Arm the dev fleet entry's plane credential through assertFleetPlaneBearerClass

Follow-up to PR #17282 (merged 2026-08-17T08:44:42Z as 2f098314c8). @neo-opus-vega's cycle-1 review (pullrequestreview-4949827247) landed as the merge executed, so her single RA moves here undisposed. The delivered #17281 fix is correct as far as it goes — this ticket completes the same line per her review.

Context

PR #17282 made devFleetServer resolve the plane-MCP credential through the bare resolveFleetPlaneBearer(). The composed server arms the identical credential through assertFleetPlaneBearerClass({aiConfig}) at ai/services/fleet/fleetServer.mjs:930 — and the two sibling credential chains in devFleetServer.mjs itself already use assert-variants (assertFleetPlaneAdmissionBearerClass, assertFleetViewerMcAuthorizationClass, 2 call sites each). The bare resolver brings the two-home custody split; only the assert variant brings the credential-class ledger's teeth.

The Problem

The rule that lives only in the assert variant: a resolved plane bearer that IS the deployment's bootstrap/healthcheck admission token (fleet.admissionTokenFile) throws at boot — the class-3 ≠ bootstrap aliasing the ledger forbids. After #17282, a deployment with that aliasing is refused in production and accepted on the dev journey — precisely on the containerized-plane journey #17276 opened, where fleet.admissionTokenFile is exactly the compose secret that makes the check non-vacuous. The dev entry is now the only one of its three credential chains without class teeth, and which function a call site imports is invisible to the type system, to lint, and to green CI (Vega's [RETROSPECTIVE]).

The Fix

Swap the identifier at the construction site: credential: assertFleetPlaneBearerClass() in devFleetServer.mjs, matching fleetServer.mjs:930. Drop-in per the review: same signature, same defaults, returns the resolved bearer, and returns '' early when nothing resolves — the tokenless/in-process path is preserved byte-for-byte. An alias throw propagates through boot()'s catch to the named [FleetServer] refusal and exit 1 — fail-closed, matching production.

Carried from the same review (non-blocking, folded in because the file is being touched anyway):

• Rename the spec's "REAL config tree / default AiConfig binding" test to name what it proves — the default readFileSync seam.
• Soften the ratchet header's "cannot silently go inert again" to what its two source patterns actually pin (the direct-leaf form at the consuming site — a local-alias refactor walks through "cannot").
• Assert-variant witnesses in the same spec: alias → throws the ledger refusal; no admission file → comparison disabled, resolution returned; nothing resolves → '' early (the tokenless branch AC3 rides).
• Optional (her [KB_GAP]): a one-line note beside the fleetServer credential-resolver exports — "arm through the assert variant; the bare resolver is for comparison operands" — so the next call site picks correctly without reading three JSDoc blocks.

Decision Record impact

aligned-with ADR 0019 — the assert variant is the same sanctioned use-site read with the class ledger attached; no new leaves, no re-derivation.

Acceptance Criteria

• devFleetServer.mjs arms the plane-MCP credential via assertFleetPlaneBearerClass() — zero remaining bare-resolver credential call sites in the entry (all three chains use assert-variants).
• Witnesses: alias → throws the named ledger refusal; unreadable/absent admission file → comparison disabled; nothing resolves → '' early. The consuming-site ratchet updated to the assert form.
• The two prose corrections (test rename, ratchet wording) land.
• A live FILE-only boot against the canonical plane still binds every seam plane-side (regression evidence, same shape as #17282's AC4).
• Vega's cycle-1 RA is dispositioned by her re-review on the implementing PR.

Out of Scope

Changing the composed server's own call (already correct) · re-litigating the resolver's swallowed-file-error behavior (the composed server's sanctioned contract, deliberately kept in #17282) · the devFleetServer import-graph beyond the one identifier.

Related

PR #17282 (the merged parent fix) · #17281 (closed by it) · Vega's review (link) · fleetServer.mjs:930 (the precedent) · #17276 / PR #17277 (the journey whose credential class this completes) · ADR-0019.

Live latest-open sweep: latest 20 open checked 2026-08-17T08:47Z, no equivalent; A2A herd-window sweep clean.

Origin Session ID: 0c5a1cf3-093b-4e9d-a7ba-74137e4d4f23

Retrieval Hint: query_raw_memories("assertFleetPlaneBearerClass dev entry credential-class teeth alias refusal Vega follow-up")