chore: lint rule banning disabled TLS verification in tests (#104)

[V3RON]

Closes #104

What changed

pnpm lint now fails when a test turns off TLS verification: setting NODE_TLS_REJECT_UNAUTHORIZED (as an assignment, through a call such as vi.stubEnv, or in a child-process env object) or setting rejectUnauthorized to false (in an options object, or by assigning it, e.g. https.globalAgent.options.rejectUnauthorized = false). The rule is appduct/no-tls-bypass in eslint.config.mjs and applies only to files under __tests__, since on a TLS server rejectUnauthorized: false is the normal setting for client certificates. The five integration tests that run the daemon in-process now trust its certificate with ca: daemon.tls.current().certPem, and their fake-app connectClient takes the daemon instead of a port, so the now-unused port fields and parameters are gone. The six files whose daemon runs as a CLI subprocess never see its certificate, so they go on a new LEGACY_TLS_BYPASS burn-down list. It works like the #88 lists, and a test checks that every entry still violates.

Acceptance criteria

#	Criterion	Test	Tier
1	pnpm lint fails on a test file with NODE_TLS_REJECT_UNAUTHORIZED = "0" or rejectUnauthorized: false, or an equivalent bypass	lint-boundaries.test.ts › "lint: TLS verification in tests": process-wide, bracketed, child env, vi.stubEnv, rejectUnauthorized: false, globalAgent.options.rejectUnauthorized = false, test helper	unit
2	pnpm lint passes on a test that trusts the daemon's cert via ca: ...certPem	lint-boundaries.test.ts › "a test trusting the daemon's own certificate passes"	unit
3	(per comment) every existing violation is migrated to ca: daemon.tls.current().certPem or on a burn-down list, and pnpm lint passes on main	lint-boundaries.test.ts › "every LEGACY_TLS_BYPASS entry still switches off TLS verification"; pnpm lint	unit
4	Does not fire outside tests (daemon TLS setup)	lint-boundaries.test.ts › "source outside tests is not linted by it"	unit

Migrated (5): tool-invocation, session-engine, policy-and-audit, tls-refresh, mcp-server integration tests.
Listed (6): cli-v2, events, exit-codes integration tests, plus e2e/harness.ts, e2e/app-client.ts, e2e/hostility.e2e.test.ts.

E2E evidence

Waived by the maintainer. The PR changes only eslint.config.mjs and files under __tests__, and no app or daemon runtime code. The session's container has no simulator. The CI ios and android jobs pass on the head commit.

Checklist

• CHANGELOG.md has an entry under Unreleased (writing-changelog skill), or the change is not user-visible
• User-facing docs updated for every surface the change touches (writing-user-docs skill), or the change is not user-visible
• No new import past a module's index.ts; no new direct node:* I/O outside an adapter
• Simplification checklist from the architecture skill applied, exceptions explained above
• docs/ARCHITECTURE.md updated if a surface it describes changed

Out of scope

• Clearing LEGACY_TLS_BYPASS: the subprocess-daemon tests need a way to get the daemon's certificate (for example from daemon status), or they need to move to an in-process daemon.
• The implement-issue lesson in .agents/memory/LESSONS.md that points at Lint rule: ban disabling TLS verification in tests #104 can be retired by the next memory review once this lands.

Status

Implement: done (9/9 green) Review: round 2, approve E2E: waived by user (lint and test files only; no simulator in this container) Ready: yes

🤖 Generated with Claude Code

https://claude.ai/code/session_01UHcZfMyTBtKc72KVYQw4rb

[V3RON]

Comment: 0 blockers, 1 should-fix, 0 nits.
Spec: issue #104, with criterion 3 replaced by the issue comment (migrate or list on a burn-down allowlist).
Fix first: appduct/no-tls-bypass lets vi.stubEnv("NODE_TLS_REJECT_UNAUTHORIZED", "0") and https.globalAgent.options.rejectUnauthorized = false through.

---

Generated by Claude Code

[V3RON]

Verdict: approve. GitHub won't take an approval on your own PR, so this is posted as a comment. Round 2: 0 blockers, 0 should-fix. The round-1 finding is fixed in ac9db98 and I've resolved the thread.
Spec: issue #104, with criterion 3 as replaced in its comment.
Nothing to fix. I agree with checking call arguments rather than every literal: it catches vi.stubEnv and still allows delete process.env[...].

---

Generated by Claude Code