feat(#131): R7 — adopt-and-backfill the live in-cluster client instead of minting an orphan

[saadqbal]

Closes #131.

The proper fix for the orphaned-mint bug (the band-aid was tracebloc/client#303 / PR #305). On an existing-fleet box, a live client whose backend cluster_id is null (installed before the anchor shipped) was re-provisioned as a fresh mint — the kube-system UID matched nothing, so the backend minted a new client and stranded the live one.

Backend already ships the whole contract (backend#883/#893, merged to master ee247ee4): cluster_id get-or-create + PATCH /edge-device/{id}/ adopt-backfill. This is the CLI half:

• api — PatchClientClusterID → PATCH /edge-device/{id}/ {cluster_id}; 409/403 → typed APIError.
• cluster — DiscoverInClusterClient reads the live CLIENT_ID from the chart's <release>-secrets Secret (located by chart labels in the jobs-manager namespace; best-effort, time-bounded like ClusterID).
• client create — before minting: if a client is live here and the anchor is readable, confirm the signed-in account owns it (by UUID username), PATCH-backfill the anchor onto it, and adopt it — no mint. Not in the account → refuse (cross-account, R6). Ownership unverifiable (list failed) → fail closed, never mint over a live client.

Fresh machines and already-anchored re-runs are unchanged.

Follow-ups (separate):

• Retire the installer band-aid (client#303 / PR #305) once this ships.
• Gate release on confirming dev/prod run a backend build with #893 (prod deploy is manual).

Tests: PatchClientClusterID (200 + 409); DiscoverInClusterClientID (happy / no-release / release-without-secret, incl. ignoring the node-agents mirror); create-flow R7 (adopt-backfill, already-anchored, cross-account refuse).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes core client provisioning and identity binding; mistakes could mint duplicates or mishandle cross-account clusters, though the new path is fail-closed and covered by targeted tests.

Overview
Fixes orphaned mint on legacy fleets: when a tracebloc client is already running but the backend cluster_id is empty, tracebloc client create now adopts that client instead of POSTing a duplicate.

API adds authenticated PATCH (bodyRequest shared with POST) and PatchClientClusterID to stamp cluster_id on /edge-device/{id}/, with 409/403 as typed APIErrors.

Cluster adds DiscoverInClusterClient: find the jobs-manager namespace via chart labels, read CLIENT_ID from the release secrets (ignoring node-agents mirrors).

client create runs R7 before mint: discover live client, fail closed if a client is live but account list fails, refuse cross-account adopt, PATCH backfill when anchor is null, or adopt when already anchored; only then fall through to the existing mint/get-or-create path. Adopt output still uses TRACEBLOC_CLIENT_ADOPTED and no new password.

^{Reviewed by Cursor Bugbot for commit 73d6155. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 34 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#143 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · no reviewer assigned
• averaging-service#156 — feat(strategies): FedMedian Byzantine-robust aggregation (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#157 — feat(strategies): FedTrimmedAvg Byzantine-robust aggregation (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#158 — feat(strategies): Krum / MultiKrum Byzantine-robust selection (CLI: a mistyped subcommand (e.g. dataset pus) prints help and exits 0 instead of erroring #75) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#159 — feat(strategies): FedProx aggregation strategy (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#160 — feat(strategies): FedOpt family — FedAdam / FedYogi / FedAdagrad (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#161 — feat(strategies): resolve per-experiment aggregation hyperparameters (dataset push: --category help lists 5 of 9 categories, and unknown-vs-empty category errors give two different lists (one leaks unsupported segmentation) #74) · author: @shujaatTracebloc · no reviewer assigned
• backend#926 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · reviewer: @saadqbal
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)