TEST-ONLY — CommHub #1053 / agent-network issue #2637
Observed: 2026-10-12 08:49 +08. Not merged, published or deployed.
Base: cfff59eaefa907c9b2fc65ab6a18d240afd4bbfe
Product/test tree before this receipt: 264376060e774d6a1610d50d900bbcda9ec6a87d

Implemented core
  Human owner/admin -> existing daemon_provider_snapshot secret_* actions ->
  token-bound Daemon short-lived pull -> pinned compiled CLI private stdin ->
  owner-only local store -> names/source/revision receipt -> startup env.
  Default Daemon keys; node overrides; delete node key restores inherited default.
  Values never go in ordinary task text, config snapshots, argv or readbacks.
  Existing explicit process/config/Provider precedence retained. No auto-restart.
  Existing raw node secrets.env remains supported; this is an additional scoped source.
  Native TUI/server needs FULL restart, not just Bridge restart.

Layered Docker core, no host credentials or production state
  Portable recipe: tests/test1053-scoped-secrets/Dockerfile
  Pinned public Node 22.22.2 + Bun 1.3.14, npm ci from three checked-in lockfiles.
  Independently built portable image manifest list:
    sha256:6c6685eba2123bc1dfb294662979b4feb37f078c0232f47915c53b01d6ed699d
  Build PASS (344 CLI modules), then --rm / --network none:
    storage/override/CAS/delete/revoked local adoption: 1/1, 18 expects PASS.
    actual registered Hub handlers -> compiled package CLI -> actual agent-node
      startup -> real child env: 1/1, 16 expects PASS.
      Includes node-token rejection, wrong binding, names-only receipt, matching
      CLI/runtime readers, exact synthetic bytes and same-name envRef resolution.
    focused strict TS check for the new CLI store: exit0.
  Earlier dependency-cache image: manifest 7684e1bf220cc6995fcf7b6454906f22608530e9bcfd95d3c29e25c62a4cdd2b.
  Cache proof kept separate; portable build does not depend on that private image.

Unchanged model-tool budget, focused actual HTTP gate
  Existing tool-audience-http.test.ts, only registry and role byte-budget cases.
  2/2 PASS, 6 expects. 95 all tools / 85444 B; 62 node / 63325 B;
  62 user / 59560 B. Existing ceilings unchanged.
  Secret work reuses the management transport with separate request IDs and
  validators; scopes/permissions are not merged. No additional model tools.

Client acceptance is independently reported by agent-network-app
  docs/tests/report-test1053-scoped-secrets-client.txt.
  Actual exported node + Daemon UI uses synthetic HTTP/native IPC, not this
  production server. Do not conflate the two fixtures with one live/native E2E.

Failures and corrections, not hidden PASS
  Initial helper fixture put a compiled CLI under /tmp without a real package
  identity; the existing binary pin correctly rejected it. Fixed fixture to the
  checked-in package entry wrapper. No pin relaxation.
  Integration move to independent test directory initially lacked root SDK
  resolution. Added the explicit Docker dependency link; assertions preserved.
  Early TS narrowing of last-write receipt fixed with an explicit presence check.
  Extra MCP schemas exceeded the existing all-tools limit; compacted onto the
  existing management lane. Then 85524 B still exceeded by 24 B; shortened the
  existing description, not the limit. Final role budget above is the acceptance.
  Numeric doc pins corrected to actual definitions; Docker scan 17 pins,
  8 determined / 8 skipped / 1 unavailable historical ref / 0 drift.
  Skipped/unavailable documentation references are NOT checked successes.

Boundaries / cleanup
  Synthetic secrets only; no real OAuth, provider entitlement, model turn,
  native TUI tool execution or macOS/Windows/Android installer acceptance.
  Existing running processes were not changed. Daemon-vdev remains the previously
  reported public .168/.134 pair, not this candidate.
  Hub queue is in-memory, 120 seconds; lost pending requests remain unconfirmed.
  Future regular children get a source reference. Clone/new-adoption auto-init
  remains outside this slice; setting a key rebinds its owned source.
  Operator secret-manager/encrypted backup source still required for real data;
  this synthetic software rebuild is not a production-data recovery assertion.
  Containers --rm; scratch DB/files inside containers removed. No host service,
  business node, authentication, global npm or default tmux touched.
  Six recovery questions and exact transport are documented in docs/scoped-secrets.md.

Next: original PR CI/review, main merge, coordinated formal exact-main release,
actual downloadable pair and explicit target Daemon installation. No branch
build artifact is a release. 09:00 +08 is a source/CI checkpoint, not publication.

08:55 +08 CI registration correction (no product behavior change): exact
a6de5ea9a had base-image-pin FAIL and test-file-coverage FAIL. Removed the
optional local-only Dockerfile.cached (recoverable in this PR's prior commit),
kept the already exercised portable recipe, and added an executable run.sh
with the same two gated test invocations. No baseline or assertion relaxation.
