@@ -0,0 +1,78 @@
+23:41:55Z
+nice=19
+✔ C2-04: launcher workspace clones code but never the library (1499.521161ms)
+✖ P3 proxy key reaches the spawned runner but never session.json or the bundle (40.623657ms)
+✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1361.267044ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r61b9e08ebd95","instance":"chief","turn":"a017a278-0466-41ec-b7d4-d05d7bb2b4e8","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r786eccbac72a","instance":"coder","turn":"5f857a62-f7e6-4662-a745-852935445baf","source":"@none","code":"baseline-unknown"}
+✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (853.066ms)
+usage: {"event":"usage-unknown","business":"acme","run":"raa425c1d9f99","instance":"chief","turn":"94eec92a-4189-4188-abf0-c0dd27eb3f7a","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r91d263cb44fe","instance":"pm","turn":"b3030547-e499-4465-ba6f-387ca92e7b2e","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"raa425c1d9f99","instance":"chief","turn":"2bb5f36b-953e-4f27-8368-d3cb77b0e68d","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r91d263cb44fe","instance":"pm","turn":"f393963d-90db-4cc3-ada0-9749bbe898e9","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r91d263cb44fe","instance":"pm","turn":"0fca073a-da7d-4cf2-953f-d590f37c6a9c","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"raa425c1d9f99","instance":"chief","turn":"9afffc56-5aca-4ac9-a8e9-ef50b859e54e","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r91d263cb44fe","instance":"pm","turn":"555642ca-00ee-4665-89ab-e68eee143f82","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"raa425c1d9f99","instance":"chief","turn":"1dad33fc-cbe9-404b-8752-3b68753ab199","source":"@none","code":"baseline-unknown"}
+✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1303.262398ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (4218.830472ms)
+✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (747.37249ms)
+✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (463.557222ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r18be47008dae","instance":"coder","turn":"52cd9cf6-57bd-41bf-96c0-fedd9ff9c092","source":"@none","code":"baseline-unknown"}
+✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (763.066104ms)
+✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (706.701053ms)
+✔ after a restart, the new host's first tick starts a holder whose decision is still held (956.687674ms)
+✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (721.85447ms)
+✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (395.757947ms)
+✔ a runner that stops at once ends its launch with the runner's reason (463.349261ms)
+✔ a Claude Code launch with no session credential refuses before it starts (235.420433ms)
+✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (443.687348ms)
+usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (477.875324ms)
+✔ a runner killed from the host ends its launch as killed, not failed (491.276085ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (257.904073ms)
+✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (271.706852ms)
+✔ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (374.032091ms)
+✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (266.897065ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r505be704086e","instance":"chief","turn":"d3144fd2-644c-4bf1-95b5-5914f45dd040","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r505be704086e","instance":"chief","turn":"c61a5cf2-9714-4e2a-a335-a48d0d1dc430","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r96a1ff87bc5e","instance":"coder","turn":"bc58500e-35cc-47b5-b849-a56aa0438ace","source":"@none","code":"baseline-unknown"}
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1866.534461ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (1438.787679ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (4207.748283ms)
+✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (275.473348ms)
+✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (235.254265ms)
+✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1246.476055ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (188.603222ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (194.710702ms)
+✔ a launch client that never closes its side doesn't hold the host's close (204.602445ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1400.602264ms)
+✔ kill switch refuses chief and hire before launch work and a clear permits a later request (396.558108ms)
+✔ kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle (362.427202ms)
+✔ a launch waiting across halt and resume cannot use its stale admission (218.641499ms)
+ℹ tests 35
+ℹ suites 0
+ℹ pass 34
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 29700.689398
+
+✖ failing tests:
+
+test at packages/cli/tests/launcher.test.mjs:150:1
+✖ P3 proxy key reaches the spawned runner but never session.json or the bundle (40.623657ms)
+  Error [CliError]: unsupported /mnt/storage/scratch/tmp/gmDV/mosaic-launch-PVUXgr/config/businesses/acme.json launch.models.claude-opus-5-5 key: "route"
+      at business (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/cli/src/config.mjs:45:47)
+      at bootConfig (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/cli/src/config.mjs:126:10)
+      at setup (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/cli/tests/launcher.test.mjs:99:16)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/cli/tests/launcher.test.mjs:156:34)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    exitCode: 3
+  }
+exit=1
+23:42:25Z

agents/fethry/work/queue-332/red/plugins-corrected.txt

@@ -0,0 +1,98 @@
+23:42:41Z
+nice=19
+✖ P3 Claude env receives the session proxy URL and key, without another agent or host credential (3.24785ms)
+✖ P3 Claude preflight accepts a proxy key without a host provider credential (1.57681ms)
+✖ P3 pi refuses no-session-credential with no provider key (1.085777ms)
+✖ P3 pi refuses no-session-credential with only a Claude OAuth token (0.464216ms)
+✔ P3 pi accepts its own provider key or a session proxy key (0.351842ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 1
+ℹ fail 4
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 71.435137
+
+✖ failing tests:
+
+test at packages/plugins/tests/proxy-harness.test.mjs:24:1
+✖ P3 Claude env receives the session proxy URL and key, without another agent or host credential (3.24785ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  + actual - expected
+  
+  + undefined
+  - 'http://127.0.0.1:12345'
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:30:12)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: 'http://127.0.0.1:12345',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at packages/plugins/tests/proxy-harness.test.mjs:39:1
+✖ P3 Claude preflight accepts a proxy key without a host provider credential (1.57681ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  + actual - expected
+  
+  + {
+  +   code: 'no-session-credential',
+  +   message: "the bus host has none of CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL; the bus unit's EnvironmentFile sets one when the bus starts"
+  + }
+  - null
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:44:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: { code: 'no-session-credential', message: "the bus host has none of CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL; the bus unit's EnvironmentFile sets one when the bus starts" },
+    expected: null,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at packages/plugins/tests/proxy-harness.test.mjs:49:1
+✖ P3 pi refuses no-session-credential with no provider key (1.085777ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  + actual - expected
+  
+  + undefined
+  - 'no-session-credential'
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:51:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: 'no-session-credential',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at packages/plugins/tests/proxy-harness.test.mjs:54:1
+✖ P3 pi refuses no-session-credential with only a Claude OAuth token (0.464216ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  + actual - expected
+  
+  + undefined
+  - 'no-session-credential'
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:56:10)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: 'no-session-credential',
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+exit=1
+23:42:41Z

agents/fethry/work/queue-332/red/plugins.txt

@@ -0,0 +1,82 @@
+23:41:44Z
+nice=19
+✖ P3 Claude env receives the session proxy URL and key, without another agent or host credential (0.739622ms)
+✖ P3 Claude preflight accepts a proxy key without a host provider credential (0.187719ms)
+✖ P3 pi refuses no-session-credential with no provider key (0.161237ms)
+✖ P3 pi refuses no-session-credential with only a Claude OAuth token (0.154227ms)
+✖ P3 pi accepts its own provider key or a session proxy key (0.168061ms)
+ℹ tests 5
+ℹ suites 0
+ℹ pass 0
+ℹ fail 5
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 52.551274
+
+✖ failing tests:
+
+test at packages/plugins/tests/proxy-harness.test.mjs:24:1
+✖ P3 Claude env receives the session proxy URL and key, without another agent or host credential (0.739622ms)
+  TypeError: Cannot destructure property 'log' of 'undefined' as it is undefined.
+      at createLoader (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/src/loader.mjs:88:32)
+      at harness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:11:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:25:24)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17)
+
+test at packages/plugins/tests/proxy-harness.test.mjs:39:1
+✖ P3 Claude preflight accepts a proxy key without a host provider credential (0.187719ms)
+  TypeError: Cannot destructure property 'log' of 'undefined' as it is undefined.
+      at createLoader (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/src/loader.mjs:88:32)
+      at harness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:11:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:40:24)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3)
+
+test at packages/plugins/tests/proxy-harness.test.mjs:49:1
+✖ P3 pi refuses no-session-credential with no provider key (0.161237ms)
+  TypeError: Cannot destructure property 'log' of 'undefined' as it is undefined.
+      at createLoader (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/src/loader.mjs:88:32)
+      at harness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:11:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:50:20)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/plugins/tests/proxy-harness.test.mjs:54:1
+✖ P3 pi refuses no-session-credential with only a Claude OAuth token (0.154227ms)
+  TypeError: Cannot destructure property 'log' of 'undefined' as it is undefined.
+      at createLoader (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/src/loader.mjs:88:32)
+      at harness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:11:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:55:20)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+
+test at packages/plugins/tests/proxy-harness.test.mjs:59:1
+✖ P3 pi accepts its own provider key or a session proxy key (0.168061ms)
+  TypeError: Cannot destructure property 'log' of 'undefined' as it is undefined.
+      at createLoader (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/src/loader.mjs:88:32)
+      at harness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:11:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/tests/proxy-harness.test.mjs:60:20)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+exit=1
+23:41:44Z

agents/fethry/work/queue-332/red/seat.txt

@@ -0,0 +1,35 @@
+23:41:50Z
+nice=19
+✖ P3 proxy sessionEnv removes every instance provider credential without widening ENV_ALLOW (1.019646ms)
+✔ P3 no proxy retains the full existing allowlist and run environment (0.564867ms)
+ℹ tests 2
+ℹ suites 0
+ℹ pass 1
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 46.658896
+
+✖ failing tests:
+
+test at packages/seat/tests/proxy-session-env.test.mjs:16:1
+✖ P3 proxy sessionEnv removes every instance provider credential without widening ENV_ALLOW (1.019646ms)
+  AssertionError [ERR_ASSERTION]: CLAUDE_CODE_OAUTH_TOKEN
+  
+  true !== false
+  
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/seat/tests/proxy-session-env.test.mjs:19:40)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: true,
+    expected: false,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+exit=1
+23:41:50Z

agents/fethry/work/queue-332/route-required/launch-settings.txt

@@ -0,0 +1,30 @@
+00:01:55Z
+nice=19
+✔ REQ-LIMIT-1 schema: every scope unset or zero, adjustable above four, bad values and unknown models refuse (22.211777ms)
+✔ REQ-LIMIT-1 counts each exact scope at/over limit, unlimited and old tuple after model reassignment (0.666965ms)
+✔ REQ-ROLE-3 writer: atomic validated revision, immutable previous bytes and authenticated actor/old/new receipt (19.091287ms)
+✔ REQ-ROLE-3 writer: pre-rename fault leaves old file, post-rename recovery records commit, conflicting recovery refuses (15.98515ms)
+✔ REQ-LIMIT-1 / decision145 migration prints only, preserves values, rejects ambiguity, and is idempotent (4.713343ms)
+✔ REQ-LIMIT-1 shared settings validates the complete proposed selection and logs exact actor (20.35829ms)
+✔ REQ-LIMIT-1 provider is table data: another provider routes separately and aliases share exact counts (2.568186ms)
+✔ REQ-ROLE-3 refuses live writer locks, symlink targets and uncertain recovery without changing bytes (9.763289ms)
+✔ Q169 assistants: vars and definition change and log the actor; tracker null leaves no tracker (16.756637ms)
+✔ Q169 assistants: refuses other instances, other definitions, holder and credentials, empty entries, a tracker the definition has no credential for and a stale revision (19.737439ms)
+✔ Q169 assistants: a definition with a vikunja credential takes a tracker change and refuses its removal or a used bot (12.898928ms)
+✔ row 65 routes lists every instance with harness, model, thinking and fallback, the switched-on harnesses, the model keys and each harness's levels (2.552837ms)
+✔ row 65 setRoutes saves a harness, model, thinking and whole fallback, reads each back from the file, logs the actor, and a null fallback clears all three (16.235475ms)
+✔ row 65 setRoutes refuses a partial fallback, a switched-off harness, a level the harness doesn't apply, an unloaded module, an unknown model or instance, a malformed route, no change and a stale revision, with the file unchanged (20.272464ms)
+✔ row 65 a file with harness vars and no plugins.harness loads and its views read; a model change still saves, and a route change refuses harness-off (10.564122ms)
+✔ B7 kept instance: the models keys it names and the instances key are the human's (26.878317ms)
+✔ B7 kept instance: its route is the human's (10.786018ms)
+✔ M10 creative instance: models keys it names, the instances key and its route are the human's (35.64373ms)
+ℹ tests 18
+ℹ suites 0
+ℹ pass 18
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 331.736961
+exit=0
+00:01:56Z

agents/fethry/work/queue-332/route-required/launcher.txt

@@ -0,0 +1,62 @@
+00:01:56Z
+nice=19
+✔ C2-04: launcher workspace clones code but never the library (1457.042303ms)
+✔ P3 proxy key reaches the spawned runner but never session.json or the bundle (1365.062806ms)
+✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1374.325436ms)
+usage: {"event":"usage-unknown","business":"acme","run":"ra78486da0ed8","instance":"chief","turn":"9402e726-ac22-4423-aea9-cf7dcc35c134","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r49e89e37520e","instance":"coder","turn":"6bf40609-ae81-49b3-96d0-de2d5811b135","source":"@none","code":"baseline-unknown"}
+✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (836.256914ms)
+usage: {"event":"usage-unknown","business":"acme","run":"rf8408ce6a5b4","instance":"chief","turn":"e773abb1-268c-4404-a5da-81acd979905f","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r42524dd77612","instance":"pm","turn":"58e2bf95-0793-4495-bcdc-b27aa651caa1","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rf8408ce6a5b4","instance":"chief","turn":"cb53fe60-e24f-4760-b284-d3b1d3620050","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r42524dd77612","instance":"pm","turn":"7460fc5d-aea2-4343-98a5-00d063c730c5","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r42524dd77612","instance":"pm","turn":"1ee4cbc7-90b7-4275-b3ac-4cbbd0394912","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rf8408ce6a5b4","instance":"chief","turn":"1573dcc7-1d85-4783-b8c9-1a25c6ff71ac","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r42524dd77612","instance":"pm","turn":"bcb2aa05-7af5-4d9e-b085-c631754554ae","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"rf8408ce6a5b4","instance":"chief","turn":"9c77b01a-8f82-4d76-8e86-3eccdf5c05bc","source":"@none","code":"baseline-unknown"}
+✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1399.028095ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (4193.990785ms)
+✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (707.949813ms)
+✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (438.968553ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r33b3a0a89f29","instance":"coder","turn":"54d42057-6aeb-4460-bbbb-11bb7d96f6a0","source":"@none","code":"baseline-unknown"}
+✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (784.946481ms)
+✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (733.626616ms)
+✔ after a restart, the new host's first tick starts a holder whose decision is still held (1104.180428ms)
+✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (766.099638ms)
+✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (314.836965ms)
+✔ a runner that stops at once ends its launch with the runner's reason (380.228742ms)
+✔ a Claude Code launch with no session credential refuses before it starts (206.698491ms)
+✔ a pi launch with no own credential refuses no-session-credential (194.63649ms)
+usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/down is missing","kept":[]}
+✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (395.760187ms)
+✔ a runner killed from the host ends its launch as killed, not failed (404.215037ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (204.482756ms)
+✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (223.681469ms)
+✔ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (294.218836ms)
+✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (216.464613ms)
+usage: {"event":"usage-unknown","business":"acme","run":"r4b699771c38c","instance":"chief","turn":"77969cf2-7fc8-41ff-8d52-7569e054b6f8","source":"@none","code":"baseline-unknown"}
+usage: {"event":"usage-unknown","business":"acme","run":"r6e6168e49a89","instance":"coder","turn":"e6dfb039-1843-41b7-8111-7992cfddac3d","source":"@none","code":"baseline-unknown"}
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (2155.647443ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (1620.990125ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (4336.758535ms)
+✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (279.143242ms)
+✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (229.339371ms)
+✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1236.511266ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (212.151607ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (201.563393ms)
+✔ a launch client that never closes its side doesn't hold the host's close (203.041695ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1399.240682ms)
+✔ kill switch refuses chief and hire before launch work and a clear permits a later request (362.776444ms)
+✔ kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle (400.610758ms)
+✔ a launch waiting across halt and resume cannot use its stale admission (221.918115ms)
+ℹ tests 35
+ℹ suites 0
+ℹ pass 35
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 30999.3545
+exit=0
+00:02:27Z

agents/fethry/work/queue-332/route-required/proxy-bundle.txt

@@ -0,0 +1,35 @@
+00:01:56Z
+nice=19
+✔ P3 Anthropic route uses messages at proxy root and the declared model id (11.574291ms)
+✔ P3 omitted route refuses proxy-route-missing before model config generation (2.072933ms)
+✔ P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility (2.699568ms)
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.510206ms)
+✔ P3 a declared Codex route refuses generation while the build-time API is PENDING (2.334352ms)
+✔ P3 models file is private, references the one session key, and stores no executable values or keys (3.084202ms)
+✔ P3 every launch regenerates proxy port, declared models and own key without caching (5.343868ms)
+ℹ tests 7
+ℹ suites 0
+ℹ pass 6
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 108.561079
+
+✖ failing tests:
+
+test at packages/harness/tests/proxy-bundle.test.mjs:62:1
+✖ P3 GPT route selects a stack-owned provider instead of pi Codex OAuth (2.510206ms)
+  Error: proxy GPT API is PENDING build-time evidence
+      at Module.bundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/plugins/harness/pi/index.mjs:78:62)
+      at buildBundle (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/src/bundle.mjs:359:23)
+      at build (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:20:18)
+      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/fethry-row332/packages/harness/tests/proxy-bundle.test.mjs:63:13)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
+exit=1
+00:01:56Z

agents/fethry/work/queue-332/route-required/proxy-fixture-grep.txt

@@ -0,0 +1,16 @@
+packages/business/tests/launch-settings.test.mjs:41: assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'missing',sonnet:'sonnet'}},f.file,{rolesDir:f.rolesDir}));assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.throws(()=>migrateLaunch(old,{...mapping,models:{...mapping.models,proxy:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}},instances:{pm:'proxy'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);const onlyOpus=structuredClone(old);onlyOpus.launch.max={opus:4};assert.throws(()=>migrateLaunch(onlyOpus,mapping,f.file,{rolesDir:f.rolesDir}),/unknown or ambiguous/);const allOpus=structuredClone(old);for(const r of Object.values(allOpus.roles))r.vars.model='claude-opus-5-5';assert.throws(()=>migrateLaunch(allOpus,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.equal(readFileSync(f.file,'utf8'),bytes);assert.equal(statSync(f.file).mtimeMs,mtime);
+packages/business/tests/launch-settings.test.mjs:45: const result=settings.set('acme',{revision:view.revision,limits:{total:0},instances:{coder:'opus'}},'jason');assert.equal(result.limits.total,0);assert.equal(result.instances.coder.modelKey,'opus');const models=structuredClone(result.models);models.opus.provider='proxy';models.opus.route='anthropic';const updated=settings.set('acme',{revision:result.revision,models},'jason');assert.equal(updated.instances.pm.provider,'proxy');assert.throws(()=>settings.set('acme',{revision:result.revision,instances:{coder:'ghost'}},'jason'));assert.throws(()=>settings.set('acme',{revision:result.revision,roles:{}},'jason'));
+packages/business/tests/launch-settings.test.mjs:154: const moved={...models,[key]:{provider:'proxy',route:'anthropic',model:'claude-sonnet-5-5'}};
+packages/business/tests/launch-settings.test.mjs:161: ({revision}=settings.set('acme',{revision,models:{...models,spare:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}}},chief));
+packages/business/tests/launch-settings.test.mjs:188: const sonnet={...models,sonnet:{provider:'proxy',route:'anthropic',model:'claude-sonnet-5-5'}};
+packages/business/tests/launch-settings.test.mjs:198: ({revision}=settings.set('acme',{revision,models:{...models,opus:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}}},chief));
+packages/business/tests/proxy-launch.test.mjs:8:    const models = { selected: { provider: 'proxy', model: 'proxy-only-id', route } };
+packages/business/tests/proxy-launch.test.mjs:14:  assert.throws(() => checkModels({ selected: { provider: 'proxy', model: 'proxy-only-id' } }), {
+packages/business/tests/proxy-launch.test.mjs:21:    assert.throws(() => checkModels({ selected: { provider: 'proxy', model: 'proxy-only-id', route } }), {
+packages/cli/tests/launcher.test.mjs:155:    doc.launch.models['claude-opus-5-5'] = { provider: 'proxy', model: 'claude-fixture', route: 'anthropic' };
+packages/harness/tests/proxy-bundle.test.mjs:10:  a: { provider: 'proxy', model: 'claude-fixture', route: 'anthropic' },
+packages/harness/tests/proxy-bundle.test.mjs:11:  z: { provider: 'proxy', model: 'glm-fixture', route: 'glm' },
+packages/harness/tests/proxy-bundle.test.mjs:12:  g: { provider: 'proxy', model: 'gpt-fixture', route: 'codex' },
+packages/harness/tests/proxy-bundle.test.mjs:47:    a: { provider: 'proxy', model: 'claude-fixture' },
+packages/harness/tests/proxy-bundle.test.mjs:97:    a: { provider: 'proxy', model: 'changed-model-id', route: 'anthropic' },
+packages/harness/tests/proxy-bundle.test.mjs:98:    z: { provider: 'proxy', model: 'changed-glm-id', route: 'glm' },

agents/fethry/work/queue-332/route-required/proxy-launch.txt

@@ -0,0 +1,18 @@
+00:01:47Z
+nice=19
+✔ P3 proxy model validation preserves each explicit wire route and the proxy model id (1.21495ms)
+✔ P3 a proxy model without route refuses proxy-route-missing (0.356994ms)
+✔ P3 an unknown proxy route refuses proxy-route-unknown (0.767073ms)
+✔ P3 nonproxy models retain their provider/model-only shape and reject route metadata (0.17626ms)
+✔ P3 launch.account accepts the proxy credential source without naming host variables (0.179844ms)
+✔ P3 existing environment-set accounts retain their validated representation (0.312195ms)
+ℹ tests 6
+ℹ suites 0
+ℹ pass 6
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 57.913873
+exit=0
+00:01:47Z

agents/fethry/work/queue-332/route-required/proxy-literal-grep.txt

@@ -0,0 +1,31 @@
+packages/business/tests/launch-settings.test.mjs:41: assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'missing',sonnet:'sonnet'}},f.file,{rolesDir:f.rolesDir}));assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.throws(()=>migrateLaunch(old,{...mapping,models:{...mapping.models,proxy:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}},instances:{pm:'proxy'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);const onlyOpus=structuredClone(old);onlyOpus.launch.max={opus:4};assert.throws(()=>migrateLaunch(onlyOpus,mapping,f.file,{rolesDir:f.rolesDir}),/unknown or ambiguous/);const allOpus=structuredClone(old);for(const r of Object.values(allOpus.roles))r.vars.model='claude-opus-5-5';assert.throws(()=>migrateLaunch(allOpus,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.equal(readFileSync(f.file,'utf8'),bytes);assert.equal(statSync(f.file).mtimeMs,mtime);
+packages/business/tests/launch-settings.test.mjs:45: const result=settings.set('acme',{revision:view.revision,limits:{total:0},instances:{coder:'opus'}},'jason');assert.equal(result.limits.total,0);assert.equal(result.instances.coder.modelKey,'opus');const models=structuredClone(result.models);models.opus.provider='proxy';models.opus.route='anthropic';const updated=settings.set('acme',{revision:result.revision,models},'jason');assert.equal(updated.instances.pm.provider,'proxy');assert.throws(()=>settings.set('acme',{revision:result.revision,instances:{coder:'ghost'}},'jason'));assert.throws(()=>settings.set('acme',{revision:result.revision,roles:{}},'jason'));
+packages/business/tests/launch-settings.test.mjs:154: const moved={...models,[key]:{provider:'proxy',route:'anthropic',model:'claude-sonnet-5-5'}};
+packages/business/tests/launch-settings.test.mjs:161: ({revision}=settings.set('acme',{revision,models:{...models,spare:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}}},chief));
+packages/business/tests/launch-settings.test.mjs:188: const sonnet={...models,sonnet:{provider:'proxy',route:'anthropic',model:'claude-sonnet-5-5'}};
+packages/business/tests/launch-settings.test.mjs:198: ({revision}=settings.set('acme',{revision,models:{...models,opus:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}}},chief));
+packages/business/tests/proxy-launch.test.mjs:8:    const models = { selected: { provider: 'proxy', model: 'proxy-only-id', route } };
+packages/business/tests/proxy-launch.test.mjs:14:  assert.throws(() => checkModels({ selected: { provider: 'proxy', model: 'proxy-only-id' } }), {
+packages/business/tests/proxy-launch.test.mjs:21:    assert.throws(() => checkModels({ selected: { provider: 'proxy', model: 'proxy-only-id', route } }), {
+packages/business/tests/proxy-launch.test.mjs:35:  assert.deepEqual(checkAccount({ name: 'proxy', credential: 'proxy' }), { name: 'proxy', credential: 'proxy' });
+packages/business/tests/proxy-launch.test.mjs:43:    assert.throws(() => checkAccount({ name: 'proxy', credential }), /launch\.account\.credential/);
+packages/cli/tests/launcher.test.mjs:155:    doc.launch.models['claude-opus-5-5'] = { provider: 'proxy', model: 'claude-fixture', route: 'anthropic' };
+packages/cli/tests/model-proxy.test.mjs:11:test('proxy init agent and tester refuse before prompting or transport',async()=>{for(const args of [['proxy','init','--tester'],['proxy','init']]){const x=io(args.includes('--tester')?{}:{CODEX_THREAD_ID:'fixture'});await assert.rejects(main(args,x,{promptProxyKey:()=>{throw Error('must not prompt');}}),code('human-required'));}});
+packages/cli/tests/model-proxy.test.mjs:12:test('proxy init prompts twice through no-echo seam and sends key only through human transport',async()=>{const x=io();x.stdin.isTTY=true;x.stdout.isTTY=true;const prompts=[],calls=[];await main(['proxy','init','--business','demo','--port','18432'],x,{system:fakeSystem(),promptProxyKey:async()=>{prompts.push('hidden');return 'p1-management';},transport:b=>async(verb,args)=>{calls.push({b,verb,args});return {port:18432,binary:'/fixture'};}});assert.equal(prompts.length,2);assert.deepEqual(calls,[{b:'demo',verb:'proxy.init',args:{key:'p1-management',port:18432}}]);assert.equal(x.out.text.includes('p1-management'),false);});
+packages/cli/tests/model-proxy.test.mjs:13:test('proxy-key-mismatch: confirmation refuses without bus call',async()=>{const x=io();x.stdin.isTTY=true;x.stdout.isTTY=true;let count=0;await assert.rejects(main(['proxy','init','--business','demo'],x,{system:fakeSystem(),promptProxyKey:async()=>++count===1?'p1-one':'p1-two',transport:()=>()=>{throw Error('must not call');}}),code('proxy-key-mismatch'));});
+packages/cli/tests/model-proxy.test.mjs:14:test('proxy-terminal-required: stdin redirection refuses',async()=>{await assert.rejects(main(['proxy','init'],io(),{system:fakeSystem()}),code('proxy-terminal-required'));});
+packages/cli/tests/model-proxy.test.mjs:15:test('proxy-usage: invalid verb and repeated flags refuse',async()=>{for(const args of [['proxy','unknown'],['proxy','init','--port','18432','--port','18433']])await assert.rejects(main(args,io(),{system:fakeSystem()}),code('proxy-usage'));});
+packages/cli/tests/model-proxy.test.mjs:16:test('proxy-config-invalid: port 8317 refuses before prompting',async()=>await assert.rejects(main(['proxy','init','--port','8317'],io(),{system:fakeSystem()}),code('proxy-config-invalid')));
+packages/cli/tests/model-proxy.test.mjs:17:test('proxy-key-invalid: empty prompt refuses without printing input',async()=>{const x=io();x.stdin.isTTY=true;x.stdout.isTTY=true;await assert.rejects(main(['proxy','init','--business','demo'],x,{system:fakeSystem(),promptProxyKey:async()=>'',transport:()=>()=>{throw Error('must not call');}}),code('proxy-key-invalid'));});
+packages/harness/tests/proxy-bundle.test.mjs:10:  a: { provider: 'proxy', model: 'claude-fixture', route: 'anthropic' },
+packages/harness/tests/proxy-bundle.test.mjs:11:  z: { provider: 'proxy', model: 'glm-fixture', route: 'glm' },
+packages/harness/tests/proxy-bundle.test.mjs:12:  g: { provider: 'proxy', model: 'gpt-fixture', route: 'codex' },
+packages/harness/tests/proxy-bundle.test.mjs:47:    a: { provider: 'proxy', model: 'claude-fixture' },
+packages/harness/tests/proxy-bundle.test.mjs:97:    a: { provider: 'proxy', model: 'changed-model-id', route: 'anthropic' },
+packages/harness/tests/proxy-bundle.test.mjs:98:    z: { provider: 'proxy', model: 'changed-glm-id', route: 'glm' },
+packages/model-proxy/tests/config-unit.test.mjs:14:test('loader proxy absent is byte-compatible; present validates sidecar and preserves config.json',()=>{const f=fixture(),before=readFileSync(f.file);let r=run(f,'scripts/mosaic-config.mjs',['validate']);assert.equal(r.status,0,r.stderr);assert.equal(Object.hasOwn(JSON.parse(r.stdout),'proxy'),false);const value=proxy(f);r=run(f,'scripts/mosaic-config.mjs',['validate']);assert.equal(r.status,0,r.stderr);assert.deepEqual(JSON.parse(r.stdout).proxy,value);assert.deepEqual(readFileSync(f.file),before);});
+packages/model-proxy/tests/config-unit.test.mjs:23:test('historical no-proxy config loader works without new package dependency',()=>{const f=fixture();const copy=join(f.root,'historical/scripts');mkdirSync(copy,{recursive:true});writeFileSync(join(copy,'mosaic-config.mjs'),readFileSync(join(repo,'scripts/mosaic-config.mjs')));const r=spawnSync(process.execPath,[join(copy,'mosaic-config.mjs'),'validate'],{env:f.env,encoding:'utf8',timeout:10000});assert.equal(r.status,0,r.stderr);assert.equal(Object.hasOwn(JSON.parse(r.stdout),'proxy'),false);});
+packages/model-proxy/tests/management-key-encoding.test.mjs:71:  assert.deepEqual(added('data'), ['proxy', 'proxy/auth', 'proxy/config.yaml', 'proxy/logs']);
+packages/model-proxy/tests/runner.test.mjs:9:test('runner verifies before spawning and supplies pinned panel and local model without ambient secrets',()=>{const {root,config,install}=fixture();const calls=[],child=new EventEmitter();startVerifiedProxy(config,{env:{HOME:join(root,'home'),MANAGEMENT_PASSWORD:'p1-management',OPENAI_API_KEY:'p1-upstream'},verify:dir=>{calls.push(['verify',dir]);return install;},spawnImpl:(...args)=>{calls.push(['spawn',...args]);return child;}});assert.equal(calls[0][0],'verify');assert.deepEqual(calls[1],['spawn',install.binary,['-config',join(config.dataRoot,'proxy/config.yaml'),'-local-model'],{cwd:join(config.dataRoot,'proxy'),stdio:'inherit',env:{HOME:join(root,'home'),PATH:'/usr/bin:/bin',MANAGEMENT_STATIC_PATH:join(root,'pin/static')}}]);});
+packages/model-proxy/tests/settings.test.mjs:19:test('exclusive initialization writes private sentinel config, never rewrites config.json or exposes key',async()=>{const f=fixture();installed(f);const key='p1-management';const result=await initializeProxy({...f,pin,key});assert.ok(result.port>=1024&&result.port!==8317);assert.equal(JSON.stringify(result).includes(key),false);const conf=JSON.parse(readFileSync(join(f.dataRoot,'proxy/config.yaml'),'utf8'));assert.equal(conf.server.host,'127.0.0.1');assert.equal(conf.management['allow-remote'],false);assert.equal(conf.management['disable-auto-update-panel'],true);assert.equal(conf.routing.strategy,'fill-first');assert.equal(conf.routing.retry['request-retry'],0);assert.match(conf.access['api-keys'][0],/^msk-.*-sentinel-/);for(const file of [join(f.configDir,'secrets/proxy-management.key'),join(f.dataRoot,'proxy/config.yaml')])assert.equal(lstatSync(file).mode&0o777,0o600);for(const dir of ['proxy','proxy/auth','proxy/logs'])assert.equal(lstatSync(join(f.dataRoot,dir)).mode&0o777,0o700);assert.equal(readFileSync(join(f.configDir,'config.json'),'utf8'),'unchanged');await assert.rejects(initializeProxy({...f,pin,key}),code('proxy-already-initialized'));});
+packages/model-proxy/tests/settings.test.mjs:23:test('proxy-already-initialized: each existing target is preserved and never followed',async()=>{for(const target of ['proxy','key','settings']){const f=fixture();installed(f);let file;if(target==='proxy'){file=join(f.dataRoot,'proxy');mkdirSync(file);writeFileSync(join(file,'marker'),'old');}else if(target==='key'){mkdirSync(join(f.configDir,'secrets'),{mode:0o700});file=join(f.configDir,'secrets/proxy-management.key');writeFileSync(file,'old');}else{file=join(f.configDir,'proxy.json');writeFileSync(file,'old');}await assert.rejects(initializeProxy({...f,pin,key:'p1-management'}),code('proxy-already-initialized'));assert.equal(readFileSync(target==='proxy'?join(file,'marker'):file,'utf8'),'old');}});

docs/SESSIONS.md

@@ -1693,3 +1693,27 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24 | magica | row329 round2 #1827 | In-progress rev4031; B1 ASCII-only key fix/new inventory tests and N1/N3/N4 docs, cleared reader verification running, old tests byte-identical.
 2026-10-24 | magica | row329 R2 #1827 | ASCII management-key fix and docs verified: package66/66,bus readers261/261,CLI readers726/726,config55/55; no required failures/skips, slot returned. Preparing authorized ff review candidate; old tests unchanged.
 2026-10-24 | Sage 1ef1e4f8 | row329 landing #1827 (mos-1634) | Gate GREEN 23:29:14Z unchanged, landed 61ebf2c34 pushed 23:31:27Z; #1827 closed c31650; queue note 4063, done 4064 (b24d917ec); DEFERRED N2/R2-N1 to 331, N1 to P7; Vikunja 631 filed, 237 c1109; 284 and 157 must rebase.
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 P3 proxy harness configuration at c8a9bcf94 | Started recovery and design; npm ci in isolated worktree; tests held for Sage CLEAR; no live proxy or credentials accessed.
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 crash stop (mos-1630) | Documentation-only handoff on fethry/row332; four unrun test files and import audit script left uncommitted; no tests/probes/production edits; no jobs restarted or other threads messaged.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 resume sage-4298 | Added unrun launcher persistence test and third mutant; regenerated import audit and delivered full inline report to Sage; no tests, probes, fetches or production edits; CLEAR and after-none notice pending.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 start sage-4301 | Canonical fethry-332-start succeeded rev4059 briefed→in-progress; no tests/probes/fetches pending CLEAR.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 P1 rebase/reader pre-step | Rebased to 9e2689dff, HEAD efe3e4697; uncommitted tests restored; P3 imports P1 broker through cli test helpers, stopped/reported under sage-4313 step1 before execution.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 first RED lane B | Ran four new files+whole launcher, all34 old launcher tests pass; two new fixture errors; fixes b285e581e then one rerun each: plugin valid RED1/4, bundle further fixture error0/5; reported/stopped, no mutants/probes/fetches, no test process leftovers.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 corrected bundle RED sage-4320 | Fixture-only56701f715 atop b285e581e; whole bundle0pass/5fail/0skip at23:44:40Z, all missing models.json generation; lane B returned, no production edits/mutants/probes/fetches.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 P3 implementation sage-4323/4325 | Production edits and authorized old fixtures written; optional route default Anthropic; GPT wire PENDING; no runs/probes/fetches, preparing pushed unverified checkpoint and import list.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 six-file run sage-4326 | business6/0,seat2/0,proxy-harness5/0,harness9/0,bundle1/5(PENDING),launcher34/1(old fallback lacks own pi key),zero skips; no reruns/behavior fixes, reported old RED before edit; title-only correction authorized, lane B free23:57:42Z,no test leftovers.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 fixture verification sage-4327 | f1e8cda07 bundle6/1(PENDING)/0skip,launcher35/0/0skip; no other failures, old fallback fixed in test only; lane B free23:59:45Z,no test leftovers.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 route required sage-4328 |9563fbc8b proxy-launch6/0,launch-settings18/0,bundle6/1(expected GPT PENDING),launcher35/0,zero skips; grep positive controls/old assertion preservation recorded; lane B free00:02:27Z UTC10-25,no test leftovers,no probes/fetches/mutants.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 pinned offline evidence sage-4329/4330 | One verified fetch; first setup0turns wrong provider shape; statically diagnosed bundled panel schema then one corrected isolated attempt: both GPT shapes+GLM exit0/marker,thinking retained,tool_stream untested(no tools); GPT choice inconclusive/PENDING,no real auth; process cleanup0,lane B free.
+
+2026-10-24 | fethry (65673bd9-3bfa-412b-85d5-9b364187d8b6) | row332 sage-4331 API choice and GLM tool field | ef0939e35 responses constant per lead reasoning tie-break;rehash/no-fetch isolated GLM one turn0/tool_stream retained;bundle7/0/0skip,proxy-harness5/0/0skip;lane B free00:14:20Z UTC10-25,no test leftovers;wait row331 before further work.

packages/business/src/launch.mjs

@@ -1,6 +1,6 @@
 // REQ-LIMIT-1: editable concurrency policy, never a compiled-in capacity ceiling.
 import { requireObject, requireId, requireString, rejectUnknownKeys } from "./util.mjs";
-import { refuse } from "./errors.mjs";
+import { BusinessError, refuse } from "./errors.mjs";
 
 const name = (value, at) => requireString(value, at, { max: 200 });
 const count = (value, at) => {
@@ -15,10 +15,19 @@ export function checkModels(value, where = "launch.models") {
   return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
     requireId(key, where);
     requireObject(entry, `${where}.${key}`);
-    rejectUnknownKeys(entry, ["provider", "model"], `${where}.${key}`);
+    rejectUnknownKeys(entry, entry.provider === "proxy" ? ["provider", "model", "route"] : ["provider", "model"], `${where}.${key}`);
+    if (entry.provider === "proxy") {
+      const missing = !Object.hasOwn(entry, "route");
+      if (missing || !["anthropic", "glm", "codex"].includes(entry.route)) {
+        throw Object.assign(new BusinessError(`${where}.${key}.route must name anthropic, glm or codex`), {
+          code: missing ? "proxy-route-missing" : "proxy-route-unknown",
+        });
+      }
+    }
     return [key, {
       provider: name(entry.provider, `${where}.${key}.provider`),
       model: name(entry.model, `${where}.${key}.model`),
+      ...(entry.provider === "proxy" && Object.hasOwn(entry, "route") ? { route: entry.route } : {}),
     }];
   }));
 }
@@ -82,7 +91,7 @@ export function checkAccount(value, where = "launch.account") {
   requireObject(value, where);
   rejectUnknownKeys(value, ["name", "credential"], where);
   const accountName = requireId(value.name, `${where}.name`);
-  if (typeof value.credential !== "string" || !CREDENTIAL.test(value.credential)) {
+  if (typeof value.credential !== "string" || (value.credential !== "proxy" && !CREDENTIAL.test(value.credential))) {
     refuse(`${where}.credential must name environment variables, joined with "+"`);
   }
   return { name: accountName, credential: value.credential };

packages/business/tests/launch-settings.test.mjs

@@ -38,11 +38,11 @@ test('REQ-ROLE-3 writer: pre-rename fault leaves old file, post-rename recovery
 test('REQ-LIMIT-1 / decision145 migration prints only, preserves values, rejects ambiguity, and is idempotent',async()=>{
  const {migrateLaunch}=await import('../src/migrate-launch.mjs');const f=fixture(),old=structuredClone(f.doc);old.roles.pm.vars.model='claude-opus-5-5';for(const [name,r] of Object.entries(old.roles))if(name!=='pm')r.vars.model='claude-sonnet-5-5';old.launch={by:'chief',instances:['coder','reviewer'],max:{opus:4,sonnet:4}};writeJson(f.file,old);const bytes=readFileSync(f.file,'utf8'),mtime=statSync(f.file).mtimeMs;
  const mapping={models:f.doc.launch.models,families:{opus:'opus',sonnet:'sonnet'}};const next=migrateLaunch(old,mapping,f.file,{rolesDir:f.rolesDir});assert.deepEqual(next.launch.limits, f.doc.launch.limits);assert.equal(next.roles.pm.vars.model,'opus');assert.equal(next.roles.coder.vars.model,'sonnet');assert.deepEqual(migrateLaunch(next,mapping,f.file,{rolesDir:f.rolesDir}),next);
- assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'missing',sonnet:'sonnet'}},f.file,{rolesDir:f.rolesDir}));assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.throws(()=>migrateLaunch(old,{...mapping,models:{...mapping.models,proxy:{provider:'proxy',model:'claude-opus-5-5'}},instances:{pm:'proxy'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);const onlyOpus=structuredClone(old);onlyOpus.launch.max={opus:4};assert.throws(()=>migrateLaunch(onlyOpus,mapping,f.file,{rolesDir:f.rolesDir}),/unknown or ambiguous/);const allOpus=structuredClone(old);for(const r of Object.values(allOpus.roles))r.vars.model='claude-opus-5-5';assert.throws(()=>migrateLaunch(allOpus,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.equal(readFileSync(f.file,'utf8'),bytes);assert.equal(statSync(f.file).mtimeMs,mtime);
+ assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'missing',sonnet:'sonnet'}},f.file,{rolesDir:f.rolesDir}));assert.throws(()=>migrateLaunch(old,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.throws(()=>migrateLaunch(old,{...mapping,models:{...mapping.models,proxy:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}},instances:{pm:'proxy'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);const onlyOpus=structuredClone(old);onlyOpus.launch.max={opus:4};assert.throws(()=>migrateLaunch(onlyOpus,mapping,f.file,{rolesDir:f.rolesDir}),/unknown or ambiguous/);const allOpus=structuredClone(old);for(const r of Object.values(allOpus.roles))r.vars.model='claude-opus-5-5';assert.throws(()=>migrateLaunch(allOpus,{...mapping,families:{opus:'opus',sonnet:'opus'}},f.file,{rolesDir:f.rolesDir}),/ambiguous/);assert.equal(readFileSync(f.file,'utf8'),bytes);assert.equal(statSync(f.file).mtimeMs,mtime);
 });
 test('REQ-LIMIT-1 shared settings validates the complete proposed selection and logs exact actor',async()=>{
  const {launchSettings}=await import('../src/launch-settings.mjs');const f=fixture(),system={environment:'development',dataRoot:join(f.root,'data'),'execution.backend':'docker','execution.provider':'anthropic','execution.model':'sonnet','execution.adapter':'pi'};const settings=launchSettings({dir:f.root,rolesDir:f.rolesDir,system,sessions:()=>[{business:'acme',provider:'anthropic',model:'claude-opus-5-5'}]});const view=settings.read('acme');assert.equal(view.usage.total,1);assert.equal(view.instances.pm.modelKey,'opus');
- const result=settings.set('acme',{revision:view.revision,limits:{total:0},instances:{coder:'opus'}},'jason');assert.equal(result.limits.total,0);assert.equal(result.instances.coder.modelKey,'opus');const models=structuredClone(result.models);models.opus.provider='proxy';const updated=settings.set('acme',{revision:result.revision,models},'jason');assert.equal(updated.instances.pm.provider,'proxy');assert.throws(()=>settings.set('acme',{revision:result.revision,instances:{coder:'ghost'}},'jason'));assert.throws(()=>settings.set('acme',{revision:result.revision,roles:{}},'jason'));
+ const result=settings.set('acme',{revision:view.revision,limits:{total:0},instances:{coder:'opus'}},'jason');assert.equal(result.limits.total,0);assert.equal(result.instances.coder.modelKey,'opus');const models=structuredClone(result.models);models.opus.provider='proxy';models.opus.route='anthropic';const updated=settings.set('acme',{revision:result.revision,models},'jason');assert.equal(updated.instances.pm.provider,'proxy');assert.throws(()=>settings.set('acme',{revision:result.revision,instances:{coder:'ghost'}},'jason'));assert.throws(()=>settings.set('acme',{revision:result.revision,roles:{}},'jason'));
 });
 test('REQ-LIMIT-1 provider is table data: another provider routes separately and aliases share exact counts',async()=>{
  const {limitHit}=await import('../src/launch.mjs');const {sessionModel}=await import('../../harness/src/bundle.mjs');
@@ -151,14 +151,14 @@ test('B7 kept instance: the models keys it names and the instances key are the h
  const chief='chief-of-staff.chief';let {revision}=settings.read('acme');
  const models=structuredClone(settings.read('acme').models);
  const key=doc.roles.coder.vars.model;
- const moved={...models,[key]:{provider:'proxy',model:'claude-sonnet-5-5'}};
+ const moved={...models,[key]:{provider:'proxy',route:'anthropic',model:'claude-sonnet-5-5'}};
  for(const actor of [chief,'tester']){
   const bytes=file();
   assert.throws(()=>settings.set('acme',{revision,models:moved},actor),code('instance-kept'),actor);
   assert.throws(()=>settings.set('acme',{revision,instances:{coder:'opus'}},actor),code('instance-kept'),actor);
   assert.equal(file(),bytes,actor);
  }
- ({revision}=settings.set('acme',{revision,models:{...models,spare:{provider:'proxy',model:'claude-opus-5-5'}}},chief));
+ ({revision}=settings.set('acme',{revision,models:{...models,spare:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}}},chief));
  ({revision}=settings.set('acme',{revision,models:{...settings.read('acme').models,[key]:moved[key]}},'jason'));
  settings.set('acme',{revision,instances:{coder:'opus'}},'jason');
  assert.equal(JSON.parse(file()).roles.coder.vars.model,'opus');
@@ -185,7 +185,7 @@ test('M10 creative instance: models keys it names, the instances key and its rou
  const g={...f,doc};const {settings}=await routeSettings(g);const file=()=>readFileSync(f.file,'utf8');
  const chief='chief-of-staff.chief';let {revision}=settings.read('acme');
  const models=structuredClone(settings.read('acme').models);
- const sonnet={...models,sonnet:{provider:'proxy',model:'claude-sonnet-5-5'}};
+ const sonnet={...models,sonnet:{provider:'proxy',route:'anthropic',model:'claude-sonnet-5-5'}};
  for(const actor of [chief,'tester']){
   const bytes=file();
   assert.throws(()=>settings.set('acme',{revision,models:sonnet},actor),code('organization-creative-human-only'),actor);
@@ -195,7 +195,7 @@ test('M10 creative instance: models keys it names, the instances key and its rou
   assert.equal(file(),bytes,actor);
  }
  // A key no creative instance names stays the chief's.
- ({revision}=settings.set('acme',{revision,models:{...models,opus:{provider:'proxy',model:'claude-opus-5-5'}}},chief));
+ ({revision}=settings.set('acme',{revision,models:{...models,opus:{provider:'proxy',route:'anthropic',model:'claude-opus-5-5'}}},chief));
  assert.throws(()=>settings.set('acme',{revision,instances:{bean:'opus'}},'jason'),code('organization-creative-instance'));
  ({revision}=settings.set('acme',{revision,models:sonnet},'jason'));
  ({revision}=settings.setRoutes('acme',{revision,routes:{bean:{harness:'pi',model:'sonnet',thinking:'high',fallback:{harness:'pi',model:'opus',thinking:'low'}}}},'jason'));

packages/business/tests/proxy-launch.test.mjs

@@ -0,0 +1,45 @@
+// P3: the proxy account is a declared credential source, never a secret value.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { checkAccount, checkModels } from '../src/launch.mjs';
+
+test('P3 proxy model validation preserves each explicit wire route and the proxy model id', () => {
+  for (const route of ['anthropic', 'glm', 'codex']) {
+    const models = { selected: { provider: 'proxy', model: 'proxy-only-id', route } };
+    assert.deepEqual(checkModels(models), models, route);
+  }
+});
+
+test('P3 a proxy model without route refuses proxy-route-missing', () => {
+  assert.throws(() => checkModels({ selected: { provider: 'proxy', model: 'proxy-only-id' } }), {
+    code: 'proxy-route-missing',
+  });
+});
+
+test('P3 an unknown proxy route refuses proxy-route-unknown', () => {
+  for (const route of ['openai-codex', 'unknown', '', null, 7]) {
+    assert.throws(() => checkModels({ selected: { provider: 'proxy', model: 'proxy-only-id', route } }), {
+      code: 'proxy-route-unknown',
+    });
+  }
+});
+
+test('P3 nonproxy models retain their provider/model-only shape and reject route metadata', () => {
+  assert.deepEqual(checkModels({ selected: { provider: 'zai', model: 'glm-fixture' } }), {
+    selected: { provider: 'zai', model: 'glm-fixture' },
+  });
+  assert.throws(() => checkModels({ selected: { provider: 'zai', model: 'glm-fixture', route: 'glm' } }), /unsupported/);
+});
+
+test('P3 launch.account accepts the proxy credential source without naming host variables', () => {
+  assert.deepEqual(checkAccount({ name: 'proxy', credential: 'proxy' }), { name: 'proxy', credential: 'proxy' });
+});
+
+test('P3 existing environment-set accounts retain their validated representation', () => {
+  for (const credential of ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN+ANTHROPIC_BASE_URL']) {
+    assert.deepEqual(checkAccount({ name: 'max', credential }), { name: 'max', credential });
+  }
+  for (const credential of ['', 'fx332-fake', 'proxy+ANTHROPIC_API_KEY', 'PROXY+proxy']) {
+    assert.throws(() => checkAccount({ name: 'proxy', credential }), /launch\.account\.credential/);
+  }
+});

packages/cli/src/launcher.mjs

@@ -157,6 +157,7 @@ import {
   runnerOf,
   SESSION_CREDENTIALS,
   sessionEnv,
+  isProviderVariable,
   sessionExit,
   sessionStore,
   sessionWorkspace,
@@ -216,6 +217,9 @@ export function createLauncher({
   host,
   system,
   env = process.env,
+  // P2 supplies only {baseUrl,key}; a factory may supply the current agent's
+  // context per check. P3 never reads a key store or calls the proxy itself.
+  proxy = null,
   tracker = false,
   launches = true,
   makeLoader = createLoader,
@@ -388,7 +392,18 @@ export function createLauncher({
     let harness = await harnessOf(primary);
     let route = "primary";
     let routeReason = null;
-    const failed = call(primary.harness, "preflight", () => harness.preflight({ env }));
+    const proxyFor = async (selected) => {
+      if (selected.provider !== "proxy") return null;
+      const context = typeof proxy === "function" ? await proxy({ business: b.id, instance }) : proxy;
+      if (!context || typeof context.key !== "string" || !context.key
+        || typeof context.baseUrl !== "string" || !/^http:\/\/127\.0\.0\.1:[0-9]+$/.test(context.baseUrl)) {
+        throw new Refusal("no-session-credential", "proxy model needs its own session proxy context");
+      }
+      // Copy only the agreed seam; never keep a store or management handle.
+      return { baseUrl: context.baseUrl, key: context.key };
+    };
+    let sessionProxy = await proxyFor(primary);
+    const failed = call(primary.harness, "preflight", () => harness.preflight({ env: sessionProxy ? sessionEnv(env, "preflight", sessionProxy) : env, proxy: sessionProxy }));
     if (failed) {
       if (!fallback) throw new Refusal(failed.code, failed.message);
       // The fallback only on a failed primary preflight, and only at launch (row 65). Any refusal of
@@ -397,7 +412,8 @@ export function createLauncher({
         if (e instanceof Refusal) e.message += ` (primary ${primary.harness}: ${failed.message})`;
         throw e;
       });
-      const also = call(fallback.harness, "preflight", () => second.preflight({ env }));
+      sessionProxy = await proxyFor(fallback);
+      const also = call(fallback.harness, "preflight", () => second.preflight({ env: sessionProxy ? sessionEnv(env, "preflight", sessionProxy) : env, proxy: sessionProxy }));
       if (also) throw new Refusal(also.code, `fallback ${fallback.harness}: ${also.message} (primary ${primary.harness}: ${failed.message})`);
       [model, harness, route, routeReason] = [fallback, second, "fallback", failed.code];
     }
@@ -408,12 +424,18 @@ export function createLauncher({
     if (account !== null) {
       // The usage records keep this name (bus schema 3i), so it must never be a credential's value.
       const holds = [...new Set(SESSION_CREDENTIALS.flat())].filter((k) => env[k] === account);
+      if (sessionProxy?.key === account) holds.push("session proxy key");
       if (holds.length) throw new Refusal("account-is-credential", `launch.account.name is the value of ${holds.join(", ")}; it names the account, never its credential`);
-      const named = b.launch.account.credential.split("+");
-      if (!SESSION_CREDENTIALS.some((set) => set.join("+") === named.join("+")) || !named.every((k) => Boolean(env[k])))
-        throw new Refusal("account-credential-missing", `account ${account} names ${named.join(" with ")}, which the bus host doesn't hold as a session login`);
-      const other = [...new Set(SESSION_CREDENTIALS.flat())].filter((k) => !named.includes(k) && Boolean(env[k]));
-      if (other.length) throw new Refusal("account-credential-ambiguous", `account ${account} names ${named.join(" with ")}, but the bus host also sets ${other.join(", ")}`);
+      if (sessionProxy || b.launch.account.credential === "proxy") {
+        if (!sessionProxy || b.launch.account.credential !== "proxy")
+          throw new Refusal("account-credential-missing", `account ${account} needs the declared proxy credential`);
+      } else {
+        const named = b.launch.account.credential.split("+");
+        if (!SESSION_CREDENTIALS.some((set) => set.join("+") === named.join("+")) || !named.every((k) => Boolean(env[k])))
+          throw new Refusal("account-credential-missing", `account ${account} names ${named.join(" with ")}, which the bus host doesn't hold as a session login`);
+        const other = [...new Set(SESSION_CREDENTIALS.flat())].filter((k) => !named.includes(k) && Boolean(env[k]));
+        if (other.length) throw new Refusal("account-credential-ambiguous", `account ${account} names ${named.join(" with ")}, but the bus host also sets ${other.join(", ")}`);
+      }
     }
     const unavailable = sandboxProblem({ bwrap });
     if (unavailable) throw new Refusal("sandbox-unavailable", unavailable);
@@ -432,7 +454,7 @@ export function createLauncher({
       throw new Refusal("limit-check-failed", `${may?.check ?? "bus"}: ${may?.code ?? "malformed-answer"}`);
     }
     admission(admissionGeneration);
-    return { resolved, model, account, harness, route, routeReason, admissionGeneration };
+    return { resolved, model, account, harness, route, routeReason, admissionGeneration, sessionProxy };
   }
 
   // Bundle, spawn, bind, register, hand over the capability.
@@ -503,8 +525,8 @@ export function createLauncher({
       if (c.outcome === "kept") record({ event: "checkout-kept", instance, project: c.project, reason: c.reason });
       else if (c.outcome === "fetched") record({ event: "checkout-fetched", instance, project: c.project, reason: c.reason });
     }
-    let harness, route, routeReason;
-    ({resolved,model,account,harness,route,routeReason}=await check(instance,{pm:instance===b.launch.by,thread,session,human}));
+    let harness, route, routeReason, sessionProxy;
+    ({resolved,model,account,harness,route,routeReason,sessionProxy}=await check(instance,{pm:instance===b.launch.by,thread,session,human}));
     admission(admissionGeneration);
     const { run, runDir } = newRun(dataRoot, b.id);
     const sessionDir = store ? store.session : join(runDir, "session");
@@ -525,6 +547,7 @@ export function createLauncher({
       dir: join(runDir, "bundle"),
       resolved,
       models: b.launch.models,
+      proxy: sessionProxy,
       contract: readFileSync(resolved.contract, "utf8"),
       arbiter: Object.values(b.arbiters).includes(instance),
       tracker,
@@ -548,6 +571,12 @@ export function createLauncher({
     // Row 199 (D11): or publishes it, once a reviewed commit routes git.push.remote within-role.
     const held = [...resolved.limits.authority.withinRole, ...resolved.limits.authority.crossRole];
     const git = land || ["git.push.working", "review.verdict", "git.push.remote"].some((a) => held.includes(a)) ? gitSocketPath(dataRoot) : null;
+    // Secrets go only to spawn, never session.json. Keep this split at the
+    // actual serialization boundary, even if a harness adds another key.
+    const harnessEnv = {}, transientEnv = {};
+    for (const [name, value] of Object.entries(bundle.env)) {
+      (sessionProxy && isProviderVariable(name) ? transientEnv : harnessEnv)[name] = value;
+    }
     writeSessionFile(runDir, {
       ...sessionDefaults,
       business: b.id,
@@ -565,7 +594,7 @@ export function createLauncher({
       sessionDir,
       adapter,
       bundle: files,
-      harnessEnv: bundle.env,
+      harnessEnv,
       turnEnd,
       toolSocket,
       turnMarker,
@@ -589,7 +618,7 @@ export function createLauncher({
     try {
       admission(admissionGeneration);
       spawnedAt.set(run, Date.now());
-      child = spawnSession({ runDir, env: sessionEnv(env, run), paths, business: b.id, role: instance, bwrap });
+      child = spawnSession({ runDir, env: { ...sessionEnv(env, run, sessionProxy), ...transientEnv }, paths, business: b.id, role: instance, bwrap });
     } catch (e) {
       spawnedAt.delete(run);
       unregisterRuntime(dataRoot, managed.id);

packages/cli/tests/launcher.test.mjs

@@ -82,6 +82,8 @@ function prepare(t, more = (doc) => doc) {
   const f = fixture(root, "acme", (doc) => more(edit(doc)));
   for (const k of SESSION_CREDENTIALS.flat()) delete f.env[k];
   f.env.CLAUDE_CODE_OAUTH_TOKEN = "stand-in";
+  if (f.doc.roles.chief.vars.harness === "pi" || f.doc.roles.chief.vars["fallback.harness"] === "pi")
+    f.env.ZAI_API_KEY = "fx332-pi";
   // The project root is a repository on main, so each launch can clone it.
   const project = f.doc.projects.stack.root;
   gitIn(project, "init", "-q", "-b", "main");
@@ -145,6 +147,29 @@ function ask(path, line) {
 
 const log = (f) => readFileSync(launchLogFile(f.dataRoot, "acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l));
 
+// Named mutant: proxy key serialized into session.json. Keep the real launcher,
+// harness env generation, session writer and runner; only the model adapter is fake.
+test('P3 proxy key reaches the spawned runner but never session.json or the bundle', { skip, timeout: 30000 }, async t => {
+  const proxy = { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' };
+  const prepared = prepare(t, doc => {
+    doc.launch.models['claude-opus-5-5'] = { provider: 'proxy', model: 'claude-fixture', route: 'anthropic' };
+    return doc;
+  });
+  const { launcher, f, close } = await setup(t, doc => doc, prepared, { proxy });
+  const launched = await launcher.launchPm();
+  const session = readSessions(f.dataRoot).find(s => s.run === launched.run);
+  assert.ok(session);
+  const environ = readFileSync(`/proc/${session.runnerPid}/environ`, 'utf8').split('\0');
+  assert.ok(environ.includes(`ANTHROPIC_API_KEY=${proxy.key}`));
+  assert.ok(!environ.some(value => value.startsWith('CLAUDE_CODE_OAUTH_TOKEN=')));
+  const stored = readFileSync(join(session.runDir, 'session.json'), 'utf8');
+  assert.ok(!stored.includes(proxy.key), 'session.json must never persist the proxy key');
+  const bundleFiles = readdirSync(join(session.runDir, 'bundle'), { recursive: true, withFileTypes: true })
+    .filter(entry => entry.isFile()).map(entry => join(entry.parentPath, entry.name));
+  for (const file of bundleFiles) assert.ok(!readFileSync(file, 'utf8').includes(proxy.key), file);
+  assert.equal(await close(), 0);
+});
+
 test("bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest", { skip, timeout: 30000 }, async (t) => {
   // Row 122: uncertain write receipts cannot prevent the window's first chief launch.
   const prepared = prepare(t);
@@ -672,14 +697,15 @@ test("a Claude Code launch with no session credential refuses before it starts",
   assert.deepEqual(readdirSync(join(f.dataRoot, "launches")), ["acme.jsonl"], "no run was made");
 });
 
-test("a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables", { skip, timeout: 30000 }, async (t) => {
+test("a pi launch with no own credential refuses no-session-credential", { skip, timeout: 30000 }, async (t) => {
   const given = prepare(t);
   delete given.f.env.CLAUDE_CODE_OAUTH_TOKEN;
+  delete given.f.env.ZAI_API_KEY;
   assert.deepEqual(SESSION_CREDENTIALS.flat().filter((k) => k in given.f.env), []);
   const { f, launcher } = await setup(t, undefined, given);
-  const chief = await launcher.launchPm();
-  assert.equal(chief.harness, "pi");
-  assert.deepEqual(log(f).map((e) => [e.event, e.instance]), [["launch", "chief"]]);
+  await assert.rejects(launcher.launchPm(), /PM launch refused: no-session-credential/);
+  assert.deepEqual(log(f).map((e) => [e.event, e.code]), [["refused", "no-session-credential"]]);
+  assert.deepEqual(readSessions(f.dataRoot), []);
 });
 
 // Row 65: a harness module no core file names, switched on in the organization file, runs a real
@@ -696,6 +722,7 @@ test("row 65 a failed primary preflight launches the fallback on a fixture harne
     write("harness", "down", `export * from ${pi};\nexport const preflight = () => ({ code: "fixture-down", message: "fixture preflight fails" });\n`);
     write("harness", "fixture", `export * from ${pi};\nexport const adapter = () => ${JSON.stringify(given.adapter)};\n`);
   });
+  given.f.env.ZAI_API_KEY = "fx332-pi";
   const { f, launcher } = await setup(t, undefined, given, { makeLoader });
   const chief = await launcher.launchPm();
   assert.deepEqual({ ...chief, run: undefined }, { run: undefined, instance: "chief", harness: "fixture", model: "claude-sonnet-5-5" });

packages/harness/src/bundle.mjs

@@ -83,7 +83,13 @@ export function sessionModel(resolved, models = null, which = "primary") {
   if (models === null) return { harness, provider: null, model, thinking };
   const entry = Object.hasOwn(models, model) ? models[model] : null;
   if (!entry) throw new BundleError(`instance ${resolved.instance}: unknown model table selection ${model}`);
-  return { harness, provider: entry.provider, model: entry.model, modelKey: model, thinking };
+  if (entry.provider === "proxy") {
+    const missing = !Object.hasOwn(entry, "route");
+    if (missing || !["anthropic", "glm", "codex"].includes(entry.route))
+      throw new BundleError("proxy model needs an explicit anthropic, glm or codex route", missing ? "proxy-route-missing" : "proxy-route-unknown");
+  }
+  return { harness, provider: entry.provider, model: entry.model, modelKey: model, thinking,
+    ...(entry.provider === "proxy" ? { proxyRoute: entry.route } : {}) };
 }
 
 // Row 91 (#1585): the project clones the host made or kept in the workspace.
@@ -309,10 +315,14 @@ function prompt({ contract, resolved, session, tools, untyped, builtins, persona
 //   personaDir   <configDir>/personas, where a creative instance's persona file is read from
 //                (row 213); an instance with persona.sha256 and no personaDir refuses
 // Returns { manifest, files, policy, tools, env } with absolute paths; env is the module's
-// adapter variables, which the host writes into session.json.
-export function buildBundle({ dir, resolved, contract, arbiter = false, tracker = false, library = false, credentials = [], session, harness, route = "primary", routeReason = null, harnessVersion = null, models = null, land = false, skillsDir = null, personaDir = null }) {
+// adapter variables. In proxy mode the host splits credentials into its
+// transient spawn environment before writing the remaining variables to session.json.
+export function buildBundle({ dir, resolved, contract, arbiter = false, tracker = false, library = false, credentials = [], session, harness, route = "primary", routeReason = null, harnessVersion = null, models = null, land = false, skillsDir = null, personaDir = null, proxy = null }) {
   if (route !== "primary" && route !== "fallback") throw new BundleError(`route ${JSON.stringify(route)} isn't primary or fallback`);
   const model = sessionModel(resolved, models, route);
+  if (model.provider === "proxy" && !proxy) throw new BundleError("proxy model needs its own session credential", "no-session-credential");
+  if (proxy && (typeof proxy.key !== "string" || !proxy.key || typeof proxy.baseUrl !== "string"
+    || !/^http:\/\/127\.0\.0\.1:[0-9]+$/.test(proxy.baseUrl))) throw new BundleError("invalid session proxy context");
   const web = webPlan(resolved, model.harness, harness.builtinWeb());
   const tools = typedTools({ resolved, arbiter, tracker, library, projects: (session.checkouts ?? []).map((c) => c.project), webTyped: !web.builtin, land });
   const untyped = untypedActions(resolved, tools);
@@ -346,7 +356,7 @@ export function buildBundle({ dir, resolved, contract, arbiter = false, tracker
     write("tools.json", JSON.stringify(tools, null, 2) + "\n"),
   ];
   // The module's own files. A name the bundle already wrote refuses at write (flag wx).
-  const own = harness.bundle({ dir, files: { ...files }, session, write, quote });
+  const own = harness.bundle({ dir, files: { ...files }, session: { ...session, ...model }, write, quote, models, proxy });
   Object.assign(files, own.files);
   digests.push(...own.digests);
   const sources = { gate: SOURCES.gate, tools: SOURCES.tools, ...own.sources };
@@ -373,6 +383,6 @@ export function buildBundle({ dir, resolved, contract, arbiter = false, tracker
     sources: Object.fromEntries(Object.entries(sources).map(([k, p]) => [k, { path: p, sha256: sha256(readFileSync(p)) }])),
   };
   writeFileSync(files.manifest, JSON.stringify(manifest, null, 2) + "\n", { mode: 0o600, flag: "wx" });
-  const env = harness.env({ files, policy, tools, session: { ...session, ...model } });
+  const env = harness.env({ files, policy, tools, session: { ...session, ...model }, models, proxy });
   return { manifest, files, policy, tools, env };
 }

packages/harness/tests/proxy-bundle.test.mjs

@@ -0,0 +1,113 @@
+// P3: generate real harness config through buildBundle; credentials never enter disk artifacts.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildBundle } from '../src/bundle.mjs';
+import { HARNESS, REPO_SKILLS, resolvedFor, scratch } from './helpers.mjs';
+
+const models = {
+  a: { provider: 'proxy', model: 'claude-fixture', route: 'anthropic' },
+  z: { provider: 'proxy', model: 'glm-fixture', route: 'glm' },
+  g: { provider: 'proxy', model: 'gpt-fixture', route: 'codex' },
+};
+function build(t, selection, proxy, declared) {
+  const root = scratch(t, 'p332-'), runDir = join(root, 'run');
+  mkdirSync(runDir, { mode: 0o700 });
+  const valid = resolvedFor(t, 'pm');
+  assert.ok(Object.hasOwn(declared, selection), 'fixture selection must exist in declared launch.models');
+  const resolved = { ...valid, vars: { ...valid.vars, harness: 'pi', model: selection } };
+  const bundle = buildBundle({
+    dir: join(runDir, 'bundle'), resolved, models: declared,
+    contract: '# Fixture\n', harness: HARNESS.pi, harnessVersion: 'fixture',
+    skillsDir: REPO_SKILLS, proxy,
+    session: { run: 'r332', launchedBy: 'chief', workspace: join(root, 'ws'),
+      toolSocket: join(runDir, 'tools.sock'), turnMarker: join(runDir, 'turn.done') },
+  });
+  const file = join(runDir, 'home', '.pi', 'agent', 'models.json');
+  return { ...bundle, file, runDir, text: readFileSync(file, 'utf8') };
+}
+function assertSafe(value) {
+  if (typeof value === 'string') assert.ok(!value.startsWith('!'), value);
+  else if (value && typeof value === 'object') for (const item of Object.values(value)) assertSafe(item);
+}
+
+test('P3 Anthropic route uses messages at proxy root and the declared model id', t => {
+  const b = build(t, 'a', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' }, { a: models.a });
+  const { anthropic } = JSON.parse(b.text).providers;
+  assert.equal(anthropic.api, 'anthropic-messages');
+  assert.equal(anthropic.baseUrl, 'http://127.0.0.1:12345');
+  assert.deepEqual(anthropic.models.map(m => m.id), ['claude-fixture']);
+  assert.equal(b.env.PI_PROVIDER, 'anthropic');
+  assert.equal(b.env.PI_MODEL, 'claude-fixture');
+});
+
+test('P3 omitted route refuses proxy-route-missing before model config generation', t => {
+  assert.throws(() => build(t, 'a', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' }, {
+    a: { provider: 'proxy', model: 'claude-fixture' },
+  }), { code: 'proxy-route-missing' });
+});
+
+test('P3 GLM route uses completions at proxy /v1 with explicit z.ai compatibility', t => {
+  const b = build(t, 'z', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' }, { z: models.z });
+  const glm = JSON.parse(b.text).providers['mosaic-proxy-glm'];
+  assert.equal(glm.api, 'openai-completions');
+  assert.equal(glm.baseUrl, 'http://127.0.0.1:12345/v1');
+  assert.deepEqual(glm.models.map(m => m.id), ['glm-fixture']);
+  assert.equal(glm.compat.thinkingFormat, 'zai');
+  assert.equal(glm.compat.zaiToolStream, true);
+  assert.equal(b.env.PI_PROVIDER, 'mosaic-proxy-glm');
+});
+
+test('P3 GPT route selects a stack-owned provider instead of pi Codex OAuth', t => {
+  const b = build(t, 'g', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' }, { g: models.g });
+  const providers = JSON.parse(b.text).providers;
+  assert.equal(Object.hasOwn(providers, 'openai-codex'), false);
+  const gpt = providers['mosaic-proxy-codex'];
+  assert.equal(gpt.api, 'openai-responses');
+  assert.equal(gpt.baseUrl, 'http://127.0.0.1:12345/v1');
+  assert.deepEqual(gpt.models.map(m => m.id), ['gpt-fixture']);
+  assert.equal(b.env.PI_PROVIDER, 'mosaic-proxy-codex');
+});
+
+test('P3 a declared Codex route generates only the single build-time responses provider', t => {
+  const b = build(t, 'g', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' }, {
+    g: models.g,
+  });
+  const providers = JSON.parse(b.text).providers;
+  assert.deepEqual(Object.keys(providers), ['mosaic-proxy-codex']);
+  assert.equal(providers['mosaic-proxy-codex'].api, 'openai-responses');
+  assert.equal(providers['mosaic-proxy-codex'].apiKey, '$ANTHROPIC_API_KEY');
+});
+
+test('P3 models file is private, references the one session key, and stores no executable values or keys', t => {
+  const key = 'fx332-agent-a';
+  const b = build(t, 'a', { baseUrl: 'http://127.0.0.1:12345', key }, { a: models.a, z: models.z });
+  const document = JSON.parse(b.text);
+  assert.deepEqual(Object.keys(document.providers).sort(), ['anthropic', 'mosaic-proxy-glm']);
+  for (const provider of Object.values(document.providers)) assert.equal(provider.apiKey, '$ANTHROPIC_API_KEY');
+  assertSafe(document);
+  assert.ok(!b.text.includes(key));
+  assert.equal(b.env.ANTHROPIC_API_KEY, key);
+  assert.equal(statSync(b.file).mode & 0o777, 0o600);
+  for (const dir of ['home', 'home/.pi', 'home/.pi/agent']) assert.equal(statSync(join(b.runDir, dir)).mode & 0o777, 0o700);
+  for (const file of Object.values(b.files)) assert.ok(!readFileSync(file, 'utf8').includes(key), file);
+  assert.ok(!JSON.stringify(b.manifest).includes(key));
+});
+
+test('P3 every launch regenerates proxy port, declared models and own key without caching', t => {
+  const first = build(t, 'a', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' }, { a: models.a, z: models.z });
+  const second = build(t, 'a', { baseUrl: 'http://127.0.0.1:23456', key: 'fx332-agent-b' }, {
+    a: { provider: 'proxy', model: 'changed-model-id', route: 'anthropic' },
+    z: { provider: 'proxy', model: 'changed-glm-id', route: 'glm' },
+  });
+  assert.equal(second.env.ANTHROPIC_API_KEY, 'fx332-agent-b');
+  assert.ok(!JSON.stringify(second).includes('fx332-agent-a'));
+  const { providers } = JSON.parse(second.text);
+  assert.deepEqual(Object.keys(providers), ['anthropic', 'mosaic-proxy-glm']);
+  assert.equal(providers.anthropic.baseUrl, 'http://127.0.0.1:23456');
+  assert.deepEqual(providers.anthropic.models.map(m => m.id), ['changed-model-id']);
+  assert.equal(providers['mosaic-proxy-glm'].baseUrl, 'http://127.0.0.1:23456/v1');
+  assert.deepEqual(providers['mosaic-proxy-glm'].models.map(m => m.id), ['changed-glm-id']);
+  assert.equal(JSON.parse(first.text).providers.anthropic.baseUrl, 'http://127.0.0.1:12345');
+});

packages/plugins/README.md

@@ -327,3 +327,32 @@ organization file or unavailable bus.
 For the re-pin introducing this kind, Jason enables both channels through
 plugins.set immediately after activate in Mos's window, then smokes CLI thread
 listing and Console chat. No development seat performs that live step.
+
+## Per-session proxy context (P3)
+
+The launcher's injected `proxy` is either a `{ baseUrl, key }` context supplied by
+P2, or a factory receiving `{ business, instance }` and returning that context.
+Checks may repeat before spawn; the factory must return that agent's current
+credential. P3 does not acquire, issue or revoke keys. No context means existing
+nonproxy launch behavior; a selected proxy model without context refuses.
+
+The harness `preflight`, `bundle` and `env` calls receive an optional `proxy`
+argument; `bundle` and `env` also receive the declared model table. In proxy
+mode the launcher removes instance provider variables, then separates the
+harness's credential variables from `harnessEnv` before writing `session.json`.
+Only the spawned runner's environment receives those variables.
+
+A proxy `launch.models` entry requires `route: anthropic|glm|codex`. Omission
+refuses `proxy-route-missing`; unknown routes refuse `proxy-route-unknown`. Other providers
+retain provider/model-only entries. `launch.account.credential: proxy` names the
+proxy credential source. Pi needs its own provider key or a supplied proxy key;
+Claude OAuth alone cannot satisfy pi preflight.
+
+Pi writes private, fresh run-local `home/.pi/agent/models.json`, with
+`$ANTHROPIC_API_KEY` references. Anthropic uses messages at the proxy root; GLM
+uses completions at `/v1` with z.ai compatibility fields. GPT uses the stack-owned
+`mosaic-proxy-codex` provider, never pi's Codex OAuth provider. Its build-time API
+value is `openai-responses` per Sage's sage-4331 ruling: both shapes passed the
+pinned offline probe, so this is a reasoning-based tie-break rather than an
+evidence-decided pick. Row209 phase A step7 verifies the first real Codex turn.
+There is no runtime API selection or fallback.

packages/plugins/harness/claude-code/index.mjs

@@ -53,8 +53,8 @@ function binary(env) {
 }
 
 // A session needs a credential from the host's environment and the binary it runs.
-export function preflight({ env }) {
-  if (!hasSessionCredential(env)) {
+export function preflight({ env, proxy = null }) {
+  if (!(typeof proxy?.key === "string" && proxy.key) && !hasSessionCredential(env)) {
     const names = SESSION_CREDENTIALS.map((set) => set.join(" with ")).join(", ");
     return { code: "no-session-credential", message: `the bus host has none of ${names}; the bus unit's EnvironmentFile sets one when the bus starts` };
   }
@@ -116,12 +116,13 @@ export function bundle({ dir, files: core, session, write, quote }) {
   return { files, digests, sources: { claudeGate: GATE, mcpServer: MCP_SERVER, ...UNSLOP } };
 }
 
-export function env({ files, policy, session }) {
+export function env({ files, policy, session, proxy = null }) {
   return {
     MOSAIC_TOOLS: claudeBuiltins(policy).join(","),
     MOSAIC_CLAUDE_SETTINGS: files.settings,
     MOSAIC_CLAUDE_MCP_CONFIG: files.mcp,
     MOSAIC_THINKING: session.thinking,
+    ...(proxy ? { ANTHROPIC_BASE_URL: proxy.baseUrl, ANTHROPIC_AUTH_TOKEN: proxy.key } : {}),
   };
 }
 

packages/plugins/harness/pi/index.mjs

@@ -3,8 +3,9 @@
 // Pi extension, which stays in packages/harness (a module can't change that boundary). The
 // launcher, the bundle and the usage reader call these on the host; the runner gets the answers
 // as data in session.json. packages/plugins/README.md lists the interface.
-import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
 
 export const interfaceVersion = 1;
@@ -12,6 +13,10 @@ export const interfaceVersion = 1;
 const REPO = fileURLToPath(new URL("../../../../", import.meta.url));
 const PACKAGE = "@earendil-works/pi-coding-agent";
 const BIN = join(REPO, "node_modules", ".bin", "pi");
+// Sage sage-4331: reasoning-based tie-break; both pinned-proxy shapes passed.
+// First real Codex verification remains row209 phase A step7. No runtime switch.
+const PROXY_CODEX_API = "openai-responses";
+const PROXY_PROVIDERS = Object.freeze({ anthropic: "anthropic", glm: "mosaic-proxy-glm", codex: "mosaic-proxy-codex" });
 const EXTENSION = fileURLToPath(new URL("../../../harness/src/pi-extension.mjs", import.meta.url));
 // Row 66 (#1559): the unslop check, loaded as a second extension. It logs to MOSAIC_UNSLOP_LOG,
 // which the runner sets, and the runner tells the operator.
@@ -30,7 +35,11 @@ export const adapter = () => join(REPO, "adapters", "pi", "adapter.sh");
 export const levels = () => LEVELS;
 
 // The session runs pi from the repository's node_modules, which the sandbox mounts.
-export function preflight() {
+export function preflight({ env = {}, proxy = null } = {}) {
+  if (!(typeof proxy?.key === "string" && proxy.key)
+    && !["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "OPENROUTER_API_KEY", "ZAI_API_KEY"].some(name => Boolean(env[name]))) {
+    return { code: "no-session-credential", message: "pi needs its own provider key or a session proxy key" };
+  }
   if (!existsSync(BIN)) return { code: "harness-binary-missing", message: `pi isn't installed at ${BIN}; run npm ci in the repository` };
   return null;
 }
@@ -57,16 +66,52 @@ export const builtins = ({ tools }) => [...tools];
 export const typedName = (name) => name;
 export const reliesOn = () => RELIES_ON;
 export const gateTimeout = () => null;
-export const bundle = () => ({ files: {}, digests: [], sources: { piExtension: EXTENSION, ...UNSLOP } });
+export function bundle({ dir, models, proxy = null }) {
+  const sources = { piExtension: EXTENSION, ...UNSLOP };
+  if (!proxy) return { files: {}, digests: [], sources };
+  const providers = {};
+  for (const entry of Object.values(models ?? {})) {
+    if (entry.provider !== "proxy") continue;
+    const route = entry.route;
+    if (!Object.hasOwn(PROXY_PROVIDERS, route)) throw new Error("proxy model has no supported route");
+    const provider = PROXY_PROVIDERS[route];
+    if (typeof entry.model !== "string" || !entry.model || entry.model.startsWith("!")) throw new Error("unsafe proxy model id");
+    const api = route === "anthropic" ? "anthropic-messages"
+      : route === "glm" ? "openai-completions" : PROXY_CODEX_API;
+    providers[provider] ??= {
+      baseUrl: proxy.baseUrl + (route === "anthropic" ? "" : "/v1"),
+      api, apiKey: "$ANTHROPIC_API_KEY",
+      ...(route === "glm" ? { compat: { thinkingFormat: "zai", zaiToolStream: true } } : {}),
+      models: [],
+    };
+    if (!providers[provider].models.some(model => model.id === entry.model)) {
+      providers[provider].models.push({ id: entry.model, reasoning: true });
+    }
+  }
+  const text = JSON.stringify({ providers }, null, 2) + "\n";
+  // Even an accidental collision between a configured model id and the key fails closed.
+  if (typeof proxy.key !== "string" || !proxy.key || text.includes(proxy.key)) throw new Error("unsafe proxy model configuration");
+  const runDir = dirname(dir);
+  for (const part of ["home", "home/.pi", "home/.pi/agent"]) {
+    const path = join(runDir, part);
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || (stat.mode & 0o777) !== 0o700) throw new Error("pi proxy config needs private run-local directories");
+  }
+  const file = join(runDir, "home", ".pi", "agent", "models.json");
+  writeFileSync(file, text, { mode: 0o600, flag: "wx" });
+  return { files: { proxyModels: file }, digests: [["../home/.pi/agent/models.json", createHash("sha256").update(text).digest("hex")]], sources };
+}
 
 // The tool limit is the built-ins plus the typed tools, which the extension serves.
-export function env({ policy, tools, session }) {
+export function env({ policy, tools, session, proxy = null }) {
   return {
     MOSAIC_TOOLS: [...policy.tools, ...tools.map((t) => t.name)].join(","),
     MOSAIC_EXTENSIONS: [EXTENSION, UNSLOP.unslopExtension].join(","),
-    PI_PROVIDER: session.provider ?? "",
+    PI_PROVIDER: proxy ? PROXY_PROVIDERS[session.proxyRoute] : session.provider ?? "",
     PI_MODEL: session.model,
     MOSAIC_THINKING: session.thinking,
+    ...(proxy ? { ANTHROPIC_API_KEY: proxy.key } : {}),
   };
 }
 

packages/plugins/tests/harness.test.mjs

@@ -97,9 +97,9 @@ test("row 65 claude-code version asks MOSAIC_CLAUDE_BIN when set, else claude on
   assert.equal(claude.version({ env: { PATH: join(dir, "none") } }), null);
 });
 
-test("row 65 pi preflight passes with the repository's pi, and its version is the package pin", async () => {
+test("row 65 pi preflight refuses missing credentials, and its version is the package pin", async () => {
   const pi = await load("pi");
-  assert.equal(pi.preflight({ env: {} }), null);
+  assert.equal(pi.preflight({ env: {} }).code, "no-session-credential");
   const pkg = JSON.parse(readFileSync(join(REPO, "package.json"), "utf8"));
   assert.equal(pi.version({ env: {} }), pkg.dependencies?.["@earendil-works/pi-coding-agent"] ?? pkg.devDependencies?.["@earendil-works/pi-coding-agent"]);
   // Row 66: the unslop extension's files, bound read-only at their own paths.

packages/plugins/tests/proxy-harness.test.mjs

@@ -0,0 +1,65 @@
+// P3: run real harness exports through the plug-in loader, with made-up session keys only.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createLoader } from '../src/loader.mjs';
+import { sessionEnv } from '../../seat/src/session.mjs';
+
+async function harness(name) {
+  const loader = createLoader({ log() {} });
+  const result = await loader.load({ harness: [name] });
+  assert.deepEqual(result.refused, []);
+  return loader.modules('harness')[0];
+}
+function scratch(t) {
+  const root = mkdtempSync(join(tmpdir(), 'p332-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  return root;
+}
+const policy = { tools: [], typed: [] };
+const session = { model: 'claude-fixture', thinking: 'low' };
+
+test('P3 Claude env receives the session proxy URL and key, without another agent or host credential', async () => {
+  const claude = await harness('claude-code');
+  const host = { CLAUDE_CODE_OAUTH_TOKEN: 'fx332-host', OPENAI_API_KEY: 'fx332-upstream' };
+  for (const [run, key] of [['r332a', 'fx332-agent-a'], ['r332b', 'fx332-agent-b']]) {
+    const proxy = { baseUrl: 'http://127.0.0.1:12345', key };
+    const env = { ...sessionEnv(host, run, proxy), ...claude.env({ files: {}, policy, session, proxy }) };
+    assert.equal(env.ANTHROPIC_BASE_URL, 'http://127.0.0.1:12345');
+    assert.equal(env.ANTHROPIC_AUTH_TOKEN, key);
+    assert.equal(Object.hasOwn(env, 'CLAUDE_CODE_OAUTH_TOKEN'), false);
+    assert.equal(Object.hasOwn(env, 'OPENAI_API_KEY'), false);
+    const other = run === 'r332a' ? 'fx332-agent-b' : 'fx332-agent-a';
+    assert.ok(!Object.values(env).includes(other));
+  }
+});
+
+test('P3 Claude preflight accepts a proxy key without a host provider credential', async t => {
+  const claude = await harness('claude-code');
+  const root = scratch(t), binary = join(root, 'claude');
+  writeFileSync(binary, '#!/bin/sh\nexit 0\n');
+  chmodSync(binary, 0o700);
+  assert.equal(claude.preflight({ env: { MOSAIC_CLAUDE_BIN: binary }, proxy: {
+    baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a',
+  } }), null);
+});
+
+test('P3 pi refuses no-session-credential with no provider key', async () => {
+  const pi = await harness('pi');
+  assert.equal(pi.preflight({ env: {} })?.code, 'no-session-credential');
+});
+
+test('P3 pi refuses no-session-credential with only a Claude OAuth token', async () => {
+  const pi = await harness('pi');
+  assert.equal(pi.preflight({ env: { CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth' } })?.code, 'no-session-credential');
+});
+
+test('P3 pi accepts its own provider key or a session proxy key', async () => {
+  const pi = await harness('pi');
+  for (const name of ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY', 'ZAI_API_KEY']) {
+    assert.equal(pi.preflight({ env: { [name]: 'fx332-own' } }), null, name);
+  }
+  assert.equal(pi.preflight({ env: {}, proxy: { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' } }), null);
+});

packages/seat/src/session.mjs

@@ -253,9 +253,13 @@ export const ENV_ALLOW = Object.freeze([
 export const SESSION_CREDENTIALS = Object.freeze([["CLAUDE_CODE_OAUTH_TOKEN"], ["ANTHROPIC_API_KEY"], ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"]].map((set) => Object.freeze(set)));
 export const hasSessionCredential = (env) => SESSION_CREDENTIALS.some((set) => set.every((k) => Boolean(env[k])));
 
-export function sessionEnv(env, run) {
+// Used again at the serialization boundary: provider credentials are transient.
+export const isProviderVariable = (name) => name.startsWith("ANTHROPIC_")
+  || ["CLAUDE_CODE_OAUTH_TOKEN", "OPENAI_API_KEY", "OPENROUTER_API_KEY", "ZAI_API_KEY"].includes(name);
+
+export function sessionEnv(env, run, proxy = null) {
   const out = {};
-  for (const k of ENV_ALLOW) if (env[k] !== undefined) out[k] = env[k];
+  for (const k of ENV_ALLOW) if (env[k] !== undefined && !(proxy && isProviderVariable(k))) out[k] = env[k];
   out.PATH = [join(REPO, "node_modules", ".bin"), env.PATH ?? "/usr/bin:/bin"].join(":");
   out.MOSAIC_RUN_ID = run;
   return out;

packages/seat/tests/proxy-session-env.test.mjs

@@ -0,0 +1,37 @@
+// P3: catches the named OAuth-leak mutant and reuse of another session's key.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ENV_ALLOW, sessionEnv } from '../src/session.mjs';
+
+const instance = {
+  HOME: '/fixture-home', USER: 'fixture', PATH: '/usr/bin', LANG: 'C',
+  CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth', ANTHROPIC_API_KEY: 'fx332-anthropic',
+  ANTHROPIC_AUTH_TOKEN: 'fx332-auth', ANTHROPIC_BASE_URL: 'http://upstream.invalid',
+  OPENAI_API_KEY: 'fx332-openai', OPENROUTER_API_KEY: 'fx332-router', ZAI_API_KEY: 'fx332-zai',
+  MOSAIC_CLAUDE_BIN: '/fixture/claude', GITEA_TOKEN: 'fx332-gitea',
+};
+const forbidden = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN',
+  'ANTHROPIC_BASE_URL', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY', 'ZAI_API_KEY'];
+
+test('P3 proxy sessionEnv removes every instance provider credential without widening ENV_ALLOW', () => {
+  const original = [...ENV_ALLOW];
+  const env = sessionEnv(instance, 'r332a', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' });
+  for (const name of forbidden) assert.equal(Object.hasOwn(env, name), false, name);
+  assert.equal(env.USER, 'fixture');
+  assert.equal(env.MOSAIC_CLAUDE_BIN, '/fixture/claude');
+  assert.equal(Object.hasOwn(env, 'GITEA_TOKEN'), false);
+  assert.equal(env.MOSAIC_RUN_ID, 'r332a');
+  assert.deepEqual([...ENV_ALLOW], original);
+});
+
+test('P3 no proxy retains the full existing allowlist and run environment', () => {
+  const env = sessionEnv(instance, 'r332b');
+  assert.deepEqual(env, {
+    HOME: '/fixture-home', USER: 'fixture', LANG: 'C',
+    CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth', ANTHROPIC_API_KEY: 'fx332-anthropic',
+    ANTHROPIC_AUTH_TOKEN: 'fx332-auth', ANTHROPIC_BASE_URL: 'http://upstream.invalid',
+    OPENAI_API_KEY: 'fx332-openai', OPENROUTER_API_KEY: 'fx332-router', ZAI_API_KEY: 'fx332-zai',
+    MOSAIC_CLAUDE_BIN: '/fixture/claude', PATH: env.PATH, MOSAIC_RUN_ID: 'r332b',
+  });
+  assert.ok(env.PATH.endsWith('node_modules/.bin:/usr/bin'));
+});