Qualify Muse 1.2.1, fix auth dispatch, integrate YOLO mode

[Srimi1]

Support stock Muse 1.2.1-R2847.1 alongside 1.0.3-R2198.1: the exact single-version gate rejected every CLI invocation on machines with the newer host installed. Discovery now prefers newer qualified versioned binaries, and the help/MSP baselines, installer, verifier, and docs cover both builds.

Fix launcher auth dispatch: the credential selector trailed the gateway auth subcommand, which clap rejects, so login/logout/auth set/auth status all exited 2. The launcher now emits --provider before the action and the gateway accepts the flag in either position.

Integrate launch-scoped --yolo: forwarded to stock Muse for the TUI, exec, and resume with a stderr warning, and translated to host sandbox options for MSP serve where approval stays wire-selected.

Recognize the model-free mcp subcommand (never gateway-backed, never confused with wrapper auth) and teach the argv scanner the local subcommand value flags.

Update the offline parity harness for the v4 readiness contract, the gateway --provider flag, and Muse 1.2.1 task fan-out, with an end-to-end YOLO lane.

Summary

Describe what changed and why.

Validation

List the commands or manual checks you ran.

Checklist

• The change is focused and does not modify vendored source unnecessarily.
• cargo fmt -p codex-transport -p muse-codex -p muse-codex-gateway -- --check passes.
• cargo clippy --workspace --all-targets --locked -- -D warnings passes.
• cargo test --workspace --all-targets --locked passes.
• bash tests/scripts/release-tooling-test.sh passes when release tooling changes.
• Tests cover new behavior or the PR explains why tests are not applicable.
• Documentation and CHANGELOG.md are updated when user-visible behavior changes.
• No credentials, private URLs, proprietary Muse artifacts, or signing keys are included.
• Security, provider-boundary, retry, and tool-call implications were considered.

Security and compatibility impact

Explain any effect on authentication, data flow, supported Muse versions,
provider routing, release integrity, or tool-call behavior. Write None when
there is no impact.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c8cfd2ff-4aa8-4359-99fc-a80c87c93f56

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Srimi1]

update

[Srimi1]

..