runtime(track-a): native login to in-game E2E v3

[blakinio]

Terminal source disposition — superseded by clean coordinator promotion #577

Status: CLOSED UNMERGED AS SUPERSEDED.
Task: OTC-20260818-native-login-to-ingame-e2e.

Coordinator audit target / frozen source head:
8e029f5849a1d51f69486adcc3716c80f139e60e.

After that freeze, a concurrent source continuation advanced the branch to 75c7deb9b2b673be7c869d1008d08509b8f1e5a1. Fresh compare of 8e029f...75c7deb showed no helper/source implementation changes. The late delta consists of current-main reconciliation, task metadata and 20260819-independent-spark-audit-auth-blocker.md. That Spark attempt produced no model response because managed Codex authentication returned HTTP 401 token_invalidated / refresh_token_invalidated; it is not evidence for or against the implementation and is superseded as the merge-readiness blocker by the completed independent coordinator audit below.

Proven physical result

RESULT=SUCCESS_AT_PROOF_POINT
CHARACTER_ACTUALLY_LOGGED_INTO_GAME=YES
CAUSAL_PROOF=COMPLETE
STRUCTURAL_IN_GAME_AT_PROOF_POINT=PASS_3_OF_3

Exact proof-point client:

PID=27368
size=52109920
sha256=ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8
DISPLAY=:1

Later post-handoff stability remains a separate terminal negative result:

CURRENTLY_LOGGED_IN=NO
POST_HANDOFF_SESSION_STABILITY=FAIL_NOT_RETAINED
SECOND_SECRET_ATTEMPT=NOT_PERFORMED

A later task-record-only unadmitted diagnostic observation is explicitly NOT_ADMISSION_GRADE and is not promoted over the terminal governed stability result.

Independent coordinator audit

Coordinator review 4971140006: ACCEPT_WITH_EDITS, open material findings after repair 0.

Audit-only PR #575 independently closed the source validation gap without real credentials, login, client execution, GUI input or gameplay. It compiled all three final current-SHA helper files, synthetic-tested sealed-memfd/SCM_RIGHTS ingress, fenced the exact current public package, ran the source gate, and independently proved generated QMeta switch-table control flow.

Terminal targeted audit run:

32242788755 = SUCCESS
TGameClient                       table=0x1d903c4 methods=44 LEA=0xd1910a
TCharacterSelectionController     table=0x1d98fe4 methods=26 LEA=0xd51c90
TAuthenticationProcessController  table=0x1d8ff20 methods=51 LEA=0xd0f5ff
STRICT_ALL_NATIVE_LOGIN_QMETA_TABLES=PASS
REAL_SECRET_ACCESS=false
OFFICIAL_CLIENT_EXECUTED=false

Two earlier coordinator-audit failures were audit-method defects (temporary-client lifetime and an inapplicable relocation-backed class-discovery assumption) and did not identify source defects.

Clean promotion

Clean promotion #577 carried the independently audited durable evidence, v4 prompt and current-SHA helper source onto current main without credential-bearing workflows.

promotion head       31b252add74ac094067effd7bb3c0e4f888f09e4
changed paths        23
behind_by            0
CI                    32243674084 = SUCCESS
Track A governance    32243673952 = SUCCESS
native auth bridge    32243673903 = SUCCESS
promotion review      4971210315
review threads        0
promotion merge       db41e9112383fd5993cba04437bbbd8f6963e6e7

No duplicate credential-bearing E2E was performed for closeout. Secret values were not logged or committed.

[blakinio]

Coordinator independent post-implementation audit classification: ACCEPT_WITH_EDITS.

The source's final CI/governance/native-auth validation was green, but it did not compile or independently falsify all three newly added current-SHA helper files. A separate coordinator audit therefore revalidated the exact frozen source head without login, real credentials, client execution, GUI input or gameplay.

Independent results:

• both new C++ helpers compile; Python gate py-compiles;
• sealed-memfd + full seal set + SCM_RIGHTS ingress passes against a synthetic same-UID/PID Unix-socket server using synthetic credentials only;
• exact current public package fence 52109920 / ed5469... passes;
• source current_sha_native_login_gate.py passes all auth/character/game-server/in-game contracts;
• strict generated QMeta switch-table proof independently confirms:
  • TGameClient table 0x1d903c4, 44 methods, switch LEA 0xd1910a;
  • TCharacterSelectionController table 0x1d98fe4, 26 methods, switch LEA 0xd51c90;
  • TAuthenticationProcessController table 0x1d8ff20, 51 methods, switch LEA 0xd0f5ff;
• the exact source targets used by the gate therefore retain independent current-build control-flow support.

Audit run history is itself falsification evidence: the first audit generation failed because its own cleanup trap removed the temporary client before the gate step; the second proved the source gate/cold-auth/character bindings but used an inapplicable relocation-backed-class discovery assumption for TAuthenticationProcessController; the targeted table-xref discriminator corrected that audit assumption and passed. Neither failed audit generation identified a source defect.

Material source findings after the independent audit: 0. The only source compile diagnostic is one non-material unused helper warning in experimental_character_control_current.cpp.

Promotion must preserve the terminal distinction RESULT=SUCCESS_AT_PROOF_POINT versus CURRENTLY_LOGGED_IN=NO / POST_HANDOFF_SESSION_STABILITY=FAIL_NOT_RETAINED; it must not re-run credentials merely to reproduce the already-proven E2E event. Clean current-main promotion/archive is required because this long-lived source branch is stale in Git ancestry.