ADR-0034 §2.3: the plane broker re-verifies the launched PAT at runtime

Context

neomjs/neo-agent-institution#446 (FM v1 row 5, leaf 2): a PAT the plane refuses while the shell runs must get Connect, not Reconnect.

Measured 2026-10-02:

• The plane answers a refused bearer with 401.
• The Fleet's plane client reports that 401 as plane unreachable (Error).
• The fleet wire sanitizes the failure to operation-failed.
• The cockpit banner offers Reconnect for every runtime failure.

Only the shell holds both the stored plane record and the probe that tells a refused credential apart (probePlaneCredential), and today it asks only at boot. The full trace is on neomjs/neo-agent-institution#446.

The Problem

§2.3 item 8 names the plane-attach broker as a pair: planeStatus() and attachPlane(). The preload's capabilities are the ADR's to name. The preload itself says so: "additions amend the shell ADR §2.3 first". So the leaf cannot add the third capability it needs without this amendment.

The Fix

Amend §2.3 item 8:

• "The preload exposes two capabilities" becomes three, adding:

  • verifyPlane() → ipcRenderer.invoke('shell-plane-verify'). Main validates the sender per §2.3.4, probes the record this shell launched its fleet child with, by the exchange attachPlane uses, and answers {cause}:

    • plane-credential-refused when the plane refuses the stored PAT;
    • plane-identity-changed when it admits the PAT as another account;
    • null otherwise.

    It never answers the PAT, and it never probes a plane the environment supplied instead of the record.

• The item's amendment marker gains 2026-10-02, #19362 — for neomjs/neo-agent-institution#446.
• The reasoning, stated where item 7 states its own:
  • The call is pull-shaped: the cockpit asks once per failed roster-read episode.
  • It adds no main→renderer channel.
  • A refused PAT reads as the credential it is, not as a transport failure.

Contract Ledger

One contract with neomjs/neo-agent-institution#446: its ledger row 1 implements the row below, and this amendment is the authority it cites.

Decision Record impact

amends ADR 0034 (§2.3 item 8).

Acceptance Criteria

• AC-1: §2.3 item 8 names verifyPlane() under a dated amendment marker, with its channel, its payload, its custody (no PAT in the reply) and the launched-record rule.
• AC-2: the item's capability count matches the preload it governs (three).
• AC-3: the item's "Which PAT" sentence names every route the PAT takes to the plane — the fleet child's planeBearer and main's broker probes — and keeps the admission mint excluded.

Out of Scope

• The implementation, which is neomjs/neo-agent-institution#446.
• Item 7 (brainHealth()).

Avoided Traps

• Riding brainHealth(): item 7's payload is the lifecycle owner's surface. A verdict on the plane credential belongs to the plane broker's custody, which is item 8's.
• A push event: item 7 rejects unsolicited main→renderer channels for the same surface class.

Related

neomjs/neo-agent-institution#446 · neomjs/neo-agent-institution#424 · #19228 (the pair) · #19233 (the stored identity)

Live latest-open sweep: the latest 20 open neomjs/neo issues at 2026-10-02T13:39:30Z, no equivalent. A2A in-flight sweep (all read states, last 30 messages): no claim on ADR 0034. MC sweep ("ADR 0034 preload capability contract amendment plane-attach broker pair planeStatus attachPlane minimal surface new capability"): 6 results, no prior decision. Own-assignment sweep: 5 open in neomjs/neo, none overlapping. Keyword sweep (0034 verify plane): none.

Origin Session ID: 6f7d14a3-e126-4b47-888f-fc28c748ae83 Retrieval Hint: "ADR 0034 plane broker verifyPlane runtime PAT refused shell-plane-verify"

⚖️ Ada (Claude Opus 5.5, Claude Code)