alfredolopez80 · Sep 30, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 25, 2026 · Sep 25, 2026
@@ -56,6 +56,18 @@ Before running anything, verify ALL of these:
       `pre-gate-sync` can restart every deployment; T2 then renews the hold
       once, before Health/Playwright, and records `PortForwards=` evidence.
       Without it an in-run sync leaves the hold on terminated pods.
+- [ ] When the same owned profile is reused after a HEAD change, the
+      orchestrator runs `pre-gate-sync` for a targeted change and refreshes
+      forwards after any restarted services. For `targeted-sync`, also supply
+      a bounded `T2_HEALTHCHECK_COMMAND` that exercises the affected
+      user-facing path.
+- [ ] Before a login-based health journey patches HCC or creates fault
+      fixtures, resolve its seeded test credential in-process. Source
+      `scripts/e2e/load-dotenv.sh` and `scripts/e2e/admin-credentials.sh`;
+      use `dotenv_load_canonical_root` and `e2e_resolve_admin_password`.
+      An explicit `E2E_USER_PASSWORD` may override the journey credential.
+      Never inspect, print, log, or persist `.env` contents, even for a
+      key-presence check. Fail before cluster mutation if resolution fails.
 
 Shell contract-test rule: fixtures that exercise Git/lease state must use a
 temporary repository via `scripts/tests/lib/minikube-fixture-repo.sh`. Keep the
@@ -113,6 +125,12 @@ Rules that override any shortcut idea:
 - Never set `T2_RUN_T0=false` / `T2_RUN_T1=false` by hand to skip a lane that
   was not certified on this HEAD; the harness refuses it unless the plan is
   `already-synced`, and evidence must show the earlier green runs.
+- Before repeating a completed full T0/T1/T2 certification, propose the
+  repeat with its reason and expected cost and ask the user to decide. A
+  recommendation is not consent. If the user declines after HEAD changes,
+  preserve the prior evidence but report the new HEAD as uncertified. A
+  same-HEAD `minikube-t2-runtime` retry finishes an authorized run without
+  repeating T0/T1.
 
 ## Step 3 — T1 specifics (Real PostgreSQL)
 

@@ -97,7 +97,7 @@ Companion to `SKILL.md`. Source of truth: `scripts/minikube/t2.sh`,
 | `ZERO_TESTS_EXECUTED` | A lane was configured off or executed nothing (including a required-but-missing Playwright journey). | Re-run with the lane enabled, or supply the required `T2_PLAYWRIGHT_COMMAND`. |
 | `REAL_PG_REQUIRED_BUT_UNAVAILABLE` | The explicit context, isolated PostgreSQL, DSN route, or exact-head database precondition is unavailable. | Re-enter `make minikube-t2` or `make minikube-t2-real-postgres` on the owned profile. Do not `docker run`, restart Docker Desktop, or probe published ports. |
 | `REAL_PG_REPORT_INCOMPLETE` | Vitest JSON did not prove the exact expected physical files. | Repair test selection/reporter output; do not accept suite counters as file identity. |
-| `REAL_PG_SUITE_FAILED` | Reporter, test assertions, process exit, or parent result contract failed. | Iterate with standalone T1; once green, run full T2 for final exact-head lane evidence. |
+| `REAL_PG_SUITE_FAILED` | Reporter, test assertions, process exit, or parent result contract failed. | Iterate with standalone T1; once green, run full T2 for final exact-head lane evidence. If Darwin 27 reports `ECONNRESET` in `routes.externalGfsRateLimitStress.realPostgres.integration.test.ts`, check the suite's shared `http.Agent`: it must cap `maxSockets` below macOS `kern.ipc.somaxconn` (the proven value is 64). An unbounded 481-request burst is reset before Express accepts it; this is a test-socket defect, not a PostgreSQL or Minikube failure. |
 | `POSTGRES_NOT_READY` | PostgreSQL precondition failed, or a PVC reset was requested without the exact expected UID. | Fix DB readiness; never guess a PVC UID. |
 | `PROFILE_UNHEALTHY` | A required deployment is unready in a fail-loud check (`T2_PLAN_MODE=false`: standalone preflight or the final exact-head T2), the mandatory targeted-sync health command is missing, or a supplied user-facing health command failed or timed out. The orchestrator planner never emits this merely for an unready deployment — it selects `full-reconcile` instead. | For a targeted sync, supply the affected service's profile-owned `T2_HEALTHCHECK_COMMAND`; otherwise repair the reported health failure. Re-run on the same HEAD and profile. Do not run manual repair scripts between runs. |
 | `NP08_HCC_AUTHORIZATION_FAILED` | The deployed Host-to-HCC authorization journey or cleanup failed after T0/T1 passed. | Repair the first NP08 failure, then use `minikube-t2-runtime` on the exact same profile/HEAD; never refresh/reissue in the test. |

@@ -534,6 +534,9 @@ jobs:
       - name: Test HCC watch-recovery gate coordination
         run: bash scripts/tests/test-hcc-watch-recovery-gate.sh
 
+      - name: Test autoresearch gate wrappers
+        run: bash scripts/tests/test-autoresearch-gates.sh
+
       - name: Test HCC watch recovery TLS proxy and configuration restoration
         run: |
           bash scripts/tests/test-hcc-watch-api-proxy.sh
@@ -542,6 +545,9 @@ jobs:
       - name: Test HCC watch-churn readiness gate contract
         run: bash scripts/tests/test-hcc-watch-churn-readiness-gate.sh
 
+      - name: Test HCC stateless cache-containment gate contract
+        run: bash scripts/tests/test-hcc-stateless-cache-containment.sh
+
       - name: HCC policy lifecycle and restoration contracts
         run: |
           bash scripts/tests/test-hcc-watch-churn-empty-fleet.sh

@@ -172,6 +172,26 @@ T2 with `make minikube-t2-runtime` (`T2_RUN_T0=false T2_RUN_T1=false`). That
 path is valid only when the pre-gate marker already matches HEAD
 (`already-synced`). Do not set those flags to skip an uncertified lane.
 
+Before repeating an already completed full T0/T1/T2 certification, propose
+the repeat with its reason and expected cost, then ask the user whether to run
+it. A recommendation alone does not authorize a repeat. This choice does not
+turn an earlier HEAD's evidence into certification for a newer HEAD: if the
+user declines, report the newer HEAD as uncertified. A same-HEAD
+`minikube-t2-runtime` retry to finish an authorized run is the supported
+recovery path, not a new full recertification.
+
+For branch-owned user-facing E2E health journeys, resolve the seeded test
+credential locally before patching HCC or creates fault-injection fixtures.
+Use `scripts/e2e/load-dotenv.sh` with `dotenv_load_canonical_root` and
+`scripts/e2e/admin-credentials.sh` with `e2e_resolve_admin_password`; an
+explicit `E2E_USER_PASSWORD` may override that journey's credential. Keep the
+resolved value in process memory. Never inspect, print, log, or persist `.env`
+contents, even to test whether a key exists. Missing credentials must fail
+preflight before mutating the owned profile. Use the profile's persisted
+ports and the exact `T2_PORT_FORWARD_COMMAND` hold when `pre-gate-sync` can
+restart a service; `targeted-sync` also requires a bounded
+`T2_HEALTHCHECK_COMMAND`.
+
 The active profile mutation lock is `$T2_LOCK_ROOT/<profile>.lock`; stale-lock
 reclaim coordination uses the sibling directory
 `$T2_LOCK_ROOT/<profile>.reclaim`. A killed reclaimer may leave that sibling

@@ -137,6 +137,10 @@ test-unit-all: test-service-matrix ## Run unit tests across all services
 test-service-matrix: ## Check local test coverage against the CI service matrix
 	@node scripts/dev/check-test-services.cjs $(TEST_SERVICES)
 
+.PHONY: autoresearch-checks
+autoresearch-checks: ## Run the local checks used by AutoResearch hard gates
+	@bash scripts/dev/autoresearch-checks.sh
+
 .PHONY: test-codex-subscription-t0
 test-codex-subscription-t0: ## Run the Codex subscription T0 aggregator (counts, no skips)
 	@bash scripts/tests/test-codex-subscription-t0.sh
@@ -784,6 +788,19 @@ minikube-t2-hcc-watch-recovery: ## Certify PR A recovery omission, runtime repai
 	@bash scripts/tests/test-hcc-watch-pr-a.sh
 	@E2E_HCC_PR_A=1 $(MAKE) minikube-t2-hcc-networkpolicy-lifecycle
 
+.PHONY: minikube-t2-hcc-stateless-cache-containment
+minikube-t2-hcc-stateless-cache-containment: ## Opt-in branch-owned T2 cache-containment journey; requires matching profile/context and refreshed user-facing forwards
+	@bash scripts/tests/test-hcc-stateless-cache-containment.sh
+	@context='$(CONTROL_API_REAL_PG_CONTEXT)'; \
+		[ -n "$$context" ] || { echo 'Set CONTROL_API_REAL_PG_CONTEXT to the verified branch-owned context' >&2; exit 1; }; \
+		[ "$(MINIKUBE_PROFILE)" = "$$context" ] || { echo 'MINIKUBE_PROFILE and CONTROL_API_REAL_PG_CONTEXT must select the same branch-owned profile/context' >&2; exit 1; }; \
+		printf '%s\n' "$$context" | grep -Eq '^clerum-[a-z0-9][a-z0-9-]*-[0-9a-f]{8}$$' || { echo 'The selected context must be generated and branch-scoped' >&2; exit 1; }
+	@E2E_HCC_WATCH_FAULT_INJECTION=1 \
+		T2_GATE_ID=minikube-t2 \
+		T2_HEALTHCHECK_COMMAND='KUBECONTEXT="$$T2_CONTEXT" MINIKUBE_PROFILE="$$T2_PROFILE" E2E_BRANCH_PROFILE_ENV="$$T2_PROFILE_ENV" E2E_PROFILE_PORTS_ENV="$$T2_PORTS_ENV" E2E_EXPECTED_PRE_GATE_GATE=minikube-t2 bash scripts/e2e/e2e-hcc-stateless-cache-containment.sh' \
+		T2_HEALTHCHECK_TIMEOUT_SECONDS=900 T2_HEALTHCHECK_KILL_GRACE_SECONDS=300 \
+		$(MAKE) minikube-t2
+
 .PHONY: minikube-t2-runtime
 minikube-t2-runtime: ## Exact-head T2 after T0 and T1 already passed on this HEAD and profile
 	@T2_RUN_T0=false T2_RUN_T1=false \
@@ -1373,12 +1390,12 @@ test-e2e-stateless-durability: ## Run stateless host durability E2E gate (Phase
 .PHONY: test-e2e-stateless-suspend-wake
 test-e2e-stateless-suspend-wake: ## Run stateless suspend/wake E2E gate (Phase 1 API + Phase 2 Desktop Playwright; needs port-forwards + seeded chatllm-stateless)
 	@echo "Running stateless suspend/wake E2E gate..."
-	KUBECONTEXT=$(E2E_KUBECONTEXT) bash scripts/e2e/e2e-stateless-suspend-wake.sh
+	E2E_ALLOW_STATELESS_CADENCE_ACCELERATION=1 KUBECONTEXT=$(E2E_KUBECONTEXT) bash scripts/e2e/e2e-stateless-suspend-wake.sh
 
 .PHONY: test-e2e-stateless-wake-recovery
 test-e2e-stateless-wake-recovery: ## Run stateless wake-recovery latency gate (R1 warm draining / R2 cold suspended / R3 drained-window p95 budgets; needs port-forwards + seeded chatllm-stateless)
 	@echo "Running stateless wake-recovery latency gate..."
-	KUBECONTEXT=$(E2E_KUBECONTEXT) bash scripts/e2e/e2e-stateless-wake-recovery.sh
+	E2E_ALLOW_STATELESS_CADENCE_ACCELERATION=1 KUBECONTEXT=$(E2E_KUBECONTEXT) bash scripts/e2e/e2e-stateless-wake-recovery.sh
 
 .PHONY: test-e2e-hcc-communicationchannel-watch-recovery
 test-e2e-hcc-communicationchannel-watch-recovery: ## Run isolated minikube HCC watch-recovery fault-injection gate

@@ -1,6 +1,6 @@
 {
   "name": "clerum-control-api",
-  "version": "0.1.680",
+  "version": "0.1.681",
   "description": "Internal Clerum control plane REST API + UI for managing CRDs and secrets",
   "main": "dist/main.js",
   "engines": {

@@ -1145,11 +1145,11 @@ export const config: Config = {
   ),
   // Default derived from the wake mechanism's worst case, not picked ad hoc.
   // rpc-proxy's wake-and-hold loop re-triggers POST /rpc/hosts/:hostRef/wake
-  // every wakeRetriggerMs=15000 for up to wakeMaxHoldMs=90000 (defaults in
+  // every wakeRetriggerMs=15000 for up to wakeMaxHoldMs=48000 (defaults in
   // rpc-proxy/src/config.ts), so one held request costs
-  // 1 + floor(90000/15000) = 7 calls per rpc-proxy instance; rpc-proxy runs
+  // 1 + floor(48000/15000) = 4 calls per rpc-proxy instance; rpc-proxy runs
   // replicas: 2 (deploy/base/rpc-proxy/rpc-proxy.yaml) with per-instance
-  // dedup, so the mechanism alone can emit 14 calls / 90s (~9.4/min) per
+  // dedup, so the mechanism alone can emit 8 calls / 48s (10.0/min) per
   // host. Desktop prewarm adds a burst of up to 3 calls per device.
   // Middleware order in routes/rpc-access/hosts.ts is limiter BEFORE
   // handler, and the hostWakeCoalesceWindowMs coalescer runs INSIDE the

@@ -1,5 +1,5 @@
 import express, { Router } from 'express'
-import type { Request } from 'express'
+import type { Request, Response } from 'express'
 import { config } from '../../config.js'
 import { pool } from '../../db.js'
 import { K8sGateway } from '../../k8s.js'
@@ -48,14 +48,25 @@ const HOST_ACCESS_SCOPES = [
 
 type RpcAuthedRequest = Request & { rpcAuth?: RpcAccessClaims }
 
-function logHostAccessDenial(
+/**
+ * Response header that tells rpc-proxy why control-api denied Host access. The
+ * 403 body stays exactly `{"error":"Forbidden"}` (a pinned 21-byte contract);
+ * the reason travels out of band so rpc-proxy can tell removed access from
+ * other denials. Scope denials from the auth middleware carry no such header.
+ */
+export const HOST_ACCESS_DENIAL_REASON_HEADER = 'x-host-access-denial-reason'
+
+function denyHostAccess(
   req: RpcAuthedRequest,
+  res: Response,
   reason: RpcHostAccessDenialReason | 'claims_missing'
 ): void {
   req.log?.warn(
     { event: 'rpc_host_access_denied', reason },
     'rpc host access denied by control-plane authority'
   )
+  res.setHeader(HOST_ACCESS_DENIAL_REASON_HEADER, reason)
+  res.status(403).json({ error: 'Forbidden' })
 }
 
 async function bindDirectRunWithinBudget(
@@ -187,8 +198,7 @@ export function createRpcAccessUsersRouter(
         const hostRef = String(req.params.hostRef || '').trim()
         const claims = req.rpcAuth
         if (!claims) {
-          logHostAccessDenial(req, 'claims_missing')
-          res.status(403).json({ error: 'Forbidden' })
+          denyHostAccess(req, res, 'claims_missing')
           return
         }
         const authorization = await authorizeRpcHostAccess(
@@ -199,8 +209,7 @@ export function createRpcAccessUsersRouter(
           directory
         )
         if (!authorization.authorized) {
-          logHostAccessDenial(req, authorization.reason)
-          res.status(403).json({ error: 'Forbidden' })
+          denyHostAccess(req, res, authorization.reason)
           return
         }
         res.status(200).json(authorization.connection)
@@ -221,8 +230,7 @@ export function createRpcAccessUsersRouter(
         const claims = req.rpcAuth
         const binding = parseDirectRunBindingRequest(req.body)
         if (!claims) {
-          logHostAccessDenial(req, 'claims_missing')
-          res.status(403).json({ error: 'Forbidden' })
+          denyHostAccess(req, res, 'claims_missing')
           return
         }
         if (!binding) {
@@ -238,8 +246,7 @@ export function createRpcAccessUsersRouter(
           directory
         )
         if (!authorization.authorized) {
-          logHostAccessDenial(req, authorization.reason)
-          res.status(403).json({ error: 'Forbidden' })
+          denyHostAccess(req, res, authorization.reason)
           return
         }
 

@@ -30,15 +30,15 @@ import { readFileSync } from 'node:fs'
 
 // Hard-coded mirrors (source files named above).
 const WAKE_RETRIGGER_MS = 15_000
-const WAKE_MAX_HOLD_MS = 90_000
+const WAKE_MAX_HOLD_MS = 48_000
 const RPC_PROXY_REPLICAS = 2
 const PREWARM_CALLS_PER_DEVICE = 3 // 1 initial + PREWARM_REEMIT_MAX_ATTEMPTS
 const PREWARM_CONCURRENT_DEVICES_BUDGET = 4
 
 // Worst case of the wake-and-hold mechanism alone, in raw calls:
-//   per instance: 1 initial + floor(maxHold / retrigger) retriggers = 7
-//   fleet-wide:   x replicas (per-instance dedup, no cross-instance dedup)
-//   per minute:   14 calls / 90s = ~9.33/min
+//   per instance: 1 initial + floor(maxHold / retrigger) retriggers = 4
+//   fleet-wide:   x replicas (per-instance dedup, no cross-instance dedup) = 8
+//   per minute:   8 calls / 48s = 10.0/min
 const HOLD_CALLS_PER_INSTANCE = 1 + Math.floor(WAKE_MAX_HOLD_MS / WAKE_RETRIGGER_MS)
 const HOLD_CALLS_FLEET = HOLD_CALLS_PER_INSTANCE * RPC_PROXY_REPLICAS
 const MECHANISM_CALLS_PER_MIN = HOLD_CALLS_FLEET * (60_000 / WAKE_MAX_HOLD_MS)
@@ -122,9 +122,9 @@ describe('host-wake rate limit budget (cross-service derivation guard)', () => {
     const config = await loadConfigWith({})
 
     // Sanity-pin the derivation arithmetic itself.
-    expect(HOLD_CALLS_PER_INSTANCE).toBe(7)
-    expect(HOLD_CALLS_FLEET).toBe(14)
-    expect(MECHANISM_CALLS_PER_MIN).toBeCloseTo(9.333, 3)
+    expect(HOLD_CALLS_PER_INSTANCE).toBe(4)
+    expect(HOLD_CALLS_FLEET).toBe(8)
+    expect(MECHANISM_CALLS_PER_MIN).toBeCloseTo(10.0, 3)
 
     // Invariant 1: >=3x the single-hold mechanism volume, so the backstop
     // alone can never come close to exhausting the bucket.

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import jwt from 'jsonwebtoken'
 import request from 'supertest'
 import { createApp } from '../src/app.js'
@@ -63,6 +63,8 @@ vi.mock('../src/db.js', () => ({
 describe('Workflow approval refresh rate limit', () => {
   let app: ReturnType<typeof createApp>
 
+  afterEach(() => vi.restoreAllMocks())
+
   beforeEach(() => {
     vi.clearAllMocks()
     rateLimitCounts.clear()
@@ -72,6 +74,9 @@ describe('Workflow approval refresh rate limit', () => {
 
   it('does not consume a refresh token when the request is rate limited', async () => {
     const limit = config.approvalRlRefreshPerMin
+    // Pin the fixed-window clock before warm-up, including near a minute boundary.
+    const baseNow = Math.floor(Date.now() / 60_000) * 60_000 + 10_000
+    const nowSpy = vi.spyOn(Date, 'now').mockReturnValue(baseNow)
     // Warm up exactly `limit` calls with unique refresh tokens — all should 200.
     for (let i = 0; i < limit; i++) {
       const { token } = issueMcpHostRefreshJwt('ns', 'recipe')
@@ -94,8 +99,6 @@ describe('Workflow approval refresh rate limit', () => {
     // Rollover the 60s window so the limiter grants a fresh slot. The
     // rateLimiterService uses `Date.now()` internally — spy on it so we don't
     // actually wait a minute in the test.
-    const baseNow = Date.now()
-    const nowSpy = vi.spyOn(Date, 'now')
     nowSpy.mockReturnValue(baseNow + 60_001)
 
     try {