[Pigbibi]

AI assistance

Claude (WorkBuddy agent) wrote the change, ran the local checks and prepared this description. No part of it was generated without a human owner reviewing the diff.

What changed

/api/desk/credentials returned 404, so the Meridian desk's credentials surface rendered api/fixtures/credentials.ts — three synthetic accounts with invented phases. The console already holds the real record (credential_maintenance_metadata, served by credentialMaintenanceCommand), so this projects it into the desk contract instead of adding a store.

• web/strategy-switch-console/application/desk/credentials.js (new): credentialPhase, credentialExpiry, credentialItems, deskCredentialsResponse. Read-only, one record, no broker I/O.
• worker.js: dispatch GET /api/desk/credentials through deskAuth, before the readback branch.
• frontend/src/desk/api/endpoints.ts: credentials: "mock" → "live".
• v2_asset_map.js: regenerated by npm run sync:v2-assets after the source flip.
• tests/desk_credentials_validation.mjs (new): vocabulary, expiry, failure and method cases, each payload validated against schemas/desk/credentials.json.
• tests/console_desk_mock_validation.mjs: the source map assertion now reads session + credentials live, and the forced-scenario block asserts zero network calls instead of a fixed call count.
• package.json: the new suite joins test:operations.

Deliberate choices:

• Phase vocabulary. credentialMaintenance.js buckets 14 days, but schemas/desk/common.json has no 14 and the UI already folds it (frontend/src/desk/credentials/model.ts, normalizeCredentialPhase: "14" → "30"). I first extended the schema, then reverted it once the type check showed that existing rule: the backend mirrors the UI rule instead of changing the contract. A phase outside both vocabularies is unknown, never a neighbouring bucket.
• Absent metadata is unknown / never_read, not {status: "none"}. No expiry on file is not proof the credential never expires.
• source stays operator_provided. The module says the expiry is operator-supplied and does not attest broker validity; the projection does not upgrade it.
• Failures stay failures. A store error is 502 read_failed; the endpoint never returns an empty healthy list.

How verified

Local, from a fresh clone of main at c2cf60b0:

node tests/desk_credentials_validation.mjs          -> desk_credentials_validation: PASS
node tests/desk_contract_validation.mjs             -> 24 responses, 63 fixtures, 569 closed objects
node tests/desk_helpers_validation.mjs              -> PASS
node tests/desk_readback_validation.mjs             -> PASS
node tests/console_desk_mock_validation.mjs         -> PASS
node tests/console_desk_format_validation.mjs       -> PASS
node tests/console_desk_pages_validation.mjs        -> PASS
node tests/console_desk_phase8_validation.mjs       -> PASS
node tests/console_desk_overview_validation.mjs     -> PASS
node tests/console_desk_shell_validation.mjs        -> passed
node tests/console_desk_p1_acceptance_validation.mjs-> PASS
node tests/console_desk_loading_retry_validation.mjs-> PASS
node tests/console_v2_assets_validation.mjs         -> 143 references; 45 assets served
node tests/credential_maintenance_worker_validation.mjs -> passed
npx tsc --noEmit                                    -> clean
npm run build (vite + size budget)                  -> Size budget OK
npm run test:operations --prefix web/strategy-switch-console -> exit 0

Not verified, and the review should weigh it: I could not sign in to the live console. readSession is an HMAC cookie signed with a Worker secret I do not hold, so the desk pages cannot be observed end-to-end from here. Everything above is contract- and unit-level; the rendered strip still needs one signed-in look after deploy.

Why

The desk is a staged build: ten of eleven endpoints still read fixtures (DESK_SOURCES), and the home page therefore shows numbers that do not exist. This is the first endpoint whose backend already existed, so it is the cheapest place to prove the pattern: project a real record, keep the guard satisfied, leave everything unprovable visibly unknown.

Risk

R1 — read-only, no new store, no auth change, no write path. Affected: web/strategy-switch-console/** (worker route + asset map) and two test files. Compatibilities to note:

• One new authenticated route; deskAuth still requires an allowed session and deskResponse keeps Cache-Control: no-store.
• The asset map changes, so the next console release must pin this head; the deploy workflow's exact-source allowlist will reject a stale pin by design.
• No behaviour change for any existing route.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T15:30:14.251497Z	183c06b	New commits
🔒 Security Review	✅ Completed 2026-11-09T15:31:58.550347Z	183c06b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a821ba0912

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".