Slice 4e: beta activation wiring — config/env-driven fleet mode arming (#398 amicissimo)

[aarontrowbridge]

Summary

Closes the activation gap recorded by the Slice A/B casts: extension.ts never passed the fleet option to createAmicodeService — the wiring option and the staging log line existed, but nothing supplied the hub getter. This slice makes the fleet overlay testable end-to-end, beta-scoped.

Part of harmoniqs/amicissimo#398 (parent #380, sub-spec spec-20260905-193000-local-shell-data-plane).

What landed

• fleet_activation.ts — resolveFleetActivation: config fields + env overrides (AMICODE_FLEET_HUB_URL / AMICODE_FLEET_TUNNEL_ALIAS / AMICODE_FLEET_TUNNEL_CONFIG) → armed (hub URL + tunnel alias + D6 posture tuning) or NOT armed with a named reason. Both fields required (D7: the tunnel stamps its own config — an activation without an alias cannot stamp one). NO activation config → the fleet option is never passed → byte-identical base (the H3 discipline extends to activation, by test).
• Wiring — startAmicodeService assembles the fleet option from the armed activation: the hub getter late-bound (re-resolved per request; a de-armed activation is the honest upstream absence, never a stale snapshot), posture tuning + tunnel config path passed through; a not-armed activation is a named boot-log outcome.
• Extension — the workspace settings (amicode.fleetHubUrl, fleetTunnelAlias, fleetTunnelConfigPath, fleetOverlaySource + the four posture tuning keys, 0 = the fixture default) feed the resolver.
• Posture tuning config-overridable with sane field defaults equal to today's fixture values — no behavior change unless configured.

Follow-ups in this slice (pushed as they land)

• The beta smoke harness (DRY legs end-to-end through the real service; LIVE gated on AMICODE_FLEET_SMOKE_LIVE=1)
• The beta checklist doc

Verification

• pnpm run typecheck clean
• New tests: test/fleet_activation_398.test.ts (13) green — activation resolution, named reasons, env precedence, tuning defaults/overrides, wiring byte-identity, staging still gates, late-bound getter, posture end-to-end
• Full suite + the DRY smoke run to follow on this PR

Verification (final)

• pnpm run typecheck — clean, repo-wide (4/5 workspace projects, exit 0).

• test/fleet_activation_398.test.ts — 13/13 green (RED first: module-absent collection error, quoted in trail).

• Full extension vitest suite (vitest run --passWithNoTests --exclude '**/slow/**'): 2697 passed | 4 failed | 53 skipped — the 4 are the known pre-existing set (terminal.test.ts ×2 OPENCODE_DB/CONFIG_DIR env, editable_diffs_wiring.test.ts ×2 mask-image/overflow), matching the clean-main baseline. The recursive pnpm -r run test also surfaced packages/amico-run agent_spawn.test.ts ×1 ($AMICO_AGENT_CONFIG_DIR override) — verified pre-existing on a pristine origin/main worktree (same 1 failed | 39 passed).

• The DRY smoke harness run in this worktree (the AC evidence):

  [smoke] PASS A · no-entitlement byte-identity (spot check): 6 requests byte-identical across the base and the activation-armed-but-unentitled boot
  [smoke] PASS A · fleet surfaces absent (the base no-route 404): fleet paths answer the base no-route shape — the fleet mode does not exist
  [smoke] PASS B · activation arms → fleet mode staged: fleet mode armed via fleet-data-plane — status answers, the hub credential resolves
  [smoke] PASS B · /amicode/fleet/sessions — the merged projection (both stores, provenance-tagged): both stores render in one list, provenance-tagged; currency tagged over [hub, local]
  [smoke] PASS C · kill leg — the hub dies → the hub-down posture routes LOCALLY: 2 no-responses → standalone (pointer surfaced); data requests route to the local engine
  [smoke] PASS C · kill leg — the projection names the hub absence (never a silent one): hub source named absent (fetch-failed); currency re-derived over [local]
  [smoke] PASS C · rejoin leg — the hub returns → recovery re-enters fleet (refetch epoch bumps): fleet re-entered after 2 healthy probes; refetch_epoch 1 → 2; the hub serves data again
  [smoke] PASS C · hang leg — a wedged hub times out CLIENT-SIDE and enters hub-down (never welded): a wedged hub → client-enforced timeouts → hub-down; recovery re-enters fleet (hysteresis held)
  [smoke] PASS D · revocation — the write is delivered while entitled: fleet write delivered (the hub 201 passed through)
  [smoke] PASS D · revocation — the credential lapses mid-flight → read-only-with-pointer, never eaten: 401 → read-only-with-pointer + Go-Standalone; the base posture keeps running
  [smoke] 10/10 legs passed
  

• CI rollup on this PR: all green — boot-smoke ×3 (macos-14, ubuntu-24.04-arm, ubuntu-latest), app-shelf-boot-proof, app-bundle-gate, bundle-build-gate, schema-roundtrip, vsix-gate, fast.

Design decisions

• No amicissimo manifest field was needed: activation config (hub URL + tunnel alias) is client-side provisioning of the existing hub_upstream surface, not a new schema/API/storage field — the freeze validator's envelope is untouched.
• Both activation fields are REQUIRED (hub URL + tunnel alias): D7 — an activation without an alias cannot stamp a tunnel, and a partially-armed fleet mode would be a silent half-surface.
• The activation snapshot also carries optional staging inputs (entitlements / entitlementConfigDir / overlaySource) for test/harness injection; production leaves them undefined = the machine's real resolution.
• The LIVE smoke runs non-destructive legs only; kill/hang/revoke are named skips, never run against a real hub.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}