docs(beta-delivery-ux): S4 kickoff §7b/§7c — close run-2 KICKOFF-AMBIGUOUS + host-verify contract

[artyhoo]

Closes the KICKOFF-AMBIGUOUS that S4 run 2's cold fidelity audit raised (PR #1300, FIDELITY: STOP), and adds the umbrella's first host-verify contract.

The gap. §7a has no channel connecting the key's storage to the process that must read it: #1 stores only the env-var NAME in the profile, #4(ii) writes the VALUE to ${XDG_CONFIG_HOME:-$HOME/.config}/getff/glm.env, and #3 requires the validation ping to run through the created profile. Verified against source rather than inferred from the audit's prose: aif resolves the key from its own runtime process.env by that name — packages/runtime/src/resolution.ts:217-219 (resolveApiKey(envVarName, env) → normalizeString(env[envVarName])) with :247 (input.env ?? process.env) — and that env is populated from the compose env-file, docker-compose.yml:15, :59, :94 (env_file: .env, all three services), both in the aif-handoff repo. So glm.env is a dead end as written, and #3 is unreachable unless something dereferences the value — which #1 and §2 constraint 1 forbid. The auditor's verdict was correct.

§7b — provenance stated, not blurred. §7a is the operator's resolution set; §7b is not. It was authored by the /dispatcher session and says so in its first line. It adds no new decision — it supplies the one step §7a omitted, and it is the only completion that leaves all three §7a clauses standing (options that keep the value confined to glm.env, or that ping the vendor directly, each require revoking one of the operator's own prior resolutions). It binds the outcome — value reachable in the aif runtime's process env under the §7a #1 name, verified before the ping, honest objective-3 MISS on failure per §2 constraint 4 — and leaves the wiring mechanism to the worker as a §7 technical fork, because deployments vary. The value still never enters the profile, never enters argv (run-2 watch-list W-2), and is never echoed. Falsifier recorded: if the live deployment reads its key by any channel other than process.env[<name>], §7b is wrong and the worker parks with the contradicting source quoted. The operator can override §7b; if they do, their call wins.

§7c — run-2 corrections that are settled by in-repo source, so they are carried as bindings, not re-parked: the invented PATCH $AIF_URL/project (scripts/getff-glm-onebutton.sh:135) is replaced by the authoritative PUT /projects/:id with a full createProjectSchema body (packages/runtime-bridge/src/cli/aifHttp.ts:96), read via GET /projects + filter since aif has no GET /projects/:id (aifHttp.ts:90); both halves of §7a #2 must be written (run 2 omitted defaultPlanRuntimeProfileId at :138); the ping routes through the profile, not $GLM_BASE_URL (:171, W-3); setup.d/10-skills.sh stays untouched (S5 is sole editor, W-5).

§4.1 — host-verify contract. All six kickoffs in this umbrella returned exit 2 («declares no contract») from scripts/host-verify.sh --list, and per destination-environment-verification.md §1 a missing contract is a FAIL, not a pass. S4 ships a shell helper + an install-time gate + a tests/install-sh/ suite — precisely the container≠host surface the rule exists for. The block declares bash tests/install-sh/glm-onebutton.test.sh; the note under it is explicit that this resolves only with the branch checked out on the host (which is when acceptance happens), not against bare staging.

Unblocks the S4 re-dispatch. A third dispatch is legitimate here because the scope changed — per dispatcher/SKILL.md §2.4 the 2-consecutive-REVISE cap counts unchanged scope, and run 1 REVISE + run 2 STOP had already reached «do not resume» on the kickoff as it stood.

Fidelity verdict

FIDELITY: skipped — dispatch-input kickoff revision (docs-only, no Provenance section); §7b/§7c carry in-repo source citations and §7b declares its own dispatcher authorship rather than presenting itself as an operator verdict