[immakermatty]

Status: ready for review. Plan DEV-6442. New overlay row 34, test only.

Problem

A Lazurio workspace gateway lets the native T3 Code client through without the workspace sign-in only for a fixed list of requests (root decision 0157, APPLICATION_PUBLIC_PATHS in HumanAndMachine-ai/Machines). Since v0.1.3 (upstream pingdotgg#24554) the client asks POST /api/auth/websocket-ticket/rpc first and falls back to the bare ticket path only on a 404. The gateway did not list the bound path and answered 302 to sign-in, so desktop and mobile pairing stopped before the socket ("T3 Code on … did not answer"). The rebuild on v0.1.3 checked Chat through the gateway on canary (row 19), but only in the browser, which is signed in, so the regression went unnoticed.

Fix

The gateway side is HumanAndMachine-ai/Machines#1018, with the 0157 addendum in HumanAndMachines/Lazurio#700. This PR adds the consumer-side contract so the next upstream change to the pre-socket requests fails here in CI, not when people try to pair:

• packages/client-runtime/src/lazurio/workspaceGateway.test.ts runs the production entry points of a direct pairing, the route desktop and mobile take to a hosted Environment: preparePairingRegistration (descriptor, pairing-code exchange) and RemoteEnvironmentAuthorization.authorizeBearer (descriptor, RPC ticket, socket URL). They run against a gateway emulator that holds a copy of the Machines allowlist and answers 302 to everything else. T3 Connect is signed out and its services are unimplemented, so the test also fails if the path starts to use the relay. Every request must reach "T3", and the socket URL must match the gateway's WebSocket rule (/ws with wsTicket). DPoP is the T3 Connect relay route and does not go through a Lazurio gateway.
• A second case pins the failure: without the rpc entry, pairing stops exactly at POST /api/auth/websocket-ticket/rpc.
• docs/operations/lazurio-fork-release.md: row 34 in the overlay table and its entry in the target stack, with the rebuild rule: when this test fails, widen the gateway first (a new decision under 0157), then the test, never only the test.

Two commits: the test (row 34) and the CI allowlist entry for it (a distribution file, row 5 at the next rebuild). Nothing outside tests and CI changes. Clients and the server behave as before.

Verification

• vp test run src/lazurio/workspaceGateway.test.ts (client-runtime): 2/2 pass. Mutation check: with one allowlist entry removed, both cases fail.
• vp run check:changed: format, lint, knip and typecheck (39 packages) pass. The only failing test is the unchanged AgentContextBudget.test.ts, tracked in Agent context budget test fails on current main #167.
• node --test scripts/lazurio-release-contract.test.mjs: 51/51 pass after rebasing on main (fix(release): install the version check's locked dependencies before it runs #165).
• Fork CI is green: the overlay allowlist in lazurio-fork-ci.yml now lists the new test (row 34). Like the rest of the distribution files, that change moves to row 5 at the next rebuild.
• Runtime transcript (2026-11-01, an Environment over its tailnet, short-lived read-only pairing token, session revoked afterwards): through the gateway the descriptor, /oauth/token and /api/auth/session returned 200 and /api/auth/websocket-ticket/rpc returned 302 → /oauth2/start. On the loopback upstream the same request returned 200, and the WebSocket opened with either ticket.

Real consumer

The desktop app (0.1.3) on the person's MacBook, Settings → Environments → Details for the station: Error: Failed to fetch remote environment endpoint https://t3code.<station>/api/auth/websocket-ticket/rpc (HttpClientError: Transport error …), Route: Direct. That is exactly the request this contract pins.

Order

Independent of Machines#1018: the test mirrors the target allowlist and passes on its own. Merge it after HumanAndMachines/Lazurio#700 (decided by Matěj on 2026-11-01), so that the copy names a decided list.

Agent: environment a480495c-25e0-4e51-828b-1dbf1b77d62f · T3 thread 35c8d8cb-2b2a-4670-8bdc-90ebb96c04fd

Claude Opus 5.5 in Claude Code (T3 Code).

🤖 Generated with Claude Code

[agentrozjedemeai]

APPROVE

Non-blocking: check:changed fails on the unchanged server agent-context budget test; tracked separately in #167. The new gateway test passes, as does the release contract; fork CI is green.

Order and migrations: merge this together with or after HumanAndMachines/Lazurio#700, so the copied allowlist has an approved decision.

@immakermatty, please assign the person responsible for this PR; it currently has no assignee.

— Pablo

[agentrozjedemeai]

APPROVE

The revised contract exercises the production direct-pairing and authorization entry points. The gateway tests pass; check:changed still fails only on the existing agent-context budget issue #167. Fork CI is still running.

Order and migrations: HumanAndMachines/Lazurio#700 is merged, satisfying the decision prerequisite.

— Pablo