# Self-hosted Subrouter authority S2 — credentialless installed canary

**Status:** DONE (owner-revised credentialless acceptance, 2026-08-21)

## Owner directive

- `zync2` is unavailable and must not be recreated or recovered.
- `zync` may be used only for a `gpt-5.3-codex-spark` model verification attempt. It must not be reauthenticated, migrated, authority-bound, repaired, copied to a seat/K3s secret, or otherwise mutated.
- No other live account/model may be used.
- Because the sanctioned remote Codex test paths distribute `auth.json`, no successful live model call is required for S2.

## Installed evidence

Exact installed candidate before this policy-record rebuild: commit `accd54f62`, patch digest `fb570ef8bf9f0c60782699c26a9cc48ca1bc06d02ed140978b4077362006aa63`. Authenticated focused/static/module/full candidate phases passed on registered buildbox `debian1`; module contract was 42/42. Harness fixture contract 17/17, Harness Factory 274/274, and Systray authority/routing 237/237 passed on `debian3`.

Installed authority reported service identity `uid-995`, store lease held, provider credentials 0, routes 0, grants 0, unresolved attempts 0, gateway ready.

Installed credentialless proof:

```text
Exact dark route: PASS
Proxy grant scope: PASS
Admin isolation: PASS
Provider credentials: 0
```

The proof used the real HTTP authority with a temporary fixture account, exact route, real hashed proxy grants, and exercised missing/malformed/conflicting-selector/wrong-route/admin/provider-unavailable/revoked/expired cases. Cleanup returned authority to zero provider credentials/routes/grants. A service restart returned healthy with zero fixture state.

The fresh authority-owned `zync2` device login was attempted once, then abandoned because the owner cannot recover that account. The pending unit was stopped and authority remained at zero credentials. No native credential was copied into authority.

A `zync` model-fixture inspection proved the exact intended selector/model: `--profile=zync` and `gpt-5.3-codex-spark`. The live invocation encountered a connector error and left no model process/log. Investigation showed both sanctioned remote-seat and K3s paths would copy native `auth.json`; under the owner restriction those paths were not retried. No confirmed `zync` model call is claimed.

## Acceptance

- [x] Exact immutable candidate gates green.
- [x] Installed service isolated and credential-empty.
- [x] Exact-route/grant/admin isolation proven through real installed HTTP authority.
- [x] Revocation and expiry proven.
- [x] Provider-unavailable path proven without provider credential.
- [x] Restart returns healthy with zero temporary authority state.
- [x] No live account migrated or authority-bound.
- [x] `zync` remains test-only/native; no successful live call claimed.

S3 may proceed credentiallessly.