# Self-hosted Subrouter authority S4 — remote seat without provider credentials

**Status:** DONE
**Base:** landed/deployed S3 `0eeda4f6e6f43ae6f6c3d9f5dc6578bf821466ce`

## Owner constraints

- No live provider account is migrated or authority-bound in S4.
- `zync` remains native/test-only; no credential copy is permitted for this authority-mode canary.
- The canary is credentialless and exercises the real remote-seat/container/tailnet path against a route whose provider account is intentionally absent.
- Native/unmigrated accounts retain the legacy seat credential path until their own future cutover.

## Implementation contract

1. `remote-seat.mjs` accepts `authority_mode=subrouter` only with an explicit registered/reachable buildbox, tailnet edge origin, provider, authority name, and protected `0600` route-reference file. Exact route IDs never enter remote runner argv or receipts.
2. A root-only `modules/subrouter/bin/seat-grant` helper mints one unique short-lived `audience=buildbox-run` grant into `/run/overdeck-subrouter-seat/<owner-uid>/<run-id>/`, then returns only the expiry. It emits no route ID, grant ID, or key.
3. Controller materialization derives `CredentialDeliveryReceipt` booleans from the explicit materialized-input set `[route_id, proxy_grant]`; provider refresh token, provider credential file, and authority admin credential are therefore false by construction.
4. The selected buildbox receives only protected `<run>.route` and `<run>.key` files via stdin. The remote runner gets only the non-secret material prefix.
5. `seat-run.sh` authority mode skips `seat-creds.mjs` convergence, provider credential preconditions, native Codex profile lookup, and every provider credential bind mount. It mounts only route and grant read-only to `/seed/subrouter/`. Container-create logging is redacted to authority mode/provider/image.
6. `seat-entrypoint.sh` creates an ephemeral gateway-only HOME. Codex gets a Subrouter `config.toml` plus `SUBROUTER_PROXY_KEY`; Claude gets `ANTHROPIC_BASE_URL`/`ANTHROPIC_AUTH_TOKEN`. No provider auth file is seeded.
7. `--authority-probe-only` performs the real authenticated route-status request through the remote seat/container and tailnet edge, requires HTTP 200 with `ready` or `migration-required`, and exits without a provider request.
8. Teardown revokes/removes the server-side grant first, removes both remote route/key files, then completes the receipt. Cleanup uncertainty forces non-completion (124), never success.
9. Existing native/unmigrated seat behavior remains unchanged when authority mode is absent.

## Acceptance

- Candidate input identity includes `modules/harness/seat/**`, not only Subrouter source.
- Authenticated focused phase runs legacy `seat-creds.test.sh` plus `seat-authority.test.sh` on a registered buildbox.
- Static phase syntax-checks all changed Bash/Node surfaces.
- Required Harness Factory suite remains green.
- Live canary on explicitly selected `debian1`:
  - real remote-seat transport executes the authority probe inside the seat container;
  - owner-visible result is success with `authority_mode=subrouter` and `state=migration-required`;
  - materialized receipt has route/grant fingerprints and bounded expiry/revocation timestamps;
  - `provider_refresh_token_present=false`;
  - `provider_credential_file_present=false`;
  - `authority_admin_credential_present=false`;
  - `remote_grant_file_removed=true`.
- Run-owned route/grant/material are deleted and authority returns to 0 provider credentials/routes/grants/unresolved attempts.
- Restart preserves healthy authority/edge state.

## Deploy-sourced transport sequencing

`~/.claude/lib/remote-runner.sh` resolves into the canonical deploy clone and the sync manifest marks `claude:lib` as deploy-sourced, not runtime-mutable. Repository policy therefore forbids installing this transport from an unlanded worktree. S4 uses the deploy-sourced exception: verify and land the implementation, synchronously deploy the landed commit so the buildboxes receive the exact runner, then execute the live credentialless canary and record its evidence in a follow-up completion commit if needed. This does not permit S5 to start early: S5 remains blocked until the live receipt, cleanup, restart, and final S4 evidence are landed/deployed.

S5 remains blocked until this S4 receipt is proven live and S4 is landed/deployed.
## Completion evidence — 2026-08-22

S4 is live-proven without a provider credential or provider request. The implementation is present in landed/deployed `main`; the deploy clone was at `71268c09c4d45e0ec6bb5ceaa5caad58013a0f19` for final acceptance. The deployed `remote-runner.sh` digest matched the repository/deploy source, and the authority seat used the transported current `seat-entrypoint.sh` over the immutable `harness-seat:3` image entrypoint.

Buildbox verification for the S4 implementation included focused/static/module/full candidate phases on registered buildboxes and Harness Factory **274/274 PASS** on `debian3`. The remote-runner regression proves that only the exact per-run `.harness-seat/<run>/runtime/seat/seat-run.sh` transport skips workspace dependency installation; ordinary remote commands retain the normal dependency preflight.

Final live canary run: `20260822021947-4080520` on explicit host `debian1`. Owner-visible result:

```json
{"ok":true,"authority_mode":"subrouter","provider":"codex","state":"migration-required","route_fingerprint":"bdb8e9d2bcaa","grant_fingerprint":"ff872f2ce318"}
```

The controller-completed bounded receipt is committed at `docs/receipts/2026-08-22-subrouter-authority-s4-seat.json`. It records:

- `provider_refresh_token_present=false`
- `provider_credential_file_present=false`
- `authority_admin_credential_present=false`
- `remote_grant_file_removed=true`
- grant expiry `2026-08-22T02:34:47Z`
- grant revocation `2026-08-22T02:20:29Z`
- only 12-character route/grant fingerprints; no raw route ID, grant ID, proxy key, provider token, or authority admin credential.

Post-run inspection proved no remote authority material on `debian1` and no per-run local grant staging. The temporary canary route was then removed. After restarting `overdeck-subrouter.service` and `overdeck-subrouter-edge.service`, both were active/running/success with listeners restricted to `127.0.0.1:31415` and `100.126.128.50:31416`, respectively. Final authority state:

```text
Provider credentials: 0
Authority routes: 0
Proxy grants: 0
Unresolved attempts: 0
Gateway: ready
```

No live account was migrated or authority-bound. `zync` was not reauthenticated, repaired, copied, or mutated. Native/unmigrated account behavior remains intact. S5 may proceed only after this evidence commit is landed and deployed.