fix(auth): require an explicit streams session URL

.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/cli-quality-deno.json

@@ -0,0 +1,15 @@
+{
+  "workspace": [],
+  "fmt": {
+    "lineWidth": 100,
+    "indentWidth": 2,
+    "semiColons": true,
+    "singleQuote": true
+  },
+  "lint": {
+    "rules": {
+      "tags": ["recommended", "jsr"],
+      "include": ["no-process-global", "no-node-globals"]
+    }
+  }
+}

.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/codex-thread-ids.md

@@ -0,0 +1,16 @@
+# release-0.0.7-legacy-port-pin-sweep — Codex implementation thread
+- **Thread / session id:** `019ffcca-8bdc-7fb3-98c5-df90e2ae3b1f`
+- **Rollout:** `/home/codex/.codex/sessions/2026/08/13/rollout-2026-08-13T22-22-40-019ffcca-8bdc-7fb3-98c5-df90e2ae3b1f.jsonl`
+- **Worktree:** `/home/codex/repos/netscript-007-leaf-legacy-port-pin-sweep`
+- **Branch:** `fix/legacy-port-pin-sweep` @ `01e096049` (NO upstream by design).
+- **Push rule:** explicit refspec only — `git push origin HEAD:refs/heads/fix/legacy-port-pin-sweep`.
+- **Requested route:** provider=openai · model=gpt-5.6-sol · effort=low
+- **Observed route:** provider=openai · model=gpt-5.6-sol · effort=low
+- **Route verdict:** matched
+- **Runtime:** approval=never · sandbox=dangerFullAccess
+- **Brief (staged):** `/home/codex/release-0.0.7-legacy-port-pin-sweep-brief.md`
+## Steering (same thread — never a second send-message-v2 at this worktree)
+```bash
+codex exec resume 019ffcca-8bdc-7fb3-98c5-df90e2ae3b1f -- "<follow-up>"
+```
+_Written by `.llm/tools/agentic/codex/launch-codex-slice.ts`._

.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/context-pack.md

@@ -0,0 +1,42 @@
+# Context pack — legacy-port-pin-sweep
+
+- Direct-to-`main` Wave 0 fixes leaf for #1243.
+- Immutable base: `01e0960494c95ce56eb35892c211a095eb13e6ed`.
+- Topic orchestrator: `/home/codex/repos/netscript-007-fixes`, run
+  `.llm/runs/release-0.0.7-fixes--orchestration/`.
+- Approved coordinator artifacts:
+  `/home/codex/repos/netscript-547-lffix/.llm/runs/release-0.0.7--orchestration/`.
+- No upstream; explicit push refspec only; draft PR against `main`; no merge or publication.
+- Live issue fetched `2026-08-13T20:23:46.556Z`; current issue is open and has no acceptance
+  checkboxes. Its milestone comment conflicts with the cluster's 0.0.7 assignment; leaf will not
+  mutate central issue state.
+- Reproduced the auth default defect and the filed streams manifest/copy occurrences. Validation
+  subsequently classified the latter as required compatibility metadata; the generated skill
+  occurrence is historical diagnostic prose, not a pin.
+- #1206's real endpoint-discovery seam lives in `@netscript/mcp`; wiring it crosses the frozen leaf
+  surface. Locked remedy: explicit required `--stream-url` with Aspire discovery guidance.
+- Draft PR #1643 opened from bootstrap commit `e49948bbf`, labeled `status:plan` with milestone
+  `0.0.7`.
+- First focused structured test falsified the issue's manifest-removal assumption: the shared schema
+  requires `backgroundPort` and atomically couples `servicePort` to the service shape; copy mode
+  still consumes them. Invalid manifest/fixture edits were restored.
+- The release coordinator's authorization was verified from live issue #1243 and PR #1643 at
+  `2026-08-13T20:35:47.522Z` (issue comment `5286074974`; PR comment `5286075209`). The sole added
+  product surface is
+  `packages/cli/src/public/features/plugins/auth/auth-plugin-command_test.ts`.
+- The manifest and official-copy `4437` values are required compatibility metadata and remain
+  unchanged. No schema/copy redesign is authorized.
+- Resume scope is the explicit-URL/fail-loud command behavior, focused tests, and structured
+  non-expensive gate receipts. PR #1643 remains draft and moves from `status:plan` to `status:impl`
+  only after real implementation evidence is committed and pushed.
+- Implementation commit `3d32e9ee2ee37dc9cebfe645f93e3a4ea479c215` is followed by an isolated
+  formatting commit `a212245867b77ab8d40e7330b2b7cb7409781a90`; the semantic slice therefore
+  remains directly reviewable. The committed CLI reporter config is
+  `6242edabc3679173c841e2e167f7f5786819e720`.
+- All allowed gates attest `6242edabc3679173c841e2e167f7f5786819e720`: focused check/test, root
+  lint/fmt plus changed-file CLI reports, `quality:gate`, `arch:check`, CLI doc lint, package-only
+  publish dry-run, and the CLI JSR audit are green. Receipts live under `receipts/`.
+- The only remaining work is topic-orchestrator Tier-A review and a fresh opposite-family
+  IMPL-EVAL. This implementation session must not self-certify or mark the draft ready.
+- `scaffold.runtime`, Aspire, Docker, merge, publication, and issue/milestone mutation remain
+  forbidden. This run owns no runtime resources and needs no cleanup.

.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/drift.md

@@ -0,0 +1,44 @@
+# Drift — legacy-port-pin-sweep
+
+## 2026-08-13 — significant — filed manifest-removal assumption is stale
+
+- The first focused structured test proved that deleting `servicePort` and `backgroundPort` from
+  `plugins/streams/scaffold.plugin.json` is not mechanical on current main.
+- `packages/plugin/src/protocol/manifest.ts` currently requires `officialSource.backgroundPort` and
+  validates `serviceEntrypoint`, `serviceConfigKey`, and `servicePort` as an atomic all-present or
+  all-omitted service shape. The shipped manifest becomes invalid when the two numbers are removed.
+- The maintainer official-copy adapter also still projects `backgroundPort`, and it treats the
+  service triple as the discriminator for an official service source. Therefore the issue's claim
+  that the installer ignores both values is true only of the newer plugin-owned install allocator,
+  not of the shared manifest/copy compatibility surface.
+- The invalid manifest/fixture deletion was restored immediately. Fixing the schema and copy
+  compatibility contract requires undeclared files and is a genuine rescope owned by the topic
+  orchestrator/coordinator.
+
+## 2026-08-13 — significant — explicit-URL contract needs undeclared tests
+
+- The proposed auth command correctly rejects an omitted `--stream-url` with actionable Aspire
+  discovery guidance.
+- The focused structured reporter found two current tests that deliberately call `session list`
+  without the option. Updating them (and adding the required error-path assertion) requires
+  `auth-plugin-command_test.ts`, which is outside the frozen four-file surface.
+- No test was edited and no broken source slice was committed. The proposed auth source diff remains
+  in the working tree for orchestrator inspection.
+
+## PLAN-EVAL correction
+
+The pre-edit `PLAN-EVAL: N/A` was justified from the issue and discovery boundary, but the first
+contract test falsified the filed assumption that manifest cleanup was mechanical. Any expanded
+schema/copy remedy now contains a material compatibility decision and requires a revised plan plus
+separate PLAN-EVAL. If the orchestrator instead narrows the leaf to the explicit-URL behavior and
+authorizes only the focused test surface, PLAN-EVAL can remain N/A because that remedy is mechanical.
+
+## 2026-08-13 — resolved — coordinator narrows compatibility remedy
+
+- Live coordinator comments on issue #1243 (`5286074974`) and PR #1643 (`5286075209`) authorize only
+  `packages/cli/src/public/features/plugins/auth/auth-plugin-command_test.ts` beyond the original
+  contract.
+- The manifest and official-copy `4437` fields are required compatibility metadata and must remain
+  unchanged; no schema/copy redesign is in scope.
+- The explicit `--stream-url` behavior plus focused tests is again locked and mechanical. The prior
+  `PLAN-EVAL: N/A` remains valid, and implementation resumes within this corrected boundary.

.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/evaluate-prompt.md

@@ -0,0 +1,64 @@
+use harness
+
+## SKILL
+
+Read and follow `AGENTS.md` plus these skills completely before evaluating:
+
+- `.agents/skills/netscript-harness/SKILL.md`
+- `.agents/skills/netscript-tools/SKILL.md`
+- `.agents/skills/netscript-pr/SKILL.md`
+- `.agents/skills/netscript-cli/SKILL.md`
+- `.agents/skills/netscript-doctrine/SKILL.md`
+- `.agents/skills/netscript-deno-toolchain/SKILL.md`
+- `.agents/skills/jsr-audit/SKILL.md`
+- `.agents/skills/aspire/SKILL.md`
+- `.agents/skills/rtk/SKILL.md`
+
+# Formal IMPL-EVAL — legacy-port-pin-sweep / PR #1643
+
+Act as the fresh separate formal IMPL-EVAL session for Codex-authored PR #1643. Do not run this
+brief before the owner-approved Claude allowance reset at 2026-08-15 00:00 Europe/Zurich. After
+that reset, use the canonical fresh native opposite-family Claude/Fable 5 medium route. The owner
+explicitly rejected Claude/OpenRouter, DeepSeek, Minimax, AGY, and other substitute formal
+evaluators during the hold. You are the sole fixes topic evaluator. Do not delegate or launch
+another evaluator.
+
+Subject facts:
+
+- immutable base: `01e0960494c95ce56eb35892c211a095eb13e6ed`;
+- current review/sign-off head before this prompt: `af3dca0f5`;
+- semantic implementation: `3d32e9ee2ee37dc9cebfe645f93e3a4ea479c215`;
+- receipt subject: `6242edabc3679173c841e2e167f7f5786819e720`;
+- evidence commit: `98d5d9654d00ca3e737d68cb2a68c2e0223f4c1e`;
+- hygiene correction: `786c5e78513706889c48e53664ba1bea9b9a51ae`;
+- Tier-A review: `.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/review-tier-a.md`;
+- live issue: #1243; draft PR: #1643 direct to `main`.
+
+Evaluate independently:
+
+1. Read the live issue, coordinator scope-amendment comments, PR body/comments, full product diff,
+   Tier-A review, plan/drift/worklog, and every relevant receipt/report.
+2. Confirm the implementation removes the auth command's silent localhost:4437 default, requires
+   explicit `--stream-url`, fails before calling the session adapter when omitted, and provides
+   actionable Aspire endpoint discovery guidance.
+3. Confirm the coordinator-classified manifest/copy port fields remain unchanged compatibility
+   metadata and no undeclared schema/copy redesign entered the branch.
+4. Verify receipt claims, claimed/actual Git heads, lock hygiene, JSR/publish evidence, and review
+   isolation. Run only the smallest independent non-expensive checks needed to substantiate the
+   verdict. Do not run `scaffold.runtime`, Aspire, Docker, or publish.
+5. Treat the broad formatting delta as reviewable only if it remains mechanically isolated from the
+   semantic commit. Inspect for hidden behavioral drift rather than trusting the implementer.
+
+Output contract:
+
+- Write `.llm/runs/fix-legacy-port-pin-sweep--0.0.7-wave0/evaluate.md` with requested and observed
+  route/session identity, evidence reviewed, findings with severity, and exactly one formal verdict:
+  `IMPL-EVAL: PASS`, `IMPL-EVAL: FAIL_FIX`, `IMPL-EVAL: FAIL_RESCOPE`, or `IMPL-EVAL: ERROR`.
+- Do not edit product code. The only permitted file edit is `evaluate.md`.
+- Commit only `evaluate.md`, push with explicit refspec
+  `git push origin HEAD:refs/heads/fix/legacy-port-pin-sweep`, and leave the worktree clean with no
+  upstream.
+- Post one structured PR comment headed `**[PHASE: IMPL-EVAL] [VERDICT: <verdict>]**`, including the
+  evaluated source/receipt heads and evaluator commit SHA.
+- Keep PR #1643 draft at `status:impl`. Do not mark ready, add a closing keyword, merge, publish,
+  mutate issue/milestone state, request an expensive-gate lease, or touch central cluster state.